Fichiers .jpg compressé avec code

[SebPMT]

Bonjour,
Ce matin je me suis retrouvé avec mes fichiers .jpg, .pdf, .docx, xls..... zippés avec un mot de passe et l'extension avec l'email et l'id !! to get password email id 1899026338 to [email protected] !! a envoyer pour décrypter les fichiers.
Ci-dessous le compte-rendu :

ComboFix 17-07-07.01 - Accueil Tremplin 16/07/2017 9:56.1.4 - x64
Microsoft Windows 7 Professionnel 6.1.7601.1.1252.33.1036.18.8073.5344 [GMT 2:00]
Lancé depuis: c:\users\Accueil Tremplin\Desktop\ComboFix.exe
Commutateurs utilisés :: /v winrnt32 yayxuss
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Un nouveau point de restauration a été créé
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\07152008232
c:\programdata\07152008232\071520082314.dll
c:\programdata\07152008232\071520082317.dll
c:\programdata\07152008232\071520082317fspall1.dll
c:\programdata\07152008232\BDR071520082317.dll
c:\programdata\07152008232\BKR071520082317.dll
c:\programdata\07152008232\BKR2071520082317.dll
c:\programdata\07152008233
c:\programdata\07152008233\svchost.exe
c:\programdata\07152008234
c:\programdata\07152008234\07152008238.dlls
c:\programdata\07152008234\07152008239.dlls
c:\programdata\07152008234\BK1_07152009437823.dlls
c:\programdata\07152008234\BK1_07152016077823.dlls
c:\programdata\07152008234\BK1_07160032257823.dlls
c:\programdata\07152008234\BK1_07160043267823.dlls
c:\programdata\07152008234\BK1_07160930487823.dlls
c:\programdata\07152008234\BK2_07152009437823.dlls
c:\programdata\07152008234\BK2_07152016077823.dlls
c:\programdata\07152008234\BK2_07160032257823.dlls
c:\programdata\07152008234\BK2_07160043267823.dlls
c:\programdata\07152008234\BK2_07160930487823.dlls
c:\programdata\07152008234\DB1_07152009438952.dlls
c:\programdata\07152008234\DB1_07152016078952.dlls
c:\programdata\07152008234\DB1_07160032258952.dlls
c:\programdata\07152008234\DB1_07160043268952.dlls
c:\programdata\07152008234\DB1_07160930488952.dlls
c:\programdata\07152008234\DB1B_07152009438932.dlls
c:\programdata\07152008234\DB1B_07152016078932.dlls
c:\programdata\07152008234\DB1VB_07152009438942.dlls
c:\programdata\07152008234\DB1VB_07152016078942.dlls
c:\programdata\07152008234\DB1VB_07160930488942.dlls
c:\programdata\07152008234\S1_07152009431209.dlls
c:\programdata\07152008234\S1_07152016071209.dlls
c:\programdata\07152008234\S1_07160032251209.dlls
c:\programdata\07152008234\S1_07160043261209.dlls
c:\programdata\07152008234\S1_07160930481209.dlls
c:\programdata\07152008234\S1VB_07152016071208.dlls
c:\programdata\07152008234\S2_07152009434514.dlls
c:\programdata\07152008234\S2_07152016074514.dlls
c:\programdata\07152008234\S2_07160032254514.dlls
c:\programdata\07152008234\S2_07160043264514.dlls
c:\programdata\07152008234\S2_07160930484514.dlls
c:\programdata\07152008234\S2VB_07152016074515.dlls
c:\programdata\07152008234\S2VB_07160032254515.dlls
c:\programdata\07152008234\S2VB_07160043264515.dlls
c:\programdata\07152008234\S2VB_07160930484515.dlls
c:\programdata\07152008235
c:\programdata\07152008235\svchost.exe
c:\programdata\Microsoft\Crypto\Keys\2f8d7067458f59b183b0a0639ef3e77a_b35ff975-2688-4f0e-8453-0a64030d654c(!! to get password email id 1899026338 to [email protected] !!).exe
c:\programdata\Microsoft\Office\ClickToRunPackageLocker(!! to get password email id 1899026338 to [email protected] !!).exe
c:\programdata\svcfnmainstvestvs
c:\programdata\svcfnmainstvestvs\stppthmainfv.dll
c:\programdata\svtstcrs
c:\users\Accueil Tremplin\AppData\Local\Microsoft\Credentials\1E4AE6A381DD9365BB01F38BC394D193(!! to get password email id 1899026338 to [email protected] !!).exe
c:\users\Accueil Tremplin\AppData\Local\Microsoft\Credentials\FFB4860BBFD7F5221C268B59A3358BFD(!! to get password email id 1899026338 to [email protected] !!).exe
c:\users\Accueil Tremplin\AppData\Roaming\Microsoft\Excel\Excel15.xlb(!! to get password email id 1899026338 to [email protected] !!).exe
c:\users\Accueil Tremplin\AppData\Roaming\Microsoft\MMC\SQLServerManager12(!! to get password email id 1899026338 to [email protected] !!).exe
c:\users\Accueil Tremplin\AppData\Roaming\Microsoft\Office\MSO1031.acl(!! to get password email id 1899026338 to [email protected] !!).exe
c:\users\Accueil Tremplin\AppData\Roaming\Microsoft\Office\MSO1033.acl(!! to get password email id 1899026338 to [email protected] !!).exe
c:\users\Accueil Tremplin\AppData\Roaming\Microsoft\Office\MSO1036.acl(!! to get password email id 1899026338 to [email protected] !!).exe
c:\users\Accueil Tremplin\AppData\Roaming\Microsoft\Office\MSO2057.acl(!! to get password email id 1899026338 to [email protected] !!).exe
c:\users\Accueil Tremplin\AppData\Roaming\Microsoft\Office\pg_custom.xml(!! to get password email id 1899026338 to [email protected] !!).exe
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2017-06-16 au 2017-07-16 ))))))))))))))))))))))))))))))))))))
.
.
2017-07-16 08:09 . 2017-07-16 08:09 -------- d-----w- c:\users\MSSQLSERVER\AppData\Local\temp
2017-07-16 08:09 . 2017-07-16 08:09 -------- d-----w- c:\users\Default\AppData\Local\temp
2017-07-16 08:02 . 2017-07-16 08:02 -------- d-----w- c:\users\Accueil Tremplin\AppData\Local\ElevatedDiagnostics
2017-07-16 07:55 . 2017-07-16 07:55 221390 ----a-w- C:\RannohDecryptor.1.9.6.1_16.07.2017_00.54.38_log.txt(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-16 07:50 . 2017-07-16 07:50 -------- d-----w- c:\windows\LastGood
2017-07-16 07:24 . 2017-07-16 07:24 -------- d-----w- c:\program files\Common Files\AV
2017-07-16 07:21 . 2017-07-16 07:21 219454 ----a-w- c:\users\Default\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\64bit\security.config.cch(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-16 07:17 . 2017-07-16 07:17 578654 ----a-w- c:\programdata\Microsoft\VisualStudio\10.0\1036\devenv.CTM(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-16 07:16 . 2017-07-16 07:16 237502 ----a-w- c:\program files (x86)\MSBuild\Microsoft\VisualStudio\v10.0\WebApplications\Microsoft.WebApplication.targets(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-16 07:16 . 2017-07-16 07:16 447230 ----a-w- c:\program files (x86)\MSBuild\Microsoft\VisualStudio\v10.0\Web\Microsoft.Web.Publishing.targets(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-16 07:16 . 2017-07-16 07:16 245214 ----a-w- c:\program files (x86)\MSBuild\Microsoft\VisualStudio\v10.0\Web\Microsoft.Web.Publishing.OnlyFilesToRunTheApp.targets(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-16 07:16 . 2017-07-16 07:16 232654 ----a-w- c:\program files (x86)\MSBuild\Microsoft\VisualStudio\v10.0\Web\Microsoft.Web.Publishing.AllFilesInTheProject.targets(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-16 07:16 . 2017-07-16 07:16 228958 ----a-w- c:\program files (x86)\MSBuild\Microsoft\VisualStudio\v10.0\Web\Microsoft.Web.Publishing.AllFilesInProjectFolder.targets(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-16 07:16 . 2017-07-16 07:16 220270 ----a-w- c:\program files (x86)\MSBuild\Microsoft\VisualStudio\v10.0\ReportingServices\Microsoft.ReportingServices.targets(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-16 07:13 . 2017-07-16 07:13 218878 ----a-w- C:\OS(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-16 02:59 . 2017-07-16 02:59 221550 ----a-w- c:\users\Accueil Tremplin\AppData\Roaming\Microsoft\Outlook\Outlook.xml(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-16 02:59 . 2017-07-16 02:59 219374 ----a-w- c:\users\Accueil Tremplin\AppData\Roaming\Microsoft\Publisher\PubAPSet.xml(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-15 23:27 . 2013-05-06 06:13 110176 ----a-w- c:\windows\system32\klfphc.dll
2017-07-15 23:26 . 2017-07-15 23:26 -------- d-----w- c:\windows\ELAMBKUP
2017-07-15 23:26 . 2017-07-16 08:00 -------- d-----w- c:\programdata\Kaspersky Lab
2017-07-15 23:26 . 2017-07-15 23:29 -------- d-----w- c:\program files (x86)\Kaspersky Lab
2017-07-15 23:26 . 2017-07-16 08:02 1035480 ----a-w- c:\windows\system32\drivers\klif.sys
2017-07-15 23:26 . 2017-07-16 08:02 195296 ----a-w- c:\windows\system32\drivers\klflt.sys
2017-07-15 23:26 . 2017-03-29 10:11 313120 ----a-w- c:\windows\system32\drivers\klhk.sys
2017-07-15 22:56 . 2013-09-20 08:49 21040 ----a-w- c:\windows\system32\sdnclean64.exe
2017-07-15 22:56 . 2017-07-15 23:14 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2017-07-15 22:56 . 2017-07-16 07:55 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
2017-07-15 22:52 . 2017-07-15 22:53 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
2017-07-15 18:38 . 2017-07-15 18:38 220878 ----a-w- c:\users\MSSQLSERVER\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\64bit\security.config.cch(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-15 18:38 . 2017-07-15 18:38 219022 ----a-w- c:\programdata\Microsoft\NetFramework\BreadcrumbStore\EntityFramework.SqlServer, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-15 18:38 . 2017-07-15 18:38 219006 ----a-w- c:\programdata\Microsoft\NetFramework\BreadcrumbStore\EntityFramework.SqlServer, Culture=neutral, PublicKeyToken=b77a5c561934e089(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-15 18:38 . 2017-07-15 18:38 1943630 ----a-w- c:\programdata\Microsoft\eHome\mcepg2-0.db(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-15 18:08 . 2017-07-16 07:30 -------- d-----w- C:\07152008236
2017-07-15 18:08 . 2017-07-15 18:08 -------- d-----w- C:\07152008231
2017-07-15 18:08 . 2017-07-15 14:15 1785856 ----a-w- c:\windows\SysWow64\lsassw86s.exe
2017-07-15 18:08 . 2016-05-20 07:54 150 ----a-w- c:\windows\SysWow64\btlogoffusrsmtv.bat
2017-07-15 18:08 . 2016-02-03 21:38 218624 ----a-w- c:\windows\SysWow64\default2.sfx
2017-07-15 18:08 . 2016-02-03 21:38 510456 ----a-w- c:\windows\SysWow64\cfwin32.dll
2017-07-15 18:08 . 2013-03-29 16:39 39 ----a-w- c:\windows\SysWow64\wblsys32vt86exkdll.dll
2017-07-15 18:08 . 2013-01-09 10:26 155736 ----a-w- c:\windows\SysWow64\sdelete.dll
2017-07-14 14:32 . 2017-06-20 17:35 13120896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4E057EA5-9D30-4F4B-B68F-2A4C09628FEB}\mpengine.dll
2017-07-12 01:40 . 2017-06-29 06:27 25734656 ----a-w- c:\windows\system32\mshtml.dll
2017-07-12 01:38 . 2017-06-16 14:53 4246528 ----a-w- c:\program files (x86)\Windows NT\Accessories\wordpad.exe
2017-07-06 16:56 . 2017-07-06 16:56 -------- d-----w- c:\users\Accueil Tremplin\AppData\Local\DigitalPersona,_Inc
2017-06-23 08:47 . 2017-06-23 08:47 451272 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE
2017-06-23 08:47 . 2017-06-23 08:47 28360 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll
2017-06-23 08:36 . 2017-06-23 08:36 213704 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2017-07-16 08:02 . 2016-06-14 15:47 199392 ----a-w- c:\windows\system32\drivers\kneps.sys
2017-07-16 07:19 . 2017-07-16 07:19 222350 ----a-w- c:\users\Accueil Tremplin\AppData\Roaming\Microsoft\Signatures\Réponse automatique absence_fichiers\themedata.thmx(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-16 03:00 . 2017-07-16 03:00 219230 ----a-w- c:\users\Accueil Tremplin\AppData\Roaming\Microsoft\Signatures\Réponse automatique absence_fichiers\filelist.xml(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-16 03:00 . 2017-07-16 03:00 258366 ----a-w- c:\users\Accueil Tremplin\AppData\Roaming\Microsoft\Signatures\Réponse automatique absence.rtf(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-16 03:00 . 2017-07-16 03:00 218974 ----a-w- c:\users\Accueil Tremplin\AppData\Roaming\Microsoft\Signatures\Réponse automatique absence.txt(!! to get password email id 1899026338 to [email protected] !!).exe
2017-07-13 01:07 . 2016-09-09 08:24 135225752 -c--a-w- c:\windows\system32\MRT.exe
2017-07-01 05:11 . 2016-08-12 08:19 3316936 ----a-w- c:\programdata\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
2017-06-02 08:10 . 2017-06-13 18:19 733696 ----a-w- c:\windows\HelpPane.exe
2017-05-26 01:02 . 2017-05-14 01:01 1705080 ----a-w- c:\windows\SysWow64\RebootPrompt.exe
2017-05-24 01:43 . 2017-05-24 01:43 60168 ----a-w- c:\windows\system32\CxPageMaster64.dll
2017-05-24 01:43 . 2017-05-24 01:43 1049248 ----a-w- c:\windows\system32\CX64BP30.dll
2017-05-24 01:43 . 2017-05-24 01:43 558528 ----a-w- c:\windows\system32\CX64APO2.dll
2017-05-24 01:43 . 2017-05-24 01:43 418616 ----a-w- c:\windows\system32\CSpkExt64.dll
2017-05-24 01:42 . 2017-05-24 01:42 4892512 ----a-w- c:\windows\system32\UCI64A164.DLL
2017-05-24 01:42 . 2017-05-24 01:42 1615456 ----a-w- c:\windows\system32\drivers\CHDRT64.sys
2017-05-17 13:42 . 2017-05-17 13:42 4801888 ----a-w- c:\windows\system32\UCI64A142.DLL
2017-05-16 15:30 . 2017-07-12 01:39 309760 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2017-05-16 15:12 . 2017-07-12 01:39 2179072 ----a-w- c:\windows\apppatch\AcGenral.dll
2017-05-16 15:12 . 2017-07-12 01:38 2560 ----a-w- c:\windows\apppatch\AcRes.dll
2017-05-14 08:09 . 2017-05-20 01:03 2758232 ----a-w- c:\windows\system32\MicTray64.exe
2017-05-12 18:27 . 2017-06-13 18:19 631176 ----a-w- c:\windows\system32\winresume.efi
2017-05-12 18:26 . 2017-06-13 18:19 706792 ----a-w- c:\windows\system32\winload.efi
2017-05-12 18:26 . 2017-06-13 18:19 5547752 ----a-w- c:\windows\system32\ntoskrnl.exe
2017-05-12 18:26 . 2017-06-13 18:19 382696 ----a-w- c:\windows\system32\atmfd.dll
2017-05-12 18:24 . 2017-06-13 18:19 1732864 ----a-w- c:\windows\system32\ntdll.dll
2017-05-12 18:22 . 2017-06-13 18:19 362496 ----a-w- c:\windows\system32\wow64win.dll
2017-05-12 18:22 . 2017-06-13 18:19 243712 ----a-w- c:\windows\system32\wow64.dll
2017-05-12 18:22 . 2017-06-13 18:19 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2017-05-12 18:22 . 2017-06-13 18:19 215552 ----a-w- c:\windows\system32\winsrv.dll
2017-05-12 18:22 . 2017-06-13 18:19 806912 ----a-w- c:\windows\system32\usp10.dll
2017-05-12 18:22 . 2017-06-13 18:19 503808 ----a-w- c:\windows\system32\srcore.dll
2017-05-12 18:22 . 2017-06-13 18:19 50176 ----a-w- c:\windows\system32\srclient.dll
2017-05-12 18:22 . 2017-06-13 18:19 63488 ----a-w- c:\windows\system32\setbcdlocale.dll
2017-05-12 18:22 . 2017-06-13 18:19 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2017-05-12 18:22 . 2017-06-13 18:19 419840 ----a-w- c:\windows\system32\KernelBase.dll
2017-05-12 18:22 . 2017-06-13 18:19 1163264 ----a-w- c:\windows\system32\kernel32.dll
2017-05-12 18:22 . 2017-06-13 18:19 41472 ----a-w- c:\windows\system32\lpk.dll
2017-05-12 18:22 . 2017-06-13 18:19 405504 ----a-w- c:\windows\system32\gdi32.dll
2017-05-12 18:22 . 2017-06-13 18:19 100864 ----a-w- c:\windows\system32\fontsub.dll
2017-05-12 18:22 . 2017-06-13 18:19 44032 ----a-w- c:\windows\system32\csrsrv.dll
2017-05-12 18:22 . 2017-06-13 18:19 14336 ----a-w- c:\windows\system32\dciman32.dll
2017-05-12 18:22 . 2017-06-13 18:19 46080 ----a-w- c:\windows\system32\atmlib.dll
2017-05-12 18:22 . 2017-06-13 18:19 880640 ----a-w- c:\windows\system32\advapi32.dll
2017-05-12 18:22 . 2017-06-13 18:19 59904 ----a-w- c:\windows\system32\appidapi.dll
2017-05-12 18:22 . 2017-06-13 18:19 34816 ----a-w- c:\windows\system32\appidsvc.dll
2017-05-12 18:22 . 2017-06-13 18:19 6656 ----a-w- c:\windows\system32\apisetschema.dll
2017-05-12 18:22 . 2017-06-13 18:19 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-05-12 18:22 . 2017-06-13 18:19 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-05-12 18:07 . 2017-06-13 18:19 4001000 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2017-05-12 18:07 . 2017-06-13 18:19 3945704 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2017-05-12 18:07 . 2017-06-13 18:19 308456 ----a-w- c:\windows\SysWow64\atmfd.dll
2017-05-12 18:04 . 2017-06-13 18:19 1314112 ----a-w- c:\windows\SysWow64\ntdll.dll
2017-05-12 18:03 . 2017-06-13 18:19 313344 ----a-w- c:\windows\SysWow64\gdi32.dll
2017-05-12 18:03 . 2017-06-13 18:19 275456 ----a-w- c:\windows\SysWow64\KernelBase.dll
2017-05-12 18:03 . 2017-06-13 18:19 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2017-05-12 18:03 . 2017-06-13 18:19 25600 ----a-w- c:\windows\SysWow64\lpk.dll
2017-05-12 18:03 . 2017-06-13 18:19 629760 ----a-w- c:\windows\SysWow64\usp10.dll
2017-05-12 18:03 . 2017-06-13 18:19 43008 ----a-w- c:\windows\SysWow64\srclient.dll
2017-05-12 18:03 . 2017-06-13 18:19 70656 ----a-w- c:\windows\SysWow64\fontsub.dll
2017-05-12 18:03 . 2017-06-13 18:19 10240 ----a-w- c:\windows\SysWow64\dciman32.dll
2017-05-12 18:03 . 2017-06-13 18:19 644096 ----a-w- c:\windows\SysWow64\advapi32.dll
2017-05-12 18:03 . 2017-06-13 18:19 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2017-05-12 18:03 . 2017-06-13 18:19 5120 ---ha-w- c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
2017-05-12 18:03 . 2017-06-13 18:19 50688 ----a-w- c:\windows\SysWow64\appidapi.dll
2017-05-12 18:03 . 2017-06-13 18:19 4608 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
2017-05-12 18:03 . 2017-06-13 18:19 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2017-05-12 18:03 . 2017-06-13 18:19 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-05-12 18:03 . 2017-06-13 18:19 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
2017-05-12 18:03 . 2017-06-13 18:19 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
2017-05-12 18:03 . 2017-06-13 18:19 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
2017-05-12 18:03 . 2017-06-13 18:19 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
2017-05-12 18:03 . 2017-06-13 18:19 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-05-12 18:03 . 2017-06-13 18:19 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-05-12 18:03 . 2017-06-13 18:19 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
.
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2017-06-30 9818328]
.
c:\users\Accueil Tremplin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Mozy Sync.lnk - c:\program files\Mozy Sync\mozysync.exe [2017-5-11 9634304]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ DPPassFilter scecli c:\program files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 igfxCUIService2.0.0.0;Intel(R) HD Graphics Control Panel Service;c:\windows\system32\igfxCUIService.exe;c:\windows\SYSNATIVE\igfxCUIService.exe [x]
R2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 WinSamSs;Windows Security Accounts Manager;c:\windows\SysWOW64\lsassw86s.exe;c:\windows\SysWOW64\lsassw86s.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;c:\program files\Intel\iCLS Client\SocketHeciServer.exe;c:\program files\Intel\iCLS Client\SocketHeciServer.exe [x]
R3 klvssbrigde64;klvssbrigde64;c:\program files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\x64\vssbridge64.exe;c:\program files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\x64\vssbridge64.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys;c:\windows\SYSNATIVE\DRIVERS\revoflt.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WSDScan;Prise en charge de la numérisation WSD via UMB;c:\windows\system32\DRIVERS\WSDScan.sys;c:\windows\SYSNATIVE\DRIVERS\WSDScan.sys [x]
R4 cbVSCService11;Cobian Backup 11 Service « Volume Shadow Copy »;c:\program files (x86)\Cobian Backup 11\cbVSCService11.exe;c:\program files (x86)\Cobian Backup 11\cbVSCService11.exe [x]
R4 ClickToRunSvc;Service Microsoft Office « Démarrer en un clic »;c:\program files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe;c:\program files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [x]
R4 CxAudMsg;Conexant Audio Message Service;c:\windows\system32\CxAudMsg64.exe;c:\windows\SYSNATIVE\CxAudMsg64.exe [x]
R4 CxMonSvc;CxMonSvc;c:\windows\CxSvc\CxMonSvc.exe;c:\windows\CxSvc\CxMonSvc.exe [x]
R4 CxUtilSvc;CxUtilSvc;c:\program files\Conexant\SA3\HP-NB-AIO\CxUtilSvc.exe;c:\program files\Conexant\SA3\HP-NB-AIO\CxUtilSvc.exe [x]
R4 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
R4 DTuneSrvc;PDI Display Tune Service;c:\program files (x86)\Common Files\Portrait Displays\Libs\DTuneSrvc.exe;c:\program files (x86)\Common Files\Portrait Displays\Libs\DTuneSrvc.exe [x]
R4 EpsonScanSvc;Epson Scanner Service;c:\windows\system32\EscSvc64.exe;c:\windows\SYSNATIVE\EscSvc64.exe [x]
R4 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
R4 RsFx0300;RsFx0300 Driver;c:\windows\system32\DRIVERS\RsFx0300.sys;c:\windows\SYSNATIVE\DRIVERS\RsFx0300.sys [x]
R4 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
R4 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
S0 cm_km;AO Kaspersky Lab Cryptographic Module x64 (56 bit);c:\windows\system32\DRIVERS\cm_km.sys;c:\windows\SYSNATIVE\DRIVERS\cm_km.sys [x]
S0 iaStorA;iaStorA;c:\windows\system32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]
S0 iaStorF;iaStorF;c:\windows\system32\drivers\iaStorF.sys;c:\windows\SYSNATIVE\drivers\iaStorF.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\drivers\iusb3hcs.sys;c:\windows\SYSNATIVE\drivers\iusb3hcs.sys [x]
S0 klbackupdisk;Kaspersky Lab klbackupdisk;c:\windows\system32\DRIVERS\klbackupdisk.sys;c:\windows\SYSNATIVE\DRIVERS\klbackupdisk.sys [x]
S0 stornvme;Microsoft Standard NVM Express Driver;c:\windows\system32\drivers\stornvme.sys;c:\windows\SYSNATIVE\drivers\stornvme.sys [x]
S1 CLVirtualDrive;CLVirtualDrive;c:\windows\system32\DRIVERS\CLVirtualDrive.sys;c:\windows\SYSNATIVE\DRIVERS\CLVirtualDrive.sys [x]
S1 klbackupflt;Kaspersky Lab klbackupflt;c:\windows\system32\DRIVERS\klbackupflt.sys;c:\windows\SYSNATIVE\DRIVERS\klbackupflt.sys [x]
S1 klhk;Kaspersky Lab service driver;c:\windows\system32\DRIVERS\klhk.sys;c:\windows\SYSNATIVE\DRIVERS\klhk.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 klpd;Kaspersky Lab format recognizer driver;c:\windows\system32\DRIVERS\klpd.sys;c:\windows\SYSNATIVE\DRIVERS\klpd.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 Klwtp;KLwtp - WFP callout traffic inspector;c:\windows\system32\DRIVERS\klwtp.sys;c:\windows\SYSNATIVE\DRIVERS\klwtp.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 AVP17.0.0;Kaspersky Anti-Virus Service 17.0.0;c:\program files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\avp.exe;c:\program files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 17.0.0\avp.exe [x]
S2 HPSupportSolutionsFrameworkService;HP Support Solutions Framework Service;c:\program files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe;c:\program files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [x]
S2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe;c:\windows\SYSNATIVE\IProsetMonitor.exe [x]
S2 kldisk;kldisk;c:\windows\system32\DRIVERS\kldisk.sys;c:\windows\SYSNATIVE\DRIVERS\kldisk.sys [x]
S3 bcbtums;Bluetooth RAM Firmware Download USB Filter;c:\windows\system32\drivers\bcbtums.sys;c:\windows\SYSNATIVE\drivers\bcbtums.sys [x]
S3 btwampfl;btwampfl;c:\windows\system32\DRIVERS\btwampfl.sys;c:\windows\SYSNATIVE\DRIVERS\btwampfl.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
S3 e1dexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver D;c:\windows\system32\DRIVERS\e1d62x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1d62x64.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\drivers\iusb3hub.sys;c:\windows\SYSNATIVE\drivers\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\drivers\iusb3xhc.sys;c:\windows\SYSNATIVE\drivers\iusb3xhc.sys [x]
S3 klflt;Kaspersky Lab Kernel DLL;c:\windows\system32\DRIVERS\klflt.sys;c:\windows\SYSNATIVE\DRIVERS\klflt.sys [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 kltap;Kaspersky Security Data Escort Adapter;c:\windows\system32\DRIVERS\kltap.sys;c:\windows\SYSNATIVE\DRIVERS\kltap.sys [x]
S3 RTSPER;Realtek PCIE Card Reader - PER;c:\windows\system32\DRIVERS\RtsPer.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPer.sys [x]
S4 KSDE1.0.0;Kaspersky Secure Connection Service 1.0.0;c:\program files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksde.exe;c:\program files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksde.exe [x]
.
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - KLBACKUPDISK
*NewlyCreated* - KLBACKUPFLT
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ mozysyncNotUploaded]
@="{34DF8AC2-A6BB-4855-B45A-CC1B4D9183E3}"
[HKEY_CLASSES_ROOT\CLSID\{34DF8AC2-A6BB-4855-B45A-CC1B4D9183E3}]
2017-05-11 11:05 892928 ----a-w- c:\program files\Mozy Sync\mozysyncshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ mozysyncPendingChanges]
@="{6673BC77-4A7B-4299-A130-14312E6B203A}"
[HKEY_CLASSES_ROOT\CLSID\{6673BC77-4A7B-4299-A130-14312E6B203A}]
2017-05-11 11:05 892928 ----a-w- c:\program files\Mozy Sync\mozysyncshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ mozysyncUpToDate]
@="{04547006-32F5-4635-844B-B8D7FCE47692}"
[HKEY_CLASSES_ROOT\CLSID\{04547006-32F5-4635-844B-B8D7FCE47692}]
2017-05-11 11:05 892928 ----a-w- c:\program files\Mozy Sync\mozysyncshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2017-07-01 05:15 3132104 ----a-w- c:\program files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2017-07-01 05:15 3132104 ----a-w- c:\program files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2017-07-01 05:15 3132104 ----a-w- c:\program files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\program files\Broadcom\Broadcom 802.11\WLTRAY.exe" [2016-06-15 8641536]
"DeliveryAndStatusCheck"="c:\program files\HP\HP ePrint\HP.DeliveryAndStatus.Desktop.App.exe" [2015-11-11 301832]
"MicTray"="c:\program files\Conexant\MicTray\MicTray64.exe" [2017-05-14 2758232]
.
------- Examen supplémentaire -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\program files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\program files (x86)\Microsoft Office\Root\Office16\ONBttnIE.dll/105
TCP: Interfaces\{30F0B2DD-6592-4738-B6F5-76D31DC6F303}: NameServer = 192.168.1.1,8.8.8.8
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - c:\program files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - c:\program files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - c:\program files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - c:\program files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
FF - ProfilePath - c:\users\Accueil Tremplin\AppData\Roaming\Mozilla\Firefox\Profiles\rpwxzl6l.default\
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Notify-SDWinLogon - SDWinLogon.dll
HKLM_Wow6432Node-ActiveSetup-{438363A8-F486-4C37-834C-4955773CB3D3} - msiexec
HKLM_Wow6432Node-ActiveSetup-{8A69D345-D564-463c-AFF1-A69D9E530F96} - c:\program files (x86)\Google\Chrome\Application\58.0.3029.81\Installer\chrmstp.exe
AddRemove-{78E2C850-ADA6-420D-BA35-2F4A9BE733CC} - c:\program files (x86)\InstallShield Installation Information\{78E2C850-ADA6-420D-BA35-2F4A9BE733CC}\setup.exe
.
.
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Heure de fin: 2017-07-16 10:19:33
ComboFix-quarantined-files.txt 2017-07-16 08:19
.
Avant-CF: 405 204 512 768 octets libres
Après-CF: 404 872 441 856 octets libres
.
- - End Of File - - 2F0EBF1DA416A8F2986FE9918FCCBAB2
A36C5E4F47E84449FF07ED3517B43A31

Qu'est-il possible de faire ?
Merci pour votre aide

[Malekal_morte]

Salut,

Windows a été infecté par un ransomware / rançongiciel chiffreur de fichiers. Ces rançongiciels s'attrapent essentiellement par l'ouverture d'une pièce jointe malicieuse dans un e-mail ou par la visite d'une page internet piégée par des exploits WEB.

A l'heure actuelle, il n'y a pas vraiment de méthode pour récupérer les documents chiffrés. Si les données sont très importantes, les stocker temporairement à l'abri car peut-être qu'il y aura dans le futur une solution pour les récupérer.
Tente de récupérer les fichiers avec Shadow Explorer - versions précédentes
sinon il faudra attendre une solution donnée sur le page : Decrypt Tools pour les ransomwares

Si tu peux zipper C:\Qoobox\quarantine\c:\programdata\07152008235 et l'envoyer sur http://upload.malekal.com
Ce serait cool.

~~

Désinstalle Spybot s'il est installé
Totalement inefficace

~~

Il faut vérifier qu'aucune menace ne soit encore active.
Par précaution, pense aussi à changer tous tes mots de passe.

1°) FRST
Suis le tutoriel FRST. ( prends le temps de lire attentivement - tout y est bien expliqué ).

Télécharge et lance le scan FRST, 3 rapports FRST seront générés :
* FRST.txt
* Shortcut.txt
* Additionnal.txt

Envoie ces 3 rapports sur le site https://pjjoint.malekal.com/ et en retour donne les 3 liens pjjoint qui mènent aux rapports ici dans une nouvelle réponse afin que l'on puisse les consulter.

[SebPMT]

Merci Malekal_morte pour ton éclairage, le probleme a été vite réglé, réinstall de la bécane, le données étaient stockées (et saines) sur cloud et sur un backup.
De toute façon il devenait impossible de désinstaller les softs.
Merci de la rapidité

[Malekal_morte]

ça roule et attention à ce que tu télécharges.

Renforce la sécurité de ton Windows : Comment sécuriser mon Windows

Les points importants :
1) Comment se protéger des scripts malicieux sur Windows
et limiter PowerShell : Les virus Powershell

2) Firewall Windows : les bon régalges