Pare feux windows et Microsoft visual c++ runtime library

salut

A tu télécharger un truc un peut douter ces dernier jours ?

Oui dans la précipitation je me suis retrouvé avec "Iminent" ; supprimer par "ajout ou supprimer les pogrammes" .

a tu fait un scan test ?

avec ?

Hello marion

As tu accès à Internet avec un autre navigateur car dudule veut que tu fasse un scan avec adwcleaner et ensuite avec zhpdiag

Je suis grâce à google chrome.
Partante pour refaire un test à mon pc; j'écoute.

Hello marion

Alors c est parti

Regardons déjà si ce n est pas infectieux

* Télécharge ZHPDiag (de Nicolas Coolman)
https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

Au cas où le premier lien ne marcherai pas, clique sur celui de dessous
ftp://zebulon.fr/ZHPDiag2.exe

* Laisse toi guider lors de l'installation, il se lancera automatiquement à la fin.
* Surtout, n'oublie pas d'installer son icône sur le bureau
* Clique sur l'icône représentant une loupe + (« Lancer le diagnostic »)
* Enregistre le rapport sur ton Bureau à l'aide de l'icône représentant une disquette
Pour héberger le rapport, clique sur la flèche bleue ce qui va te diriger vers Pjjoint
pour héberger ce rapport.
Clique sur Parcourir pour chercher le rapport dans ton PC.
Le rapport est sauvegardé dans C:\ZHP\ZHPDiag.txt
Une fois le rapport trouvé, sélectionne le, et clique sur Ouvrir
Clique sur envoyer le fichier, puis poste le lien en bleu qu'on va te fournir.

Hello marion

Oui il y a eu un petit couac mais dudule a géré :)

Par contre c'est moi qui vais te prendre en charge :)

J'attends donc le rapport de Zhpdiag :)

Si problème il y a il existe toujours une solution
N'oubliez pas de mettre votre sujet en résolu :)

Hello

Pourtant ça devrait marcher

Tu es sous xp tu n'as pas besoin de l'exécuter en tant qu'administrateur

Quand tu as l'icône en forme de parchemin sur ton bureau tu n'as plus qu'à double cliquer dessus puis accepter la photo où Nicolas Coolman apparait

Tu as quel antivirus?

Je cliquais sur le raccourcie puis en refusant au bout de la seconde fois ...la page réapparut puis rebloque.
antivir et la pare feux ne fonctionnait pas (toujours pas d'ailleurs) Microsoft security essential.

Hello

Essaie de le faire en mode sans échec

Tapotes F8 au démarrage de windows juste après l'apparition de la page du bios et juste avant le lancement de windows

Je pense qu'il y a quelque chose qui doit bloquer

Mon pc n'apprécie pas trop de chamboulement et avance à son rythme.
Sans échec , le résultat :...suis je obligé de l'afficher sur le site ?

Rapport de ZHPDiag v2013.5.12.105 par Nicolas Coolman, Update du 12/05/2013
Run by CA at 13/05/2013 15:33:52
State : Version à jour.
WhiteList : Enable
High Elevated Privileges : OK
UAC : Not Found

---\\ Web Browser
MSIE: Internet Explorer v8.0.6001.18702 (Defaut)
GCIE: Google Chrome v23.0.1271.97

---\\ Windows Product Information
~ Langage: Français
Windows XP Home Edition Service Pack 3 (Build 2600)
Windows Automatic Updates : OK
Windows Genuine Advantage : KO

---\\ System Protection
Microsoft Security Client v4.2.0223.1

---\\ System Optimizer
CCleaner v3.05 =>Piriform Ltd

---\\ Peer To Peer (P2P)

---\\ Software Update
Adobe Flash Player 11 ActiveX
Adobe Reader X

---\\ System Information
~ Processor: x86 Family 6 Model 13 Stepping 6, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 510 MB (24% free)
System Restore: Activé (Enable)
System drive C: has 12 GB (36%) free of 33 GB

---\\ Logged in mode
~ Computer Name: CLAIRE
~ User Name: CA
~ All Users Names: SUPPORT_388945a0, HelpAssistant, CA, Administrateur,
~ Unselected Option: None
Logged in as Administrator

---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Documents and Settings\CA\Application Data\
~ %Desktop% : C:\Documents and Settings\CA\Bureau\
~ %Favorites% : C:\Documents and Settings\CA\Favoris\
~ %LocalAppData% : C:\Documents and Settings\CA\Local Settings\Application Data\
~ %StartMenu% : C:\Documents and Settings\CA\Menu Démarrer\
~ %Windir% : C:\WINDOWS\
~ %System% : C:\WINDOWS\SYSTEM32\

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 12 Go of 33 Go)
D:\ CD-ROM drive (Not Inserted)
E:\ Hard drive, Flash drive, Thumb drive (Free 2 Go of 4 Go)

---\\ Security Center & Tools Informations
~ Security Center: 30 Legitimates Filtered in 00mn 00s

---\\ Recherche particulière de fichiers génériques
[MD5.F2317622D29F9FF0F88AEECD5F60F0DD] - (.Microsoft Corporation - Explorateur Windows.) (.14/04/2008 - 03:34:03.) -- C:\WINDOWS\Explorer.exe [1037824]
[MD5.48309E1F5ED8E72783EEFBA04898BDA1] - (.Microsoft Corporation - Internet Extensions for Win32.) (.02/03/2013 - 02:55:11.) -- C:\WINDOWS\SYSTEM32\wininet.dll [916480]
[MD5.DD73D6B9F6B4CB630CF35B438B540174] - (.Microsoft Corporation - Application d'ouverture de session Windows NT.) (.14/04/2008 - 03:34:28.) -- C:\WINDOWS\SYSTEM32\Winlogon.exe [512000]
[MD5.1E44BC1E83D8FD2305F8D452DB109CF9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.17/08/2011 - 14:49:54.) -- C:\WINDOWS\sysTEM32\Drivers\AFD.sys [138496]
[MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.13/04/2008 - 19:40:30.) -- C:\WINDOWS\sysTEM32\Drivers\atapi.sys [96512]
[MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/04/2008 - 20:14:21.) -- C:\WINDOWS\sysTEM32\Drivers\Cdfs.sys [63744]
[MD5.1F4260CC5B42272D71F79E570A27A4FE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.13/04/2008 - 19:40:46.) -- C:\WINDOWS\sysTEM32\Drivers\Cdrom.sys [62976]
[MD5.31F923EB2170FC172C81ABDA0045D18C] - (.Microsoft Corporation - Pilote de cryptographie FIPS.) (.14/04/2008 - 02:57:38.) -- C:\WINDOWS\sysTEM32\Drivers\Fips.sys [44672]
[MD5.573C7D0A32852B48F3058CFD8026F511] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.13/04/2008 - 17:36:05.) -- C:\WINDOWS\sysTEM32\Drivers\HDAudBus.sys [144384]
[MD5.A09BDC4ED10E3B2E0EC27BB94AF32516] - (.Microsoft Corporation - Pilote de port i8042.) (.14/04/2008 - 03:00:52.) -- C:\WINDOWS\sysTEM32\Drivers\i8042prt.sys [54144]
[MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.13/04/2008 - 19:40:58.) -- C:\WINDOWS\sysTEM32\Drivers\Imapi.sys [42112]
[MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.13/04/2008 - 19:57:15.) -- C:\WINDOWS\sysTEM32\Drivers\IpNat.sys [152832]
[MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.13/04/2008 - 20:19:42.) -- C:\WINDOWS\sysTEM32\Drivers\IPSec.sys [75264]
[MD5.7D304A5EB4344EBEEAB53A2FE3FFB9F0] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.15/07/2011 - 14:29:31.) -- C:\WINDOWS\sysTEM32\Drivers\MRxSmb.sys [456320]
[MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.13/04/2008 - 20:21:00.) -- C:\WINDOWS\sysTEM32\Drivers\netBT.sys [162816]
[MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.13/04/2008 - 20:15:53.) -- C:\WINDOWS\sysTEM32\Drivers\ntfs.sys [574976]
[MD5.8FD0BDBEA875D06CCF6C945CA9ABAF75] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/04/2008 - 03:09:40.) -- C:\WINDOWS\sysTEM32\Drivers\Parport.sys [80384]
[MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13/04/2008 - 20:19:43.) -- C:\WINDOWS\sysTEM32\Drivers\Rasl2tp.sys [51328]
[MD5.15CABD0F7C00C47C70124907916AF3F1] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.13/04/2008 - 19:32:51.) -- C:\WINDOWS\sysTEM32\Drivers\rdpdr.sys [196224]
[MD5.D8EB2A7904DB6C916EB5361878DDCBAE] - (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) (.14/04/2008 - 02:57:34.) -- C:\WINDOWS\sysTEM32\Drivers\redbook.sys [58752]
[MD5.46DE1126684369BACE4849E4FC8C43CA] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.14/04/2008 - 02:56:04.) -- C:\WINDOWS\sysTEM32\Drivers\volsnap.sys [53376]
~ Generic Processes: Scanned in 00mn 07s

---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 2/213
~ Mes musiques (My Musics) : 1/4
~ Mes Favoris (My Favorites) : 1/197
~ Mes Documents (My Documents) : 0/711
~ Mon Bureau (My Desktop) : 0/1937
~ Menu demarrer (Programs) : 0/37
~ Hidden Files: Scanned in 00mn 39s

---\\ Processus lancés
[MD5.C1F19D2BACBEE9AB64D9AE69E9859AC0] - (.Microsoft Corporation - Antimalware Service Executable.) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456] [PID.1196]
[MD5.B982C2FB580EAA5F9B9FEF5E24A847A2] - (.Intel Corporation - ZeroCfgSvc MFC Application.) -- C:\WINDOWS\system32\ZCfgSvc.exe [360448] [PID.1552]
[MD5.8FE6AB59CAB8F2C038FEA9522A5EEBA7] - (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.exe [113664] [PID.468]
[MD5.5E06A9D23727DAF96FAA796F1135FDCD] - (.Sun Microsystems, Inc. - Java(TM) Quick Starter Service.) -- C:\Program Files\Java\jre6\bin\jqs.exe [153376] [PID.532]
[MD5.11F714F85530A2BD134074DC30E99FCA] - (.Microsoft Corporation - Machine Debug Manager.) -- C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.exe [322120] [PID.548]
[MD5.F02A533F517EB38333CB12A9E8963773] - (.Google Inc. - Programme d'installation de Google.) -- C:\Program Files\Google\Update\GoogleUpdate.exe [136176] [PID.556]
[MD5.B29EF836368AE9873A6F8F8E021CD148] - (.Microsoft Corporation - MsCamSvc.exe.) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe [240408] [PID.592]
[MD5.F036CFB275D0C55F4E45FBBF5F98B3C8] - (.Protexis Inc. - PsiService PsiService.) -- C:\Program Files\Fichiers communs\Protexis\License Service\PsiService_2.exe [193824] [PID.664]
[MD5.F50C447C15A25DC960A8C8BB86A3B2B4] - (.Alps Electric Co., Ltd. - Alps Pointing-device Driver.) -- C:\Program Files\Apoint\Apoint.exe [155648] [PID.3588]
[MD5.B434B19E717A4E6E8DE708008B55B7F9] - (.Dell - Advanced Desktop Engineering - DVDSentry.) -- C:\WINDOWS\system32\DSentry.exe [28672] [PID.3772]
[MD5.BE3238A165AFB321F1696CC1FF9EF271] - (.Roxio - DirectCD Application.) -- C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe [684032] [PID.3848]
[MD5.98ED4651EDC8112C943A885108D3F509] - (.Microsoft Corporation - Microsoft LifeCam Device Application.) -- C:\WINDOWS\vVX3000.exe [707360] [PID.3908]
[MD5.01018F75F3F18CE629FAC9689954A2AE] - (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe [77824] [PID.3960]
[MD5.996ABAC2332DE28F3B6A179C6DA20205] - (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe [114688] [PID.3972]
[MD5.98B93FD3A8F8D140B18D414014C5F929] - (.Intel Corporation - igfxsrvc Module.) -- C:\WINDOWS\system32\igfxsrvc.exe [159744] [PID.4000]
[MD5.8DDA2B606279753601F9415DA503CA63] - (.Apple Inc. - QuickTime Task.) -- C:\Program Files\QuickTime\QTTask.exe [421888] [PID.728]
[MD5.0AA31DE4E40861EAF259D194A58D4317] - (.Alps Electric Co., Ltd. - Alps Pointing-device Driver for Windows NT/.) -- C:\Program Files\Apoint\Apntex.exe [45056] [PID.1832]
[MD5.16DCC8ACC504A6662BB04A0ED9454A4D] - (.SFR - Propriétés de la connexion SFR.) -- C:\Program Files\SFR\Kit\9props.exe [959808] [PID.2148]
[MD5.F920FBB43C1CDB905044C91B9A3FD516] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe [18643560] [PID.2388]
[MD5.2D08AC1443FFA7FBED9A5EA5FD49AEB3] - (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe [1242728] [PID.2876]
[MD5.0411F7EE63AE48D2918AB4F2C79AB6C4] - (.Microsoft Corporation - Windows® installer.) -- C:\WINDOWS\system32\msiexec.exe [78848] [PID.1108]
[MD5.C5A75EB48E2344ABDC162BDA79E16841] - (.Microsoft Corporation - .NET Runtime Optimization Service.) -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [130384] [PID.2540]
[MD5.2E0B0A051FFAA86E358465BB0880D453] - (.Microsoft Corporation - Windows Update.) -- C:\WINDOWS\system32\wuauclt.exe [53784] [PID.1280]
[MD5.FE30E4DC9D03AF450FE9E944BCA6DFEB] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag2\ZHPDiag.exe [7326208] [PID.2884]
~ Processes Running: Scanned in 00mn 47s

---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences
G0 - GCSP: Preference [User Data\Default] http://www2.delta-search.com =>Toolbar.DeltaSearch
G1 - GCS: Preference [User Data\Default] http://www2.delta-search.com =>Toolbar.DeltaSearch
G2 - GCE: Preference [User Data\Default] [cnmdgidklhhnmppphpohildcefnaaflp] Services x86 v.1.23.52 (Activé) =>PUP.CrossRider
G2 - GCE: Preference [User Data\Default] [eooncjejnppfjjklapaamhcdmjbilmde] Delta Toolbar v.1.3 (Activé)
G2 - GCE: Preference [User Data\Default] [pbpohikckhbcljgombipcdoinkaedlfa] Smart Display v.1.4 (Activé) =>Spyware.SmartDisplay
~ Google Browser: 9 Legitimates Filtered in 00mn 06s

---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
P2 - FPN: [HKLM] [@www.dlmanager.net/omaha/tools//Software Update;version=8] - (.Boxore OU. - Software Update.) -- C:\Program Files\Software\Update\1.2.201.0\npSoftwareOneClick8.dll =>Adware.Boxore
P2 - FPN: [HKCU] [boxore.com/BoxorePlugin] - (...) -- C:\Program Files\Boxore\BoxoreClient\BoxorePlugin\1.0.0.1\npBoxorePlugin.dll (.not file.) =>Adware.Boxore
~ Firefox Browser: 10 Legitimates Filtered in 00mn 01s

---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www2.delta-search.com =>Toolbar.DeltaSearch
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs = http://www2.delta-search.com =>Toolbar.DeltaSearch
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (...) (No version) -- (.not file.)
~ IE Browser: 13 Legitimates Filtered in 00mn 00s

---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s

---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\WINDOWS\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Keys: Scanned in 00mn 00s

---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 1

---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: CrossriderApp0027096 - {11111111-1111-1111-1111-110211701196} . (.Corporate Inc - Services x86 BHO.) -- C:\Program Files\Services x86\Services x86-bho.dll =>PUP.CrossRider
O2 - BHO: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} . (.Delta-search.com - Pas de description.) -- C:\Program Files\Delta\delta\1.8.16.16\bh\delta.dll =>Toolbar.DeltaSearch
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} . (.SEIKO EPSON CORPORATION - EPSON Web-To-Page.) -- C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
~ BHO: 14 Legitimates Filtered in 00mn 05s

---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: MSN - [HKLM]{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} . (.Microsoft Corporation - MSN Toolbar extension.) -- C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: EPSON Web-To-Page - [HKLM]{EE5D279F-081B-4404-994D-C6B60AAEBA6D} . (.SEIKO EPSON CORPORATION - EPSON Web-To-Page.) -- C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: WOT - [HKLM]{71576546-354D-41c9-AAE8-31F2EC22BF0D} . (...) -- C:\Program Files\WOT\WOT.dll
O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Delta Toolbar - [HKLM]{82E1477C-B154-48D3-9891-33D83C26BCD3} . (.Delta-search.com - Pas de description.) -- C:\Program Files\Delta\delta\1.8.16.16\deltaTlbr.dll =>Toolbar.DeltaSearch
~ Toolbar: Scanned in 00mn 01s

---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [Apoint] . (.Alps Electric Co., Ltd. - Alps Pointing-device Driver.) -- C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [DVDSentry] . (.Dell - Advanced Desktop Engineering - DVDSentry.) -- C:\WINDOWS\system32\DSentry.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] . (.Roxio - DirectCD Application.) -- C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [VX3000] . (.Microsoft Corporation - Microsoft LifeCam Device Application.) -- C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] . (.Microsoft Corporation - LifeExp.exe.) -- C:\Program Files\Microsoft LifeCam\LifeExp.exe
O4 - HKLM\..\Run: [igfxtray] . (.Intel Corporation - igfxTray Module.) -- C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] . (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] . (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe
O4 - HKLM\..\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- C:\Program Files\QuickTime\QTTask.exe
O4 - HKLM\..\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKCU\..\Run: [Connexion SFR 9props.exe] . (.SFR - Propriétés de la connexion SFR.) -- C:\Program Files\SFR\Kit\9props.exe
O4 - HKCU\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.exe
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] . (.Microsoft Corporation - Watson Subscriber for SENS Network Notifica.) -- C:\Program Files\Fichiers communs\Microsoft Shared\DW\DWTRIG20.exe
O4 - HKUS\S-1-5-21-1613070322-1123952881-1719806338-1006\..\Run: [Connexion SFR 9props.exe] . (.SFR - Propriétés de la connexion SFR.) -- C:\Program Files\SFR\Kit\9props.exe
O4 - HKUS\S-1-5-21-1613070322-1123952881-1719806338-1006\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-21-1613070322-1123952881-1719806338-1006\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-1613070322-1123952881-1719806338-1006\..\Run: [EPSON Stylus DX4400 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.exe
O4 - HKUS\S-1-5-21-1613070322-1123952881-1719806338-1006\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe
~ Application: Scanned in 00mn 04s

---\\ Autres liens utilisateurs (O4)
O4 - GS\Programs: Adobe Reader X.lnk . (...) -- C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-AA1000000001}\SC_Reader.ico
O4 - GS\Programs: Apple Software Update.lnk . (...) -- C:\WINDOWS\Installer\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}\AppleSoftwareUpdateIco.exe
O4 - GS\Programs: Corel WinDVD 2010.lnk . (.Corel Corporation - WinDVD.) -- C:\Program Files\Corel\CorelWinDVD2010\WinDVD.exe
O4 - GS\Programs: Gravure de CD & DVD avec Roxio.lnk . (.Roxio - Roxio Create CD.) -- C:\Program Files\Fichiers communs\Adaptec Shared\CreateCD\CreateCD50.exe
O4 - GS\Programs: Microsoft Security Essentials.lnk . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- C:\Program Files\Microsoft Security Client\msseces.exe
O4 - GS\Programs: Windows Messenger.lnk . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe
O4 - GS\Programs: Windows Movie Maker.lnk . (.Microsoft Corporation - Windows Movie Maker.) -- C:\Program Files\Movie Maker\moviemk.exe
O4 - GS\Programs: Assistance à distance.lnk . (.Microsoft Corporation - Assistance à distance Microsoft.) -- C:\WINDOWS\SYSTEM32\rcimlby.exe
O4 - GS\Programs: Installation du Contrôle Parental.lnk . (.InstallShield Software Corporation - InstallShield (R) Setup Launcher.) -- C:\Program Files\Securitoo\Contrôle Parental\securitoo_controle_parental.exe
O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Programs: Outlook Express.lnk . (.Microsoft Corporation - Outlook Express.) -- C:\Program Files\Outlook Express\msimn.exe
O4 - GS\Programs: Webplayer.lnk . (...) -- C:\Documents and Settings\CA\Application Data\Microsoft\Installer\{9937E55B-6331-4804-93EF-77E992F204BD}\_3F7CDAE07E1639C4AEA7A8.exe
O4 - GS\Programs: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe
~ Global Startup: Scanned in 00mn 05s

---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} . (.Microsoft Corporation - Windows Live Writer Blog This Extension.) -- C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\OFFICE11\REFBARH.ICO
O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -- Clé orpheline
O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe
~ IE Extra Buttons: Scanned in 00mn 00s

---\\ Winsock hijacker (Layered Service Provider) (O10)
O10 - Broken Internet access because of LSP provider (.not file.) -- mswsock.dll
~ Winsock: 3 Legitimates Filtered in 00mn 00s

---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} ((no name)) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} ((no name)) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1367055297660
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} ((no name)) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} ((no name)) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
~ Objets ActiveX: Scanned in 00mn 00s

---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{AB77CB5D-D854-40B3-8A39-5DF2822F2889}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{AB77CB5D-D854-40B3-8A39-5DF2822F2889}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{AB77CB5D-D854-40B3-8A39-5DF2822F2889}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 01s

---\\ Protocole additionnel (O18)
O18 - Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} . (...) -- C:\Program Files\WOT\WOT.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.dll
~ Protocole Additionnel: Scanned in 00mn 01s

---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\SYSTEM32\crypt32.dll
O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\SYSTEM32\cryptnet.dll
O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agent réseau hors connexion.) -- C:\WINDOWS\SYSTEM32\cscdll.dll
O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\SYSTEM32\dimsntfy.dll
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\SYSTEM32\wlnotify.dll
O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\SYSTEM32\wlnotify.dll
O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL secondaire de notification de service d.) -- C:\WINDOWS\SYSTEM32\sclgntfy.dll
O20 - Winlogon Notify: Sebring . (.Intel Corporation - LogonNotify DLL.) -- C:\WINDOWS\system32\LgNotify.dll
O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\SYSTEM32\WlNotify.dll
O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\SYSTEM32\wlnotify.dll
O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\SYSTEM32\wlnotify.dll
~ Winlogon: Scanned in 00mn 01s

---\\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Desktop General: BackupWallPaper - .(...) - C:\Documents and Settings\CA\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop General: WallPaper - .(...) - C:\Documents and Settings\CA\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
~ Desktop Component: 4 Legitimates Filtered in 00mn 00s

---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\EPUpdater.job [254]
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\MpIdleTask.job [366]
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\SoftwareUpdateTaskMachineCore.job [1062]
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\SoftwareUpdateTaskMachineUA.job [1066]
~ Scheduled Task: 10 Legitimates Filtered in 00mn 00s

---\\ Pilotes lancés au démarrage (O41)
O41 - Driver: (omci) . (.Dell Inc - OMCI Device Driver.) - C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys
~ Drivers: 60 Legitimates Filtered in 00mn 03s

---\\ Logiciels installés (O42)
O42 - Logiciel: Boxore Client - (.Boxore OU.) [HKLM] -- {EA69DAE1-1BC2-48ED-AB9A-24A5C8AC8071} =>Adware.Boxore
O42 - Logiciel: Delta toolbar - (.Delta.) [HKLM] -- delta
O42 - Logiciel: QuickSet - (...) [HKLM] -- {C5074CC4-0E26-4716-A307-960272A90040}
O42 - Logiciel: Services x86 - (.Corporate Inc.) [HKLM] -- Services x86 =>PUP.CrossRider
O42 - Logiciel: Webplayer - (.Kreapixel.) [HKLM] -- {9937E55B-6331-4804-93EF-77E992F204BD} =>Adware.SocialSkinz
~ Logic: 105 Legitimates Filtered in 00mn 04s

---\\ HKCU & HKLM Software Keys
[HKCU\Software\BabylonToolbar] =>Toolbar.Babylon
[HKCU\Software\Crossrider] =>PUP.CrossRider
[HKCU\Software\DVision]
[HKCU\Software\DataMngr] =>PUP.Datamngr
[HKCU\Software\DataMngr_Toolbar] =>PUP.Datamngr
[HKCU\Software\Delta]
[HKCU\Software\Iminent] =>Adware.IMBooster
[HKCU\Software\InstalledBrowserExtensions] =>Adware.VidSaver
[HKCU\Software\OnlyScreenSavers]
[HKCU\Software\Pol]
[HKCU\Software\QuickSearch]
[HKCU\Software\Services x86] =>PUP.CrossRider
[HKCU\Software\Softonic]
[HKCU\Software\UselessCreations]
[HKCU\Software\eZula]
[HKLM\Software\5f68dd1e56fec10]
[HKLM\Software\Babylon] =>Toolbar.Babylon
[HKLM\Software\DataMngr] =>PUP.Datamngr
[HKLM\Software\Delta]
[HKLM\Software\Editions eni]
[HKLM\Software\Iminent] =>Adware.IMBooster
[HKLM\Software\QuickSearch]
[HKLM\Software\S24Trans]
[HKLM\Software\Symbol Technologies, Inc.]
[HKLM\Software\UselessCreations]
~ Key Software: 191 Legitimates Filtered in 00mn 04s

---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 24/04/2013 - 10:30:32 - [0] ----D C:\Program Files\Boxore =>Adware.Boxore
O43 - CFD: 08/05/2013 - 11:26:48 - [2,786] ----D C:\Program Files\Delta
O43 - CFD: 08/05/2013 - 13:52:28 - [0,663] ----D C:\Program Files\Iminent =>Adware.IMBooster
O43 - CFD: 19/03/2011 - 18:08:07 - [0] -S-AD C:\Program Files\QuickSearch
O43 - CFD: 08/05/2013 - 11:25:58 - [4,447] ----D C:\Program Files\Services x86 =>PUP.CrossRider
O43 - CFD: 03/06/2005 - 21:59:27 - [0] ----D C:\Program Files\UselessCreations
O43 - CFD: 08/05/2013 - 11:27:01 - [1,932] ----D C:\Documents and Settings\CA\Application Data\BabSolution =>Hijacker.BabSolution
O43 - CFD: 08/05/2013 - 11:25:13 - [0,010] ----D C:\Documents and Settings\CA\Application Data\Babylon =>Toolbar.Babylon
O43 - CFD: 08/05/2013 - 11:27:29 - [0,259] ----D C:\Documents and Settings\CA\Application Data\Delta
O43 - CFD: 26/04/2013 - 13:26:13 - [0,187] ----D C:\Documents and Settings\CA\Local Settings\Application Data\APN
O43 - CFD: 23/01/2012 - 13:29:49 - [0,115] ----D C:\Documents and Settings\CA\Local Settings\Application Data\xdg
O43 - CFD: 03/06/2005 - 21:42:12 - [0,000] ----D C:\Documents and Settings\CA\Menu Démarrer\Programmes\UselessCreations
~ Program Folder: 150 Legitimates Filtered in 07mn 10s

---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.8FEFC6B278AC3D37994923A56DCCC75E] - 13/05/2013 - 09:12:45 ---A- . (...) -- C:\WINDOWS\ModemLog_Conexant D480 MDC V.9x Modem.txt [4824]
O44 - LFC:[MD5.450A760F65859079EF71EE78848F506F] - 13/05/2013 - 09:12:43 ---A- . (...) -- C:\WINDOWS\WIADEBUG.LOG [159]
O44 - LFC:[MD5.640DFEBF2FA2BBF411CFEB4577CDB3CD] - 13/05/2013 - 09:12:42 ---A- . (...) -- C:\WINDOWS\WIASERVC.LOG [50]
O44 - LFC:[MD5.26A5C0E3F6077217019CC8F12B32E423] - 08/05/2013 - 13:07:04 ---A- . (...) -- C:\WINDOWS\nsw.log [439]
O44 - LFC:[MD5.87074870AE168D1487B92A1F85F7C07C] - 08/05/2013 - 12:43:25 ---A- . (...) -- C:\WINDOWS\SYSTEM32\InstallUtil.InstallLog [918]
~ Files: 17 Legitimates Filtered in 01mn 20s

---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.93D89CB336ABAE5A0C4ADB9E50D9E6C0] - 13/05/2013 - 09:15:14 ---A- - C:\WINDOWS\Prefetch\DSENTRY.EXE-28A3C4CF.pf
O45 - LFCP:[MD5.227E90B3215EEB4FD999E23A31249C62] - 13/05/2013 - 09:15:15 ---A- - C:\WINDOWS\Prefetch\DIRECTCD.EXE-0582AB76.pf
O45 - LFCP:[MD5.175566B2C9496C42AB9CB585FAB3C130] - 20/04/2013 - 09:00:03 ---A- - C:\WINDOWS\Prefetch\BOXORE.EXE-2493A27E.pf =>Adware.Boxore
O45 - LFCP:[MD5.F85C4F5BD9DC730AE80595A59EF7CB45] - 20/04/2013 - 09:39:06 ---A- - C:\WINDOWS\Prefetch\0.6520299498656472.BFG-10A8008E.pf
O45 - LFCP:[MD5.7656EA411B799AE866E71BFEFD3DFB33] - 20/04/2013 - 09:39:48 ---A- - C:\WINDOWS\Prefetch\2527684.EXE-160F2DCD.pf
O45 - LFCP:[MD5.849D73DAA66B9D5974FFE289D1DE2A59] - 20/04/2013 - 09:39:54 ---A- - C:\WINDOWS\Prefetch\SYSHOST.EXE-2DFBD205.pf
O45 - LFCP:[MD5.9867D7AD0DF29B3D1BE718F2E5F160D3] - 20/04/2013 - 09:40:04 ---A- - C:\WINDOWS\Prefetch\2534604.EXE-3258BC14.pf
O45 - LFCP:[MD5.CA50143A64E63CEB199BA74D4A770E1D] - 23/04/2013 - 13:25:04 ---A- - C:\WINDOWS\Prefetch\SOFTWARECRASHHANDLER.EXE-0425ECA6.pf
~ Prefetcher: 94 Legitimates Filtered in 00mn 09s

---\\ Opérations et fonctions au démarrage de Windows Explorer (O46)
O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll
~ ShellExecuteHooks: Scanned in 00mn 00s

---\\ Image File Execution Options (IFEO) (O50)
O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d
~ IFEO: Scanned in 00mn 00s

---\\ Liste des Drivers Système (O58)
O58 - SDL:[MD5.1140AB9938809700B46BB88E46D72A96] - 17/08/2001 - 22:51:56 ---A- . (.Acer Laboratories Inc. - ALi mini IDE Driver.) -- C:\WINDOWS\SYSTEM32\Drivers\ALIIDE.SYS [5248]
O58 - SDL:[MD5.6D3ADA4CE95CECA7BCE527A08C4C474E] - 05/08/2004 - 13:00:00 ---A- . (...) -- C:\WINDOWS\SYSTEM32\ANSI.SYS [9037]
~ Drivers: Scanned in 00mn 01s

---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 13/05/2013 - 09:12:38 -SHA- C:\Documents and Settings\CA\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-1613070322-1123952881-1719806338-1006\Credentials [2586]
O61 - LFC: 13/05/2013 - 09:12:38 -SHA- C:\Documents and Settings\CA\Local Settings\DESKTOP.INI [62]
O61 - LFC: 13/05/2013 - 09:14:48 ---A- C:\Documents and Settings\CA\SendTo\Unité DirectCD (D).lnk [183]
O61 - LFC: 13/05/2013 - 09:20:05 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Toolbar Cache\7.4.3607.2246\fr\translate_element.js.content [2337]
O61 - LFC: 13/05/2013 - 11:07:49 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension State\CURRENT [16]
O61 - LFC: 13/05/2013 - 11:07:49 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension State\MANIFEST-000002 [50]
O61 - LFC: 13/05/2013 - 11:07:57 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Archived History [57344]
O61 - LFC: 13/05/2013 - 11:07:57 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Archived History-journal [512]
O61 - LFC: 13/05/2013 - 11:07:58 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Visited Links [131072]
O61 - LFC: 13/05/2013 - 11:08:14 ----- C:\Documents and Settings\CA\IETldCache\index.dat [262144]
O61 - LFC: 13/05/2013 - 11:08:22 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Managed Mode Settings [8]
O61 - LFC: 13/05/2013 - 11:08:23 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde\1.3_0\BUSolution.dll [691792]
O61 - LFC: 13/05/2013 - 11:08:23 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde\1.3_0\BabMaint.x [9808]
O61 - LFC: 13/05/2013 - 11:08:23 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde\1.3_0\NPObject.dll [126976]
O61 - LFC: 13/05/2013 - 11:08:23 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde\1.3_0\bg.html [202]
O61 - LFC: 13/05/2013 - 11:08:23 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde\1.3_0\bg.js [400]
O61 - LFC: 13/05/2013 - 11:08:23 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde\1.3_0\redirect.html [189]
O61 - LFC: 13/05/2013 - 11:08:23 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde\1.3_0\redirect.js [357]
O61 - LFC: 13/05/2013 - 11:08:26 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde\1.3_0\manifest.json [748]
O61 - LFC: 13/05/2013 - 11:08:26 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\History Provider Cache [608]
O61 - LFC: 13/05/2013 - 11:08:34 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\http_www.google.fr_0.localstorage [3072]
O61 - LFC: 13/05/2013 - 11:08:34 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\http_www.google.fr_0.localstorage-journal [512]
O61 - LFC: 13/05/2013 - 11:08:34 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Session Storage\CURRENT [16]
O61 - LFC: 13/05/2013 - 11:08:34 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000002 [50]
O61 - LFC: 13/05/2013 - 11:08:41 ---A- C:\Documents and Settings\CA\Application Data\BabSolution\Shared\chu.js [501] =>Hijacker.BabSolution
O61 - LFC: 13/05/2013 - 11:08:44 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pbpohikckhbcljgombipcdoinkaedlfa\1.4_0\background.js [904]
O61 - LFC: 13/05/2013 - 11:08:44 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pbpohikckhbcljgombipcdoinkaedlfa\1.4_0\manifest.json [992]
O61 - LFC: 13/05/2013 - 11:08:44 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pbpohikckhbcljgombipcdoinkaedlfa\1.4_0\smartdisplay.js [936]
O61 - LFC: 13/05/2013 - 11:08:44 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pbpohikckhbcljgombipcdoinkaedlfa\1.4_0\utils.html [823]
O61 - LFC: 13/05/2013 - 11:08:44 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\databases\Databases.db [7168]
O61 - LFC: 13/05/2013 - 11:08:44 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\databases\Databases.db-journal [5672]
O61 - LFC: 13/05/2013 - 11:08:49 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\README [180]
O61 - LFC: 13/05/2013 - 11:08:50 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\background.html [1080]
O61 - LFC: 13/05/2013 - 11:08:50 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\crossriderManifest.json [368] =>PUP.CrossRider
O61 - LFC: 13/05/2013 - 11:08:51 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\api\chrome.js [12232]
O61 - LFC: 13/05/2013 - 11:08:51 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\api\cookie.js [11793]
O61 - LFC: 13/05/2013 - 11:08:51 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\api\message.js [3187]
O61 - LFC: 13/05/2013 - 11:08:51 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\app\background.js [137391]
O61 - LFC: 13/05/2013 - 11:08:52 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\app\extension.js [681806]
O61 - LFC: 13/05/2013 - 11:08:52 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\background.js [43967]
O61 - LFC: 13/05/2013 - 11:08:52 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\lib\app_api.js [5584]
O61 - LFC: 13/05/2013 - 11:08:52 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\lib\async_api.js [2707]
O61 - LFC: 13/05/2013 - 11:08:52 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\lib\bg_app_api.js [4402]
O61 - LFC: 13/05/2013 - 11:08:52 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\lib\cookie_store.js [5618]
O61 - LFC: 13/05/2013 - 11:08:52 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\lib\crossriderAPI.js [11136] =>PUP.CrossRider
O61 - LFC: 13/05/2013 - 11:08:52 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\lib\data_store.js [6507]
O61 - LFC: 13/05/2013 - 11:08:52 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\lib\delegate.js [1880]
O61 - LFC: 13/05/2013 - 11:08:52 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\lib\events.js [5467]
O61 - LFC: 13/05/2013 - 11:08:52 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\lib\logging.js [937]
O61 - LFC: 13/05/2013 - 11:08:52 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\lib\onBGDocumentLoad.js [1075]
O61 - LFC: 13/05/2013 - 11:08:52 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\lib\popupResource\newPopup.js [40]
O61 - LFC: 13/05/2013 - 11:08:52 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\lib\popupResource\popup.js [45]
O61 - LFC: 13/05/2013 - 11:08:52 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\lib\reports.js [3446]
O61 - LFC: 13/05/2013 - 11:08:52 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\lib\util.js [347]
O61 - LFC: 13/05/2013 - 11:08:52 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\js\lib\xhr.js [2370]
O61 - LFC: 13/05/2013 - 11:08:52 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\manifest.json [1194]
O61 - LFC: 13/05/2013 - 11:08:52 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp\1.23.52_0\popup.html [139]
O61 - LFC: 13/05/2013 - 11:09:06 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\databases\chrome-extension_cnmdgidklhhnmppphpohildcefnaaflp_0\4 [707584]
O61 - LFC: 13/05/2013 - 11:10:09 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cnmdgidklhhnmppphpohildcefnaaflp_0.localstorage [3072]
O61 - LFC: 13/05/2013 - 11:10:09 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cnmdgidklhhnmppphpohildcefnaaflp_0.localstorage-journal [3608]
O61 - LFC: 13/05/2013 - 11:10:40 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\QuotaManager [13312]
O61 - LFC: 13/05/2013 - 11:10:40 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\QuotaManager-journal [8768]
O61 - LFC: 13/05/2013 - 11:29:13 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data [12288]
O61 - LFC: 13/05/2013 - 11:29:13 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data-journal [512]
O61 - LFC: 13/05/2013 - 11:52:58 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\http_www.larepubliquedespyrenees.fr_0.localstorage [3072]
O61 - LFC: 13/05/2013 - 11:52:58 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\http_www.larepubliquedespyrenees.fr_0.localstorage-journal [3608]
O61 - LFC: 13/05/2013 - 12:06:36 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\http_c.betrad.com_0.localstorage [74752]
O61 - LFC: 13/05/2013 - 12:06:36 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\http_c.betrad.com_0.localstorage-journal [3608]
O61 - LFC: 13/05/2013 - 12:06:39 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\http_www.commentcamarche.net_0.localstorage [3072]
O61 - LFC: 13/05/2013 - 12:06:39 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\http_www.commentcamarche.net_0.localstorage-journal [512]
O61 - LFC: 13/05/2013 - 12:14:08 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Certificate Revocation Lists [271217]
O61 - LFC: 13/05/2013 - 12:27:31 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\http_staticf.dealply.com_0.localstorage [3072] =>PUP.DealPly
O61 - LFC: 13/05/2013 - 12:27:31 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\http_staticf.dealply.com_0.localstorage-journal [512] =>PUP.DealPly
O61 - LFC: 13/05/2013 - 12:46:11 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\https_halc.iadvize.com_0.localstorage [3072]
O61 - LFC: 13/05/2013 - 12:46:11 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\https_halc.iadvize.com_0.localstorage-journal [3608]
O61 - LFC: 13/05/2013 - 12:47:22 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data [92160]
O61 - LFC: 13/05/2013 - 12:47:22 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data-journal [16384]
O61 - LFC: 13/05/2013 - 12:52:55 ----- C:\Documents and Settings\CA\IECompatCache\index.dat [16384]
O61 - LFC: 13/05/2013 - 12:52:55 ---A- C:\Documents and Settings\CA\PrivacIE\index.dat [16187392]
O61 - LFC: 13/05/2013 - 13:08:28 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\http_telechargement.zebulon.fr_0.localstorage [3072]
O61 - LFC: 13/05/2013 - 13:08:28 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\http_telechargement.zebulon.fr_0.localstorage-journal [3608]
O61 - LFC: 13/05/2013 - 13:12:34 ---A- C:\Documents and Settings\CA\Mes documents\Downloads\FileConverter_1.5.exe [1315168]
O61 - LFC: 13/05/2013 - 13:20:50 ---A- C:\Documents and Settings\CA\Bureau\Raccourci vers ZHPDiag2.lnk [893]
O61 - LFC: 13/05/2013 - 13:26:06 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\TransportSecurity [281]
O61 - LFC: 13/05/2013 - 13:32:38 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Shortcuts [12288]
O61 - LFC: 13/05/2013 - 13:32:39 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Shortcuts-journal [8720]
O61 - LFC: 13/05/2013 - 13:32:45 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Network Action Predictor [83968]
O61 - LFC: 13/05/2013 - 13:32:46 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Network Action Predictor-journal [16384]
O61 - LFC: 13/05/2013 - 14:00:03 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\https_dub118.mail.live.com_0.localstorage [3072]
O61 - LFC: 13/05/2013 - 14:00:03 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\https_dub118.mail.live.com_0.localstorage-journal [3608]
O61 - LFC: 13/05/2013 - 14:27:51 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Top Sites [139264]
O61 - LFC: 13/05/2013 - 14:27:51 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Top Sites-journal [12824]
O61 - LFC: 13/05/2013 - 14:29:07 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\History [212992]
O61 - LFC: 13/05/2013 - 14:29:08 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Favicons [73728]
O61 - LFC: 13/05/2013 - 14:29:08 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Favicons-journal [16384]
O61 - LFC: 13/05/2013 - 14:29:08 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\History-journal [16384]
O61 - LFC: 13/05/2013 - 14:29:10 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\History Index 2013-05 [790528]
O61 - LFC: 13/05/2013 - 14:29:10 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\History Index 2013-05-journal [16384]
O61 - LFC: 13/05/2013 - 14:29:11 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\databases\chrome-extension_cnmdgidklhhnmppphpohildcefnaaflp_0\3 [15360]
O61 - LFC: 13/05/2013 - 14:34:01 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences [77505]
O61 - LFC: 13/05/2013 - 14:41:46 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Safe Browsing Cookies [6144]
O61 - LFC: 13/05/2013 - 14:41:47 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Safe Browsing Cookies-journal [4640]
O61 - LFC: 13/05/2013 - 14:42:06 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Safe Browsing Download [1747048]
O61 - LFC: 13/05/2013 - 14:42:19 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Safe Browsing Bloom [7755928]
O61 - LFC: 13/05/2013 - 14:42:22 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Safe Browsing Bloom Prefix Set [1362592]
O61 - LFC: 13/05/2013 - 14:42:24 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Safe Browsing Csd Whitelist [134920]
O61 - LFC: 13/05/2013 - 14:42:24 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Safe Browsing Download Whitelist [19972]
O61 - LFC: 13/05/2013 - 14:48:18 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Local State [19095]
O61 - LFC: 13/05/2013 - 14:50:02 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies [102400]
O61 - LFC: 13/05/2013 - 14:50:02 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Cookies-journal [16384]
O61 - LFC: 13/05/2013 - 14:50:30 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\https_secure.shared.live.com_0.localstorage [3072]
O61 - LFC: 13/05/2013 - 14:50:30 ---A- C:\Documents and Settings\CA\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\https_secure.shared.live.com_0.localstorage-journal [3608]
~ 16 Fichiers temporaires (Temporary files)
~ 9 Fichiers cookies (Cookies files)
~ Files: 446 Legitimates Filtered in 10mn 44s

---\\ Liste des outils de nettoyage (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
~ ADS: Scanned in 00mn 00s

---\\ Liste des services Legacy (O64)
O64 - Services: CurCS - ??\??\???? - Pas de propriétaire (58ee5488b34f299b) .(...) - LEGACY_58EE5488B34F299B
O64 - Services: CurCS - 19/11/2004 - C:\WINDOWS\SYSTEM32\DRIVERS\mdc8021x.sys (MDC8021X) .(.Meetinghouse Data Communications - IEEE 802.1X Protocol Driver.) - LEGACY_MDC8021X
O64 - Services: CurCS - 29/04/2003 - C:\Program Files\Intel\NCS\Sync\NetSvc.exe (NetSvc) .(.Intel(R) Corporation - NetSvc Module.) - LEGACY_NETSVC
~ Legacy: 221 Legitimates Filtered in 00mn 17s

---\\ File Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <htmlfile>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 17 Legitimates Filtered in 00mn 01s

---\\ Start Menu Internet (O68)
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s

---\\ Search Browser Infection (O69)
O69 - SBI: SearchScopes [HKCU] {050D8EC1-A880-4D6E-A6F2-8F71465DADEE} [DefaultScope] - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - () - https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8
O69 - SBI: SearchScopes [HKCU] {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} - (Delta Search) - http://www2.delta-search.com =>Toolbar.DeltaSearch
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Google) - https://www.google.com/?gws_rd=ssl
O69 - SBI: SearchScopes [HKCU] {7B5FAB87-0010-4486-A970-80ADABD9835D} - (Live Search) - https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8
O69 - SBI: SearchScopes [HKCU] {7F6CB4E7-59AE-4FFC-B0C1-E937785AAD1E} - (Ask Search) - http://www.search.ask.com/?o=10148&l=dis
~ Keys: Scanned in 00mn 02s

---\\ Recherche particuliere à la racine de certains dossiers (O84)
[MD5.1457AC385ABBCD30BF1FFF4C1E32C74C] [SPRF][27/04/2013] (...) -- C:\Documents and Settings\All Users\Application Data\9CE767842D.sys [88]
[MD5.7B66BF789188497A76B504D88A644A75] [SPRF][27/04/2013] (...) -- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys [2828]
[MD5.280BDB621A900E99D3BA6BC328FC1CC8] [SPRF][20/08/2004] (...) -- C:\Documents and Settings\CA\Local Settings\Application Data\fusioncache.dat [135]
[MD5.1A07D96FCC4DA3C7E32E1C3F548AD71D] [SPRF][16/04/2012] (.Microsoft Corporation - Pas de description.) -- C:\Documents and Settings\CA\Bureau\OutlookConnector.exe [4578656]
[MD5.9E5AB1B36629D90DAAD69FC4C5137C2D] [SPRF][15/04/2011] (.Microsoft Corporation - Self-Extracting Cabinet.) -- C:\Documents and Settings\CA\Bureau\Silverlight_Developer.exe [9065360]
[MD5.39F5E4F063347865CBBC482F85594FD8] [SPRF][04/04/2011] (...) -- C:\Program Files\cc_20110404_122859.reg [134350]
[MD5.A26E532014C376EED3326F4B2220E1C4] [SPRF][04/04/2011] (...) -- C:\Program Files\DelFix.exe [387041]
[MD5.8EF7ADCFD01707558A47EE4856786260] [SPRF][02/04/2011] (...) -- C:\Program Files\FHSetup.exe [252991]
[MD5.FE37F318F46E21FBA5777E23A57D1F90] [SPRF][02/04/2011] (.Microsoft Corporation - MSE Package.) -- C:\Program Files\mseinstall.exe [8134272]
[MD5.046FA1DEFBEDAF3CB29B30F24D1EBDAC] [SPRF][02/04/2011] (.Apple Inc. - QuickTime Installer.) -- C:\Program Files\QuickTimeInstaller.exe [38147376]
[MD5.FF518B7FABD0BFBC09155C15BF893EA5] [SPRF][02/04/2011] (.Corel Corporation - Pas de description.) -- C:\Program Files\WinDVDPro2010-TBYB.exe [163117352]
[MD5.3FEA9D2EDF23B0283C7A66C8DEA380BD] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player Module.) -- C:\WINDOWS\Downloaded Program Files\dwusplay.dll [24576]
[MD5.CDBE35EA59BC9223E4F800BD1DB82D27] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player.) -- C:\WINDOWS\Downloaded Program Files\dwusplay.exe [196608]
[MD5.0C78701C6F42345DFF2B2B6C3C3D01EF] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Web Agent.) -- C:\WINDOWS\Downloaded Program Files\isusweb.dll [172032]
~ Files: Scanned in 02mn 11s

---\\ Scan Additionnel (O88)
Database Version : v2.12078 - (12/05/2013)
Clés trouvées (Keys found) : 158
Valeurs trouvées (Values found) : 1
Dossiers trouvés (Folders found) : 7
Fichiers trouvés (Files found) : 1

[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{006E6A46-8D55-4F10-BBA8-2C9653B4278B}] =>Adware.Boxore
[HKLM\Software\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}] =>Adware.Agent
[HKLM\Software\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}] =>Adware.IMBooster
[HKLM\Software\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}] =>Adware.IMBooster
[HKLM\Software\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}] =>Adware.IMBooster
[HKLM\Software\Classes\CLSID\{092A2C6B-43EE-4F9F-8F8E-14ED5E11C14B}] =>Adware.Agent
[HKLM\Software\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}] =>Toolbar.Babylon
[HKLM\Software\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}] =>Adware.IMBooster
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9}] =>Toolbar.Babylon
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}] =>Toolbar.Agent
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}] =>Toolbar.Agent
[HKLM\Software\Classes\CLSID\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}] =>Toolbar.Agent
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0F6E720A-1A6B-40E1-A294-1D4D19F156C8}] =>Toolbar.Agent
[HKLM\Software\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}] =>PUP.RewardsArcade
[HKLM\Software\Classes\CLSID\{257A6158-1416-4B31-9BF8-29FF49F3814F}] =>Adware.Agent
[HKLM\Software\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}] =>PUP.RewardsArcade
[HKLM\Software\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}] =>PUP.RewardsArcade
[HKLM\Software\Classes\AppID\{32451DFC-C23B-4E12-866C-FC7982238504}] =>Toolbar.Babylon
[HKLM\Software\Classes\CLSID\{32451DFC-C23B-4E12-866C-FC7982238504}] =>Toolbar.Babylon
[HKLM\Software\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}] =>PUP.RewardsArcade
[HKLM\Software\Classes\CLSID\{42AEFAF9-09D6-4185-87AE-DEDF6E955CB4}] =>Toolbar.Conduit
[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{42AEFAF9-09D6-4185-87AE-DEDF6E955CB4}] =>Toolbar.Conduit
[HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{42AEFAF9-09D6-4185-87AE-DEDF6E955CB4}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}] =>PUP.RewardsArcade
[HKLM\Software\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}] =>Toolbar.Babylon
[HKLM\Software\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}] =>Toolbar.Babylon
[HKLM\Software\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}] =>PUP.RewardsArcade
[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}] =>Adware.IMBooster
[HKLM\Software\Classes\Interface\{6e4c89cf-3061-4ee4-b22a-b7a8aaea5cb3}] =>Adware.Bandoo
[HKLM\Software\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{736EF78E-5A04-46F9-893E-EDEC6EA5DF45}] =>Adware.Agent
[HKLM\Software\Classes\CLSID\{7555B87D-D711-48B2-B97D-04DF700652BA}] =>Adware.Boxore
[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7555B87D-D711-48B2-B97D-04DF700652BA}] =>Adware.Boxore
[HKLM\Software\Microsoft\Wi

Hello

Le rapport n'étant pas complet peux tu l'héberger sur cjoint en t'aidant de ce tutoriel

http://www.pc-infopratique.com/forum-informatique/tutoriel-heberger-rapport-vt-67934.html

Hello

Et ben tu as une belle panoplie des adwares des logiciels potentiellement indésirables et un hijacker

On attaque directement avec Adwcleaner

On va passer cet outil simple d'utilisation

Télécharge cet outil simple d'utilisation http://general-changelog-team.fr/fr/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner (de Xplode) sur ton bureau.

Lance le (Sous vista/seven/8 clic droit dessus, et sur Exécuter en tant qu'administrateur) si tu es sous xp double cliques dessus, puis clique sur Suppression.
Sauvegarde tout travail en cours puis accepte la fermeture des programmes en cours d'exécution.

Patiente le temps du nettoyage.

Une fois le scan fini, il te sera proposé de redémarrer.

Au redémarrage du PC, un rapport s'ouvrira.
Poste moi son contenu dans ta prochaine réponse.

Note : Le rapport est également sauvegardé sous C:\AdwCleaner[S1].txt

J'attends donc le rapport de suppression avec adwcleaner

Hello Marion

Super adwcleaner a bien bossé ;) de plus en mode normal c'est bon :)

Ensuite on va faire une analyse avec Malwarebytes

Je te préviens ça risque d'être long

Télécharge MalwareBytes' anti-malware sur le bureau
https://www.commentcamarche.net/telecharger/securite/14361-malwarebytes-anti-malware/
Cliques droit sur l'icône Download_mbam-setup.exe afin de l'exécuter en tant qu'admin pour lancer le processus d'installation
Si la pare-feu demande l'autorisation de se connecter pour malwareBytes, accepte
Décoche pour la version d'essai pour malwarebytes pro
Il va se mettre à jour une fois faite
Va dans l'onglet recherche
Sélectionne exécuter un examen complet
Clique sur rechercher
Le scan démarre
A la fin de l'analyse, le message s'affiche: L'examen s'est terminé normalement.
Clique sur afficher les résultats pour afficher les objets trouvés
Clique sur OK pour poursuivre
Si des malwares ont été détectés, cliquer sur afficher les résultats
Sélectionne tout (ou laisser coché)
Clique sur tout supprimer
MalwareBytes va détruire les fichiers et les clés de registre et en mettre une
copie dans la quarantaine
Malwarebytes va ouvrir le bloc-note et y copier le rapport
Redémarre le PC
Une fois redémarré, double-clique sur MalwareBytes
Va dans l'onglet rapport/log
Clique dessus pour l'afficher une fois affiché, cliquer sur édition
en haut du bloc-note puis sur sélectionner tout
Reviens sur édition, puis sur copier et reviens
sur le forum dans ta réponse
Clic droit dans le cadre de la réponse et coller

Bonne chance

A la fin du mois d'avril j'avais lancé malwarebytes en l absence de mon pare feux et espérant que cela suffiré...erreur
Aujourd'hui j'ai effacé toutes la quarantaine avant d'exécuter l'examen complet.
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Version de la base de données: v2013.05.13.05

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
CA :: CLAIRE [administrateur]

13/05/2013 18:26:45
mbam-log-2013-05-13 (18-26-45).txt

Type d'examen: Examen complet (C:\|D:\|E:\|)
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 310539
Temps écoulé: 3 heure(s), 36 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 0
(Aucun élément nuisible détecté)

(fin)

Aucun dossier suspect mais j'ai pu re activer le pare feux :)
Mystère ! internet explorer refonctionne.

Quel est la suite ? il me semble que je dois supprimer ... je t'écoute.

Hello

La suite demain :) avec un rapport zhpdiag :)

Hello Marion

Oui oui je suis disponible :)

J'attends donc un nouveau rapport zhpdiag :)

Voiçi :
https://www.cjoint.com/?3EopPoywM8q