cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

Malwarebytes Anti-Malware
www.malwarebytes.org

Date de l'analyse: 30/10/2016
Heure de l'analyse: 17:52
Fichier journal: Rapport_malware.txt
Administrateur: Oui

Version: 2.2.1.1043
Base de données de programmes malveillants: v2016.10.30.08
Base de données de rootkits: v2016.09.26.02
Licence: Gratuit
Protection contre les programmes malveillants: Désactivé
Protection contre les sites Web malveillants: Désactivé
Autoprotection: Désactivé

Système d'exploitation: Windows 10
Processeur: x64
Système de fichiers: NTFS
Utilisateur: Laurence

Type d'analyse: Analyse des menaces
Résultat: Terminé
Objets analysés: 390166
Temps écoulé: 12 min, 15 s

Mémoire: Activé
Démarrage: Activé
Système de fichiers: Activé
Archives: Activé
Rootkits: Désactivé
Heuristique: Activé
PUP: Activé
PUM: Activé

Processus: 1
PUP.Optional.SafeGuard.ChrPRST, C:\Program Files (x86)\XBox\XBLive.exe, 3068, Supprimer au redémarrage, [67f92976faa0eb4b42802da4f90908f8]

Modules: 0
(Aucun élément malveillant détecté)

Clés du Registre: 23
PUP.Optional.GlobalUpdate, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}, En quarantaine, [b7a92c7348525cdaf25dcacc7191ff01],
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\LAYERS\VC32LDR , En quarantaine, [3d232e717426c86e859f8039cb38e11f],
PUP.Optional.SearchProtect.AppFlsh, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}, En quarantaine, [0d53bee17426d165628889547d869e62],
PUP.Optional.SearchProtect.AppFlsh, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{cf2797aa-b7ec-e311-8ed9-005056c00008}, En quarantaine, [64fcbee1dac0c1757e6db4299172a25e],
PUP.Optional.IFEO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\BROWSEMNGR.EXE, En quarantaine, [6bf5f3acc5d54bebaa40ced763a05ea2],
PUP.Optional.IFEO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CLTMNGSVC.EXE, En quarantaine, [a6ba39661d7da88e07eac2e3956ee61a],
PUP.Optional.IFEO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RJATYDIMOFU.EXE, En quarantaine, [7be52877673371c539e412948f7437c9],
PUP.Optional.StartPage, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WarThunder sat, En quarantaine, [1c444f503763cd6903ab9a3c2ad89d63],
PUP.Optional.StartPage, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WarThunder sun, En quarantaine, [de827d22e8b262d43975f1e5d9292fd1],
PUP.Optional.StartPage, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WarThunder05, En quarantaine, [0c54148b4852c571921c9442689a6d93],
PUP.Optional.StartPage, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WarThunder24, En quarantaine, [213f9d0223776accf9b5a82e7b87cc34],
PUP.Optional.Navegaki.PrxySvrRST, HKLM\SOFTWARE\RELTEK, En quarantaine, [4b15940bc7d3132328d559904eb5639d],
PUP.Optional.IFEO, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\BROWSEMNGR.EXE, En quarantaine, [b9a7633cdcbe38fec02a7332db2838c8],
PUP.Optional.IFEO, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CLTMNGSVC.EXE, En quarantaine, [71ef1f80d0ca59dd6091edb8f50e51af],
PUP.Optional.IFEO, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RJATYDIMOFU.EXE, En quarantaine, [f16fecb3b3e7ce688b926d39ed1649b7],
PUP.Optional.MultiPlug, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{478472F9-9E09-492A-BDAB-42EE595EF1AD}, En quarantaine, [d987425decae42f4e97c05d69b6710f0],
PUP.Optional.Navegaki.PrxySvrRST, HKLM\SOFTWARE\WOW6432NODE\RELTEK, En quarantaine, [fb653b6457434aecec1198519f642dd3],
PUP.Optional.SafeGuard.ChrPRST, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\XBOX, En quarantaine, [67f92976faa0eb4b42802da4f90908f8],
PUP.Optional.Shopperz.BrwsrFlsh, HKU\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\INTERNETREGISTRY\REGISTRY\USER\S-1-5-18\SOFTWARE\shopperz071020151013, En quarantaine, [253b465959412e0860e4459e30d3857b],
PUP.Optional.Shopperz.BrwsrFlsh, HKU\S-1-5-18\SOFTWARE\{827EAF42-00E9-4F9E-A5B7-659003D501A1}, En quarantaine, [dd8336690793aa8cad76abea699ab54b],
PUP.Optional.Gameo, HKU\S-1-5-21-3598442851-1422663116-1831931895-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY\AUDIO\POLICYCONFIG\PROPERTYSTORE\EA9A5B7C_0, En quarantaine, [352bffa0128865d169c3aa296b979868],
PUP.Optional.Shopperz.BrwsrFlsh, HKU\S-1-5-21-3598442851-1422663116-1831931895-1001\SOFTWARE\{827EAF42-00E9-4F9E-A5B7-659003D501A1}, En quarantaine, [00604b54f5a5cd691e05d0c5d033c13f],
PUP.Optional.VBates, HKU\S-1-5-21-3598442851-1422663116-1831931895-1001_Classes\SOFTWARE\{827EAF42-00E9-4F9E-A5B7-659003D501A1}, En quarantaine, [6000cdd2cbcfe74f17fbf6fa4bb8b34d],

Valeurs du Registre: 21
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\chrome.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130888064817406544, En quarantaine, [7de35c43bbdf55e1ba69dddc53b0b44c]
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\explorer.xxx|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130888064817406544, En quarantaine, [322e940bf8a2a59102217e3b3ac9cb35]
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\firefox.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130888064817406544, En quarantaine, [49174956930793a39d86bdfc00032fd1]
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\iexplore.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130888064817406544, En quarantaine, [2e32c1deaded191dd54e368351b218e8]
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\software_removal_tool.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130888064817406544, En quarantaine, [e67a6b34e6b4f24469ba9722e122768a]
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\software_reporter_tool.exe|{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130888064817406544, En quarantaine, [144c46596139d95d28fbc1f809fa59a7]
PUP.Optional.Trovi, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\CUSTOM\LAYERS\VC32Ldr |{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb, 130888064817406544, En quarantaine, [3d232e717426c86e859f8039cb38e11f]
PUP.Optional.IFEO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\BROWSEMNGR.EXE|debugger, tasklist.exe, En quarantaine, [6bf5f3acc5d54bebaa40ced763a05ea2]
PUP.Optional.IFEO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CLTMNGSVC.EXE|debugger, En quarantaine, [a6ba39661d7da88e07eac2e3956ee61a],
PUP.Optional.IFEO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RJATYDIMOFU.EXE|debugger, tasklist.exe, En quarantaine, [7be52877673371c539e412948f7437c9]
PUP.Optional.Navegaki.PrxySvrRST, HKLM\SOFTWARE\RELTEK|channel, egg3, En quarantaine, [4b15940bc7d3132328d559904eb5639d]
PUP.Optional.IFEO, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\BROWSEMNGR.EXE|debugger, tasklist.exe, En quarantaine, [b9a7633cdcbe38fec02a7332db2838c8]
PUP.Optional.IFEO, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CLTMNGSVC.EXE|debugger, En quarantaine, [71ef1f80d0ca59dd6091edb8f50e51af],
PUP.Optional.IFEO, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RJATYDIMOFU.EXE|debugger, tasklist.exe, En quarantaine, [f16fecb3b3e7ce688b926d39ed1649b7]
PUP.Optional.DeskTopPlay, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|dply_en_042010109, En quarantaine, [abb54956b3e749ed862af9c49f64e719],
PUP.Optional.Navegaki.PrxySvrRST, HKLM\SOFTWARE\WOW6432NODE\RELTEK|channel, egg3, En quarantaine, [fb653b6457434aecec1198519f642dd3]
PUP.Optional.SafeGuard.ChrPRST, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\XBOX|ImagePath, C:\Program Files (x86)\XBox\XBLive.exe, En quarantaine, [67f92976faa0eb4b42802da4f90908f8]
PUP.Optional.Shopperz.BrwsrFlsh, HKU\S-1-5-18\SOFTWARE\{827EAF42-00E9-4F9E-a5B7-659003D501A1}|Name, C:\Program Files\shopperz071020151013\Abeogfie.exe, En quarantaine, [dd8336690793aa8cad76abea699ab54b]
PUP.Optional.Gameo, HKU\S-1-5-21-3598442851-1422663116-1831931895-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY\AUDIO\POLICYCONFIG\PROPERTYSTORE\ea9a5b7c_0, {2}.\\?\hdaudio#func_01&ven_14f1&dev_506e&subsys_17aaa001&rev_1000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\rearlineouttopo/00010001|\Device\HarddiskVolume5\Users\Laurence\AppData\Roaming\Gameo\gameo.exe%b{00000000-0000-0000-0000-000000000000}, En quarantaine, [352bffa0128865d169c3aa296b979868]
PUP.Optional.Shopperz.BrwsrFlsh, HKU\S-1-5-21-3598442851-1422663116-1831931895-1001\SOFTWARE\{827EAF42-00E9-4F9E-a5B7-659003D501A1}|Name, C:\Program Files\shopperz071020151013\Abeogfie.exe, En quarantaine, [00604b54f5a5cd691e05d0c5d033c13f]
PUP.Optional.VBates, HKU\S-1-5-21-3598442851-1422663116-1831931895-1001_Classes\SOFTWARE\{827EAF42-00E9-4F9E-a5B7-659003D501A1}|Name, C:\Program Files\shopperz071020151013\Abeogfie.exe, En quarantaine, [6000cdd2cbcfe74f17fbf6fa4bb8b34d]

Données du Registre: 0
(Aucun élément malveillant détecté)

Dossiers: 4
PUP.Optional.VBates, C:\Users\Laurence\AppData\LocalLow\Company\Product\1.0, En quarantaine, [243c8c13c7d36cca53d9a321e81b1ee2],
PUP.Optional.VBates, C:\Users\Laurence\AppData\LocalLow\Company\Product, En quarantaine, [243c8c13c7d36cca53d9a321e81b1ee2],
PUP.Optional.XBLive.ChrPRST, C:\ProgramData\Microsoft\XBLive\Egg, En quarantaine, [c0a01c8323778aac4ccb35c230d3d030],
PUP.Optional.XBLive.ChrPRST, C:\ProgramData\Microsoft\XBLive, En quarantaine, [c0a01c8323778aac4ccb35c230d3d030],

Fichiers: 8
PUP.Optional.OpenCandy, C:\Users\Laurence\AppData\Roaming\uTorrent\updates\3.4.3_40097.exe, En quarantaine, [5709e9b613873105d8c50a5e36cc5fa1],
PUP.Optional.WinNetSvc, C:\Users\Laurence\AppData\Roaming\WMPNetworkAcSvc\WMPNetworkAcSvc.exe, En quarantaine, [6ef2c7d829715bdbe6a007a13cc8b54b],
PUP.Optional.WordShark, C:\Windows\System32\drivers\wsfd_vt_1_10_0_20.sys, En quarantaine, [e977fda28614231369deb876ca37f60a],
PUP.Optional.WordShark, C:\Windows\System32\drivers\wsfd_vw_1_10_0_20.sys, En quarantaine, [b1af940b643656e0f453b975768b27d9],
PUP.Optional.VBates, C:\Users\Laurence\AppData\LocalLow\Company\Product\1.0\localStorageIE.txt, En quarantaine, [243c8c13c7d36cca53d9a321e81b1ee2],
PUP.Optional.VBates, C:\Users\Laurence\AppData\LocalLow\Company\Product\1.0\localStorageIE_backup.txt, En quarantaine, [243c8c13c7d36cca53d9a321e81b1ee2],
PUP.Optional.XBLive.ChrPRST, C:\ProgramData\Microsoft\XBLive\Egg\{dx0bfo8z88a6483f8bd3d99958aa5f40160614}.config, En quarantaine, [c0a01c8323778aac4ccb35c230d3d030],
PUP.Optional.SafeGuard.ChrPRST, C:\Program Files (x86)\XBox\XBLive.exe, Supprimer au redémarrage, [67f92976faa0eb4b42802da4f90908f8],

Secteurs physiques: 0
(Aucun élément malveillant détecté)


(end)

Publicité


Signaler le contenu de ce document

Publicité