cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

ComboFix 16-01-31.01 - yves 02/02/2016 15:50:06.1.2 - x64
Microsoft Windows 7 Édition Familiale Premium 6.1.7601.1.1252.33.1036.18.4095.2368 [GMT 1:00]
Lancé depuis: c:\users\yves\Application Data\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Internet Explorer\minftnet.ini
c:\programdata\redaertaborca.pad
c:\users\yves\AppData\Roaming\Microsoft\Windows\Recent\B727 AF (2).url
c:\users\yves\AppData\Roaming\Microsoft\Windows\Recent\B727 AF (3).url
c:\users\yves\AppData\Roaming\Microsoft\Windows\Recent\B727 AF.url
c:\users\yves\AppData\Roaming\Microsoft\Windows\Recent\http--www.implantologiebasale.com-++++sinus lift.url
c:\users\yves\AppData\Roaming\Microsoft\Windows\Recent\Imagerie dento-maxillaire approche ... - Google Livres.url
c:\users\yves\googleupdatesetup.exe
c:\users\yves\GoToAssistDownloadHelper.exe
c:\users\yves\ZHPDiag3.exe
c:\windows\msdownld.tmp
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2016-01-02 au 2016-02-02 ))))))))))))))))))))))))))))))))))))
.
.
2016-02-02 15:02 . 2016-02-02 15:02 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2016-02-02 15:02 . 2016-02-02 15:02 -------- d-----w- c:\users\FMDK7412\AppData\Local\temp
2016-02-02 15:02 . 2016-02-02 15:02 -------- d-----w- c:\users\DefaultAppPool\AppData\Local\temp
2016-02-02 15:02 . 2016-02-02 15:02 -------- d-----w- c:\users\Default\AppData\Local\temp
2016-02-02 14:46 . 2016-01-25 13:08 211448 ----a-w- c:\windows\system32\drivers\asw2B35.tmp
2016-02-02 14:46 . 2016-01-25 13:12 155304 ----a-w- c:\windows\system32\drivers\asw2AC6.tmp
2016-02-02 14:46 . 2016-01-25 13:09 464256 ----a-w- c:\windows\system32\drivers\asw2799.tmp
2016-02-02 14:46 . 2016-01-25 13:08 273784 ----a-w- c:\windows\system32\drivers\asw27F8.tmp
2016-02-02 14:46 . 2016-01-25 13:09 97648 ----a-w- c:\windows\system32\drivers\asw26AD.tmp
2016-02-02 14:46 . 2016-01-25 13:08 65224 ----a-w- c:\windows\system32\drivers\asw271B.tmp
2016-02-02 14:46 . 2016-01-25 13:08 28656 ----a-w- c:\windows\system32\drivers\asw264F.tmp
2016-02-02 14:46 . 2016-01-25 13:12 93528 ----a-w- c:\windows\system32\drivers\asw2332.tmp
2016-02-02 14:46 . 2016-01-25 13:09 1065208 ----a-w- c:\windows\system32\drivers\asw21AA.tmp
2016-02-02 14:46 . 2016-01-25 13:08 64712 ----a-w- c:\windows\system32\drivers\asw22B4.tmp
2016-02-02 11:30 . 2016-02-02 11:30 -------- dc----w- c:\program files (x86)\ZHPFix
2016-02-02 08:20 . 2016-02-02 08:20 -------- dc----w- C:\avast! sandbox
2016-02-01 15:30 . 2016-02-01 15:39 -------- dc----w- c:\programdata\RogueKiller
2016-02-01 13:41 . 2016-02-01 14:30 192216 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2016-02-01 13:40 . 2016-02-01 13:40 -------- dc----w- c:\program files (x86)\anti loup
2016-02-01 13:40 . 2015-10-05 08:50 64216 ----a-w- c:\windows\system32\drivers\mwac.sys
2016-02-01 13:40 . 2015-10-05 08:50 109272 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2016-02-01 13:40 . 2015-10-05 08:50 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2016-01-31 11:30 . 2016-02-02 12:36 -------- d-----w- c:\users\yves\AppData\Roaming\ZHP
2016-01-31 09:41 . 2016-01-31 09:41 -------- dc----w- c:\program files\Speccy
2016-01-30 17:07 . 2016-01-30 17:07 -------- dc----w- c:\program files (x86)\Western Digital Corporation
2016-01-26 16:13 . 2016-01-26 16:13 -------- d-----w- c:\users\yves\AppData\Roaming\Ahead
2016-01-25 13:09 . 2016-01-25 13:09 -------- d-----w- c:\users\yves\AppData\Roaming\AVAST Software
2016-01-25 13:08 . 2016-01-25 13:08 43112 ----a-w- c:\windows\avastSS.scr
2016-01-25 13:05 . 2016-01-25 13:05 -------- dc----w- c:\program files\AVAST Software
2016-01-25 08:16 . 2016-01-25 08:16 -------- dc----w- C:\perflogs
2016-01-23 11:17 . 2016-01-23 11:17 -------- d-----w- c:\users\yves\AppData\Local\GWX
2016-01-22 18:52 . 2016-01-22 18:52 3886784 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2016-01-07 09:55 . 2016-01-07 09:55 -------- d-----w- C:\found.000
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2016-02-01 15:33 . 2015-12-13 17:44 24688 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2016-01-22 19:39 . 2014-09-12 12:55 796864 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2016-01-22 19:39 . 2014-09-12 12:55 142528 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-12-24 16:13 . 2015-12-24 16:14 97888 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-12-14 10:32 . 2015-12-14 10:32 41080 ----a-w- c:\windows\system32\drivers\hitmanpro37.sys
2015-11-25 14:01 . 2015-11-25 14:00 2509824 ----a-w- c:\windows\SysWow64\QtCore4.dll
2015-11-06 01:46 . 2010-01-08 11:17 143481208 ----a-w- c:\windows\system32\MRT.exe
2015-11-05 13:21 . 2015-11-05 13:21 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{B4859D09-DA3A-4938-B431-FDCA2405B706}\offreg.2616.dll
2015-11-04 18:39 . 2015-11-04 18:39 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{B4859D09-DA3A-4938-B431-FDCA2405B706}\offreg.3736.dll
2010-05-25 19:23 . 2010-05-25 19:23 2881456 -c--a-w- c:\program files (x86)\labeler.exe
2010-05-02 19:07 . 2010-05-02 19:07 2028912 -c--a-w- c:\program files (x86)\WLRCDLL.DLL
2009-05-18 22:03 . 2009-05-18 22:03 491590 -c--a-w- c:\program files (x86)\xls2dbf_d2007.dll
2004-12-21 21:04 . 2009-12-05 16:04 3180032 -c--a-w- c:\program files\BITZIPPER.EXE
2004-02-04 19:08 . 2004-02-04 19:08 184320 -c--a-w- c:\program files (x86)\WLTMPLMG.dll
2004-02-04 19:08 . 2004-02-04 19:08 163840 -c--a-w- c:\program files (x86)\WLTLCVRT.DLL
2004-02-04 19:08 . 2004-02-04 19:08 151552 -c--a-w- c:\program files (x86)\WLTLVCHK.DLL
2004-02-04 19:08 . 2004-02-04 19:08 180224 -c--a-w- c:\program files (x86)\wlftmrg.dll
2004-02-04 18:36 . 2004-02-04 18:36 163840 -c--a-w- c:\program files (x86)\WLBVCHK.DLL
2003-10-10 10:25 . 2003-10-10 10:25 212480 -c--a-w- c:\program files (x86)\PCDLIB32.DLL
2003-10-10 10:25 . 2003-10-10 10:25 437248 -c--a-w- c:\program files (x86)\ltkrn13n.dll
2003-10-10 10:25 . 2003-10-10 10:25 35328 -c--a-w- c:\program files (x86)\lttwn13n.dll
2003-10-10 10:25 . 2003-10-10 10:25 246272 -c--a-w- c:\program files (x86)\Lvkrn13n.dll
2003-10-10 10:25 . 2003-10-10 10:25 323072 -c--a-w- c:\program files (x86)\ltimg13n.dll
2003-10-10 10:25 . 2003-10-10 10:25 205312 -c--a-w- c:\program files (x86)\ltefx13n.dll
2003-10-10 10:25 . 2003-10-10 10:25 138240 -c--a-w- c:\program files (x86)\ltfil13n.DLL
2003-10-10 10:25 . 2003-10-10 10:25 974848 -c--a-w- c:\program files (x86)\LtDlgRes13n.dll
2003-10-10 10:25 . 2003-10-10 10:25 1368064 -c--a-w- c:\program files (x86)\ltdlg13n.dll
2003-10-10 10:25 . 2003-10-10 10:25 258560 -c--a-w- c:\program files (x86)\LTDIS13n.dll
2003-10-10 10:24 . 2003-10-10 10:24 1685504 -c--a-w- c:\program files (x86)\LTCLR13n.dll
2003-10-10 10:24 . 2003-10-10 10:24 20480 -c--a-w- c:\program files (x86)\lfwpg13n.dll
2003-10-10 10:24 . 2003-10-10 10:24 40448 -c--a-w- c:\program files (x86)\Lfwmf13n.dll
2003-10-10 10:24 . 2003-10-10 10:24 23552 -c--a-w- c:\program files (x86)\lftga13n.dll
2003-10-10 10:24 . 2003-10-10 10:24 148480 -c--a-w- c:\program files (x86)\Lfpng13n.dll
2003-10-10 10:24 . 2003-10-10 10:24 131072 -c--a-w- c:\program files (x86)\lftif13n.dll
2003-10-10 10:24 . 2003-10-10 10:24 73216 -c--a-w- c:\program files (x86)\lffax13n.dll
2003-10-10 10:24 . 2003-10-10 10:24 37888 -c--a-w- c:\program files (x86)\lfeps13n.dll
2003-10-10 10:24 . 2003-10-10 10:24 31744 -c--a-w- c:\program files (x86)\lflmb13n.dll
2003-10-10 10:24 . 2003-10-10 10:24 26112 -c--a-w- c:\program files (x86)\lfpcx13n.dll
2003-10-10 10:24 . 2003-10-10 10:24 20992 -c--a-w- c:\program files (x86)\lfimg13n.dll
2003-10-10 10:24 . 2003-10-10 10:24 19968 -c--a-w- c:\program files (x86)\lfpcd13n.dll
2003-10-10 10:24 . 2003-10-10 10:24 351744 -c--a-w- c:\program files (x86)\LFCMP13n.DLL
2003-10-10 10:24 . 2003-10-10 10:24 30208 -c--a-w- c:\program files (x86)\lfbmp13n.dll
.
[code]

c:\program files (x86)\Programme\MAJ_Estimateur de cout .exe
[/code]
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCleaner Monitoring"="c:\program files (x86)\CCleaner\CCleaner64.exe" [2016-01-15 8619224]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
@=""
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-disabled]
"SearchSettings"=c:\program files (x86)\pdfforge Toolbar\SearchSettings.exe
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - NVSTREAMKMS
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2016-01-29 02:06 1090376 -c--a-w- c:\program files (x86)\Google\Chrome\Application\48.0.2564.97\Installer\chrmstp.exe
.
Contenu du dossier 'Tâches planifiées'
.
2016-01-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-12 19:39]
.
2014-02-05 c:\windows\Tasks\Defraggler Volume C Task.job
- c:\program files\Defraggler\df64.exe [2013-10-14 15:05]
.
2016-02-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-01-03 06:06]
.
2016-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-01-03 06:06]
.
2015-07-17 c:\windows\Tasks\PCDRScheduledMaintenance-Delay.job
- c:\program files\PC-Doctor for Windows\pcdr5cuiw32.exe [2009-06-10 11:04]
.
2015-07-17 c:\windows\Tasks\PCDRScheduledMaintenance.job
- c:\program files\PC-Doctor for Windows\pcdr5cuiw32.exe [2009-06-10 11:04]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\000_OMHOverlayError]
@="{6985F9D3-5A54-4C41-BABF-812F79A2B673}"
[HKEY_CLASSES_ROOT\CLSID\{6985F9D3-5A54-4C41-BABF-812F79A2B673}]
2015-04-10 15:33 848896 ----a-w- c:\users\yves\AppData\Local\Le Cloud Orange\overlay\x64\OMHOverlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\001_OMHOverlayProg]
@="{809D24D6-A067-4C51-BF0F-0A60CA722182}"
[HKEY_CLASSES_ROOT\CLSID\{809D24D6-A067-4C51-BF0F-0A60CA722182}]
2015-04-10 15:33 848896 ----a-w- c:\users\yves\AppData\Local\Le Cloud Orange\overlay\x64\OMHOverlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\002_OMHOverlayIcon]
@="{0D077A21-3DB2-4955-A3AB-D623C9270D9C}"
[HKEY_CLASSES_ROOT\CLSID\{0D077A21-3DB2-4955-A3AB-D623C9270D9C}]
2015-04-10 15:33 848896 ----a-w- c:\users\yves\AppData\Local\Le Cloud Orange\overlay\x64\OMHOverlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\003_OMHOverlayExcl]
@="{37FC1C76-E238-4779-B2AC-68DCEA8253C5}"
[HKEY_CLASSES_ROOT\CLSID\{37FC1C76-E238-4779-B2AC-68DCEA8253C5}]
2015-04-10 15:33 848896 ----a-w- c:\users\yves\AppData\Local\Le Cloud Orange\overlay\x64\OMHOverlay.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"NCPluginUpdater"="c:\program files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" [2014-01-28 21720]
.
------- Examen supplémentaire -------
.
uStart Page = www.google.com
uLocal Page = c:\windows\system32\blank.htm
uSearchMigratedDefaultURL = hxxp://www.google.com
mStart Page = https://www.google.com/?trackid=sp-006
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
mSearch Bar = https://www.google.com/?trackid=sp-006
uInternet Settings,ProxyOverride = *.local
IE: Accéder au portail Orange - c:\users\yves\AppData\Roaming\Orange\OrangeInside\src\orange_html\orange.html
IE: Envoyer par SMS Orange le texte sélectionné - c:\users\yves\AppData\Roaming\Orange\OrangeInside\src\sendsmsselectedtext_html\sendsmsselectedtext.html
IE: Rechercher le texte sélectionné - c:\users\yves\AppData\Roaming\Orange\OrangeInside\src\selectedsearch_html\selectedsearch.html
TCP: Interfaces\{48009D41-315E-4153-941E-4B7F3232C489}: NameServer = 8.8.8.8,8.8.4.4
DPF: {5A779DC0-837B-4590-AC42-C7C0847478C5} - hxxp://logicielsgratuits.orange.fr/download_service/Install/OrangeInstaller.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab
FF - ProfilePath - c:\users\yves\AppData\Roaming\Mozilla\Firefox\Profiles\ddkbb1vb.default-1452159135086\
FF - prefs.js: browser.search.selectedEngine - Yahoo!
FF - prefs.js: browser.startup.homepage - hxxps://www.google.fr/?gws_rd=ssl
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Toolbar-10 - (no file)
Toolbar-10 - (no file)
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
ShellIconOverlayIdentifiers-{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} - (no file)
AddRemove-{79C54A05-F146-4EA0-8A70-D4EFE6181E52} - c:\program files (x86)\InstallShield Installation Information\{79C54A05-F146-4EA0-8A70-D4EFE6181E52}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\EsgScanner]
"ImagePath"="system32\DRIVERS\EsgScanner.sys"
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\AppDataLow\Software\Avanquest_FR]
@DACL=(02 0000)
@SACL=(02 0001)
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\AppDataLow\Software\Avanquest_FR\toolbar]
@DACL=(02 0000)
@SACL=(02 0001)
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\dll-files.com]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\dll-files.com\Fixer]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\FWT_DLM]
@DACL=(02 0000)
"audacity203_inst [1].exe"="1373193551472,http://audacity.download-server.net/bin/audacity-win-2.0.3.exe"
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1DAF86FF-C112-43AE-8B62-B1A6C7C3D9D}]
@DACL=(02 0000)
"AppName"="dadefa9f-f4c0-4347-9744-6a37726b5bdc-2.exe-buttonutil64.exe"
"AppPath"="c:\\Program Files (x86)\\Free Video Grabber 6.6"
"Policy"=dword:00000003
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{392FF6C7-E7AC-407F-8E30-D2141F82DB}]
@DACL=(02 0000)
"AppName"="dadefa9f-f4c0-4347-9744-6a37726b5bdc-2.exe-codedownloader.exe"
"AppPath"="c:\\Program Files (x86)\\Free Video Grabber 6.6"
"Policy"=dword:00000003
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3AED76BF-9A9B-449A-AE5-834F83D33BCB}]
@DACL=(02 0000)
"AppName"="9393823c-ffd0-426a-bc28-8bc11683ed61-2.exe-codedownloader.exe"
"AppPath"="c:\\Program Files (x86)\\CinemaDPV1"
"Policy"=dword:00000003
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{77D33510-93BA-426E-94C1-FCE2FA96E7BD}]
@DACL=(02 0000)
"AppName"="dadefa9f-f4c0-4347-9744-6a37726b5bdc-2.exe-buttonutil64.exe"
"AppPath"="c:\\Program Files (x86)\\Free Video Grabber 6.6"
"Policy"=dword:00000003
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{90B905D4-8FB8-44BC-8D2C-FAA42C5FBDFA}]
@DACL=(02 0000)
"AppName"="9393823c-ffd0-426a-bc28-8bc11683ed61-2.exe-buttonutil64.exe"
"AppPath"="c:\\Program Files (x86)\\CinemaDPV1"
"Policy"=dword:00000003
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A31049CB-DC74-47C1-A5C2-F277E283FF62}]
@DACL=(02 0000)
"AppName"="dadefa9f-f4c0-4347-9744-6a37726b5bdc-2.exe-helper.exe"
"AppPath"="c:\\Program Files (x86)\\Free Video Grabber 6.6"
"Policy"=dword:00000003
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C6565F37-655B-4c9e-AA5F-0307AC976ED4}]
@DACL=(02 0000)
"AppName"="RewardsArcadeSuite.exe"
"AppPath"="c:\\Program Files (x86)\\RewardsArcadeSuite"
"Policy"=dword:00000003
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C894E6B0-E36C-4AF9-8666-3643C82C3BD2}]
@DACL=(02 0000)
"AppName"="9393823c-ffd0-426a-bc28-8bc11683ed61-2.exe-helper.exe"
"AppPath"="c:\\Program Files (x86)\\CinemaDPV1"
"Policy"=dword:00000003
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F345FAF4-1EC6-4E29-BDCC-522B6181454D}]
@DACL=(02 0000)
"AppName"="dadefa9f-f4c0-4347-9744-6a37726b5bdc-2.exe-helper.exe"
"AppPath"="c:\\Program Files (x86)\\Free Video Grabber 6.6"
"Policy"=dword:00000003
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\Audacity Packages]
@DACL=(02 0000)
"DisplayIcon"="c:\\Users\\yves\\AppData\\Roaming\\0F0W0T1V0D0L0M\\Audacity Packages\\uninstaller.exe"
"UninstallString"="c:\\Users\\yves\\AppData\\Roaming\\0F0W0T1V0D0L0M\\Audacity Packages\\uninstaller.exe /Uninstall /NM=\"Audacity Packages\" /AN=\"0F0W0T1V0D0L0M\" /MBN=\"Audacity Packages\""
"DisplayName"="Audacity Packages"
"UninstallerPath"="c:\\Users\\yves\\AppData\\Roaming\\0F0W0T1V0D0L0M\\Audacity Packages"
"UninstallerPathParent"="c:\\Users\\yves\\AppData\\Roaming\\0F0W0T1V0D0L0M"
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\Flash Video Player Packages]
@DACL=(02 0000)
"DisplayIcon"="c:\\Users\\yves\\AppData\\Roaming\\0V1L2Z2Z1T1I1L1T\\Flash Video Player Packages\\uninstaller.exe"
"UninstallString"="c:\\Users\\yves\\AppData\\Roaming\\0V1L2Z2Z1T1I1L1T\\Flash Video Player Packages\\uninstaller.exe /Uninstall /NM=\"Flash Video Player Packages\" /AN=\"0V1L2Z2Z1T1I1L1T\" /MBN=\"Flash Video Player Packages\""
"DisplayName"="Flash Video Player Packages"
"UninstallerPath"="c:\\Users\\yves\\AppData\\Roaming\\0V1L2Z2Z1T1I1L1T\\Flash Video Player Packages"
"UninstallerPathParent"="c:\\Users\\yves\\AppData\\Roaming\\0V1L2Z2Z1T1I1L1T"
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Money Essentials 2008 17.0 Packages]
@DACL=(02 0000)
"DisplayIcon"="c:\\Users\\yves\\AppData\\Roaming\\0V1L2Z2Z1T1I1L1T\\Microsoft Money Essentials 2008 17.0 Packages\\uninstaller.exe"
"UninstallString"="c:\\Users\\yves\\AppData\\Roaming\\0V1L2Z2Z1T1I1L1T\\Microsoft Money Essentials 2008 17.0 Packages\\uninstaller.exe /Uninstall /NM=\"Microsoft Money Essentials 2008 17.0 Packages\" /AN=\"0V1L2Z2Z1T1I1L1T\" /MBN=\"Microsoft Money Essentials 2008 17.0 Packages\""
"DisplayName"="Microsoft Money Essentials 2008 17.0 Packages"
"UninstallerPath"="c:\\Users\\yves\\AppData\\Roaming\\0V1L2Z2Z1T1I1L1T\\Microsoft Money Essentials 2008 17.0 Packages"
"UninstallerPathParent"="c:\\Users\\yves\\AppData\\Roaming\\0V1L2Z2Z1T1I1L1T"
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\tsfgbihn]
@DACL=(02 0000)
"DisplayName"="Lollipop"
"UninstallString"="c:\\users\\yves\\appdata\\local\\lollipop\\lollipop.bat"
"NoRemove"=dword:00000000
"NoModify"=dword:00000001
"NoRepair"=dword:00000001
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\ParetoLogic]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\ParetoLogic\PC Health Advisor]
@DACL=(02 0000)
"DUPLICATE_SCAN_RADIO"=dword:00000001
"XPos"=dword:00000000
"YPos"=dword:00000000
"Width"=dword:00000320
"Height"=dword:00000244
"INSTALLDATE"="19:49 27-01-2016"
"INSTALLDATELOCAL"="20:49 27-01-2016"
"RunCount"=dword:00000002
"FROMSCHEDULE"=dword:00000000
"OUTDATED_COUNT"=dword:00000179
"MALWARE_COUNT"=dword:00000000
"LastScanTime"=hex:45,20,a9,56,00,00,00,00
"HealthRating"=dword:00000000
"SCANCOUNT"=dword:00000001
"BUTTON"=dword:00000006
"MinimizeOnExit"=dword:00000000
"CACHEDMD5"=""
"CacheMalwareFlush"=hex:8c,3c,a9,56,00,00,00,00
"CacheCompleteFlush"=hex:8c,3c,a9,56,00,00,00,00
"DUPLICATE_FOLDER"=""
"DUPLICATE_SCAN_FOLDERS"=dword:00000001
"DUPLICATE_SCAN_IMAGE"=dword:00000001
"DUPLICATE_SCAN_AUDIO"=dword:00000001
"DUPLICATE_SCAN_VIDEO"=dword:00000001
"DUPLICATE_SCAN_DOCS"=dword:00000001
"LaunchOnStartup"=dword:00000000
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000\Software\ParetoLogic\UUS3]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000_Classes\.oga]
@DACL=(02 0000)
@="HiDefMedia.oga"
"HiDefMedia.backup"="FirefoxHTML"
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000_Classes\.ogg]
@DACL=(02 0000)
"HiDefMedia.backup"="NeroShowTime.Files9.ogg"
@="HiDefMedia.ogg"
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000_Classes\.ogv]
@DACL=(02 0000)
@="HiDefMedia.ogv"
"HiDefMedia.backup"="FirefoxHTML"
.
[HKEY_USERS\S-1-5-21-2670434365-1904120166-4130494484-1000_Classes\.webm]
@DACL=(02 0000)
@="HiDefMedia.webm"
"HiDefMedia.backup"="FirefoxHTML"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_20_0_0_286_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_20_0_0_286_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_20_0_0_286_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_20_0_0_286_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_20_0_0_286.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.20"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_20_0_0_286.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_20_0_0_286.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_20_0_0_286.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing]
@DACL=(02 0000)
"EnableConsoleTracing"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\DotNetCheck_RASMANCS]
@DACL=(02 0000)
"EnableFileTracing"=dword:00000000
"EnableConsoleTracing"=dword:00000000
"FileTracingMask"=dword:ffff0000
"ConsoleTracingMask"=dword:ffff0000
"MaxFileSize"=dword:00100000
"FileDirectory"=expand:"%windir%\\tracing"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\firefox_RASAPI32]
@DACL=(02 0000)
"EnableFileTracing"=dword:00000000
"EnableConsoleTracing"=dword:00000000
"FileTracingMask"=dword:ffff0000
"ConsoleTracingMask"=dword:ffff0000
"MaxFileSize"=dword:00100000
"FileDirectory"=expand:"%windir%\\tracing"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\firefox_RASDLG]
@DACL=(02 0000)
"EnableFileTracing"=dword:00000000
"EnableConsoleTracing"=dword:00000000
"FileTracingMask"=dword:ffff0000
"ConsoleTracingMask"=dword:ffff0000
"MaxFileSize"=dword:00100000
"FileDirectory"=expand:"%windir%\\tracing"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\firefox_RASMANCS]
@DACL=(02 0000)
"EnableFileTracing"=dword:00000000
"EnableConsoleTracing"=dword:00000000
"FileTracingMask"=dword:ffff0000
"ConsoleTracingMask"=dword:ffff0000
"MaxFileSize"=dword:00100000
"FileDirectory"=expand:"%windir%\\tracing"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\EsgScanner]
@DACL=(02 0000)
"Type"=dword:00000002
"Start"=dword:00000003
"ErrorControl"=dword:00000001
"Tag"=dword:00000006
"ImagePath"=expand:"system32\\DRIVERS\\EsgScanner.sys"
"DisplayName"="EsgScanner"
"Group"="FSFilter Activity Monitor"
"DependOnService"=multi:"FltMgr\00\00"
"Description"="Enigma Scan filter"
.
Heure de fin: 2016-02-02 16:06:35
ComboFix-quarantined-files.txt 2016-02-02 15:06
.
Avant-CF: 148 470 353 920 octets libres
Après-CF: 148 387 860 480 octets libres
.
- - End Of File - - E906E79D4EE68218D6300E318BD200BE
10B4D1168EA18B65A7B7773AAA4A561E

Publicité


Signaler le contenu de ce document

Publicité