Malwarebytes
www.malwarebytes.com

-Détails du journal-
Date de l'analyse: 02/07/2017
Heure de l'analyse: 16:01
Fichier journal: malwarebytes.txt
Administrateur: Oui

-Informations du logiciel-
Version: 3.1.2.1733
Version de composants: 1.0.141
Version de pack de mise à jour: 1.0.2276
Licence: Gratuit

-Informations système-
Système d'exploitation: Windows 10
Processeur: x64
Système de fichiers: NTFS
Utilisateur: BENJAMIN\benja_000

-Résumé de l'analyse-
Type d'analyse: Analyse des menaces
Résultat: Terminé
Objets analysés: 474990
Menaces détectées: 83
Menaces mises en quarantaine: 82
Temps écoulé: 9 min, 35 s

-Options d'analyse-
Mémoire: Activé
Démarrage: Activé
Système de fichiers: Activé
Archives: Activé
Rootkits: Désactivé
Heuristique: Activé
PUP: Activé
PUM: Activé

-Détails de l'analyse-
Processus: 4
Trojan.BitCoinMiner, C:\PROGRAMDATA\WINDOWSSQL\COM SURROGATE.EXE, En quarantaine, [98], [411217],1.0.2276
RiskWare.BitCoinMiner, C:\PROGRAMDATA\DIRECTX11B\SYSTEM.EXE, En quarantaine, [112], [410558],1.0.2276
RiskWare.Agent.E, C:\ProgramData\WindowsSQL\System.exe, En quarantaine, [1071], [409613],1.0.2276
RiskWare.BitCoinMiner, C:\PROGRAMDATA\FRAMEWORK\SYSTEM.EXE, En quarantaine, [112], [410560],1.0.2276

Module: 4
Trojan.BitCoinMiner, C:\PROGRAMDATA\WINDOWSSQL\COM SURROGATE.EXE, En quarantaine, [98], [411217],1.0.2276
RiskWare.BitCoinMiner, C:\PROGRAMDATA\DIRECTX11B\SYSTEM.EXE, En quarantaine, [112], [410558],1.0.2276
RiskWare.Agent.E, C:\ProgramData\WindowsSQL\System.exe, En quarantaine, [1071], [409613],1.0.2276
RiskWare.BitCoinMiner, C:\PROGRAMDATA\FRAMEWORK\SYSTEM.EXE, En quarantaine, [112], [410560],1.0.2276

Clé du registre: 16
RiskWare.BitCoinMiner, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\DirectX11b, En quarantaine, [112], [410558],1.0.2276
PUP.Optional.Sense, HKU\S-1-5-18\SOFTWARE\Sense-nv, En quarantaine, [1595], [242913],1.0.2276
PUP.Optional.Yontoo, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\Update Edu App, En quarantaine, [53], [254083],1.0.2276
PUP.Optional.Yontoo, HKLM\SOFTWARE\POLICIES\GOOGLE\CHROME, En quarantaine, [53], [-1],0.0.0
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\CHROME, En quarantaine, [53], [-1],0.0.0
Hijack.AutoConfigURL.PrxySvrRST, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\NLASVC\PARAMETERS\INTERNET\MANUALPROXIES, En quarantaine, [287], [-1],0.0.0
RiskWare.Agent.E, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Framework, En quarantaine, [1071], [409613],1.0.2276
PUP.Optional.AmiUpdater, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\amiupdaterExd, En quarantaine, [14631], [235414],1.0.2276
PUP.Optional.AmiUpdater, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\amiupdaterExi, En quarantaine, [14631], [235414],1.0.2276
PUP.Optional.Gameo, HKU\S-1-5-21-947915296-3583002873-1704246444-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY\AUDIO\POLICYCONFIG\PROPERTYSTORE\53a6c179_0, En quarantaine, [7087], [185308],1.0.2276
PUP.Optional.MultiPlug, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{1146AC44-2F03-4431-B4FD-889BC837521F}{23cb3056}, En quarantaine, [279], [240969],1.0.2276
RiskWare.BitCoinMiner, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\MinerGate, En quarantaine, [112], [410560],1.0.2276
PUP.Optional.CrossRider, HKU\S-1-5-21-947915296-3583002873-1704246444-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{0e785c76-51ce-4438-9819-0798879a988f}, En quarantaine, [249], [237486],1.0.2276
PUP.Optional.CrossRider, HKU\S-1-5-21-947915296-3583002873-1704246444-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{3e50ccab-cb1c-42f2-90d8-c4531f1338e8}, En quarantaine, [249], [237488],1.0.2276
PUP.Optional.CrossRider, HKU\S-1-5-21-947915296-3583002873-1704246444-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{b4a78158-1c31-4b1c-a82f-dd5d39b7e720}, En quarantaine, [249], [237487],1.0.2276
PUP.Optional.CrossRider, HKU\S-1-5-21-947915296-3583002873-1704246444-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{FC80D2AD-5E19-4473-A6A5-69FAA23AFA29}, En quarantaine, [249], [237487],1.0.2276

Valeur du registre: 14
Hijack.AutoConfigURL.PrxySvrRST, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IPHLPSVC\PARAMETERS\PROXYMGR\{0A565B7D-877E-4FA8-9088-A910058FF13E}|AUTOCONFIGURL, En quarantaine, [287], [320554],1.0.2276
Hijack.AutoConfigURL.PrxySvrRST, HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, En quarantaine, [287], [-1],0.0.0
Hijack.AutoConfigURL.PrxySvrRST, HKU\S-1-5-21-947915296-3583002873-1704246444-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, En quarantaine, [287], [-1],0.0.0
Hijack.AutoConfigURL.PrxySvrRST, HKU\S-1-5-21-947915296-3583002873-1704246444-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, En quarantaine, [287], [-1],0.0.0
Hijack.AutoConfigURL.PrxySvrRST, HKU\S-1-5-21-947915296-3583002873-1704246444-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYOVERRIDE, En quarantaine, [287], [-1],0.0.0
Hijack.AutoConfigURL.PrxySvrRST, HKU\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, En quarantaine, [287], [-1],0.0.0
Hijack.AutoConfigURL.PrxySvrRST, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IPHLPSVC\PARAMETERS\PROXYMGR\{1BF6D047-734F-4E30-918F-09378ED832AF}|AUTOCONFIGURL, En quarantaine, [287], [320554],1.0.2276
Hijack.AutoConfigURL.PrxySvrRST, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IPHLPSVC\PARAMETERS\PROXYMGR\{C3A3F0EC-85D1-47B8-B61A-39EE8D9FA0D0}|AUTOCONFIGURL, En quarantaine, [287], [320554],1.0.2276
PUP.Optional.Gameo, HKU\S-1-5-21-947915296-3583002873-1704246444-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY\AUDIO\POLICYCONFIG\PROPERTYSTORE\53a6c179_0|, En quarantaine, [7087], [185308],1.0.2276
PUP.Optional.CrossRider.Generic, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|SENSE-BG.EXE, En quarantaine, [1022], [260099],1.0.2276
PUP.Optional.CrossRider, HKU\S-1-5-21-947915296-3583002873-1704246444-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{0e785c76-51ce-4438-9819-0798879a988f}|APPNAME, En quarantaine, [249], [237486],1.0.2276
PUP.Optional.CrossRider, HKU\S-1-5-21-947915296-3583002873-1704246444-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{3e50ccab-cb1c-42f2-90d8-c4531f1338e8}|APPNAME, En quarantaine, [249], [237488],1.0.2276
PUP.Optional.CrossRider, HKU\S-1-5-21-947915296-3583002873-1704246444-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{b4a78158-1c31-4b1c-a82f-dd5d39b7e720}|APPNAME, En quarantaine, [249], [237487],1.0.2276
PUP.Optional.CrossRider, HKU\S-1-5-21-947915296-3583002873-1704246444-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{FC80D2AD-5E19-4473-A6A5-69FAA23AFA29}|APPNAME, En quarantaine, [249], [237487],1.0.2276

Données du registre: 0
(Aucun élément malveillant détecté)

Flux de données: 0
(Aucun élément malveillant détecté)

Dossier: 3
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\HowToRemove, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\USERS\BENJA_000\APPDATA\LOCAL\{7A894CD5-5E21-206D-33B9-058517D1F91D}, En quarantaine, [91], [302717],1.0.2276
RiskWare.Agent.E, C:\PROGRAMDATA\WINDOWSSQL, En quarantaine, [1071], [409613],1.0.2276

Fichier: 42
Trojan.BitCoinMiner, C:\PROGRAMDATA\WINDOWSSQL\COM SURROGATE.EXE, En quarantaine, [98], [411217],1.0.2276
Trojan.MultiDropper, C:\PROGRAMDATA\DIRECTX11B\DIRECTX11B.EXE, En quarantaine, [218], [411201],1.0.2276
RiskWare.BitCoinMiner, C:\PROGRAMDATA\WINDOWSSQL\WINDOWS DRIVER SERVICE.EXE, En quarantaine, [112], [411031],1.0.2276
Trojan.BitCoinMiner, C:\PROGRAMDATA\WINDOWSSQL\MDNS2.EXE, En quarantaine, [98], [411251],1.0.2276
PUP.Optional.BrowseFox, C:\USERS\BENJA_000\APPDATA\ROAMING\ZHP\QUARANTINE, En quarantaine, [1800], [299543],1.0.2276
PUP.Optional.InstallCore, C:\PROGRAM FILES (X86)\AGEIA TECHNOLOGIES\3C4972FD-5601-41ED-89C4-BC6E3C36014E.DLL, En quarantaine, [3], [301067],1.0.2276
PUP.Optional.InstallCore, C:\PROGRAM FILES (X86)\ASUS\920FB8FB-0003-49F3-8541-FFF21BB54879.DLL, En quarantaine, [3], [301068],1.0.2276
PUP.Optional.InstallCore, C:\PROGRAM FILES (X86)\AGEIA TECHNOLOGIES\0EE6ADA1-AFF9-47F1-AD76-EB8A5B90022D.DLL, En quarantaine, [3], [301067],1.0.2276
PUP.Optional.InstallCore, C:\PROGRAM FILES (X86)\ASUS\5C0545C4-AFEE-4CC4-9C6B-012F3CEBF2EA.DLL, En quarantaine, [3], [301068],1.0.2276
PUP.Optional.InstallCore, C:\USERS\BENJA_000\DOWNLOADS\CYBERGHOST_6.0.5.2405.EXE, En quarantaine, [3], [395467],1.0.2276
PUP.Optional.InstallCore, C:\USERS\BENJA_000\DOWNLOADS\CYBERGHOST_6.0.5.2405 (1).EXE, En quarantaine, [3], [395467],1.0.2276
Spyware.PasswordStealer, C:\USERS\BENJA_000\DOWNLOADS\PEAN'S PUBLIC MULTIHACK V1.4.3_MPGH.NET.ZIP, En quarantaine, [306], [154400],1.0.2276
PUP.Optional.InstallCore, C:\USERS\BENJA_000\DOWNLOADS\RIGHT CLICK TO NECROMANCE-1.0.EXE, En quarantaine, [3], [300948],1.0.2276
PUP.Optional.WinYahoo, C:\USERS\BENJA_000\APPDATA\LOCAL\{7A894CD5-5E21-206D-33B9-058517D1F91D}\HOWTOREMOVE\HOWTOREMOVE.HTML, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\HowToRemove\chromium-min.jpg, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\HowToRemove\control panel-min-min.JPG, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\HowToRemove\down.png, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\HowToRemove\ff menu.JPG, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\HowToRemove\ff search engine-min.png, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\HowToRemove\hp-min ff.png, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\HowToRemove\hp-min ie.png, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\HowToRemove\search engine.gif, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\HowToRemove\setup pages.gif, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\HowToRemove\sp-min.png, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\HowToRemove\start-min.jpg, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\HowToRemove\up.png, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\bapi_ff.dat, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\bapi_ie.dat, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\deta.exe, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\install.log, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\nina, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\rola, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\Sqlite3.dll, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\tete, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\uninst.dat, En quarantaine, [91], [302717],1.0.2276
PUP.Optional.WinYahoo, C:\Users\benja_000\AppData\Local\{7A894CD5-5E21-206D-33B9-058517D1F91D}\uninst.exe, En quarantaine, [91], [302717],1.0.2276
RiskWare.BitCoinMiner, C:\PROGRAMDATA\DIRECTX11B\SYSTEM.EXE, En quarantaine, [112], [410558],1.0.2276
PUP.Optional.Yontoo, C:\PROGRAMDATA\NTUSER.POL, Échec de la suppression, [53], [-1],0.0.0
PUP.Optional.Yontoo, C:\WINDOWS\SYSTEM32\GROUPPOLICY\MACHINE\REGISTRY.POL, En quarantaine, [53], [-1],0.0.0
RiskWare.Agent.E, C:\ProgramData\WindowsSQL\mDNS1.exe, En quarantaine, [1071], [409613],1.0.2276
RiskWare.Agent.E, C:\ProgramData\WindowsSQL\System.exe, En quarantaine, [1071], [409613],1.0.2276
RiskWare.BitCoinMiner, C:\PROGRAMDATA\FRAMEWORK\SYSTEM.EXE, En quarantaine, [112], [410560],1.0.2276

Secteur physique: 0
(Aucun élément malveillant détecté)


(end)