ComboFix 17-12-11.01 - Ludovic 08/01/2018 20:34:42.1.2 - x64
Microsoft Windows 7 Édition Familiale Premium 6.1.7601.1.1252.33.1036.18.4095.2477 [GMT 1:00]
Lancé depuis: c:\users\Ludovic\Desktop\LUDO.exe
AV: Malwarebytes *Disabled/Updated* {23007AD3-69FE-687C-2629-D584AFFAF72B}
SP: Malwarebytes *Disabled/Updated* {98619B37-4FC4-67F2-1C99-EEF6D47DBD96}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Ludovic\AppData\Local\assembly\tmp
c:\users\Ludovic\AppData\Roaming\Microsoft Corporation\2007 Microsoft Office system
c:\users\Ludovic\AppData\Roaming\Microsoft Corporation\2007 Microsoft Office system\Offisync-UserSettings.config
c:\users\Ludovic\AppData\Roaming\Microsoft Corporation\2007 Microsoft Office system\Offisync.config.old_backup
c:\users\Ludovic\AppData\Roaming\Microsoft Corporation\2007 Microsoft Office system\ostelbuf.dat
c:\users\Ludovic\ZHPDiag3.exe
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2017-12-08 au 2018-01-08 ))))))))))))))))))))))))))))))))))))
.
.
2018-01-08 19:43 . 2018-01-08 19:43 -------- d-----w- c:\users\Default\AppData\Local\temp
2018-01-07 20:50 . 2018-01-08 00:38 -------- d-----w- c:\users\Ludovic\AppData\Local\Mozilla
2018-01-07 20:50 . 2018-01-07 20:50 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2018-01-07 18:26 . 2018-01-07 18:26 -------- d-----w- c:\program files (x86)\ESET
2018-01-05 16:49 . 2018-01-05 16:54 -------- d-----w- C:\AdwCleaner
2018-01-04 19:48 . 2018-01-05 17:18 -------- d-----w- c:\program files\CCleaner
2018-01-04 19:27 . 2018-01-05 16:59 -------- d-----w- c:\users\Ludovic\AppData\Local\ZHP
2018-01-04 16:54 . 2017-11-29 08:11 77432 ----a-w- c:\windows\system32\drivers\mbae64.sys
2018-01-04 16:54 . 2018-01-04 16:54 -------- d-----w- c:\programdata\Malwarebytes
2018-01-04 16:54 . 2018-01-04 16:54 -------- d-----w- c:\program files\Malwarebytes
2018-01-03 18:48 . 2018-01-05 23:17 -------- d-----w- C:\FRST
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2017-11-20 20:32 . 2010-02-25 15:25 545440 ------w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2009-10-27 6998656]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2009-08-20 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"BrStsWnd"="c:\program files (x86)\Brownie\BrstsW64.exe" [2009-08-19 3695928]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotPostWindows10UpgradeReInstall"="c:\program files\Common Files\AV\Spybot - Search and Destroy\Test.exe" [2015-07-28 1011200]
.
c:\users\Ludovic\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
DSmobileSCAN II.lnk - c:\program files (x86)\Brother\DSmobileSCAN II\DSmobileSCAN.exe [2012-5-28 628224]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
SRS Premium Sound.lnk - c:\windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe /f=srs_premium_sound_nopreset.zip /h [2010-1-17 156952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;Malwarebytes Service;c:\program files\Malwarebytes\Anti-Malware\mbamservice.exe;c:\program files\Malwarebytes\Anti-Malware\mbamservice.exe [x]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS;c:\windows\SYSNATIVE\drivers\AmUStor.SYS [x]
R3 dtlitescsibus;DAEMON Tools Lite Virtual SCSI Bus;c:\windows\system32\DRIVERS\dtlitescsibus.sys;c:\windows\SYSNATIVE\DRIVERS\dtlitescsibus.sys [x]
R3 dtliteusbbus;DAEMON Tools Lite Virtual USB Bus;c:\windows\system32\DRIVERS\dtliteusbbus.sys;c:\windows\SYSNATIVE\DRIVERS\dtliteusbbus.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys;c:\windows\SYSNATIVE\DRIVERS\SiSG664.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe;c:\windows\SYSNATIVE\FBAgent.exe [x]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [x]
S2 MSSQL$EBP;SQL Server (EBP);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe;c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\windows\SysWOW64\nvSCPAPISvr.exe;c:\windows\SysWOW64\nvSCPAPISvr.exe [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
.
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - ESPROTECTIONDRIVER
*NewlyCreated* - MBAMFARFLT
*NewlyCreated* - MBAMPROTECTION
*NewlyCreated* - MBAMSWISSARMY
*NewlyCreated* - MBAMWEBPROTECTION
*Deregistered* - ESProtectionDriver
*Deregistered* - MBAMFarflt
*Deregistered* - MBAMProtection
*Deregistered* - MBAMSwissArmy
*Deregistered* - MBAMWebProtection
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr QWAVE wcncsvc
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2009-11-26 05:49 70656 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-12-11 16414824]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-09-30 621440]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-09-01 323584]
.
------- Examen supplémentaire -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.fr/
mStart Page = hxxp://www.google.fr/
mDefault_Page_URL = hxxp://www.google.fr/
mDefault_Search_URL = hxxp://www.google.fr/
mSearch Page = hxxp://www.google.fr/?q={searchTerms}
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.0.254
FF - ProfilePath - c:\users\Ludovic\AppData\Roaming\Mozilla\Firefox\Profiles\th4xjzdt.default-1484757855150-1515358299669\
.
- - - - ORPHELINS SUPPRIMES - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM_Wow6432Node-ActiveSetup-{8A69D345-D564-463c-AFF1-A69D9E530F96} - c:\program files (x86)\Google\Chrome\Application\63.0.3239.132\Installer\chrmstp.exe
AddRemove-3f10ea13-9a1f-4236-beae-206ba68c767a - c:\progra~3\INSTAL~1\{9BB3A~1\Setup.exe
AddRemove-4ecff384-ba61-4f80-81d4-d58bfc0d25e4 - c:\progra~3\INSTAL~1\{98E00~1\Setup.exe
AddRemove-c12393c3-4a0f-45fb-a068-91694251d909 - c:\progra~3\INSTAL~1\{754A3~1\Setup.exe
AddRemove-EBP Compta Classic Open Line 2011 3.0 - c:\programdata\{4932F8D7-FB73-4966-865D-3C3C1372C09B}\setup.exe
AddRemove-EBP Devis et Facturation Bâtiment Classic 2010 11.0 - c:\programdata\{5428908B-4203-4FFA-9A62-F36E4771A7BC}\setup.exe
AddRemove-EBP Utilitaire d'échanges 1.1 - c:\programdata\{4E8B28E9-7604-40D3-A02C-8E3AFD1703AC}\setup.exe
AddRemove-{3657B23B-4E07-4B42-BBEF-B024429431F2} - c:\programdata\{4932F8D7-FB73-4966-865D-3C3C1372C09B}\setup.exe
AddRemove-{5E39F2FB-0D5B-413E-903C-3F495017109C} - c:\programdata\{3FEAFE1E-B171-4F43-9D22-153B42A7D1BF}\setup.exe
AddRemove-{EAF8BEC9-B95F-4CAC-B04F-72D93139DA9C} - c:\programdata\{5428908B-4203-4FFA-9A62-F36E4771A7BC}\setup.exe
.
.
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Heure de fin: 2018-01-08 20:46:47
ComboFix-quarantined-files.txt 2018-01-08 19:46
.
Avant-CF: 21 720 571 904 octets libres
Après-CF: 21 290 151 936 octets libres
.
- - End Of File - - CB8ED6916FF6CCE3D0B8A876A13B622A
5C616939100B85E558DA92B899A0FC36