ComboFix 17-05-24.14 - mohamed 28/06/2017 22:16:01.2.2 - x86 Microsoft Windows 7 Édition Familiale Basique 6.1.7601.1.1252.33.1036.18.3053.1201 [GMT 2:00] Lancé depuis: c:\users\mohamed\Desktop\ComboFix.exe AV: Avast Antivirus *Disabled/Updated* {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF} FW: Avast Antivirus *Disabled* {B693136B-F6EE-DD1C-A0EF-229B8B0B29C4} SP: Avast Antivirus *Disabled/Updated* {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((( Fichiers créés du 2017-05-28 au 2017-06-28 )))))))))))))))))))))))))))))))))))) . . 2017-06-28 20:27 . 2017-06-28 20:27 -------- d-----w- c:\users\Default\AppData\Local\temp 2017-06-28 09:53 . 2017-06-28 09:53 -------- d-----r- C:\MSOCache 2017-06-28 06:34 . 2017-06-28 06:34 -------- d-----w- c:\programdata\SWCUTemp 2017-06-20 09:36 . 2017-06-28 12:30 -------- d-----w- c:\programdata\boost_interprocess 2017-06-19 20:02 . 2017-06-19 20:02 -------- d-----w- c:\program files\Supercopier 2017-06-19 09:58 . 2017-06-28 11:09 -------- d-----w- c:\programdata\Apple Computer 2017-06-19 09:57 . 2017-06-19 09:58 -------- d-----w- c:\program files\MpcStar 2017-06-18 16:01 . 2017-06-28 09:57 -------- d-----w- c:\program files\Microsoft Works 2017-06-18 16:01 . 2017-06-18 16:01 -------- d-----w- c:\windows\PCHEALTH 2017-06-18 15:59 . 2017-06-18 15:59 -------- d-----w- c:\program files\Microsoft Visual Studio 8 2017-06-18 15:59 . 2017-06-18 16:01 -------- d-----w- c:\windows\SHELLNEW 2017-06-18 15:59 . 2017-06-28 09:59 -------- d-----w- c:\programdata\Microsoft Help 2017-06-18 09:46 . 2017-06-18 09:45 391048 ----a-w- c:\windows\system32\drivers\aswNetSec.sys 2017-06-18 09:45 . 2017-06-17 22:32 330768 ----a-w- c:\windows\system32\aswBoot.exe 2017-06-18 09:45 . 2017-06-18 09:45 27896 ----a-w- c:\windows\system32\drivers\aswNetNd6.sys 2017-06-18 07:25 . 2017-06-18 07:25 31064 ----a-w- c:\windows\system32\drivers\aswKbd.sys 2017-06-18 03:12 . 2017-06-17 17:19 -------- d-----w- c:\windows\Panther 2017-06-18 03:12 . 2017-06-18 03:12 -------- d-----w- C:\Boot 2017-06-17 22:27 . 2017-06-18 07:25 -------- d-----w- c:\program files\AVAST Software 2017-06-17 22:26 . 2017-06-18 09:22 -------- d-----w- c:\programdata\AVAST Software 2017-06-17 19:58 . 2017-06-17 19:58 -------- d-----w- c:\program files\PlayReady 2017-06-17 19:57 . 2017-06-17 19:57 -------- d-----w- c:\program files\Microsoft Silverlight 2017-06-17 19:56 . 2017-06-17 19:56 -------- d-----w- c:\programdata\Package Cache 2017-06-17 19:14 . 2017-06-17 19:14 -------- d-----w- c:\programdata\IDM 2017-06-17 19:14 . 2017-06-18 07:22 -------- d-----w- c:\program files\Internet Download Manager 2017-06-17 19:12 . 2017-06-18 16:01 -------- d-----w- c:\program files\Microsoft.NET 2017-06-17 19:12 . 2017-06-17 19:12 -------- d-----w- c:\windows\Migration 2017-06-17 19:11 . 2017-04-27 22:50 3550208 ----a-w- c:\windows\system32\D3DCompiler_47.dll 2017-06-17 19:05 . 2017-06-17 19:05 -------- d-----w- c:\program files\Common Files\Java 2017-06-17 19:05 . 2017-06-17 19:05 95808 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2017-06-17 19:05 . 2017-06-17 19:05 -------- d-----w- c:\program files\Java 2017-06-17 19:05 . 2017-06-17 19:05 -------- d-----w- c:\programdata\Oracle 2017-06-17 18:58 . 2017-06-17 18:59 -------- d-----w- c:\program files\Google 2017-06-17 18:58 . 2017-06-28 11:08 -------- d-----w- c:\program files\Opera 2017-06-17 18:57 . 2017-06-18 13:29 803328 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2017-06-17 18:57 . 2017-06-18 13:29 144896 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2017-06-17 18:57 . 2017-06-18 13:29 -------- d-----w- c:\windows\system32\Macromed 2017-06-17 18:57 . 2017-06-17 18:57 -------- d-----w- c:\program files\DAUM 2017-06-17 18:56 . 2017-06-28 11:09 -------- d-sh--w- c:\windows\Installer 2017-06-17 18:52 . 2017-06-17 18:51 10555024 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5BEDBF91-70E0-4377-9910-A33108013E45}\mpengine.dll 2017-06-17 17:27 . 2017-06-17 17:27 -------- d-----w- c:\program files\Mozilla Maintenance Service 2017-06-08 16:59 . 2017-06-08 16:15 148104 ----a-w- c:\windows\system32\drivers\idmwfp.sys . . . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2017-05-04 11:18 . 2017-05-04 11:18 52680 ----a-w- c:\windows\system32\drivers\EpfwLWF.sys 2017-04-21 12:53 . 2017-04-21 12:53 29376 ----a-w- c:\windows\system32\aspnet_counters.dll 2017-04-21 12:53 . 2017-04-21 12:53 18600 ----a-w- c:\windows\system32\msvcr110_clr0400.dll 2017-04-21 12:53 . 2017-04-21 12:53 18600 ----a-w- c:\windows\system32\msvcr100_clr0400.dll 2017-04-21 12:53 . 2017-04-21 12:53 18600 ----a-w- c:\windows\system32\msvcp110_clr0400.dll 2017-04-20 18:09 . 2017-04-20 18:09 987840 ----a-w- c:\windows\system32\msvcr120_clr0400.dll 2017-04-20 18:09 . 2017-04-20 18:09 485576 ----a-w- c:\windows\system32\msvcp120_clr0400.dll . . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ IDM Shell Extension] @="{CDC95B92-E27C-4745-A8C5-64A52A78855D}" [HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}] 2015-08-14 14:52 23520 ----a-w- c:\program files\Internet Download Manager\IDMShellExt.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00asw] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2017-06-17 22:32 1192144 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SysinfY2X"="start wscript" [X] "IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2017-06-08 4015216] "uTorrent"="c:\users\mohamed\AppData\Roaming\uTorrent\uTorrent.exe" [2017-06-18 1984448] "ultracopier"="c:\program files\Supercopier\supercopier.exe" [2016-01-01 1160192] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2017-03-15 587288] "AvastUI.exe"="c:\program files\AVAST Software\Avast\AvLaunch.exe" [2017-06-17 213824] . c:\users\mohamed\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ MyCashBar.appref-ms [2017-6-18 306] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2017-06-17 115152] R3 aswbIDSAgent;aswbIDSAgent;c:\program files\AVAST Software\Avast\aswidsagent.exe [2017-06-17 5732136] R3 aswHwid;aswHwid;c:\windows\system32\drivers\aswHwid.sys [2017-06-17 34136] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264] S0 aswbidsh;aswbidsh;c:\windows\\SystemRoot\system32\drivers\aswbidshx.sys [x] S0 aswblog;aswblog;c:\windows\\SystemRoot\system32\drivers\aswblogx.sys [x] S0 aswbuniv;aswbuniv;c:\windows\\SystemRoot\system32\drivers\aswbunivx.sys [x] S0 aswRvrt;aswRvrt;c:\windows\\SystemRoot\system32\drivers\aswRvrt.sys [x] S0 aswVmm;aswVmm;c:\windows\\SystemRoot\system32\drivers\aswVmm.sys [x] S1 aswbidsdriver;aswbidsdriver;c:\windows\system32\drivers\aswbidsdriverx.sys [2017-06-17 258288] S1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [2017-06-18 31064] S1 aswNetSec;aswNetSec;c:\windows\system32\drivers\aswNetSec.sys [2017-06-18 391048] S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2017-06-17 764576] S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2017-06-17 482608] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2017-06-17 107928] S2 avast! Firewall;Avast Firewall Service;c:\program files\AVAST Software\Avast\afwServ.exe [2017-06-18 310496] S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [2017-06-08 148104] S3 aswNetNd6;Avast Firewall NDIS6 Helper;c:\windows\system32\DRIVERS\aswNetNd6.sys [2017-06-18 27896] . . --- Autres Services/Pilotes en mémoire --- . *NewlyCreated* - 28972376 *Deregistered* - 28972376 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc SensrSvc . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2017-06-17 18:59 1394008 ----a-w- c:\program files\Google\Chrome\Application\59.0.3071.104\Installer\chrmstp.exe . . ------- Examen supplémentaire ------- . uInternet Settings,ProxyServer = 91.121.162.173:80 IE: Télécharger avec IDM - c:\program files\Internet Download Manager\IEExt.htm IE: Télécharger tous les liens avec IDM - c:\program files\Internet Download Manager\IEGetAll.htm TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\mohamed\AppData\Roaming\Mozilla\Firefox\Profiles\10rbrwz2.default\ . . --------------------- CLES DE REGISTRE BLOQUEES --------------------- . [HKEY_USERS\S-1-5-21-3225286026-1542302421-2383450491-1000_Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}] @Denied: (Full) (Everyone) @Allowed: (Read) (RestrictedCode) "scansk"=hex(0):1f,9a,51,66,48,f8,af,ee,85,e8,75,1c,b5,9b,53,51,64,d5,73,62,14, dc,be,29,2a,52,08,2d,c5,ee,5c,8c,63,e9,50,07,da,17,5b,63,00,00,00,00,00,00,\ . [HKEY_USERS\S-1-5-21-3225286026-1542302421-2383450491-1000_Classes\CLSID\{74b7af2b-9c9e-489c-929c-fc622bcfe11e}] @Denied: (Full) (Everyone) @Allowed: (Read) (RestrictedCode) "Model"=dword:000000b2 "Therad"=dword:0000000c . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Heure de fin: 2017-06-28 22:36:32 ComboFix-quarantined-files.txt 2017-06-28 20:36 . Avant-CF: 53 962 342 400 octets libres Après-CF: 53 963 264 000 octets libres . - - End Of File - - 324E93BB7A05BE63501D041E3CE02C2C A36C5E4F47E84449FF07ED3517B43A31