Malwarebytes Anti-Malware www.malwarebytes.org Date de l'analyse: 17/01/2016 Heure de l'analyse: 14:15 Fichier journal: mbam.txt Administrateur: Oui Version: 2.2.0.1024 Base de données de programmes malveillants: v2016.01.17.02 Base de données de rootkits: v2016.01.09.01 Licence: Gratuit Protection contre les programmes malveillants: Désactivé Protection contre les sites Web malveillants: Désactivé Autoprotection: Désactivé Système d'exploitation: Windows 10 Processeur: x64 Système de fichiers: NTFS Utilisateur: Karine Type d'analyse: Analyse des menaces Résultat: Terminé Objets analysés: 387735 Temps écoulé: 42 min, 17 s Mémoire: Activé Démarrage: Activé Système de fichiers: Activé Archives: Activé Rootkits: Activé Heuristique: Activé PUP: Activé PUM: Activé Processus: 0 (Aucun élément malveillant détecté) Modules: 0 (Aucun élément malveillant détecté) Clés du Registre: 9 PUP.Optional.BrowserWeb, HKLM\SOFTWARE\MICROSOFT\TRACING\BrowserWeb_RASMANCS, En quarantaine, [a80e86b4c5d48ea80bd083976e96f010], PUP.Optional.DeskBar, HKLM\SOFTWARE\MICROSOFT\TRACING\DeskBar_RASMANCS, En quarantaine, [1e98b981e3b6f541d9f3cc24ae557090], PUP.Optional.CrossAd, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Browser Bubble, Supprimer au redémarrage, [35812f0b2574d462f52ee14d1de79e62], PUP.Optional.Goobzo, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\SMW_UpdateTask_Time_313435333835383834322d325b573423416c45555a2a6c, Supprimer au redémarrage, [4c6afb3f3f5ab4822c428252de24f010], PUP.Optional.BoBrowser, HKU\S-1-5-21-834990444-1505823523-4223169436-1001\SOFTWARE\CLIENTS\STARTMENUINTERNET\BoBrowser.ATNF463UELHJJ7YFW7YBVMVMPM, En quarantaine, [922458e2a9f0a5915fe35ac8956fcf31], PUP.Optional.BrowserAir, HKU\S-1-5-21-834990444-1505823523-4223169436-1001\SOFTWARE\CLIENTS\STARTMENUINTERNET\BrowserAir.ATNF463UELHJJ7YFW7YBVMVMPM, En quarantaine, [a2145bdf039675c1779a72810ff4ff01], PUP.Optional.Komodia, HKU\S-1-5-21-834990444-1505823523-4223169436-1001\SOFTWARE\INSTALLPATH\STATUS, En quarantaine, [e9cd0832356438fe018052db0df7ed13], PUP.Optional.BrowserAir, HKU\S-1-5-21-834990444-1505823523-4223169436-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY\AUDIO\POLICYCONFIG\PROPERTYSTORE\15E33395_0, En quarantaine, [684e0337fb9ebf779fb3df4d5da7a25e], PUP.Optional.BrowserAir, HKU\S-1-5-21-834990444-1505823523-4223169436-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\BrowserAir.exe, En quarantaine, [575fd1695346d16583a50d0357ad42be], Valeurs du Registre: 7 PUP.Optional.SpeedBrowser, HKLM\SOFTWARE\REGISTEREDAPPLICATIONS|speed browser, Software\Clients\StartMenuInternet\speed browser\Capabilities, En quarantaine, [fdb93406e3b63cfa24930719d52f09f7] PUP.Optional.SpeedBrowser, HKLM\SOFTWARE\WOW6432NODE\REGISTEREDAPPLICATIONS|speed browser, Software\Clients\StartMenuInternet\speed browser\Capabilities, En quarantaine, [c8ee89b1bddce353b0077ea2f0144cb4] PUP.Optional.Komodia, HKU\S-1-5-21-834990444-1505823523-4223169436-1001\SOFTWARE\INSTALLPATH\STATUS|FlowsurfCB, Y, En quarantaine, [e9cd0832356438fe018052db0df7ed13] PUP.Optional.BrowserAir, HKU\S-1-5-21-834990444-1505823523-4223169436-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY\AUDIO\POLICYCONFIG\PROPERTYSTORE\15e33395_0, {2}.\\?\hdaudio#func_01&ven_10ec&dev_0282&subsys_103c2212&rev_1000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}\singlelineouttopo/00010001|\Device\HarddiskVolume4\Users\Karine\AppData\Local\BrowserAir\Application\BrowserAir.exe%b{00000000-0000-0000-0000-000000000000}, En quarantaine, [684e0337fb9ebf779fb3df4d5da7a25e] PUP.Optional.BrowserWeb, HKU\S-1-5-21-834990444-1505823523-4223169436-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|BrowserWeb.exe, 11001, En quarantaine, [783e4bef009940f61eb24dddb05420e0] PUP.Optional.DeskBar, HKU\S-1-5-21-834990444-1505823523-4223169436-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|DeskBar.exe, 8888, En quarantaine, [cee8a199851464d2598766c49b696898] PUP.Optional.BoBrowser, HKU\S-1-5-21-834990444-1505823523-4223169436-1001\SOFTWARE\REGISTEREDAPPLICATIONS|BoBrowser.ATNF463UELHJJ7YFW7YBVMVMPM, Software\Clients\StartMenuInternet\BoBrowser.ATNF463UELHJJ7YFW7YBVMVMPM\Capabilities, En quarantaine, [e2d478c2d5c4ef4765de62c021e327d9] Données du Registre: 0 (Aucun élément malveillant détecté) Dossiers: 11 PUP.Optional.CrossAd.Gen, C:\Users\Karine\AppData\Roaming\Mozilla\Firefox\Profiles\gkummyzm.default\jetpack\@C50A0D409D3B6877D7B7DC00FFDED0FAC50A, En quarantaine, [a51121192c6daf878b1ebede13ef5fa1], PUP.Optional.CrossAd.Gen, C:\Users\Karine\AppData\Roaming\Mozilla\Firefox\Profiles\gkummyzm.default\jetpack\@C50A0D409D3B6877D7B7DC00FFDED0FAC50A\simple-storage, En quarantaine, [a51121192c6daf878b1ebede13ef5fa1], PUP.Optional.PullUpdate, C:\ProgramData\mgfSKeanVOI\dat, En quarantaine, [377f54e696039c9a7c9895491be99e62], PUP.Optional.PullUpdate, C:\ProgramData\mgfSKeanVOI, En quarantaine, [377f54e696039c9a7c9895491be99e62], PUP.Optional.CrossAd.Gen, C:\Users\Karine\AppData\Local\Browser Bubble\Component, En quarantaine, [1a9cc8723663ad8927bf29b223e128d8], PUP.Optional.CrossAd.Gen, C:\Users\Karine\AppData\Local\Browser Bubble, En quarantaine, [1a9cc8723663ad8927bf29b223e128d8], PUP.Optional.CrossAd.Gen, C:\Users\Karine\AppData\Local\Browser Bubble\Component2, En quarantaine, [1a9cc8723663ad8927bf29b223e128d8], PUP.Optional.CrossAd.Gen, C:\Users\Karine\AppData\Local\Browser Bubble\xBin, En quarantaine, [1a9cc8723663ad8927bf29b223e128d8], PUP.Optional.SetSearchSetting, C:\Users\Karine\AppData\Roaming\Mozilla\Firefox\Profiles\gkummyzm.default\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}, En quarantaine, [15a19e9ceeab270f412306d8c73d8878], PUP.Optional.PrimaryColor, C:\Users\Karine\AppData\Roaming\Opera Software\Opera Stable\Extensions\faemilinkmhbempjjlmemddpjjbgdmcd\1.0.1_0, En quarantaine, [397d92a83267e94d62ac8d51f60e8779], PUP.Optional.PrimaryColor, C:\Users\Karine\AppData\Roaming\Opera Software\Opera Stable\Extensions\faemilinkmhbempjjlmemddpjjbgdmcd, En quarantaine, [397d92a83267e94d62ac8d51f60e8779], Fichiers: 63 Adware.PullUpdate, C:\ProgramData\mgfSKeanVOI\dat\DFmmPpfc.dll, En quarantaine, [0caaba80c3d6ec4aa2c1d256c0419070], PUP.Optional.OneSystemCare, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\OneSystemCare[1].exe, En quarantaine, [e5d1201ae5b4fb3bb87030a823e149b7], PUP.Optional.CrossRider, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\Takatap.dll, En quarantaine, [fbbb8eacbadf3ff79ec1f0b224e0f907], PUP.Optional.Clara, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\ClaraUpdater.exe, En quarantaine, [fabc3406bedb15214243865131d343bd], PUP.Optional.Boxore.WnskRST, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\mediastreamingagent.exe, En quarantaine, [585e340641587db9f921983d71931fe1], PUP.Optional.Komodia, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\mediastreamingcert.dll, En quarantaine, [14a241f99504d165cff1fa4be7192dd3], PUP.Optional.Nosibay, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\WindApp Uninstall.exe, En quarantaine, [d1e5201ac9d09d9948f2c213887ce11f], PUP.Optional.WebShield, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\XhZrxx.exe, En quarantaine, [3d791624f3a62e08e125f93e44bd7d83], PUP.Optional.Amonetize, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\Installer.VIR\Install_24214\nsnE5FE.tmp, En quarantaine, [4c6a71c9772283b365a2172bfa06e21e], PUP.Optional.Amonetize, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\Installer.VIR\Install_4622\nsnE5FE.tmp, En quarantaine, [a01672c88e0be94d7e89ae94a35d07f9], PUP.Optional.OneSystemCare, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\OneSystemCare\CleanupConsole.exe, En quarantaine, [b600c2782e6b0d291a0e95430ef6eb15], PUP.Optional.OneSystemCare, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\OneSystemCare\SystemCash.exe, En quarantaine, [b600a496ddbc61d5ac7c498f4fb541bf], PUP.Optional.OneSystemCare, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\OneSystemCare\SystemConsole.exe, En quarantaine, [26906cce178255e14cdc60783cc82ed2], PUP.Optional.OneSystemCare, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\OneSystemCare\Uninstaller.exe, En quarantaine, [179fe75371281f171f091abe34d0d828], PUP.Optional.SystemNotifier, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\System NotifierV11.08\utils.exe, En quarantaine, [06b046f4dcbdf83e41d7d0013dc71de3], PUP.Optional.CrossRider, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\Takatap.DIR\{B7F1A66A-6927-0879-6711-732C04092637}\vekvygw.dll, En quarantaine, [3383063471281224d3b3bbe84bb9ff01], PUP.Optional.CrossRider, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\Takatap.DIR\{B7F1A66A-6927-0879-6711-732C04092637}\{BAD87C85-CDB2-2650-7C72-D092A971D78B}.dll, En quarantaine, [239377c37326f541431cf1b1de2614ec], PUP.Optional.Clara, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\BoBrowser.DIR\Application\bobrowser.exe, En quarantaine, [0da90a30a0f94aec3c49488f6f953ec2], PUP.Optional.Clara, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\BoBrowser.DIR\Application\chrome_elf.dll, En quarantaine, [2e88ca7082171b1bf98c5a7dd72df20e], PUP.Optional.Clara, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\BoBrowser.DIR\Application\crash_service.exe, En quarantaine, [1c9ab08ad0c9241222635483ea1ac33d], PUP.Optional.BrowserApps, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\BrowserV11.08\utils.exe, En quarantaine, [6f47a09a60398aac3ecafcd445bfea16], PUP.Optional.CSDI, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\Max Driver Updater\isxdl.dll, En quarantaine, [a412e5556f2a8ea837c143959b6908f8], PUP.Optional.CSDI, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\Max Driver Updater\unins000.exe, En quarantaine, [f8bee258f5a40c2ae51300d83acaf010], PUP.Optional.Nosibay, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\WTools.DIR\Selection Tools\Selection Tools Uninstall.exe, En quarantaine, [605648f22f6afc3aea50d20314f051af], PUP.Optional.Nosibay, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\WTools.DIR\Selection Tools\selection tools.exe, En quarantaine, [12a41327ddbc72c442f8fcd973919967], PUP.Optional.MixiVideoPlayer, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\MixVideoPlayer\FrameworkControl.exe, En quarantaine, [496d41f9c5d48caac381893206fbfa06], PUP.Optional.MixVideoPlayer, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\MixVideoPlayer\references\mixChecker.exe, En quarantaine, [4e68dc5e3b5ec86e86ef012cfb054ab6], PUP.Optional.Nosibay, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\Nosibay\Bubble Dock\Bubble Dock Update.exe, En quarantaine, [348297a3b1e867cfbd7d2ea7877d1ce4], PUP.Optional.Nosibay, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\Nosibay\Bubble Dock\LBubble Dock.exe, En quarantaine, [9422e6544e4b33037fbb1cb96e9631cf], PUP.Optional.MyPCBackup, C:\Users\Karine\AppData\Roaming\ZHP\Quarantine\OLBPre\uninst.exe, En quarantaine, [278f22185d3ceb4b8649c3dfb153916f], PUP.Optional.Goobzo, C:\Windows\System32\rsrcs.dll, En quarantaine, [f5c129113960b284614f6c4dfa07e41c], PUP.Optional.CrossRider, C:\Windows\SysWOW64\35.exe, En quarantaine, [2f8796a4821787afb6baac8581806a96], PUP.Optional.CrossRider, C:\Windows\SysWOW64\d6492c.exe, En quarantaine, [9b1be05ae5b4d462d59b2809a061c838], PUP.Optional.BundleInstaller, C:\Users\Karine\Downloads\Setup.exe, En quarantaine, [c2f40a30a6f3171f18b940f035cce61a], PUP.Optional.DomaIQ, C:\Users\Karine\Downloads\Setup(1).exe, En quarantaine, [2c8aa397b4e53501f72fe64317ea41bf], PUP.Optional.CrossRider, C:\Users\Karine\AppData\Local\Takatap\{B7F1A66A-6927-0879-6711-732C04092637}\vekvygw.dll, En quarantaine, [288e01394f4a5bdb2660bee5e123847c], PUP.Optional.CrossAd.Gen, C:\Users\Karine\AppData\Roaming\Mozilla\Firefox\Profiles\gkummyzm.default\extensions\@C50A0D409D3B6877D7B7DC00FFDED0FAC50A.xpi, En quarantaine, [9f17d6646a2f58de923e96100bf8fd03], PUP.Optional.FireFoxHijack, C:\Program Files (x86)\Mozilla Firefox\defaults\pref\!C50A0D409D3B6877D7B7DC00FFDED0FAC50A.js, En quarantaine, [14a2de5c0891c472e09ecc6181832cd4], PUP.Optional.CrossAd, C:\Windows\System32\Tasks\Browser Bubble, En quarantaine, [d5e1f8427128eb4b899476b808fc29d7], PUP.Optional.CrossAd.Gen, C:\Users\Karine\AppData\Roaming\Mozilla\Firefox\Profiles\gkummyzm.default\jetpack\@C50A0D409D3B6877D7B7DC00FFDED0FAC50A\simple-storage\store.json, En quarantaine, [a51121192c6daf878b1ebede13ef5fa1], PUP.Optional.PullUpdate, C:\ProgramData\mgfSKeanVOI\dat\QPfjaie.exe.config, En quarantaine, [377f54e696039c9a7c9895491be99e62], PUP.Optional.PullUpdate, C:\ProgramData\mgfSKeanVOI\dat\DFmmPpfc.dll, En quarantaine, [377f54e696039c9a7c9895491be99e62], PUP.Optional.PullUpdate, C:\ProgramData\mgfSKeanVOI\dat\XhZrxx.exe.config, En quarantaine, [377f54e696039c9a7c9895491be99e62], PUP.Optional.PullUpdate, C:\ProgramData\mgfSKeanVOI\info.dat, En quarantaine, [377f54e696039c9a7c9895491be99e62], PUP.Optional.PullUpdate, C:\ProgramData\mgfSKeanVOI\ZjxqebRbAQ.dat, En quarantaine, [377f54e696039c9a7c9895491be99e62], PUP.Optional.PullUpdate, C:\ProgramData\mgfSKeanVOI\ZjxqebRbAQ.exe.config, En quarantaine, [377f54e696039c9a7c9895491be99e62], PUP.Optional.CrossAd.Gen, C:\Users\Karine\AppData\Local\Browser Bubble\Component\config.json, En quarantaine, [1a9cc8723663ad8927bf29b223e128d8], PUP.Optional.CrossAd.Gen, C:\Users\Karine\AppData\Local\Browser Bubble\Component\hello.js, En quarantaine, [1a9cc8723663ad8927bf29b223e128d8], PUP.Optional.CrossAd.Gen, C:\Users\Karine\AppData\Local\Browser Bubble\Component\manifest.json, En quarantaine, [1a9cc8723663ad8927bf29b223e128d8], PUP.Optional.CrossAd.Gen, C:\Users\Karine\AppData\Local\Browser Bubble\Component\scriptTagContext.js, En quarantaine, [1a9cc8723663ad8927bf29b223e128d8], PUP.Optional.CrossAd.Gen, C:\Users\Karine\AppData\Local\Browser Bubble\Component\tmp_bg.js, En quarantaine, [1a9cc8723663ad8927bf29b223e128d8], PUP.Optional.CrossAd.Gen, C:\Users\Karine\AppData\Local\Browser Bubble\Component\uconfig.json, En quarantaine, [1a9cc8723663ad8927bf29b223e128d8], PUP.Optional.CrossAd.Gen, C:\Users\Karine\AppData\Local\Browser Bubble\Component2\plugin, En quarantaine, [1a9cc8723663ad8927bf29b223e128d8], PUP.Optional.CrossAd.Gen, C:\Users\Karine\AppData\Local\Browser Bubble\xBin\c.dat, En quarantaine, [1a9cc8723663ad8927bf29b223e128d8], PUP.Optional.CrossAd.Gen, C:\Users\Karine\AppData\Local\Browser Bubble\xBin\vdvpeh.dll, En quarantaine, [1a9cc8723663ad8927bf29b223e128d8], PUP.Optional.WinYahoo, C:\Users\Karine\AppData\Local\Chromium\User Data\Default\Secure Preferences, Bon : ("session":{"restore_on_startup":4,"startup_urls":["https://www.malwarebytes.org/restorebrowser/"]}}), Mauvais : ("session":{"restore_on_startup":4,"startup_urls":["https://fr.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_mdaffmarmarie_15_44¶m1=1¶m2=f%3D7%26b%3Dchmm%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0DtD0B0Fzy0CtCyBtAyCtC0A0AyCtB0EtN0D0Tzu0StCyEtDtDtN1L2XzutAtFtCyDtFtDtFtDtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2StB0DyCzyzytDyEtDtGtAzy0FyDtGzy0DtDzytGyD0CtAtBtGyC0D0BtByDyBtBzz0BtBzztC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCzzyByEyCyDyD0FtGyE0AyBzytGyEtCyCyBtG0BtCtDtAtGyEtAtB0D0BtD0C0F0EyC0ByC2QtN0A0LzuyE%26cr%3D224604013%26a%3Dwncy_mdaffmarmarie_15_44%26os%3DWindowsRemplacé,[368048f22c6dc373ea96da0737cd926e]B10Remplacé,[368048f22c6dc373ea96da0737cd926e]BHome&uref=chmm"]}}), %5 PUP.Optional.SetSearchSetting, C:\Users\Karine\AppData\Roaming\Mozilla\Firefox\Profiles\gkummyzm.default\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\install.rdf, En quarantaine, [15a19e9ceeab270f412306d8c73d8878], PUP.Optional.SetSearchSetting, C:\Users\Karine\AppData\Roaming\Mozilla\Firefox\Profiles\gkummyzm.default\extensions\{9f0e13d8-98ad-4d9d-9d25-049819b552b7}\search.json, En quarantaine, [15a19e9ceeab270f412306d8c73d8878], PUP.Optional.DefaultProtectedSearch, C:\Users\Karine\AppData\Roaming\Mozilla\Firefox\Profiles\gkummyzm.default\prefs.js, Bon : (), Mauvais : (defsearchp@gmail.com), Remplacé,[506657e32277b68087117969da2af40c] PUP.Optional.PrimaryColor, C:\Users\Karine\AppData\Roaming\Opera Software\Opera Stable\Extensions\faemilinkmhbempjjlmemddpjjbgdmcd\1.0.1_0\manifest.json, En quarantaine, [397d92a83267e94d62ac8d51f60e8779], PUP.Optional.PrimaryColor, C:\Users\Karine\AppData\Roaming\Opera Software\Opera Stable\Extensions\faemilinkmhbempjjlmemddpjjbgdmcd\1.0.1_0\background.js, En quarantaine, [397d92a83267e94d62ac8d51f60e8779], PUP.Optional.PrimaryColor, C:\Users\Karine\AppData\Roaming\Opera Software\Opera Stable\Extensions\faemilinkmhbempjjlmemddpjjbgdmcd\1.0.1_0\content.js, En quarantaine, [397d92a83267e94d62ac8d51f60e8779], PUP.Optional.PrimaryColor, C:\Users\Karine\AppData\Roaming\Opera Software\Opera Stable\Extensions\faemilinkmhbempjjlmemddpjjbgdmcd\1.0.1_0\icon.png, En quarantaine, [397d92a83267e94d62ac8d51f60e8779], Secteurs physiques: 0 (Aucun élément malveillant détecté) (end)