ComboFix 17-05-09.01 - hassan 13/05/2017 12:28:59.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.33.1025.18.2012.1169 [GMT 2:00]
Lancé depuis: c:\users\hassan\Desktop\ComboFix.exe
AV: ESET Smart Security *Enabled/Updated* {EC1D6F37-E411-475A-DF50-12FF7FE4AC70}
SP: ESET Smart Security *Enabled/Updated* {577C8ED3-C22B-48D4-E5E0-298D0463E6CD}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Un antivirus résident est actif
.
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Common Files\gastydiv.exe
c:\program files\FireFox\plugin-container.exe
c:\program files\FireFox\uninstall\helper.exe
c:\program files\FireFox\updater.exe
c:\programdata\BIT\BIT.dll
c:\users\hassan\AppData\Local\Qvoity.bin
c:\users\hassan\AppData\Local\Ventotam.bin
c:\users\hassan\AppData\Local\Zoom-Kix.bin
c:\users\hassan\AppData\Roaming\DRPSu
c:\users\hassan\AppData\Roaming\DRPSu\diagnostics\soft.json
c:\users\hassan\AppData\Roaming\DRPSu\DRIVERS\Microsoft-FORCED-7x86-drp.zip
c:\users\hassan\AppData\Roaming\DRPSu\DRIVERS\Realtek-matchver-FORCED-NTx86-RTL8139_6.112.0123.2014-drp.zip
c:\users\hassan\AppData\Roaming\DRPSu\dumpchk\dbgeng.dll
c:\users\hassan\AppData\Roaming\DRPSu\dumpchk\dbghelp.dll
c:\users\hassan\AppData\Roaming\DRPSu\dumpchk\dumpchk.exe
c:\users\hassan\AppData\Roaming\DRPSu\dumpchk\dumpchk.zip
c:\users\hassan\AppData\Roaming\DRPSu\dumpchk\triage\pooltag.txt
c:\users\hassan\AppData\Roaming\DRPSu\dumpchk\triage\triage.ini
c:\users\hassan\AppData\Roaming\DRPSu\dumpchk\winext\ext.dll
c:\users\hassan\AppData\Roaming\DRPSu\Internet\WifiInterface.txt
c:\users\hassan\AppData\Roaming\DRPSu\Logs\log___2017-05-10-20-24-29.html
c:\users\hassan\AppData\Roaming\DRPSu\Logs\log___2017-05-10-23-12-47.html
c:\users\hassan\AppData\Roaming\DRPSu\Logs\log___2017-05-11-14-54-45.html
c:\users\hassan\AppData\Roaming\DRPSu\Logs\log___2017-05-11-15-02-26.html
c:\users\hassan\AppData\Roaming\DRPSu\Logs\log___2017-05-11-15-10-45.html
c:\users\hassan\AppData\Roaming\DRPSu\Logs\log___2017-05-11-15-11-26.html
c:\users\hassan\AppData\Roaming\DRPSu\ohm\openhardwaremonitor.zip
c:\users\hassan\AppData\Roaming\DRPSu\PROGRAMS\DirectX.exe
c:\users\hassan\AppData\Roaming\DRPSu\PROGRAMS\DotNet.exe
c:\users\hassan\AppData\Roaming\DRPSu\PROGRAMS\OperaBlink.exe
c:\users\hassan\AppData\Roaming\DRPSu\temp\devcon_24400.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\devcon_26305.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\devcon_34208.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\devcon_55459.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\devcon_71469.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\devcon_88328.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\installing_38271.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\installing_40380.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\installing_88149.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\installing_9139.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\log_zip_file_24400.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\log_zip_file_26305.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\log_zip_file_34208.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\log_zip_file_55459.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\log_zip_file_71469.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\log_zip_file_88328.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2jbe06y.oildh.cmd.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2jbe06y.oildh.stderr.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2jbe06y.oildh.stdout.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2jbe06y.q06ep.ps1
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2jhefq2.f0ng4.ps1
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2jhefq2.m0eom.cmd.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2jhefq2.m0eom.stderr.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2jhefq2.m0eom.stdout.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2kf1tdu.65a05.ps1
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2kf1tee.x86j3.cmd.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2kf1tee.x86j3.stderr.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2kf1tee.x86j3.stdout.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2kfbora.s8cfy.ps1
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2kfbora.sb01g.cmd.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2kfbora.sb01g.stderr.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2kfbora.sb01g.stdout.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2kfn9hg.x4vrg.cmd.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2kfn9hg.x4vrg.stderr.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2kfn9hg.x4vrg.stdout.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\ps.j2kfn9hg.yxkru.ps1
c:\users\hassan\AppData\Roaming\DRPSu\temp\run_command_13746.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\run_command_24385.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\run_command_65570.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\run_command_76047.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\run_command_95705.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\taskkill_14123.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\taskkill_5020.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\taskkill_84878.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\taskkill_90204.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\unzipping_24400.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\unzipping_26305.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\unzipping_34208.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\unzipping_55459.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\unzipping_71469.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\unzipping_88328.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\unzipping_undefined.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_15546.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_22671.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_24400.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_26305.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_29003.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_29314.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_34208.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_35060.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_37447.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_3824.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_38271.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_38998.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_39493.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_40380.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_43118.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_45660.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_47456.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_51509.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_53680.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_55459.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_55533.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_57191.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_61188.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_66018.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_67511.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_68541.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_6992.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_71469.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_76285.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_79298.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_88149.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_88328.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_9139.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_91850.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_93754.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_finished_94692.txt
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_15546.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_22671.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_24400.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_26305.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_27634.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_29003.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_29084.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_29314.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_34208.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_35060.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_37447.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_3824.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_38271.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_38998.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_39493.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_40380.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_43118.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_45660.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_47456.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_51509.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_5252.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_53680.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_55459.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_55533.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_57191.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_61188.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_66018.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_67511.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_68541.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_6992.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_69960.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_71469.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_76052.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_76285.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_79298.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_83557.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_88149.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_88328.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_9139.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_91850.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_93754.log
c:\users\hassan\AppData\Roaming\DRPSu\temp\wget_log_94692.log
c:\windows\Manager.exe
.
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_BIT
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2017-04-13 au 2017-05-13 ))))))))))))))))))))))))))))))))))))
.
.
2017-05-13 06:22 . 2017-05-12 02:47 109056 ----a-w- c:\programdata\Microsoft\AppV\sym\dbg.dll
2017-05-13 06:22 . 2017-05-13 06:22 -------- d-----w- c:\program files\Eggper
2017-05-12 23:32 . 2017-05-12 23:32 -------- d-----w- c:\program files\Default Company Name
2017-05-12 11:45 . 2017-05-13 10:05 -------- d-----w- c:\programdata\locep
2017-05-12 11:43 . 2017-05-12 11:44 -------- d-----w- c:\program files\ZHPDiag
2017-05-12 11:40 . 2017-05-12 11:40 -------- d-----w- c:\program files\ESET
2017-05-12 07:53 . 2017-05-12 07:53 -------- d-----w- c:\windows\Migration
2017-05-12 05:51 . 2017-05-12 05:52 -------- d-----w- c:\program files\CCleaner
2017-05-11 23:18 . 2017-05-13 10:03 -------- d-----w- c:\programdata\Affenpinscher
2017-05-11 23:15 . 2017-05-12 23:17 -------- d-----w- c:\program files\Common Files\ul432lwc
2017-05-11 22:36 . 2017-05-12 23:20 -------- d-----w- c:\program files\BestZiper
2017-05-11 22:26 . 2006-08-15 15:46 96896 ----a-w- c:\windows\system32\drivers\ES1969.sys
2017-05-11 22:23 . 2017-05-11 22:23 -------- d-----w- c:\programdata\Microsoft OneDrive
2017-05-11 22:22 . 2017-05-13 11:13 -------- d---a-w- c:\program files\Firefox
2017-05-11 22:16 . 2016-05-19 06:42 59152 ----a-w- c:\windows\system32\drivers\iSafeNetFilter.sys
2017-05-11 22:15 . 2017-05-12 05:28 -------- d-----w- c:\program files\BitTorrent
2017-05-11 22:13 . 2017-05-11 22:13 -------- d-----w- c:\programdata\Logic Cramble
2017-05-11 22:08 . 2017-05-12 21:34 -------- d-----w- c:\programdata\PrefsSecure
2017-05-11 22:03 . 2017-05-13 11:13 -------- d-----w- c:\programdata\BIT
2017-05-11 22:02 . 2017-05-12 23:25 -------- d-----w- C:\Reerdition
2017-05-11 21:04 . 2017-05-11 21:04 23840 ----a-w- c:\windows\system32\drivers\HWiNFO32.SYS
2017-05-11 21:00 . 2017-05-12 13:42 -------- d-----w- c:\program files\Drouing Center
2017-05-11 13:08 . 2017-05-11 13:08 -------- d-----w- c:\windows\system32\wbem\Framework
2017-05-11 12:58 . 2017-05-11 12:58 -------- d-----w- c:\program files\Intel
2017-05-11 12:58 . 2017-05-11 12:58 -------- d-----w- C:\Intel
2017-05-11 12:37 . 2017-05-11 12:37 -------- d-----w- c:\program files\PlayReady
2017-05-11 12:35 . 2017-05-11 12:35 -------- d-----w- c:\program files\Microsoft Silverlight
2017-05-11 11:55 . 2017-05-11 11:55 -------- d-----w- c:\program files\Microsoft.NET
2017-05-11 11:18 . 2017-05-11 11:18 -------- d-----w- c:\windows\system32\Adobe
2017-05-11 11:16 . 2017-05-13 00:02 -------- d-sh--w- c:\windows\Installer
2017-05-11 10:30 . 2017-05-11 20:41 -------- d-----w- c:\program files\PowerISO
2017-05-11 09:56 . 2017-05-11 21:27 -------- d-----w- c:\program files\Internet Download Manager
2017-05-11 09:11 . 2017-05-11 09:11 -------- d-----w- c:\program files\Realtek
2017-05-11 09:11 . 2011-12-13 09:01 1698408 ----a-w- c:\windows\RtlExUpd.dll
2017-05-11 09:10 . 2017-05-11 09:10 -------- d-----w- c:\program files\Common Files\InstallShield
2017-05-11 08:48 . 2017-05-11 08:48 803320 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2017-05-11 08:48 . 2017-05-11 08:48 144888 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2017-05-11 08:12 . 2017-05-11 08:12 10510336 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{192D79C6-85BC-488C-A598-747BA285B3B6}\mpengine.dll
2017-05-11 00:06 . 2017-05-12 05:59 -------- d-----w- c:\windows\Panther
2017-05-10 21:27 . 2017-05-11 22:12 -------- d-----w- c:\programdata\ProductData
2017-05-10 21:27 . 2017-05-10 21:27 -------- d-----w- c:\windows\IObit
2017-05-10 21:11 . 2017-05-11 11:28 -------- d-----w- c:\program files\Google
2017-05-10 21:08 . 2017-05-11 11:16 -------- d-----w- c:\program files\Common Files\Adobe AIR
2017-05-10 20:59 . 2017-05-11 08:48 -------- d-----w- c:\windows\system32\Macromed
2017-05-10 20:53 . 2017-05-11 08:42 -------- d-----w- c:\program files\Mozilla Maintenance Service
2017-05-10 18:14 . 2017-05-10 18:14 -------- d-----w- c:\programdata\IDM
2017-05-10 14:15 . 2017-05-12 13:44 -------- d-----w- c:\users\hassan
2017-05-10 14:15 . 2017-05-10 14:15 -------- d-----w- C:\Recovery
2017-05-10 14:15 . 2017-05-10 14:15 -------- d-sh--we c:\users\Default\7A3E~1
2017-05-10 14:15 . 2017-05-10 14:15 -------- d-sh--we c:\progra~2\7A3E~1
2017-05-10 14:15 . 2017-05-10 14:15 -------- d-sh--we c:\progra~2\5793~1
2017-04-27 17:39 . 2014-01-23 09:16 51928 ----a-w- c:\windows\system32\drivers\Rtnicxp.sys
2017-04-27 17:39 . 2013-10-31 02:24 76872 ----a-w- c:\windows\system32\RtNicProp32.dll
2017-04-27 17:39 . 2013-10-31 02:24 100896 ----a-w- c:\windows\system32\RTNUninst32.dll
2017-04-27 13:10 . 2012-11-13 23:43 81920 ----a-w- c:\windows\system32\igfxCoIn_v2869.dll
2017-04-27 13:10 . 2012-11-13 23:43 208896 ----a-w- c:\windows\system32\iglhsip32.dll
2017-04-27 13:10 . 2012-11-13 23:43 147456 ----a-w- c:\windows\system32\iglhcp32.dll
2017-04-27 13:10 . 2012-11-13 23:43 828928 ----a-w- c:\windows\system32\igfxress.dll
2017-04-27 13:10 . 2012-11-13 23:43 57856 ----a-w- c:\windows\system32\igfxsrvc.dll
2017-04-27 13:10 . 2012-11-13 23:43 261632 ----a-w- c:\windows\system32\igfxTMM.dll
2017-04-27 13:10 . 2012-11-13 23:43 195584 ----a-w- c:\windows\system32\igfxpph.dll
2017-04-27 13:10 . 2012-11-13 23:43 4096 ----a-w- c:\windows\system32\IGFXDEVLib.dll
2017-04-27 13:10 . 2012-11-13 23:43 23552 ----a-w- c:\windows\system32\igfxexps.dll
2017-04-27 13:10 . 2012-11-13 23:43 228864 ----a-w- c:\windows\system32\igfxdev.dll
2017-04-27 13:10 . 2012-11-13 23:43 130048 ----a-w- c:\windows\system32\igfxdo.dll
2017-04-27 13:10 . 2012-11-13 23:43 571904 ----a-w- c:\windows\system32\igdumdx32.dll
2017-04-21 12:53 . 2017-04-21 12:53 29376 ----a-w- c:\windows\system32\aspnet_counters.dll
2017-04-21 12:53 . 2017-04-21 12:53 18600 ----a-w- c:\windows\system32\msvcr110_clr0400.dll
2017-04-21 12:53 . 2017-04-21 12:53 18600 ----a-w- c:\windows\system32\msvcr100_clr0400.dll
2017-04-21 12:53 . 2017-04-21 12:53 18600 ----a-w- c:\windows\system32\msvcp110_clr0400.dll
2017-04-20 18:09 . 2017-04-20 18:09 987840 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
2017-04-20 18:09 . 2017-04-20 18:09 485576 ----a-w- c:\windows\system32\msvcp120_clr0400.dll
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2017-03-09 19:55 . 2017-03-09 19:55 90656 ----a-w- c:\windows\system32\drivers\edevmon.sys
2017-03-09 19:55 . 2017-03-09 19:55 86504 ----a-w- c:\windows\system32\drivers\epfwwfp.sys
2017-03-09 19:55 . 2017-03-09 19:55 69304 ----a-w- c:\windows\system32\drivers\epfw.sys
2017-03-09 19:55 . 2017-03-09 19:55 52680 ----a-w- c:\windows\system32\drivers\EpfwLWF.sys
2017-03-09 19:55 . 2017-03-09 19:55 43920 ----a-w- c:\windows\system32\drivers\ekbdflt.sys
2017-03-09 19:55 . 2017-03-09 19:55 139384 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2017-03-09 19:55 . 2017-03-09 19:55 113032 ----a-w- c:\windows\system32\drivers\eamonm.sys
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ IDM Shell Extension]
@="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
[HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
2015-08-14 14:52 23520 ----a-w- c:\program files\Internet Download Manager\IDMShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2017-05-02 4027504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R1 iSafeKrnlMon;YAC Monitor Driver;c:\program files\Elex-tech\YAC\iSafeKrnlMon.sys [x]
R2 Affenpinscher;Affenpinscher;c:\programdata\\Affenpinscher\\Affenpinscher.exe [x]
R2 EggperSU;EggperSU;c:\users\hassan\AppData\Local\Temp\1\GoogleUpdats.exe [x]
R2 locep;locep;c:\programdata\\locep\\locep.exe [x]
R2 OneDirveSrv;OneDirve Sync Services;c:\windows\System32\svchost.exe [2009-07-14 20992]
R2 Recover;Recover;c:\program files\MIO\IPPK9NFWDXPUAPNCVFWQ339X\qe-i5R2f_N.exe [x]
R2 WinSAPSvc;WinSAPSvc;c:\windows\system32\svchost.exe [2009-07-14 20992]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [2010-11-20 77184]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2010-11-20 25600]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [2010-11-20 112640]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S0 edevmon;edevmon;c:\windows\system32\DRIVERS\edevmon.sys [2017-03-09 90656]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2017-03-09 113032]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2017-03-09 139384]
S1 EpfwLWF;ESET Personal Firewall;c:\windows\system32\DRIVERS\EpfwLWF.sys [2017-03-09 52680]
S1 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2017-03-09 86504]
S1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\windows\system32\drivers\HWiNFO32.SYS [2017-05-11 23840]
S2 ekbdflt;ekbdflt;c:\windows\system32\DRIVERS\ekbdflt.sys [2017-03-09 43920]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Security\ekrn.exe [2017-03-09 2069424]
S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [2016-10-17 147120]
S2 NPASRE;NPASRE;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 WinAppSvr;Windows Applications Services;c:\windows\System32\svchost.exe [2009-07-14 20992]
S3 es1969;ESS ES1946_1938 Audio Driver (WDM);c:\windows\system32\drivers\ES1969.sys [2006-08-15 96896]
.
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WinSAPSvc REG_MULTI_SZ WinSAPSvc
NPASRE REG_MULTI_SZ NPASRE
BIT REG_MULTI_SZ BIT
wxsappx REG_MULTI_SZ OneDirveSrv
appmodels REG_MULTI_SZ WinAppSvr
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2017-05-11 11:47 1371480 ----a-w- c:\program files\Google\Chrome\Application\58.0.3029.110\Installer\chrmstp.exe
.
.
------- Examen supplémentaire -------
.
uStart Page = https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNbqiwsrfOqu9TNB0c6REacLCOykh5jk1n8yahmUSarMCPTf6Uv1oSVIO18w77SaC0du4DgQosoBqkSG2iqwCluQcd3oefV6f8aDQx055BT0168tjNqP-RbCO49s1Eumr5XQDW0iUkbbI7mBqk9RjlRYE5phn02zGWl4hR6Sc,
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
Trusted Zone: eset.com\help
TCP: DhcpNameServer = 192.168.1.1 0.0.0.0
TCP: Interfaces\{2F941FA0-4A3F-4FC4-8262-37D175800866}: NameServer = 8.8.8.8,8.8.4.4
FF - ProfilePath - c:\users\hassan\AppData\Roaming\Mozilla\Firefox\Profiles\3s3fqtmt.default-1494544447815\
FF - prefs.js: browser.startup.homepage - c:\programdata\loceps\ff.HP
.
- - - - ORPHELINS SUPPRIMES - - - -
.
HKLM-Run-BestZiper - c:\program files\BestZiper\BestZiper.exe
c:\users\hassan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\produpd.lnk - c:\users\hassan\AppData\Roaming\VDI\Shared\Product Updater\produpd.exe /20506
ShellExecuteHooks-{07DCF67A-3173-11E7-8FAA-64006A5CFC23} - c:\users\hassan\AppData\Roaming\Stamerpy\Thoverpykubuph.dll
ShellExecuteHooks-{D05BC048-3173-11E7-A9A1-64006A5CFC23} - c:\users\hassan\AppData\Roaming\Qktynerzos\Coerzph.dll
.
.
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-1796275782-4292205373-2313263118-1001_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):6d,87,ea,47,63,3b,14,9b,b7,92,58,4a,12,95,19,d4,e9,8b,5b,3c,8f,
6c,2b,08,cb,2d,9f,d6,86,dd,2c,eb,23,a9,b6,08,7c,9c,41,79,00,00,00,00,00,00,\
.
[HKEY_USERS\S-1-5-21-1796275782-4292205373-2313263118-1001_Classes\CLSID\{dea67128-9ec4-4525-8874-e49fe73473bf}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:00000082
"Therad"=dword:00000001
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\taskhost.exe
c:\program files\ESET\ESET Security\egui.exe
c:\windows\system32\conhost.exe
.
**************************************************************************
.
Heure de fin: 2017-05-13 13:29:17 - La machine a redémarré
ComboFix-quarantined-files.txt 2017-05-13 11:29
.
Avant-CF: 93 091 565 568 bytes free
Après-CF: 93 348 151 296 bytes free
.
- - End Of File - - 56FC0D9A76F4F26D12EB32F10C331DFC
A36C5E4F47E84449FF07ED3517B43A31