ComboFix 18-03-14.01 - user 07/04/2018 21:08:46.1.2 - x86 Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.3326.2530 [GMT 2:00] Lancé depuis: c:\documents and settings\user\Bureau\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !! . . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\system32\SET41A.tmp c:\windows\system32\SET428.tmp c:\windows\system32\SET429.tmp c:\windows\system32\SET43D.tmp . . ((((((((((((((((((((((((((((( Fichiers créés du 2018-03-07 au 2018-04-07 )))))))))))))))))))))))))))))))))))) . . 2018-04-07 12:28 . 2018-04-07 12:28 -------- d-----w- c:\documents and settings\user\Application Data\CodeBlocks 2018-04-07 10:40 . 2018-04-07 13:23 -------- d-----w- C:\FRST 2018-04-06 15:58 . 2018-04-06 16:05 -------- d-----w- c:\documents and settings\user\Application Data\ZHP 2018-04-06 15:58 . 2018-04-06 15:58 -------- d-----w- c:\documents and settings\user\Local Settings\Application Data\ZHP 2018-04-06 10:48 . 2018-04-06 11:02 -------- d-----w- c:\documents and settings\user\Application Data\inkscape 2018-04-05 18:08 . 2018-04-05 18:08 -------- d-----w- c:\documents and settings\user\Local Settings\Application Data\Adobe 2018-03-25 15:52 . 2018-03-25 16:11 -------- d-----w- c:\documents and settings\user\Local Settings\Application Data\WMTools Downloaded Files 2018-03-25 12:59 . 2018-03-25 12:59 -------- d-----w- c:\documents and settings\user\.thumbnails 2018-03-25 12:57 . 2018-03-25 13:19 -------- d-----w- c:\documents and settings\user\Local Settings\Application Data\gtk-2.0 2018-03-25 12:56 . 2018-03-25 12:56 -------- d-----w- c:\documents and settings\user\Local Settings\Application Data\fontconfig 2018-03-25 12:55 . 2018-03-25 16:32 -------- d-----w- c:\documents and settings\user\.gimp-2.8 2018-03-25 12:55 . 2018-03-25 12:55 -------- d-----w- c:\documents and settings\user\Local Settings\Application Data\gegl-0.2 2018-03-24 16:52 . 2018-03-24 16:52 -------- d-----w- c:\documents and settings\user\Application Data\FastStone 2018-03-13 16:58 . 2018-03-13 16:58 -------- d-sh--w- c:\documents and settings\user\IECompatCache 2018-03-11 15:53 . 2018-03-11 15:53 -------- d-----w- c:\program files\Lame For Audacity . . . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2018-02-14 18:46 . 2018-02-14 18:46 113280 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VCExpress\9.0\1036\ResourceCache.dll 2018-02-14 18:45 . 2018-02-14 18:45 416 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1036\ResourceCache.dll . . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2015-11-03 17:59 749192 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2009-01-26 16858112] "Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-13 143872] "AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-11-03 7004376] "BabyGoCP"="c:\program files\FreeAngel\FreeAngel.exe" [2008-05-30 578560] "Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2014-05-08 959904] "Microsoft Works Update Detection"="c:\program files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 50688] "SunJavaUpdateSched"="c:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2016-12-12 587288] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360] . c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\ Utilitaire de configuration sans fil TP-LINK.lnk - c:\program files\TP-LINK\Utilitaire de configuration sans fil TP-LINK\TWCU.exe -nogui [2015-6-9 848384] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "SoftwareSASGeneration"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-794017837-3131750297-2016117228-1299\Scripts\Logon\0\0] "Script"=\\netarseaa.lcl\SYSVOL\netarseaa.lcl\scripts\MAILINBLACK.BAT . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-794017837-3131750297-2016117228-1299\Scripts\Logon\1\0] "Script"=Connexion-YPareo.cmd . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-794017837-3131750297-2016117228-1302\Scripts\Logon\0\0] "Script"=\\netarseaa.lcl\SYSVOL\netarseaa.lcl\scripts\MAILINBLACK.BAT . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-794017837-3131750297-2016117228-1302\Scripts\Logon\1\0] "Script"=Connexion-YPareo.cmd . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-794017837-3131750297-2016117228-1363\Scripts\Logon\0\0] "Script"=\\netarseaa.lcl\SYSVOL\netarseaa.lcl\scripts\MAILINBLACK.BAT . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-794017837-3131750297-2016117228-7641\Scripts\Logon\0\0] "Script"=\\netarseaa.lcl\SYSVOL\netarseaa.lcl\scripts\MAILINBLACK.BAT . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-794017837-3131750297-2016117228-7641\Scripts\Logon\1\0] "Script"=Connexion-YPareo.cmd . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Office\\Office12\\OUTLOOK.EXE"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= . R0 aswRvrt;avast! Revert;c:\windows\system32\drivers\aswRvrt.sys [10/06/2015 18:43 49776] R0 aswVmm;avast! VM Monitor;c:\windows\system32\drivers\aswVmm.sys [10/06/2015 18:43 209432] R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [10/06/2015 18:43 794952] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [10/06/2015 18:43 435464] R2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [10/06/2015 18:43 24016] R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [10/06/2015 18:43 81168] R2 vnccom;vnccom;c:\windows\system32\drivers\vnccom.SYS [11/06/2009 14:19 6016] R3 aswStmXP;Avast StreamFilter Driver;c:\windows\system32\drivers\aswStmXP.sys [05/09/2015 07:55 167152] R3 RtlWlanu;Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\drivers\RTWlanU.sys [09/06/2015 20:27 1345936] S2 FusionInventory-Agent;FusionInventory-Agent;c:\program files\FusionInventory-Agent\perl\bin\perl.exe [08/01/2013 14:13 9728] . Contenu du dossier 'Tâches planifiées' . 2018-04-07 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-06-24 18:45] . 2018-04-07 c:\windows\Tasks\Avast Emergency Update.job - c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2015-11-03 17:07] . 2018-04-07 c:\windows\Tasks\Notification de fin de service de Microsoft Windows XP - à la connexion.job - c:\windows\system32\xp_eos.exe [2015-06-10 23:28] . 2017-10-08 c:\windows\Tasks\Notification de fin de service de Microsoft Windows XP -mensuellement.job - c:\windows\system32\xp_eos.exe [2015-06-10 23:28] . . ------- Examen supplémentaire ------- . mStart Page = https://www.google.com/?trackid=sp-006 mSearch Bar = https://www.google.com/?trackid=sp-006 IE: E&xporter vers Microsoft Excel - c:\progra~1\Office\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.1.254 FF - ProfilePath - c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\gwdargbu.default\ FF - prefs.js: browser.startup.homepage - google.com . . ------- Associations de fichier ------- . vbefile\shell\open2\command=%SystemRoot%\System32\CScript.exe "%1" %* . - - - - ORPHELINS SUPPRIMES - - - - . Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) AddRemove-Microsoft Visual C++ 2008 Express Edition - FRA - c:\program files\Microsoft Visual Studio 9.0\Microsoft Visual C++ 2008 Express Edition - FRA\setup.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2018-04-07 21:15 Windows 5.1.2600 Service Pack 3 NTFS . Recherche de processus cachés ... . Recherche d'éléments en démarrage automatique cachés ... . Recherche de fichiers cachés ... . Scan terminé avec succès Fichiers cachés: 0 . ************************************************************************** . Heure de fin: 2018-04-07 21:17:07 ComboFix-quarantined-files.txt 2018-04-07 19:17 . Avant-CF: 122 069 053 440 octets libres Après-CF: 122 032 562 176 octets libres . - - End Of File - - 82D3B33786A3E470DBDFD00AA1CB4916 8F558EB6672622401DA993E1E865C861