désinstaller Searchnu Fermé

Question

Bonjour, 

J'ai un problème avec searchnu, impossible de s'en débarrasser.
Voici le rapport de ZHPDiag        https://www.cjoint.com/?0HgmvSufolC 
quelqu'un peut-il m'aider à interpréter ces données? 
D'avance, merci.
<config>Windows 7 / googe chrome

zulfikarhan · Answer

Suivre les conseils, de ce contributeur de sécurité.

https://forums.commentcamarche.net/forum/affich-25049705-supprimer-searchnu

cysco · Answer

ok! Quelqu'un peut m'aider avec ce rapport?
https://www.cjoint.com/?BHgmT1Em6GK

Smart91 · Answer

Bonjour,

Évite d'installer des barres d'outils c'est totalement inutile, lis les dossier ci-dessous:
Les Toolbars ce n'est pas obligatoires 

Ensuite tu vas faire ceci:

 Télécharge sur ton bureau  AdwCleaner de Xplode
- Choisis "Recherche"  et poste le rapport qu'il va ouvrir
- Le rapport se trouve ici ==> C:\AdwCleaner[R1].txt

Smart

cysco · Answer

Voila le rapport adwCleaner:

# AdwCleaner v1.800 - Rapport créé le 06/08/2012 à 12:34:40
# Mis à jour le 01/08/2012 par Xplode
# Système d'exploitation : Windows 7 Ultimate  (64 bits)
# Nom d'utilisateur : cyrille - CYRILLE-PC
# Exécuté depuis : C:\Users\cyrille\Downloads\adwcleaner.exe
# Option [Suppression]


***** [Services] *****


***** [Fichiers / Dossiers] *****


***** [Registre] *****

Clé Supprimée : HKLM\SOFTWARE\DT Soft

***** [Registre - GUID] *****


***** [Navigateurs] *****

-\ Internet Explorer v8.0.7600.16385

[OK] Le registre ne contient aucune entrée illégitime.

-\ Google Chrome v21.0.1180.60

Fichier : C:\Users\cyrille\AppData\Local\Google\Chrome\User Data\Default\Preferences

Supprimée :          "urls_to_restore_on_startup": [ "hxxp://www.google.com/", "hxxp://www.searchnu.com/410" ]
Supprimée :       "name": "Search Results",
Supprimée :       "search_url": "hxxp://dts.search-results.com/sr?src=crb&appid=0&systemid=410&sr=0&q={searchTer[...]
Supprimée :       "urls_to_restore_on_startup": [ "hxxp://www.google.com/", "hxxp://www.searchnu.com/410" ]

*************************

AdwCleaner[S1].txt - [290 octets] - [06/08/2012 11:37:17]
AdwCleaner[S2].txt - [11036 octets] - [06/08/2012 11:40:20]
AdwCleaner[S3].txt - [1248 octets] - [06/08/2012 12:34:40]

########## EOF - C:\AdwCleaner[S3].txt - [1376 octets] ##########

Smart91 · Answer

Tu aurais dû dire que tu avais déjà passé Adwcleaner et en plus en mode suppression directement (pas prudent) 

Peux-tu poster ce rapport: C:\AdwCleaner[S2].txt 
Normalement tu ne devrais plus avoir searchnu; 

Smart 
"Si tu n'as pas d'ambitions, tu t'installes au bord de la chute" (Kundera)

cysco · Answer

Le rapport S2

# AdwCleaner v1.800 - Rapport créé le 06/08/2012 à 11:40:20
# Mis à jour le 01/08/2012 par Xplode
# Système d'exploitation : Windows 7 Ultimate  (64 bits)
# Nom d'utilisateur : cyrille - CYRILLE-PC
# Exécuté depuis : C:\Users\cyrille\Downloads\adwcleaner (1).exe
# Option [Suppression]


***** [Services] *****


***** [Fichiers / Dossiers] *****

Supprimé au redémarrage : C:\Users\cyrille\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Supprimé au redémarrage : C:\Users\cyrille\AppData\Local\Google\Chrome\User Data\Default\Extensions
iapdbllcanepiiimjjndipklodoedlc
Supprimé au redémarrage : C:\Users\cyrille\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}
Supprimé au redémarrage : C:\Users\cyrille\AppData\Local\Temp\BabylonToolbar
Supprimé au redémarrage : C:\Users\cyrille\AppData\LocalLow\BabylonToolbar
Supprimé au redémarrage : C:\Users\cyrille\AppData\LocalLow\SweetIM
Supprimé au redémarrage : C:\Users\cyrille\AppData\Roaming\Babylon
Supprimé au redémarrage : C:\Users\cyrille\AppData\Roaming\OfferBox
Supprimé au redémarrage : C:\ProgramData\Babylon
Supprimé au redémarrage : C:\ProgramData\boost_interprocess
Supprimé au redémarrage : C:\ProgramData\Tarma Installer
Supprimé au redémarrage : C:\Program Files (x86)\SweetIM
Supprimé au redémarrage : C:\Program Files (x86)\Yontoo
Fichier Supprimé : C:\Users\cyrille\AppData\Local\Temp\Searchqu.ini
Fichier Supprimé : C:\Users\cyrille\AppData\Local\Temp\searchqutoolbar-manifest.xml
Fichier Supprimé : C:\Users\cyrille\AppData\Local\Temp\SetupDataMngr_Searchqu.exe

***** [Registre] *****

Clé Supprimée : HKCU\Software\DataMngr
Clé Supprimée : HKCU\Software\Offerbox
Clé Supprimée : HKCU\Software\SweetIm
Clé Supprimée : HKLM\SOFTWARE\Babylon
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Clé Supprimée : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar
Clé Supprimée : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1
Clé Supprimée : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook
Clé Supprimée : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1
Clé Supprimée : HKLM\SOFTWARE\Classes\Toolbar3.sweetie
Clé Supprimée : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1
Clé Supprimée : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Clé Supprimée : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Clé Supprimée : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
Clé Supprimée : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1
Clé Supprimée : HKLM\SOFTWARE\DT Soft
Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn
Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions
iapdbllcanepiiimjjndipklodoedlc
Clé Supprimée : HKLM\SOFTWARE\Iminent
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2F603A45-D956-496B-81B5-50D782424976}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B85C4CB2-B352-4BD8-818C-BCE353599107}
Clé Supprimée : HKLM\SOFTWARE\Offerbox
Clé Supprimée : HKLM\SOFTWARE\SweetIM
[x64] Clé Supprimée : HKLM\SOFTWARE\DataMngr
[x64] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2F603A45-D956-496B-81B5-50D782424976}
[x64] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
[x64] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B85C4CB2-B352-4BD8-818C-BCE353599107}
[x64] Clé Supprimée : HKLM\SOFTWARE\Tarma Installer

***** [Registre - GUID] *****

Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}
Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Valeur Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Valeur Supprimée : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Valeur Supprimée : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EEE6C35D-6118-11DC-9C72-001320C79847}]
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
[x64] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
[x64] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}

***** [Navigateurs] *****

-\ Internet Explorer v8.0.7600.16385

Remplacé : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://home.sweetim.com/?crg=3.1010000.10011&barid={77242EE6-D375-11E1-A148-5404A6B226A6} --> hxxp://www.google.com
Remplacé : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.searchnu.com/410 --> hxxp://www.google.com

-\ Google Chrome v21.0.1180.60

Fichier : C:\Users\cyrille\AppData\Local\Google\Chrome\User Data\Default\Preferences

Supprimée :          "urls_to_restore_on_startup": [ "hxxp://www.google.com/", "hxxp://www.searchnu.com/410" ]
Supprimée :       "name": "Search Results",
Supprimée :       "search_url": "hxxp://dts.search-results.com/sr?src=crb&appid=0&systemid=410&sr=0&q={searchTer[...]
Supprimée :                "description": "SweetIm for Facebook",
Supprimée :                "name": "SweetIM for Facebook",
Supprimée :       "urls_to_restore_on_startup": [ "hxxp://www.google.com/", "hxxp://www.searchnu.com/410" ]

*************************

AdwCleaner[S1].txt - [290 octets] - [06/08/2012 11:37:17]
AdwCleaner[S2].txt - [10927 octets] - [06/08/2012 11:40:20]

########## EOF - C:\AdwCleaner[S2].txt - [11056 octets] ##########

Smart91 · Answer

Tu ne m'as pas dit si tu avais toujours searchnu ?

Refais un scan ZHPDiag et poste le rapport vicijoint

Smart

cysco · Answer

Rapport de ZHPDiag v1.31.13 par Nicolas Coolman, Update du 31/07/2012
Run by cyrille at 06/08/2012 13:37:25
Web site :  http://www.premiumorange.com/zeb-help-process/zhpdiag.html
Web site :  http://nicolascoolman.skyrock.com/
State : Version à jour.


---\ Web Browser
MSIE: Internet Explorer v8.0.7600.16385

---\ Windows Product Information
~ Langage: Français
Windows 7 Ultimate Edition, 64-bit  (Build 7600)
Windows Server License Manager Script : OK
~ Windows(R) 7, RETAIL channel
Windows ID Activation : OK
~ Windows Partial Key : 3DBYD
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle)  : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\ System Information
~ Processor: Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 8173 MB (74% free)
System Restore: Activé (Enable)
System drive C: has 316 GB (67%) free of 466 GB

---\ Logged in mode
~ Computer Name: CYRILLE-PC
~ User Name: cyrille
~ All Users Names: UpdatusUser, HomeGroupUser$, cyrille, Administrateur, 
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Users\cyrille\AppData\Roaming\
~ %Desktop% : C:\Users\cyrille\Desktop\
~ %Favorites% : C:\Users\cyrille\Favorites\
~ %LocalAppData% : C:\Users\cyrille\AppData\Local\
~ %StartMenu% : C:\Users\cyrille\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 316 Go of 466 Go)
D:\ CD-ROM drive (Not Inserted)
E:\ Hard drive, Flash drive, Thumb drive (Free 0 Go of 0 Go)
F:\ Hard drive, Flash drive, Thumb drive (Free 351 Go of 466 Go)
G:\ CD-ROM drive (Free 0 Go of 2 Go)
J:\ CD-ROM drive (Not Inserted)



---\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime :  Out Of Date
~ Scan Security Center in 00mn 00s



---\ Recherche particulière de fichiers génériques
[MD5.C235A51CB740E45FFA0EBFB9BAFCDA64] - (.Microsoft Corporation - Explorateur Windows.) (.14/07/2009 - 02:39:10.) -- C:\Windows\Explorer.exe [2868224]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.B1037F0131C9A010D611F6914E03CD92] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.14/07/2009 - 02:41:56.) -- C:\Windows\System32\wininet.dll [1193472]
[MD5.132328DF455B0028F13BF0ABEE51A63A] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Winlogon.exe [389120]
[MD5.75341574F21E766748732BDF530C74BD] - (.Microsoft Corporation - Bibliothèque de licences.) (.14/07/2009 - 02:41:54.) -- C:\Windows\System32\sppcomapi.dll [231936]
[MD5.B9384E03479D2506BC924C16A3DB87BC] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.14/07/2009 - 00:21:42.) -- C:\Windows\system32\Drivers\AFD.sys [500224]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.83D2D75E1EFB81B3450C18131443F7DB] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.14/07/2009 - 00:19:54.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.3F1DC527070ACB87E40AFE46EF6DA749] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.14/07/2009 - 00:23:44.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.0A49913402747A0B67DE940FB42CBDBB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.14/07/2009 - 01:06:13.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.CFDCD8CA87C2A657DEBC150AC35B5E08] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.14/07/2009 - 00:24:00.) -- C:\Windows\system32\Drivers\MRxSmb.sys [157184]
[MD5.9162B273A44AB9DCE5B44362731D062A] - (.Microsoft Corporation - MBT Transport driver.) (.14/07/2009 - 00:21:29.) -- C:\Windows\system32\Drivers
etBT.sys [259072]
[MD5.356698A13C4630D5B31C37378D469196] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.14/07/2009 - 02:48:27.) -- C:\Windows\system32\Drivers
tfs.sys [1659984]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.87A6E852A22991580D6D39ADC4790463] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.14/07/2009 - 01:10:12.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [130048]
[MD5.9706B84DBABFC4B4CA46C5A82B14DFA3] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.14/07/2009 - 01:18:02.) -- C:\Windows\system32\Driversdpdr.sys [165376]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.079125C4B17B01FCAEEBCE0BCB290C0F] - (.Microsoft Corporation - TDI Translation Driver.) (.14/07/2009 - 00:21:15.) -- C:\Windows\system32\Drivers	dx.sys [99840]
[MD5.C9D0EAF58D6BA71E128E715EA43AD87D] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.25/02/2011 - 07:36:10.) -- C:\Windows\system32\Drivers\volsnap.sys [295296]
~ Scan Generic Processes in 00mn 00s



---\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 2/12268
~ Mes musiques (My Musics) : 1/4162
~ Mes Favoris (My Favorites) : 1/26
~ Mes Documents (My Documents) : 1/6
~ Mon Bureau (My Desktop) : 1/62
~ Menu demarrer (Programs) : 0/29
~ Scan Hidden Files in 00mn 04s



---\ Processus lancés
[MD5.0C67D1B468FAE532FAA40B075440DA42] - (.Druide informatique inc. - Gestionnaire Antidote.) -- C:\Program Files (x86)\Druide\Antidote\Gestionnaire Antidote.exe   [439992] [PID.252]
[MD5.20C4535969F2006F6082CDF146CD95C4] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe   [4273976] [PID.3084]
[MD5.D9D79F547AE2A70C650DFCFC27AEC0F7] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe   [421736] [PID.3112]
[MD5.FCB13D9E3D55075C8FACA9CA3C55B263] - (...) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe   [3763200] [PID.3904]
[MD5.E8565816A2CE2F612497CE9DCA893F22] - (.Google Inc. - Google Chrome.) -- C:\Users\cyrille\AppData\Local\Google\Chrome\Application\chrome.exe   [1229848] [PID.3352]
[MD5.529CFF8518D682BD7D08FA6399516C47] - (.Apple Inc. - iTunes.) -- C:\Program Files (x86)\iTunes\iTunes.exe   [9777000] [PID.4804]
[MD5.9DA5F9909EF807E5A265FB66A70BE4AB] - (.Apple Inc. - MobileDeviceHelper.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe   [55144] [PID.4316]
[MD5.BB3A22F3EED85A12CFB2DD60D9F9B52F] - (.Apple Inc. - distnoted.) -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe   [13672] [PID.2508]
[MD5.35AC4B63CBB9FB6B4472913E9948B517] - (.Apple Inc. - Apple Push.) -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe   [59240] [PID.3160]
[MD5.8544A200C40447E465F06E58687428BB] - (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision
vSCPAPISvr.exe   [382272] [PID.]
[MD5.2F7C0F3E39C45E0127FB78B2F18A41F3] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe   [44808] [PID.]
[MD5.7EF47644B74EBE721CC32211D3C35E76] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe   [55144] [PID.]
[MD5.1992C2A1867D95AA3A0802539358D162] - (.Pas de propriétaire - Service.) -- C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe   [18656] [PID.]
[MD5.B90E093E7A7250906F1054418B5339C0] - (.Nero AG - Nero BackItUp.) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe   [935208] [PID.]
[MD5.CD0BFAA6872CFE38C908D313AE17C350] - (.NVIDIA Corporation - NVIDIA Settings Update Manager.) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe   [2348352] [PID.]
~ Scan Processes Running in 00mn 00s



---\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\cyrille\AppData\Local\Google\Chrome\User Data\Default\Preferences
G0 - GCSP: Preference [User Data\Default][HomePage] https://www.google.com/?gws_rd=ssl
G0 - GCSP: Preference [User Data\Default] https://www.google.com/?gws_rd=ssl
G1 - GCS: Preference [User Data\Default] None
~ Scan Google Browser in 00mn 00s



---\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions  (P2,M0,M1,M2,M3)
P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (...) -- C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_270.dll
P2 - FPN: [HKCU] [@tools.google.com/Google Update;version=3] - (.Google Inc. - Google Update.) -- C:\Users\cyrille\AppData\Local\Google\Update\1.3.21.115
pGoogleUpdate3.dll
P2 - FPN: [HKCU] [@tools.google.com/Google Update;version=9] - (.Google Inc. - Google Update.) -- C:\Users\cyrille\AppData\Local\Google\Update\1.3.21.115
pGoogleUpdate3.dll
~ Scan Firefox Browser in 00mn 00s



---\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?gws_rd=ssl
R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.microsoft.com/fr-fr/
R0 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?gws_rd=ssl
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = https://www.microsoft.com/fr-fr/
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs = res://ieframe.dll/tabswelcome.htm
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs,Tabs = res://ieframe.dll/tabswelcome.htm
R4 - HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,EnabledV8 = 0
R4 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\PhishingFilter,EnabledV8 = 0
~ Scan IE Browser in 00mn 00s



---\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local>
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Scan Proxy management in 00mn 00s



---\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2)
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Scan Keys in 00mn 00s



---\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Scan Hosts File in 00mn 00s
~ Nombre de lignes (Lines number): 101



---\ Browser Helper Objects de navigateur (O2)
O2 - BHO: ContributeBHO Class [64Bits] - {074C1DC5-9320-4A9A-947D-C042949C6216} . (.Adobe Systems, Inc. - Contribute IE Plugin.) -- C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll
O2 - BHO: AcroIEHelperStub [64Bits] - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} . (.Adobe Systems Incorporated - Adobe PDF Helper for Internet Explorer.) -- C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: avast! WebRep [64Bits] - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} . (.AVAST Software - avast! WebRep Plugin.) -- C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: (no name) [64Bits] - {AE7CD045-E861-484f-8273-0445EE161910} Clé orpheline
O2 - BHO: SmartSelect [64Bits] - {F4971EE7-DAA0-4053-9964-665D8EE6A077} Clé orpheline
~ Scan BHO in 00mn 00s



---\ Internet Explorer Toolbars (O3)
O3 - Toolbar: (no name) [64Bits] - [HKLM]{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} . (...) --  (.not file.)
~ Scan Toolbar in 00mn 00s



---\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe 
O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe 
O4 - HKCU\..\Run: [Gestionnaire Antidote.exe] . (.Druide informatique inc. - Gestionnaire Antidote.) -- C:\Program Files (x86)\Druide\Antidote\Gestionnaire Antidote.exe 
O4 - HKCU\..\Run: [AdobeBridge] Clé orpheline 
O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\cyrille\AppData\Local\Google\Update\GoogleUpdate.exe 
O4 - HKLM\..\Wow6432Node\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe 
O4 - HKLM\..\Wow6432Node\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe 
O4 - HKLM\..\Wow6432Node\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe 
O4 - HKUS\S-1-5-18\..\Run: [Gestionnaire Antidote.exe] . (.Druide informatique inc. - Gestionnaire Antidote.) -- C:\Program Files (x86)\Druide\Antidote\Gestionnaire Antidote.exe 
O4 - HKUS\S-1-5-18\..\Run: [Gestionnaire Antidote.exe] . (.Druide informatique inc. - Gestionnaire Antidote.) -- C:\Program Files (x86)\Druide\Antidote\Gestionnaire Antidote.exe 
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe 
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe 
O4 - HKUS\S-1-5-21-3780040346-2934936549-2989591182-1004-3780040346-2934936549-2989591182-1000\..\Run: [DAEMON Tools Lite] . (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe 
O4 - HKUS\S-1-5-21-3780040346-2934936549-2989591182-1004-3780040346-2934936549-2989591182-1000\..\Run: [Gestionnaire Antidote.exe] . (.Druide informatique inc. - Gestionnaire Antidote.) -- C:\Program Files (x86)\Druide\Antidote\Gestionnaire Antidote.exe 
O4 - HKUS\S-1-5-21-3780040346-2934936549-2989591182-1004-3780040346-2934936549-2989591182-1000\..\Run: [AdobeBridge] Clé orpheline 
O4 - HKUS\S-1-5-21-3780040346-2934936549-2989591182-1004-3780040346-2934936549-2989591182-1000\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\cyrille\AppData\Local\Google\Update\GoogleUpdate.exe 
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe 
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe 
~ Scan Application in 00mn 00s



---\ Autres liens utilisateurs (O4)
O4 - Global Startup: C:\Users\cyrille\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk . (.Microsoft Corporation.)  -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\cyrille\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk . (.Microsoft Corporation.)  -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\cyrille\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk . (.Microsoft Corporation.)  -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\cyrille\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart Essentials.lnk . (.Nero AG.)  -- C:\Program Files (x86)\Nero\Nero 9\Nero StartSmart\NeroStartSmart.exe
O4 - Global Startup: C:\Users\cyrille\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk . (.BitTorrent, Inc..)  -- C:\Program Files (x86)\uTorrent\uTorrent.exe
~ Scan Global Startup in 00mn 00s



---\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
O8 - Extra context menu item: Ajouter la cible du lien à un fichier PDF existant . (.Adobe Systems Incorporated - Adobe PDF Toolbar for Internet Explorer.) -- C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O8 - Extra context menu item: Ajouter à un fichier PDF existant . (.Adobe Systems Incorporated - Adobe PDF Toolbar for Internet Explorer.) -- C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O8 - Extra context menu item: Convertir au format Adobe PDF . (.Adobe Systems Incorporated - Adobe PDF Toolbar for Internet Explorer.) -- C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O8 - Extra context menu item: Convertir la cible du lien au format Adobe PDF . (.Adobe Systems Incorporated - Adobe PDF Toolbar for Internet Explorer.) -- C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
~ Scan IE Menu Contextuel in 00mn 00s



---\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Network Location Awareness 2.) -- C:\Windows\system32\NLAapi.dll
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\Windows\system32\mswsock.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\Windows\system32\winrnr.dll
O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - Fournisseur Shim d'affectation de noms de messagerie.) -- C:\Windows\system32
apinsp.dll
O10 - WLSP:\000000000005\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000006\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\Windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000007\Winsock LSP File . (.Apple Inc. - Bonjour Namespace Provider.) -- C:\Program Files (x86)\Bonjour\mdnsNSP.dll
~ Scan Winsock in 00mn 00s



---\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{61D90CFD-187D-44FA-A3E4-5DB6DC78B88F}: DhcpNameServer = 89.2.0.1 89.2.0.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{61D90CFD-187D-44FA-A3E4-5DB6DC78B88F}: DhcpNameServer = 89.2.0.1 89.2.0.2
O17 - HKLM\System\CS2\Services\Tcpip\..\{61D90CFD-187D-44FA-A3E4-5DB6DC78B88F}: DhcpNameServer = 89.2.0.1 89.2.0.2
~ Scan Domain in 00mn 00s



---\ Protocole additionnel (O18)
O18 - Handler: cdl [64Bits] - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} . (...) -- 
O18 - Handler: dvd [64Bits] - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} . (...) -- 
O18 - Handler: file [64Bits] - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} . (...) -- 
O18 - Handler: ftp [64Bits] - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} . (...) -- 
O18 - Handler: http [64Bits] - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} . (...) -- 
O18 - Handler: https [64Bits] - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} . (...) -- 
O18 - Handler: its [64Bits] - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} . (...) -- 
O18 - Handler: javascript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (...) -- 
O18 - Handler: local [64Bits] - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} . (...) -- 
O18 - Handler: mailto [64Bits] - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} . (...) -- 
O18 - Handler: mhtml [64Bits] - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} . (...) -- 
O18 - Handler: mk [64Bits] - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} . (...) -- 
O18 - Handler: ms-its [64Bits] - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} . (...) -- 
O18 - Handler: res [64Bits] - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} . (...) -- 
O18 - Handler: tv [64Bits] - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} . (...) -- 
O18 - Handler: vbscript [64Bits] - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} . (...) -- 
O18 - Filter: application/octet-stream [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (...) -- 
O18 - Filter: application/x-complus [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (...) -- 
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (...) -- 
O18 - Filter: deflate [64Bits] - {8f6b0360-b80d-11d0-a9b3-006097942311} . (...) -- 
O18 - Filter: gzip [64Bits] - {8f6b0360-b80d-11d0-a9b3-006097942311} . (...) -- 
~ Scan Protocole Additionnel in 00mn 00s



---\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
~ Scan SSODL in 00mn 00s



---\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Apple Mobile Device (Apple Mobile Device) . (.Apple Inc. - MobileDeviceService.) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Autodesk Content Service (Autodesk Content Service) . (.Pas de propriétaire - Service.) - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: avast! Antivirus (avast! Antivirus) . (.AVAST Software - avast! Service.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Service Bonjour (Bonjour Service) . (.Apple Inc. - Bonjour Service.) - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service Google Update (gupdate) (gupdate) . (.Google Inc. - Programme d'installation de Google.) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Nero BackItUp Scheduler 4.0 (Nero BackItUp Scheduler 4.0) . (.Nero AG - Nero BackItUp.) - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) . (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 295.7.) - C:\Windows\system32
vvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) . (.NVIDIA Corporation - NVIDIA Settings Update Manager.) - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) . (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision
vSCPAPISvr.exe
O23 - Service:  (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (.not file.)
~ Scan Services in 00mn 00s



---\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Default MHTML Editor: Last - .(...) -  (.not file.)
~ Scan Desktop Component in 00mn 00s



---\ BootExecute (O34)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
~ Scan Keys in 00mn 00s



---\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task  - C:\Windows\Tasks\Adobe Flash Player Updater.job
O39 - APT:Automatic Planified Task  - C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
O39 - APT:Automatic Planified Task  - C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
O39 - APT:Automatic Planified Task  - C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3780040346-2934936549-2989591182-1000Core.job
O39 - APT:Automatic Planified Task  - C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3780040346-2934936549-2989591182-1000UA.job
[MD5.F19C98AD81D2C0E1BBFD8153D2C80EE8] [APT] [Adobe Flash Player Updater] (.Adobe Systems Incorporated.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
[MD5.3429E299485DAA041082DB099D5367E8] [APT] [AdobeAAMUpdater-1.0-cyrille-PC-cyrille] (.Adobe Systems Incorporated.) -- C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe
[MD5.5A7E85100ACB28FBA8A81181A06C52D7] [APT] [avast! Emergency Update] (.AVAST Software.) -- C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
[MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
[MD5.F02A533F517EB38333CB12A9E8963773] [APT] [GoogleUpdateTaskMachineUA] (.Google Inc..) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
[MD5.506708142BC63DABA64F2D3AD1DCD5BF] [APT] [GoogleUpdateTaskUserS-1-5-21-3780040346-2934936549-2989591182-1000Core] (.Google Inc..) -- C:\Users\cyrille\AppData\Local\Google\Update\GoogleUpdate.exe
[MD5.506708142BC63DABA64F2D3AD1DCD5BF] [APT] [GoogleUpdateTaskUserS-1-5-21-3780040346-2934936549-2989591182-1000UA] (.Google Inc..) -- C:\Users\cyrille\AppData\Local\Google\Update\GoogleUpdate.exe
[MD5.00000000000000000000000000000000] [APT] [{0C712F1B-196F-41F9-A7BC-6A98D3E99211}] (...) -- C:\Users\cyrille\Downloads\RGSC\setup.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [{39286B9B-5E18-4E1A-AA85-02B127712CEF}] (...) -- H:\Gamme de r'paraion\GTA4RC.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [{7654B471-F3FD-4ABA-831A-D466B74D8B5A}] (...) -- C:\Program Files (x86)\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [{AFA7A683-A5CD-45BB-A9DF-E3991DB8D2FE}] (...) -- C:\Program Files (x86)\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe (.not file.)
~ Scan Scheduled Task in 00mn 00s



---\ Composants installés (ActiveSetup Installed Components) (O40)
O40 - ASIC: Microsoft Windows Media Player [64Bits] - >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} . (.Microsoft Corporation - Ressources du Lecteur Windows Media.) -- C:\Windows\System32\wmploc.dll
O40 - ASIC: Internet Explorer [64Bits] - >{26923b43-4d38-484f-9b9e-de460746276c} . (.Microsoft Corporation - Utilitaire d'initialisation d'Internet Explorer par utilisateur.) -- C:\Windows\System32\ie4uinit.exe
O40 - ASIC: Browser Customizations [64Bits] - >{60B49E34-C7CC-11D0-8953-00A0C90347FF} . (.Microsoft Corporation - Personnalisation d'IEAK.) -- C:\Windows\System32\iedkcs32.dll
O40 - ASIC: Themes Setup [64Bits] - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} . (.Microsoft Corporation - API Windows Theme.) -- C:\Windows\System32	hemeui.dll
O40 - ASIC: Microsoft Windows [64Bits] - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} . (.Microsoft Corporation - Windows Mail.) -- C:\Program Files (x86)\Windows Mail\WinMail.exe
O40 - ASIC: Browsing Enhancements [64Bits] - {630b1da0-b465-11d1-9948-00c04f98bbc9} . (.Microsoft Corporation - Extension Shell dossier FTP Microsoft Internet Explorer..) -- C:\Windows\System32\msieftp.dll
O40 - ASIC: Microsoft Windows Media Player [64Bits] - {6BF52A52-394A-11d3-B153-00C04F79FAA6} . (.Microsoft Corporation - Ressources du Lecteur Windows Media.) -- C:\Windows\System32\wmploc.dll
O40 - ASIC: Windows Desktop Update [64Bits] - {89820200-ECBD-11cf-8B85-00AA005B4340} . (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\Windows\System32\shell32.dll
O40 - ASIC: Web Platform Customizations [64Bits] - {89820200-ECBD-11cf-8B85-00AA005B4383} . (.Microsoft Corporation - Utilitaire d'initialisation d'Internet Explorer par utilisateur.) -- C:\Windows\System32\ie4uinit.exe
O40 - ASIC: (no name) [64Bits] - {89B4C1CD-B018-4511-B0A1-5476DBF70820} . (.Microsoft Corporation - Microsoft .NET IE SECURITY REGISTRATION.) -- C:\Windows\system32\mscories.dll
~ Scan Active Setup in 00mn 00s



---\ Pilotes lancés au démarrage (O41)
O41 - Driver: C:\Windows\System32\drivers\afd.sys (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\Windows\system32\drivers\afd.sys
O41 - Driver:  (aswRdr) . (.AVAST Software - avast! WFP Redirect Driver.) - C:\Windows\system32\Drivers\aswrdr2.sys
O41 - Driver: (blbdrive) . (.Microsoft Corporation - BLB Drive Driver.) - C:\Windows\System32\DRIVERS\blbdrive.sys
O41 - Driver:  (cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\Windows\System32\DRIVERS\cdrom.sys
O41 - Driver: C:\Windows\System32\cscsvc.dll (CSC) . (.Microsoft Corporation - Windows Client Side Caching Driver.) - C:\Windows\System32\drivers\csc.sys
O41 - Driver: C:\Windows\System32\drivers\dfsc.sys (DfsC) . (.Microsoft Corporation - DFS Namespace Client Driver.) - C:\Windows\System32\Drivers\dfsc.sys
O41 - Driver: C:\Windows\System32\drivers\discache.sys (discache) . (.Microsoft Corporation - System Indexer/Cache Driver.) - C:\Windows\System32\drivers\discache.sys
O41 - Driver:  (dtsoftbus01) . (.DT Soft Ltd - DAEMON Tools Virtual Bus Driver.) - C:\Windows\System32\DRIVERS\dtsoftbus01.sys
O41 - Driver:  (mssmbios) . (.Microsoft Corporation - System Management BIOS Driver.) - C:\Windows\System32\DRIVERS\mssmbios.sys
O41 - Driver:  (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\Windows\System32\DRIVERS
etbios.sys
O41 - Driver: C:\Windows\System32\drivers
etbt.sys (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\Windows\System32\DRIVERS
etbt.sys
O41 - Driver: C:\Windows\System32\drivers
siproxy.sys (nsiproxy) . (.Microsoft Corporation - NSI Proxy.) - C:\Windows\System32\drivers
siproxy.sys
O41 - Driver: C:\Windows\System32\drivers\pacer.sys (Psched) . (.Microsoft Corporation - Planificateur de paquets QoS.) - C:\Windows\System32\DRIVERS\pacer.sys
O41 - Driver: C:\Windows\System32\wkssvc.dll (rdbss) . (.Microsoft Corporation - Pilote du sous-système de mise en mémoire t.) - C:\Windows\System32\DRIVERSdbss.sys
O41 - Driver: C:\Windows\System32\DRIVERS\RDPCDD.sys (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\Windows\System32\DRIVERS\RDPCDD.sys
O41 - Driver: C:\Windows\System32\drivers\RDPENCDD.sys (RDPENCDD) . (.Microsoft Corporation - RDP Encoder Miniport.) - C:\Windows\System32\driversdpencdd.sys
O41 - Driver: C:\Windows\System32\drivers\RdpRefMp.sys (RDPREFMP) . (.Microsoft Corporation - RDP Reflector Driver Miniport.) - C:\Windows\System32\driversdprefmp.sys
O41 - Driver:  (Serial) . (.Microsoft Corporation - Pilote de périphérique série.) - C:\Windows\System32\DRIVERS\serial.sys
O41 - Driver: C:\Windows\System32	cpipcfg.dll (tdx) . (.Microsoft Corporation - TDI Translation Driver.) - C:\Windows\System32\DRIVERS	dx.sys
O41 - Driver:  (TermDD) . (.Microsoft Corporation - Remote Desktop Server Driver.) - C:\Windows\System32\DRIVERS	ermdd.sys
O41 - Driver: (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\Windows\system32\drivers\vga.sys
O41 - Driver: C:\Windows\System32ascfg.dll (Wanarpv6) . (.Microsoft Corporation - MS Remote Access and Routing ARP Driver.) - C:\Windows\System32\DRIVERS\wanarp.sys
O41 - Driver:  (WfpLwf) . (.Microsoft Corporation - WFP NDIS 6.20 Lightweight Filter Driver.) - C:\Windows\System32\DRIVERS\wfplwf.sys
~ Scan Drivers in 00mn 00s



---\ Logiciels installés (O42)
O42 - Logiciel: 1ClickDownloader - (.1ClickDownload.) [HKLM] -- 1ClickDownload
O42 - Logiciel: Adobe AIR - (.Adobe Systems Inc..) [HKLM] -- Adobe AIR
O42 - Logiciel: Adobe AIR - (.Adobe Systems Inc..) [HKLM] -- {A2BCA9F1-566C-4805-97D1-7FDC93386723}
O42 - Logiciel: Adobe Acrobat X Pro - English, Français, Deutsch - (.Adobe Systems.) [HKLM] -- {AC76BA86-1033-F400-7760-000000000005}
O42 - Logiciel: Adobe Community Help - (.Adobe Systems Incorporated.) [HKLM] -- chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
O42 - Logiciel: Adobe Community Help - (.Adobe Systems Incorporated.) [HKLM] -- {0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}
O42 - Logiciel: Adobe Creative Suite 5 Master Collection - (.Adobe Systems Incorporated.) [HKLM] -- {1BBD8D70-721A-41AD-AC8F-7308A0C8FA92}
O42 - Logiciel: Adobe Flash Player 11 ActiveX - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player ActiveX
O42 - Logiciel: Adobe Flash Player 11 Plugin - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player Plugin
O42 - Logiciel: Advertising Center - (.Nero AG.) [HKLM] -- {9F3523F8-DAD7-AE52-6DA7-45CDDDF33726}
O42 - Logiciel: Antidote RX v2 - (.Druide informatique inc..) [HKLM] -- {A474EA56-5DBD-4181-8230-806A4762EA7F}
O42 - Logiciel: Apple Application Support - (.Apple Inc..) [HKLM] -- {EB879750-CCBD-4013-BFD5-0294D4DA5BD0}
O42 - Logiciel: Apple Software Update - (.Apple Inc..) [HKLM] -- {789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}
O42 - Logiciel: Asmedia ASM104x USB 3.0 Host Controller Driver - (.Asmedia Technology.) [HKLM] -- {E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}
O42 - Logiciel: Autodesk Content Service - (.Autodesk.) [HKLM] -- {086F9A69-CD39-4893-A9FB-D3A0634CE3F7}
O42 - Logiciel: Autodesk Material Library 2012 - (.Autodesk.) [HKLM] -- {8F0837C2-EE09-4903-88F3-1976FE7FFF4E}
O42 - Logiciel: Autodesk Material Library Base Resolution Image Library 2012 - (.Autodesk.) [HKLM] -- {65420DC9-306E-4371-905F-F4DC3B418E52}
O42 - Logiciel: DAEMON Tools Lite - (.DT Soft Ltd.) [HKLM] -- DAEMON Tools Lite
O42 - Logiciel: Geekbench 2.3 - (.Primate Labs.) [HKLM] -- Geekbench 2.3
O42 - Logiciel: Google SketchUp Pro 8 - (.Google, Inc..) [HKLM] -- {F067EE71-369C-4D72-BDB7-DE7CF346660F}
O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM] -- {A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
O42 - Logiciel: Google Earth - (.Google.) [HKLM] -- {28E82311-8616-11E1-BEB0-B8AC6F97B88E}
O42 - Logiciel: Grand Theft Auto IV - (.Rockstar Games Inc..) [HKLM] -- {5454083B-1308-4485-BF17-1110000B8301}
O42 - Logiciel: Grand Theft Auto IV - (.Rockstar Games Inc..) [HKLM] -- {5454083B-1308-4485-BF17-1110000B8302}
O42 - Logiciel: Grand Theft Auto IV - (.Rockstar Games Inc..) [HKLM] -- {5454083B-1308-4485-BF17-1110000B8303}
O42 - Logiciel: Grand Theft Auto IV - (.Rockstar Games Inc..) [HKLM] -- {5454083B-1308-4485-BF17-1110000B8304}
O42 - Logiciel: Grand Theft Auto IV - (.Rockstar Games Inc..) [HKLM] -- {5454083B-1308-4485-BF17-1110000D8301}
O42 - Logiciel: Grand Theft Auto IV - (.Rockstar Games Inc..) [HKLM] -- {5454083B-1308-4485-BF17-1110000D8302}
O42 - Logiciel: Grand Theft Auto IV - (.Rockstar Games Inc..) [HKLM] -- {5454083B-1308-4485-BF17-1110000D8303}
O42 - Logiciel: Grand Theft Auto IV - (.Rockstar Games Inc..) [HKLM] -- {5454083B-1308-4485-BF17-1110000D8304}
O42 - Logiciel: Grand Theft Auto IV - (.Rockstar Games Inc..) [HKLM] -- {5454083B-1308-4485-BF17-1110000D8305}
O42 - Logiciel: Grand Theft Auto IV - (.Rockstar Games Inc..) [HKLM] -- {5454083B-1308-4485-BF17-1110000D8306}
O42 - Logiciel: Internet Explorer Toolbar 4.6 by SweetPacks - (.SweetIM Technologies Ltd..) [HKLM] -- {774C0434-9948-4DEE-A14E-69CDD316E36C}
O42 - Logiciel: Menu Templates - Starter Kit - (.Nero AG.) [HKLM] -- {B78120A0-CF84-4366-A393-4D0A59BC546C}
O42 - Logiciel: Microsoft Games for Windows - LIVE Redistributable - (.Microsoft Corporation.) [HKLM] -- {59E4543A-D49D-4489-B445-473D763C79AF}
O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable - (.Microsoft Corporation.) [HKLM] -- {7299052b-02a4-4627-81f2-1818da5d550d}
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 - (.Microsoft Corporation.) [HKLM] -- {5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 - (.Microsoft Corporation.) [HKLM] -- {9A25302D-30C0-39D9-BD6F-21E6EC160475}
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 - (.Microsoft Corporation.) [HKLM] -- {1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
O42 - Logiciel: Microsoft_VC80_ATL_x86 - (.Adobe.) [HKLM] -- {0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}
O42 - Logiciel: Microsoft_VC80_CRT_x86 - (.Adobe.) [HKLM] -- {92D58719-BBC1-4CC3-A08B-56C9E884CC2C}
O42 - Logiciel: Microsoft_VC80_MFCLOC_x86 - (.Adobe.) [HKLM] -- {D92BBB52-82FF-42ED-8A3C-4E062F944AB7}
O42 - Logiciel: Microsoft_VC80_MFC_x86 - (.Adobe.) [HKLM] -- {D1A19B02-817E-4296-A45B-07853FD74D57}
O42 - Logiciel: Microsoft_VC90_ATL_x86 - (.Adobe.) [HKLM] -- {033E378E-6AD3-4AD5-BDEB-CBD69B31046C}
O42 - Logiciel: Microsoft_VC90_CRT_x86 - (.Adobe.) [HKLM] -- {08D2E121-7F6A-43EB-97FD-629B44903403}
O42 - Logiciel: Microsoft_VC90_MFC_x86 - (.Adobe.) [HKLM] -- {635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}
O42 - Logiciel: Movie Templates - Starter Kit - (.Nero AG.) [HKLM] -- {E498385E-1C51-459A-B45F-1721E37AA1A0}
O42 - Logiciel: NVIDIA 3D Vision Controller Driver - (.NVIDIA Corporation.) [HKLM] -- NVIDIA StereoUSB Driver
O42 - Logiciel: NVIDIA PhysX - (.NVIDIA Corporation.) [HKLM] -- {4EAE665D-957A-4D04-9679-3AD582008877}
O42 - Logiciel: NVIDIA Stereoscopic 3D Driver - (.NVIDIA Corporation.) [HKLM] -- NVIDIAStereo
O42 - Logiciel: Nero 9 Essentials - (.Nero AG.) [HKLM] -- {abcc1b91-265c-49ed-acc7-455bc473de37}
O42 - Logiciel: Nero BurnRights - (.Nero AG.) [HKLM] -- {7829DB6F-A066-4E40-8912-CB07887C20BB}
O42 - Logiciel: Nero BurnRights Help - (.Nero AG.) [HKLM] -- {F6BDD7C5-89ED-4569-9318-469AA9732572}
O42 - Logiciel: Nero CoverDesigner - (.Nero AG.) [HKLM] -- {62AC81F6-BDD3-4110-9D36-3E9EAAB40999}
O42 - Logiciel: Nero CoverDesigner Help - (.Nero AG.) [HKLM] -- {CE96F5A5-584D-4F8F-AA3E-9BAED413DB72}
O42 - Logiciel: Nero DiscSpeed - (.Nero AG.) [HKLM] -- {869200DB-287A-4DC0-B02B-2B6787FBCD4C}
O42 - Logiciel: Nero DiscSpeed Help - (.Nero AG.) [HKLM] -- {CC019E3F-59D2-4486-8D4B-878105B62A71}
O42 - Logiciel: Nero DriveSpeed - (.Nero AG.) [HKLM] -- {33CF58F5-48D8-4575-83D6-96F574E4D83A}
O42 - Logiciel: Nero DriveSpeed Help - (.Nero AG.) [HKLM] -- {E5C7D048-F9B4-4219-B323-8BDB01A2563D}
O42 - Logiciel: Nero Express Help - (.Nero AG.) [HKLM] -- {83202942-84B3-4C50-8622-B8C0AA2D2885}
O42 - Logiciel: Nero InfoTool - (.Nero AG.) [HKLM] -- {FBCDFD61-7DCF-4E71-9226-873BA0053139}
O42 - Logiciel: Nero InfoTool Help - (.Nero AG.) [HKLM] -- {20400DBD-E6DB-45B8-9B6B-1DD7033818EC}
O42 - Logiciel: Nero Online Upgrade - (.Nero AG.) [HKLM] -- {C81A2FE0-3574-00A9-CED4-BDAA334CBE8E}
O42 - Logiciel: Nero ShowTime - (.Nero AG.) [HKLM] -- {D9DCF92E-72EB-412D-AC71-3B01276E5F8B}
O42 - Logiciel: Nero StartSmart - (.Nero AG.) [HKLM] -- {7748AC8C-18E3-43BB-959B-088FAEA16FB2}
O42 - Logiciel: Nero StartSmart Help - (.Nero AG.) [HKLM] -- {2348B586-C9AE-46CE-936C-A68E9426E214}
O42 - Logiciel: Nero Vision - (.Nero AG.) [HKLM] -- {43E39830-1826-415D-8BAE-86845787B54B}
O42 - Logiciel: Nero Vision Help - (.Nero AG.) [HKLM] -- {5D9BE3C1-8BA4-4E7E-82FD-9F74FA6815D1}
O42 - Logiciel: NeroExpress - (.Nero AG.) [HKLM] -- {595A3116-40BB-4E0F-A2E8-D7951DA56270}
O42 - Logiciel: OpenOffice.org 3.4 - (.OpenOffice.org.) [HKLM] -- {2F90A789-DD1E-41CE-BFCA-BD78213BABC7}
O42 - Logiciel: PDF Settings CS5 - (.Adobe Systems Incorporated.) [HKLM] -- {A78FE97A-C0C8-49CE-89D0-EDD524A17392}
O42 - Logiciel: PxMergeModule - (.Your Company Name.) [HKLM] -- {024521CF-C07E-4F8E-8481-0D75695E03AF}
O42 - Logiciel: QuickTime - (.Apple Inc..) [HKLM] -- {7BE15435-2D3E-4B58-867F-9C75BED0208C}
O42 - Logiciel: Realtek Ethernet Controller Driver - (.Realtek.) [HKLM] -- {8833FFB6-5B0C-4764-81AA-06DFEED9A476}
O42 - Logiciel: Realtek Ethernet Diagnostic Utility - (.Realtek.) [HKLM] -- {DADC7AB0-E554-4705-9F6A-83EA82ED708E}
O42 - Logiciel: Realtek High Definition Audio Driver - (.Realtek Semiconductor Corp..) [HKLM] -- {F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}
O42 - Logiciel: VLC media player 2.0.0 - (.VideoLAN.) [HKLM] -- VLC media player
O42 - Logiciel: WinRAR 4.11 (32-bit) - (.win.rar GmbH.) [HKLM] -- WinRAR archiver
O42 - Logiciel: avast! Free Antivirus v7.0.1456.0 - (.AVAST Software.) [HKLM] -- avast
O42 - Logiciel: neroxml - (.Nero AG.) [HKLM] -- {56C049BE-79E9-4502-BEA7-9754A3E60F9B}
O42 - Logiciel: µTorrent - (.Pas de propriétaire.) [HKLM] -- uTorrent

---\ HKCU & HKLM Software Keys
[HKCU\Software\AppDataLow\Software]
[HKLM\Software\8169Diag]
[HKLM\Software\AGEIA Technologies]
[HKLM\Software\AVAST Software]
[HKLM\Software\Adobe]
[HKLM\Software\AdwCleaner]
[HKLM\Software\Apple Computer, Inc.]
[HKLM\Software\Apple Inc.]
[HKLM\Software\Audible]
[HKLM\Software\Autodesk]
[HKLM\Software\C07ft5Y]
[HKLM\Software\Classes]
[HKLM\Software\Clients]
[HKLM\Software\DT Soft]
[HKLM\Software\Druide informatique inc.]
[HKLM\Software\EA Games]
[HKLM\Software\Google]
[HKLM\Software\InstallShield]
[HKLM\Software\Intel]
[HKLM\Software\Kaydara]
[HKLM\Software\Khronos]
[HKLM\Software\MAXSOFT-OCRON]
[HKLM\Software\Macromedia]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\Mozilla]
[HKLM\Software\NVIDIA Corporation]
[HKLM\Software\Nero]
[HKLM\Software\Novell]
[HKLM\Software\ODBC]
[HKLM\Software\OpenOffice.org]
[HKLM\Software\Policies]
[HKLM\Software\Realtek Semiconductor Corp.]
[HKLM\Software\Realtek]
[HKLM\Software\RegisteredApplications]
[HKLM\Software\Rockstar Games]
[HKLM\Software\VideoLAN]
[HKLM\Software\WinRAR]
[HKLM\Software\mozilla.org]
~ Scan Softwares in 00mn 00s



---\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 21/07/2012 - 22:48:34 - [2,880] ----D C:\Program Files (x86)\1ClickDownload
O43 - CFD: 08/03/2012 - 21:32:02 - [1838,330] ----D C:\Program Files (x86)\Adobe
O43 - CFD: 08/03/2012 - 19:14:48 - [2,316] ----D C:\Program Files (x86)\Apple Software Update
O43 - CFD: 08/03/2012 - 18:46:27 - [2,269] ----D C:\Program Files (x86)\ASM104xUSB3
O43 - CFD: 13/03/2012 - 14:17:49 - [95,468] ----D C:\Program Files (x86)\Autodesk
O43 - CFD: 12/03/2012 - 14:04:38 - [0,602] ----D C:\Program Files (x86)\Bonjour
O43 - CFD: 02/08/2012 - 13:11:24 - [1606,179] ----D C:\Program Files (x86)\Common Files
O43 - CFD: 08/03/2012 - 19:12:26 - [24,755] ----D C:\Program Files (x86)\DAEMON Tools Lite
O43 - CFD: 27/03/2012 - 16:49:27 - [125,356] ----D C:\Program Files (x86)\Druide
O43 - CFD: 06/08/2012 - 11:57:51 - [0,116] ----D C:\Program Files (x86)\Free mp3 Wma Converter
O43 - CFD: 12/04/2012 - 21:26:03 - [10,803] ----D C:\Program Files (x86)\Geekbench 2.3
O43 - CFD: 22/04/2012 - 00:07:38 - [286,838] ----D C:\Program Files (x86)\Google
O43 - CFD: 21/07/2012 - 16:07:14 - [16,406] --H-D C:\Program Files (x86)\InstallShield Installation Information
O43 - CFD: 08/03/2012 - 18:45:54 - [0,092] ----D C:\Program Files (x86)\Intel
O43 - CFD: 14/07/2009 - 17:24:08 - [4,263] ----D C:\Program Files (x86)\Internet Explorer
O43 - CFD: 11/05/2012 - 14:13:53 - [120,782] ----D C:\Program Files (x86)\iTunes
O43 - CFD: 09/03/2012 - 01:21:26 - [4,568] ----D C:\Program Files (x86)\Microsoft Games for Windows - LIVE
O43 - CFD: 13/03/2012 - 14:01:43 - [0,023] ----D C:\Program Files (x86)\Microsoft.NET
O43 - CFD: 14/07/2009 - 07:32:38 - [0,025] ----D C:\Program Files (x86)\MSBuild
O43 - CFD: 08/03/2012 - 20:56:02 - [0] ----D C:\Program Files (x86)\My Company Name
O43 - CFD: 02/08/2012 - 13:15:02 - [621,941] ----D C:\Program Files (x86)\Nero
O43 - CFD: 12/03/2012 - 20:20:55 - [114,389] ----D C:\Program Files (x86)\NVIDIA Corporation
O43 - CFD: 29/05/2012 - 15:48:11 - [285,318] ----D C:\Program Files (x86)\OpenOffice.org 3
O43 - CFD: 08/03/2012 - 19:15:25 - [71,358] ----D C:\Program Files (x86)\QuickTime
O43 - CFD: 08/03/2012 - 18:47:57 - [7,993] ----D C:\Program Files (x86)\Realtek
O43 - CFD: 14/07/2009 - 07:32:38 - [36,805] ----D C:\Program Files (x86)\Reference Assemblies
O43 - CFD: 08/03/2012 - 18:44:03 - [0] --H-D C:\Program Files (x86)\Temp
O43 - CFD: 14/07/2009 - 06:57:06 - [0] --H-D C:\Program Files (x86)\Uninstall Information
O43 - CFD: 12/03/2012 - 18:12:21 - [0,840] ----D C:\Program Files (x86)\uTorrent
O43 - CFD: 08/03/2012 - 19:13:28 - [87,980] ----D C:\Program Files (x86)\VideoLAN
O43 - CFD: 14/07/2009 - 17:24:08 - [0,500] ----D C:\Program Files (x86)\Windows Defender
O43 - CFD: 14/07/2009 - 17:24:08 - [5,895] ----D C:\Program Files (x86)\Windows Mail
O43 - CFD: 14/07/2009 - 17:24:08 - [4,791] ----D C:\Program Files (x86)\Windows Media Player
O43 - CFD: 14/07/2009 - 07:32:38 - [11,630] ----D C:\Program Files (x86)\Windows NT
O43 - CFD: 14/07/2009 - 17:24:08 - [4,213] ----D C:\Program Files (x86)\Windows Photo Viewer
O43 - CFD: 14/07/2009 - 07:32:40 - [0,181] ----D C:\Program Files (x86)\Windows Portable Devices
O43 - CFD: 14/07/2009 - 17:24:08 - [5,716] ----D C:\Program Files (x86)\Windows Sidebar
O43 - CFD: 08/03/2012 - 19:15:45 - [3,881] ----D C:\Program Files (x86)\WinRAR
O43 - CFD: 06/08/2012 - 13:37:32 - [12,792] ----D C:\Program Files (x86)\ZHPDiag
O43 - CFD: 08/03/2012 - 21:33:47 - [1090,796] ----D C:\Program Files (x86)\Common Files\Adobe
O43 - CFD: 08/03/2012 - 20:54:09 - [30,670] ----D C:\Program Files (x86)\Common Files\Adobe AIR
O43 - CFD: 11/05/2012 - 14:13:38 - [105,241] ----D C:\Program Files (x86)\Common Files\Apple
O43 - CFD: 10/04/2012 - 12:27:13 - [165,667] ----D C:\Program Files (x86)\Common Files\Autodesk Shared
O43 - CFD: 12/03/2012 - 20:16:22 - [0,540] --H-D C:\Program Files (x86)\Common Files\EAInstaller
O43 - CFD: 04/06/2012 - 15:20:10 - [4,779] ----D C:\Program Files (x86)\Common Files\InstallShield
O43 - CFD: 10/03/2012 - 19:57:40 - [16,720] ----D C:\Program Files (x86)\Common Files\microsoft shared
O43 - CFD: 02/08/2012 - 13:17:55 - [142,381] ----D C:\Program Files (x86)\Common Files\Nero
O43 - CFD: 08/03/2012 - 20:56:02 - [0,195] ----D C:\Program Files (x86)\Common Files\PX Storage Engine
O43 - CFD: 14/07/2009 - 05:20:08 - [0,003] ----D C:\Program Files (x86)\Common Files\Services
O43 - CFD: 08/03/2012 - 20:56:02 - [0,355] ----D C:\Program Files (x86)\Common Files\Sonic Shared
O43 - CFD: 14/07/2009 - 05:20:08 - [39,200] ----D C:\Program Files (x86)\Common Files\SpeechEngines
O43 - CFD: 14/07/2009 - 17:24:08 - [9,634] ----D C:\Program Files (x86)\Common Files\System
O43 - CFD: 14/03/2012 - 16:59:21 - [531,671] ----D C:\ProgramData\Adobe
O43 - CFD: 08/03/2012 - 21:04:27 - [0] ----D C:\ProgramData\ALM
O43 - CFD: 12/03/2012 - 14:04:49 - [34,816] ----D C:\ProgramData\Apple
O43 - CFD: 12/03/2012 - 14:05:11 - [72,499] ----D C:\ProgramData\Apple Computer
O43 - CFD: 14/07/2009 - 07:08:56 - [0] --H-D C:\ProgramData\Application Data
O43 - CFD: 10/04/2012 - 12:29:17 - [49,681] ----D C:\ProgramData\Autodesk
O43 - CFD: 08/03/2012 - 19:08:43 - [18,611] ----D C:\ProgramData\AVAST Software
O43 - CFD: 08/03/2012 - 18:20:43 - [0] --H-D C:\ProgramData\Bureau
O43 - CFD: 08/03/2012 - 19:11:38 - [0,001] ----D C:\ProgramData\DAEMON Tools Lite
O43 - CFD: 14/07/2009 - 07:08:56 - [0] --H-D C:\ProgramData\Desktop
O43 - CFD: 14/07/2009 - 07:08:56 - [0] --H-D C:\ProgramData\Documents
O43 - CFD: 08/03/2012 - 18:20:43 - [0] --H-D C:\ProgramData\Favoris
O43 - CFD: 14/07/2009 - 07:08:56 - [0] --H-D C:\ProgramData\Favorites
O43 - CFD: 09/04/2012 - 19:28:03 - [0,040] ----D C:\ProgramData\FLEXnet
O43 - CFD: 10/03/2012 - 16:47:54 - [6,940] ----D C:\ProgramData\Google
O43 - CFD: 08/03/2012 - 18:20:43 - [0] --H-D C:\ProgramData\Menu Démarrer
O43 - CFD: 19/07/2012 - 14:53:26 - [255,822] -S--D C:\ProgramData\Microsoft
O43 - CFD: 08/03/2012 - 18:20:43 - [0] --H-D C:\ProgramData\Modèles
O43 - CFD: 02/08/2012 - 13:12:38 - [10,608] ----D C:\ProgramData\Nero
O43 - CFD: 06/08/2012 - 12:35:48 - [2,796] ----D C:\ProgramData\NVIDIA
O43 - CFD: 08/03/2012 - 20:33:07 - [0,933] ----D C:\ProgramData\NVIDIA Corporation
O43 - CFD: 09/03/2012 - 00:46:00 - [0,003] ----D C:\ProgramDataegid.1986-12.com.adobe
O43 - CFD: 14/07/2009 - 07:08:56 - [0] --H-D C:\ProgramData\Start Menu
O43 - CFD: 14/07/2009 - 07:08:56 - [0] --H-D C:\ProgramData\Templates
O43 - CFD: 12/03/2012 - 14:05:19 - [0,852] ----D C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
O43 - CFD: 22/05/2012 - 13:15:14 - [97,295] ----D C:\Users\cyrille\AppData\Roaming\Adobe
O43 - CFD: 02/08/2012 - 14:21:28 - [0,376] ----D C:\Users\cyrille\AppData\Roaming\Apple Computer
O43 - CFD: 10/04/2012 - 12:25:24 - [10,029] ----D C:\Users\cyrille\AppData\Roaming\Autodesk
O43 - CFD: 04/06/2012 - 15:19:53 - [0,859] ----D C:\Users\cyrille\AppData\Roaming\DAEMON Tools Lite
O43 - CFD: 27/03/2012 - 16:17:16 - [0,003] ----D C:\Users\cyrille\AppData\Roaming\Druide
O43 - CFD: 15/07/2012 - 01:30:41 - [0,000] ----D C:\Users\cyrille\AppData\Roaming\dvdcss
O43 - CFD: 02/08/2012 - 13:35:16 - [0,000] ----D C:\Users\cyrille\AppData\Roaming\FreeAudioPack
O43 - CFD: 13/03/2012 - 16:13:49 - [0,024] ----D C:\Users\cyrille\AppData\Roaming\Google
O43 - CFD: 08/03/2012 - 18:20:56 - [0] ----D C:\Users\cyrille\AppData\Roaming\Identities
O43 - CFD: 08/03/2012 - 20:51:36 - [0,042] ----D C:\Users\cyrille\AppData\Roaming\Macromedia
O43 - CFD: 14/07/2009 - 17:35:02 - [0] ----D C:\Users\cyrille\AppData\Roaming\Media Center Programs
O43 - CFD: 19/07/2012 - 14:53:27 - [0,806] -S--D C:\Users\cyrille\AppData\Roaming\Microsoft
O43 - CFD: 21/07/2012 - 22:48:34 - [0,102] ----D C:\Users\cyrille\AppData\Roaming\Mozilla
O43 - CFD: 02/08/2012 - 13:20:07 - [1,896] ----D C:\Users\cyrille\AppData\Roaming\Nero
O43 - CFD: 13/03/2012 - 16:13:51 - [0,135] ----D C:\Users\cyrille\AppData\Roaming\NVIDIA
O43 - CFD: 29/05/2012 - 16:08:35 - [21,376] ----D C:\Users\cyrille\AppData\Roaming\OpenOffice.org
O43 - CFD: 09/03/2012 - 01:25:49 - [0,010] R-H-D C:\Users\cyrille\AppData\Roaming\SecuROM
O43 - CFD: 03/08/2012 - 02:43:55 - [5,415] ----D C:\Users\cyrille\AppData\Roaming\uTorrent
O43 - CFD: 06/08/2012 - 00:40:49 - [1,276] ----D C:\Users\cyrille\AppData\Roaming\vlc
O43 - CFD: 08/03/2012 - 20:30:22 - [0,000] ----D C:\Users\cyrille\AppData\Roaming\WinRAR
O43 - CFD: 06/04/2012 - 16:45:32 - [29,580] ----D C:\Users\cyrille\AppData\Local\Adobe
O43 - CFD: 08/03/2012 - 19:14:49 - [0] ----D C:\Users\cyrille\AppData\Local\Apple
O43 - CFD: 12/03/2012 - 14:05:28 - [22,697] ----D C:\Users\cyrille\AppData\Local\Apple Computer
O43 - CFD: 08/03/2012 - 18:20:48 - [0] ----D C:\Users\cyrille\AppData\Local\Application Data
O43 - CFD: 10/04/2012 - 12:25:24 - [2,917] ----D C:\Users\cyrille\AppData\Local\Autodesk
O43 - CFD: 03/08/2012 - 14:56:56 - [2,268] ----D C:\Users\cyrille\AppData\Local\cache
O43 - CFD: 30/07/2012 - 16:03:42 - [0,563] ----D C:\Users\cyrille\AppData\Local\Diagnostics
O43 - CFD: 19/07/2012 - 12:53:42 - [0,251] ----D C:\Users\cyrille\AppData\Local\ElevatedDiagnostics
O43 - CFD: 22/07/2012 - 14:35:29 - [684,437] ----D C:\Users\cyrille\AppData\Local\Google
O43 - CFD: 08/03/2012 - 18:20:48 - [0] ----D C:\Users\cyrille\AppData\Local\Historique
O43 - CFD: 30/07/2012 - 16:03:13 - [265,845] ----D C:\Users\cyrille\AppData\Local\Microsoft
O43 - CFD: 12/07/2012 - 20:41:31 - [0,150] ----D C:\Users\cyrille\AppData\Local\Microsoft Games
O43 - CFD: 28/05/2012 - 17:24:38 - [0,000] ----D C:\Users\cyrille\AppData\Local\Rockstar Games
O43 - CFD: 06/08/2012 - 13:37:12 - [-1324,293] ----D C:\Users\cyrille\AppData\Local\Temp
O43 - CFD: 08/03/2012 - 18:20:48 - [0] ----D C:\Users\cyrille\AppData\Local\Temporary Internet Files
O43 - CFD: 06/08/2012 - 12:36:24 - [0,092] ----D C:\Users\cyrille\AppData\Local\VirtualStore
O43 - CFD: 14/07/2009 - 06:54:32 - [0,014] R---D C:\Users\cyrille\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
O43 - CFD: 08/03/2012 - 18:21:22 - [0,000] R---D C:\Users\cyrille\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
O43 - CFD: 27/03/2012 - 16:49:32 - [0,003] ----D C:\Users\cyrille\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antidote
O43 - CFD: 04/06/2012 - 15:37:28 - [0,000] ----D C:\Users\cyrille\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
O43 - CFD: 12/04/2012 - 21:26:03 - [0,001] ----D C:\Users\cyrille\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Geekbench 2.3
O43 - CFD: 22/07/2012 - 14:35:55 - [0,005] ----D C:\Users\cyrille\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
O43 - CFD: 14/07/2009 - 06:49:38 - [0,001] R---D C:\Users\cyrille\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
O43 - CFD: 06/08/2012 - 11:28:14 - [0] R---D C:\Users\cyrille\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
O43 - CFD: 08/03/2012 - 19:15:45 - [0,003] ----D C:\Users\cyrille\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
O43 - CFD: 21/07/2012 - 22:48:34 - [2,880] ----D C:\Program Files (x86)\1ClickDownload
O43 - CFD: 08/03/2012 - 21:32:02 - [1838,330] ----D C:\Program Files (x86)\Adobe
O43 - CFD: 08/03/2012 - 19:14:48 - [2,316] ----D C:\Program Files (x86)\Apple Software Update
O43 - CFD: 08/03/2012 - 18:46:27 - [2,269] ----D C:\Program Files (x86)\ASM104xUSB3
O43 - CFD: 13/03/2012 - 14:17:49 - [95,468] ----D C:\Program Files (x86)\Autodesk
O43 - CFD: 12/03/2012 - 14:04:38 - [0,602] ----D C:\Program Files (x86)\Bonjour
O43 - CFD: 02/08/2012 - 13:11:24 - [1606,179] ----D C:\Program Files (x86)\Common Files
O43 - CFD: 08/03/2012 - 19:12:26 - [24,755] ----D C:\Program Files (x86)\DAEMON Tools Lite
O43 - CFD: 27/03/2012 - 16:49:27 - [125,356] ----D C:\Program Files (x86)\Druide
O43 - CFD: 06/08/2012 - 11:57:51 - [0,116] ----D C:\Program Files (x86)\Free mp3 Wma Converter
O43 - CFD: 12/04/2012 - 21:26:03 - [10,803] ----D C:\Program Files (x86)\Geekbench 2.3
O43 - CFD: 22/04/2012 - 00:07:38 - [286,838] ----D C:\Program Files (x86)\Google
O43 - CFD: 21/07/2012 - 16:07:14 - [16,406] --H-D C:\Program Files (x86)\InstallShield Installation Information
O43 - CFD: 08/03/2012 - 18:45:54 - [0,092] ----D C:\Program Files (x86)\Intel
O43 - CFD: 14/07/2009 - 17:24:08 - [4,263] ----D C:\Program Files (x86)\Internet Explorer
O43 - CFD: 11/05/2012 - 14:13:53 - [120,782] ----D C:\Program Files (x86)\iTunes
O43 - CFD: 09/03/2012 - 01:21:26 - [4,568] ----D C:\Program Files (x86)\Microsoft Games for Windows - LIVE
O43 - CFD: 13/03/2012 - 14:01:43 - [0,023] ----D C:\Program Files (x86)\Microsoft.NET
O43 - CFD: 14/07/2009 - 07:32:38 - [0,025] ----D C:\Program Files (x86)\MSBuild
O43 - CFD: 08/03/2012 - 20:56:02 - [0] ----D C:\Program Files (x86)\My Company Name
O43 - CFD: 02/08/2012 - 13:15:02 - [621,941] ----D C:\Program Files (x86)\Nero
O43 - CFD: 12/03/2012 - 20:20:55 - [114,389] ----D C:\Program Files (x86)\NVIDIA Corporation
O43 - CFD: 29/05/2012 - 15:48:11 - [285,318] ----D C:\Program Files (x86)\OpenOffice.org 3
O43 - CFD: 08/03/2012 - 19:15:25 - [71,358] ----D C:\Program Files (x86)\QuickTime
O43 - CFD: 08/03/2012 - 18:47:57 - [7,993] ----D C:\Program Files (x86)\Realtek
O43 - CFD: 14/07/2009 - 07:32:38 - [36,805] ----D C:\Program Files (x86)\Reference Assemblies
O43 - CFD: 08/03/2012 - 18:44:03 - [0] --H-D C:\Program Files (x86)\Temp
O43 - CFD: 14/07/2009 - 06:57:06 - [0] --H-D C:\Program Files (x86)\Uninstall Information
O43 - CFD: 12/03/2012 - 18:12:21 - [0,840] ----D C:\Program Files (x86)\uTorrent
O43 - CFD: 08/03/2012 - 19:13:28 - [87,980] ----D C:\Program Files (x86)\VideoLAN
O43 - CFD: 14/07/2009 - 17:24:08 - [0,500] ----D C:\Program Files (x86)\Windows Defender
O43 - CFD: 14/07/2009 - 17:24:08 - [5,895] ----D C:\Program Files (x86)\Windows Mail
O43 - CFD: 14/07/2009 - 17:24:08 - [4,791] ----D C:\Program Files (x86)\Windows Media Player
O43 - CFD: 14/07/2009 - 07:32:38 - [11,630] ----D C:\Program Files (x86)\Windows NT
O43 - CFD: 14/07/2009 - 17:24:08 - [4,213] ----D C:\Program Files (x86)\Windows Photo Viewer
O43 - CFD: 14/07/2009 - 07:32:40 - [0,181] ----D C:\Program Files (x86)\Windows Portable Devices
O43 - CFD: 14/07/2009 - 17:24:08 - [5,716] ----D C:\Program Files (x86)\Windows Sidebar
O43 - CFD: 08/03/2012 - 19:15:45 - [3,881] ----D C:\Program Files (x86)\WinRAR
O43 - CFD: 06/08/2012 - 13:37:32 - [12,792] ----D C:\Program Files (x86)\ZHPDiag
O43 - CFD: 08/03/2012 - 21:33:47 - [1090,796] ----D C:\Program Files (x86)\Common Files\Adobe
O43 - CFD: 08/03/2012 - 20:54:09 - [30,670] ----D C:\Program Files (x86)\Common Files\Adobe AIR
O43 - CFD: 11/05/2012 - 14:13:38 - [105,241] ----D C:\Program Files (x86)\Common Files\Apple
O43 - CFD: 10/04/2012 - 12:27:13 - [165,667] ----D C:\Program Files (x86)\Common Files\Autodesk Shared
O43 - CFD: 12/03/2012 - 20:16:22 - [0,540] --H-D C:\Program Files (x86)\Common Files\EAInstaller
O43 - CFD: 04/06/2012 - 15:20:10 - [4,779] ----D C:\Program Files (x86)\Common Files\InstallShield
O43 - CFD: 10/03/2012 - 19:57:40 - [16,720] ----D C:\Program Files (x86)\Common Files\microsoft shared
O43 - CFD: 02/08/2012 - 13:17:55 - [142,381] ----D C:\Program Files (x86)\Common Files\Nero
O43 - CFD: 08/03/2012 - 20:56:02 - [0,195] ----D C:\Program Files (x86)\Common Files\PX Storage Engine
O43 - CFD: 14/07/2009 - 05:20:08 - [0,003] ----D C:\Program Files (x86)\Common Files\Services
O43 - CFD: 08/03/2012 - 20:56:02 - [0,355] ----D C:\Program Files (x86)\Common Files\Sonic Shared
O43 - CFD: 14/07/2009 - 05:20:08 - [39,200] ----D C:\Program Files (x86)\Common Files\SpeechEngines
O43 - CFD: 14/07/2009 - 17:24:08 - [9,634] ----D C:\Program Files (x86)\Common Files\System
~ Scan Program Folder in 00mn 05s



---\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.1CB876E5311DC537A51A8A0092071230] - 06/08/2012 - 11:39:17 ---A- . (...) -- C:\Windows\WindowsUpdate.log   [2031102]
O44 - LFC:[MD5.6A84C98BF2907D420A479009039C3ECF] - 06/08/2012 - 11:35:48 ---A- . (...) -- C:\Windows\setupact.log   [10970]
O44 - LFC:[MD5.9677312E048A9D2A1385BA748848D48D] - 06/08/2012 - 11:35:47 -S-A- . (...) -- C:\Windows\bootstat.dat   [67584]
O44 - LFC:[MD5.A77291DDB54132547D06B870E42C4C6F] - 06/08/2012 - 11:34:47 ---A- . (...) -- C:\AdwCleaner[S3].txt   [1377]
O44 - LFC:[MD5.75E349C164E9680802C8AFC526A85EE3] - 06/08/2012 - 10:40:25 ---A- . (...) -- C:\AdwCleaner[S2].txt   [11036]
O44 - LFC:[MD5.C89A71F3BD2BC464774BD5E606614A76] - 06/08/2012 - 10:37:17 ---A- . (...) -- C:\AdwCleaner[S1].txt   [290]
O44 - LFC:[MD5.A1DA5ABD678872E60FAC46F1C5088624] - 03/08/2012 - 21:38:28 ---A- . (...) -- C:\Windows\PFRO.log   [700]
O44 - LFC:[MD5.DABC6EFD803EC2F23B5F0795228BCA74] - 02/08/2012 - 12:34:16  . (...) -- C:\Windows\System32\perfc009.dat   []
O44 - LFC:[MD5.FE9DA8E667A0D402732DC095587181A9] - 02/08/2012 - 12:34:16  . (...) -- C:\Windows\System32\perfc00C.dat   []]
O44 - LFC:[MD5.35B7F63CFDA4D1227BD9351AEF553761] - 02/08/2012 - 12:34:16  . (...) -- C:\Windows\System32\perfh009.dat   []]]
O44 - LFC:[MD5.6C0813B3326FC97A19CE007F561C5C01] - 02/08/2012 - 12:34:16  . (...) -- C:\Windows\System32\perfh00C.dat   []]]]
O44 - LFC:[MD5.6C1085B5BF8F2D93A1B8C9E520B7DC3C] - 02/08/2012 - 12:34:16 ---A- . (...) -- C:\Windows\SysNative\PerfStringBackup.INI   [1662102]
O44 - LFC:[MD5.DABC6EFD803EC2F23B5F0795228BCA74] - 02/08/2012 - 12:34:16 ---A- . (...) -- C:\Windows\SysNative\perfc009.dat   [120974]
O44 - LFC:[MD5.FE9DA8E667A0D402732DC095587181A9] - 02/08/2012 - 12:34:16 ---A- . (...) -- C:\Windows\SysNative\perfc00C.dat   [148678]
O44 - LFC:[MD5.35B7F63CFDA4D1227BD9351AEF553761] - 02/08/2012 - 12:34:16 ---A- . (...) -- C:\Windows\SysNative\perfh009.dat   [652042]
O44 - LFC:[MD5.6C0813B3326FC97A19CE007F561C5C01] - 02/08/2012 - 12:34:16 ---A- . (...) -- C:\Windows\SysNative\perfh00C.dat   [745160]
O44 - LFC:[MD5.6C1085B5BF8F2D93A1B8C9E520B7DC3C] - 02/08/2012 - 12:34:16 ---A- . (...) -- C:\Windows\System32\PerfStringBackup.INI   [1662102]
O44 - LFC:[MD5.633B833711EA1D3ABFE3E

Smart91 · Answer

il faut que héberges le rapport sur cijoint, car il est trop grand pour être collé dans ta réponse

Smart

cysco · Answer

https://www.cjoint.com/?BHgnXyheQOf

Smart91 · Answer

Il reste encore des traces: 

- Ferme toutes tes applications en cours 
- Lance ZHPFix via le raccourci sur ton Bureau, (Si tu es sous Vista ou Windows 7 n'oublie pas clic droit ==> en tant qu'administrateur")  
- Si tu ne l'as pas, télécharge le depuis ce lien: https://www.zebulon.fr/telechargements/securite/systeme/zhpfix.html 
- Copie/colle les lignes en gras suivantes : 
  
----------------------------------------------------------  
[MD5.E1424DDE5D2A72EA010765E6295F8384] [SPRF][29/05/2012] (.Aedge Performance BCN SL - OfferBox setup.) -- C:\Users\cyrille\AppData\Local\Temp\OB.exe   [2445832] 
[MD5.D4FE9619462D7613A6750256C94F4589] [SPRF][29/05/2012] (.Babylon Ltd. - Babylon Client Setup.) -- C:\Users\cyrille\AppData\Local\Temp	bbabylonv2.exe   [862832] 
[MD5.8A4AF3B0695F29186AD02E2FD766FA3B] [SPRF][22/07/2012] (.SweetIM Technologies Ltd. - SQLite DLL.) -- C:\Users\cyrille\AppData\Local\Temp\mgsqlite3.dll   [393016] 
[MD5.87586E59941486AC9E2562C1B6F6DC73] [SPRF][06/08/2012] (...) -- C:\Users\cyrille\AppData\Local\Temp\Uninst.bat   [635] 
O4 - HKCU\..\Run: [AdobeBridge] Clé orpheline 
O4 - HKUS\S-1-5-21-3780040346-2934936549-2989591182-1004-3780040346-2934936549-2989591182-1000\..\Run: [AdobeBridge] Clé orpheline 
[MD5.00000000000000000000000000000000] [APT] [{0C712F1B-196F-41F9-A7BC-6A98D3E99211}] (...) -- C:\Users\cyrille\Downloads\RGSC\setup.exe (.not file.) 
[MD5.00000000000000000000000000000000] [APT] [{39286B9B-5E18-4E1A-AA85-02B127712CEF}] (...) -- H:\Gamme de r'paraion\GTA4RC.exe (.not file.) 
[MD5.1A3D1A7349253561EF89D017F6EDD5FC] [SPRF][22/07/2012] (.SweetIM Technologies Lt - This installer.) -- C:\Users\cyrille\AppData\Local\Temp\SIMEEIInstaller.exe   [2626512] 
[MD5.992E52F7F30376894FF23B089521605C] [SPRF][21/07/2012] (.SweetIM Technologies Ltd. - SweetIM Installer by SweetPacks.) -- C:\Users\cyrille\AppData\Local\Temp\Shortcut_SimDSetup.exe   [6204760] 
[MD5.2EE69D8A113835EE145E750FA3C1588E] [SPRF][22/07/2012] (.SweetIM Technologies Ltd. - SweetIM Installer by SweetPacks.) -- C:\Users\cyrille\AppData\Local\Temp\Shortcut_SweetImSetup (1).exe   [296792] 
[MD5.2EE69D8A113835EE145E750FA3C1588E] [SPRF][22/07/2012] (.SweetIM Technologies Ltd. - SweetIM Installer by SweetPacks.) -- C:\Users\cyrille\AppData\Local\Temp\Shortcut_SweetImSetup.exe   [296792] 
[MD5.3DA4A5D8504B08ACEA7CBC3A5A916377] [SPRF][22/07/2012] (.SweetIM Technologies Lt - This installer.) -- C:\Users\cyrille\AppData\Local\Temp\SweetIESetup.exe   [3686376] 
[MD5.194860223F42FE04E47EAAB3FE7CE119] [SPRF][22/07/2012] (.SweetIM Technologies Lt - This installer.) -- C:\Users\cyrille\AppData\Local\Temp\SweetIMSetup.exe   [4087768] 
EmptyTemp 
EmptyFlash 
FirewallRAZ 
 
----------------------------------------------------------  
- Clique sur l'icone représentant la lettre H (« coller les lignes Helper »)  
- Les lignes se collent automatiquement dans ZHPFix, sinon colle les lignes  
- Clique sur le bouton « GO » pour le lancer le nettoyage 
- Copie/colle la totalité du rapport dans ta prochaine réponse  

Redémarre le PC

Smart 
"Si tu n'as pas d'ambitions, tu t'installes au bord de la chute" (Kundera)

cysco · Answer

Rapport de ZHPFix 1.2.04 par Nicolas Coolman, Update du 23/04/2011
Fichier d'export Registre : C:\ZHP\ZHPExportRegistry-06-08-2012-14-10-38.txt
Run by cyrille at 06/08/2012 14:10:38
Windows 7 Ultimate Edition, 64-bit  (Build 7600)
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html
Web site : http://nicolascoolman.skyrock.com/

========== Processus mémoire ==========
SUPPRIME Memory Process: C:\Users\cyrille\AppData\Local\Temp\OB.exe
SUPPRIME Memory Process: C:\Users\cyrille\AppData\Local\Temp	bbabylonv2.exe
SUPPRIME Memory Process: C:\Users\cyrille\AppData\Local\Temp\SIMEEIInstaller.exe
SUPPRIME Memory Process: C:\Users\cyrille\AppData\Local\Temp\Shortcut_SimDSetup.exe
SUPPRIME Memory Process: C:\Users\cyrille\AppData\Local\Temp\Shortcut_SweetImSetup (1).exe
SUPPRIME Memory Process: C:\Users\cyrille\AppData\Local\Temp\Shortcut_SweetImSetup.exe
SUPPRIME Memory Process: C:\Users\cyrille\AppData\Local\Temp\SweetIESetup.exe
SUPPRIME Memory Process: C:\Users\cyrille\AppData\Local\Temp\SweetIMSetup.exe

========== Module(s) mémoire ==========
SUPPRIME Memory Module: C:\Users\cyrille\AppData\Local\Temp\mgsqlite3.dll

========== Valeur(s) du Registre ==========
SUPPRIME RunValue: AdobeBridge
ABSENT RunValue: AdobeBridge
ABSENT Valeur Standard Profile: FirewallRaz : 
ABSENT Valeur Domain Profile: FirewallRaz : 
SUPPRIME FirewallRaz (Public) : {1373593D-7EE3-4B2F-B2D8-9A001B255DCE}
SUPPRIME FirewallRaz (Public) : {55ABC9E6-D332-46EB-9D52-172818B84E2A}
SUPPRIME FirewallRaz (Public) : {B2A7A080-DBB7-4BB9-95B3-9F1CD6570E7F}
SUPPRIME FirewallRaz (Public) : {97F49B00-D8B8-4B08-81E1-8E647A8FEC2C}
SUPPRIME FirewallRaz (Private) : {5747A388-536D-45AC-955F-FC6AB49D334D}
SUPPRIME FirewallRaz (Private) : {104872C7-F4DA-4FBD-AC7A-35C6A9CD56FD}
SUPPRIME FirewallRaz (Private) : {FF8E03B4-5F70-48FE-962D-2F1F75E1C033}
SUPPRIME FirewallRaz (Private) : {405F57A9-4413-40BC-84DB-73B3D21AB5FC}

========== Dossier(s) ==========
SUPPRIME Temporaires Windows
SUPPRIME Flash Cookies

========== Fichier(s) ==========
SUPPRIME File*: c:\users\cyrille\appdata\local	emp\ob.exe
SUPPRIME File*: c:\users\cyrille\appdata\local	emp	bbabylonv2.exe
SUPPRIME File*: c:\users\cyrille\appdata\local	emp\mgsqlite3.dll
SUPPRIME File: C:\Users\cyrille\AppData\Local\Temp\Uninst.bat
SUPPRIME File*: c:\users\cyrille\appdata\local	emp\uninst.bat
SUPPRIME File*: c:\users\cyrille\appdata\local	emp\simeeiinstaller.exe
SUPPRIME File*: c:\users\cyrille\appdata\local	emp\shortcut_simdsetup.exe
SUPPRIME File***: c:\users\cyrille\appdata\local	emp\shortcut_sweetimsetup (1).exe
SUPPRIME File*: c:\users\cyrille\appdata\local	emp\shortcut_sweetimsetup.exe
SUPPRIME File*: c:\users\cyrille\appdata\local	emp\sweetiesetup.exe
SUPPRIME File*: c:\users\cyrille\appdata\local	emp\sweetimsetup.exe
SUPPRIME Temporaires Windows
SUPPRIME Flash Cookies

========== Tache planifiée ==========
SUPPRIME Task: {0C712F1B-196F-41F9-A7BC-6A98D3E99211}
SUPPRIME Task: {39286B9B-5E18-4E1A-AA85-02B127712CEF}


========== Récapitulatif ==========
8 : Processus mémoire
1 : Module(s) mémoire
12 : Valeur(s) du Registre
2 : Dossier(s)
13 : Fichier(s)
2 : Tache planifiée


End of clean in 00mn 04s

========== Chemin de fichier rapport ==========
C:\ZHP\ZHPFix[R1].txt - 06/08/2012 14:10:38 [3257]

cysco · Answer

Je viens de redémarer et searchnu est revenu!

Smart91 · Answer

Maintenant tu vas passer Malwarebytes outils que tu gardera et que tu utiliseras une fois à deux fois par moi:

 Télécharge et installe Malwarebytes
* A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware » soit cochée
* Lance MBAM et laisse les Mises à jour se télécharger (sinon fais les manuellement au lancement du programme). C'est très important
* Puis va dans l'onglet "Recherche", coche "Exécuter un examen complet puis "Rechercher"
* Ne t'inquiète pas, l'analyse peut durer plusieurs heures en fonction du nombre de fichiers et infections à analyser 
* A la fin de l'analyse, clique sur "Afficher les résultats"
* Coche tous les éléments détectés puis clique sur "Supprimer la sélection"
* Enregistre le rapport
* S'il t'est demandé de redémarrer l'ordinateur, clique sur Yes
* Un rapport apparait après la suppression : poste le dans ta prochaine réponse.

Smart

Désinstaller Searchnu

14 réponses

Discussions similaires