ComboFix 17-05-04.01 - acer 15/12/2018 20:08:07.1.4 - x86 Microsoft Windows 7 Professionnel 6.1.7600.0.1252.33.1036.18.2670.1420 [GMT 1:00] Lancé depuis: c:\users\acer\Desktop\combofix-17-5-4-1.exe AV: Malwarebytes *Disabled/Updated* {23007AD3-69FE-687C-2629-D584AFFAF72B} SP: Malwarebytes *Disabled/Updated* {98619B37-4FC4-67F2-1C99-EEF6D47DBD96} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files\ma-config.com c:\program files\ma-config.com\config.xml c:\programdata\ma-config.com c:\programdata\ma-config.com\Logs\activex.txt c:\programdata\ma-config.com\Logs\maconfservice.txt c:\programdata\ma-config.com\Logs\mcdetection.txt c:\programdata\ma-config.com\Logs\mcstubuser.txt c:\programdata\ma-config.com\Logs\npapi.txt c:\programdata\ma-config.com\Temp\componenttemp.gz c:\users\acer\Documents\~yt8E6D.tmp c:\users\acer\Documents\~ytFA1C.tmp c:\windows\system32\Packet.dll c:\windows\system32\pthreadVC.dll c:\windows\system32\wpcap.dll E:\360Downloads . . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Legacy_NPF -------\Service_npf . . ((((((((((((((((((((((((((((( Fichiers créés du 2018-11-15 au 2018-12-15 )))))))))))))))))))))))))))))))))))) . . 2018-12-15 19:21 . 2018-12-15 19:21 63760 ----a-w- c:\windows\system32\drivers\mbam.sys 2018-12-15 19:21 . 2018-12-15 19:21 172280 ----a-w- c:\windows\system32\drivers\MbamChameleon.sys 2018-12-15 19:21 . 2018-12-15 19:21 106144 ----a-w- c:\windows\system32\drivers\farflt.sys 2018-12-15 19:19 . 2018-12-15 19:36 -------- d-----w- c:\users\acer\AppData\Local\temp 2018-12-15 18:50 . 2018-12-15 19:21 230120 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2018-12-09 21:15 . 2018-12-15 19:21 60016 ----a-w- c:\windows\system32\drivers\EnigmaFileMonDriver.sys 2018-12-09 21:15 . 2018-12-13 19:12 -------- d-----w- c:\programdata\EnigmaSoft Limited 2018-12-09 21:13 . 2018-12-09 21:14 -------- d-----w- C:\sh5ldr 2018-12-09 20:37 . 2018-12-09 20:52 -------- d-----w- c:\program files\EnigmaSoft 2018-12-08 22:17 . 2018-12-08 22:46 -------- d-----w- C:\Pre_Scan 2018-12-07 16:16 . 2018-12-07 16:16 -------- d-----w- c:\users\acer\AppData\Local\ESET 2018-12-07 16:09 . 2018-12-12 16:33 -------- d-----w- c:\program files\ESET 2018-12-07 16:04 . 2018-12-07 16:04 -------- d-----w- c:\program files\7-Zip 2018-12-07 00:06 . 2018-12-07 00:06 -------- d-----w- c:\users\acer\AppData\Roaming\addpcs 2018-12-04 23:15 . 2018-12-05 05:16 -------- d-----w- C:\[Smad-Cage] 2018-12-04 23:15 . 2018-12-04 23:15 -------- d-----w- c:\users\acer\AppData\Roaming\Smadav 2018-12-04 23:15 . 2018-12-04 23:15 -------- d-----w- c:\program files\SMADAV 2018-12-04 21:50 . 2018-12-04 21:50 -------- d-----w- c:\users\acer\AppData\Local\mbam 2018-12-01 16:45 . 2018-12-01 16:46 -------- d-----w- c:\program files\Common Files\Atheros 2018-11-30 11:28 . 2018-11-30 11:28 -------- d-----w- c:\users\acer\AppData\Local\MagicScreen 2018-11-30 11:20 . 2018-11-30 11:37 -------- d-----w- c:\programdata\inst 2018-11-26 20:27 . 2018-11-26 20:27 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83C400E9-6261-4140-9F19-700431C10195}\offreg.4360.dll 2018-11-24 12:25 . 2018-11-24 12:25 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83C400E9-6261-4140-9F19-700431C10195}\offreg.2844.dll 2018-11-23 16:42 . 2018-12-06 23:09 -------- d-----w- c:\users\acer\AppData\Local\CrashDumps 2018-11-20 19:44 . 2018-12-01 20:28 -------- d-----w- c:\program files\Bluetooth Suite 2018-11-20 19:39 . 2018-11-20 19:39 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83C400E9-6261-4140-9F19-700431C10195}\offreg.4308.dll . . . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2018-12-05 23:06 . 2016-06-21 23:01 842240 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2018-12-05 23:06 . 2016-06-21 23:01 175104 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2018-11-20 19:45 . 2011-09-16 14:16 246804 ----a-w- c:\windows\system32\drivers\AtherosBt.bin 2018-11-10 12:10 . 2018-11-10 12:10 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83C400E9-6261-4140-9F19-700431C10195}\offreg.4932.dll 2018-11-07 17:44 . 2018-11-07 17:44 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83C400E9-6261-4140-9F19-700431C10195}\offreg.4124.dll 2018-10-27 21:29 . 2018-10-27 21:29 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83C400E9-6261-4140-9F19-700431C10195}\offreg.4276.dll 2018-10-26 11:01 . 2018-10-26 11:01 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83C400E9-6261-4140-9F19-700431C10195}\offreg.4672.dll 2018-10-19 12:00 . 2018-10-19 12:00 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83C400E9-6261-4140-9F19-700431C10195}\offreg.5296.dll 2018-10-17 14:37 . 2018-10-17 14:37 54240 ----a-w- c:\windows\system32\drivers\EpfwLWF.sys 2018-09-22 14:57 . 2018-09-22 14:57 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83C400E9-6261-4140-9F19-700431C10195}\offreg.5256.dll . . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1] @="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}" [HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}] 2014-10-23 19:22 223432 ----a-w- c:\users\acer\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2] @="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}" [HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}] 2014-10-23 19:22 223432 ----a-w- c:\users\acer\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3] @="{BBACC218-34EA-4666-9D7A-C78F2274A524}" [HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}] 2014-10-23 19:22 223432 ----a-w- c:\users\acer\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension] @="{CDC95B92-E27C-4745-A8C5-64A52A78855D}" [HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}] 2012-02-08 00:49 22376 ----a-w- c:\program files\Internet Download Manager\IDMShellExt.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CONNMGRTRAY"="c:\program files\Acer\Acer 3G Connection Manager\ConnMgrLauncher.exe" [2011-06-20 363112] "CCleaner Monitoring"="c:\program files\CCleaner\CCleaner.exe" [2016-12-06 7175384] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SM?RT-Protection"="c:\program files\Smadav\SM?RTP.exe" [?] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-08-16 10820200] "RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RtHDVBg.exe" [2011-08-16 1571432] "Dolby Advanced Audio v2"="c:\dolby pcee4\pcee4.exe" [2011-06-01 506712] "IntelPAN"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-05-02 1210640] "ETDCtrl"="c:\program files\Elantech\ETDCtrl.exe" [2011-04-05 1813800] "IntelTBRunOnce"="wscript.exe" [2009-07-14 141824] "NUSB3MON"="c:\program files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2015-06-04 147560] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2015-06-04 182888] "Persistence"="c:\windows\system32\igfxpers.exe" [2015-06-04 191592] "AtherosBtStack"="c:\program files\Bluetooth Suite\BtvStack.exe" [2011-09-16 841376] "AthBtTray"="c:\program files\Bluetooth Suite\AthBtTray.exe" [2011-09-16 694432] . c:\users\acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Moniteur de la technologie Intel® Turbo Boost 2.0.lnk - c:\program files\Intel\TurboBoost\SignalIslandUi.exe [2010-11-29 204288] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "TaskbarNoNotification"= 0 (0x0) "HideSCAHealth"= 0 (0x0) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService] @="Service" . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlueStacks Agent] 2018-10-09 09:57 510984 ----a-w- c:\program files\BlueStacks\HD-Agent.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner Monitoring] 2016-12-06 14:09 7175384 ----a-w- c:\program files\CCleaner\CCleaner.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] 2017-10-06 11:38 27832264 ----a-r- c:\program files\Skype\Phone\Skype.exe . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "SunJavaUpdateSched"=c:\program files\Common Files\Java\Java Update\jusched.exe . R2 AntiRansom;Kaspersky Anti-Ransomware Tool for Business 1.1;c:\program files\Kaspersky Lab\Kaspersky Anti-Ransomware Tool for Business 1.1\anti_ransom.exe [x] R2 KSDE1.0.0;Kaspersky Secure Connection Service 1.0.0;c:\program files\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksde.exe [x] R2 MBAMService;Malwarebytes Service;c:\program files\Malwarebytes\Anti-Malware\mbamservice.exe [2018-09-19 5073376] R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2017-07-18 317408] R2 WCMVCAM;WebcamMax, WDM Video Capture;c:\windows\system32\DRIVERS\wcmvcam.sys [x] R3 BlueStacksDrv;BlueStacks Hypervisor;c:\program files\BlueStacks\BstkDrv.sys [2018-10-09 252360] R3 eapihdrv;eapihdrv;c:\users\acer\AppData\Local\Temp\ehdrv.sys [x] R3 GoogleChromeElevationService;Google Chrome Elevation Service;c:\program files\Google\Chrome\Application\71.0.3578.98\elevation_service.exe [2018-12-12 375776] R3 kltap;Kaspersky Security Data Escort Adapter;c:\windows\system32\DRIVERS\kltap.sys [2016-06-07 48056] R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C60x86.sys [2011-04-19 68208] R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2011-05-02 227600] R3 SEE;SoftEther Ethernet Layer Driver;c:\windows\system32\drivers\see.sys [2017-08-14 55328] R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2012-07-18 1343400] S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys [2013-10-08 71888] S0 vsock;vSockets Driver;c:\windows\system32\drivers\vsock.sys [2013-10-08 63824] S1 Klwtp;KLwtp - WFP callout traffic inspector;c:\windows\system32\DRIVERS\klwtp.sys [2016-06-02 108888] S2 AtherosSvc;AtherosSvc;c:\program files\Bluetooth Suite\adminservice.exe [2011-09-16 84640] S2 DsiWMIService;Dritek WMI Service;c:\program files\Launch Manager\dsiwmis.exe [2011-07-01 353360] S2 EsgShKernel;SpyHunter 5 Kernel;c:\program files\EnigmaSoft\SpyHunter\ShKernel.exe [2018-12-09 7878960] S2 Freemake Improver;Freemake Improver;c:\programdata\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [2016-04-07 108032] S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [2012-09-27 99192] S2 ShMonitor;SpyHunter 5 Kernel Monitor;c:\program files\EnigmaSoft\SpyHunter\ShMonitor.exe [2018-12-09 433456] S2 TeamViewer8;TeamViewer 8;c:\program files\TeamViewer\Version8\TeamViewer_Service.exe [2015-06-24 5097232] S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2010-11-29 16120] S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-02-01 2656280] S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files\Common Files\VMware\USB\vmware-usbarbitrator.exe [2014-02-27 722624] S2 WindscribeService;WindscribeService;c:\program files\Windscribe\WindscribeService.exe [2017-05-09 71272] S3 b57xdbd;Broadcom xD Picture Bus Driver Service;c:\windows\system32\DRIVERS\b57xdbd.sys [2011-01-20 60456] S3 b57xdmp;Broadcom xD Picture vstorp client drv;c:\windows\system32\DRIVERS\b57xdmp.sys [2011-01-20 17960] S3 bScsiMSx;bScsiMSx;c:\windows\system32\DRIVERS\bScsiMSx.sys [2011-05-16 42536] S3 bScsiSDx;bScsiSDx;c:\windows\system32\DRIVERS\bScsiSDx.sys [2011-05-06 54824] S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2011-09-16 25248] S3 EnigmaFileMonDriver;EnigmaFileMonDriver Mini-Filter Driver;c:\windows\system32\Drivers\EnigmaFileMonDriver.sys [2018-12-15 60016] S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2011-04-05 119592] S3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [2012-04-24 169752] S3 IntcDAud;Son Intel(R) pour écrans;c:\windows\system32\DRIVERS\IntcDAud.sys [2012-10-02 289792] S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2011-05-09 361000] S3 MEI;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECI.sys [2010-10-19 41088] S3 Neo_VPN;VPN Client Device Driver - VPN;c:\windows\system32\DRIVERS\Neo_0127.sys [2017-08-14 26208] S3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys [2016-05-27 36944] S3 tapwindscribe0901;Windscribe VPN;c:\windows\system32\DRIVERS\tapwindscribe0901.sys [2017-04-21 41976] S3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe [2010-11-29 121856] . . --- Autres Services/Pilotes en mémoire --- . *NewlyCreated* - ESPROTECTIONDRIVER *NewlyCreated* - MBAMPROTECTION *Deregistered* - ESProtectionDriver *Deregistered* - MBAMProtection *Deregistered* - MBAMSwissArmy . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2018-12-12 21:34 2100192 ----a-w- c:\program files\Google\Chrome\Application\71.0.3578.98\Installer\chrmstp.exe . . ------- Examen supplémentaire ------- . uInternet Settings,ProxyOverride = *.local IE: Télécharger avec IDM - c:\program files\Internet Download Manager\IEExt.htm IE: Télécharger tous les liens avec IDM - c:\program files\Internet Download Manager\IEGetAll.htm TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - . - - - - ORPHELINS SUPPRIMES - - - - . Toolbar-Locked - (no file) . . . --------------------- CLES DE REGISTRE BLOQUEES --------------------- . [HKEY_USERS\S-1-5-21-898282021-3541179277-2100125183-1000_Classes\CLSID\{289fe66a-cabf-432f-a221-ef75cc27e8b7}] @Denied: (Full) (Everyone) @Allowed: (Read) (RestrictedCode) "Model"=dword:00000088 "Therad"=dword:0000001a "SpecVersion"=dword:0000013e "MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a, 1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\ . [HKEY_USERS\S-1-5-21-898282021-3541179277-2100125183-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}] @Denied: (Full) (Everyone) @Allowed: (Read) (RestrictedCode) "scansk"=hex(0):13,16,c0,6a,5a,a7,3f,f9,3f,bb,ef,4c,61,bb,f9,b9,d0,7a,bd,79,b9, 2d,b6,74,9e,c1,3d,5d,59,ed,0f,d7,49,cc,c4,25,63,b1,ce,c4,00,00,00,00,00,00,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Autres processus actifs ------------------------ . c:\windows\system32\WLANExt.exe c:\windows\system32\conhost.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Launch Manager\LMutilps32.exe c:\program files\Intel\WiFi\bin\EvtEng.exe c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe c:\windows\system32\vmnat.exe c:\program files\VMware\VMware Player\vmware-authd.exe c:\windows\system32\vmnetdhcp.exe c:\windows\system32\wbem\unsecapp.exe c:\windows\TEMP\Ins5F8.tmp c:\program files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\windows\system32\UI0Detect.exe c:\windows\system32\taskhost.exe c:\program files\Smadav\SMc:\windows\system32\conhost.exe c:\windows\system32\wbem\unsecapp.exe c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe c:\users\acer\AppData\Local\Programs\Opera\launcher.exe c:\users\acer\AppData\Local\Programs\Opera\56.0.3051.116\opera_autoupdate.exe . ************************************************************************** . Heure de fin: 2018-12-15 20:41:02 - La machine a redémarré ComboFix-quarantined-files.txt 2018-12-15 19:41 . Avant-CF: 206 856 187 904 octets libres Après-CF: 206 545 182 720 octets libres . - - End Of File - - 2F9276BA4E2859284496755325BA7767 A36C5E4F47E84449FF07ED3517B43A31