Yahoo bloque Google moteur de recherch -

bonjour

Télécharge ZHPDiag ( de Nicolas coolman ).
https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html


(outil de diagnostic)

Double clique sur le fichier d'installation, puis installe le avec les paramètres par défaut ( N'oublie pas de cocher " Créer une icône sur le bureau " )

Lance ZHPDiag en double cliquant sur l'icône présente sur ton bureau (Clique droit -> Executer en tant qu'admin ( vista/Seven )

Clique sur la loupe en haut à gauche, puis laisse l'outil scanner.

Une fois le scan terminé, clique sur l'icône en forme de disquette et enregistre le fichier sur ton bureau.

Rend toi sur http://pjjoint.malekal.com/

Clique sur "Parcourir "

Sélectionne le rapport ZHPdiag.txt qui se trouve sur ton bureau

Clique ensuite sur "Envoyer le fichier " et copie/colle le lien dans ton prochain message

* Tuto zhpdiag :
http://www.premiumorange.com/zeb-help-process/zhpdiag.html

Alors je crois que j'y suis arrivée, et voilà le lien:
http://pjjoint.malekal.com/files.php?id=ZHPDiag_20120724_u10n8i11g15n5

? bon . alors je te laisse continuer la discussion....

Merciii pour ce moment de grâce...

Vivi

ok

1)
Télécharge AdwCleaner ( d'Xplode ) sur ton bureau.

http://general-changelog-team.fr/fr/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner

Lance le, clique sur SUPPRESSION puis patiente le temps du scan.
Une fois le scan fini, un rapport s'ouvrira. Poste moi son contenu dans ta prochaine réponse.

Note : Le rapport est également sauvegardé sous C:\AdwCleane.txt

.................

2)

fais un nouveau rapport ZHPdiag

Rend toi sur http://pjjoint.malekal.com/

Clique sur "Parcourir "

Sélectionne le rapport ZHPdiag.txt qui se trouve sur ton bureau

Clique ensuite sur "Envoyer le fichier " et copie/colle le lien dans ton prochain message

J'ai tout fait, je n'arrive pas à envoyer le message complet avec le rapport. Peut-être est-il trop long?

Il y a vraiment beaucoup de lignes "supprimé"...

Je ne sais pas comment joindre un document dans ce message.

Le lien pour le fichier final est:
http://pjjoint.malekal.com/files.php?id=ZHPDiag_20120724_e10m9x6i11t15

Je n'en sais pas plus...

le soucis, c'est l'installation de adware via les toolbars et les utilitaires

1)

Copie tout le texte présent en gras ci-dessous (tu le selectionnes avec ta souris / Clique droit dessus et choisis "copier" ou fait Ctrl+C )



SysRestore
EMPTYTEMP
EMPTYFLASH
M3 - MFPP: Plugins - [vma] -- C:\Users\vma\AppData\Roaming\Mozilla\Firefox\Profiles\jc5ybxfe.default\searchplugins\conduit.xml => Toolbar.Conduit
M0 - MFSP: prefs.js [vma - jc5ybxfe.default] http://search.conduit.com => Toolbar.Conduit
M2 - MFEP: prefs.js [vma - jc5ybxfe.default\{9e96c0cd-a901-4032-9236-0e4a264aeee4}] [] NCH FR v10.10.20.14 (.Conduit Ltd..) => Toolbar.Conduit
O69 - SBI: C:\Users\vma\AppData\Roaming\Mozilla\Firefox\Profiles\jc5ybxfe.default\searchplugins\conduit.xml => Toolbar.Conduit
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.FirstTime", "true"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.FirstTimeFF3", "true"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.SearchFromAddressBarUrl", "http://search.conduit.com/ResultsExt.aspx?ctid=CT2801939&SearchSource=2&q="); => Toolbar.Conduit
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.UserID", "UN51398329252057983"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.addressBarTakeOverEnabledInHidden", "true"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.browser.search.defaultthis.engineName", true); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.defaultSearch", "true"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.embeddedsData", "[{\"appId\":\"129306877870131855\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFra[...] => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.enableAlerts", "always"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.enableSearchFromAddressBar", "true"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.firstTimeDialogOpened", "true"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.fixPageNotFoundError", "true"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.fixPageNotFoundErrorInHidden", "true"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.fixUrls", true); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.installId", "ConduitInstaller.exe"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.installType", "ConduitNSISIntegration"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.isNewTabEnabled", true); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.isPerformedSmartBarTransition", "true"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.keyword", true); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"https%3A%2F%2Fmail.google.com%2Fmai[...] => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.openThankYouPage", "false"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.openUninstallPage", "true"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.searchInNewTabEnabledInHidden", "true"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"2\"}"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT2801939\"}"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"NCH FR\"}"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.settingsINI", true); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.shouldFirstTimeDialog", "false"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.smartbar.CTID", "CT2801939"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.smartbar.Uninstall", "0"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.smartbar.homepage", true); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.smartbar.toolbarName", "NCH FR "); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.toolbarBornServerTime", "24-7-2012"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.toolbarCurrentServerTime", "24-7-2012"); => Toolbar.Agent
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("Smartbar.ConduitHomepagesList", "http://search.conduit.com/?ctid=CT2801939&SearchSource=13"); => Toolbar.Conduit
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("Smartbar.ConduitSearchUrlList", "http://search.conduit.com/ResultsExt.aspx?ctid=CT2801939&SearchSource=2&q="); => Toolbar.Conduit
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("browser.startup.homepage", "http://search.conduit.com/?ctid=CT2801939&SearchSource=13"); => Toolbar.Conduit
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("keyword.URL", "http://search.conduit.com/ResultsExt.aspx?ctid=CT2801939&SearchSource=2&q="); => Toolbar.Conduit
[MD5.F59F192D75396538912A87A5A8447E70] [SPRF][07/06/2012] (.Ask.com - AskStub Application.) -- C:\Users\vma\AppData\Local\Temp\ApnStub.exe [357032]
[MD5.2D2894581D355D5F44EAE38898A66846] [SPRF][01/01/2012] (.Conduit Ltd. - Conduit Toolbar.) -- C:\Users\vma\AppData\Local\Temp\tbNCH_.dll [4398888]
C:\Users\vma\AppData\Roaming\Mozilla\Firefox\Profiles\jc5ybxfe.default\SearchPlugins\conduit.xml => Toolbar.Conduit
O44 - LFC:[MD5.A103FDF7348130EF3F3FEF56B1700A27] - 14/07/2012 - 09:09:00 ---A- . (...) -- C:\END [9] => Infection FakeAlert (Trojan.FakeAlert)
[MD5.1551AFA651B9A4BAF2861FD0A7E624C9] [SPRF][14/07/2012] (.Bandoo Media Inc - Free mp3 Wma Converter Install.) -- C:\Users\vma\Desktop\free-mp3-wma-converter_free_mp3_wma_converter_2.0_francais_34863.exe [426088] => Infection PUP (Adware.Bandoo)
[MD5.266B21515706E2399B3BD0DF2C7D1472] [SPRF][15/09/2011] (.pdfforge GbR - PDFCreator is the easy way of creating PDFs..) -- C:\Users\vma\Desktop\PDFCreator-1_2_3_setup.exe [18590304



Puis Lance ZHPFix depuis le raccourci du bureau . (Clique droit -> Executer en tant qu'admin pour Vista ou Seven)

* Une fois l'outil ZHPFix ouvert ,

- Clique sur l'icone représentant la lettre H (« coller les lignes Helper »)
- Les lignes se collent automatiquement dans ZHPFix, sinon colle les lignes
- Clique sur le bouton « GO » pour lancer le nettoyage,
- Copie/colle la totalité du rapport dans ta prochaine réponse

le rapport se trouve dans le dossier de zhpdiag dans program files sous le nom de ZHPFixReport

.......................

2)
lance MalwareByte's Anti-Malware que tu possèdes déjà

. Dans l'onglet "mise à jour", cliques sur le bouton Recherche de mise à jour
. Si le pare-feu demande l'autorisation de se connecter pour malwarebytes, accepte
. Une fois la mise à jour terminé
. Rend-toi dans l'onglet, Recherche
. Sélectionnes Exécuter un examen rapide
. Cliques sur Rechercher
. Le scan démarre.
. A la fin de l'analyse, un message s'affiche : L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.
. Cliques sur Ok pour poursuivre.
. Si des malwares ont été détectés, clique sur Afficher les résultats
. Sélectionnes tout (ou laisses cochés) et cliques sur Supprimer la sélection Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
. Malwarebytes va ouvrir le bloc-notes et y copier le rapport d'analyse.
. Rends toi dans l'onglet rapport/log
. Tu cliques dessus pour l'afficher, une fois affiché
. Tu cliques sur edition en haut du boc notes, et puis sur sélectionner tous
. Tu recliques sur edition et puis sur copier et tu reviens sur le forum et dans ta réponse
. tu cliques droit dans le cadre de la reponse et coller

Si tu as besoin d'aide regarde ces tutoriels :
Aide: https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
http://www.infos-du-net.com/forum/278396-11-tuto-malwarebytes-anti-malware-mbam

.......................

3)
Redemarre le pc et dis moi si tu as encore des soucis

Voici d'abord:
- le rapport de ZPH puis
Rapport de ZHPDiag v1.31.11 par Nicolas Coolman, Update du 21/07/2012
Run by vma at 24/07/2012 20:09:48
Web site : http://www.premiumorange.com/zeb-help-process/zhpdiag.html
Web site : http://nicolascoolman.skyrock.com/
State : Version à jour.

---\\ Web Browser
MSIE: Internet Explorer v

---\\ Windows Product Information
~ Langage: Français
Windows 7 Home Premium Edition, 64-bit (Build 7600)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : BWX77
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : KO
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ System Information
~ Processor: Intel64 Family 6 Model 23 Stepping 10, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3964 MB (59% free)
System Restore: Inconnu (Unknown)
System drive C: has 179 GB (77%) free of 233 GB

---\\ Logged in mode
~ Computer Name: CARVILLE
~ User Name: vma
~ All Users Names: vma, HomeGroupUser$, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Users\vma\AppData\Roaming\
~ %Desktop% : C:\Users\vma\Desktop\
~ %Favorites% : C:\Users\vma\Favorites\
~ %LocalAppData% : C:\Users\vma\AppData\Local\
~ %StartMenu% : C:\Users\vma\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 179 Go of 233 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 209 Go of 233 Go)
E:\ CD-ROM drive (Not Inserted)

---\\ Security Center & Tools Informations
~ Scan Security Center in 00mn 00s

---\\ Recherche particulière de fichiers génériques
[MD5.0862495E0C825893DB75EF44FAEA8E93] - (.Microsoft Corporation - Explorateur Windows.) (.26/02/2011 - 07:23:14.) -- C:\Windows\Explorer.exe [2870272]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.5A45FA344F4AD99D903F4B20E43B89EC] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.02/06/2012 - 13:05:28.) -- C:\Windows\System32\wininet.dll [1392128]
[MD5.DA3E2A6FA9660CC75B471530CE88453A] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.28/10/2009 - 07:24:40.) -- C:\Windows\System32\Winlogon.exe [389632]
[MD5.75341574F21E766748732BDF530C74BD] - (.Microsoft Corporation - Bibliothèque de licences.) (.14/07/2009 - 02:41:54.) -- C:\Windows\System32\sppcomapi.dll [231936]
[MD5.DB9D6C6B2CD95A9CA414D045B627422E] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/12/2011 - 04:59:11.) -- C:\Windows\system32\Drivers\AFD.sys [499200]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.83D2D75E1EFB81B3450C18131443F7DB] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.14/07/2009 - 00:19:54.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9C253CE7311CA60FC11C774692A13208] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.27/04/2011 - 03:57:40.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.0A49913402747A0B67DE940FB42CBDBB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.14/07/2009 - 01:06:13.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.040D62A9D8AD28922632137ACDD984F2] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.04/05/2011 - 03:51:08.) -- C:\Windows\system32\Drivers\MRxSmb.sys [157696]
[MD5.9162B273A44AB9DCE5B44362731D062A] - (.Microsoft Corporation - MBT Transport driver.) (.14/07/2009 - 00:21:29.) -- C:\Windows\system32\Drivers\netBT.sys [259072]
[MD5.378E0E0DFEA67D98AE6EA53ADBBD76BC] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.11/03/2011 - 07:23:06.) -- C:\Windows\system32\Drivers\ntfs.sys [1657216]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.87A6E852A22991580D6D39ADC4790463] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.14/07/2009 - 01:10:12.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [130048]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.079125C4B17B01FCAEEBCE0BCB290C0F] - (.Microsoft Corporation - TDI Translation Driver.) (.14/07/2009 - 00:21:15.) -- C:\Windows\system32\Drivers\tdx.sys [99840]
[MD5.58F82EED8CA24B461441F9C3E4F0BF5C] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.14/07/2009 - 02:45:55.) -- C:\Windows\system32\Drivers\volsnap.sys [294992]
~ Scan Generic Processes in 00mn 00s

---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 2/50
~ Mes Videos (My Videos) : 2/25
~ Mes Favoris (My Favorites) : 1/46
~ Mes Documents (My Documents) : 1/2
~ Mon Bureau (My Desktop) : 1/521
~ Menu demarrer (Programs) : 1/32
~ Scan Hidden Files in 00mn 02s

---\\ Processus lancés
[MD5.A7E406711790197712D376B44A9FBB0B] - (.TOSHIBA CORPORATION - ConfigFree Task Tray Menu.) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [304496] [PID.2740]
[MD5.89F7C30A91E5581BDF14C62AB46A2B2D] - (.McAfee, Inc. - McAfee Security Scanner Scheduler.) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [255536] [PID.3080]
[MD5.569E547273C25B019054A12A40400ECE] - (.OpenOffice.org - OpenOffice.org 3.2.) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe [11318784] [PID.3624]
[MD5.4B723F33D7331F20E06F3A2FD76EC1D5] - (.OpenOffice.org - OpenOffice.org 3.2.) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin [11312128] [PID.3664]
[MD5.80A02F5ADDDF2D615B85A4F19424DCBB] - (.Nero AG - Nero BackItUp.) -- C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe [1086760] [PID.3704]
[MD5.F7E0783DA9043BC131BB37C77EDB04DF] - (.TOSHIBA CORPORATION. - Pas de description.) -- C:\Program Files (x86)\Toshiba\TOSHIBA Web Camera Application\TWebCamera.exe [2454840] [PID.3724]
[MD5.C98FF6C440E8967251F59C7919B505A1] - (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe [37296] [PID.3760]
[MD5.98A078F838A70F84E1BD490D7C7675F4] - (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696] [PID.3792]
[MD5.84DB35F319E5B67838A4877C11748866] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [462920] [PID.3824]
[MD5.3F677172F23FC17283D9BCE4B42E3F65] - (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [913888] [PID.4156]
[MD5.A06AB1550658A19E871A6FD7FF1C2CDB] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe [16864] [PID.360]
[MD5.7E55EB324D283979E450F71C973110B9] - (.Adobe Systems, Inc. - Adobe Flash Player 11.3 r300.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_265.exe [1536712] [PID.1572]
[MD5.09E411E1DC92D813F49DFEEB4039CBCA] - (.Google - Google Talk Plugin.) -- C:\Users\vma\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe [79384] [PID.5052]
[MD5.8A07221789D46B2EA7DFCA2BC807572A] - (.TOSHIBA CORPORATION - ConfigFree Switch Manager Process.) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe [62848] [PID.2616]
[MD5.72AE847EB2B526CC0551C88B9A2970C1] - (...) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [3763200] [PID.388]
~ Scan Processes Running in 00mn 01s

---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\vma\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [ahfgeienlihckogmohjhadlkjgocpleb] Premier utilisateur" v. ()
~ Scan Google Browser in 00mn 00s

---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\vma\AppData\Roaming\Mozilla\Firefox\Profiles\jc5ybxfe.default\prefs.js
M3 - MFPP: Plugins - [vma] -- C:\Users\vma\AppData\Roaming\Mozilla\Firefox\Profiles\jc5ybxfe.default\searchplugins\conduit.xml
M3 - MFPP: Plugins - [vma] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\amazon-france.xml
M3 - MFPP: Plugins - [vma] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\bing.xml
M3 - MFPP: Plugins - [vma] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\cnrtl-tlfi-fr.xml
M3 - MFPP: Plugins - [vma] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\eBay-france.xml
M3 - MFPP: Plugins - [vma] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\google.xml
M3 - MFPP: Plugins - [vma] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\wikipedia-fr.xml
M3 - MFPP: Plugins - [vma] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\yahoo-france.xml
M3 - MFPP: Plugins - [vma] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\yahoo.xml
M0 - MFSP: prefs.js [vma - jc5ybxfe.default] http://search.conduit.com
M2 - MFEP: prefs.js [vma - jc5ybxfe.default\{9e96c0cd-a901-4032-9236-0e4a264aeee4}] [] NCH FR v10.10.20.14 (.Conduit Ltd..)
M2 - MFEP: prefs.js [vma - jc5ybxfe.default\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}] [dwhelper] DownloadHelper v4.9.9 (.Michel Gutierrez.)
P2 - FPN:Firefox Plugin Navigator . (.Adobe Systems Inc. - Adobe PDF Plug-In For Firefox and Netscape "9.5.1".) -- C:\Program Files (x86)\Mozilla Firefox\Plugins\nppdf32.dll
P2 - FPN: [HKCU] [@talk.google.com/GoogleTalkPlugin] - (.Google - Version 3.2.4.8431.) -- C:\Users\vma\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
P2 - FPN: [HKCU] [@talk.google.com/O3DPlugin] - (.Pas de propriétaire - Google Talk Plugin Video Accelerator version:0.1.44.16.) -- C:\Users\vma\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
P2 - FPN: [HKCU] [@tools.google.com/Google Update;version=3] - (.Google Inc. - Google Update.) -- C:\Users\vma\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll
P2 - FPN: [HKCU] [@tools.google.com/Google Update;version=9] - (.Google Inc. - Google Update.) -- C:\Users\vma\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll
~ Scan Firefox Browser in 00mn 00s

---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://toshiba.msn.com
R3 - URLSearchHook: (no name) [64Bits] - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Google Inc. - Google Update.) (No version) -- (.not file.)
R3 - URLSearchHook: (no name) [64Bits] - {9e96c0cd-a901-4032-9236-0e4a264aeee4} . (.Google Inc. - Google Update.) (No version) -- (.not file.)
~ Scan IE Browser in 00mn 00s

---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = squid.in.ac-rouen.fr:8080
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Scan Proxy management in 00mn 00s

---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Scan Hosts File in 00mn 00s
~ Nombre de lignes (Lines number): 21

---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\vma\AppData\Local\Google\Update\GoogleUpdate.exe
O4 - HKCU\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
O4 - HKCU\..\Run: [DriverScanner] . (.Uniblue Systems Limited - Uniblue Launcher.) -- C:\Program Files (x86)\Uniblue\DriverScanner\launcher.exe
~ Scan Application in 00mn 00s

---\\ Autres liens utilisateurs (O4)
O4 - Global Startup: C:\Users\vma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\vma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\vma\Desktop\Adobe Reader 9.lnk . (...) -- C:\Windows\Installer\{AC76BA86-7AD7-1036-7B44-A93000000001}\SC_Reader.ico (.not file.)
O4 - Global Startup: C:\Users\vma\Desktop\AVANT-mai2010 - Raccourci.lnk . (...) -- D:\documents-veronique\AVANT-mai2010
O4 - Global Startup: C:\Users\vma\Desktop\CNU - Raccourci.lnk . (...) -- D:\documents-veronique\AVANT-mai2010\Mes documents-France-avtmai2010\Travaux-France2\ROUE-FAC\CNU
O4 - Global Startup: C:\Users\vma\Desktop\Easy Audio Cutter.lnk . (.Koyote Soft.) -- C:\Program Files (x86)\Free mp3 Wma Converter\Easy Audio Cutter\AudioCutter.exe
O4 - Global Startup: C:\Users\vma\Desktop\Free CD Ripper.lnk . (.Koyote Soft.) -- C:\Program Files (x86)\Free mp3 Wma Converter\Free CD Ripper\FreeCDRipper.exe
O4 - Global Startup: C:\Users\vma\Desktop\Free Mp3 Wma Converter.lnk . (.Koyote Soft.) -- C:\Program Files (x86)\Free mp3 Wma Converter\FreeConverter\FreeConverter.exe
O4 - Global Startup: C:\Users\vma\Desktop\HijackThis.lnk . (.Trend Micro Inc..) -- C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe
O4 - Global Startup: C:\Users\vma\Desktop\Microsoft Excel 2010.lnk . (...) -- C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\xlicons.exe
O4 - Global Startup: C:\Users\vma\Desktop\Microsoft PowerPoint 2010.lnk . (...) -- C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pptico.exe
O4 - Global Startup: C:\Users\vma\Desktop\Microsoft Security Essentials.lnk . (...) -- C:\Program Files (x86)\Microsoft Security Client\msseces.exe (.not file.)
O4 - Global Startup: C:\Users\vma\Desktop\Microsoft Word 2010.lnk . (...) -- C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\wordicon.exe
O4 - Global Startup: C:\Users\vma\Desktop\MIXclasis - Raccourci.lnk . (...) -- D:\documents-veronique\AVANT-mai2010\Mes documents-France-avtmai2010\Travaux-France2\ROUEN-recherche\MIXclasis
O4 - Global Startup: C:\Users\vma\Desktop\modele-TH-verolabtop-dernier - Raccourci.lnk . (...) -- D:\documents-veronique\AVANT-mai2010\Mes documents-France-avtmai2010\THESE-france2\modele-TH-verolabtop-dernier
O4 - Global Startup: C:\Users\vma\Desktop\nantes-plurilinguisme-horsdeFrance - Raccourci.lnk . (...) -- D:\documents-veronique\AVANT-mai2010\Mes documents-France-avtmai2010\Travaux-France2\Publlications-france_avtmai2010\nantes-plurilinguisme-horsdeFran
O4 - Global Startup: C:\Users\vma\Desktop\Outils Microsoft Office 2010 - Raccourci.lnk . (...) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Outils Microsoft Office 2010
O4 - Global Startup: C:\Users\vma\Desktop\Plurilinguisme-flsco-paf - Raccourci.lnk . (...) -- D:\documents-veronique\AVANT-mai2010\Mes documents-France-avtmai2010\Travaux-France2\ROUEN-recherche\ENA\formation-paf\Plurilinguisme-flsco-paf.pptx
O4 - Global Startup: C:\Users\vma\Desktop\publication-TH - Raccourci.lnk . (...) -- D:\documents-veronique\AVANT-mai2010\Mes documents-France-avtmai2010\THESE-france2\modele-TH-verolabtop-dernier\publication-TH
O4 - Global Startup: C:\Users\vma\Desktop\Publications-novembre-2010 - Raccourci.lnk . (...) -- D:\documents-veronique\AVANT-mai2010\Mes documents-France-avtmai2010\Travaux-France2\ROUE-FAC\CNU\Publications-novembre-2010.doc
O4 - Global Startup: C:\Users\vma\Desktop\rapport-activite-inspection-2009 - Raccourci.lnk . (...) -- D:\documents-veronique\AVANT-mai2010\Mes documents-France-avtmai2010\Travaux-France2\ROUEN-recherche\ecole\rapport-activite-inspection-2009.pdf
O4 - Global Startup: C:\Users\vma\Desktop\Rencontres biblio intéressantes après TH-2 - Raccourci.lnk . (...) -- D:\documents-veronique\AVANT-mai2010\Mes documents-France-avtmai2010\Travaux-France2\ROUEN-recherche\biblio-recherche-general\Rencontres bibl
O4 - Global Startup: C:\Users\vma\Desktop\Sonal.lnk . (.Alex ALBER.) -- C:\Program Files (x86)\Sonal\Sonal.exe
O4 - Global Startup: C:\Users\vma\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\CDBurnerXP.lnk . (.Canneverbe Limited.) -- C:\Program Files\CDBurnerXP\cdbxpp.exe
O4 - Global Startup: C:\Users\vma\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\DriverScanner.lnk . (.Uniblue Systems Limited.) -- C:\Program Files (x86)\Uniblue\DriverScanner\Launcher.exe
O4 - Global Startup: C:\Users\vma\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Easy Audio Cutter.lnk . (.Koyote Soft.) -- C:\Program Files (x86)\Free mp3 Wma Converter\Easy Audio Cutter\AudioCutter.exe
O4 - Global Startup: C:\Users\vma\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Free CD Ripper.lnk . (.Koyote Soft.) -- C:\Program Files (x86)\Free mp3 Wma Converter\Free CD Ripper\FreeCDRipper.exe
O4 - Global Startup: C:\Users\vma\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Free Mp3 Wma Converter.lnk . (.Koyote Soft.) -- C:\Program Files (x86)\Free mp3 Wma Converter\FreeConverter\FreeConverter.exe
O4 - Global Startup: C:\Users\vma\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\vma\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk . (.Mozilla Corporation.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - Global Startup: C:\Users\vma\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PDFCreator.lnk . (.pdfforge http://www.pdfforge.org/.) -- C:\Program Files (x86)\PDFCreator\PDFCreator.exe
~ Scan Global Startup in 00mn 43s

---\\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
O8 - Extra context menu item: &Envoyer à OneNote . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\MIF5BA~1\Office14\ONBttnIE.dll
O8 - Extra context menu item: E&xporter vers Microsoft Excel . (.Microsoft Corporation - Microsoft Excel.) -- C:\Program Files (x86)\MIF5BA~1\Office14\EXCEL.exe
~ Scan IE Menu Contextuel in 00mn 00s

---\\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Default MHTML Editor: Last - .(...) - (.not file.)
~ Scan Desktop Component in 00mn 00s

---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Adobe Flash Player Updater.job
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\DriverScanner.job
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-623347304-1096556946-2693182148-1000Core.job
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-623347304-1096556946-2693182148-1000UA.job
[MD5.A7E406711790197712D376B44A9FBB0B] [APT] [ConfigFree Startup Programs] (.TOSHIBA CORPORATION.) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
[MD5.0B14724F4869639B92CEF25F2CF72448] [APT] [DriverScanner] (.Uniblue Systems Limited.) -- C:\Program Files (x86)\Uniblue\DriverScanner\dsmonitor.exe
[MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskUserS-1-5-21-623347304-1096556946-2693182148-1000Core] (.Google Inc..) -- C:\Users\vma\AppData\Local\Google\Update\GoogleUpdate.exe
[MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskUserS-1-5-21-623347304-1096556946-2693182148-1000UA] (.Google Inc..) -- C:\Users\vma\AppData\Local\Google\Update\GoogleUpdate.exe
[MD5.00000000000000000000000000000000] [APT] [{A43F72C4-5406-4F95-B3A5-D3C66BF784FD}] (...) -- c:\program files (x86)\mozilla firefox\firefox.exe2égoogle-chrome:notoffered;alreadyoffered (.not file.)
[MD5.12A9F354160A1204D85A21F8D19790CB] [APT] [expressShakeIcon] (.NCH Software.) -- C:\Program Files (x86)\NCH Software\Express\Express.exe
~ Scan Scheduled Task in 00mn 05s

---\\ Composants installés (ActiveSetup Installed Components) (O40) (None)

---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 25/12/2011 - 09:19:03 - [25,246] ----D C:\Program Files (x86)\3G-EVDO
O43 - CFD: 01/03/2011 - 13:16:30 - [109,775] ----D C:\Program Files (x86)\Adobe
O43 - CFD: 21/07/2010 - 19:37:27 - [1,821] ----D C:\Program Files (x86)\Atheros
O43 - CFD: 05/01/2011 - 12:30:33 - [0,331] ----D C:\Program Files (x86)\Bing Bar Installer
O43 - CFD: 28/08/2011 - 15:31:09 - [457,177] ----D C:\Program Files (x86)\Canon
O43 - CFD: 24/07/2012 - 20:04:13 - [468,591] ----D C:\Program Files (x86)\Common Files
O43 - CFD: 14/07/2012 - 08:48:04 - [25,739] ----D C:\Program Files (x86)\Free mp3 Wma Converter
O43 - CFD: 22/07/2012 - 20:12:18 - [124,731] ----D C:\Program Files (x86)\Google
O43 - CFD: 05/01/2011 - 12:46:41 - [7,701] ----D C:\Program Files (x86)\GPLGS
O43 - CFD: 25/12/2011 - 09:19:44 - [124,008] --H-D C:\Program Files (x86)\InstallShield Installation Information
O43 - CFD: 07/04/2010 - 13:35:54 - [62,685] ----D C:\Program Files (x86)\Intel
O43 - CFD: 12/07/2012 - 06:54:18 - [5,240] ----D C:\Program Files (x86)\Internet Explorer
O43 - CFD: 12/07/2012 - 07:05:27 - [84,568] ----D C:\Program Files (x86)\Java
O43 - CFD: 05/01/2011 - 13:12:37 - [15,541] ----D C:\Program Files (x86)\JRE
O43 - CFD: 24/07/2012 - 08:15:48 - [11,720] ----D C:\Program Files (x86)\Malwarebytes' Anti-Malware
O43 - CFD: 20/03/2011 - 22:17:21 - [9,453] ----D C:\Program Files (x86)\McAfee Security Scan
O43 - CFD: 07/04/2010 - 14:03:39 - [0,216] ----D C:\Program Files (x86)\Microsoft
O43 - CFD: 21/01/2011 - 09:01:38 - [38,002] ----D C:\Program Files (x86)\Microsoft Analysis Services
O43 - CFD: 21/01/2011 - 09:05:28 - [985,061] ----D C:\Program Files (x86)\Microsoft Office
O43 - CFD: 28/04/2012 - 08:20:53 - [1,178] ----D C:\Program Files (x86)\Microsoft Security Client
O43 - CFD: 20/05/2012 - 09:37:57 - [40,838] ----D C:\Program Files (x86)\Microsoft Silverlight
O43 - CFD: 21/01/2011 - 09:05:25 - [3,467] ----D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
O43 - CFD: 21/01/2011 - 09:05:25 - [0,757] ----D C:\Program Files (x86)\Microsoft Sync Framework
O43 - CFD: 21/01/2011 - 09:05:58 - [0,312] ----D C:\Program Files (x86)\Microsoft Synchronization Services
O43 - CFD: 21/01/2011 - 09:02:49 - [1,314] ----D C:\Program Files (x86)\Microsoft Visual Studio 8
O43 - CFD: 05/01/2011 - 12:45:03 - [0,146] ----D C:\Program Files (x86)\Microsoft Works
O43 - CFD: 26/02/2011 - 09:52:30 - [7,789] ----D C:\Program Files (x86)\Microsoft.NET
O43 - CFD: 19/07/2012 - 13:29:04 - [42,248] ----D C:\Program Files (x86)\Mozilla Firefox
O43 - CFD: 22/07/2012 - 19:53:07 - [0,195] ----D C:\Program Files (x86)\Mozilla Maintenance Service
O43 - CFD: 21/01/2011 - 09:06:26 - [0,025] ----D C:\Program Files (x86)\MSBuild
O43 - CFD: 26/02/2011 - 10:13:21 - [0] ----D C:\Program Files (x86)\MSXML 4.0
O43 - CFD: 14/07/2012 - 10:07:18 - [7,987] ----D C:\Program Files (x86)\NCH Software
O43 - CFD: 07/04/2010 - 14:00:39 - [615,730] ----D C:\Program Files (x86)\Nero
O43 - CFD: 05/01/2011 - 13:12:35 - [370,139] ----D C:\Program Files (x86)\OpenOffice.org 3
O43 - CFD: 15/09/2011 - 14:37:29 - [11,039] ----D C:\Program Files (x86)\PDFCreator
O43 - CFD: 07/04/2010 - 14:04:05 - [26,129] ----D C:\Program Files (x86)\Photo-Service
O43 - CFD: 07/04/2010 - 13:44:34 - [8,142] ----D C:\Program Files (x86)\Realtek
O43 - CFD: 14/07/2009 - 07:32:38 - [36,809] ----D C:\Program Files (x86)\Reference Assemblies
O43 - CFD: 11/03/2012 - 11:18:58 - [31,089] R---D C:\Program Files (x86)\Skype
O43 - CFD: 14/07/2012 - 09:10:27 - [31,863] ----D C:\Program Files (x86)\Sonal
O43 - CFD: 21/07/2010 - 19:40:17 - [276,326] ----D C:\Program Files (x86)\Toshiba
O43 - CFD: 07/04/2010 - 14:07:27 - [174,057] ----D C:\Program Files (x86)\TOSHIBA Games
O43 - CFD: 07/04/2010 - 14:08:17 - [10,863] ----D C:\Program Files (x86)\Toshiba TEMPRO
O43 - CFD: 24/07/2012 - 13:57:19 - [0,392] ----D C:\Program Files (x86)\Trend Micro
O43 - CFD: 30/07/2011 - 10:05:25 - [25,717] ----D C:\Program Files (x86)\Uniblue
O43 - CFD: 14/07/2009 - 06:57:06 - [0] --H-D C:\Program Files (x86)\Uninstall Information
O43 - CFD: 14/07/2009 - 17:24:08 - [0,500] ----D C:\Program Files (x86)\Windows Defender
O43 - CFD: 07/04/2010 - 14:11:08 - [141,097] ----D C:\Program Files (x86)\Windows Live
O43 - CFD: 07/04/2010 - 14:09:46 - [0,234] ----D C:\Program Files (x86)\Windows Live SkyDrive
O43 - CFD: 26/02/2011 - 10:26:54 - [5,895] ----D C:\Program Files (x86)\Windows Mail
O43 - CFD: 26/02/2011 - 10:26:40 - [4,791] ----D C:\Program Files (x86)\Windows Media Player
O43 - CFD: 14/07/2009 - 07:32:38 - [11,632] ----D C:\Program Files (x86)\Windows NT
O43 - CFD: 14/07/2009 - 17:24:08 - [4,213] ----D C:\Program Files (x86)\Windows Photo Viewer
O43 - CFD: 14/07/2009 - 07:32:40 - [0,181] ----D C:\Program Files (x86)\Windows Portable Devices
O43 - CFD: 14/07/2009 - 17:24:08 - [5,937] ----D C:\Program Files (x86)\Windows Sidebar
O43 - CFD: 10/07/2011 - 08:09:46 - [3,951] ----D C:\Program Files (x86)\WinRAR
O43 - CFD: 24/07/2012 - 20:10:00 - [12,788] ----D C:\Program Files (x86)\ZHPDiag
O43 - CFD: 28/02/2012 - 23:51:57 - [6,178] ----D C:\Program Files (x86)\Common Files\Adobe
O43 - CFD: 07/04/2010 - 14:04:04 - [30,668] ----D C:\Program Files (x86)\Common Files\Adobe AIR
O43 - CFD: 28/08/2011 - 15:27:44 - [1,216] ----D C:\Program Files (x86)\Common Files\Canon
O43 - CFD: 21/01/2011 - 09:05:57 - [0,095] ----D C:\Program Files (x86)\Common Files\DESIGNER
O43 - CFD: 25/12/2011 - 09:16:37 - [4,102] ----D C:\Program Files (x86)\Common Files\InstallShield
O43 - CFD: 12/07/2012 - 07:06:34 - [1,201] ----D C:\Program Files (x86)\Common Files\Java
O43 - CFD: 21/01/2011 - 08:57:53 - [0,784] ----D C:\Program Files (x86)\Common Files\mcafee
O43 - CFD: 02/12/2011 - 09:48:51 - [234,059] ----D C:\Program Files (x86)\Common Files\microsoft shared
O43 - CFD: 07/04/2010 - 14:00:06 - [126,518] ----D C:\Program Files (x86)\Common Files\Nero
O43 - CFD: 14/07/2009 - 05:20:08 - [0,003] ----D C:\Program Files (x86)\Common Files\Services
O43 - CFD: 14/07/2009 - 05:20:08 - [39,200] ----D C:\Program Files (x86)\Common Files\SpeechEngines
O43 - CFD: 02/12/2011 - 08:31:38 - [15,951] ----D C:\Program Files (x86)\Common Files\System
O43 - CFD: 07/04/2010 - 14:08:41 - [0] ----D C:\Program Files (x86)\Common Files\Windows Live
O43 - CFD: 07/04/2010 - 14:08:13 - [8,616] ----D C:\Program Files (x86)\Common Files\Wise Installation Wizard
O43 - CFD: 28/02/2012 - 23:52:01 - [275,655] ----D C:\ProgramData\Adobe
O43 - CFD: 14/07/2009 - 07:08:56 - [0] --H-D C:\ProgramData\Application Data
O43 - CFD: 21/07/2010 - 19:37:35 - [0,010] ----D C:\ProgramData\Atheros
O43 - CFD: 05/01/2011 - 10:21:55 - [0] --H-D C:\ProgramData\Bureau
O43 - CFD: 30/07/2011 - 10:05:30 - [0] ----D C:\ProgramData\Canneverbe Limited
O43 - CFD: 01/03/2011 - 13:12:11 - [18,731] --H-D C:\ProgramData\CanonBJ
O43 - CFD: 10/03/2011 - 19:26:07 - [0,002] --H-D C:\ProgramData\CanonIJScan
O43 - CFD: 07/03/2012 - 17:03:41 - [0,000] ----D C:\ProgramData\Conexant
O43 - CFD: 14/07/2009 - 07:08:56 - [0] --H-D C:\ProgramData\Desktop
O43 - CFD: 14/07/2009 - 07:08:56 - [0] --H-D C:\ProgramData\Documents
O43 - CFD: 05/01/2011 - 10:21:55 - [0] --H-D C:\ProgramData\Favoris
O43 - CFD: 14/07/2009 - 07:08:56 - [0] --H-D C:\ProgramData\Favorites
O43 - CFD: 24/07/2012 - 08:15:38 - [6,408] ----D C:\ProgramData\Malwarebytes
O43 - CFD: 16/03/2011 - 22:17:58 - [0,544] ----D C:\ProgramData\McAfee
O43 - CFD: 16/03/2011 - 22:17:59 - [0,001] ----D C:\ProgramData\McAfee Security Scan
O43 - CFD: 05/01/2011 - 10:21:55 - [0] --H-D C:\ProgramData\Menu Démarrer
O43 - CFD: 21/01/2011 - 09:05:25 - [58,505] -S--D C:\ProgramData\Microsoft
O43 - CFD: 12/07/2012 - 06:33:12 - [0,071] ----D C:\ProgramData\Microsoft Help
O43 - CFD: 05/01/2011 - 10:21:55 - [0] --H-D C:\ProgramData\Modèles
O43 - CFD: 23/05/2012 - 08:04:56 - [0,007] ----D C:\ProgramData\Mozilla
O43 - CFD: 14/07/2012 - 10:07:14 - [0,572] ----D C:\ProgramData\NCH Software
O43 - CFD: 07/04/2010 - 13:56:59 - [10,863] ----D C:\ProgramData\Nero
O43 - CFD: 11/03/2012 - 11:18:58 - [65,062] ----D C:\ProgramData\Skype
O43 - CFD: 14/07/2009 - 07:08:56 - [0] --H-D C:\ProgramData\Start Menu
O43 - CFD: 05/01/2011 - 13:11:45 - [0,000] ----D C:\ProgramData\Sun
O43 - CFD: 14/07/2009 - 07:08:56 - [0] --H-D C:\ProgramData\Templates
O43 - CFD: 21/07/2010 - 19:44:09 - [5,018] ----D C:\ProgramData\Toshiba
O43 - CFD: 05/01/2011 - 10:22:33 - [0,002] ----D C:\ProgramData\ToshibaEurope
O43 - CFD: 08/10/2011 - 09:25:13 - [0] ----D C:\ProgramData\Uniblue
O43 - CFD: 07/04/2010 - 14:07:26 - [890,103] ----D C:\ProgramData\WildTangent
O43 - CFD: 28/08/2011 - 15:29:52 - [0] ----D C:\ProgramData\ZoomBrowser
O43 - CFD: 01/03/2011 - 21:05:03 - [3,713] ----D C:\Users\vma\AppData\Roaming\Adobe
O43 - CFD: 30/07/2011 - 10:05:29 - [0,001] ----D C:\Users\vma\AppData\Roaming\Canneverbe Limited
O43 - CFD: 10/03/2011 - 19:26:07 - [1,101] ----D C:\Users\vma\AppData\Roaming\Canon
O43 - CFD: 14/07/2012 - 08:48:11 - [0,000] ----D C:\Users\vma\AppData\Roaming\FreeAudioPack
O43 - CFD: 05/01/2011 - 10:24:58 - [0] ----D C:\Users\vma\AppData\Roaming\Identities
O43 - CFD: 07/04/2010 - 14:04:04 - [0,071] ----D C:\Users\vma\AppData\Roaming\Macromedia
O43 - CFD: 24/07/2012 - 08:15:54 - [0,002] ----D C:\Users\vma\AppData\Roaming\Malwarebytes
O43 - CFD: 14/07/2009 - 17:35:05 - [0] ----D C:\Users\vma\AppData\Roaming\Media Center Programs
O43 - CFD: 15/06/2012 - 10:04:18 - [49,868] -S--D C:\Users\vma\AppData\Roaming\Microsoft
O43 - CFD: 21/07/2012 - 07:24:25 - [52,684] ----D C:\Users\vma\AppData\Roaming\Mozilla
O43 - CFD: 14/07/2012 - 10:07:13 - [-1816,648] ----D C:\Users\vma\AppData\Roaming\NCH Software
O43 - CFD: 05/01/2011 - 10:30:37 - [-1447,586] ----D C:\Users\vma\AppData\Roaming\Nero
O43 - CFD: 05/01/2011 - 13:14:23 - [2,643] ----D C:\Users\vma\AppData\Roaming\OpenOffice.org
O43 - CFD: 19/03/2012 - 20:32:21 - [4,365] ----D C:\Users\vma\AppData\Roaming\Skype
O43 - CFD: 13/05/2011 - 18:28:15 - [0,001] ----D C:\Users\vma\AppData\Roaming\Softland
O43 - CFD: 26/02/2011 - 09:49:58 - [3,559] ----D C:\Users\vma\AppData\Roaming\Toshiba
O43 - CFD: 30/07/2011 - 10:05:28 - [5,638] ----D C:\Users\vma\AppData\Roaming\Uniblue
O43 - CFD: 10/07/2011 - 08:10:05 - [0,000] ----D C:\Users\vma\AppData\Roaming\WinRAR
O43 - CFD: 25/12/2011 - 09:19:20 - [0,003] ----D C:\Users\vma\AppData\Roaming\ZTEEVDO
O43 - CFD: 16/03/2012 - 13:17:01 - [4,379] ----D C:\Users\vma\AppData\Local\Adobe
O43 - CFD: 05/01/2011 - 10:22:04 - [0] ----D C:\Users\vma\AppData\Local\Application Data
O43 - CFD: 07/03/2012 - 17:03:38 - [0,016] ----D C:\Users\vma\AppData\Local\Conexant
O43 - CFD: 14/07/2012 - 10:08:43 - [1,602] ----D C:\Users\vma\AppData\Local\CRE
O43 - CFD: 21/07/2012 - 12:22:03 - [4,484] ----D C:\Users\vma\AppData\Local\Diagnostics
O43 - CFD: 31/01/2012 - 14:18:49 - [0] ----D C:\Users\vma\AppData\Local\ElevatedDiagnostics
O43 - CFD: 15/04/2012 - 00:08:09 - [252,186] ----D C:\Users\vma\AppData\Local\Google
O43 - CFD: 05/01/2011 - 10:22:04 - [0] ----D C:\Users\vma\AppData\Local\Historique
O43 - CFD: 15/06/2012 - 10:04:18 - [0] ----D C:\Users\vma\AppData\Local\Macromedia
O43 - CFD: 27/06/2012 - 21:41:10 - [1212,096] ----D C:\Users\vma\AppData\Local\Microsoft
O43 - CFD: 17/04/2012 - 06:11:30 - [0,209] ----D C:\Users\vma\AppData\Local\Microsoft Help
O43 - CFD: 05/01/2011 - 12:06:19 - [54,165] ----D C:\Users\vma\AppData\Local\Mozilla
O43 - CFD: 05/01/2011 - 10:31:02 - [0,001] ----D C:\Users\vma\AppData\Local\Nero_AG
O43 - CFD: 24/07/2012 - 20:08:40 - [1078,255] ----D C:\Users\vma\AppData\Local\Temp
O43 - CFD: 05/01/2011 - 10:22:04 - [0] ----D C:\Users\vma\AppData\Local\Temporary Internet Files
O43 - CFD: 05/01/2011 - 10:25:28 - [0] ----D C:\Users\vma\AppData\Local\Toshiba
O43 - CFD: 05/01/2011 - 11:58:54 - [0,000] ----D C:\Users\vma\AppData\Local\TOSHIBA_Corporation
O43 - CFD: 14/07/2012 - 09:20:09 - [0,000] ----D C:\Users\vma\AppData\Local\VirtualStore
O43 - CFD: 25/12/2011 - 09:19:20 - [0] ----D C:\Users\vma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\3G EVDO
O43 - CFD: 14/07/2009 - 06:54:32 - [0,014] R---D C:\Users\vma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
O43 - CFD: 12/07/2012 - 06:56:43 - [0,000] R---D C:\Users\vma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
O43 - CFD: 23/07/2012 - 08:37:56 - [0,005] ----D C:\Users\vma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
O43 - CFD: 14/07/2009 - 06:49:38 - [0,001] R---D C:\Users\vma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
O43 - CFD: 14/07/2012 - 09:10:29 - [0,003] ----D C:\Users\vma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sonal
O43 - CFD: 12/07/2012 - 06:56:43 - [0,003] R---D C:\Users\vma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
O43 - CFD: 10/07/2011 - 08:09:46 - [0,003] ----D C:\Users\vma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
O43 - CFD: 25/12/2011 - 09:19:03 - [25,246] ----D C:\Program Files (x86)\3G-EVDO
O43 - CFD: 01/03/2011 - 13:16:30 - [109,775] ----D C:\Program Files (x86)\Adobe
O43 - CFD: 21/07/2010 - 19:37:27 - [1,821] ----D C:\Program Files (x86)\Atheros
O43 - CFD: 05/01/2011 - 12:30:33 - [0,331] ----D C:\Program Files (x86)\Bing Bar Installer
O43 - CFD: 28/08/2011 - 15:31:09 - [457,177] ----D C:\Program Files (x86)\Canon
O43 - CFD: 24/07/2012 - 20:04:13 - [468,591] ----D C:\Program Files (x86)\Common Files
O43 - CFD: 14/07/2012 - 08:48:04 - [25,739] ----D C:\Program Files (x86)\Free mp3 Wma Converter
O43 - CFD: 22/07/2012 - 20:12:18 - [124,731] ----D C:\Program Files (x86)\Google
O43 - CFD: 05/01/2011 - 12:46:41 - [7,701] ----D C:\Program Files (x86)\GPLGS
O43 - CFD: 25/12/2011 - 09:19:44 - [124,008] --H-D C:\Program Files (x86)\InstallShield Installation Information
O43 - CFD: 07/04/2010 - 13:35:54 - [62,685] ----D C:\Program Files (x86)\Intel
O43 - CFD: 12/07/2012 - 06:54:18 - [5,240] ----D C:\Program Files (x86)\Internet Explorer
O43 - CFD: 12/07/2012 - 07:05:27 - [84,568] ----D C:\Program Files (x86)\Java
O43 - CFD: 05/01/2011 - 13:12:37 - [15,541] ----D C:\Program Files (x86)\JRE
O43 - CFD: 24/07/2012 - 08:15:48 - [11,720] ----D C:\Program Files (x86)\Malwarebytes' Anti-Malware
O43 - CFD: 20/03/2011 - 22:17:21 - [9,453] ----D C:\Program Files (x86)\McAfee Security Scan
O43 - CFD: 07/04/2010 - 14:03:39 - [0,216] ----D C:\Program Files (x86)\Microsoft
O43 - CFD: 21/01/2011 - 09:01:38 - [38,002] ----D C:\Program Files (x86)\Microsoft Analysis Services
O43 - CFD: 21/01/2011 - 09:05:28 - [985,061] ----D C:\Program Files (x86)\Microsoft Office
O43 - CFD: 28/04/2012 - 08:20:53 - [1,178] ----D C:\Program Files (x86)\Microsoft Security Client
O43 - CFD: 20/05/2012 - 09:37:57 - [40,838] ----D C:\Program Files (x86)\Microsoft Silverlight
O43 - CFD: 21/01/2011 - 09:05:25 - [3,467] ----D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
O43 - CFD: 21/01/2011 - 09:05:25 - [0,757] ----D C:\Program Files (x86)\Microsoft Sync Framework
O43 - CFD: 21/01/2011 - 09:05:58 - [0,312] ----D C:\Program Files (x86)\Microsoft Synchronization Services
O43 - CFD: 21/01/2011 - 09:02:49 - [1,314] ----D C:\Program Files (x86)\Microsoft Visual Studio 8
O43 - CFD: 05/01/2011 - 12:45:03 - [0,146] ----D C:\Program Files (x86)\Microsoft Works
O43 - CFD: 26/02/2011 - 09:52:30 - [7,789] ----D C:\Program Files (x86)\Microsoft.NET
O43 - CFD: 19/07/2012 - 13:29:04 - [42,248] ----D C:\Program Files (x86)\Mozilla Firefox
O43 - CFD: 22/07/2012 - 19:53:07 - [0,195] ----D C:\Program Files (x86)\Mozilla Maintenance Service
O43 - CFD: 21/01/2011 - 09:06:26 - [0,025] ----D C:\Program Files (x86)\MSBuild
O43 - CFD: 26/02/2011 - 10:13:21 - [0] ----D C:\Program Files (x86)\MSXML 4.0
O43 - CFD: 14/07/2012 - 10:07:18 - [7,987] ----D C:\Program Files (x86)\NCH Software
O43 - CFD: 07/04/2010 - 14:00:39 - [615,730] ----D C:\Program Files (x86)\Nero
O43 - CFD: 05/01/2011 - 13:12:35 - [370,139] ----D C:\Program Files (x86)\OpenOffice.org 3
O43 - CFD: 15/09/2011 - 14:37:29 - [11,039] ----D C:\Program Files (x86)\PDFCreator
O43 - CFD: 07/04/2010 - 14:04:05 - [26,129] ----D C:\Program Files (x86)\Photo-Service
O43 - CFD: 07/04/2010 - 13:44:34 - [8,142] ----D C:\Program Files (x86)\Realtek
O43 - CFD: 14/07/2009 - 07:32:38 - [36,809] ----D C:\Program Files (x86)\Reference Assemblies
O43 - CFD: 11/03/2012 - 11:18:58 - [31,089] R---D C:\Program Files (x86)\Skype
O43 - CFD: 14/07/2012 - 09:10:27 - [31,863] ----D C:\Program Files (x86)\Sonal
O43 - CFD: 21/07/2010 - 19:40:17 - [276,326] ----D C:\Program Files (x86)\Toshiba
O43 - CFD: 07/04/2010 - 14:07:27 - [174,057] ----D C:\Program Files (x86)\TOSHIBA Games
O43 - CFD: 07/04/2010 - 14:08:17 - [10,863] ----D C:\Program Files (x86)\Toshiba TEMPRO
O43 - CFD: 24/07/2012 - 13:57:19 - [0,392] ----D C:\Program Files (x86)\Trend Micro
O43 - CFD: 30/07/2011 - 10:05:25 - [25,717] ----D C:\Program Files (x86)\Uniblue
O43 - CFD: 14/07/2009 - 06:57:06 - [0] --H-D C:\Program Files (x86)\Uninstall Information
O43 - CFD: 14/07/2009 - 17:24:08 - [0,500] ----D C:\Program Files (x86)\Windows Defender
O43 - CFD: 07/04/2010 - 14:11:08 - [141,097] ----D C:\Program Files (x86)\Windows Live
O43 - CFD: 07/04/2010 - 14:09:46 - [0,234] ----D C:\Program Files (x86)\Windows Live SkyDrive
O43 - CFD: 26/02/2011 - 10:26:54 - [5,895] ----D C:\Program Files (x86)\Windows Mail
O43 - CFD: 26/02/2011 - 10:26:40 - [4,791] ----D C:\Program Files (x86)\Windows Media Player
O43 - CFD: 14/07/2009 - 07:32:38 - [11,632] ----D C:\Program Files (x86)\Windows NT
O43 - CFD: 14/07/2009 - 17:24:08 - [4,213] ----D C:\Program Files (x86)\Windows Photo Viewer
O43 - CFD: 14/07/2009 - 07:32:40 - [0,181] ----D C:\Program Files (x86)\Windows Portable Devices
O43 - CFD: 14/07/2009 - 17:24:08 - [5,937] ----D C:\Program Files (x86)\Windows Sidebar
O43 - CFD: 10/07/2011 - 08:09:46 - [3,951] ----D C:\Program Files (x86)\WinRAR
O43 - CFD: 24/07/2012 - 20:10:00 - [12,788] ----D C:\Program Files (x86)\ZHPDiag
O43 - CFD: 28/02/2012 - 23:51:57 - [6,178] ----D C:\Program Files (x86)\Common Files\Adobe
O43 - CFD: 07/04/2010 - 14:04:04 - [30,668] ----D C:\Program Files (x86)\Common Files\Adobe AIR
O43 - CFD: 28/08/2011 - 15:27:44 - [1,216] ----D C:\Program Files (x86)\Common Files\Canon
O43 - CFD: 21/01/2011 - 09:05:57 - [0,095] ----D C:\Program Files (x86)\Common Files\DESIGNER
O43 - CFD: 25/12/2011 - 09:16:37 - [4,102] ----D C:\Program Files (x86)\Common Files\InstallShield
O43 - CFD: 12/07/2012 - 07:06:34 - [1,201] ----D C:\Program Files (x86)\Common Files\Java
O43 - CFD: 21/01/2011 - 08:57:53 - [0,784] ----D C:\Program Files (x86)\Common Files\mcafee
O43 - CFD: 02/12/2011 - 09:48:51 - [234,059] ----D C:\Program Files (x86)\Common Files\microsoft shared
O43 - CFD: 07/04/2010 - 14:00:06 - [126,518] ----D C:\Program Files (x86)\Common Files\Nero
O43 - CFD: 14/07/2009 - 05:20:08 - [0,003] ----D C:\Program Files (x86)\Common Files\Services
O43 - CFD: 14/07/2009 - 05:20:08 - [39,200] ----D C:\Program Files (x86)\Common Files\SpeechEngines
O43 - CFD: 02/12/2011 - 08:31:38 - [15,951] ----D C:\Program Files (x86)\Common Files\System
O43 - CFD: 07/04/2010 - 14:08:41 - [0] ----D C:\Program Files (x86)\Common Files\Windows Live
O43 - CFD: 07/04/2010 - 14:08:13 - [8,616] ----D C:\Program Files (x86)\Common Files\Wise Installation Wizard
~ Scan Program Folder in 00mn 31s

---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.E1E3C5D4E1C0814EE1BD6E4CC6FF4AFD] - 24/07/2012 - 19:11:04 ---A- . (...) -- C:\Windows\WindowsUpdate.log [1934413]
O44 - LFC:[MD5.BCB2977F2B3786DC40F6AA259C8C09AC] - 24/07/2012 - 19:05:40 ---A- . (...) -- C:\Windows\setupact.log [45226]
O44 - LFC:[MD5.6EB42CC444C5E73F3B561C5C468636F0] - 24/07/2012 - 19:05:36 -S-A- . (...) -- C:\Windows\bootstat.dat [67584]
O44 - LFC:[MD5.1A057D0DF9727D425C29CFE8E32F3E4C] - 24/07/2012 - 19:04:18 ---A- . (...) -- C:\AdwCleaner[S1].txt [10382]
O44 - LFC:[MD5.6406636EE6C4D40C062DE9037563B2AB] - 24/07/2012 - 18:44:15 ---A- . (...) -- C:\Windows\SysNative\PerfStringBackup.INI [1556648]
O44 - LFC:[MD5.834B48EF07D3BA3FDB173ADB8253B99E] - 24/07/2012 - 18:44:15 ---A- . (...) -- C:\Windows\SysNative\perfc009.dat [107650]
O44 - LFC:[MD5.EF2211CD233EBC25EC4760B18946943C] - 24/07/2012 - 18:44:15 ---A- . (...) -- C:\Windows\SysNative\perfc00C.dat [132016]
O44 - LFC:[MD5.43B74FEF0BF0CF17A8D514F109D52670] - 24/07/2012 - 18:44:15 ---A- . (...) -- C:\Windows\SysNative\perfh009.dat [618370]
O44 - LFC:[MD5.661995DFB6FC9C521A2FEF4DD181B78B] - 24/07/2012 - 18:44:15 ---A- . (...) -- C:\Windows\SysNative\perfh00C.dat [706842]
O44 - LFC:[MD5.6406636EE6C4D40C062DE9037563B2AB] - 24/07/2012 - 18:44:15 ---A- . (...) -- C:\Windows\System32\PerfStringBackup.INI [1556648]
O44 - LFC:[MD5.D0272CF3029D32CF06100BC89EF5F8E2] - 24/07/2012 - 18:38:04 ---A- . (...) -- C:\Windows\PFRO.log [55632]
O44 - LFC:[MD5.A103FDF7348130EF3F3FEF56B1700A27] - 14/07/2012 - 09:09:00 ---A- . (...) -- C:\END [9]
O44 - LFC:[MD5.1C3BD05D128D2A5473EA42D057737F43] - 12/07/2012 - 05:55:59 . (...) -- C:\Windows\System32\FNTCACHE.DAT []
O44 - LFC:[MD5.1C3BD05D128D2A5473EA42D057737F43] - 12/07/2012 - 05:55:59 ---A- . (...) -- C:\Windows\SysNative\FNTCACHE.DAT [448256]
~ Scan Files in 00mn 06s

---\\ Contrôle du Safe Boot (CSB) (O49) (None)

---\\ MountPoints2 Shell Key (O51) (None)

---\\ ShareTools MSconfig StartupReg (O53) (None)

---\\ Liste des Drivers Système (O58)
O58 - SDL:[MD5.2F6B34B83843F0C5118B63AC634F5BF4] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [491088]
~ Scan Drivers in 00mn 00s

---\\ File Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <FirefoxHTML>[HKCU\..\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O67 - Shell Spawning: <.html> <FirefoxHTML>[HKCR\..\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
~ Scan Keys in 00mn 00s

---\\ Start Menu Internet (O68) (None)

---\\ Search Browser Infection (O69)
O69 - SBI: C:\Users\vma\AppData\Roaming\Mozilla\Firefox\Profiles\jc5ybxfe.default\searchplugins\conduit.xml
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.FirstTime", "true");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.FirstTimeFF3", "true");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.SearchFromAddressBarUrl", "http://search.conduit.com/ResultsExt.aspx?ctid=CT2801939&SearchSource=2&q=");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.UserID", "UN51398329252057983");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.addressBarTakeOverEnabledInHidden", "true");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.browser.search.defaultthis.engineName", true);
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.defaultSearch", "true");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.embeddedsData", "[{\"appId\":\"129306877870131855\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFra[...]
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.enableAlerts", "always");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.enableSearchFromAddressBar", "true");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.firstTimeDialogOpened", "true");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.fixPageNotFoundError", "true");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.fixPageNotFoundErrorInHidden", "true");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.fixUrls", true);
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.installId", "ConduitInstaller.exe");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.installType", "ConduitNSISIntegration");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.isNewTabEnabled", true);
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.isPerformedSmartBarTransition", "true");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.keyword", true);
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"https%3A%2F%2Fmail.google.com%2Fmai[...]
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.openThankYouPage", "false");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.openUninstallPage", "true");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.searchInNewTabEnabledInHidden", "true");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"2\"}");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT2801939\"}");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"http://NCHFR.Ou[...]
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"NCH FR\"}");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.settingsINI", true);
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.shouldFirstTimeDialog", "false");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.smartbar.CTID", "CT2801939");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.smartbar.Uninstall", "0");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.smartbar.homepage", true);
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.smartbar.toolbarName", "NCH FR ");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.toolbarBornServerTime", "24-7-2012");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("CT2801939.toolbarCurrentServerTime", "24-7-2012");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("Smartbar.ConduitHomepagesList", "http://search.conduit.com/?ctid=CT2801939&SearchSource=13");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("Smartbar.ConduitSearchEngineList", "NCH FR Customized Web Search");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("Smartbar.ConduitSearchUrlList", "http://search.conduit.com/ResultsExt.aspx?ctid=CT2801939&SearchSource=2&q=");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("browser.startup.homepage", "http://search.conduit.com/?ctid=CT2801939&SearchSource=13");
O69 - SBI: prefs.js [vma - jc5ybxfe.default] user_pref("keyword.URL", "http://search.conduit.com/ResultsExt.aspx?ctid=CT2801939&SearchSource=2&q=");
O69 - SBI: SearchScopes [HKCU] {7B146B94-2256-4785-8930-EDBA8105ECB4} [DefaultScope] - (Google) - http://www.google.com
O69 - SBI: SearchScopes [HKCU] {9A5E4672-F841-4602-992D-AF0156151A17} - (Yahoo! Search) - http://fr.search.yahoo.com
~ Scan Keys in 00mn 00s

---\\ Recherche des services démarrés par Svchost (O83) (None)

---\\ Recherche particuliere à la racine de certains dossiers (O84)
[MD5.F59F192D75396538912A87A5A8447E70] [SPRF][07/06/2012] (.Ask.com - AskStub Application.) -- C:\Users\vma\AppData\Local\Temp\ApnStub.exe [357032]
[MD5.09ADE88E9328E45B3373A81CA3668153] [SPRF][12/07/2012] (.McAfee, Inc. - McAfee Scanner Content Installer.) -- C:\Users\vma\AppData\Local\Temp\contentDATs.exe [957312]
[MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][01/03/2011] (...) -- C:\Users\vma\AppData\Local\Temp\jqleo21t.dll [0]
[MD5.A8D666FCE8EFD0788FA0DF14FB3491B4] [SPRF][10/02/2011] (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Users\vma\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe [885536]
[MD5.107167F15D30AA71D7CAFC0326AFB315] [SPRF][08/06/2012] (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Users\vma\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe [909104]
[MD5.168DDE5E84E651ADBF83587C0673F6F4] [SPRF][06/03/2010] (.Microsoft Corporation - Barre d'outils Bing®.) -- C:\Users\vma\AppData\Local\Temp\MSN47F7.exe [346968]
[MD5.9D10F99A6712E28F8ACD5641E3A7EA6B] [SPRF][29/03/2010] (.Microsoft Corporation - Office Source Engine.) -- C:\Users\vma\AppData\Local\Temp\ose00000.exe [149352]
[MD5.B2C46C7064C867F4722A0F51CF18FB62] [SPRF][20/03/2011] (.McAfee, Inc. - McAfee Security Scan Plus Installer.) -- C:\Users\vma\AppData\Local\Temp\SecurityScan_Release.exe [3598224]
[MD5.4B64816606CB61A694C6F2C4EAFE17B0] [SPRF][14/04/2012] (.Adobe Systems Inc. - Adobe Shockwave Player.) -- C:\Users\vma\AppData\Local\Temp\Shockwave_Installer_FF.exe [185616]
[MD5.61FBC6C9BE728206CD74CEBBCC328847] [SPRF][27/10/2011] (.Skype Technologies S.A. - Skype.) -- C:\Users\vma\AppData\Local\Temp\SkypeSetup.exe [23803016]
[MD5.2D2894581D355D5F44EAE38898A66846] [SPRF][01/01/2012] (.Conduit Ltd. - Conduit Toolbar.) -- C:\Users\vma\AppData\Local\Temp\tbNCH_.dll [4398888]
[MD5.5F158A8B8AD2E3DBADAF95E3246CF862] [SPRF][24/07/2012] (...) -- C:\Users\vma\AppData\Local\Temp\Uninst.bat [605]
[MD5.07DA6C9C3547C38BBA12E63F54FD9B00] [SPRF][24/07/2012] (...) -- C:\Users\vma\Desktop\adwcleaner.exe [632049]
[MD5.EA919D38E49DA4F407F6C94696878E00] [SPRF][30/07/2011] (.Canneverbe Limited - CDBurnerXP.) -- C:\Users\vma\Desktop\cdbxp_setup_4.3.8.2523.exe [4983296]
[MD5.D16AF8C48A3F35066B74B8CE8CCB6BFD] [SPRF][13/05/2011] (.Softland - doPDF 7 printer Setup.) -- C:\Users\vma\Desktop\dopdf-7.exe [4185176]
[MD5.034A0014EABA0E1E29F6D185EFBB2DB0] [SPRF][14/07/2012] (.NCH Software - Express Scribe.) -- C:\Users\vma\Desktop\essetup.exe [898104]
[MD5.E071915EF48471AB75A4A89198D5EE0F] [SPRF][24/02/2012] (.Mozilla - Firefox.) -- C:\Users\vma\Desktop\Firefox Setup 10.0.2.exe [15917152]
[MD5.1551AFA651B9A4BAF2861FD0A7E624C9] [SPRF][14/07/2012] (.Bandoo Media Inc - Free mp3 Wma Converter Install.) -- C:\Users\vma\Desktop\free-mp3-wma-converter_free_mp3_wma_converter_2.0_francais_34863.exe [426088]
[MD5.20CA07AAD11E09E82B9164039513E322] [SPRF][01/08/2011] (.Google Inc. - Google Update Setup.) -- C:\Users\vma\Desktop\GoogleEarthSetup.exe [589640]
[MD5.5A1F86CDCD63A33F736050925244C9C6] [SPRF][09/04/2011] (.Google Inc. - Setup.) -- C:\Users\vma\Desktop\GoogleVoiceAndVideoSetup(2).exe [568672]
[MD5.AB1C4DEAB684B0D883CFAA82C7BC6D19] [SPRF][24/07/2012] (.Trend Micro Inc. - HijackThis.) -- C:\Users\vma\Desktop\HJTInstall.exe [812344]
[MD5.E210104436065F03B0B067D461003269] [SPRF][11/03/2012] (.Bandoo Media Inc. - iLivid Installation.) -- C:\Users\vma\Desktop\iLividSetupV1.exe [2081080]
[MD5.F3660EE8136BDFFE172BE66093D2F427] [SPRF][14/07/2012] (...) -- C:\Users\vma\Desktop\InstallSonal.exe [9268374]
[MD5.5BF85298D6E2D96235027E3F041605EF] [SPRF][25/06/2011] (.Adobe Systems, Inc. - Adobe® Flash® Player Installer/Uninstaller 10.3 r181.) -- C:\Users\vma\Desktop\install_flash_player.exe [3082400]
[MD5.46E0A382005B3C03B326B2B614DBF4AB] [SPRF][14/07/2012] (...) -- C:\Users\vma\Desktop\MAJSonal.exe [1486333]
[MD5.B3F52C1F402613B110EE66F5A3604063] [SPRF][24/07/2012] (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Users\vma\Desktop\mbam-setup-1.62.0.1300.exe [10652120]
[MD5.8CFF20A62EFADF9860B0CEEE960975A0] [SPRF][05/01/2011] (...) -- C:\Users\vma\Desktop\OOo_3.2.1_Win_x86_install-wJRE_fr.exe [149664176]
[MD5.266B21515706E2399B3BD0DF2C7D1472] [SPRF][15/09/2011] (.pdfforge GbR - PDFCreator is the easy way of creating PDFs..) -- C:\Users\vma\Desktop\PDFCreator-1_2_3_setup.exe [18590304]
[MD5.ADF7EBDB461F21F4DB3397591A7ECBC4] [SPRF][19/03/2012] (.Frank Heindörfer, Philip Chinery - PDFCreator is the easy way of creating PDFs..) -- C:\Users\vma\Desktop\PDFCreator-1_3_1_setup.exe [17815464]
[MD5.0DCA470D9F49E5F6CD7A6F3D75DA0D27] [SPRF][07/07/2011] (.Skype Technologies S.A. - Skype.) -- C:\Users\vma\Desktop\SkypeSetup(2).exe [1029000]
[MD5.0DCA470D9F49E5F6CD7A6F3D75DA0D27] [SPRF][07/07/2011] (.Skype Technologies S.A. - Skype.) -- C:\Users\vma\Desktop\SkypeSetup.exe [1029000]
[MD5.2F5A438D23DFD21EBA32306C64EBE992] [SPRF][24/07/2012] (.Nicolas Coolman - ZHPDiag.) -- C:\Users\vma\Desktop\ZHPDiag2.exe [4598607]
~ Scan Files in 00mn 05s

---\\ Scan Additionnel (O88)
Database Version : 9170 - (21/07/2012)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 1

C:\Users\vma\AppData\Roaming\Mozilla\Firefox\Profiles\jc5ybxfe.default\SearchPlugins\conduit.xml =>Toolbar.Conduit
~ Scan Additionnel in 00mn 07s

End of the scan (620 lines in 01mn 57s)(0)

- le rapport de malwarebytes (aucun élément nuisible détecté)

le soucis, c'est l'installation de adware via les toolbars et les utilitaires

pour terminer on fait le ménage

tout est ecrit là :
https://gen-hackman.kanak.fr/

(merci à mon ami g3n-h@ckm@n)