Analyse de Windows 7 avec ComboFix et demande d'aide

Aide à la désinfection pour supprimer les virus, adwares, ransomwares, trojans.

Modérateurs : Mods Windows, Helper

isaki

Analyse de Windows 7 avec ComboFix et demande d'aide

par isaki »

Bonjour,

Je suis nouveau sur ce forum. Je salue donc tous ceux qui l'animent et le fréquente. Etant un bleu je ne sais pas encore comment procéder efficacement sans agacer par mes questions qui de toute façon auront été traitées, je n'en doute pas, sur ce forum. Par avance excuses si c'est le cas.

Voila.

J'ai utilisé un logiciel du nom de combofix. Il est dit sur le forum de bleepingcomputer.com que je dois, après avoir nettoyé mon Windows 7 avec ledit combofix que je dois poster le rapport que ce dernier a produit après avoir terminé son office et que malekal's forum est le site français de référence pour m'aider à analyser le resultat du scan de combofix. Alors voici copie du rapport :

Code : Tout sélectionner

ComboFix 16-04-01.01 - New TP 01/04/2016  18:00:21.1.4 - x86
Microsoft Windows 7 Édition Intégrale   6.1.7601.1.1252.33.1036.18.3583.2532 [GMT 2:00]
Lancé depuis: c:\users\New TP\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Spybot - Search and Destroy *Disabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\New TP\WINDOWS
c:\users\New TP\WINDOWS\system.exe
.
.
(((((((((((((((((((((((((((((   Fichiers créés du 2016-03-01 au 2016-04-01  ))))))))))))))))))))))))))))))))))))
.
.
2016-04-01 07:58 . 2016-03-17 01:50	9302992	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{C6A439B4-A78E-4C6C-8713-9A091F11183C}\mpengine.dll
2016-03-28 11:51 . 2016-03-28 11:51	--------	d-----w-	c:\program files\Common Files\Java
2016-03-22 20:46 . 2016-03-22 20:46	35096	----a-w-	c:\windows\system32\drivers\aswKbd.sys
2016-03-14 13:44 . 2016-02-12 18:39	2956288	----a-w-	c:\windows\system32\wucltux.dll
2016-03-14 13:44 . 2016-02-12 18:39	174080	----a-w-	c:\windows\system32\wuwebv.dll
2016-03-14 13:44 . 2016-02-12 18:26	73728	----a-w-	c:\windows\system32\WinSetupUI.dll
2016-03-14 13:44 . 2016-02-12 18:07	2062848	----a-w-	c:\windows\system32\wuaueng.dll
2016-03-14 13:44 . 2016-02-12 18:06	573440	----a-w-	c:\windows\system32\wuapi.dll
2016-03-14 13:44 . 2016-02-12 18:05	93696	----a-w-	c:\windows\system32\wudriver.dll
2016-03-14 13:44 . 2016-02-12 18:05	30208	----a-w-	c:\windows\system32\wups.dll
2016-03-14 13:44 . 2016-02-12 18:05	136192	----a-w-	c:\windows\system32\wuauclt.exe
2016-03-14 13:44 . 2016-02-12 18:05	35840	----a-w-	c:\windows\system32\wups2.dll
2016-03-14 13:44 . 2016-02-12 18:05	35328	----a-w-	c:\windows\system32\wuapp.exe
2016-03-14 13:44 . 2016-02-12 18:05	11776	----a-w-	c:\windows\system32\wu.upgrade.ps.dll
2016-03-14 13:44 . 2016-02-04 18:41	296448	----a-w-	c:\windows\system32\mfds.dll
2016-03-14 09:23 . 2016-02-05 18:44	26112	----a-w-	c:\windows\system32\lpk.dll
2016-03-14 09:23 . 2016-02-05 18:44	70656	----a-w-	c:\windows\system32\fontsub.dll
2016-03-14 09:23 . 2016-02-05 18:42	10240	----a-w-	c:\windows\system32\dciman32.dll
2016-03-14 09:23 . 2016-02-05 17:43	299520	----a-w-	c:\windows\system32\atmfd.dll
2016-03-14 09:23 . 2016-02-05 17:43	34304	----a-w-	c:\windows\system32\atmlib.dll
2016-03-14 09:23 . 2016-02-09 09:51	12625408	----a-w-	c:\windows\system32\wmploc.DLL
2016-03-14 09:23 . 2016-02-09 09:13	101888	----a-w-	c:\program files\Windows Media Player\wmpconfig.exe
2016-03-14 09:23 . 2016-02-09 09:13	164864	----a-w-	c:\program files\Windows Media Player\wmplayer.exe
2016-03-14 09:23 . 2016-02-09 09:13	4096	----a-w-	c:\windows\system32\msdxm.ocx
2016-03-14 09:23 . 2016-02-09 09:13	4096	----a-w-	c:\windows\system32\dxmasf.dll
2016-03-14 09:23 . 2016-02-09 09:13	8192	----a-w-	c:\windows\system32\spwmp.dll
2016-03-14 09:23 . 2016-02-09 09:13	102400	----a-w-	c:\program files\Windows Media Player\wmpshare.exe
2016-03-13 20:26 . 2016-03-03 21:59	334280	----a-w-	c:\windows\system32\aswBoot.exe
2016-03-13 18:58 . 2016-03-13 20:09	--------	d-----w-	c:\users\New TP\AppData\Roaming\Solvusoft
2016-03-09 09:14 . 2016-02-08 20:47	10948096	----a-w-	c:\program files\Internet Explorer\F12Resources.dll
2016-03-03 21:59 . 2016-03-03 21:59	52184	----a-w-	c:\windows\avastSS.scr
.
.
.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2016-03-28 11:50 . 2014-10-27 07:07	95808	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2016-03-23 17:47 . 2014-03-13 15:20	797376	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2016-03-23 17:47 . 2014-03-13 15:20	142528	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2016-03-09 21:59 . 2016-01-06 21:23	91168	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2016-03-09 21:59 . 2016-01-06 21:23	816304	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2016-03-03 22:00 . 2016-01-06 21:23	447848	----a-w-	c:\windows\system32\drivers\aswSP.sys
2016-03-03 21:59 . 2016-01-06 21:23	221240	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2016-03-03 21:59 . 2016-01-06 21:23	127432	----a-w-	c:\windows\system32\drivers\aswStm.sys
2016-03-03 21:59 . 2016-01-06 21:23	58776	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2016-03-03 21:59 . 2016-01-06 21:23	32792	----a-w-	c:\windows\system32\drivers\aswHwid.sys
2016-03-03 21:59 . 2016-01-06 21:23	91232	----a-w-	c:\windows\system32\drivers\aswRdr2.sys
2016-03-03 21:59 . 2016-01-06 21:23	812720	----a-w-	c:\windows\system32\drivers\aswsnx.sys.1457560789427
2016-02-06 09:43 . 2016-02-10 10:20	2280448	----a-w-	c:\windows\system32\iertutil(53).dll
2016-02-06 08:54 . 2016-02-10 10:20	1312256	----a-w-	c:\windows\system32\urlmon(70).dll
2016-01-22 06:09 . 2016-02-10 10:20	1310232	----a-w-	c:\windows\system32\ntdll(60).dll
2016-01-22 06:06 . 2016-02-10 10:20	169984	----a-w-	c:\windows\system32\winsrv.dll
2016-01-22 06:06 . 2016-02-10 10:20	171520	----a-w-	c:\windows\system32\wdigest(71).dll
2016-01-22 06:06 . 2016-02-10 10:20	65536	----a-w-	c:\windows\system32\TSpkg(69).dll
2016-01-22 06:06 . 2016-02-10 10:20	99840	----a-w-	c:\windows\system32\sspicli(67).dll
2016-01-22 06:06 . 2016-02-10 10:20	400896	----a-w-	c:\windows\system32\srcore(66).dll
2016-01-22 06:05 . 2016-02-10 10:20	22016	----a-w-	c:\windows\system32\secur32(64).dll
2016-01-22 06:05 . 2016-02-10 10:20	251392	----a-w-	c:\windows\system32\schannel(63).dll
2016-01-22 06:05 . 2016-02-10 10:20	654336	----a-w-	c:\windows\system32\rpcrt4(62).dll
2016-01-22 06:04 . 2016-02-10 10:20	642048	----a-w-	c:\windows\system32\CPFilters.dll
2016-01-22 06:04 . 2016-02-10 10:20	535040	----a-w-	c:\windows\system32\EncDec.dll
2016-01-22 06:02 . 2016-02-10 10:20	223232	----a-w-	c:\windows\system32\ncrypt(59).dll
2016-01-22 06:02 . 2016-02-10 10:20	114176	----a-w-	c:\windows\system32\mtxoci.dll
2016-01-22 06:02 . 2016-02-10 10:20	259584	----a-w-	c:\windows\system32\msv1_0(58).dll
2016-01-22 06:02 . 2016-02-10 10:20	176128	----a-w-	c:\windows\system32\msorcl32.dll
2016-01-22 06:02 . 2016-02-10 10:20	1060864	----a-w-	c:\windows\system32\lsasrv(56).dll
2016-01-22 06:02 . 2016-02-10 10:20	293888	----a-w-	c:\windows\system32\KernelBase.dll
2016-01-22 06:02 . 2016-02-10 10:20	553472	----a-w-	c:\windows\system32\kerberos(54).dll
2016-01-22 05:59 . 2016-02-10 10:20	38912	----a-w-	c:\windows\system32\csrsrv(52).dll
2016-01-22 05:59 . 2016-02-10 10:20	17408	----a-w-	c:\windows\system32\credssp(50).dll
2016-01-22 05:59 . 2016-02-10 10:20	6656	----a-w-	c:\windows\system32\apisetschema(49).dll
2016-01-22 05:59 . 2016-02-10 10:20	5120	---ha-w-	c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	4608	---ha-w-	c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	4096	---ha-w-	c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	4096	---ha-w-	c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	4096	---ha-w-	c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	4096	---ha-w-	c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	4096	---ha-w-	c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	3584	---ha-w-	c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	3584	---ha-w-	c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	3584	---ha-w-	c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	3584	---ha-w-	c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	3584	---ha-w-	c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	3584	---ha-w-	c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	3072	---ha-w-	c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	3072	---ha-w-	c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	3072	---ha-w-	c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	3072	---ha-w-	c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	3072	---ha-w-	c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	3072	---ha-w-	c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	3072	---ha-w-	c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	3072	---ha-w-	c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	3072	---ha-w-	c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	3072	---ha-w-	c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	3072	---ha-w-	c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-01-22 05:59 . 2016-02-10 10:20	642560	----a-w-	c:\windows\system32\advapi32(48).dll
2016-01-22 05:07 . 2016-02-10 10:20	2120704	----a-w-	c:\windows\system32\wininet(73).dll
2016-01-22 05:01 . 2016-02-10 10:20	271360	----a-w-	c:\windows\system32\conhost.exe
2016-01-22 04:51 . 2016-02-10 10:20	36352	----a-w-	c:\windows\system32\cryptbase(51).dll
2016-01-22 04:51 . 2016-02-10 10:20	22016	----a-w-	c:\windows\system32\lsass(57).exe
2016-01-22 04:51 . 2016-02-10 10:20	15872	----a-w-	c:\windows\system32\sspisrv(68).dll
2016-01-22 04:51 . 2016-02-10 10:20	69632	----a-w-	c:\windows\system32\smss(65).exe
2016-01-22 04:51 . 2016-02-10 10:20	6144	---ha-w-	c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-01-22 04:51 . 2016-02-10 10:20	4608	---ha-w-	c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-01-22 04:51 . 2016-02-10 10:20	3584	---ha-w-	c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-01-22 04:51 . 2016-02-10 10:20	3072	---ha-w-	c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-01-16 18:36 . 2016-02-10 10:21	1413632	----a-w-	c:\windows\system32\ole32.dll
2016-01-07 17:35 . 2016-02-10 10:20	116224	----a-w-	c:\windows\system32\drivers\mrxdav.sys
2016-01-06 18:41 . 2016-02-10 10:20	216064	----a-w-	c:\windows\system32\InkEd.dll
2016-01-06 17:56 . 2016-02-10 10:20	19968	----a-w-	c:\windows\system32\jnwmon.dll
2016-01-06 17:56 . 2016-02-10 10:20	22528	----a-w-	c:\windows\system32\Spool\prtprocs\w32x86\jnwppr.dll
.
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\!BTSync2.0.124Done]
@="{581FFA04-FC33-007C-0002-95003A5CDE89}"
[HKEY_CLASSES_ROOT\CLSID\{581FFA04-FC33-007C-0002-95003A5CDE89}]
2015-06-06 09:24	362496	----a-w-	c:\program files\BitTorrent Sync\SyncShellExtension86_33554556.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\!BTSync2.0.124RO]
@="{581FFA03-FC33-007C-0002-95003A5CDE89}"
[HKEY_CLASSES_ROOT\CLSID\{581FFA03-FC33-007C-0002-95003A5CDE89}]
2015-06-06 09:24	362496	----a-w-	c:\program files\BitTorrent Sync\SyncShellExtension86_33554556.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\!BTSync2.0.124RW]
@="{581FFA02-FC33-007C-0002-95003A5CDE89}"
[HKEY_CLASSES_ROOT\CLSID\{581FFA02-FC33-007C-0002-95003A5CDE89}]
2015-06-06 09:24	362496	----a-w-	c:\program files\BitTorrent Sync\SyncShellExtension86_33554556.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2016-03-03 21:59	770088	----a-w-	c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-04-04 22:12	130736	----a-w-	c:\users\New TP\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-04-04 22:12	130736	----a-w-	c:\users\New TP\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-04-04 22:12	130736	----a-w-	c:\users\New TP\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-04-04 22:12	130736	----a-w-	c:\users\New TP\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner.exe" [2015-12-08 6602152]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2011-03-04 2741616]
"RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]
"Spybot-S&D Cleaning"="c:\program files\Spybot - Search & Destroy 2\SDCleaner.exe" [2014-06-24 4566952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2016-03-23 7139256]
"SDTray"="c:\program files\Spybot - Search & Destroy 2\SDTray.exe" [2014-06-24 4101576]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2016-03-20 595480]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotPostWindows10UpgradeReInstall"="c:\program files\Common Files\AV\Spybot - Search and Destroy\Test.exe" [2015-07-28 1011200]
.
c:\users\New TP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Alertes de surveillance de l'encre - HP Deskjet 2050 J510 series.lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Deskjet 2050 J510 series\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN1CU1N65D05QV;CONNECTION=USB;MONITOR=1; [2009-7-14 44544]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer4"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0\0sdnclean.exe
.
[HKLM\~\startupfolder\C:^Users^New TP^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Alertes de surveillance de l'encre - HP Deskjet 1050 J410 series.lnk]
path=c:\users\New TP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Alertes de surveillance de l'encre - HP Deskjet 1050 J410 series.lnk
backup=c:\windows\pss\Alertes de surveillance de l'encre - HP Deskjet 1050 J410 series.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^New TP^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\New TP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2013-05-30 13:50	96056	----a-w-	c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Google Update"="c:\users\New TP\AppData\Local\Google\Update\GoogleUpdate.exe" /c
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HP Software Update"=c:\program files\Hp\HP Software Update\HPWuSchd2.exe
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
.
R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2016-03-03 127432]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files\Spybot - Search & Destroy 2\SDFSSvc.exe [2014-06-24 1738168]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2014-06-27 2088408]
R2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files\Spybot - Search & Destroy 2\SDWSCSvc.exe [2014-04-25 171928]
R2 vToolbarUpdater40.1.8;vToolbarUpdater40.1.8;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\40.1.8\ToolbarUpdater.exe [x]
R3 cleanhlp;cleanhlp;c:\program files\Emsisoft Anti-Malware\cleanhlp32.sys [x]
R3 cpuz134;cpuz134;c:\users\NEWTP~1\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2016-02-08 102912]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2015-06-11 15872]
R3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\DRIVERS\s1018bus.sys [2009-03-25 86824]
R3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1018mdfl.sys [2009-03-25 15016]
R3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1018mdm.sys [2009-03-25 114728]
R3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1018mgmt.sys [2009-03-25 106208]
R3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1018nd5.sys [2009-03-25 26024]
R3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1018obex.sys [2009-03-25 104744]
R3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1018unic.sys [2009-03-25 109864]
R3 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-01-18 383264]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2013-02-12 1343400]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [2016-03-22 35096]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2016-03-09 816304]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2016-03-03 447848]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [2016-03-03 32792]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2016-03-09 91168]
S2 lxef_device;lxef_device;c:\windows\system32\lxefcoms.exe [2010-09-09 598696]
S2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2011-02-11 35088]
S2 WtuSystemSupport;WtuSystemSupport;c:\program files\AVG Web TuneUp\WtuSystemSupport.exe [2015-10-05 1205136]
S3 Apowersoft_AudioDevice;Apowersoft_AudioDevice;c:\windows\system32\drivers\Apowersoft_AudioDevice.sys [2014-04-09 26032]
S3 netr73;Pilote adaptateur USB sans fil 802.11 b/g pour Vista;c:\windows\system32\DRIVERS\netr73.sys [2009-07-13 545792]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2011-03-04 10:29	451872	----a-w-	c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A6EADE66-0000-0000-484E-7E8A45000000}]
2015-12-18 15:42	286904	----a-w-	c:\program files\Adobe\Acrobat Reader DC\Esl\AiodLite.dll
.
Contenu du dossier 'Tâches planifiées'
.
2016-04-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-13 17:47]
.
2016-04-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-16 11:51]
.
2016-04-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-16 11:51]
.
2016-04-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2385515534-1547979708-266644476-1000Core.job
- c:\users\New TP\AppData\Local\Google\Update\GoogleUpdate.exe [2014-01-27 16:16]
.
2016-04-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2385515534-1547979708-266644476-1000UA.job
- c:\users\New TP\AppData\Local\Google\Update\GoogleUpdate.exe [2014-01-27 16:16]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://google.fr/
mStart Page = about:blank
uInternet Settings,ProxyServer = localhost:21320
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{D04B650F-B9FD-407F-8D9D-79641921D838}: NameServer = 8.8.8.8,8.8.4.4
TCP: Interfaces\{D04B650F-B9FD-407F-8D9D-79641921D838}\2426F687D2834393932403: NameServer = 178.33.41.181,46.4.70.20
FF - ProfilePath - c:\users\New TP\AppData\Roaming\Mozilla\Firefox\Profiles\tqxlkpir.default\
FF - prefs.js: browser.search.defaulturl - hxxps://www.google.com/search/?trackid=sp-006
FF - prefs.js: browser.search.selectedEngine - Google (avast)
FF - prefs.js: browser.startup.homepage - hxxps://www.google.fr
FF - prefs.js: keyword.URL - hxxps://www.google.com/search/?trackid=sp-006
FF - prefs.js: network.proxy.http - 87.98.216.22		
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.type - 4
.
.
------- Associations de fichier -------
.
inifile="%SystemRoot%\system32\NOTEPAD.EXE" %1
txtfile="%SystemRoot%\system32\NOTEPAD.EXE" %1
.
- - - - ORPHELINS SUPPRIMES - - - -
.
HKLM-Run-DivXMediaServer - c:\program files\DivX\DivX Media Server\DivXMediaServer.exe
Notify-SDWinLogon - SDWinLogon.dll
SafeBoot-CleanHlp
SafeBoot-CleanHlp.sys
MSConfigStartUp-Ad-Aware Browsing Protection - c:\programdata\Ad-Aware Browsing Protection\adawarebp.exe
MSConfigStartUp-BDAgent - c:\program files\BitDefender\BitDefender 2010\bdagent.exe
MSConfigStartUp-DivXUpdate - c:\program files\DivX\DivX Update\DivXUpdate.exe
MSConfigStartUp-Sony PC Companion - c:\program files\Sony\Sony PC Companion\PCCompanion.exe
MSConfigStartUp-TkBellExe - c:\program files\Real\RealPlayer\update\realsched.exe
AddRemove-Microsoft .NET Framework 4 Client Profile - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe
AddRemove-Microsoft .NET Framework 4 Client Profile FRA Language Pack - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\ClientLP\Setup.exe
AddRemove-Microsoft .NET Framework 4 Extended - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\Setup.exe
AddRemove-Microsoft .NET Framework 4 Extended FRA Language Pack - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\ExtendedLP\Setup.exe
AddRemove-Reimage Protector - c:\program files\Reimage\Reimage Protector\Uninst.exe
AddRemove-{0A0CADCF-78DA-33C4-A350-CD51849B9702}.KB2468871 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{0A0CADCF-78DA-33C4-A350-CD51849B9702}.KB2487367 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{0A0CADCF-78DA-33C4-A350-CD51849B9702}.KB2533523 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{0A0CADCF-78DA-33C4-A350-CD51849B9702}.KB2656351 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{0A0CADCF-78DA-33C4-A350-CD51849B9702}.KB2736428 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{0A0CADCF-78DA-33C4-A350-CD51849B9702}.KB2742595 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{0A0CADCF-78DA-33C4-A350-CD51849B9702}.KB2858302v2 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{0A0CADCF-78DA-33C4-A350-CD51849B9702}.KB2894842v2 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{0A0CADCF-78DA-33C4-A350-CD51849B9702}.KB2901110v2 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{0A0CADCF-78DA-33C4-A350-CD51849B9702}.KB3037578 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{0A0CADCF-78DA-33C4-A350-CD51849B9702}.KB3098778 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2468871 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2533523 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2604121 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2656351 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2729449 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2736428 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2737019 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2742595 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2789642 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2804576 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2835393 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2840628 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2840628v2 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2858302v2 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2894842v2 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2898855v2 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2901110v2 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2931365 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2972106 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2972215 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2978125 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2979575v2 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB3023221 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB3032662 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB3037578 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB3074547 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB3097994 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
AddRemove-{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB3098778 - c:\windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\setup.exe
.
.
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Heure de fin: 2016-04-01  18:12:07
ComboFix-quarantined-files.txt  2016-04-01 16:12
.
Avant-CF: 384 522 018 816 octets libres
Après-CF: 384 388 292 608 octets libres
.
- - End Of File - - F97E2C436AD64E37AF55AC3E561052D4
A36C5E4F47E84449FF07ED3517B43A31
Inutile de dire que c'est un peu abstrait pour moi tout cela.

Enfin merci de me dire ce que je dois penser de ce rapport et ce qu'il y a lieu de faire.

Merci doublement d'avance.

Cordialement

Isaki
Haut
Malekal_morte
Messages : 113189
Inscription : 10 sept. 2005 13:57

Re: Analyse de mon ordi par ComboFix et demande d'aide

par Malekal_morte »

Hello,

Bienvenue,

Rien de vraiment malicieux.
Tu as des symptômes en particulier ?
Première règle élémentaire de sécurité : on réfléchit puis on clic et pas l'inverse - Les fichiers/programmes c'est comme les bonbons, quand ça vient d'un inconnu, on n'accepte pas !
➔ Comment protéger son PC des virus
➔ Windows 11 : Compatibilité, Configuration minimale requise, télécharger ISO et installer Windows 11

Comment demander de l'aide sur le forum
Partagez malekal.com : n'hésitez pas à partager les articles qui vous plaisent sur la page Facebook du site.
Haut
davidblaine

Re: Analyse de Windows 7 avec ComboFix et demande d'aide

par davidblaine »

Bonjour
J'ai fais un peu la même chose que Isaki. Je me demande ci mon PC est infecté et si après avoir lancé Combofix, ça été nettoyé.
Ci-joint le rapport généré.
Prière de me clarifier
Vous ne pouvez pas consulter les pièces jointes insérées à ce message.
Haut
Malekal_morte
Messages : 113189
Inscription : 10 sept. 2005 13:57

Re: Analyse de Windows 7 avec ComboFix et demande d'aide

par Malekal_morte »

Salut,

Rien d'anormal sur le rapport.
Quel est le problème ?
Première règle élémentaire de sécurité : on réfléchit puis on clic et pas l'inverse - Les fichiers/programmes c'est comme les bonbons, quand ça vient d'un inconnu, on n'accepte pas !
➔ Comment protéger son PC des virus
➔ Windows 11 : Compatibilité, Configuration minimale requise, télécharger ISO et installer Windows 11

Comment demander de l'aide sur le forum
Partagez malekal.com : n'hésitez pas à partager les articles qui vous plaisent sur la page Facebook du site.
Haut
  • Sujets similaires
    Réponses
    Vues
    Dernier message

Revenir à « Supprimer/Desinfecter les virus (Trojan, Adwares, Ransomwares, Backdoor, Spywares) »