Infection (Plus que) Probable
monkeyD.mojo
Messages postés
3
Statut
Membre
-
Malekal_morte- Messages postés 178136 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention -
Malekal_morte- Messages postés 178136 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention -
Bonjour,
Aujourd'hui mon ami me donne son ordi pour que je jette un yeux car il trouve son ordinateur plutot lent,
c'est alors ni une ni deux que je check les graphiques et effectivement mon cher ami a son processeur et son disque au taquet..
Je clean alors un petit coup avec adwcleaner, je desactive les programmes en fond, je désinstalle 2/3 merdouilles (McAfee), clean son bureau, desactive les programmes inutiles du demarrage, nettoie son disque ...
Mais alors, connaissant mon ami adepte de streaming UFC (compendre PRON), et voyant ces graphs de performances s'agiter dans tous les sens, j'ai tout de meme fait un scan avec Hijackthis, je souhaiterai que vous jettiez un petit coup d'oeil, car je vous avoue ne rien y comprendre.. Déso!
Merci d'avance
---------------------------------------------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 18:32:37, on 10/01/2019
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.17134.0001)
FIREFOX: 38.0.1 (x86 en-US)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe
C:\Users\nino\Downloads\Firefox Installer.exe
C:\Users\nino\AppData\Local\Temp\7zS471DB97A\setup-stub.exe
C:\Users\nino\AppData\Local\Temp\7zS471DB97A\setup-stub.exe
C:\Users\nino\AppData\Local\Temp\nsy4A43.tmp\download.exe
C:\Users\nino\AppData\Local\Temp\7zS0F02C66E\setup.exe
C:\Users\nino\Downloads\HijackThis.exe
C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer15.msn.com/?pc=ACTE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://acer15.msn.com/?pc=ACTE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [OneDrive] "C:\Users\nino\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
O4 - HKCU\..\Run: [CCleaner Smart Cleaning] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\RunOnce: [WAB Migrate] %ProgramFiles%\Windows Mail\wab.exe /Upgrade (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-20\..\RunOnce: [WAB Migrate] %ProgramFiles%\Windows Mail\wab.exe /Upgrade (User 'SERVIZIO DI RETE')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - (no file)
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - (no file)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\WINDOWS\system32\atiesrxx.exe (file missing)
O23 - Service: AtherosSvc - Windows (R) Win 7 DDK provider - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
O23 - Service: Servizio Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: ClientAnalyticsService - Unknown owner - C:\Program Files\Common Files\McAfee\ClientAnalytics\Legacy\McClientAnalytics.exe (file missing)
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: McAfee Activation Service (McAWFwk) - Unknown owner - C:\Program Files\Common Files\McAfee\ActWiz\McAWFwk.exe (file missing)
O23 - Service: McAfee CSP Service (mccspsvc) - Unknown owner - C:\Program Files\Common Files\McAfee\CSP\2.9.175.0\\McCSPServiceHost.exe (file missing)
O23 - Service: McAfee Service Controller (mfemms) - Unknown owner - C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe (file missing)
O23 - Service: McAfee Module Core Service (ModuleCoreService) - Unknown owner - C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: McAfee PEF Service (PEFService) - Unknown owner - C:\Program Files\Common Files\McAfee\PEF\CORE\PEFService.exe (file missing)
O23 - Service: Quick Access Local Service (QALSvc) - Acer Incorporated - C:\Program Files\Acer\Acer Quick Access\QALSvc.exe
O23 - Service: Quick Access Service (QASvc) - Acer Incorporated - C:\Program Files\Acer\Acer Quick Access\QASvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\SecurityHealthAgent.dll,-1002 (SecurityHealthService) - Unknown owner - C:\WINDOWS\system32\SecurityHealthService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: @%SystemRoot%\System32\SgrmBroker.exe,-100 (SgrmBroker) - Unknown owner - C:\WINDOWS\system32\SgrmBroker.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spectrum.exe,-101 (spectrum) - Unknown owner - C:\WINDOWS\system32\spectrum.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: SAMSUNG Mobile Connectivity Service (ss_conn_service) - DEVGURU Co., LTD. - C:\Program Files\SAMSUNG\USB Drivers\25_escape\conn\ss_conn_service.exe
O23 - Service: tbaseprovisioning - Advanced Micro Devices, Inc. - C:\Windows\SysWOW64\tbaseprovisioning.exe
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\WINDOWS\system32\TieringEngineService.exe (file missing)
O23 - Service: User Experience Improvement Program (UEIPSvc) - acer - C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: @%systemroot%\system32\xbgmsvc.exe,-100 (xbgm) - Unknown owner - C:\WINDOWS\system32\xbgmsvc.exe (file missing)
--
End of file - 8860 bytes
---------------------------------------------------------------------------------------------------------------
PS. Déso si vous avez l'impression que je suis faché avec les accents,
mais je suis sur un qwerty italien Jajajaja
Aujourd'hui mon ami me donne son ordi pour que je jette un yeux car il trouve son ordinateur plutot lent,
c'est alors ni une ni deux que je check les graphiques et effectivement mon cher ami a son processeur et son disque au taquet..
Je clean alors un petit coup avec adwcleaner, je desactive les programmes en fond, je désinstalle 2/3 merdouilles (McAfee), clean son bureau, desactive les programmes inutiles du demarrage, nettoie son disque ...
Mais alors, connaissant mon ami adepte de streaming UFC (compendre PRON), et voyant ces graphs de performances s'agiter dans tous les sens, j'ai tout de meme fait un scan avec Hijackthis, je souhaiterai que vous jettiez un petit coup d'oeil, car je vous avoue ne rien y comprendre.. Déso!
Merci d'avance
---------------------------------------------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 18:32:37, on 10/01/2019
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.17134.0001)
FIREFOX: 38.0.1 (x86 en-US)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe
C:\Users\nino\Downloads\Firefox Installer.exe
C:\Users\nino\AppData\Local\Temp\7zS471DB97A\setup-stub.exe
C:\Users\nino\AppData\Local\Temp\7zS471DB97A\setup-stub.exe
C:\Users\nino\AppData\Local\Temp\nsy4A43.tmp\download.exe
C:\Users\nino\AppData\Local\Temp\7zS0F02C66E\setup.exe
C:\Users\nino\Downloads\HijackThis.exe
C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer15.msn.com/?pc=ACTE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://acer15.msn.com/?pc=ACTE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [OneDrive] "C:\Users\nino\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
O4 - HKCU\..\Run: [CCleaner Smart Cleaning] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\RunOnce: [WAB Migrate] %ProgramFiles%\Windows Mail\wab.exe /Upgrade (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-20\..\RunOnce: [WAB Migrate] %ProgramFiles%\Windows Mail\wab.exe /Upgrade (User 'SERVIZIO DI RETE')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - (no file)
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - (no file)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\WINDOWS\system32\atiesrxx.exe (file missing)
O23 - Service: AtherosSvc - Windows (R) Win 7 DDK provider - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
O23 - Service: Servizio Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: ClientAnalyticsService - Unknown owner - C:\Program Files\Common Files\McAfee\ClientAnalytics\Legacy\McClientAnalytics.exe (file missing)
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: McAfee Activation Service (McAWFwk) - Unknown owner - C:\Program Files\Common Files\McAfee\ActWiz\McAWFwk.exe (file missing)
O23 - Service: McAfee CSP Service (mccspsvc) - Unknown owner - C:\Program Files\Common Files\McAfee\CSP\2.9.175.0\\McCSPServiceHost.exe (file missing)
O23 - Service: McAfee Service Controller (mfemms) - Unknown owner - C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe (file missing)
O23 - Service: McAfee Module Core Service (ModuleCoreService) - Unknown owner - C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: McAfee PEF Service (PEFService) - Unknown owner - C:\Program Files\Common Files\McAfee\PEF\CORE\PEFService.exe (file missing)
O23 - Service: Quick Access Local Service (QALSvc) - Acer Incorporated - C:\Program Files\Acer\Acer Quick Access\QALSvc.exe
O23 - Service: Quick Access Service (QASvc) - Acer Incorporated - C:\Program Files\Acer\Acer Quick Access\QASvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\SecurityHealthAgent.dll,-1002 (SecurityHealthService) - Unknown owner - C:\WINDOWS\system32\SecurityHealthService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: @%SystemRoot%\System32\SgrmBroker.exe,-100 (SgrmBroker) - Unknown owner - C:\WINDOWS\system32\SgrmBroker.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spectrum.exe,-101 (spectrum) - Unknown owner - C:\WINDOWS\system32\spectrum.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: SAMSUNG Mobile Connectivity Service (ss_conn_service) - DEVGURU Co., LTD. - C:\Program Files\SAMSUNG\USB Drivers\25_escape\conn\ss_conn_service.exe
O23 - Service: tbaseprovisioning - Advanced Micro Devices, Inc. - C:\Windows\SysWOW64\tbaseprovisioning.exe
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\WINDOWS\system32\TieringEngineService.exe (file missing)
O23 - Service: User Experience Improvement Program (UEIPSvc) - acer - C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: @%systemroot%\system32\xbgmsvc.exe,-100 (xbgm) - Unknown owner - C:\WINDOWS\system32\xbgmsvc.exe (file missing)
--
End of file - 8860 bytes
---------------------------------------------------------------------------------------------------------------
PS. Déso si vous avez l'impression que je suis faché avec les accents,
mais je suis sur un qwerty italien Jajajaja
Configuration: Windows / Firefox 64.0
5 réponses
-
Salut,
Pour vérifier ton ordinateur, pour d'éventuels infections et avoir un état général du système :
Suis le tutoriel FRST en cliquant sur ce lien bleu. ( prends le temps de lire attentivement - tout y est bien expliqué ).
Télécharge et lance le scan FRST,
Attendre la fin du scan, un message indique que l'analyse est terminée.
Trois rapports FRST seront générés :- FRST.txt
- Shortcut.
- Additionnal.txt
Envoie ces 3 rapports sur le site https://pjjoint.malekal.com/ et en retour donne les 3 liens pjjoint qui mènent aux rapports ici dans une nouvelle réponse afin que l'on puisse les consulter.
(Les liens bleus mènent à des tutoriels explicatifs pas à pas, clic dessus pour avoir les instructions plus précises à suivre).
-
Ok super! Merci pour ta reponse rapide!
Alors voici les 3 liens:
Addition
https://pjjoint.malekal.com/files.php?id=20190110_f13z12l8m7c12
FRST
https://pjjoint.malekal.com/files.php?id=FRST_20190110_i14s11c5r6j8
Shortcut
https://pjjoint.malekal.com/files.php?id=20190110_q13p5q14k15y7
Qu'est ce qui ressort du chapeau magique? -
Pas infecté, il y a des restes de McAfee.
CCleaner n'est pas vraiment utile, même si on le recommande de partout.
Si tu veux le garder, désactive la surveillance de CCleaner, inutile, ça se met au démarrage de Windows et le ralentit avec ces nettoyages incessants, voir : https://www.malekal.com/supprimer-ccleaner-demarrage-windows/
~~
Vérifie déjà le disque dur : Comment vérifier la santé du disque dur
Par exemple avec CrystalDiskInfo.
Sur ce dernier vérifie que tous les disques sont en bleus "correct".
~~
Voici la correction à effectuer avec FRST. Tu peux t'aider de cette note explicative avec des captures d'écran.
Relance FRST puis sur ton clavier appuyer sur la touche CTRL + Y.
Le bloc-note va s'ouvrir, copie/colle ceci.
CreateRestorePoint:
CloseProcesses:
Task: {03B75BD9-CE49-4F6A-9893-E3553DE8A3BB} - System32\Tasks\McAfeeLogon => C:\PROGRA~1\COMMON~1\McAfee\Platform\McUICnt.exe
S3 ClientAnalyticsService; C:\Program Files\Common Files\McAfee\ClientAnalytics\Legacy\McClientAnalytics.exe [X]
S3 McAWFwk; C:\Program Files\Common Files\McAfee\ActWiz\McAWFwk.exe [X]
S2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\2.9.175.0\\McCSPServiceHost.exe [X]
S2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe [X]
S2 ModuleCoreService; C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe [X]
S2 PEFService; C:\Program Files\Common Files\McAfee\PEF\CORE\PEFService.exe [X]
S2 mfeaack; C:\WINDOWS\System32\drivers\mfeaack.sys [497568 2018-05-16] (McAfee, LLC)
C:\WINDOWS\System32\drivers\mfeaack.sys
S3 mfeplk; C:\WINDOWS\System32\drivers\mfeplk.sys [115616 2018-05-16] (McAfee, LLC)
C:\WINDOWS\System32\drivers\mfeplk.sys
2019-01-10 17:58 - 2019-01-10 17:58 - 003480040 _____ (McAfee, Inc.) C:\Users\nino\Downloads\MCPR.exe
2019-01-10 19:11 - 2015-09-04 04:50 - 000000000 ____D C:\ProgramData\McAfee
2019-01-10 18:16 - 2015-09-04 04:50 - 000000000 ____D C:\Program Files\mcafee
2019-01-10 18:16 - 2015-09-04 04:50 - 000000000 ____D C:\Program Files\Common Files\McAfee
2019-01-10 17:17 - 2018-02-11 15:53 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2018-12-17 14:57 - 2018-07-17 01:55 - 000003720 _____ C:\WINDOWS\System32\Tasks\McAfee Remediation (Prepare)
Hosts:
EmptyTemp:
RemoveProxy:
Reboot:
Enregistre le contenu par le menu fichier puis enregistrer.
Ferme le bloc-note, retourne sur FRST et clique sur le bouton "Corriger / Fix"
Un redémarrage sera peut-être nécessaire et automatique.
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.
Redémarre l'ordinateur
-
J'ai check les disks, tout est au bleu.
Concernant FRST j'ai pu terminer le fix, voici les logs:
Fix result of Farbar Recovery Scan Tool (x64) Version: 09.01.2019 01
Ran by nino (12-01-2019 20:20:58) Run:1
Running from C:\Users\nino\Desktop
Loaded Profiles: nino (Available Profiles: nino)
Boot Mode: Normal
==============================================
fixlist content:
CreateRestorePoint:
CloseProcesses:
Task: {03B75BD9-CE49-4F6A-9893-E3553DE8A3BB} - System32\Tasks\McAfeeLogon => C:\PROGRA~1\COMMON~1\McAfee\Platform\McUICnt.exe
S3 ClientAnalyticsService; C:\Program Files\Common Files\McAfee\ClientAnalytics\Legacy\McClientAnalytics.exe [X]
S3 McAWFwk; C:\Program Files\Common Files\McAfee\ActWiz\McAWFwk.exe [X]
S2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\2.9.175.0\\McCSPServiceHost.exe [X]
S2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe [X]
S2 ModuleCoreService; C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe [X]
S2 PEFService; C:\Program Files\Common Files\McAfee\PEF\CORE\PEFService.exe [X]
S2 mfeaack; C:\WINDOWS\System32\drivers\mfeaack.sys [497568 2018-05-16] (McAfee, LLC)
C:\WINDOWS\System32\drivers\mfeaack.sys
S3 mfeplk; C:\WINDOWS\System32\drivers\mfeplk.sys [115616 2018-05-16] (McAfee, LLC)
C:\WINDOWS\System32\drivers\mfeplk.sys
2019-01-10 17:58 - 2019-01-10 17:58 - 003480040 _____ (McAfee, Inc.) C:\Users\nino\Downloads\MCPR.exe
2019-01-10 19:11 - 2015-09-04 04:50 - 000000000 ____D C:\ProgramData\McAfee
2019-01-10 18:16 - 2015-09-04 04:50 - 000000000 ____D C:\Program Files\mcafee
2019-01-10 18:16 - 2015-09-04 04:50 - 000000000 ____D C:\Program Files\Common Files\McAfee
2019-01-10 17:17 - 2018-02-11 15:53 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2018-12-17 14:57 - 2018-07-17 01:55 - 000003720 _____ C:\WINDOWS\System32\Tasks\McAfee Remediation (Prepare)
Hosts:
EmptyTemp:
RemoveProxy:
Reboot:
Restore point was successfully created.
Processes closed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{03B75BD9-CE49-4F6A-9893-E3553DE8A3BB}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{03B75BD9-CE49-4F6A-9893-E3553DE8A3BB}" => removed successfully
C:\WINDOWS\System32\Tasks\McAfeeLogon => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\McAfeeLogon" => removed successfully
HKLM\System\CurrentControlSet\Services\ClientAnalyticsService => removed successfully
ClientAnalyticsService => service removed successfully
HKLM\System\CurrentControlSet\Services\McAWFwk => removed successfully
McAWFwk => service removed successfully
HKLM\System\CurrentControlSet\Services\mccspsvc => removed successfully
mccspsvc => service removed successfully
HKLM\System\CurrentControlSet\Services\mfemms => removed successfully
mfemms => service removed successfully
HKLM\System\CurrentControlSet\Services\ModuleCoreService => removed successfully
ModuleCoreService => service removed successfully
HKLM\System\CurrentControlSet\Services\PEFService => removed successfully
PEFService => service removed successfully
HKLM\System\CurrentControlSet\Services\mfeaack => removed successfully
mfeaack => service removed successfully
C:\WINDOWS\System32\drivers\mfeaack.sys => moved successfully
HKLM\System\CurrentControlSet\Services\mfeplk => removed successfully
mfeplk => service removed successfully
C:\WINDOWS\System32\drivers\mfeplk.sys => moved successfully
C:\Users\nino\Downloads\MCPR.exe => moved successfully
C:\ProgramData\McAfee => moved successfully
C:\Program Files\mcafee => moved successfully
C:\Program Files\Common Files\McAfee => moved successfully
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee => moved successfully
C:\WINDOWS\System32\Tasks\McAfee Remediation (Prepare) => moved successfully
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
========= RemoveProxy: =========
"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully
"HKU\S-1-5-21-3686240371-3204240113-3050809895-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\S-1-5-21-3686240371-3204240113-3050809895-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully
========= End of RemoveProxy: =========
=========== EmptyTemp: ==========
BITS transfer queue => 9461760 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 230916794 B
Java, Flash, Steam htmlcache => 1124 B
Windows/system/drivers => 165068 B
Edge => 3584 B
Chrome => 0 B
Firefox => 1088414570 B
Opera => 0 B
Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 294136 B
systemprofile32 => 0 B
LocalService => 0 B
LocalService => 0 B
NetworkService => 6398 B
NetworkService => 0 B
nino => 17169801 B
RecycleBin => 0 B
EmptyTemp: => 1.3 GB temporary data Removed.
================================
The system needed a reboot.End of Fixlog 20:30:17
-
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question -
ok sinon il n'y a pas de malware.
