Publicité
Publicité
Format du document : text/plain
Prévisualisation
ComboFix 17-08-04.01 - MOA 21/08/2017 21:04:44.2.4 - x64
Microsoft Windows 7 Édition Familiale Premium 6.1.7601.1.1252.33.1036.18.4005.1803 [GMT 2:00]
Lancé depuis: c:\users\MOA\Desktop\ComboFix.exe
AV: Malwarebytes *Disabled/Updated* {23007AD3-69FE-687C-2629-D584AFFAF72B}
SP: Malwarebytes *Disabled/Updated* {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Exécution préalable -------
.
c:\users\MOA\Documents\~WRL1789.tmp
c:\users\MOA\Documents\~WRL3809.tmp
c:\windows\msvcr71.dll
c:\windows\SysWow64\DEBUG.log
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2017-07-21 au 2017-08-21 ))))))))))))))))))))))))))))))))))))
.
.
2017-08-21 19:17 . 2017-08-21 19:17 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2017-08-21 19:17 . 2017-08-21 19:17 -------- d-----w- c:\users\Default\AppData\Local\temp
2017-08-20 16:38 . 2017-08-20 16:38 -------- d-----w- C:\$AV_ASW
2017-08-18 14:49 . 2017-08-18 17:01 -------- d-----w- C:\FRST
2017-08-11 00:31 . 2017-08-11 00:31 803328 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2017-08-11 00:31 . 2017-08-11 00:31 144896 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2017-08-09 11:18 . 2017-08-19 22:28 -------- d-----w- c:\users\MOA\AppData\Roaming\IDM
2017-08-09 06:57 . 2017-07-07 15:29 690688 ----a-w- c:\windows\system32\adtschema.dll
2017-08-09 06:57 . 2017-07-07 15:10 690688 ----a-w- c:\windows\SysWow64\adtschema.dll
2017-08-09 06:57 . 2017-07-14 07:15 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2017-08-09 06:57 . 2017-07-07 15:29 146432 ----a-w- c:\windows\system32\msaudite.dll
2017-08-09 06:57 . 2017-07-07 15:10 146432 ----a-w- c:\windows\SysWow64\msaudite.dll
2017-08-09 06:57 . 2017-07-07 15:10 60416 ----a-w- c:\windows\SysWow64\msobjs.dll
2017-08-09 06:57 . 2017-07-07 15:29 60416 ----a-w- c:\windows\system32\msobjs.dll
2017-08-09 06:57 . 2017-07-21 14:26 282624 ----a-w- c:\windows\SysWow64\mstext40.dll
2017-08-09 06:57 . 2017-07-21 14:26 409600 ----a-w- c:\windows\SysWow64\msexch40.dll
2017-08-08 10:47 . 2017-08-08 10:47 -------- d-----w- c:\users\MOA\AppData\Local\ElevatedDiagnostics
2017-08-05 16:31 . 2017-08-05 16:26 225568 ----a-w- c:\windows\system32\drivers\idmwfp.sys
2017-07-29 11:28 . 2017-07-29 11:28 54728 ----a-w- c:\program files (x86)\Mozilla Firefox\pingsender.exe
2017-07-28 13:30 . 2017-08-20 13:48 101784 ----a-w- c:\windows\system32\drivers\farflt.sys
2017-07-28 13:29 . 2017-07-28 13:33 77376 ----a-w- c:\windows\system32\drivers\mbae64.sys
2017-07-28 13:29 . 2017-07-28 13:29 -------- d-----w- c:\program files\Malwarebytes
2017-07-28 05:38 . 2017-08-21 18:35 253856 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2017-07-28 05:38 . 2017-07-28 13:33 188352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2017-07-28 05:38 . 2017-08-21 18:35 45472 ----a-w- c:\windows\system32\drivers\mbam.sys
2017-07-28 05:38 . 2017-08-20 13:53 84256 ----a-w- c:\windows\system32\drivers\mwac.sys
2017-07-28 05:38 . 2017-07-28 05:38 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2017-08-09 09:01 . 2017-04-21 15:54 140394280 -c--a-w- c:\windows\system32\MRT.exe
2017-07-24 19:00 . 2017-06-07 20:40 506368 ----a-w- c:\windows\system32\drivers\RapportKE64.sys
2017-07-24 19:00 . 2017-06-07 20:40 252320 ----a-w- c:\windows\system32\drivers\RapportHades64.sys
2017-07-24 13:41 . 2015-03-21 14:12 146696 ----a-w- c:\windows\system32\drivers\asw87df28ff1def473a.tmp
2017-07-18 14:52 . 2017-02-07 14:08 57728 ----a-w- c:\windows\system32\drivers\aswdda16e2a8c827fa1.tmp
2017-07-18 14:52 . 2017-02-07 14:08 343288 ----a-w- c:\windows\system32\drivers\asw9b317ee47c5f5d34.tmp
2017-07-18 14:52 . 2017-02-07 14:08 320008 ----a-w- c:\windows\system32\drivers\asw3a494d8621e2843c.tmp
2017-07-18 14:52 . 2017-02-07 14:08 198976 ----a-w- c:\windows\system32\drivers\asw3925f9b5953bf73c.tmp
2017-07-07 15:10 . 2017-08-09 06:58 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2017-07-06 04:56 . 2017-07-12 07:10 119296 ----a-w- c:\windows\system32\drivers\bthpan.sys
2017-06-30 20:49 . 2015-03-21 14:13 361336 ----a-w- c:\windows\system32\drivers\aswa4f4ea4a6a71dc3b.tmp
2017-06-26 19:09 . 2015-03-21 14:13 198768 ----a-w- c:\windows\system32\drivers\asw7ff3c363e077043b.tmp
2017-06-26 19:09 . 2015-03-21 14:13 84392 ----a-w- c:\windows\system32\drivers\asw72e26f85701450c5.tmp
2017-06-26 19:09 . 2015-03-21 14:13 585608 ----a-w- c:\windows\system32\drivers\asw9c4b4f6cfcd56989.tmp
2017-06-26 19:09 . 2015-03-21 14:12 46984 ----a-w- c:\windows\system32\drivers\asw4cdb299b9dfa4342.tmp
2017-06-26 19:09 . 2015-03-21 14:12 110352 ----a-w- c:\windows\system32\drivers\asw1eb9e0652d5feb69.tmp
2017-06-26 19:08 . 2015-03-21 14:12 1015848 ----a-w- c:\windows\system32\drivers\aswff128d9e9fa747da.tmp
2017-06-26 19:07 . 2016-04-09 22:35 554528 ----a-w- c:\windows\system32\drivers\asw66e4cda61a6af73a.tmp
2017-06-15 20:23 . 2017-07-12 07:10 753664 ----a-w- c:\windows\system32\drivers\http.sys
2017-06-12 22:49 . 2017-07-12 07:10 594432 ----a-w- c:\windows\system32\wvc.dll
2017-06-12 22:49 . 2017-07-12 07:10 1363456 ----a-w- c:\windows\system32\wdc.dll
2017-06-12 22:49 . 2017-07-12 07:10 475136 ----a-w- c:\windows\system32\sysmon.ocx
2017-06-12 22:49 . 2017-07-12 07:10 58880 ----a-w- c:\windows\system32\pdhui.dll
2017-06-12 22:29 . 2017-07-12 07:10 444928 ----a-w- c:\windows\SysWow64\wvc.dll
2017-06-12 22:29 . 2017-07-12 07:10 1227264 ----a-w- c:\windows\SysWow64\wdc.dll
2017-06-12 22:29 . 2017-07-12 07:10 390144 ----a-w- c:\windows\SysWow64\sysmon.ocx
2017-06-12 22:28 . 2017-07-12 07:10 47104 ----a-w- c:\windows\SysWow64\pdhui.dll
2017-06-12 22:14 . 2017-07-12 07:10 379392 ----a-w- c:\windows\system32\msinfo32.exe
2017-06-12 22:14 . 2017-07-12 07:10 172544 ----a-w- c:\windows\system32\perfmon.exe
2017-06-12 22:14 . 2017-07-12 07:10 103936 ----a-w- c:\windows\system32\resmon.exe
2017-06-12 22:06 . 2017-07-12 07:10 157184 ----a-w- c:\windows\SysWow64\perfmon.exe
2017-06-12 22:06 . 2017-07-12 07:10 303616 ----a-w- c:\windows\SysWow64\msinfo32.exe
2017-06-12 22:06 . 2017-07-12 07:10 103424 ----a-w- c:\windows\SysWow64\resmon.exe
2017-06-10 15:59 . 2017-07-12 07:10 313856 ----a-w- c:\windows\system32\Wldap32.dll
2017-06-10 15:39 . 2017-07-12 07:10 271360 ----a-w- c:\windows\SysWow64\Wldap32.dll
2017-06-09 15:33 . 2017-07-12 07:10 1680616 ----a-w- c:\windows\system32\drivers\ntfs.sys
2017-06-06 15:30 . 2017-07-12 07:10 1867264 ----a-w- c:\windows\system32\ExplorerFrame.dll
2017-06-06 15:12 . 2017-07-12 07:10 1499648 ----a-w- c:\windows\SysWow64\ExplorerFrame.dll
2017-06-02 08:10 . 2017-06-14 14:55 733696 ----a-w- c:\windows\HelpPane.exe
2017-05-30 04:56 . 2017-07-12 07:10 1895656 ----a-w- c:\windows\system32\drivers\tcpip.sys
2017-05-30 04:56 . 2017-07-12 07:10 377576 ----a-w- c:\windows\system32\drivers\netio.sys
2017-05-30 04:56 . 2017-07-12 07:10 287976 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2016-01-24 18:05 . 2016-03-03 22:35 5386056 ----a-w- c:\program files\cdbxp_setup_4.5.6.5931_minimal.exe
2015-12-28 21:09 . 2016-03-03 22:35 6741048 ----a-w- c:\program files\idman625build9f.exe
2015-12-27 21:37 . 2016-03-03 22:35 436504 ----a-w- c:\program files\RapportSetup.exe
2015-12-27 19:47 . 2016-03-03 22:35 75714480 ----a-w- c:\program files\KiesSetup.exe
2008-09-13 10:53 . 2008-09-13 10:53 7296000 ----a-w- c:\program files (x86)\PocketDivXEncoder_0.4.4.exe
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Mobile Partner"="c:\program files (x86)\Parametres SFR 3G\Parametres SFR 3G" [X]
"KiesPreload"="c:\program files (x86)\Samsung\Kies\Kies.exe" [2015-07-27 1566016]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2017-04-10 9532120]
"EPLTarget\P0000000000000000"="c:\windows\system32\spool\DRIVERS\x64\3\E_YATIRFE.EXE" [2014-11-14 417776]
"ISUSPM"="c:\programdata\FLEXnet\Connect\11\ISUSPM.exe" [2009-05-05 222496]
"IDMan"="c:\program files (x86)\Internet Download Manager\IDMan.exe" [2017-08-05 4027504]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-13 283160]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2011-07-21 5716608]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2015-07-27 311616]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 aswTap;avast! SecureLine TAP Adapter v3;c:\windows\system32\DRIVERS\aswTap.sys;c:\windows\SYSNATIVE\DRIVERS\aswTap.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys;c:\windows\SYSNATIVE\DRIVERS\ew_hwusbdev.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys;c:\windows\SYSNATIVE\DRIVERS\ew_usbenumfilter.sys [x]
R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jucdcacm.sys [x]
R3 huawei_cdcecm;huawei_cdcecm;c:\windows\system32\DRIVERS\ew_jucdcecm.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jucdcecm.sys [x]
R3 huawei_ext_ctrl;huawei_ext_ctrl;c:\windows\system32\DRIVERS\ew_juextctrl.sys;c:\windows\SYSNATIVE\DRIVERS\ew_juextctrl.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
R3 MBAMProtection;MBAMProtection;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 MBAMService;Malwarebytes Service;c:\program files\Malwarebytes\Anti-Malware\mbamservice.exe;c:\program files\Malwarebytes\Anti-Malware\mbamservice.exe [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUVStor.sys [x]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys;c:\windows\SYSNATIVE\DRIVERS\SiSG664.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WSDScan;Prise en charge de la numérisation WSD via UMB;c:\windows\system32\DRIVERS\WSDScan.sys;c:\windows\SYSNATIVE\DRIVERS\WSDScan.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S0 RapportHades64;RapportHades64;c:\windows\System32\Drivers\RapportHades64.sys;c:\windows\SYSNATIVE\Drivers\RapportHades64.sys [x]
S0 RapportKE64;RapportKE64;c:\windows\System32\Drivers\RapportKE64.sys;c:\windows\SYSNATIVE\Drivers\RapportKE64.sys [x]
S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [x]
S1 nvkflt;nvkflt;c:\windows\system32\DRIVERS\nvkflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvkflt.sys [x]
S1 RapportAegle64;RapportAegle64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportAegle64.sys;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportAegle64.sys [x]
S1 RapportCerberus_1804068;RapportCerberus_1804068;c:\programdata\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_1804068.sys;c:\programdata\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_1804068.sys [x]
S1 RapportEI64;RapportEI64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [x]
S1 RapportPG64;RapportPG64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [x]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe;c:\windows\SYSNATIVE\FBAgent.exe [x]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 EPSON_PM_RPCV4_06;EPSON V3 Service4(06);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S60RPB.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S60RPB.EXE [x]
S2 EpsonScanSvc;Epson Scanner Service;c:\windows\system32\EscSvc64.exe;c:\windows\SYSNATIVE\EscSvc64.exe [x]
S2 HWDeviceService64.exe;HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys;c:\windows\SYSNATIVE\DRIVERS\idmwfp.sys [x]
S2 RapportMgmtService;Rapport Management Service;c:\program files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe;c:\program files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [x]
S2 ss_conn_service;SAMSUNG Mobile Connectivity Service;c:\program files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe;c:\program files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 AiCharger;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiCharger.sys;c:\windows\SYSNATIVE\DRIVERS\AiCharger.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jubusenum.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr QWAVE wcncsvc
.
Contenu du dossier 'Tâches planifiées'
.
2017-08-21 c:\windows\Tasks\EPSON XP-243 245 247 Series Update {029954AE-9BC4-41CE-89FB-B75570391B92}.job
- c:\windows\system32\spool\DRIVERS\x64\3\E_YTSRFE.EXE [2017-06-05 23:30]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2011-05-25 07:09 227840 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2011-05-25 07:09 227840 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-05-11 2213992]
"IntelTBRunOnce"="wscript.exe" [2013-10-12 168960]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Examen supplémentaire -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://google.fr/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xporter vers Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Télécharger avec IDM - c:\program files (x86)\Internet Download Manager\IEExt.htm
IE: Télécharger tous les liens avec IDM - c:\program files (x86)\Internet Download Manager\IEGetAll.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\MOA\AppData\Roaming\Mozilla\Firefox\Profiles\8ho6fuj7.default-1426972149348\
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Toolbar-Locked - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM_Wow6432Node-ActiveSetup-{8A69D345-D564-463c-AFF1-A69D9E530F96} - c:\program files (x86)\Google\Chrome\Application\58.0.3029.110\Installer\chrmstp.exe
Toolbar-Locked - (no file)
{CDC95B92-E27C-4745-A8C5-64A52A78855D}"-IDM Shell Extension - ShellIconOverlayIdentifiers
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe
AddRemove-ASUS_Screensaver - c:\windows\system32\ASUS_Screensaver.scr
.
.
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-1763895367-2035602292-2249291644-1001_Classes\Wow6432Node\CLSID\{2b426d94-ba15-4690-9f97-8162cf67642b}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:00000048
"Therad"=dword:00000014
"MData"=hex(0):39,cf,3a,42,28,e6,df,2c,b0,d0,2d,40,fc,0c,7f,fd,4d,07,38,27,48,
16,9c,79,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
.
[HKEY_USERS\S-1-5-21-1763895367-2035602292-2249291644-1001_Classes\Wow6432Node\CLSID\{3a55cb78-580e-4ae7-8d6b-a4dc47d5fd98}]
@Denied: (Full) (Everyone)
"Model"=dword:000000dc
"Therad"=dword:00000014
.
[HKEY_USERS\S-1-5-21-1763895367-2035602292-2249291644-1001_Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):2b,f3,b2,54,a2,62,79,42,30,d6,27,f3,d1,2d,7f,2a,2c,50,38,d0,f0,
ce,8c,db,a7,5a,3b,48,fd,0e,78,9c,00,d0,fd,94,b2,c5,e0,7d,00,00,00,00,00,00,\
.
[HKEY_USERS\S-1-5-21-1763895367-2035602292-2249291644-1001_Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):90,61,c5,84,63,63,10,84,fd,c8,59,6d,c4,90,d6,48,40,85,2c,41,f8,
7d,8e,9f,e3,3f,27,d5,bb,f2,6c,94,4f,f0,91,eb,c2,d2,c9,e3,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_25_0_0_171_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_25_0_0_171_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Heure de fin: 2017-08-21 21:22:38
ComboFix-quarantined-files.txt 2017-08-21 19:22
.
Avant-CF: 235 932 528 640 octets libres
Après-CF: 235 237 740 544 octets libres
.
- - End Of File - - 76C157F8355E92C5FE009D77C6274FB6
Microsoft Windows 7 Édition Familiale Premium 6.1.7601.1.1252.33.1036.18.4005.1803 [GMT 2:00]
Lancé depuis: c:\users\MOA\Desktop\ComboFix.exe
AV: Malwarebytes *Disabled/Updated* {23007AD3-69FE-687C-2629-D584AFFAF72B}
SP: Malwarebytes *Disabled/Updated* {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Exécution préalable -------
.
c:\users\MOA\Documents\~WRL1789.tmp
c:\users\MOA\Documents\~WRL3809.tmp
c:\windows\msvcr71.dll
c:\windows\SysWow64\DEBUG.log
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2017-07-21 au 2017-08-21 ))))))))))))))))))))))))))))))))))))
.
.
2017-08-21 19:17 . 2017-08-21 19:17 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2017-08-21 19:17 . 2017-08-21 19:17 -------- d-----w- c:\users\Default\AppData\Local\temp
2017-08-20 16:38 . 2017-08-20 16:38 -------- d-----w- C:\$AV_ASW
2017-08-18 14:49 . 2017-08-18 17:01 -------- d-----w- C:\FRST
2017-08-11 00:31 . 2017-08-11 00:31 803328 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2017-08-11 00:31 . 2017-08-11 00:31 144896 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2017-08-09 11:18 . 2017-08-19 22:28 -------- d-----w- c:\users\MOA\AppData\Roaming\IDM
2017-08-09 06:57 . 2017-07-07 15:29 690688 ----a-w- c:\windows\system32\adtschema.dll
2017-08-09 06:57 . 2017-07-07 15:10 690688 ----a-w- c:\windows\SysWow64\adtschema.dll
2017-08-09 06:57 . 2017-07-14 07:15 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2017-08-09 06:57 . 2017-07-07 15:29 146432 ----a-w- c:\windows\system32\msaudite.dll
2017-08-09 06:57 . 2017-07-07 15:10 146432 ----a-w- c:\windows\SysWow64\msaudite.dll
2017-08-09 06:57 . 2017-07-07 15:10 60416 ----a-w- c:\windows\SysWow64\msobjs.dll
2017-08-09 06:57 . 2017-07-07 15:29 60416 ----a-w- c:\windows\system32\msobjs.dll
2017-08-09 06:57 . 2017-07-21 14:26 282624 ----a-w- c:\windows\SysWow64\mstext40.dll
2017-08-09 06:57 . 2017-07-21 14:26 409600 ----a-w- c:\windows\SysWow64\msexch40.dll
2017-08-08 10:47 . 2017-08-08 10:47 -------- d-----w- c:\users\MOA\AppData\Local\ElevatedDiagnostics
2017-08-05 16:31 . 2017-08-05 16:26 225568 ----a-w- c:\windows\system32\drivers\idmwfp.sys
2017-07-29 11:28 . 2017-07-29 11:28 54728 ----a-w- c:\program files (x86)\Mozilla Firefox\pingsender.exe
2017-07-28 13:30 . 2017-08-20 13:48 101784 ----a-w- c:\windows\system32\drivers\farflt.sys
2017-07-28 13:29 . 2017-07-28 13:33 77376 ----a-w- c:\windows\system32\drivers\mbae64.sys
2017-07-28 13:29 . 2017-07-28 13:29 -------- d-----w- c:\program files\Malwarebytes
2017-07-28 05:38 . 2017-08-21 18:35 253856 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2017-07-28 05:38 . 2017-07-28 13:33 188352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2017-07-28 05:38 . 2017-08-21 18:35 45472 ----a-w- c:\windows\system32\drivers\mbam.sys
2017-07-28 05:38 . 2017-08-20 13:53 84256 ----a-w- c:\windows\system32\drivers\mwac.sys
2017-07-28 05:38 . 2017-07-28 05:38 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2017-08-09 09:01 . 2017-04-21 15:54 140394280 -c--a-w- c:\windows\system32\MRT.exe
2017-07-24 19:00 . 2017-06-07 20:40 506368 ----a-w- c:\windows\system32\drivers\RapportKE64.sys
2017-07-24 19:00 . 2017-06-07 20:40 252320 ----a-w- c:\windows\system32\drivers\RapportHades64.sys
2017-07-24 13:41 . 2015-03-21 14:12 146696 ----a-w- c:\windows\system32\drivers\asw87df28ff1def473a.tmp
2017-07-18 14:52 . 2017-02-07 14:08 57728 ----a-w- c:\windows\system32\drivers\aswdda16e2a8c827fa1.tmp
2017-07-18 14:52 . 2017-02-07 14:08 343288 ----a-w- c:\windows\system32\drivers\asw9b317ee47c5f5d34.tmp
2017-07-18 14:52 . 2017-02-07 14:08 320008 ----a-w- c:\windows\system32\drivers\asw3a494d8621e2843c.tmp
2017-07-18 14:52 . 2017-02-07 14:08 198976 ----a-w- c:\windows\system32\drivers\asw3925f9b5953bf73c.tmp
2017-07-07 15:10 . 2017-08-09 06:58 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2017-07-06 04:56 . 2017-07-12 07:10 119296 ----a-w- c:\windows\system32\drivers\bthpan.sys
2017-06-30 20:49 . 2015-03-21 14:13 361336 ----a-w- c:\windows\system32\drivers\aswa4f4ea4a6a71dc3b.tmp
2017-06-26 19:09 . 2015-03-21 14:13 198768 ----a-w- c:\windows\system32\drivers\asw7ff3c363e077043b.tmp
2017-06-26 19:09 . 2015-03-21 14:13 84392 ----a-w- c:\windows\system32\drivers\asw72e26f85701450c5.tmp
2017-06-26 19:09 . 2015-03-21 14:13 585608 ----a-w- c:\windows\system32\drivers\asw9c4b4f6cfcd56989.tmp
2017-06-26 19:09 . 2015-03-21 14:12 46984 ----a-w- c:\windows\system32\drivers\asw4cdb299b9dfa4342.tmp
2017-06-26 19:09 . 2015-03-21 14:12 110352 ----a-w- c:\windows\system32\drivers\asw1eb9e0652d5feb69.tmp
2017-06-26 19:08 . 2015-03-21 14:12 1015848 ----a-w- c:\windows\system32\drivers\aswff128d9e9fa747da.tmp
2017-06-26 19:07 . 2016-04-09 22:35 554528 ----a-w- c:\windows\system32\drivers\asw66e4cda61a6af73a.tmp
2017-06-15 20:23 . 2017-07-12 07:10 753664 ----a-w- c:\windows\system32\drivers\http.sys
2017-06-12 22:49 . 2017-07-12 07:10 594432 ----a-w- c:\windows\system32\wvc.dll
2017-06-12 22:49 . 2017-07-12 07:10 1363456 ----a-w- c:\windows\system32\wdc.dll
2017-06-12 22:49 . 2017-07-12 07:10 475136 ----a-w- c:\windows\system32\sysmon.ocx
2017-06-12 22:49 . 2017-07-12 07:10 58880 ----a-w- c:\windows\system32\pdhui.dll
2017-06-12 22:29 . 2017-07-12 07:10 444928 ----a-w- c:\windows\SysWow64\wvc.dll
2017-06-12 22:29 . 2017-07-12 07:10 1227264 ----a-w- c:\windows\SysWow64\wdc.dll
2017-06-12 22:29 . 2017-07-12 07:10 390144 ----a-w- c:\windows\SysWow64\sysmon.ocx
2017-06-12 22:28 . 2017-07-12 07:10 47104 ----a-w- c:\windows\SysWow64\pdhui.dll
2017-06-12 22:14 . 2017-07-12 07:10 379392 ----a-w- c:\windows\system32\msinfo32.exe
2017-06-12 22:14 . 2017-07-12 07:10 172544 ----a-w- c:\windows\system32\perfmon.exe
2017-06-12 22:14 . 2017-07-12 07:10 103936 ----a-w- c:\windows\system32\resmon.exe
2017-06-12 22:06 . 2017-07-12 07:10 157184 ----a-w- c:\windows\SysWow64\perfmon.exe
2017-06-12 22:06 . 2017-07-12 07:10 303616 ----a-w- c:\windows\SysWow64\msinfo32.exe
2017-06-12 22:06 . 2017-07-12 07:10 103424 ----a-w- c:\windows\SysWow64\resmon.exe
2017-06-10 15:59 . 2017-07-12 07:10 313856 ----a-w- c:\windows\system32\Wldap32.dll
2017-06-10 15:39 . 2017-07-12 07:10 271360 ----a-w- c:\windows\SysWow64\Wldap32.dll
2017-06-09 15:33 . 2017-07-12 07:10 1680616 ----a-w- c:\windows\system32\drivers\ntfs.sys
2017-06-06 15:30 . 2017-07-12 07:10 1867264 ----a-w- c:\windows\system32\ExplorerFrame.dll
2017-06-06 15:12 . 2017-07-12 07:10 1499648 ----a-w- c:\windows\SysWow64\ExplorerFrame.dll
2017-06-02 08:10 . 2017-06-14 14:55 733696 ----a-w- c:\windows\HelpPane.exe
2017-05-30 04:56 . 2017-07-12 07:10 1895656 ----a-w- c:\windows\system32\drivers\tcpip.sys
2017-05-30 04:56 . 2017-07-12 07:10 377576 ----a-w- c:\windows\system32\drivers\netio.sys
2017-05-30 04:56 . 2017-07-12 07:10 287976 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2016-01-24 18:05 . 2016-03-03 22:35 5386056 ----a-w- c:\program files\cdbxp_setup_4.5.6.5931_minimal.exe
2015-12-28 21:09 . 2016-03-03 22:35 6741048 ----a-w- c:\program files\idman625build9f.exe
2015-12-27 21:37 . 2016-03-03 22:35 436504 ----a-w- c:\program files\RapportSetup.exe
2015-12-27 19:47 . 2016-03-03 22:35 75714480 ----a-w- c:\program files\KiesSetup.exe
2008-09-13 10:53 . 2008-09-13 10:53 7296000 ----a-w- c:\program files (x86)\PocketDivXEncoder_0.4.4.exe
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Mobile Partner"="c:\program files (x86)\Parametres SFR 3G\Parametres SFR 3G" [X]
"KiesPreload"="c:\program files (x86)\Samsung\Kies\Kies.exe" [2015-07-27 1566016]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2017-04-10 9532120]
"EPLTarget\P0000000000000000"="c:\windows\system32\spool\DRIVERS\x64\3\E_YATIRFE.EXE" [2014-11-14 417776]
"ISUSPM"="c:\programdata\FLEXnet\Connect\11\ISUSPM.exe" [2009-05-05 222496]
"IDMan"="c:\program files (x86)\Internet Download Manager\IDMan.exe" [2017-08-05 4027504]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-13 283160]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2011-07-21 5716608]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2015-07-27 311616]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 aswTap;avast! SecureLine TAP Adapter v3;c:\windows\system32\DRIVERS\aswTap.sys;c:\windows\SYSNATIVE\DRIVERS\aswTap.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys;c:\windows\SYSNATIVE\DRIVERS\ew_hwusbdev.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys;c:\windows\SYSNATIVE\DRIVERS\ew_usbenumfilter.sys [x]
R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jucdcacm.sys [x]
R3 huawei_cdcecm;huawei_cdcecm;c:\windows\system32\DRIVERS\ew_jucdcecm.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jucdcecm.sys [x]
R3 huawei_ext_ctrl;huawei_ext_ctrl;c:\windows\system32\DRIVERS\ew_juextctrl.sys;c:\windows\SYSNATIVE\DRIVERS\ew_juextctrl.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
R3 MBAMProtection;MBAMProtection;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 MBAMService;Malwarebytes Service;c:\program files\Malwarebytes\Anti-Malware\mbamservice.exe;c:\program files\Malwarebytes\Anti-Malware\mbamservice.exe [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUVStor.sys [x]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys;c:\windows\SYSNATIVE\DRIVERS\SiSG664.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WSDScan;Prise en charge de la numérisation WSD via UMB;c:\windows\system32\DRIVERS\WSDScan.sys;c:\windows\SYSNATIVE\DRIVERS\WSDScan.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S0 RapportHades64;RapportHades64;c:\windows\System32\Drivers\RapportHades64.sys;c:\windows\SYSNATIVE\Drivers\RapportHades64.sys [x]
S0 RapportKE64;RapportKE64;c:\windows\System32\Drivers\RapportKE64.sys;c:\windows\SYSNATIVE\Drivers\RapportKE64.sys [x]
S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [x]
S1 nvkflt;nvkflt;c:\windows\system32\DRIVERS\nvkflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvkflt.sys [x]
S1 RapportAegle64;RapportAegle64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportAegle64.sys;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportAegle64.sys [x]
S1 RapportCerberus_1804068;RapportCerberus_1804068;c:\programdata\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_1804068.sys;c:\programdata\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_1804068.sys [x]
S1 RapportEI64;RapportEI64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [x]
S1 RapportPG64;RapportPG64;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys;c:\program files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [x]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe;c:\windows\SYSNATIVE\FBAgent.exe [x]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 EPSON_PM_RPCV4_06;EPSON V3 Service4(06);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S60RPB.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S60RPB.EXE [x]
S2 EpsonScanSvc;Epson Scanner Service;c:\windows\system32\EscSvc64.exe;c:\windows\SYSNATIVE\EscSvc64.exe [x]
S2 HWDeviceService64.exe;HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys;c:\windows\SYSNATIVE\DRIVERS\idmwfp.sys [x]
S2 RapportMgmtService;Rapport Management Service;c:\program files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe;c:\program files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [x]
S2 ss_conn_service;SAMSUNG Mobile Connectivity Service;c:\program files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe;c:\program files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 AiCharger;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiCharger.sys;c:\windows\SYSNATIVE\DRIVERS\AiCharger.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jubusenum.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr QWAVE wcncsvc
.
Contenu du dossier 'Tâches planifiées'
.
2017-08-21 c:\windows\Tasks\EPSON XP-243 245 247 Series Update {029954AE-9BC4-41CE-89FB-B75570391B92}.job
- c:\windows\system32\spool\DRIVERS\x64\3\E_YTSRFE.EXE [2017-06-05 23:30]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2011-05-25 07:09 227840 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2011-05-25 07:09 227840 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-05-11 2213992]
"IntelTBRunOnce"="wscript.exe" [2013-10-12 168960]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Examen supplémentaire -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://google.fr/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xporter vers Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Télécharger avec IDM - c:\program files (x86)\Internet Download Manager\IEExt.htm
IE: Télécharger tous les liens avec IDM - c:\program files (x86)\Internet Download Manager\IEGetAll.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\MOA\AppData\Roaming\Mozilla\Firefox\Profiles\8ho6fuj7.default-1426972149348\
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Toolbar-Locked - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM_Wow6432Node-ActiveSetup-{8A69D345-D564-463c-AFF1-A69D9E530F96} - c:\program files (x86)\Google\Chrome\Application\58.0.3029.110\Installer\chrmstp.exe
Toolbar-Locked - (no file)
{CDC95B92-E27C-4745-A8C5-64A52A78855D}"-IDM Shell Extension - ShellIconOverlayIdentifiers
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe
AddRemove-ASUS_Screensaver - c:\windows\system32\ASUS_Screensaver.scr
.
.
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-1763895367-2035602292-2249291644-1001_Classes\Wow6432Node\CLSID\{2b426d94-ba15-4690-9f97-8162cf67642b}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:00000048
"Therad"=dword:00000014
"MData"=hex(0):39,cf,3a,42,28,e6,df,2c,b0,d0,2d,40,fc,0c,7f,fd,4d,07,38,27,48,
16,9c,79,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
.
[HKEY_USERS\S-1-5-21-1763895367-2035602292-2249291644-1001_Classes\Wow6432Node\CLSID\{3a55cb78-580e-4ae7-8d6b-a4dc47d5fd98}]
@Denied: (Full) (Everyone)
"Model"=dword:000000dc
"Therad"=dword:00000014
.
[HKEY_USERS\S-1-5-21-1763895367-2035602292-2249291644-1001_Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):2b,f3,b2,54,a2,62,79,42,30,d6,27,f3,d1,2d,7f,2a,2c,50,38,d0,f0,
ce,8c,db,a7,5a,3b,48,fd,0e,78,9c,00,d0,fd,94,b2,c5,e0,7d,00,00,00,00,00,00,\
.
[HKEY_USERS\S-1-5-21-1763895367-2035602292-2249291644-1001_Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):90,61,c5,84,63,63,10,84,fd,c8,59,6d,c4,90,d6,48,40,85,2c,41,f8,
7d,8e,9f,e3,3f,27,d5,bb,f2,6c,94,4f,f0,91,eb,c2,d2,c9,e3,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_25_0_0_171_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_25_0_0_171_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Heure de fin: 2017-08-21 21:22:38
ComboFix-quarantined-files.txt 2017-08-21 19:22
.
Avant-CF: 235 932 528 640 octets libres
Après-CF: 235 237 740 544 octets libres
.
- - End Of File - - 76C157F8355E92C5FE009D77C6274FB6