svchost, 500 000K Fermé

Question

Bonjour, je suis nouvelle sur ce site et j'ai beaucoup de problème avec mon portable. Il rame énormement, google chrome passe son temps à planter (ne répond pas), les pages prennent plusieurs minutes à ouvrir, etc.

J'ai constater que j'ai un svchost.exe qui roule au environ de 500 000 K et ça consomme ma mémoire à presque 100% et je me demande si c'est pas le principal problème.

J'ai malwarebyte qui trouve rien
Roguekiller qui ne trouve rien
super antispyware qui trouve rien
J'ai essayer l'autre jour USBfix qui n'a rien trouver non plus
je viens d'essayer TDSSkiller, ça n'a rien trouvé non plus
Je viens de télécharger hijackthis mais honnêtement, je comprend rien au log qui en sort alors ça m'avance pas vraiment!

Je commence à être décourager :P Donc je me demande si quelqu'un ici aurait l'âme charitable pour m'aider avec mon portable qui est en train de me rendre folle.

Merci d'avance :)

Configuration: Windows 7 / Chrome 38.0.2125.111

artaban7 · Answer

Bonsoir,

oui il est connu ce malware ....

je vous propose d'abord un diagnostique
....

Pour le diagnostique il s'agit de ce logiciel : https://nicolascoolman.eu

il suffit de le lancer, il va ensuite créer un rapport sur votre système sur le bureau au format .txt qu'il faudra transmettre ici (ou par MP si vous préférez) à l'aide de : http://pjjoint.malekal.com/

Si vous avez besoins d'explication sur des points précis comme l'utilisation du générateur de fichier, n'hésitez pas.

katou1811 · Answer

Bonjour Artaban 7 Merci beaucoup pour votre aide! voici le rapport que j'ai obtenu : ~ Report of ZHPDiag v2015.4.13.38 - Nicolas Coolman (4/13/2015) ~ Launched by eric (4/13/2015 7:23:23 PM) ~ Facebook : https://www.facebook.com/nicolascoolman1 ~ Web forum address : https://nicolascoolman.eu ~ Translated by ~ Version State : Updated version. ~ White List : Activate by program ~ Elevation of privilege : OK ~ User Account Control : Activate by user ---\ Internet browsers MSIE: Internet Explorer v11.0.9600.17691 GCIE: Google Chrome v38.0.2125.111 (Defaut) ---\ Windows product information ~ Langage: Anglais Windows Server License Manager Script : OK ~ Windows Operating System - Windows(R) 7, OEM_SLP channel System Locked Preinstallation (OEM_SLP) : OK Windows ID Activation : OK ~ Windows Partial Key : 2C9T3 Windows License : OK ~ Windows Remaining Initializations Number : 3 Software Protection Service (Protection logicielle) : OK Windows Automatic Updates : OK Windows Activation Technologies : OK Windows 7 Ultimate, 32-bit Service Pack 1 (Build 7601) ---\ System protection software Malwarebytes Anti-Malware version 2.1.4.1018 Microsoft Security Client v4.7.0205.0 Kaspersky Security Scan v12.0.1.881 SUPERAntiSpyware v6.0.1164 Windows Defender W7 (Deactivate) ---\ System optimization software CCleaner v4.08 ---\ Sharing software PeerToPeer ---\ Surveillance software Adobe Flash Player 11 Plugin Adobe Reader XI ---\ Information on the system ~ Processor: x86 Family 6 Model 13 Stepping 6, GenuineIntel ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 1535.4 MB (42% free) System Restore: Activé (Enable) System drive C: has 45 GB (45%) free of 98 GB ---\ Connection to the system mode ~ Computer Name: ERIC-PC ~ User Name: eric ~ All Users Names: HomeGroupUser$, Guest, eric, Administrator, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\ Environment variables ~ System Unit : C:\ ~ %AppZHP% : C:\Users\eric\AppData\Roaming\ZHP\ ~ %AppData% : C:\Users\eric\AppData\Roaming\ ~ %Desktop% : C:\Users\eric\Desktop\ ~ %Favorites% : C:\Users\eric\Favorites\ ~ %LocalAppData% : C:\Users\eric\AppData\Local\ ~ %StartMenu% : C:\Users\eric\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\ Enumeration of the disk units A: Floppy drive, Flash card reader, USB Key (Not Inserted) C: Hard drive, Flash drive, Thumb drive (Free 45 Go of 98 Go) D: Hard drive, Flash drive, Thumb drive (Free 51 Go of 51 Go) E: CD-ROM drive (Not Inserted) ---\ State of the Windows Security Center ~ Security Center: 46 Legitimates Filtered in 00mn AMs ---\ Search Generic System Files [MD5.8B88EBBB05A0E56B7DCC708498C02B3E] - (.Microsoft Corporation - Explorateur Windows.) (.2/25/2011 - 12:30:54 AM.) -- C:\Windows\Explorer.exe [2616320] [MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Application de démarrage de Windows.) (.7/13/2009 - 8:14:45 PM.) -- C:\Windows\System32\Wininit.exe [96256] [MD5.EA6EA6912F27F05C61D8D747517EB47E] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.2/19/2015 - 8:01:25 PM.) -- C:\Windows\System32\wininet.dll [1888256] [MD5.52449FD429D6053B78AE564DEF303870] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.7/16/2014 - 8:39:27 PM.) -- C:\Windows\System32\Winlogon.exe [304128] [MD5.E3AE23569749DE12D45BA3B489A036AE] - (.Microsoft Corporation - Bibliothèque de licences.) (.11/20/2010 - 4:29:24 PM.) -- C:\Windows\System32\sppcomapi.dll [193536] [MD5.D0B388DA1D111A34366E04EB4A5DD156] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.5/30/2014 - 1:36:07 AM.) -- C:\Windows\system32\Drivers\AFD.sys [338944] [MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.7/13/2009 - 8:26:15 PM.) -- C:\Windows\system32\Drivers\atapi.sys [21584] [MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.7/13/2009 - 6:11:15 PM.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656] [MD5.BE167ED0FDB9C1FA1133953C18D5A6C9] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.11/20/2010 - 4:29:03 PM.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544] [MD5.F024449C97EC1E464AAFFDA18593DB88] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.11/20/2010 - 4:29:07 PM.) -- C:\Windows\system32\Drivers\DfsC.sys [78336] [MD5.9036377B8A6C15DC2EEC53E489D159B5] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.11/20/2010 - 4:29:03 PM.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544] [MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - Pilote de port i8042.) (.7/13/2009 - 6:11:24 PM.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896] [MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.7/13/2009 - 6:54:29 PM.) -- C:\Windows\system32\Drivers\IpNat.sys [101888] [MD5.5D16C921E3671636C0EBA3BBAAC5FD25] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.4/26/2011 - 9:17:22 PM.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123904] [MD5.280122DDCF04B378EDD1AD54D71C1E54] - (.Microsoft Corporation - MBT Transport driver.) (.11/20/2010 - 4:29:08 PM.) -- C:\Windows\system32\Drivers etBT.sys [187904] [MD5.C8DFF8D07755A66C7A4A738930F0FEAC] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.1/23/2014 - 9:18:22 PM.) -- C:\Windows\system32\Drivers tfs.sys [1212352] [MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - Pilote de port parallèle.) (.7/13/2009 - 6:45:35 PM.) -- C:\Windows\system32\Drivers\Parport.sys [79360] [MD5.D9F91EAFEC2815365CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.7/13/2009 - 6:54:34 PM.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848] [MD5.B973FCFC50DC1434E1970A146F7E3885] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.11/20/2010 - 4:29:49 PM.) -- C:\Windows\system32\Drivers dpdr.sys [133632] [MD5.3E21C083B8A01CB70BA1F09303010FCE] - (.Microsoft Corporation - SMB Transport driver.) (.7/13/2009 - 6:53:41 PM.) -- C:\Windows\system32\Drivers\smb.sys [71168] [MD5.7FE680A3DFA421C4A8E4879AE4C5AAB0] - (.Microsoft Corporation - TDI Translation Driver.) (.11/10/2014 - 8:32:14 PM.) -- C:\Windows\system32\Drivers dx.sys [74752] [MD5.F497F67932C6FA693D7DE2780631CFE7] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.11/20/2010 - 4:29:03 PM.) -- C:\Windows\system32\Drivers\volsnap.sys [245632] ~ Generic Processes: Scanned in 01mn AMs ---\ Hidden files state (Hidden/Total) ~ Mes images (My Pictures) : 1/399 ~ Mes musiques (My Musics) : 1/2018 ~ Mes Videos (My Videos) : 1/13 ~ Mes Favoris (My Favorites) : 1/37 ~ Mes Documents (My Documents) : 1/286 ~ Mon Bureau (My Desktop) : 3/2089 ~ Menu demarrer (Programs) : 1/28 ~ Hidden Files: Scanned in 12mn AMs ---\ Process running [MD5.51138BEEA3E2C21EC44D0932C71762A8] - (...) -- ystem32 undll32.exe [0] [PID.2352] [MD5.51508F0C2476177E50C31B0BBFBF1BDB] - (.Google Inc. - Programme d'installation de Google.) -- C:\Users\eric\AppData\Local\Google\Update\GoogleUpdate.exe [107912] [PID.2084] [MD5.072678E0D68E9C3A7960328671134C7B] - (.Microsoft Corporation - Windows Update.) -- C:\Windows\system32\wuauclt.exe [54240] [PID.492] [MD5.66A4A7C7802E0968E07647999FFC87E2] - (.Google Inc. - Google Chrome.) -- C:\Users\eric\AppData\Local\Google\Chrome\Application\chrome.exe [854344] [PID.4048] [MD5.3446EFE5B35A7478CA26932084F2E1C6] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8197120] [PID.2232] [MD5.5FEAB868CAEDBBD1B7A145CA8261E4AA] - (.Microsoft Corporation - Rapports de problèmes Windows.) -- C:\Windows\system32\werfault.exe [360448] [PID.0] ~ Processes Running: Scanned in 00mn AMs ---\ Google Chrome, Start,Search,Extensions (G0,G1,G2) C:\Users\eric\AppData\Local\Google\Chrome\User Data\Default\Preferences G2 - GCE: Preference [User Data\Default] [dnhpdliibojhegemfjheidglijccjfmc] hotword helper v.0.0.2.0 (Activé) G2 - GCE: Preference [User Data\Default] [kmendfapggjehodndflmmgagdbamhnfd] CryptoTokenExtension v.0.8.59 (Activé) G2 - GCE: Preference [User Data\Default] [lojpenhmoajbiciapkjkiekmobleogjc] Default Placeholder Extensions v.35.2.1, (Activé) G2 - GCE: Preference [User Data\Default] [mfffpogegjflfpflabcdkioaeobkgjik] GaiaAuthExtension v.0.0.1, (Activé) G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé) G2 - GCE: Preference [User Data\Default] [pafkbggdmjlpgkdkcbjmhmfcdpncadgh] Google Now v.1.2.0.1 (Activé) ---\ Google Chrome Extension Folder ~ Google Lines Browser: 14 Legitimates Filtered in 13mn AMs ---\ Internet Explorer Extensions, Start, Search (R4,R3,R0,R1) R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = preserve ~ IE Browser: 11 Legitimates Filtered in 00mn AMs ---\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn AMs ---\ Line Analysis F0, F1, F2, F3 - IniFiles, Auto loading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe ~ Keys: Scanned in 00mn AMs ---\ Hosts file redirection (O1) ~ Le fichier hôte est sain (The hosts file is clean) (25) ~ Hosts File: Scanned in 00mn AMs ---\ Auto loading programs from Registry and folders (O4) O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\eric\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc O4 - HKCU\..\RunOnce: [Application Restart #1] . (.Google Inc. - Google Chrome.) -- C:\Users\eric\AppData\Local\Google\Chrome\Application\chrome.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-21-1770399669-2001577007-2657050352-1001\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\eric\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc O4 - HKUS\S-1-5-21-1770399669-2001577007-2657050352-1001\..\RunOnce: [Application Restart #1] . (.Google Inc. - Google Chrome.) -- C:\Users\eric\AppData\Local\Google\Chrome\Application\chrome.exe ~ Application: Scanned in 00mn AMs ---\ Extra buttons on main IE button toolbar, or extra items in IE 'Tools' menu (O9) O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} -- C:\Program Files\PokerStars\main.ico (.not file.) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\OFFICE11\REFBARH.ICO O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} -- C:\Program Files\PokerStars.NET\main.ico (.not file.) ~ IE Extra Buttons: Scanned in 00mn AMs ---\ Lop.com/Domain Hijackers (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{24210476-26AD-4F16-8B4B-BE68574B7D18}: NameServer = 8.8.8.8 O17 - HKLM\System\CCS\Services\Tcpip\..\{24210476-26AD-4F16-8B4B-BE68574B7D18}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{24210476-26AD-4F16-8B4B-BE68574B7D18}: DhcpDomain = gateway.2wire.net O17 - HKLM\System\CS1\Services\Tcpip\..\{24210476-26AD-4F16-8B4B-BE68574B7D18}: NameServer = 8.8.8.8 O17 - HKLM\System\CS1\Services\Tcpip\..\{24210476-26AD-4F16-8B4B-BE68574B7D18}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{24210476-26AD-4F16-8B4B-BE68574B7D18}: DhcpDomain = gateway.2wire.net O17 - HKLM\System\CS2\Services\Tcpip\..\{24210476-26AD-4F16-8B4B-BE68574B7D18}: NameServer = 8.8.8.8 O17 - HKLM\System\CS2\Services\Tcpip\..\{24210476-26AD-4F16-8B4B-BE68574B7D18}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{24210476-26AD-4F16-8B4B-BE68574B7D18}: DhcpDomain = gateway.2wire.net O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 ~ Domain: Scanned in 00mn AMs ---\ Extra protocols (O18) O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.dll =>.Microsoft Corporation ~ Protocole Additionnel: Scanned in 00mn AMs ---\ Non Microsoft non disabled Windows XP/NT/2000 Services (O23) O23 - Service: Kaspersky Security Scan Service (KSS) . (...) - C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe (.not file.) ~ Services: 4 Legitimates Filtered in 04mn AMs ---\ Task Planned Automatically (039) [MD5.00000000000000000000000000000000] [APT] [{5787C2D9-3971-4DCB-AF37-D86E3C832B44}] (...) -- E:\setup\FR_QRS\setup.exe (.not file.) [0] O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore [882] O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA [886] O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1770399669-2001577007-2657050352-1001Core [852] O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1770399669-2001577007-2657050352-1001UA [904] ~ Scheduled Task: 12 Legitimates Filtered in 07mn AMs ---\ Software installed (O42) O42 - Logiciel: PokerStars - (.PokerStars.) [HKLM] -- PokerStars ~ Logic: 14 Legitimates Filtered in 00mn AMs ---\ HKCU & HKLM Software Keys [HKCU\Software\WSysInfo] [HKLM\Software\File Type Helper] =>PUP.FileTypeHelper [HKLM\Software\ZUpdater] ~ Key Software: 116 Legitimates Filtered in 00mn AMs ---\ Contents of the Common Files folders (O43) O43 - CFD: 12/21/2014 - 9:28:37 PM - [] ----D C:\Program Files\PokerStars O43 - CFD: 3/23/2014 - 9:55:12 PM - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerStars O43 - CFD: 11/20/2010 - 8:46:50 PM - [0] R-H-D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC O43 - CFD: 11/21/2014 - 11:47:28 AM - [] -SH-D C:\Users\eric\AppData\Local\EmieBrowserModeList O43 - CFD: 2/27/2015 - 11:25:30 PM - [] ----D C:\Users\eric\AppData\Local\PokerStars O43 - CFD: 4/17/2013 - 10:40:00 PM - [0] ----D C:\Users\eric\AppData\Local\PokerStars.NET ~ Program Folder: 121 Legitimates Filtered in 00mn AMs ---\ Last modified or created files under Windows and System32 (O44) O44 - LFC:[MD5.D3305942321F89588F2675B5AA428DCA] - 4/12/2015 - 10:10:46 AM ---A- . (...) -- C:\TDSSKiller.3.0.0.44_12.04.2015_11.07.57_log.txt [197816] O44 - LFC:[MD5.A29232BB41172CC271392F8854457B25] - 4/12/2015 - 11:17:55 AM ---A- . (...) -- C:\TDSSKiller.3.0.0.44_12.04.2015_12.01.15_log.txt [198298] O44 - LFC:[MD5.FD44FA80DA03EA144153A76DEBBB61B4] - 4/9/2015 - 12:56:42 PM ---A- . (...) -- C:\Windows\System32\Drivers\TrueSight.sys [35064] ~ Files: 8 Legitimates Filtered in 05mn AMs ---\ Microsoft Windows Policies System (MWPS) (O55) O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 ~ MWPS: 16 Legitimates Filtered in 00mn AMs ---\ System Drivers List (SDL) (O58) O58 - SDL:12/21/2009 - 12:14:44 PM ---A- . (.CSR, plc - Bluetooth Hands-free Audio Device Driver.) -- C:\Windows\System32\Drivers\BthAudioHF.sys [43008] O58 - SDL:12/21/2009 - 12:14:26 PM ---A- . (.CSR, plc - Bluetooth A2DP Driver.) -- C:\Windows\System32\Drivers\bthav.sys [61952] O58 - SDL:8/13/2009 - 7:23:02 AM ---A- . (.CSR, plc - Bluetooth Remote Control Driver.) -- C:\Windows\System32\Drivers\BthAvrcp.sys [22528] O58 - SDL:7/13/2009 - 8:20:28 PM ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [453712] O58 - SDL:7/13/2009 - 5:54:14 PM ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [26624] O58 - SDL:7/24/2003 - 2:50:00 PM R--A- . (.O2 Micro - O2Micro MemoryCardBus Slot Manager.) -- C:\Windows\System32\Drivers\MbxStby.sys [5689] O58 - SDL:4/25/2007 - 1:32:42 PM ---A- . (.SMSC - SMSC Fast Infrared Driver.) -- C:\Windows\System32\Drivers\smscirda.sys [31232] O58 - SDL:3/28/2005 - 4:19:38 PM ---A- . (.Analog Devices, Inc. - SoundMAX Integrated Digital Audio.) -- C:\Windows\System32\Drivers\smwdm.sys [220992] O58 - SDL:7/13/2009 - 8:19:04 PM ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [21072] O58 - SDL:4/9/2015 - 12:56:42 PM ---A- . (...) -- C:\Windows\System32\Drivers\TrueSight.sys [35064] O58 - SDL:7/13/2009 - 4:40:41 PM ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029] O58 - SDL:7/13/2009 - 4:40:44 PM ---A- . (...) -- C:\Windows\System32\country.sys [27097] O58 - SDL:7/13/2009 - 4:40:40 PM ---A- . (...) -- C:\Windows\System32\HIMEM.SYS [4768] O58 - SDL:7/13/2009 - 4:40:43 PM ---A- . (...) -- C:\Windows\System32\KEY01.SYS [42809] O58 - SDL:7/13/2009 - 4:40:43 PM ---A- . (...) -- C:\Windows\System32\KEYBOARD.SYS [42537] O58 - SDL:7/13/2009 - 4:40:23 PM ---A- . (...) -- C:\Windows\System32\NTDOS.SYS [27866] O58 - SDL:7/13/2009 - 4:40:31 PM ---A- . (...) -- C:\Windows\System32\NTDOS404.SYS [29146] O58 - SDL:7/13/2009 - 4:40:35 PM ---A- . (...) -- C:\Windows\System32\NTDOS411.SYS [29370] O58 - SDL:7/13/2009 - 4:40:39 PM ---A- . (...) -- C:\Windows\System32\NTDOS412.SYS [29274] O58 - SDL:7/13/2009 - 4:40:27 PM ---A- . (...) -- C:\Windows\System32\NTDOS804.SYS [29146] O58 - SDL:7/13/2009 - 4:40:11 PM ---A- . (...) -- C:\Windows\System32\NTIO.SYS [33952] O58 - SDL:7/13/2009 - 4:40:15 PM ---A- . (...) -- C:\Windows\System32\NTIO404.SYS [34672] O58 - SDL:7/13/2009 - 4:40:17 PM ---A- . (...) -- C:\Windows\System32\NTIO411.SYS [35776] O58 - SDL:7/13/2009 - 4:40:19 PM ---A- . (...) -- C:\Windows\System32\NTIO412.SYS [35536] O58 - SDL:7/13/2009 - 4:40:13 PM ---A- . (...) -- C:\Windows\System32\NTIO804.SYS [34672] ~ Drivers: 72 Legitimates Filtered in 44mn AMs ---\ List all tools cleaner (LATC) (O63) O63 - Logiciel: ZHPDiag 2015 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman ~ ADS: Scanned in 00mn AMs ---\ Start Menu Internet (SMI) (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\eric\AppData\Local\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn AMs ---\ Search Browser Infection (SBI) (O69) O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8 ~ Keys: Scanned in 00mn AMs ---\ Search Particular Root Folder (SPRF) (O84) [MD5.1036E3DDDC89A4E68D8A33F3823A180E] [SPRF][12/26/2014] (...) -- C:\Users\eric\AppData\Roaming\appdataFr2.bin [4] ~ Files: 3 Legitimates Filtered in 00mn AMs ---\ General States of Services not Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Disabled 12/1/2008 720896 | (Ati External Event Utility) . (.ATI Technologies Inc..) - C:\Windows\System32\Ati2evxx.exe SS - | Auto 10/19/2014 107912 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 10/19/2014 107912 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Auto 7/22/1658 0 | (KSS) . (...) - C:\Program Files\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe SS - | Auto 3/17/2015 1080120 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe SS - | Demand 7/13/2009 20992 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 7/22/2014 142648 | (!SASCORE) . (.SUPERAntiSpyware.com.) - C:\Program Files\SUPERAntiSpyware\SASCORE.exe SR - | Auto 12/19/2014 81088 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe SR - | Auto 7/13/2009 20992 | C:\Windows\System32\HFGService.dll (HFGService) . (.CSR, plc.) - C:\Windows\System32\svchost.exe SR - | Auto 1/30/2015 22184 | (MsMpSvc) . (.Microsoft Corporation.) - c:\Program Files\Microsoft Security Client\MsMpEng.exe SR - | Auto 7/13/2009 20992 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe ~ Services: Scanned in 20mn AMs ---\ Scan Additionnel (O88) Database Version : 13008 - (4/13/2015) Clés trouvées (Keys found) : 0 Valeurs trouvées (Values found) : 0 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 1 [HKLM\Software\File Type Helper] =>PUP.FileTypeHelper^ ~ Additionnel Scan: 166970 Items scanned in 31mn AMs ---\ Additional information about modules ~ https://nicolascoolman.eu =>.Google Chrome, Start,Search,Extensions (G0,G1,G2) ~ https://nicolascoolman.eu =>.Internet Explorer, Proxy Management (R5) ~ https://nicolascoolman.eu =>.Auto loading programs from Registry and folders (O4) ~ AMI: 3 Legitimates Filtered in 00mn AMs ---\ Summary of the detections found on your workstation https://nicolascoolman.eu =>PUP.FileTypeHelper ~ MSI: 1 link(s) detected in 00mn AMs ~ 577 Legitimates filtered by white list End of the scan (377 lines in 19mn AMs)(0.11)

katou1811 · Answer

Rebonjour
Alors voila, c'est fait. Pour l'instant, ça va bien, L'ordi n'a toujours pas planté :P

Voici le 2e rapport :) 

https://pjjoint.malekal.com/files.php?id=20150414_y137u11p5j14

katou1811 · Answer

Mémoire physique de 45% et je suis capable d'ouvrir plusieurs pages en même temps sans avoir le temps de me servir un café en attendant qu'elles ouvrent! :P 
C'est de la magie :D

katou1811 · Answer

Ouais bien je me suis emballée pour rien, le svchost de malheur est toujours là, avec des pointe jusqu'à 900 000 K...

Svchost, 500 000K

5 réponses

Discussions similaires