[MsMpEng.exe] Détection Gmer : rootkit ou faux positif ? (résolu)

[Ulquiorra]

Bonjour,

Je possède un ordinateur qui tourne en dual boot sur Windows 10 et Xubuntu 16.04 mais je parle ici de Windows 10. J'ai récemment lu l'article du site sur gmer et j'ai voulu lancer un scan par curiosité. Or, il m'a annoncé qu'il détectait quelque chose. Le nom du serice est "MsMpEng.exe", il est " ***hidden*** " et sa valeur est [AUTO]WinDefend.
Le nom semble inoffensif et, après des recherches sur Google, j'ai l'impression qu'il s'agit d'un faux positif. Néanmoins, je demande votre avis afin d'avoir une confirmation d'utilisateurs plus expérimentés.

Je vous remercie de l'attention que vous porterez à ce message.

Ci-dessous le log de gmer :

GMER 2.2.19882 - http://www.gmer.net
Rootkit scan 2017-04-04 17:46:06
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\0000003e HFS256G39TND-N210A rev.30100P10 238.47GB
Running: gmer.exe; Driver: C:\Users\Cyril\AppData\Local\Temp\kwldikob.sys


---- User code sections - GMER 2.2 ----

? C:\WINDOWS\SYSTEM32\NTASN1.dll [2828] entry point in ".rdata" section 000000006d6ba020
? C:\WINDOWS\system32\ncryptsslp.dll [2828] entry point in ".rdata" section 000000006d6904f0
? C:\WINDOWS\system32\wbem\wbemsvc.dll [3112] entry point in ".rdata" section 000000005f068fc0
? C:\WINDOWS\SYSTEM32\atlthunk.dll [1500] entry point in ".data" section 000000006d914290
? C:\WINDOWS\SYSTEM32\NTASN1.dll [4488] entry point in ".rdata" section 000000006d6ba020
? C:\WINDOWS\system32\ncryptsslp.dll [4488] entry point in ".rdata" section 000000006d6904f0
? C:\WINDOWS\SYSTEM32\iertutil.dll [1424] entry point in ".rdata" section 00000000697716f0
? C:\WINDOWS\system32\wbem\wbemsvc.dll [1424] entry point in ".rdata" section 000000005f068fc0
? C:\WINDOWS\SYSTEM32\NTASN1.dll [1424] entry point in ".rdata" section 000000006d6ba020
? C:\WINDOWS\system32\ncryptsslp.dll [1424] entry point in ".rdata" section 000000006d6904f0
? C:\WINDOWS\system32\apphelp.dll [8112] entry point in ".rdata" section 000000005d52f7c0
? C:\WINDOWS\SYSTEM32\iertutil.dll [10392] entry point in ".rdata" section 00000000697716f0
? C:\WINDOWS\SYSTEM32\dbgcore.DLL [10392] entry point in ".rdata" section 000000006e52c940
? C:\WINDOWS\system32\wbem\wbemsvc.dll [10392] entry point in ".rdata" section 000000005f068fc0
? C:\WINDOWS\SYSTEM32\atlthunk.dll [10392] entry point in ".data" section 000000006d914290
? C:\Windows\System32\ActXPrxy.dll [10392] entry point in ".rdata" section 000000006c199c50
? C:\WINDOWS\SYSTEM32\apphelp.dll [10392] entry point in ".rdata" section 000000005d52f7c0
? C:\WINDOWS\system32\mssprxy.dll [10392] entry point in ".rdata" section 000000005c66a650
? C:\Windows\System32\OneCoreCommonProxyStub.dll [10392] entry point in ".rdata" section 000000005c91da90
? C:\WINDOWS\system32\apphelp.dll [6292] entry point in ".rdata" section 000000005d52f7c0

---- Threads - GMER 2.2 ----

Thread C:\WINDOWS\system32\csrss.exe [5472:10320] ffffc40c01df6c20

---- Services - GMER 2.2 ----

Service C:\Program Files (x86)\Windows Defender\MsMpEng.exe (*** hidden *** ) [AUTO] WinDefend <-- ROOTKIT !!!

---- Registry - GMER 2.2 ----

Reg HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Configuration\LGD04E80_00_07DF_BC^[email protected] 0x8C 0xD1 0x14 0x15 ...
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\[email protected] -1920338568
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 12496
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 5917
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 16663
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 481
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 678
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 12981
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 109
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 525
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 13120
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 170
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 307
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 13660
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 13720
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 15524
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 13713
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 16637
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 2524
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 905
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 11116
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 1390
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 57
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 1087
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 31
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 464320
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 0xC8 0x20 0x02 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 64180
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 0xB7 0x48 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 254
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 33
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 413
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 79
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 94
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 10
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 62
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 7
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 659
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 499
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 1826
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\[email protected] 0x04 0x1B 0x2B 0x04 ...
Reg HKLM\SYSTEM\CurrentControlSet\Control\Terminal [email protected] 2
Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\[email protected] 1
Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\[email protected] 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\d0577b77cb6b
Reg HKLM\SYSTEM\CurrentControlSet\Services\CDPUserSvc_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 224
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] CDPUserSvc_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 0x80 0x51 0x01 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] @%SystemRoot%\system32\cdpusersvc.dll,-101
Reg HKLM\SYSTEM\CurrentControlSet\Services\CDPUserSvc_f041ee\Security
Reg HKLM\SYSTEM\CurrentControlSet\Services\CDPUserSvc_f041ee\[email protected] 0x01 0x00 0x14 0x80 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\CDPUserSvc_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{FED5DD23-FE11-4DB3-A837-8FB0418A3355}@DefunctTimestamp 0x9F 0x46 0xE3 0x58 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\MessagingService_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 224
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 3
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] MessagingService_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 0x80 0x51 0x01 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] @%SystemRoot%\system32\MessagingService.dll,-101
Reg HKLM\SYSTEM\CurrentControlSet\Services\MessagingService_f041ee\Security
Reg HKLM\SYSTEM\CurrentControlSet\Services\MessagingService_f041ee\[email protected] 0x01 0x00 0x14 0x80 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\MessagingService_f041ee\TriggerInfo
Reg HKLM\SYSTEM\CurrentControlSet\Services\MessagingService_f041ee\TriggerInfo\0
Reg HKLM\SYSTEM\CurrentControlSet\Services\MessagingService_f041ee\TriggerInfo\[email protected] 7
Reg HKLM\SYSTEM\CurrentControlSet\Services\MessagingService_f041ee\TriggerInfo\[email protected] 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\MessagingService_f041ee\TriggerInfo\[email protected] 0x16 0x28 0x7A 0x2D ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\MessagingService_f041ee\TriggerInfo\[email protected] 0x75 0x18 0xBC 0xA3 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\MessagingService_f041ee\TriggerInfo\[email protected] 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\MessagingService_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\OneSyncSvc_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 224
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] Sync Host_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 0x80 0x51 0x01 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] @%SystemRoot%\system32\APHostRes.dll,-10001
Reg HKLM\SYSTEM\CurrentControlSet\Services\OneSyncSvc_f041ee\Security
Reg HKLM\SYSTEM\CurrentControlSet\Services\OneSyncSvc_f041ee\[email protected] 0x01 0x00 0x04 0x80 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\OneSyncSvc_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\PimIndexMaintenanceSvc_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 224
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 3
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] Contact Data_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 0x80 0x51 0x01 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] @%SystemRoot%\system32\UserDataAccessRes.dll,-15000
Reg HKLM\SYSTEM\CurrentControlSet\Services\PimIndexMaintenanceSvc_f041ee\Security
Reg HKLM\SYSTEM\CurrentControlSet\Services\PimIndexMaintenanceSvc_f041ee\[email protected] 0x01 0x00 0x04 0x80 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\PimIndexMaintenanceSvc_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\[email protected] 6345
Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\[email protected] 1256
Reg HKLM\SYSTEM\CurrentControlSet\Services\UnistoreSvc_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 224
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 3
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] User Data Storage_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 0x80 0x51 0x01 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] @%SystemRoot%\system32\UserDataAccessRes.dll,-10002
Reg HKLM\SYSTEM\CurrentControlSet\Services\UnistoreSvc_f041ee\Security
Reg HKLM\SYSTEM\CurrentControlSet\Services\UnistoreSvc_f041ee\[email protected] 0x01 0x00 0x04 0x80 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\UnistoreSvc_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\UserDataSvc_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 224
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 3
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] User Data Access_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 0x80 0x51 0x01 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] @%SystemRoot%\system32\UserDataAccessRes.dll,-14000
Reg HKLM\SYSTEM\CurrentControlSet\Services\UserDataSvc_f041ee\Security
Reg HKLM\SYSTEM\CurrentControlSet\Services\UserDataSvc_f041ee\[email protected] 0x01 0x00 0x04 0x80 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\UserDataSvc_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\[email protected] 0xAC 0x92 0x8F 0x6C ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\[email protected] 0x76 0x23 0x1C 0xAC ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\[email protected] 0x76 0x8B 0xE0 0x0D ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\[email protected] 0x76 0xBB 0x57 0x4A ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\[email protected] time.windows.com,0?????????????????
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] Early-Launch
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] system32\drivers\WdBoot.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\WdBoot
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] system32\drivers\WdFilter.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\WdFilter
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\WinDefend
Reg HKLM\SYSTEM\CurrentControlSet\Services\WpnUserService_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 224
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 3
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] Windows Push Notifications User Service_f041ee
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] 0x80 0x51 0x01 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\[email protected] @%SystemRoot%\system32\WpnUserService.dll,-2
Reg HKLM\SYSTEM\CurrentControlSet\Services\WpnUserService_f041ee\Security
Reg HKLM\SYSTEM\CurrentControlSet\Services\WpnUserService_f041ee\[email protected] 0x01 0x00 0x04 0x80 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\WpnUserService_f041ee
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\[email protected] 0x64 0x62 0x03 0x00 ...
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\[email protected] 0x64 0x62 0x03 0x00 ...
Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\[email protected] windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel?
Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{DD73BD17-8518-48CA-BD0D-E9C895A9B022}
Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{DD73BD17-8518-48CA-BD0D-E9C895A9B022}@LastAccessedTime 0x70 0xA3 0xCD 0x71 ...
Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{DD73BD17-8518-48CA-BD0D-E9C895A9B022}@AppId D:\products\pyzo-4.3.1-win32.exe
Reg HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{DD73BD17-8518-48CA-BD0D-E9C895A9B022}@LaunchCount 1

---- Disk sectors - GMER 2.2 ----

Disk \Device\Harddisk0\DR0 unknown MBR code

---- EOF - GMER 2.2 ----

[Malekal_morte]

Bonsoir,

Rien le malicieux, le service mentionné appartient à Windows Defender.

[Ulquiorra]

Très bien, merci de la confirmation et de votre rapidité.

[Malekal_morte]

de rien =)