ComboFix 16-08-10.01 - chawki 14/08/2016 14:14:31.1.2 - x86 Microsoft Windows 7 Édition Intégrale 6.1.7601.1.1252.33.1036.18.2046.1417 [GMT 2:00] Lancé depuis: c:\users\chawki\Downloads\ComboFix.exe SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Un nouveau point de restauration a été créé . . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\chawki\AppData\Local\Google\Chrome\User Data\Default\Extensions\feeilhmlfcpfchpbgoknoeefdkbgionj c:\users\chawki\AppData\Local\Google\Chrome\User Data\Default\Extensions\feeilhmlfcpfchpbgoknoeefdkbgionj\1.0.0_0\_metadata\computed_hashes.json c:\users\chawki\AppData\Local\Google\Chrome\User Data\Default\Extensions\feeilhmlfcpfchpbgoknoeefdkbgionj\1.0.0_0\_metadata\verified_contents.json c:\users\chawki\AppData\Local\Google\Chrome\User Data\Default\Extensions\feeilhmlfcpfchpbgoknoeefdkbgionj\1.0.0_0\icons\128x128.png c:\users\chawki\AppData\Local\Google\Chrome\User Data\Default\Extensions\feeilhmlfcpfchpbgoknoeefdkbgionj\1.0.0_0\icons\16x16.png c:\users\chawki\AppData\Local\Google\Chrome\User Data\Default\Extensions\feeilhmlfcpfchpbgoknoeefdkbgionj\1.0.0_0\icons\512x512.png c:\users\chawki\AppData\Local\Google\Chrome\User Data\Default\Extensions\feeilhmlfcpfchpbgoknoeefdkbgionj\1.0.0_0\icons\64x64.png c:\users\chawki\AppData\Local\Google\Chrome\User Data\Default\Extensions\feeilhmlfcpfchpbgoknoeefdkbgionj\1.0.0_0\icons\favicon.ico c:\users\chawki\AppData\Local\Google\Chrome\User Data\Default\Extensions\feeilhmlfcpfchpbgoknoeefdkbgionj\1.0.0_0\js\background.js c:\users\chawki\AppData\Local\Google\Chrome\User Data\Default\Extensions\feeilhmlfcpfchpbgoknoeefdkbgionj\1.0.0_0\js\site.js c:\users\chawki\AppData\Local\Google\Chrome\User Data\Default\Extensions\feeilhmlfcpfchpbgoknoeefdkbgionj\1.0.0_0\manifest.json c:\users\chawki\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_feeilhmlfcpfchpbgoknoeefdkbgionj_0.localstorage-journal c:\users\chawki\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_feeilhmlfcpfchpbgoknoeefdkbgionj_0.localstorage c:\users\chawki\AppData\Local\Google\Chrome\User Data\Default\Preferences c:\users\chawki\AppData\Roaming\Inchtech.exe c:\users\chawki\AppData\Roaming\Voyabam.exe c:\users\chawki\AppData\Roaming\Whitetech.bin c:\users\chawki\AppData\Roaming\Zerhold.bin c:\windows\run.vbs . . ((((((((((((((((((((((((((((( Fichiers créés du 2016-07-14 au 2016-08-14 )))))))))))))))))))))))))))))))))))) . . 2016-08-14 12:27 . 2016-08-14 12:27 -------- d-----w- c:\users\chawki\AppData\Local\temp 2016-08-14 12:27 . 2016-08-14 12:27 -------- d-----w- c:\users\Default\AppData\Local\temp 2016-08-12 15:58 . 2016-08-12 15:58 -------- d-----w- c:\program files\iPod 2016-08-12 15:58 . 2016-08-12 15:58 -------- d-----w- c:\program files\iTunes 2016-08-12 15:34 . 2016-08-12 15:34 -------- d-----w- c:\programdata\FonePaw 2016-08-12 15:34 . 2016-08-12 15:34 -------- d-----w- c:\program files\FonePaw 2016-08-12 14:50 . 2016-08-12 15:35 -------- d-----w- c:\users\chawki\AppData\Local\FonePaw 2016-08-12 00:59 . 2015-09-14 12:03 38520 ----a-w- c:\windows\system32\drivers\DasPtct.SYS 2016-08-12 00:59 . 2016-08-12 00:59 -------- d-----w- c:\program files\Panda Security 2016-08-12 00:09 . 2016-08-12 00:09 24688 ----a-w- c:\windows\system32\drivers\TrueSight.sys 2016-08-12 00:09 . 2016-08-12 00:09 -------- d-----w- c:\programdata\RogueKiller 2016-08-11 14:20 . 2016-08-11 14:20 -------- d-----w- c:\users\chawki\AppData\Local\UCBrowser 2016-08-11 14:20 . 2016-08-02 06:55 72064 ----a-w- c:\windows\system32\drivers\ucguard.sys 2016-08-11 14:20 . 2016-08-11 15:29 -------- d-----w- c:\program files\UCBrowser 2016-08-11 14:19 . 2016-08-11 14:19 -------- d--h--w- c:\program files\r5z4A0C 2016-08-11 14:19 . 2016-08-11 14:19 -------- d-----w- c:\program files\SoEasySvc 2016-08-11 14:18 . 2016-08-11 14:19 -------- d-----w- c:\users\chawki\AppData\Roaming\Profiles 2016-08-11 14:18 . 2016-08-11 14:19 -------- d-----w- c:\users\chawki\AppData\Local\bumosyreoqeentdrhge 2016-08-11 14:17 . 2016-08-13 00:50 -------- d-----w- c:\program files\Rafucult 2016-08-11 14:13 . 2016-08-12 00:45 -------- d-----w- c:\users\chawki\AppData\Local\app 2016-08-11 14:12 . 2016-08-11 14:12 -------- d-----w- c:\program files\sbqh 2016-08-11 14:09 . 2016-08-11 14:09 -------- d-----w- c:\program files\Common Files\Hotflex 2016-08-11 13:33 . 2016-08-12 14:13 -------- d-----w- c:\users\chawki\AppData\Roaming\WindSolutions 2016-08-11 13:33 . 2016-08-11 13:37 -------- d-----w- c:\programdata\WindSolutions 2016-08-11 08:46 . 2016-08-11 08:46 -------- d-----w- c:\users\chawki\AppData\Local\Apple Computer 2016-08-11 08:46 . 2016-08-11 13:28 -------- d-----w- c:\users\chawki\AppData\Roaming\Apple Computer 2016-08-11 08:46 . 2016-08-11 08:46 -------- d-----w- c:\programdata\Apple Computer 2016-08-11 08:45 . 2016-08-11 08:45 -------- d-----w- c:\users\chawki\AppData\Local\Apple 2016-08-11 08:45 . 2016-08-11 08:45 -------- d-----w- c:\program files\Apple Software Update 2016-08-11 08:44 . 2016-08-11 08:44 -------- d-----w- c:\program files\Bonjour 2016-08-11 08:44 . 2016-08-12 15:58 -------- d-----w- c:\program files\Common Files\Apple 2016-08-11 08:44 . 2016-08-11 08:45 -------- d-----w- c:\programdata\Apple 2016-08-11 01:47 . 2016-08-11 01:47 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2323ADED-77C8-4503-BCE1-E4DDFFD3555D}\offreg.1340.dll 2016-07-21 01:36 . 2016-07-21 01:36 -------- d-----w- c:\users\chawki\AppData\Local\ElevatedDiagnostics . . . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2016-08-10 20:23 . 2016-02-16 01:42 796352 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2016-08-10 20:23 . 2016-02-16 01:42 142528 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2016-07-12 00:29 . 2016-07-12 00:29 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2323ADED-77C8-4503-BCE1-E4DDFFD3555D}\offreg.268.dll 2016-07-10 00:41 . 2016-07-10 00:41 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2323ADED-77C8-4503-BCE1-E4DDFFD3555D}\offreg.2512.dll 2016-07-05 00:22 . 2016-07-05 00:22 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2323ADED-77C8-4503-BCE1-E4DDFFD3555D}\offreg.1484.dll 2016-07-03 00:14 . 2016-07-03 00:14 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2323ADED-77C8-4503-BCE1-E4DDFFD3555D}\offreg.3960.dll 2016-07-02 00:17 . 2016-07-02 00:17 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2323ADED-77C8-4503-BCE1-E4DDFFD3555D}\offreg.872.dll 2016-07-01 00:18 . 2016-07-01 00:18 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2323ADED-77C8-4503-BCE1-E4DDFFD3555D}\offreg.3660.dll 2016-06-30 01:23 . 2016-06-30 01:23 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2323ADED-77C8-4503-BCE1-E4DDFFD3555D}\offreg.1996.dll 2016-06-24 02:59 . 2016-06-24 02:59 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2323ADED-77C8-4503-BCE1-E4DDFFD3555D}\offreg.924.dll 2016-06-21 02:48 . 2016-06-21 02:48 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2323ADED-77C8-4503-BCE1-E4DDFFD3555D}\offreg.3428.dll 2016-06-18 02:01 . 2016-06-18 02:01 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2323ADED-77C8-4503-BCE1-E4DDFFD3555D}\offreg.2604.dll 2016-06-15 01:12 . 2016-06-10 01:16 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2323ADED-77C8-4503-BCE1-E4DDFFD3555D}\offreg.2476.dll 2016-06-14 02:40 . 2016-06-14 02:40 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2323ADED-77C8-4503-BCE1-E4DDFFD3555D}\offreg.2528.dll 2016-06-12 00:28 . 2016-06-12 00:28 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2323ADED-77C8-4503-BCE1-E4DDFFD3555D}\offreg.2584.dll 2016-06-11 00:09 . 2016-06-11 00:09 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2323ADED-77C8-4503-BCE1-E4DDFFD3555D}\offreg.3340.dll 2016-06-10 02:41 . 2016-06-10 02:41 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2323ADED-77C8-4503-BCE1-E4DDFFD3555D}\offreg.3812.dll 2016-06-07 02:36 . 2016-06-07 02:36 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2323ADED-77C8-4503-BCE1-E4DDFFD3555D}\offreg.1024.dll 2016-06-02 00:20 . 2016-06-02 00:20 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2323ADED-77C8-4503-BCE1-E4DDFFD3555D}\offreg.832.dll 2016-05-25 00:35 . 2016-05-25 00:35 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2323ADED-77C8-4503-BCE1-E4DDFFD3555D}\offreg.1908.dll . [code]
c:\program files\Tonec Inc., Copyright © 1999 - 2015\Internet Download Manager\IDMan .exe
[/code] . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ IDM Shell Extension] @="{CDC95B92-E27C-4745-A8C5-64A52A78855D}" [HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}] 2015-08-14 10:52 23520 ----a-w- c:\program files\Internet Download Manager\IDMShellExt.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IDMan"="c:\program files\Tonec Inc." [X] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016] "ComputerZ-Tray"="c:\program files\LuDaShi\ComputerZTray.exe" [2016-07-21 2949032] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "tsnpstd3"="c:\windows\tsnpstd3.exe" [2009-03-10 262144] "snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-18 843776] "apphide"="c:\program files\sbqh\uc.exe" [2016-08-02 233520] "FonePaw iPhone Data RecoveryAppService"="c:\program files\FonePaw\FonePaw iPhone Data Recovery\AppService.exe" [2015-08-14 79464] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2016-07-26 164152] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2016-02-15 280576] . c:\users\chawki\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ SystemSettings.exe.tmp [2016-8-12 20480] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . R2 CidighdosaModuleGjg.exe;Cidighdosa Module;c:\program files\Rafucult\CidighdosaModuleGjg.exe {C25DA384-2010-45A4-A1ED-BFA540D4789B} {9DC74CD5-24EA-4ADE-9C42-608A8CE17116} [x] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2016-02-16 102912] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] S1 UCGuard;UCGuard;c:\windows\system32\DRIVERS\ucguard.sys [2016-08-02 72064] S2 ComputerZLock;ComputerZLock;c:\program files\LuDaShi\ComputerZLock.sys [2016-05-19 40168] S2 HpSvc;Hardware Protection Service;c:\windows\System32\svchost.exe [2009-07-14 20992] S2 KuaiZipDrive2;KuaiZipDrive2;c:\windows\system32\drivers\KuaiZipDrive2.sys [2016-08-11 68368] S2 RosettaStoneDaemon;RosettaStoneDaemon;c:\program files\RosettaStoneLtdServices\RosettaStoneDaemon.exe [2012-06-19 1646608] S2 SoEasySvc;SoEasySvc;c:\program files\SoEasySvc\SoEasySvc.exe {8DE54EC4-2DF3-4F56-9F19-EBC2BDF2FF59} [x] S3 ComputerZ;ComputerZ;c:\program files\LuDaShi\ComputerZ.sys [2016-06-27 47616] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] kuaizip2updatesvc REG_MULTI_SZ Kuaizip Update Checker . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs HpSvc . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2016-08-08 22:24 1262408 ----a-w- c:\program files\Google\Chrome\Application\52.0.2743.116\Installer\chrmstp.exe . Contenu du dossier 'Tâches planifiées' . 2016-08-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2016-05-12 18:05] . 2016-08-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2016-05-12 18:05] . 2016-08-14 c:\windows\Tasks\UCBrowserUpdater.job - c:\program files\UCBrowser\Application\update_task.exe [2016-08-11 06:00] . . ------- Examen supplémentaire ------- . uStart Page = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoH2TlPbfGRogFokxBZm9hvK3Km0sRIjmP4t2BP3BBglHuDQbEyQf7RtWWZ8mbiPDICSZv7pPZXXtQlH5hWTi1cKuXppt7ieR-DUtWQra1pf5AePM5r-GsrlAKY0bMIp-Y-M5WPvhzW5g8qf8IxjdQwVYLQ4Bjquuq0_o4yPgVQ,, uInternet Settings,ProxyOverride = *.local IE: Télécharger avec IDM - c:\program files\Tonec Inc., Copyright © 1999 - 2015\Internet Download Manager\IEExt.htm IE: Télécharger tous les liens avec IDM - c:\program files\Tonec Inc., Copyright © 1999 - 2015\Internet Download Manager\IEGetAll.htm LSP: chtbrkg.dll TCP: DhcpNameServer = 192.168.1.1 0.0.0.0 FF - ProfilePath - c:\users\chawki\AppData\Roaming\Mozilla\Firefox\Profiles\pe4jzj4g.default\ FF - prefs.js: browser.startup.homepage - c:\programdata\Quoteexs\ff.HP . - - - - ORPHELINS SUPPRIMES - - - - . ShellIconOverlayIdentifiers-{056D528D-CE28-4194-9BA3-BA2E9197FF8C} - c:\users\chawki\AppData\Local\MEGAsync\ShellExtX32.dll ShellIconOverlayIdentifiers-{05B38830-F4E9-4329-978B-1DD28605D202} - c:\users\chawki\AppData\Local\MEGAsync\ShellExtX32.dll ShellIconOverlayIdentifiers-{0596C850-7BDD-4C9D-AFDF-873BE6890637} - c:\users\chawki\AppData\Local\MEGAsync\ShellExtX32.dll ShellIconOverlayIdentifiers-{AAA0C5B8-933F-4200-93AD-B143D7FFF9F3} - c:\program files\KuaiZip\X86\KZipShell.dll AddRemove-DriverEasy_is1 - c:\program files\Easeware\DriverEasy\unins000.exe AddRemove-Internet Download Manager 6, 25, 2, 2 - c:\program files\Tonec Inc. . . . ************************************************************************** . Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net Windows 6.1.7601 . CreateFile("\\.\PHYSICALDRIVE0"): Le processus ne peut pas accéder au fichier car ce fichier est utilisé par un autre processus. device: opened successfully user: error reading MBR kernel: MBR read successfully user != kernel MBR !!! . ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- . [HKEY_USERS\S-1-5-21-1525682710-1008469388-749619866-1001_Classes\CLSID\{4b1259a3-3815-4c42-91c7-b9ece31f14b6}] @Denied: (Full) (Everyone) . [HKEY_USERS\S-1-5-21-1525682710-1008469388-749619866-1001_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}] @Denied: (Full) (Everyone) "scansk"=hex(0):67,46,9c,5f,1d,20,57,4f,05,d1,20,6c,bc,13,1e,93,69,e5,fa,dc,06, 3a,37,2d,5e,86,a6,c7,35,60,35,3d,65,c7,87,fa,90,3f,83,ab,00,00,00,00,00,00,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Heure de fin: 2016-08-14 14:28:48 ComboFix-quarantined-files.txt 2016-08-14 12:28 . Avant-CF: 240 407 306 240 octets libres Après-CF: 240 388 931 584 octets libres . - - End Of File - - ADBFC41B7BF988A6A2EE35C7563E158A A36C5E4F47E84449FF07ED3517B43A31