virus qui transforme les dossier en Raccourci Résolu/Fermé

Question

Bonjour, 
j'ai un virus que j'ai attraper d'une carte mémoire que j'ai introduit dans mon laptop 
depuis ce jour là mon ordinateur est devenue très long et quand j'introduis un disque amovible ou flash disque , il transforme les dossier en raccourci 
j'ai beaux cherché la racine de ce virus dans mon laptop je trouve pas!!
veuillez m'aidez SVP 


Configuration: Windows Vista / Firefox 19.0

lokardz · Accepted Answer

voila le fichier mokrjf.pif 
sosvirus.org/Malware/ea83330ff4acb54765dc72bf3da16958.pif

Le fichier mokrjf.pif a été uploadé.
Sa valeur md5 est : ea83330ff4acb54765dc72bf3da16958
Son poid est : 33224 bytes
Son type est : application/octet-stream
Son nom sur le serveur est : ea83330ff4acb54765dc72bf3da16958.pif

La valeur MD5 du fichier mokrjf.pif n est pas connue sur VirusTotal.
Le fichier a été envoyé pour analyse.
Sha256 : 2b9f5b93d04dcbd2de6c61516996507af49bfbc9661220530580bd1f1e8725e0




et voila le fichier autorun.ini le contenue du fichier 

[AutoRun]
;
;vGqkRDfMlGqucxS 
ShEll\explore\COmmAnd=mokrjf.pif

;eckNOqrer pDoRn PWvUi
SheLL\open\dEFauLt=1
;ejpQkhjdtxBsppFi 
oPen =mokrjf.pif
;Bvav OTitk kklwdewjWuvin 
SHelL\oPeN\coMmand= mokrjf.pif

;dfod nfJFfrbOi huLEl
shell\AuToplAy\Command =mokrjf.pif

lokardz · Answer

j'ai fais un scan avec USBfix mais je comprend pas ,

############################## | UsbFix V 7.120 | [Recherche]

Utilisateur: DR (Administrateur) # PC-DE-DR
Mis à jour le 30/03/2013 par El Desaparecido
Lancé à 11:32:48 | 06/04/2013

Site Web: https://www.sosvirus.net/
Upload Malware: http://upload.sosvirus.org/
Contact: contact@sosvirus.org

PC: Hewlett-Packard (Compaq Presario C700 Notebook PC) (X86-based PC)
CPU: Intel(R) Pentium(R) Dual  CPU  T2410  @ 2.00GHz (2000)
RAM -> [Total : 2037 | Free : 679]
BIOS: Default System BIOS
BOOT: Normal boot

OS: Microsoft® Windows Vista(TM) Édition Familiale Basique  (6.0.6001 32-Bit) # Service Pack 1
WB: Windows Internet Explorer 7.0.6001.18000

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AS: Windows Defender [Enabled | (!) Outdated]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 222 Go (28 Go libre(s) - 12%) [] # NTFS
D:\ -> Disque fixe # 11 Go (402 Mo libre(s) - 4%) [PRESARIO_RP] # NTFS
E:\ -> CD-ROM
F:\ -> Disque amovible # 2 Go (919 Mo libre(s) - 48%) [KHALED] # FAT

################## | Processus Actif |

C:\Windows\system32\csrss.exe (524)
C:\Windows\system32\wininit.exe (568)
C:\Windows\system32\services.exe (612)
C:\Windows\system32\lsass.exe (624)
C:\Windows\system32\lsm.exe (632)
C:\Windows\system32\svchost.exe (832)
C:\Windows\system32\svchost.exe (892)
C:\Windows\System32\svchost.exe (932)
C:\Windows\System32\svchost.exe (1028)
C:\Windows\System32\svchost.exe (1096)
C:\Windows\system32\svchost.exe (1108)
C:\Windows\system32\SLsvc.exe (1216)
C:\Windows\system32\svchost.exe (1276)
C:\Windows\system32\svchost.exe (1436)
C:\Windows\System32\spoolsv.exe (1616)
C:\Windows\system32\svchost.exe (1640)
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (1816)
C:\Program Files\Bonjour\mDNSResponder.exe (1920)
C:\PVSW\Bin\WGE_SRV.exe (1952)
C:\PVSW\BIN\W3dbsmgr.EXE (204)
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe (264)
c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (396)
C:\Windows\system32\svchost.exe (876)
C:\Program Files\CyberLink\Shared Files\RichVideo.exe (1172)
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe (1304)
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe (1524)
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (512)
C:\Windows\system32\svchost.exe (728)
C:\Windows\System32\svchost.exe (2092)
C:\Windows\system32\SearchIndexer.exe (2164)
C:\Windows\system32\DRIVERS\xaudio.exe (2232)
C:\Windows\system32\WUDFHost.exe (2272)
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe (2440)
C:\Windows\system32	askeng.exe (2572)
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe (1388)
C:\Windows\system32\wbem\wmiprvse.exe (2996)
C:\Windows\system32\csrss.exe (1796)
C:\Windows\system32\winlogon.exe (3272)
C:\Windows\system32\Dwm.exe (3176)
C:\Windows\system32	askeng.exe (564)
C:\Windows\Explorer.EXE (3384)
C:\WINDOWS\System32\igfxtray.exe (2752)
C:\WINDOWS\System32\hkcmd.exe (3680)
C:\WINDOWS\System32\igfxpers.exe (3064)
C:\Program Files\Apoint2K\Apoint.exe (1004)
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (3688)
C:\Program Files\Hp\QuickPlay\QPService.exe (3664)
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe (3672)
C:\Program Files\Windows Defender\MSASCui.exe (3520)
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe (3580)
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (3872)
C:\Program Files\Common Files\Java\Java Update\jusched.exe (3900)
C:\Program Files\iTunes\iTunesHelper.exe (988)
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe (2136)
C:\Program Files\uTorrent\uTorrent.exe (3796)
C:\Program Files\Windows Live\Messenger\msnmsgr.exe (3820)
C:\Program Files\Windows Media Player\wmpnscfg.exe (3892)
C:\Program Files\Windows Sidebar\sidebar.exe (2316)
C:\Program Files\Skype\Phone\Skype.exe (3960)
C:\Program Files\Google\Drive\googledrivesync.exe (3712)
C:\Users\DR\AppData\Roaming\Dropbox\bin\Dropbox.exe (156)
C:\Windows\system32\wbem\unsecapp.exe (488)
C:\Windows\system32\wuauclt.exe (2820)
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE (4292)
C:\Windows\system32\igfxsrvc.exe (4308)
C:\Program Files\Apoint2K\ApMsgFwd.exe (4508)
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe (4764)
C:\Program Files\Apoint2K\Apntex.exe (4824)
C:\Program Files\iPod\bin\iPodService.exe (5164)
C:\Program Files\Google\Drive\googledrivesync.exe (2488)
C:\Program Files\Windows Live\Contacts\wlcomm.exe (4628)
C:\Program Files\Mozilla Firefox\firefox.exe (3268)
C:\Program Files\Mozilla Firefox\plugin-container.exe (6004)
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe (3956)
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe (6108)
C:\Program Files\Common Files\Java\Java Update\jucheck.exe (5396)
C:\UsbFix\Go.exe (440)
C:\Windows\system32\wbem\wmiprvse.exe (5428)
C:\Windows\system32\SearchProtocolHost.exe (5620)

################## | El Desaparecido Section |

HKLM\SOFTWARE | Run : [IgfxTray] - C:\Windows\system32\igfxtray.exe
HKLM\SOFTWARE | Run : [HotKeysCmds] - C:\Windows\system32\hkcmd.exe
HKLM\SOFTWARE | Run : [Persistence] - C:\Windows\system32\igfxpers.exe
HKLM\SOFTWARE | Run : [Apoint] - C:\Program Files\Apoint2K\Apoint.exe
HKLM\SOFTWARE | Run : [IAAnotif] - "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
HKLM\SOFTWARE | Run : [QPService] - "C:\Program Files\HP\QuickPlay\QPService.exe"
HKLM\SOFTWARE | Run : [QlbCtrl] - %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
HKLM\SOFTWARE | Run : [UCam_Menu] - "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
HKLM\SOFTWARE | Run : [Windows Defender] - %ProgramFiles%\Windows Defender\MSASCui.exe -hide
HKLM\SOFTWARE | Run : [Adobe Reader Speed Launcher] - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
HKLM\SOFTWARE | Run : [HP Health Check Scheduler] - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
HKLM\SOFTWARE | Run : [HP Software Update] - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
HKLM\SOFTWARE | Run : [hpWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE | Run : [AdobeCS4ServiceManager] - "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM\SOFTWARE | Run : [iTunesHelper] - "C:\Program Files\iTunes\iTunesHelper.exe"
HKLM\SOFTWARE | RunOnce : [] - 
HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem
HKU\S-1-5-19\SOFTWARE | Run : [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem
HKU\S-1-5-20\SOFTWARE | Run : [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter 
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [HPAdvisor] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [uTorrent] - "C:\Program Files\uTorrent\uTorrent.exe"  /MINIMIZED
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [msnmsgr] - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [EPSON Stylus CX4300 Series] - C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAR.EXE /FU "C:\Windows\TEMP\E_S23B3.tmp" /EF "HKCU"
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [AdobeBridge] - 
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [Windows Defender] - C:\Users\DR\AppData\Local\Temp\lJxSJ.exe
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [GoogleDriveSync] - "C:\Program Files\Google\Drive\googledrivesync.exe" /autostart
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [Fbjqjv] - C:\Users\DR\AppData\Roaming\Fbjqjv.exe

################## | Éléments infectieux |


################## | Registre |

Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr

################## | Mountpoints2 |



################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | E.O.F | https://www.sosvirus.net/ |

lokardz · Answer

voila le rapport ZHPDiag: Rapport de ZHPDiag v2013.4.2.8 par Nicolas Coolman, Update du 03/04/2013 Run by DR at 06/04/2013 12:26:46 State : Nouvelle version disponible High Elevated Privileges : OK UAC : Deactivate by user ---\ Web Browser MSIE: Internet Explorer v7.0.6001.18000 MFIE: Mozilla Firefox 19.0.2 v19.0.2 (Defaut) ---\ Windows Product Information ~ Langage: Français Windows Vista Home Basic Edition, 32-bit Service Pack 1 (Build 6001) Windows Server License Manager Script : OK ~ Vista, OEM_SLP channel System Locked Preinstallation (OEM_SLP) : OK Windows ID Activation : OK ~ Windows Partial Key : 44MV3 Windows License : OK Windows Automatic Updates : OK ---\ System Information ~ Processor: x86 Family 6 Model 15 Stepping 13, GenuineIntel ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 2037.3 MB (39% free) System Restore: Activé (Enable) System drive C: has 28 GB (12%) free of 222 GB ---\ Logged in mode ~ Computer Name: PC-DE-DR ~ User Name: DR ~ All Users Names: DR, Administrateur, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\ Environnement Variables ~ System Unit : C:\ ~ %AppData% : C:\Users\DR\AppData\Roaming\ ~ %Desktop% : C:\Users\DR\Desktop\ ~ %Favorites% : C:\Users\DR\Favorites\ ~ %LocalAppData% : C:\Users\DR\AppData\Local\ ~ %StartMenu% : C:\Users\DR\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\WINDOWS\ ~ %System% : C:\WINDOWS\System32\ ---\ DOS/Devices C:\ Hard drive, Flash drive, Thumb drive (Free 28 Go of 222 Go) D:\ Hard drive, Flash drive, Thumb drive (Free 0 Go of 11 Go) E:\ CD-ROM drive (Not Inserted) ---\ Security Center & Tools Informations [HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: Modified [HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: Modified [HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: Modified [HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: Modified [HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: Modified [HKLM\SOFTWARE\Microsoft\Security Center] UacDisableNotify: Modified [HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK [HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK [HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK [HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] Load: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date ~ Security Center: Scanned in 00mn 00s ---\ Recherche particulière de fichiers génériques [MD5.4F554999D7D5F05DAAEBBA7B5BA1089D] - (.Microsoft Corporation - Explorateur Windows.) (.29/10/2008 - 07:29:41.) -- C:\WINDOWS\Explorer.exe [2927104] [MD5.101BA3EA053480BB5D957EF37C06B5ED] - (.Microsoft Corporation - Application de démarrage de Windows.) (.21/01/2008 - 03:33:13.) -- C:\WINDOWS\System32\Wininit.exe [96768] [MD5.DA5A72211661C7F162B332FEA4F09A69] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.21/04/2011 - 16:00:34.) -- C:\WINDOWS\System32\wininet.dll [833024] [MD5.C2610B6BDBEFC053BBDAB4F1B965CB24] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.21/01/2008 - 03:34:38.) -- C:\WINDOWS\System32\Winlogon.exe [314880] [MD5.48EB99503533C27AC6135648E5474457] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.21/04/2011 - 14:16:42.) -- C:\WINDOWS\system32\Drivers\AFD.sys [273408] [MD5.2D9C903DC76A66813D350A562DE40ED9] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.21/01/2008 - 03:32:21.) -- C:\WINDOWS\system32\Drivers\atapi.sys [21560] [MD5.7ADD03E75BEB9E6DD102C3081D29840A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.21/01/2008 - 03:33:23.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [70144] [MD5.1EC25CEA0DE6AC4718BF89F9E1778B57] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/01/2008 - 03:32:23.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [67072] [MD5.A3E9FA213F443AC77C7746119D13FEEC] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.14/04/2011 - 15:24:14.) -- C:\WINDOWS\system32\Drivers\DfsC.sys [75264] [MD5.C87B1EE051C0464491C1A7B03FA0BC99] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/01/2008 - 03:32:47.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [53760] [MD5.22D56C8184586B7A1F6FA60BE5F5A2BD] - (.Microsoft Corporation - Pilote de port i8042.) (.21/01/2008 - 03:32:45.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [54784] [MD5.8793643A67B42CEC66490B2A0CF92D68] - (.Microsoft Corporation - IP Network Address Translator.) (.21/01/2008 - 03:34:06.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [100864] [MD5.5734A0F2BE7E495F7D3ED6EFD4B9F5A1] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.29/04/2011 - 13:49:35.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [105984] [MD5.7C5FEE5B1C5728507CD96FB4A13E7A02] - (.Microsoft Corporation - MBT Transport driver.) (.21/01/2008 - 03:34:49.) -- C:\WINDOWS\system32\Drivers etBT.sys [184320] [MD5.B4EFFE29EB4F15538FD8A9681108492D] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.21/01/2008 - 03:33:23.) -- C:\WINDOWS\system32\Drivers tfs.sys [1081912] [MD5.0FA9B5055484649D63C303FE404E5F4D] - (.Microsoft Corporation - Pilote de port parallèle.) (.02/11/2006 - 09:51:30.) -- C:\WINDOWS\system32\Drivers\Parport.sys [79360] [MD5.A214ADBAF4CB47DD2728859EF31F26B0] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/01/2008 - 03:34:44.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [76288] [MD5.FBC0BACD9C3D7F6956853F64A66E252D] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.21/01/2008 - 03:32:22.) -- C:\WINDOWS\system32\Drivers dpdr.sys [248832] [MD5.031E6BCD53C9B2B9ACE111EAFEC347B6] - (.Microsoft Corporation - SMB Transport driver.) (.21/01/2008 - 03:34:49.) -- C:\WINDOWS\system32\Drivers\smb.sys [66560] [MD5.D09276B1FAB033CE1D40DCBDF303D10F] - (.Microsoft Corporation - TDI Translation Driver.) (.21/01/2008 - 03:34:42.) -- C:\WINDOWS\system32\Drivers dx.sys [71680] [MD5.D8B4A53DD2769F226B3EB374374987C9] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/01/2008 - 03:32:47.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [227896] ~ Generic Processes: Scanned in 00mn 01s ---\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 1/32 ~ Mes musiques (My Musics) : 1/8 ~ Mes Videos (My Videos) : 1/2 ~ Mes Favoris (My Favorites) : 1/21 ~ Mes Documents (My Documents) : 1/720 ~ Mon Bureau (My Desktop) : 1/127653 ~ Menu demarrer (Programs) : 1/47 ~ Hidden Files: Scanned in 03mn 46s ---\ Processus lancés [MD5.F96EBC5A624349D81DCC7600A3C5DC43] - (.Microsoft Corporation - Console IME.) -- C:\Windows\system32\conime.exe [69120] [PID.6320] [MD5.C9BE08664611DDAF98E2331E9288B00B] - (.Microsoft Corporation - PresentationFontCache.exe.) -- C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [46104] [PID.7168] [MD5.A5299D04ED225D64CF07A568A3E1BF8C] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [55184] [PID.3816] [MD5.0D26C438E2938A3E6BDD91173BC96FF0] - (.Hewlett-Packard - HP Health Check Service.) -- c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [65536] [PID.5848] [MD5.0BA91E1358AD25236863039BB2609A2E] - (.Microsoft Corporation - Service de gestion des licences Microsoft.) -- C:\Windows\system32\SLsvc.exe [2623488] [PID.460] [MD5.8E93CDF0EA8EDBA63F07E2898A9B2147] - (.Microsoft Corporation - Windows Update Automatic Updates.) -- C:\Windows\system32\wuauclt.exe [43008] [PID.6540] [MD5.BF2F2717C13A4BD4FD73F2788534E86B] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe [917400] [PID.1348] [MD5.AA6844A5127ED4B20DF6D313467B929D] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files\Mozilla Firefox\plugin-container.exe [17304] [PID.2828] [MD5.680AD8F376970696B45269F074A8A28E] - (.Adobe Systems, Inc. - Adobe Flash Player 11.6 r602.) -- C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe [1822424] [PID.412] [MD5.95FB55B85D0AFC0962443808383C5588] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [6396416] [PID.4620] ~ Processes Running: Scanned in 00mn 01s ---\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) C:\Users\DR\AppData\Roaming\Mozilla\Firefox\Profiles\b8i9g5kg.default\prefs.js C:\Users\DR\AppData\Roaming\Mozilla\Firefox\Profiles\b8i9g5kg.default\user.js M3 - MFPP: Plugins - [DR] -- C:\Program Files\Mozilla FireFox\searchplugins\amazon-france.xml M3 - MFPP: Plugins - [DR] -- C:\Program Files\Mozilla FireFox\searchplugins\bing.xml M3 - MFPP: Plugins - [DR] -- C:\Program Files\Mozilla FireFox\searchplugins\cnrtl-tlfi-fr.xml M3 - MFPP: Plugins - [DR] -- C:\Program Files\Mozilla FireFox\searchplugins\eBay-france.xml M3 - MFPP: Plugins - [DR] -- C:\Program Files\Mozilla FireFox\searchplugins\google.xml M3 - MFPP: Plugins - [DR] -- C:\Program Files\Mozilla FireFox\searchplugins\wikipedia-fr.xml M3 - MFPP: Plugins - [DR] -- C:\Program Files\Mozilla FireFox\searchplugins\yahoo-france.xml M0 - MFSP: prefs.js [DR - b8i9g5kg.default] https://www.google.com/?gws_rd=ssl M2 - MFEP: prefs.js [DR - b8i9g5kg.default\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}] [dwhelper] DownloadHelper v4.9.14 (.Michel Gutierrez.) P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (...) -- C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll P2 - FPN: [HKLM] [@Apple.com/iTunes,version=1.0] - (...) -- C:\Program Files\iTunes\Mozilla Plugins pitunes.dll P2 - FPN: [HKLM] [@Google.com/GoogleEarthPlugin] - (.Google - GEPlugin.) -- C:\Program Files\Google\Google Earth\plugin pgeplugin.dll P2 - FPN: [HKLM] [@java.com/DTPlugin,version=1.6.0_33] - (.Sun Microsystems, Inc. - NPRuntime Script Plug-in Library for Java(TM) Deploy.) -- C:\Windows\system32 pdeployJava1.dll P2 - FPN: [HKLM] [@java.com/JavaPlugin] - (.Sun Microsystems, Inc. - Next Generation Java Plug-in 1.6.0_33 for Mozilla browsers.) -- C:\Program Files\Java\jre6\bin\plugin2 pjp2.dll P2 - FPN: [HKLM] [@Microsoft.com/NpCtrl,version=1.0] - (. Microsoft Corporation - 4.1.10329.0.) -- c:\Program Files\Microsoft Silverlight\4.1.10329.0 pctrl.dll P2 - FPN: [HKLM] [@microsoft.com/WLPG,version=14.0.8117.0416] - (.Microsoft Corporation - NPWLPG.) -- C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll P2 - FPN: [HKLM] [@microsoft.com/WPF,version=3.5] - (.Microsoft Corporation - Windows Presentation Foundation (WPF) plug-in for Mozilla browsers.) -- c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=3] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.3.21.135 pGoogleUpdate3.dll P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=9] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.3.21.135 pGoogleUpdate3.dll P2 - FPN: [HKLM] [@videolan.org/vlc,version=2.0.1] - (.VideoLAN - VLC media player Web Plugin 2.0.0.) -- C:\Program Files\VideoLAN\VLC pvlc.dll ~ Firefox Browser: Scanned in 00mn 00s ---\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4) R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = https://www.microsoft.com/fr-fr/ R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.microsoft.com/fr-fr/ R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.microsoft.com/fr-fr/ R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.microsoft.com/fr-fr/ R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs = res://ieframe.dll/tabswelcome.htm R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.VideoLAN - VLC media player Web Plugin 2.0.0.) (No version) -- (.not file.) R4 - HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,Enabled = 2 ~ IE Browser: Scanned in 00mn 00s ---\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\Userinit.exe, F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl" ~ Keys: Scanned in 00mn 00s ---\ Redirection du fichier Hosts (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 00s ~ Nombre de lignes (Lines number): 22 ---\ Browser Helper Objects de navigateur (O2) O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} . (.Yontoo LLC - Yontoo Runtime.) -- C:\Program Files\Yontoo\YontooIEClient.dll =>PUP.Yontoo ~ BHO: 7 Legitimates Scanned in 00mn 00s ---\ Internet Explorer Toolbars (O3) O3 - Toolbar: (no name) - [HKLM]{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} Clé orpheline ~ Toolbar: Scanned in 00mn 00s ---\ Applications démarrées par registre & par dossier (O4) O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [Apoint] . (.Alps Electric Co., Ltd. - Alps Pointing-device Driver.) -- C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [IAAnotif] . (.Intel Corporation - Event Monitor User Notification Tool.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe O4 - HKLM\..\Run: [QPService] . (.CyberLink Corp. - HP QuickPlay Resident Program.) -- C:\Program Files\HP\QuickPlay\QPService.exe O4 - HKLM\..\Run: [QlbCtrl] . (. Hewlett-Packard Development Company, L.P. - Quick Launch Buttons.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe O4 - HKLM\..\Run: [UCam_Menu] . (.CyberLink Corp. - StartMen Application.) -- C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe O4 - HKLM\..\Run: [Windows Defender] . (.Microsoft Corporation - Windows Defender User Interface.) -- C:\Program Files\Windows Defender\MSASCui.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe O4 - HKLM\..\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [hpWirelessAssistant] . (.Hewlett-Packard Development Company, L.P. - HPWAMain Module.) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe O4 - HKLM\..\Run: [AdobeCS4ServiceManager] . (.Adobe Systems Incorporated - Adobe CS4 Service Manager.) -- C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe O4 - HKLM\..\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe O4 - HKLM\..\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe O4 - HKCU\..\Run: [WindowsWelcomeCenter] oobefldr.dll O4 - HKCU\..\Run: [HPAdvisor] . (.Hewlett-Packard - HP Advisor.) -- C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe O4 - HKCU\..\Run: [uTorrent] . (.BitTorrent, Inc. - µTorrent.) -- C:\Program Files\uTorrent\uTorrent.exe O4 - HKCU\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe O4 - HKCU\..\Run: [EPSON Stylus CX4300 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAR.exe O4 - HKCU\..\Run: [AdobeBridge] Clé orpheline O4 - HKCU\..\Run: [WMPNSCFG] . (.Microsoft Corporation - Application de configuration du service Par.) -- C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [Windows Defender] C:\Users\DR\AppData\Local\Temp\lJxSJ.exe (.not file.) O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe O4 - HKCU\..\Run: [GoogleDriveSync] . (.Google - Google Drive.) -- C:\Program Files\Google\Drive\googledrivesync.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] oobefldr.dll O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] oobefldr.dll O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [WindowsWelcomeCenter] oobefldr.dll O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [HPAdvisor] . (.Hewlett-Packard - HP Advisor.) -- C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [uTorrent] . (.BitTorrent, Inc. - µTorrent.) -- C:\Program Files\uTorrent\uTorrent.exe O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [EPSON Stylus CX4300 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAR.exe O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [AdobeBridge] Clé orpheline O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [WMPNSCFG] . (.Microsoft Corporation - Application de configuration du service Par.) -- C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [Windows Defender] C:\Users\DR\AppData\Local\Temp\lJxSJ.exe (.not file.) O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [GoogleDriveSync] . (.Google - Google Drive.) -- C:\Program Files\Google\Drive\googledrivesync.exe ~ Application: Scanned in 00mn 00s ---\ Autres liens utilisateurs (O4) O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Programs: Windows Mail.lnk . (.Microsoft Corporation - Windows Mail.) -- C:\Program Files\Windows Mail\WinMail.exe O4 - GS\Programs: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\QuickLaunch: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O4 - GS\QuickLaunch: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\SendTo: Dropbox.lnk . (...) -- C:\Users\DR\Dropbox O4 - GS\SendTo: Skype.lnk . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe O4 - GS\Desktop: Audacity.lnk . (.The Audacity Team - Audacity®, the Free, Cross-Platform Sound E.) -- C:\Program Files\Audacity\audacity.exe O4 - GS\Desktop: Digital Image Recovery.lnk . (...) -- C:\Program Files\Digital Image Recovery\DIR.exe O4 - GS\Desktop: Dropbox.lnk . (.Dropbox, Inc. - Dropbox.) -- C:\Users\DR\AppData\Roaming\Dropbox\bin\Dropbox.exe O4 - GS\Desktop: Google Drive.lnk . (...) -- C:\Users\DR\Google Drive O4 - GS\Desktop: Images - Raccourci.lnk . (...) -- C:\Users\DR\Pictures O4 - GS\Desktop: MagicISO.lnk . (.MagicISO, Inc. - MagicISO Maker.) -- C:\Program Files\MagicISO\MagicISO.exe O4 - GS\Desktop: Téléchargement - Raccourci.lnk . (...) -- C:\Users\DR\Downloads ~ Global Startup: Scanned in 00mn 00s ---\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO ~ IE Extra Buttons: Scanned in 00mn 00s ---\ Winsock hijacker (Layered Service Provider) (O10) ~ Winsock: 7 Legitimates Scanned in 00mn 00s ---\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{15381E7B-4353-4480-BD49-8E4CC4253C14}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{AB6CD3B3-BC34-4414-9F12-87CDB96AC58B}: DhcpNameServer = 100.100.3.40 O17 - HKLM\System\CCS\Services\Tcpip\..\{B7A7B727-1515-4E77-99D3-3A25F8C621F5}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{B7A7B727-1515-4E77-99D3-3A25F8C621F5}: DhcpDomain = Belkin O17 - HKLM\System\CS1\Services\Tcpip\..\{15381E7B-4353-4480-BD49-8E4CC4253C14}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{AB6CD3B3-BC34-4414-9F12-87CDB96AC58B}: DhcpNameServer = 100.100.3.40 O17 - HKLM\System\CS1\Services\Tcpip\..\{B7A7B727-1515-4E77-99D3-3A25F8C621F5}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{B7A7B727-1515-4E77-99D3-3A25F8C621F5}: DhcpDomain = Belkin O17 - HKLM\System\CS3\Services\Tcpip\..\{15381E7B-4353-4480-BD49-8E4CC4253C14}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS3\Services\Tcpip\..\{AB6CD3B3-BC34-4414-9F12-87CDB96AC58B}: DhcpNameServer = 100.100.3.40 O17 - HKLM\System\CS3\Services\Tcpip\..\{B7A7B727-1515-4E77-99D3-3A25F8C621F5}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CS3\Services\Tcpip\..\{B7A7B727-1515-4E77-99D3-3A25F8C621F5}: DhcpDomain = Belkin O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 ~ Domain: Scanned in 00mn 00s ---\ Protocole additionnel (O18) O18 - Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} . (.Microsoft Corporation - Windows Live Mail.) -- C:\Program Files\Windows Live\Mail\mailcomm.dll O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.dll ~ Protocole Additionnel: Scanned in 00mn 00s ---\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\WINDOWS\System32\igfxdev.dll ~ Winlogon: Scanned in 00mn 00s ---\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21) ~ SSODL: 1 Legitimates Scanned in 00mn 00s ---\ Clé de Registre autorun SharedTaskScheduler (STS) (O22) O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\WINDOWS\System32\browseui.dll ~ STS/SSO: Scanned in 00mn 00s ---\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: EBP Pervasive.SQL (EBP Pervasive.SQL) . (...) - C:\PVSW\Bin\WGE_SRV.exe O23 - Service: Sentinel Keys Server (SentinelKeysServer) . (.SafeNet, Inc. - Pas de description.) - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe O23 - Service: Sentinel Protection Server (SentinelProtectionServer) . (.SafeNet, Inc - Sentinel Protection Server for SuperPro and.) - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe O23 - Service: XAudioService (XAudioService) . (.Conexant Systems, Inc. - Modem Audio Service.) - C:\WINDOWS\System32\DRIVERS\xaudio.exe ~ Services: 12 Legitimates Scanned in 00mn 13s ---\ Enumération Active Desktop & MHTML Editor (O24) O24 - Desktop General: BackupWallPaper - .(...) - C:\WINDOWS\web\Wallpaper\img8.jpg O24 - Desktop General: WallPaper - .(...) - C:\WINDOWS\web\Wallpaper\img8.jpg ~ Desktop Component: 1 Legitimates Scanned in 00mn 00s ---\ BootExecute (O34) ~ BEX: 1 Legitimates Scanned in 00mn 00s ---\ Tâches planifiées en automatique (O39) [MD5.00000000000000000000000000000000] [APT] [YourFile Update] (...) -- C:\Program Files\YourFileDownloader\YourFileUpdater.exe (.not file.) [0] [MD5.B463F51E53CC636C6C40560B6204B50A] [APT] [{DE5F74E3-7B32-45A8-BD7C-14899FDC4826}] (...) -- C:\Users\DR\Downloads\modasng.exe [7783528] ~ Scheduled Task: 11 Legitimates Scanned in 00mn 04s ---\ Composants installés (ActiveSetup Installed Components) (O40) ~ Active Setup: 13 Legitimates Scanned in 00mn 00s ---\ Pilotes lancés au démarrage (O41) ~ Drivers: 60 Legitimates Scanned in 00mn 00s ---\ Logiciels installés (O42) O42 - Logiciel: ALTools Update - (.ESTsoft Corp..) [HKLM] -- ALUpdate_is1 O42 - Logiciel: ALZip - (.ESTsoft Corp..) [HKLM] -- ALZip_is1 O42 - Logiciel: Adobe CSI CS4 - (.Adobe Systems Incorporated.) [HKLM] -- {0F723FC1-7606-4867-866C-CE80AD292DAF} O42 - Logiciel: Adobe Dynamiclink Support - (.Adobe Systems Incorporated.) [HKLM] -- {60DB5894-B5A1-4B62-B0F3-669A22C0EE5D} O42 - Logiciel: Adobe Flash CS4 - (.Adobe Systems Incorporated.) [HKLM] -- {F6E99614-F042-4459-82B7-8B38B2601356} O42 - Logiciel: Adobe Flash CS4 Extension - Flash Lite STI en - (.Adobe Systems Incorporated.) [HKLM] -- {793D1D88-6141-43DE-BE58-59BCE31B4090} O42 - Logiciel: Adobe Flash CS4 STI-en - (.Adobe Systems Incorporated.) [HKLM] -- {2168245A-B5AD-40D8-A641-48E3E070B5B6} O42 - Logiciel: Adobe Flash Player 11 ActiveX - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player ActiveX O42 - Logiciel: Adobe Flash Player 11 Plugin - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player Plugin O42 - Logiciel: Adobe Media Encoder CS4 - (.Adobe Systems Incorporated.) [HKLM] -- {DEB90B8E-0DCB-48CE-B90E-8842A2BD643E} O42 - Logiciel: Adobe Media Encoder CS4 Exporter - (.Adobe Systems Incorporated.) [HKLM] -- {561968FD-56A1-49FD-9ED0-F55482C7C5BC} O42 - Logiciel: Adobe Media Encoder CS4 Importer - (.Adobe Systems Incorporated.) [HKLM] -- {8186FF34-D389-4B7E-9A2F-C197585BCFBD} O42 - Logiciel: Adobe Output Module - (.Adobe Systems Incorporated.) [HKLM] -- {BB4E33EC-8181-4685-96F7-8554293DEC6A} O42 - Logiciel: Adobe Reader 8.1.0 - Français - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-7AD7-1036-7B44-A81000000003} O42 - Logiciel: Adobe Search for Help - (.Adobe Systems Incorporated.) [HKLM] -- {F0E64E2E-3A60-40D8-A55D-92F6831875DA} O42 - Logiciel: Adobe Service Manager Extension - (.Adobe Systems Incorporated.) [HKLM] -- {4943EFF5-229F-435D-BEA9-BE3CAEA783A7} O42 - Logiciel: AdobeColorCommonSetCMYK - (.Adobe Systems Incorporated.) [HKLM] -- {68243FF8-83CA-466B-B2B8-9F99DA5479C4} O42 - Logiciel: AdobeColorCommonSetRGB - (.Adobe Systems Incorporated.) [HKLM] -- {16E6D2C1-7C90-4309-8EC4-D2212690AAA4} O42 - Logiciel: Ciel Compta 18.0 - (.Ciel.) [HKLM] -- {A094E2AD-FD66-497A-AC31-59CC71A2DA11} O42 - Logiciel: Connect - (.Adobe Systems Incorporated.) [HKLM] -- {B29AD377-CC12-490A-A480-1452337C618D} O42 - Logiciel: EBP Compta 14.1 - (.EBP.) [HKLM] -- EBP Compta 14.1 O42 - Logiciel: EBP Compta 14.1 - (.EBP.) [HKLM] -- {10A4CAB8-D1B8-4C8C-9F54-76BF6063E71B} O42 - Logiciel: EBP Utilitaire d'échanges 1.1 - (.EBP.) [HKLM] -- EBP Utilitaire d'échanges 1.1 O42 - Logiciel: EBP Utilitaire d'échanges 1.1 - (.EBP.) [HKLM] -- {5E39F2FB-0D5B-413E-903C-3F495017109C} O42 - Logiciel: Java(TM) 6 Update 2 - (.Sun Microsystems, Inc..) [HKLM] -- {3248F0A8-6813-11D6-A77B-00B0D0160020} O42 - Logiciel: Java(TM) 6 Update 33 - (.Oracle.) [HKLM] -- {26A24AE4-039D-4CA4-87B4-2F83216033FF} O42 - Logiciel: Java(TM) SE Development Kit 6 Update 17 - (.Sun Microsystems, Inc..) [HKLM] -- {32A3A4F4-B792-11D6-A78A-00B0D0160170} O42 - Logiciel: Magic ISO Maker v5.5 (build 0281) - (...) [HKLM] -- Magic ISO Maker v5.5 (build 0281) O42 - Logiciel: MyPhpFactory 1.0 - (.Webcom, Inc..) [HKLM] -- MyPhpFactory_is1 O42 - Logiciel: Omics8-DirectLab - (.OMICS Software Inc..) [HKLM] -- {E5F138C5-0973-4988-8E93-0769FEAA8A1C} O42 - Logiciel: Pixel Bender Toolkit - (.Adobe Systems Incorporated.) [HKLM] -- {43509E18-076E-40FE-AF38-CA5ED400A5A9} O42 - Logiciel: RTF to HTML Converter 1.0 - (.WonderWebWare.com.) [HKLM] -- WonderWebWare RTF to HTML Converter_is1 O42 - Logiciel: Suite Shared Configuration CS4 - (.Adobe Systems Incorporated.) [HKLM] -- {842B4B72-9E8F-4962-B3C1-1C422A5C4434} O42 - Logiciel: SurfOffline Professional 2 - (.Bimesoft.) [HKLM] -- SurfOffline Professional 2 O42 - Logiciel: Touch Pad Driver - (...) [HKLM] -- {9F72EF8B-AEC9-4CA5-B483-143980AFD6FD} O42 - Logiciel: Webplayer setup version 1.0 - (...) [HKLM] -- {68D2ED23-69EB-46B7-812C-FDC04C5CA032}_is1 =>Adware.SocialSkinz O42 - Logiciel: WinOptics - (.WinOptics sarl.) [HKLM] -- WinOptics O42 - Logiciel: Yontoo 1.10.03 - (.Yontoo LLC.) [HKLM] -- {889DF117-14D1-44EE-9F31-C5FB5D47F68B} =>PUP.Yontoo O42 - Logiciel: kuler - (.Adobe Systems Incorporated.) [HKLM] -- {098727E1-775A-4450-B573-3F441F1CA243} O42 - Logiciel: µTorrent - (...) [HKLM] -- uTorrent ~ Logic: 236 Legitimates Scanned in 00mn 01s ---\ HKCU & HKLM Software Keys [HKCU\Software\2K75] [HKCU\Software\Acucorp] [HKCU\Software\Ah] [HKCU\Software\AppDataLow\Software\Smartbar] =>Hijacker.SmartBar [HKCU\Software\Bimesoft] [HKCU\Software\BitTorrent] [HKCU\Software\DSNR Labs] [HKCU\Software\DxOLabs] [HKCU\Software\LMSOFT] [HKCU\Software\MagicISO] [HKCU\Software\Softonic] [HKCU\Software\SweetIM] =>PUP.SweetIM [HKCU\Software\WOWSlider.com] [HKCU\Software\YourFileDownloader] [HKLM\Software\Bimesoft] [HKLM\Software\Iminent] =>Adware.IMBooster [HKLM\Software\LMSOFT] [HKLM\Software\SweetIM] =>PUP.SweetIM [HKLM\Software\Tarma Installer] [HKLM\Software\YourFileDownloader] ~ Key Software: 233 Legitimates Scanned in 00mn 01s ---\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 06/01/2013 - 20:04:24 - [0.382] ----D C:\Program Files\Babylon =>Toolbar.Babylon O43 - CFD: 30/12/2012 - 19:40:11 - [251.743] ----D C:\Program Files\LMSOFT O43 - CFD: 26/02/2013 - 18:31:47 - [2.960] ----D C:\Program Files\MagicISO O43 - CFD: 02/04/2013 - 16:30:05 - [2.278] ----D C:\Program Files\MyPhpFactory O43 - CFD: 01/01/2013 - 11:59:54 - [1.943] ----D C:\Program Files\SurfOffline Professional 2 O43 - CFD: 21/05/2012 - 22:59:03 - [1.056] ----D C:\Program Files\uTorrent O43 - CFD: 11/11/2012 - 12:21:01 - [12.538] ----D C:\Program Files\Webplayer setup =>Adware.SocialSkinz O43 - CFD: 18/01/2013 - 15:01:55 - [46.231] ----D C:\Program Files\WinOptics O43 - CFD: 27/09/2012 - 01:49:38 - [1.176] ----D C:\Program Files\WonderWebWare RTF to HTML Converter O43 - CFD: 10/11/2012 - 17:59:19 - [0.186] ----D C:\Program Files\Yontoo =>PUP.Yontoo O43 - CFD: 01/01/2013 - 12:00:39 - [1.618] ----D C:\ProgramData\Bimesoft O43 - CFD: 05/04/2013 - 10:23:49 - [0.001] ----D C:\ProgramData\open-config O43 - CFD: 10/11/2012 - 17:59:19 - [1.661] ----D C:\ProgramData\Tarma Installer O43 - CFD: 20/01/2013 - 00:21:05 - [7.890] --H-D C:\ProgramData\{457901F5-5804-47CE-B6ED-F1EB9C24658D} O43 - CFD: 20/01/2013 - 00:24:34 - [158.049] --H-D C:\ProgramData\{6F64497B-6549-4D0D-BD03-D772876B75EB} O43 - CFD: 19/01/2013 - 19:46:29 - [1.229] ----D C:\Users\DR\AppData\Roaming\DxO Labs O43 - CFD: 07/10/2012 - 11:54:43 - [0.287] ----D C:\Users\DR\AppData\Roaming\eType O43 - CFD: 30/12/2012 - 19:53:25 - [0.010] ----D C:\Users\DR\AppData\Roaming\LMSOFT O43 - CFD: 06/04/2013 - 12:19:09 - [6.228] ----D C:\Users\DR\AppData\Roaming\uTorrent O43 - CFD: 23/09/2012 - 13:09:42 - [0] ----D C:\Users\DR\AppData\Roaming\YourFileDownloader O43 - CFD: 19/01/2013 - 19:43:31 - [1.968] ----D C:\Users\DR\AppData\Local\DxO_Labs O43 - CFD: 19/01/2013 - 19:46:17 - [0.002] --H-D C:\Users\DR\AppData\Local\TM9D2uhpZhJNR0l O43 - CFD: 30/12/2012 - 19:45:12 - [0.009] ----D C:\Users\DR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LMSOFT O43 - CFD: 26/02/2013 - 18:31:36 - [0] ----D C:\Users\DR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MagicISO O43 - CFD: 06/01/2013 - 18:42:08 - [0.002] ----D C:\Users\DR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinOptics ~ Program Folder: 219 Legitimates Scanned in 01mn 57s ---\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.AF0356B3CEEFEAFB969F11FAB1BE5787] - 06/04/2013 - 11:22:00 ---A- . (...) -- C:\UsbFix [Clean 4] PC-DE-DR.txt [16183] O44 - LFC:[MD5.3866725134FA41E89B5440D8D65C1C4C] - 06/04/2013 - 11:15:48 ----- . (...) -- C:\UsbFix [Scan 2] PC-DE-DR.txt [9487] O44 - LFC:[MD5.BEEF84F4163284C8A883D839B093F738] - 06/04/2013 - 10:22:32 ----- . (...) -- C:\UsbFix.txt [765] O44 - LFC:[MD5.4712CE57B739C41054F1608469A8600B] - 06/04/2013 - 10:21:56 ---A- . (...) -- C:\WINDOWS\pvsw.log [56827] O44 - LFC:[MD5.50AF7E0CEA671738F79E82B88FC3ED5A] - 05/04/2013 - 14:36:53 ----- . (...) -- C:\UsbFix [Clean 3] PC-DE-DR.txt [8628] O44 - LFC:[MD5.9E7DA4ABD50A273D51454B22A1EB45F5] - 05/04/2013 - 09:56:37 ----- . (...) -- C:\UsbFix [Scan 1] PC-DE-DR.txt [9556] O44 - LFC:[MD5.873A21E3D17CC1F542A2746DD4EB33DA] - 05/04/2013 - 09:26:30 ---A- . (...) -- C:\WINDOWS\system.ini [253] O44 - LFC:[MD5.BED6A061A8364D67774A0D31E97D578F] - 04/04/2013 - 11:27:06 ----- . (...) -- C:\UsbFix [Clean 2] PC-DE-DR.txt [14381] ~ Files: 19 Legitimates Scanned in 00mn 03s ---\ Déni du service (Local Security Authority) (O48) ~ LSA: 7 Legitimates Scanned in 00mn 00s ---\ Contrôle du Safe Boot (CSB) (O49) ~ CBS: 15 Legitimates Scanned in 00mn 00s ---\ Trojan Driver Search Data (HKLM) (O52) ~ TDSD: 4 Legitimates Scanned in 00mn 00s ---\ Microsoft Control Security Providers (O54) ~ MSCP: 2 Legitimates Scanned in 00mn 00s ---\ Microsoft Windows Policies System (O55) O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0 O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 O55 - MWPS:[HKLM\...\Policies\System] - "EnableLinkedConnections"=1 ~ MWPS: 17 Legitimates Scanned in 00mn 00s ---\ Microsoft Windows Policies Explorer (O56) O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDriveAutoRun"=3 O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDriveTypeAutoRun"=0 O56 - MWPE:[HKLM\...\policies\Explorer] - "NoDriveAutoRun"=3 O56 - MWPE:[HKLM\...\policies\Explorer] - "NoDriveTypeAutoRun"=0 ~ Keys: Scanned in 00mn 00s ---\ Liste des Drivers Système (O58) O58 - SDL:[MD5.04F0FCAC69C7C71A3AC4EB97FAFC8303] - 21/01/2008 - 03:32:46 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\WINDOWS\System32\Drivers\adp94xx.sys [422968] O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 02/11/2006 - 08:09:42 ---A- . (...) -- C:\WINDOWS\System32\ANSI.SYS [9029] ~ Drivers: Scanned in 00mn 00s ---\ Liste des outils de nettoyage (O63) O63 - Logiciel: UsbFix By El Desaparecido - (.El Desaparecido - SosVirus.org.) [HKLM] -- Usbfix O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 ~ ADS: Scanned in 00mn 00s ---\ Liste des services Legacy (O64) ~ Legacy: 63 Legitimates Scanned in 00mn 00s ---\ File Associations Shell Spawning (O67) O67 - Shell Spawning: <.bat> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.cpl> [HKLM\..\cplopen\Command] (.Microsoft Corporation - Windows Control Panel.) -- C:\WINDOWS\System32\control.exe O67 - Shell Spawning: <.cmd> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.com> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.evt> [HKLM\..\open\Command] (.Microsoft Corporation - Lanceur du composant logiciel enfichable Observateur d'événements.) -- C:\WINDOWS\System32\eventvwr.exe O67 - Shell Spawning: <.exe> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.html> [HKLM\..\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O67 - Shell Spawning: <.js> [HKLM\..\open\Command] (.Microsoft Corporation - Microsoft (R) Windows Based Script Host.) -- C:\WINDOWS\System32\WScript.exe O67 - Shell Spawning: <.reg> [HKLM\..\open\Command] (.Microsoft Corporation - Éditeur du Registre.) -- C:\WINDOWS egedit.exe O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O67 - Shell Spawning: <.bat> [HKCR\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.cpl> [HKCR\..\cplopen\Command] (.Microsoft Corporation - Windows Control Panel.) -- C:\WINDOWS\System32\control.exe O67 - Shell Spawning: <.cmd> [HKCR\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.com> [HKCR\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.evt> [HKCR\..\open\Command] (.Microsoft Corporation - Lanceur du composant logiciel enfichable Observateur d'événements.) -- C:\WINDOWS\System32\eventvwr.exe O67 - Shell Spawning: <.exe> [HKCR\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.html> [HKCR\..\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O67 - Shell Spawning: <.js> [HKCR\..\open\Command] (.Adobe Systems, Inc. - Adobe Dreamweaver CS4.) -- C:\Program Files\Adobe\Adobe Dreamweaver CS4\Dreamweaver.exe O67 - Shell Spawning: <.reg> [HKCR\..\open\Command] (.Microsoft Corporation - Éditeur du Registre.) -- C:\WINDOWS egedit.exe ~ Keys: Scanned in 00mn 00s ---\ Start Menu Internet (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\ Search Browser Infection (O69) O69 - SBI: SearchScopes [HKCU] ${searchCLSID} - (@ieframe.dll,-12512) - https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8 O69 - SBI: SearchScopes [HKCU] {51B0C529-4961-4997-B5F3-4D93C5C38223} - (Kelkoo) - http://fr.kelkoopartners.net O69 - SBI: SearchScopes [HKCU] {F06C9E33-E332-48E7-91DC-AF028AA60E37} - (AOL Recherche) - http://slirsredirect.search.aol.com ~ Keys: Scanned in 00mn 00s ---\ Recherche des services démarrés par Svchost (O83) ~ Services: 31 Legitimates Scanned in 00mn 00s ---\ Recherche particuliere à la racine de certains dossiers (O84) [MD5.816565442BB64A0F4F2B618596F75098] [SPRF][26/06/2012] (...) -- C:\Users\DR\AppData\Local\wbeqvfge.exe [442368] [MD5.86A81698D73E34F6462F7607EA83F8A9] [SPRF][18/02/2013] (...) -- C:\Users\DR\AppData\Roaming\wklnhst.dat [182] [MD5.A830AEFF4C87333BBE0222D976F47E6D] [SPRF][16/10/2011] (.ESTsoft Corp. - ALZip Setup.) -- C:\Users\DR\Desktop\ALZip.exe [6852616] [MD5.006C83751B9F17934B58085D0B7BDA2C] [SPRF][24/01/2007] (.America Online, Inc. - AOL Media Playback Control.) -- C:\WINDOWS\Downloaded Program Files\ampAx3.0.84.2.dll [841304] [MD5.3FEA9D2EDF23B0283C7A66C8DEA380BD] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player Module.) -- C:\WINDOWS\Downloaded Program Files\dwusplay.dll [24576] [MD5.CDBE35EA59BC9223E4F800BD1DB82D27] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player.) -- C:\WINDOWS\Downloaded Program Files\dwusplay.exe [196608] [MD5.0C78701C6F42345DFF2B2B6C3C3D01EF] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Web Agent.) -- C:\WINDOWS\Downloaded Program Files\isusweb.dll [172032] [MD5.6F678556A6FCE04FC94F3435F6313705] [SPRF][06/03/2008] (...) -- C:\WINDOWS\Downloaded Program Files\unagiuninst.exe [38428] ~ Files: Scanned in 00mn 00s ---\ Firewall Active Exception List (FirewallRules) (O87) O87 - FAEL: "{F0F4D101-604B-40F9-96B8-1360C2214806}" | In - Public - P6 - TRUE | .(.AOL LLC - AOL Loader.) -- C:\Program Files\Common Files\AOL\Loader\aolload.exe O87 - FAEL: "{A1B23C7E-6F91-494B-A99D-EF52F22EDBB1}" | In - Public - P17 - TRUE | .(.AOL LLC - AOL Loader.) -- C:\Program Files\Common Files\AOL\Loader\aolload.exe O87 - FAEL: "{53AF2BC5-B7A6-4F1F-80AE-F2E78DF302A5}" | In - None - P6 - TRUE | .(.BitTorrent, Inc. - µTorrent.) -- C:\Program Files\uTorrent\uTorrent.exe O87 - FAEL: "{AFA39A82-5EE6-46CC-8420-9BFC7F19DF14}" | In - None - P17 - TRUE | .(.BitTorrent, Inc. - µTorrent.) -- C:\Program Files\uTorrent\uTorrent.exe O87 - FAEL: "{57119231-A585-4C3F-848C-D05E0557E8C5}" |In - Public - P6 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\Downloader.exe (.not file.) O87 - FAEL: "{A57EDCDB-2C94-4411-AA21-19F6C53E1D00}" |In - Public - P17 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\Downloader.exe (.not file.) O87 - FAEL: "{22033A6E-AB6C-42B0-AEBA-3965582E9621}" |In - Public - P6 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\YourFile.exe (.not file.) O87 - FAEL: "{93248E24-ED02-4160-927C-BF7ED1318480}" |In - Public - P17 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\YourFile.exe (.not file.) O87 - FAEL: "{6C07B7F2-C202-4442-B905-98056FE4B957}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\Downloader.exe (.not file.) O87 - FAEL: "{D2C1CFD0-5158-46BD-986D-C5AA6F201AE3}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\Downloader.exe (.not file.) O87 - FAEL: "{C2FECF98-3937-4167-9F24-9E92D8D2C2B0}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\YourFile.exe (.not file.) O87 - FAEL: "{39365B7D-7107-43F4-B097-B9FB94C2EF0F}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\YourFile.exe (.not file.) O87 - FAEL: "{BDDCB897-E97B-4598-9151-BA74F0E69EEF}" | In - Private - P6 - FALSE | .(.SafeNet, Inc.) -- C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe O87 - FAEL: "{DF1C9C6E-C645-49F0-BDAF-8DBC161F0CAC}" | In - Private - P17 - FALSE | .(.SafeNet, Inc.) -- C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe O87 - FAEL: "{71D92A63-8014-40F5-BA7F-9E7A9E8EC856}" | In - Private - P6 - FALSE | .(.SafeNet, Inc. - Pas de description.) -- C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe O87 - FAEL: "{455CA368-CD81-446B-814D-0F5E104D505C}" | In - Private - P17 - FALSE | .(.SafeNet, Inc. - Pas de description.) -- C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe O87 - FAEL: "{ADE16596-C03C-43AD-8392-A9DDD29140E7}" | In - Private - P6 - TRUE | .(.Bimesoft - SurfOffline.) -- C:\Program Files\SurfOffline Professional 2\SO_PRO.exe O87 - FAEL: "{89E25BCA-E0C4-4B8B-9B39-5B98690E4AC2}" | In - Private - P17 - TRUE | .(.Bimesoft - SurfOffline.) -- C:\Program Files\SurfOffline Professional 2\SO_PRO.exe O87 - FAEL: "{625958F8-CE3B-44E7-BD48-D2D0609AA9E6}" | In - Domain - P6 - TRUE | .(...) -- C:\PVSW\Bin\w3dbsmgr.exe O87 - FAEL: "{F18FD081-23E9-42FE-9ECC-FB5AC2CDA0C8}" | In - Domain - P17 - TRUE | .(...) -- C:\PVSW\Bin\w3dbsmgr.exe O87 - FAEL: "{9DD05E07-FDEC-4710-AAE5-79E32F634335}" | In - Private - P6 - TRUE | .(...) -- C:\PVSW\Bin\w3dbsmgr.exe O87 - FAEL: "{735340B3-D0BE-43B7-BF02-0FEAD1DEAE48}" | In - Private - P17 - TRUE | .(...) -- C:\PVSW\Bin\w3dbsmgr.exe O87 - FAEL: "TCP Query User{2CFE2E54-ADB2-4AB1-A6E9-66B312568EAF}C:\users\dr\desktop\iphone 4 5.1.1 inyumbrella-6.10.02a.exe" | In - Private - P6 - TRUE | .(...) -- C:\users\dr\desktop\iphone 4 5.1.1 inyumbrella-6.10.02a.exe O87 - FAEL: "UDP Query User{BBF681B4-8F9C-47E5-931C-19DD582E3865}C:\users\dr\desktop\iphone 4 5.1.1 inyumbrella-6.10.02a.exe" | In - Private - P17 - TRUE | .(...) -- C:\users\dr\desktop\iphone 4 5.1.1 inyumbrella-6.10.02a.exe O87 - FAEL: "TCP Query User{A6081377-9F05-4628-A348-6DB3FF3F6AD3}C:\users\dr\dropbox\cours et exos\+\logiciels et outils\optical\optical.exe" | In - Private - P6 - TRUE | .(...) -- C:\users\dr\dropbox\cours et exos\+\logiciels et outils\optical\optical.exe O87 - FAEL: "UDP Query User{3E70E7CA-F9C5-45B2-8E33-0E7A8C28BA7E}C:\users\dr\dropbox\cours et exos\+\logiciels et outils\optical\optical.exe" | In - Private - P17 - TRUE | .(...) -- C:\users\dr\dropbox\cours et exos\+\logiciels et outils\optical\optical.exe O87 - FAEL: "TCP Query User{04A90919-7455-45A6-BA8B-FB861AA65A46}F: ecycler\e5188982.exe" |In - Private - P6 - TRUE | .(...) -- F: ecycler\e5188982.exe (.not file.) O87 - FAEL: "UDP Query User{1605CFB4-7864-42CE-978D-AC5B777D6423}F: ecycler\e5188982.exe" |In - Private - P17 - TRUE | .(...) -- F: ecycler\e5188982.exe (.not file.) ~ Firewall: 210 Legitimates Scanned in 00mn 01s ---\ Scan Additionnel (O88) Database Version : v2.11367 - (03/04/2013) Clés trouvées (Keys found) : 34 Valeurs trouvées (Values found) : 0 Dossiers trouvés (Folders found) : 5 Fichiers trouvés (Files found) : 0 [HKLM\Software\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}] =>PUP.Funmoods [HKLM\Software\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}] =>Adware.Yontoo [HKLM\Software\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}] =>Adware.Yontoo [HKLM\Software\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}] =>Adware.Yontoo [HKLM\Software\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}] =>Adware.Agent [HKLM\Software\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}] =>Adware.Yontoo [HKLM\Software\Classes\CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}] =>Adware.Yontoo [HKLM\Software\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}] =>Adware.Yontoo [HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}] =>Adware.Yontoo [HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}] =>Adware.Yontoo [HKLM\Software\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}] =>Adware.CDNHelper [HKLM\Software\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}] =>Toolbar.Babylon [HKLM\Software\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}] =>Adware.Yontoo [HKLM\Software\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}] =>Adware.Yontoo [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}] =>Adware.Yontoo [HKLM\Software\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}] =>Adware.Yontoo [HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}] =>Adware.Yontoo [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}] =>Adware.Yontoo [HKLM\Software\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}] =>Adware.Yontoo [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}] =>Adware.Yontoo [HKLM\Software\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}] =>Adware.Yontoo [HKCU\Software\1ClickDownload] =>PUP.1ClickDownloader [HKCU\Software\DSNR Labs] =>Toolbar.Agent [HKLM\Software\Iminent] =>Adware.IMBooster [HKCU\Software\Softonic] =>Toolbar.Conduit [HKCU\Software\SweetIM] =>PUP.SweetIM [HKLM\Software\SweetIM] =>PUP.SweetIM [HKLM\Software\Tarma Installer] =>Toolbar.Agent [HKLM\Software\Classes\Prod.cap] =>Toolbar.Babylon [HKLM\Software\Classes\YontooIEClient.Api] =>Adware.Yontoo [HKLM\Software\Classes\YontooIEClient.Api.1] =>Adware.Yontoo [HKLM\Software\Classes\YontooIEClient.Layers] =>Adware.Yontoo [HKLM\Software\Classes\YontooIEClient.Layers.1] =>Adware.Yontoo [HKLM\Software\Classes\AppID\YontooIEClient.DLL] =>Adware.Yontoo C:\Program Files\yontoo =>Adware.Yontoo C:\Program Files\Babylon =>Toolbar.Babylon C:\Program Files\Webplayer setup =>Adware.SocialSkinz C:\Users\DR\AppData\Roaming\yourfiledownloader =>PUP.YourFileDownloader C:\Users\DR\AppData\Roaming\eType =>Adware.Zugo ~ Additionnel: Scanned in 00mn 51s ---\ Product Upgrade Codes (O90) O90 - PUC: "409D4822831C85B439CEC563A25B31A0" . (.Les Sims(TM) Histoires de vie.) -- C:\Windows\Installer\{2284D904-C138-4B58-93EC-5C362AB5130A}\ARPPRODUCTICON.exe O90 - PUC: "5C831F5E37908894E8397096EFAAA8C1" . (.Omics8-DirectLab.) -- C:\Windows\Installer\{E5F138C5-0973-4988-8E93-0769FEAA8A1C}\ARPPRODUCTICON.exe ~ Update Products: 175 Legitimates Scanned in 00mn 00s ---\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Demand 14/03/2013 253656 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe SR - | Auto 11/08/2012 55184 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe SS - | Auto 30/08/2011 390504 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe SS - | Demand 05/03/2007 110592 | (Com4Qlb) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe SS - | Auto 32768 | (EBP Pervasive.SQL) . (...) - C:\PVSW\Bin\WGE_SRV.exe SS - | Demand 21/05/2012 655624 | (FLEXnet Licensing Service) . (.Acresso Software Inc..) - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe SS - | Demand 24/07/2007 181800 | (GameConsoleService) . (.WildTangent, Inc..) - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe SS - | Auto 11/06/2012 116648 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 11/06/2012 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SR - | Auto 19/09/2007 65536 | (HP Health Check Service) . (.Hewlett-Packard.) - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe SS - | Auto 05/12/2007 144688 | (hpqwmiex) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe SS - | Auto 03/10/2007 358936 | (IAANTMON) . (.Intel Corporation.) - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe SS - | Demand 03/04/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe SS - | Demand 09/09/2012 821648 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe SS - | Demand 31/03/2013 115608 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe SS - | Auto 272024 | (RichVideo) . (...) - C:\Program Files\CyberLink\Shared Files\RichVideo.exe SS - | Auto 11/07/2008 328992 | (SentinelKeysServer) . (.SafeNet, Inc..) - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe SS - | Auto 11/07/2008 226592 | (SentinelProtectionServer) . (.SafeNet, Inc.) - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe SS - | Auto 08/01/2013 161536 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe SS - | Demand 13/05/2012 18432 | (wampapache) . (.Apache Software Foundation.) - c:\wamp\bin\apache\apache2.2.22\bin\httpd.exe SS - | Demand 8177664 | (wampmysqld) . (...) - c:\wamp\bin\mysql\mysql5.5.24\bin\mysqld.exe SR - | Auto 21/01/2008 21504 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\WINDOWS\System32\svchost.exe SR - | Auto 21/01/2008 21504 | C:\WINDOWS\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\WINDOWS\System32\svchost.exe SS - | Auto 10/07/2007 386560 | (XAudioService) . (.Conexant Systems, Inc..) - C:\WINDOWS\System32\DRIVERS\xaudio.exe ~ Services: Scanned in 00mn 01s End of the scan (715 lines in 07mn 36s)(0)

g3n-h@ckm@n · Answer

salut branche tous tes perifs , carte infectée compris

Attention !!! : Seuls ces liens sont officiels ne pas telecharger l'outil sur d'autres liens !! 
Attention !!! : cet outil peut etre détecté à tort comme virus 
Attention !!! : cet outil est puissant suivre scrupuleusement les instructions ci-dessous 

tous les processus "non vitaux de windows" vont être coupés , enregistre ton travail. Il y aura une extinction du bureau pendant le scan --> pas de panique. 

Désactive toutes tes protections si possible , antivirus , sandbox , pare-feux , etc....: https://forum.pcastuces.com/default.asp 

telecharge et enregistre Pre_Scan sur ton bureau  : 

http://services.service-webmaster.fr/cpt-clics/clics-30453-6820.html  (renommé winlogon) 

ou , si le lien n'est pas fonctionnel : 

http://www.archive-host.com (renommé winlogon) 
http://www.security-helpzone.com/Tools/g3n/winlogon.exe (renommé winlogon) 

si l'outil est relancé plusieurs fois , il te proposera un menu et qu'aucune option n'est demandée, lance l'option "Scan|Kill" 

si l'outil est bloqué par l'infection utilise cette version avec ces autres extensions : 

http://www.security-helpzone.com/Tools/g3n/Pre_Scan.scr 
http://www.security-helpzone.com/Tools/g3n/Pre_Scan.pif 
http://www.security-helpzone.com/Tools/g3n/Pre_Scan.com 

si l'outil detecte un proxy et que tu n'en as pas installé clique sur "supprimer le proxy" 

Il se peut que des fenêtres noires clignotent , laisse-le travailler. 

l'outil va envoyer sur un serveur les virus qu'il a mis en quarantaine afin que je puisse l'ameliorer et etudier ces infections plus en profondeur. 

Laisse l'outil redemarrer ton pc. 

Poste Pre_Scan_la_date_et_l'heure.txt qui apparaitra  à la racine de ton disque système ( généralement C:\ ) 

NE LE POSTE PAS SUR LE FORUM !!! (il est trop long) 

Heberge le rapport sur https://www.cjoint.com/ puis donne le lien obtenu en echange sur le forum où tu te fais aider  
  
¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤

g3n-h@ckm@n · Answer

pourquoi le service pack 2 n'est-il pas installé sur cette machine ?

======

ok relance l'outil , clique sur diag , heberge le rapport pre_diag et donne le lien

g3n-h@ckm@n · Answer

?

quand tu as fait usbfix tous tes peripheriques usb etaient branchés  ????

g3n-h@ckm@n · Answer

hello

 fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.


&#9654 Télécharge ici :

Malwarebytes  

&#9654 Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

relance malwarebytes en suivant scrupuleusement ces consignes :

! Déconnecte toi et ferme toutes applications en cours !

&#9654 Lance Malwarebyte's .

Fais un examen dit "Complet" .

&#9654 Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
&#9654 à la fin tu cliques sur "résultat" .
&#9654 Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

&#9654 Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !


&#9654 Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

g3n-h@ckm@n · Answer

re

laisse tout branché et suis ce tuto :

 http://www.forum-entraide-informatique.com/support/drweb-cureit-tutoriel-t22.html

¡El Desaparecido! · Answer

Hello ,

C'est dossier ont été créé par toi ? 

H:\zohir
H:\zohireee
H:\savage
H:\savages
G:\applications
G:\applicationss

¡El Desaparecido! · Answer

Envoi le ou les fichier . pif comme  (mokrjf.pif) sur mon serveur stp pour analyse :

http://sosvirus.org/viewtopic.php?f=6&t=489

g3n-h@ckm@n · Answer

re

fais exactement ce qu'El Desaparecido demande pour le moment , je suis le sujet.ne supprime aucun fichier et ne tente rien de ton propre chef.evite de brancher d'autres peripheriques usb (mp3 , mp4 , disques externes , sdCard , etc .... , tout objet branché sera infecté )

merci

¡El Desaparecido! · Answer

T'es infecté par Sality : 
 https://www.virustotal.com/gui/file/2b9f5b93d04dcbd2de6c61516996507af49bfbc9661220530580bd1f1e8725e0

Il va falloir formater l'ordinateur et réinstaller ton système .

Ne pas conserver de fichier .exe .scr .html

g3n-h@ckm@n · Answer

salitykiller peut desinfecter

je suis étonné que drweb n'ai pas desinfecté aussi....

g3n-h@ckm@n · Answer

il etaient connectés ?

g3n-h@ckm@n · Answer

possible de voir le rapport comme demandé ?

lokardz · Answer

nan je trouve pas , voila la screen foto du deusieme resultat 
parceque j'ai fait le scan 2 fois 
http://cjoint.com/data/0Dlxdp2GrC2.htm

la premiere été plein d'infection 
mais la deusieme elle est vide mais toujours il n'a pas scanner mes disque 
je crois qu'il scan les disques interne seulement

g3n-h@ckm@n · Answer

et le rapport de drweb ?

g3n-h@ckm@n · Answer

tu as lu ceci ?

https://forums.commentcamarche.net/forum/affich-27522776-virus-qui-transforme-les-dossier-en-raccourci#27

lokardz · Answer

j'ai scanner le disque amovible avec avira dans un pc clean 

une partition été infecter avec sality j'ai suprrimer les fichier infecter dans un premier scan 

dans le deusieme scan voila le raport 
http://cjoint.com/data/0DnoJWY1Srb.htm

juju666 · Answer

[RESULTAT]  Contient le modèle de détection du virus de script HTML HTML/NetCarto.6913 

Félicitations, si les sites web sont en ligne, ils infestent tous les visiteurs

Tout ça grâce aux cr@cks ....

juju666 · Answer

I:	out\Applications\Firefox Setup 4.0.1.exe  

Sûrement infesté aussi ...
De toute manière ça sert à keudal de conserver des installeurs, surtout un vieux br0l comme lui, on est à la v20 de firefox .... ^^

p · Answer

aprés plusieurs scan avec avira   
voila le rapport  , il détecte rien mais jaimerais savoir s'il y a un anti virus plus performant que avira pour etre sure  qu'il ya pas de virus   

ce rapport est avant dernier  http://cjoint.com/13av/CDAqJPn79Yn.htm  
celui la est le dernier que j'ai fait   http://cjoint.com/13av/CDAqPDuHPAl.htm

juju666 · Answer

Je vais te dire franchement ... 

1) Tu reviens 2 semaines plus tard sans dire bonjour ou merci
2) Tu l'as cherché, Sality ça se chope pas n'importe comment mais via des (faux) cr@cks, tu ne peux t'en prendre qu'à toi même.

A+

summd5 · Answer

La solution est simple,

utiliser ce petit soft efficace et gratuit

http://tec.ong-tn.org/article1/usb-av-antivirus-free

yzack29 · Answer

La solution est simple, 
Si tu veut choper encore plus de virus, oui!!!
Le post date de pratiquement un ans.

Virus qui transforme les dossier en Raccourci

25 réponses

Discussions similaires