Aide pour résoudre l'écran bleu de la mort récurrent

• FRST.txt
• Shortcut.txt
• Additionnal.txt

Welcome to WhoCrashed (HOME EDITION) v 5.54

This program checks for drivers which have been crashing your computer. If your computer has displayed a blue (or black) screen of death, suddenly rebooted or shut down then this program might help you find the root cause of the problem and a solution. 

Whenever a computer suddenly reboots without displaying any notice or blue (or black) screen of death, the first thing that is often thought about is a hardware failure. In reality, on Windows most crashes are caused by malfunctioning device drivers and kernel modules. In case of a kernel error, many computers do not show a blue or black screen unless they are configured for this. Instead these systems suddenly reboot without any notice. 

This program will analyze your crash dumps with the single click of a button. It will tell you what drivers are likely to be responsible for crashing your computer. It will report a conclusion which offers suggestions on how to proceed in any situation while the analysis report will display internet links which will help you further troubleshoot any detected problems. 

To obtain technical support visit www.resplendence.com/support

Click here to check if you have the latest version or if an update is available. 

Just click the Analyze button for a comprehensible report ...


Home Edition Notice

This version of WhoCrashed is free for use at home only. If you would like to use this software at work or in a commercial environment you should get the professional edition of WhoCrashed which allows you to perform more thorough and detailed analysis. It also offers a range of additional features such as remote analysis on remote directories and remote computers on the network. 

Please note that this version of WhoCrashed is not licensed for use by professional support engineers.

Click here for more information on the professional edition.
Click here to buy the the professional edition of WhoCrashed.

System Information (local)

Computer name: USER-PC
Windows version: Windows 7 Service Pack 1, 6.1, build: 7601
Windows dir: C:\Windows
Hardware: ASRock, 960GM-VGS3 FX
CPU: AuthenticAMD AMD FX(tm)-4130 Quad-Core Processor AMD586, level: 21
4 logical processors, active mask: 15
RAM: 8572358656 bytes total



Crash Dump Analysis

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.

On Thu 22/06/2017 03:22:25 your computer crashed
crash dump file: C:\Windows\Minidump\062217-31621-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x4B2EFC) 
Bugcheck code: 0x124 (0x0, 0xFFFFFA8007DD88F8, 0x0, 0x0)
Error: WHEA_UNCORRECTABLE_ERROR
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This bug check indicates that a fatal hardware error has occurred. This bug check uses the error data that is provided by the Windows Hardware Error Architecture (WHEA). 
This is likely to be caused by a hardware problem. This problem might also be caused because of overheating (thermal issue). 
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time. 



On Tue 13/06/2017 04:00:59 your computer crashed
crash dump file: C:\Windows\Minidump\061317-30654-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x4B2EFC) 
Bugcheck code: 0x124 (0x0, 0xFFFFFA8007DCD8F8, 0x0, 0x0)
Error: WHEA_UNCORRECTABLE_ERROR
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This bug check indicates that a fatal hardware error has occurred. This bug check uses the error data that is provided by the Windows Hardware Error Architecture (WHEA). 
This is likely to be caused by a hardware problem. This problem might also be caused because of overheating (thermal issue). 
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time. 



On Tue 6/06/2017 01:28:45 your computer crashed
crash dump file: C:\Windows\Minidump\060617-29062-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x4B2EFC) 
Bugcheck code: 0x124 (0x0, 0xFFFFFA8007DE6688, 0x0, 0x0)
Error: WHEA_UNCORRECTABLE_ERROR
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This bug check indicates that a fatal hardware error has occurred. This bug check uses the error data that is provided by the Windows Hardware Error Architecture (WHEA). 
This is likely to be caused by a hardware problem. This problem might also be caused because of overheating (thermal issue). 
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time. 



On Tue 30/05/2017 02:59:08 your computer crashed
crash dump file: C:\Windows\Minidump\053017-26769-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x4B2EFC) 
Bugcheck code: 0x124 (0x0, 0xFFFFFA8007E928F8, 0x0, 0x0)
Error: WHEA_UNCORRECTABLE_ERROR
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This bug check indicates that a fatal hardware error has occurred. This bug check uses the error data that is provided by the Windows Hardware Error Architecture (WHEA). 
This is likely to be caused by a hardware problem. This problem might also be caused because of overheating (thermal issue). 
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time. 



On Tue 30/05/2017 01:34:38 your computer crashed
crash dump file: C:\Windows\Minidump\053017-30217-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x4B2EFC) 
Bugcheck code: 0x124 (0x0, 0xFFFFFA8007EA0038, 0x0, 0x0)
Error: WHEA_UNCORRECTABLE_ERROR
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This bug check indicates that a fatal hardware error has occurred. This bug check uses the error data that is provided by the Windows Hardware Error Architecture (WHEA). 
This is likely to be caused by a hardware problem. This problem might also be caused because of overheating (thermal issue). 
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time. 




Conclusion

9 crash dumps have been found and analyzed. Only 5 are included in this report. A third party driver has been identified to be causing system crashes on your computer. It is strongly suggested that you check for updates for these drivers on their company websites. Click on the links below to search with Google for updates for these drivers: 

aswmonflt.sys (Avast File System Minifilter for Windows 2003/Vista, AVAST Software)

If no updates for these drivers are available, try searching with Google on the names of these drivers in combination with the errors that have been reported for these drivers. Include the brand and model name of your computer as well in the query. This often yields interesting results from discussions on the web by users who have been experiencing similar problems.


Read the topic general suggestions for troubleshooting system crashes for more information. 

Note that it's not always possible to state with certainty whether a reported driver is responsible for crashing your system or that the root cause is in another module. Nonetheless it's suggested you look for updates for the products that these drivers belong to and regularly visit Windows update or enable automatic updates for Windows. In case a piece of malfunctioning hardware is causing trouble, a search with Google on the bug check errors together with the model name and brand of your computer may help you investigate this further. 

CreateRestorePoint:
CloseProcesses:
ShortcutWithArgument: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.ourluckysites.com/?type=sc&ts=1494877293&z=7fa77c1438cb692c3225095gdzbt8zdb8m1m7o0tae&from=che0812&uid=WDCXWD10EARS-00Y5B1_WD-WCAV5C30047800478
ShortcutWithArgument: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.ourluckysites.com/?type=sc&ts=1494877293&z=7fa77c1438cb692c3225095gdzbt8zdb8m1m7o0tae&from=che0812&uid=WDCXWD10EARS-00Y5B1_WD-WCAV5C30047800478
IFEO\GoogleUpdate.exe: [Debugger] 324095823984.exe
IFEO\GoogleUpdaterService.exe: [Debugger] 8736459873644.exe
ShellExecuteHooks: No Name - {470A8BA2-DE47-11E6-A341-64006A5CFC23} - C:\Users\User\AppData\Roaming\Stonuryvmetion\Jalele.dll -> No File <==== ATTENTION
HKU\S-1-5-21-3928150652-2756980015-3035233101-1000\...\Run: [background_fault] => C:\Users\User\AppData\Local\background_fault\aswRD.exe [1419576 2017-05-04] (AVAST Software) <==== ATTENTION
C:\Users\User\AppData\Local\background_fault
S4 SANARE; C:\Users\User\AppData\Local\SANARE\Snare.dll [826368 2017-05-24] () [File not signed] <==== ATTENTION
S2 SNAREA; C:\Users\User\AppData\Local\SNAREA\Snare.dll [826368 2017-05-24] () [File not signed] <==== ATTENTION
S4 WANARE; C:\Users\User\AppData\Local\WANARE\Snare.dll [826368 2017-05-24] () [File not signed] <==== ATTENTION
R2 BIT; C:\ProgramData\BIT\BIT.dll [1812992 2017-05-31] (TODO: <公司名>) [File not signed] <==== ATTENTION
S4 CSHMDR; C:\Users\User\AppData\Local\CSHMDR\Snare.dll [900096 2017-06-10] () [File not signed] <==== ATTENTION
S4 CWASRE; C:\Users\User\AppData\Local\CWASRE\Snare.dll [828416 2017-05-24] () [File not signed] <==== ATTENTION
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [409128 2017-02-10] (EasyAntiCheat Ltd)
R2 FirefoxU; C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe [116376 2017-05-24] () <==== ATTENTION
 2017-07-12 00:39 - 2017-07-12 00:39 - 00000000 ____D C:\dbe7e4f44f4315842c2299c5 
C:\Users\User\AppData\Local\SANARE
Task: {2ACA07BA-3E98-443D-ACE5-4D2E15A47F2F} - System32\Tasks\Kukuch Agent => C:\Program Files (x86)\Ghibay\ariqer.exe
C:\Program Files (x86)\Ghibay
C:\ProgramData\BIT
Hosts:
EmptyTemp:
RemoveProxy:
Reboot:

• Réparer Mozilla Firefox (premier paragraphe)
• Réparer Google Chrome (seulement le premier paragraphe).
• Réinitialiser et réparer Internet Explorer

Fix result of Farbar Recovery Scan Tool (x64) Version: 11-07-2017
Ran by User (13-07-2017 16:47:03) Run:1
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available Profiles: User)
Boot Mode: Normal
==============================================

fixlist content:

CreateRestorePoint:CloseProcesses:ShortcutWithArgument: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.ourluckysites.com/?type=sc&ts=1494877293&z=7fa77c1438cb692c3225095gdzbt8zdb8m1m7o0tae&from=che0812&uid=WDCXWD10EARS-00Y5B1_WD-WCAV5C30047800478ShortcutWithArgument: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.ourluckysites.com/?type=sc&ts=1494877293&z=7fa77c1438cb692c3225095gdzbt8zdb8m1m7o0tae&from=che0812&uid=WDCXWD10EARS-00Y5B1_WD-WCAV5C30047800478IFEO\GoogleUpdate.exe: [Debugger] 324095823984.exeIFEO\GoogleUpdaterService.exe: [Debugger] 8736459873644.exeShellExecuteHooks: No Name - {470A8BA2-DE47-11E6-A341-64006A5CFC23} - C:\Users\User\AppData\Roaming\Stonuryvmetion\Jalele.dll -> No File <==== ATTENTIONHKU\S-1-5-21-3928150652-2756980015-3035233101-1000\...\Run: [background_fault] => C:\Users\User\AppData\Local\background_fault\aswRD.exe [1419576 2017-05-04] (AVAST Software) <==== ATTENTIONC:\Users\User\AppData\Local\background_faultS4 SANARE; C:\Users\User\AppData\Local\SANARE\Snare.dll [826368 2017-05-24] () [File not signed] <==== ATTENTIONS2 SNAREA; C:\Users\User\AppData\Local\SNAREA\Snare.dll [826368 2017-05-24] () [File not signed] <==== ATTENTIONS4 WANARE; C:\Users\User\AppData\Local\WANARE\Snare.dll [826368 2017-05-24] () [File not signed] <==== ATTENTIONR2 BIT; C:\ProgramData\BIT\BIT.dll [1812992 2017-05-31] (TODO: <???>) [File not signed] <==== ATTENTIONS4 CSHMDR; C:\Users\User\AppData\Local\CSHMDR\Snare.dll [900096 2017-06-10] () [File not signed] <==== ATTENTIONS4 CWASRE; C:\Users\User\AppData\Local\CWASRE\Snare.dll [828416 2017-05-24] () [File not signed] <==== ATTENTIONS3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [409128 2017-02-10] (EasyAntiCheat Ltd)R2 FirefoxU; C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe [116376 2017-05-24] () <==== ATTENTION 2017-07-12 00:39 - 2017-07-12 00:39 - 00000000 ____D C:\dbe7e4f44f4315842c2299c5 C:\Users\User\AppData\Local\SANARETask: {2ACA07BA-3E98-443D-ACE5-4D2E15A47F2F} - System32\Tasks\Kukuch Agent => C:\Program Files (x86)\Ghibay\ariqer.exeC:\Program Files (x86)\GhibayC:\ProgramData\BITHosts:EmptyTemp:RemoveProxy:Reboot:*****************Restore point was successfully created.Processes closed successfully.C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk => Shortcut argument removed successfully.C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk => Shortcut argument restored successfullyHKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\GoogleUpdate.exe => key removed successfullyHKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\GoogleUpdaterService.exe => key removed successfullyHKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks\\{470A8BA2-DE47-11E6-A341-64006A5CFC23} => value removed successfullyHKLM\Software\Classes\CLSID\{470A8BA2-DE47-11E6-A341-64006A5CFC23} => key removed successfullyHKU\S-1-5-21-3928150652-2756980015-3035233101-1000\Software\Microsoft\Windows\CurrentVersion\Run\\background_fault => value removed successfullyC:\Users\User\AppData\Local\background_fault => moved successfullyHKLM\System\CurrentControlSet\Services\SANARE => key removed successfullySANARE => service removed successfullyHKLM\System\CurrentControlSet\Services\SNAREA => key removed successfullySNAREA => service removed successfullyHKLM\System\CurrentControlSet\Services\WANARE => key removed successfullyWANARE => service removed successfullyHKLM\System\CurrentControlSet\Services\BIT => key removed successfullyBIT => service removed successfullyHKLM\System\CurrentControlSet\Services\CSHMDR => key removed successfullyCSHMDR => service removed successfullyHKLM\System\CurrentControlSet\Services\CWASRE => key removed successfullyCWASRE => service removed successfullyHKLM\System\CurrentControlSet\Services\EasyAntiCheat => key removed successfullyEasyAntiCheat => service removed successfullyHKLM\System\CurrentControlSet\Services\FirefoxU => key removed successfullyFirefoxU => service removed successfullyC:\dbe7e4f44f4315842c2299c5 => moved successfullyC:\Users\User\AppData\Local\SANARE => moved successfullyHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2ACA07BA-3E98-443D-ACE5-4D2E15A47F2F} => key removed successfullyHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2ACA07BA-3E98-443D-ACE5-4D2E15A47F2F} => key removed successfullyC:\Windows\System32\Tasks\Kukuch Agent => moved successfullyHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Kukuch Agent => key removed successfully"C:\Program Files (x86)\Ghibay" => not found.C:\ProgramData\BIT => moved successfullyC:\Windows\System32\Drivers\etc\hosts => moved successfullyHosts restored successfully.========= RemoveProxy: =========HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfullyHKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfullyHKU\S-1-5-21-3928150652-2756980015-3035233101-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfullyHKU\S-1-5-21-3928150652-2756980015-3035233101-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully========= End of RemoveProxy: ==================== EmptyTemp: ==========BITS transfer queue => 8388608 BDOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 39295825 BJava, Flash, Steam htmlcache => 356213887 BWindows/system/drivers => 112845477 BEdge => 0 BChrome => 1364236 BFirefox => 8695790 BOpera => 0 BTemp, IE cache, history, cookies, recent:Users => 0 BDefault => 66228 BPublic => 0 BProgramData => 0 Bsystemprofile => 114955115 Bsystemprofile32 => 25004630 BLocalService => 66295 BNetworkService => 0 BUser => 1218251043 BRecycleBin => 0 BEmptyTemp: => 1.8 GB temporary data Removed.================================The system needed a reboot.==== End of Fixlog 16:56:19 ====

Malwarebytes
www.malwarebytes.com

-Détails du journal-
Date de l'analyse: 13/07/2017
Heure de l'analyse: 18:13
Fichier journal: 
Administrateur: Oui

-Informations du logiciel-
Version: 3.1.2.1733
Version de composants: 1.0.160
Version de pack de mise à jour: 1.0.2355
Licence: Gratuit

-Informations système-
Système d'exploitation: Windows 7 Service Pack 1
Processeur: x64
Système de fichiers: NTFS
Utilisateur: User-PC\User

-Résumé de l'analyse-
Type d'analyse: Analyse des menaces
Résultat: Terminé
Objets analysés: 400075
Menaces détectées: 2833
Menaces mises en quarantaine: 0
(Aucun élément malveillant détecté)
Temps écoulé: 1 h, 25 min, 36 s

-Options d'analyse-
Mémoire: Activé
Démarrage: Activé
Système de fichiers: Activé
Archives: Activé
Rootkits: Désactivé
Heuristique: Activé
PUP: Activé
PUM: Activé

-Détails de l'analyse-
Processus: 0
(Aucun élément malveillant détecté)