Nouveau Virus Gendarmerie

Bonsoir

Tu procèdes avec OTLPE sous environnement Seven.
Télécharge ici http://www.security-helpzone.com/Tools/g3n/7pe_x___86_E.exe => OTLPE sous environnement windows 7 en CD Live (Merci à "g3n-h@ckm@n")

double-clique sur le fichier , patiente quelques secondes , puis un logiciel de gravure va s'ouvrir

insère un cd dans ton graveur puis clique sur "BURN ISO"

(normalement le fichier à graver est déjà sélectionné)
Note : Le CD gravé, il faut maintenant redémarrer la machine sur le lecteur CDROM
Pour ce faire suivre ce lien : Booter sur un CD

Tu lances l'iso d'OTLPE que tu as gravé.
* Double-clique sur l'icone OTLPE
* Une fenêtre s'ouvre: « Choose Windows Directory »

Tu choisis le lecteur qui embarque Windows (C par défaut) et ensuite tu pointes vers ce fichier Windows.
Une autre fenêtre mentionne :"Do you wish to loadremote user profile(s) for scanning ?"
Tu cliques sur Oui
Tu choisis ensuite ta session (logiquement la première ligne de cette fenêtre)
La ligne en bas du tableau est cochée (sinon le faire)

Cliquer sur Ok

Tu cliques sur OK

Ensuite
* sous custom scans /fixes
1) copie_colle le contenu du cadre ci dessous:

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
cdrom.sys
disk.sys
ndis.sys
mountmgr.sys
aec.sys
rasacd.sys
mrxsmb10.sys
mrxsmb20.sys
termdd.sys
mrxsmb.sys
win32k.sys
storport.sys
IdeChnDr.sys
viasraid.sys
explorer.exe
winlogon.exe
wininit.exe
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
CREATERESTOREPOINT

* copie colle ce texte dans un fichier texte|bloc note que tu enregistres sur clé usb que tu brancheras sous reatogo tu pourras alors facilement le copier\coller.

* 2) Clic Run Scan pour démarrer le scan.
* Une fois terminé , le fichier se trouve là C:\OTL.txt
* Copie_colle le contenu dans ta prochaine réponse.

@+

Salut Narva 32.
Je ne connais pas cette nouvelle version mais on peut toujours tenter quelque chose avant qu'un expert ne puisse t'apporter une meilleur solution.

L'idée est de démarrer l'utilitaire de restauration windows sans interface graphique. Dans les versions précédentes, ce fameux virus attaquait les paramètres liés au mode d'affichage personnalisé du système. C'est la raison pour laquelle, en mode sans échec, tu n'avais plus le problème. Dans ton cas, il semble que la bête ait contourné le problème...

As-tu la possibilité de sélectionner l'"invite de commande en mode sans échec" (ça doit être la ligne en dessous de mode sans échec avec prise en charge réseau... je n'ai pas windows, je ne peux donc pas vérifier). Si tu peux, tu vas tomber sur un joli écran tout noir où tu vas pouvoir oeuvrer en lignes de commandes.

Si ton système est windows XP, tu devrais pouvoir activer l'outil de restauration en tapant (ou en copiant/collant) : %systemroot%/system32/restore/rstrui.exe

Si tu es sous Vista ou Seven : %systemroot%/system32/rstrui.exe

Ca devrait ouvrir la fenêtre de restauration et tu devrais pouvoir sélectionner un point antérieur à l'attaque.

Désolé, pas d'autre idée pour l'instant...
Bon courage.

Merci pour vos réponses et votre réactivité.

Concernant l'invité de commande, je parviens à accéder au panneau de configuration ce qui me redonne beaucoup d'espoirs ! Par contre impossible de restaurer les fichiers car "La protection du système est désactivée" et impossible de l'activer, il n'y a pas l'onglet "Protection Systeme" dans le menu de gauche du menu "Systeme".

Je suis en train de télécharger le logiciel conseillé par Guillaume5188

@Guillaume5188

Voici le rapport du scan:

OTL logfile created on: 13/05/2013 21:43:51 - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Program Files\OTLPE
Windows 7 Professional Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 65,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 63,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files
Drive C: | 300,00 Mb Total Space | 260,86 Mb Free Space | 86,95% Space Free | Partition Type: NTFS
Drive D: | 80,00 Gb Total Space | 1,15 Gb Free Space | 1,44% Space Free | Partition Type: NTFS
Drive E: | 217,80 Gb Total Space | 127,07 Gb Free Space | 58,34% Space Free | Partition Type: NTFS
Drive F: | 327,04 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive G: | 298,09 Gb Total Space | 297,64 Gb Free Space | 99,85% Space Free | Partition Type: NTFS
Drive X: | 255,26 Mb Total Space | 252,83 Mb Free Space | 99,05% Space Free | Partition Type: NTFS

Computer Name: MININT-1SALSIN | User Name: Système
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001

[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

SRV - [2013/04/12 16:31:50 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand] -- D:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/01/27 11:11:46 | 000,295,232 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2013/01/27 11:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012/12/04 21:24:20 | 000,580,576 | ---- | M] () [Auto] -- D:\ProgramData\IBUpdaterService\ibsvc.exe -- (IBUpdaterService)
SRV - [2012/09/20 13:28:48 | 030,785,672 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2011/08/03 12:50:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) [Auto] -- D:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011/08/03 02:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) [Auto] -- D:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2011/07/15 12:51:09 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2010/12/24 19:16:30 | 000,513,536 | ---- | M] (TOSHIBA Corporation) [Auto] -- D:\Windows\System32\ThpSrv.exe -- (Thpsrv)
SRV - [2009/07/14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009/07/14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - [2013/01/20 15:59:04 | 000,100,328 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- D:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2011/08/03 12:50:00 | 010,304,104 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2011/03/12 09:54:18 | 002,158,592 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2011/02/10 13:52:10 | 000,141,952 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV - [2011/02/10 13:52:10 | 000,063,872 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\nusb3hub.sys -- (nusb3hub)
DRV - [2011/01/27 12:35:04 | 001,281,152 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)
DRV - [2010/12/11 23:08:40 | 000,234,800 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand] -- D:\Windows\System32\drivers\tosrfbd.sys -- (tosrfbd)
DRV - [2010/12/02 18:29:00 | 000,056,760 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand] -- D:\Windows\System32\drivers\tosrfusb.sys -- (tosrfusb)
DRV - [2010/12/01 15:12:04 | 000,197,224 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- D:\Windows\System32\Drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV - [2010/11/30 13:40:04 | 000,226,408 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\RtsUVStor.sys -- (RSUSBVSTOR)
DRV - [2010/11/20 13:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 13:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 13:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\system32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/11/20 10:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 10:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\system32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/11/12 07:10:52 | 000,122,984 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2010/11/08 11:44:58 | 000,067,184 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\L1C60x86.sys -- (L1C)
DRV - [2010/10/19 15:33:40 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\HECI.sys -- (MEI) Intel(R)
DRV - [2010/06/18 15:44:00 | 000,015,160 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\tosrfec.sys -- (tosrfec)
DRV - [2009/06/29 15:16:22 | 000,013,120 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\Thpevm.sys -- (Thpevm)
DRV - [2009/06/29 09:25:28 | 000,030,272 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\thpdrv.sys -- (Thpdrv)
DRV - [2009/06/19 08:58:00 | 000,009,608 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand] -- D:\Windows\system32\drivers\Toshidpt.sys -- (toshidpt)
DRV - [2009/06/17 10:59:00 | 000,046,984 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\tosporte.sys -- (tosporte)
DRV - [2007/11/09 04:00:52 | 000,023,640 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\TVALZ_O.SYS -- (TVALZ)

[color=#E56717]========== Standard Registry (SafeList) ==========[/color]

[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?pc=MSSE

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\ecenter_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://students.grenoble-em.com
IE - HKU\ecenter_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?pc=MSSE
IE - HKU\ecenter_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Etudiant2011_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://students.grenoble-em.com
IE - HKU\Etudiant2011_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?pc=MSSE
IE - HKU\Etudiant2011_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\rouby106710_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://scruter.net
IE - HKU\rouby106710_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = "http://scruter.net/result.php?cx=partner-pub-3128276511037541:8870723493&cof=GIMP:CCCCCC;T:000000;ALC:551a8b;GFNT:B7B7B7;LC:2200cc;BGC:FFFFFF;VLC:551a8b;GALT:008B45;FORID:10;DIV:#FFFFF0;&ie=UTF-8&q={searchTerms}&sa=Rechercher"
IE - HKU\rouby106710_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://scruter.net
IE - HKU\rouby106710_ON_D\Software\Microsoft\Internet Explorer\Main,Search Page =
IE - HKU\rouby106710_ON_D\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = http://scruter.net
IE - HKU\rouby106710_ON_D\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = "http://scruter.net/result.php?cx=partner-pub-3128276511037541:8870723493&cof=GIMP:CCCCCC;T:000000;ALC:551a8b;GFNT:B7B7B7;LC:2200cc;BGC:FFFFFF;VLC:551a8b;GALT:008B45;FORID:10;DIV:#FFFFF0;&ie=UTF-8&q={searchTerms}&sa=Rechercher"
IE - HKU\rouby106710_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?pc=MSSE
IE - HKU\rouby106710_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://scruter.net
IE - HKU\rouby106710_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\rouby106710_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKU\test_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://students.grenoble-em.com
IE - HKU\test_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?pc=MSSE

IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://students.grenoble-em.com
IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?pc=MSSE
IE - HKU\UpdatusUser_ON_D\..\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - Reg Error: Key error. File not found
IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.startup.homepage: "http://ww25.allssearch.com/"

FF - user.js..browser.startup.homepage: "http://ww25.allssearch.com/"

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: D:\Windows\System32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: D:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: D:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.4: D:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: D:\Users\rouby106710\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\editions-eni.fr/EniEditionsMediaplusClientPluginProxy: D:\Users\rouby106710\AppData\Roaming\Editions ENI\MEDIAplus Client\npEniEditionsMediaplusClientPluginProxy.dll (Editions ENI)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/04/12 16:31:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\specialsavings@vshsolutions.com: C:\Users\rouby106710\AppData\Roaming\Mozilla\Extensions\specialsavings@vshsolutions.com [2012/12/04 21:25:31 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/04/12 16:31:53 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\SeaMonkey\Extensions\\mozilla_cc@internetdownloadmanager.com: C:\Users\rouby106710\AppData\Roaming\IDM\idmmzcc5

[2012/12/04 21:25:31 | 000,000,000 | ---D | M] (No name found) -- D:\Users\rouby106710\AppData\Roaming\mozilla\Extensions
[2012/12/04 21:25:31 | 000,000,000 | ---D | M] (Special Savings) -- D:\Users\rouby106710\AppData\Roaming\mozilla\Extensions\specialsavings@vshsolutions.com
[2013/05/08 18:43:28 | 000,000,000 | ---D | M] (No name found) -- D:\Users\rouby106710\AppData\Roaming\mozilla\Firefox\Profiles\f43gyd79.default\extensions
[2012/12/04 21:25:40 | 000,002,432 | ---- | M] () -- D:\Users\rouby106710\AppData\Roaming\Mozilla\Firefox\Profiles\f43gyd79.default\searchplugins\babylon1.xml
[2012/12/04 21:25:40 | 000,002,432 | ---- | M] () -- D:\Users\rouby106710\AppData\Roaming\Mozilla\Firefox\Profiles\f43gyd79.default\searchplugins\mngr.xml
[2013/04/12 16:31:02 | 000,000,000 | ---D | M] (No name found) -- D:\Program Files\mozilla firefox\extensions
File not found (No name found) --
[2013/04/12 16:31:53 | 000,263,064 | ---- | M] (Mozilla Foundation) -- D:\Program Files\mozilla firefox\components\browsercomps.dll
[2013/01/11 22:10:47 | 000,001,609 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\amazon-france.xml
[2012/12/04 21:25:14 | 000,002,349 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012/09/16 12:43:13 | 000,002,465 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/12/07 18:14:58 | 000,002,035 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\cnrtl-tlfi-fr.xml
[2013/02/27 16:33:30 | 000,001,472 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\eBay-france.xml
[2013/01/11 22:10:47 | 000,001,399 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\wikipedia-fr.xml
[2012/12/07 18:14:58 | 000,001,169 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\yahoo-france.xml

O1 HOSTS File: ([2009/06/10 22:39:37 | 000,000,824 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (no name) - {bb184e6d-26d1-461a-9226-b93ca8da2af9} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [agentantidote.exe] D:\Program Files\Druide\Antidote 7\Programmes32\agentantidote.exe (Druide informatique inc.)
O4 - HKLM..\Run: [APSDaemon] D:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [MSC] File not found
O4 - HKLM..\Run: [SmartAudio] D:\Program Files\CONEXANT\SAII\SAIICpl.exe (Conexant systems, Inc.)
O4 - HKLM..\Run: [ThpSrv] D:\Windows\System32\thpsrv.exe (TOSHIBA Corporation)
O4 - HKU\ecenter_ON_D..\Run: [SuperCopier2.exe] D:\Program Files\SuperCopier2\SuperCopier2.exe (SFX TEAM)
O4 - HKU\Etudiant2011_ON_D..\Run: [SuperCopier2.exe] D:\Program Files\SuperCopier2\SuperCopier2.exe (SFX TEAM)
O4 - HKU\rouby106710_ON_D..\Run: [ApplePhotoStreams] D:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.)
O4 - HKU\rouby106710_ON_D..\Run: [com.apple.dav.bookmarks.daemon] D:\Program Files\Common Files\Apple\Internet Services\BookmarkDAV_client.exe (Apple Inc.)
O4 - HKU\rouby106710_ON_D..\Run: [Facebook Update] D:\Users\rouby106710\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKU\rouby106710_ON_D..\Run: [iCloudServices] D:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.)
O4 - HKU\rouby106710_ON_D..\Run: [RESTART_STICKY_NOTES] D:\Windows\System32\StikyNot.exe (Microsoft Corporation)
O4 - HKU\rouby106710_ON_D..\Run: [Spotify] D:\Users\rouby106710\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd)
O4 - HKU\rouby106710_ON_D..\Run: [Spotify Web Helper] D:\Users\rouby106710\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - HKU\rouby106710_ON_D..\Run: [SuperCopier2.exe] D:\Program Files\SuperCopier2\SuperCopier2.exe (SFX TEAM)
O4 - HKU\UpdatusUser_ON_D..\Run: [BrowserChoice] D:\Windows\System32\browserchoice.exe (Microsoft Corporation)
O4 - HKU\UpdatusUser_ON_D..\Run: [SuperCopier2.exe] D:\Program Files\SuperCopier2\SuperCopier2.exe (SFX TEAM)
O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: D:\Users\rouby106710\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\ecenter_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Etudiant2011_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\rouby106710_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\UpdatusUser_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Notes &liées OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Notes &liées OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - D:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = student.grenoble-em.com
O20 - AppInit_DLLs: (c:\progra~2\browse~1\25976~1.107\{c16c1~1\mngr.dll) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - D:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKU\rouby106710_ON_D Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKU\rouby106710_ON_D Winlogon: Shell - (C:\Users\rouby106710\AppData\Roaming\skype.dat) - D:\Users\rouby106710\AppData\Roaming\skype.dat ()
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - D:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010/03/31 09:35:30 | 000,000,102 | ---- | M] () - G:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{634cd5a4-9062-11e1-b4b0-e89a8f8f3c02}\Shell - "" = AutoRun
O33 - MountPoints2\{634cd5a4-9062-11e1-b4b0-e89a8f8f3c02}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{8d62d1a7-0ee6-11e1-8f56-e89a8f8f3c02}\Shell - "" = AutoRun
O33 - MountPoints2\{8d62d1a7-0ee6-11e1-8f56-e89a8f8f3c02}\Shell\AutoRun\command - "" = F:\laucher.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

MsConfig - StartUpReg: [b]Adobe ARM[/b] - hkey= - key= - D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: [b]Adobe Reader Speed Launcher[/b] - hkey= - key= - D:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: [b]BCSSync[/b] - hkey= - key= - D:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
MsConfig - StartUpReg: [b]SunJavaUpdateSched[/b] - hkey= - key= - D:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: MsMpSvc - D:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - D:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: MsMpSvc - D:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - D:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 10.1
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.4
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 10.1
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.0
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

Drivers32: msacm.l3acm - D:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - D:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - D:\Windows\System32\iccvid.dll (Radius Inc.)

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2013/05/13 19:23:25 | 000,000,000 | ---D | C] -- D:\Users\rouby106710\AppData\Local\ElevatedDiagnostics
[2013/05/04 19:05:23 | 000,000,000 | ---D | C] -- D:\Users\rouby106710\AppData\Local\85F104CF-9146-4FEE-9195-D5BAE63C98B2.aplzod

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2013/05/13 20:24:02 | 000,067,584 | --S- | M] () -- D:\Windows\bootstat.dat
[2013/05/13 19:56:00 | 000,001,102 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1834913581-721874356-3486338912-18422UA.job
[2013/05/13 19:51:26 | 000,016,336 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/13 19:51:26 | 000,016,336 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/13 19:50:00 | 000,001,120 | ---- | M] () -- D:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1834913581-721874356-3486338912-18422UA.job
[2013/05/13 19:50:00 | 000,001,098 | ---- | M] () -- D:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1834913581-721874356-3486338912-18422Core.job
[2013/05/13 19:48:27 | 000,704,714 | ---- | M] () -- D:\Windows\System32\perfh00C.dat
[2013/05/13 19:48:27 | 000,616,242 | ---- | M] () -- D:\Windows\System32\perfh009.dat
[2013/05/13 19:48:27 | 000,130,988 | ---- | M] () -- D:\Windows\System32\perfc00C.dat
[2013/05/13 19:48:27 | 000,106,622 | ---- | M] () -- D:\Windows\System32\perfc009.dat
[2013/05/13 19:43:54 | 1596,346,368 | -HS- | M] () -- D:\hiberfil.sys
[2013/05/13 18:25:08 | 000,000,004 | ---- | M] () -- D:\Users\rouby106710\AppData\Roaming\skype.ini
[2013/05/12 06:56:00 | 000,001,050 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1834913581-721874356-3486338912-18422Core.job
[2013/05/02 16:28:50 | 000,238,872 | ---- | M] (Microsoft Corporation) -- D:\Windows\System32\MpSigStub.exe

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2013/05/13 13:28:09 | 000,000,004 | ---- | C] () -- D:\Users\rouby106710\AppData\Roaming\skype.ini
[2012/09/10 15:00:05 | 000,021,930 | ---- | C] () -- D:\Users\rouby106710\AppData\Roaming\Microsoft Excel 97-2003.ADR
[2012/01/11 07:48:09 | 000,057,856 | ---- | C] () -- D:\Users\rouby106710\AppData\Roaming\skype.dat
[2011/09/22 13:46:45 | 000,066,048 | ---- | C] () -- D:\Windows\System32\PrintBrmUi.exe
[2011/08/10 07:07:42 | 000,049,152 | ---- | C] () -- D:\Windows\System32\ITSUtils.dll
[2011/08/10 07:07:40 | 000,029,184 | ---- | C] () -- D:\Windows\System32\ITSLauncher.dll
[2011/08/10 07:07:40 | 000,028,672 | ---- | C] () -- D:\Windows\System32\ITSMAPI.dll
[2011/08/10 07:07:40 | 000,017,920 | ---- | C] () -- D:\Windows\System32\IMPLODE.DLL
[2011/08/03 02:31:54 | 000,311,912 | ---- | C] () -- D:\Windows\System32\nvStreaming.exe
[2011/07/15 12:45:03 | 000,002,412 | RHS- | C] () -- D:\ProgramData\ntuser.pol
[2011/07/12 11:13:52 | 000,116,224 | ---- | C] () -- D:\Windows\System32\pdfcmnnt.dll
[2011/07/12 11:04:14 | 000,000,051 | ---- | C] () -- D:\Windows\smsts.ini
[2010/12/14 15:20:28 | 000,009,728 | ---- | C] () -- D:\Windows\System32\shortcut.dll
[2010/10/28 12:22:18 | 000,030,895 | ---- | C] () -- D:\Windows\System32\drivers\Mixer.ini
[2009/07/14 09:36:29 | 000,704,714 | ---- | C] () -- D:\Windows\System32\perfh00C.dat
[2009/07/14 09:36:29 | 000,344,522 | ---- | C] () -- D:\Windows\System32\perfi00C.dat
[2009/07/14 09:36:29 | 000,130,988 | ---- | C] () -- D:\Windows\System32\perfc00C.dat
[2009/07/14 09:36:29 | 000,038,160 | ---- | C] () -- D:\Windows\System32\perfd00C.dat
[2009/07/14 05:57:37 | 000,067,584 | --S- | C] () -- D:\Windows\bootstat.dat
[2009/07/14 05:33:53 | 000,408,616 | ---- | C] () -- D:\Windows\System32\FNTCACHE.DAT
[2009/07/14 03:05:48 | 000,616,242 | ---- | C] () -- D:\Windows\System32\perfh009.dat
[2009/07/14 03:05:48 | 000,291,294 | ---- | C] () -- D:\Windows\System32\perfi009.dat
[2009/07/14 03:05:48 | 000,106,622 | ---- | C] () -- D:\Windows\System32\perfc009.dat
[2009/07/14 03:05:48 | 000,031,548 | ---- | C] () -- D:\Windows\System32\perfd009.dat
[2009/07/14 03:05:05 | 000,000,741 | ---- | C] () -- D:\Windows\System32\NOISE.DAT
[2009/07/14 03:04:11 | 000,215,943 | ---- | C] () -- D:\Windows\System32\dssec.dat
[2009/07/14 01:55:09 | 001,332,736 | ---- | C] () -- D:\Windows\System32\hpotiop1.dll
[2009/07/14 01:55:09 | 000,587,776 | ---- | C] () -- D:\Windows\System32\hpotscl1.dll
[2009/07/14 00:55:01 | 000,043,131 | ---- | C] () -- D:\Windows\mib.bin
[2009/07/14 00:51:43 | 000,073,728 | ---- | C] () -- D:\Windows\System32\BthpanContextHandler.dll
[2009/07/14 00:42:10 | 000,064,000 | ---- | C] () -- D:\Windows\System32\BWContextHandler.dll
[2009/06/10 22:26:10 | 000,673,088 | ---- | C] () -- D:\Windows\System32\mlang.dat

[color=#E56717]========== LOP Check ==========[/color]

[2013/02/25 19:48:30 | 000,000,000 | ---D | M] -- D:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2009/07/14 05:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Application Data
[2012/06/19 19:23:31 | 000,000,000 | ---D | M] -- D:\ProgramData\Babylon
[2011/07/12 11:03:21 | 000,000,000 | -HSD | M] -- D:\ProgramData\Bureau
[2012/06/20 14:30:37 | 000,000,000 | -H-D | M] -- D:\ProgramData\CanonBJ
[2009/07/14 05:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop
[2009/07/14 05:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Documents
[2011/10/26 16:18:14 | 000,000,000 | ---D | M] -- D:\ProgramData\Downloaded Installations
[2011/07/12 11:03:21 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favoris
[2009/07/14 05:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favorites
[2012/12/04 21:24:52 | 000,000,000 | ---D | M] -- D:\ProgramData\IBUpdaterService
[2011/07/12 11:03:21 | 000,000,000 | -HSD | M] -- D:\ProgramData\Menu Démarrer
[2011/07/12 11:03:22 | 000,000,000 | -HSD | M] -- D:\ProgramData\Modèles
[2009/07/14 05:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Start Menu
[2012/12/28 15:10:12 | 000,000,000 | ---D | M] -- D:\ProgramData\Tarma Installer
[2009/07/14 05:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Templates
[2011/07/15 10:12:42 | 000,000,000 | ---D | M] -- D:\ProgramData\Xerox
[2011/10/26 18:03:47 | 000,000,000 | ---D | M] -- D:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2013/05/13 19:50:00 | 000,001,098 | ---- | M] () -- D:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1834913581-721874356-3486338912-18422Core.job
[2013/05/13 19:50:00 | 000,001,120 | ---- | M] () -- D:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1834913581-721874356-3486338912-18422UA.job
[2013/02/03 18:43:49 | 000,032,496 | ---- | M] () -- D:\Windows\Tasks\SCHEDLGU.TXT

[color=#E56717]========== Purity Check ==========[/color]

[color=#E56717]========== Custom Scans ==========[/color]

Invalid Environment Variable: %ALLUSERSPROFILE%\Application Data\*.

Invalid Environment Variable: %ALLUSERSPROFILE%\Application Data\*.exe

[color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color]

[color=#A23BEC]< MD5 for: AGP440.SYS >[/color]
[2009/07/14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- D:\Windows\System32\drivers\AGP440.sys
[2009/07/14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- D:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009/07/14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- D:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009/07/14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- D:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys

[color=#A23BEC]< MD5 for: ATAPI.SYS >[/color]
[2009/07/14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- D:\Windows\System32\drivers\atapi.sys
[2009/07/14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- D:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009/07/14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- D:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009/07/14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- D:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16552_none_dd2bf0ef82c7be83\atapi.sys
[2009/07/14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- D:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16593_none_dd01b18982e7479e\atapi.sys
[2009/07/14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- D:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.20669_none_ddb1bfd49be72b9f\atapi.sys
[2009/07/14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- D:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.20713_none_dde1cf9a9bc40507\atapi.sys
[2009/07/14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- D:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.20776_none_dda3f0f09bf1f8b2\atapi.sys
[2009/07/14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- D:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys

[color=#A23BEC]< MD5 for: CDROM.SYS >[/color]
[2009/07/14 00:11:26 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=BA6E70AA0E6091BC39DE29477D866A77 -- D:\Windows\winsxs\x86_cdrom.inf_31bf3856ad364e35_6.1.7600.16385_none_5f7fb206051affbb\cdrom.sys
[2010/11/20 09:38:10 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=BE167ED0FDB9C1FA1133953C18D5A6C9 -- D:\Windows\System32\drivers\cdrom.sys
[2010/11/20 09:38:10 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=BE167ED0FDB9C1FA1133953C18D5A6C9 -- D:\Windows\System32\DriverStore\FileRepository\cdrom.inf_x86_neutral_6381e09675524225\cdrom.sys
[2010/11/20 09:38:10 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=BE167ED0FDB9C1FA1133953C18D5A6C9 -- D:\Windows\winsxs\x86_cdrom.inf_31bf3856ad364e35_6.1.7601.17514_none_61b0c5ce02098355\cdrom.sys

[color=#A23BEC]< MD5 for: CNGAUDIT.DLL >[/color]
[2009/07/14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- D:\Windows\System32\cngaudit.dll
[2009/07/14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- D:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

[color=#A23BEC]< MD5 for: DISK.SYS >[/color]
[2009/07/14 02:20:27 | 000,057,424 | ---- | M] (Microsoft Corporation) MD5=565003F326F99802E68CA78F2A68E9FF -- D:\Windows\System32\drivers\disk.sys
[2009/07/14 02:20:27 | 000,057,424 | ---- | M] (Microsoft Corporation) MD5=565003F326F99802E68CA78F2A68E9FF -- D:\Windows\System32\DriverStore\FileRepository\disk.inf_x86_neutral_b431b61a11f8df6c\disk.sys
[2009/07/14 02:20:27 | 000,057,424 | ---- | M] (Microsoft Corporation) MD5=565003F326F99802E68CA78F2A68E9FF -- D:\Windows\winsxs\x86_disk.inf_31bf3856ad364e35_6.1.7600.16385_none_f99cd807d58018cb\disk.sys

[color=#A23BEC]< MD5 for: EXPLORER.EXE >[/color]
[2011/02/26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009/07/14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011/02/26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009/10/31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011/02/26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010/11/20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- D:\Windows\explorer.exe
[2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2009/08/03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2009/08/03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009/10/31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe

[color=#A23BEC]< MD5 for: IASTORV.SYS >[/color]
[2010/05/12 10:05:35 | 000,332,168 | ---- | M] (Intel Corporation) MD5=2D2918606673C46769FB516A5ACE958E -- D:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16592_none_aed9db9de9265a3a\iaStorV.sys
[2011/03/11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- D:\Windows\System32\drivers\iaStorV.sys
[2011/03/11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- D:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys
[2011/03/11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- D:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011/03/11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- D:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011/03/11 06:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- D:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009/07/14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- D:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010/11/20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- D:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010/11/20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- D:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011/03/11 06:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- D:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
[2010/05/12 10:20:41 | 000,332,160 | ---- | M] (Intel Corporation) MD5=FE8186428F0AB44F0E500C7AA33E9B51 -- D:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20712_none_afb9f9af020317a3\iaStorV.sys

[color=#A23BEC]< MD5 for: MOUNTMGR.SYS >[/color]
[2009/07/14 02:20:44 | 000,078,416 | ---- | M] (Microsoft Corporation) MD5=921C18727C5920D6C0300736646931C2 -- D:\Windows\winsxs\x86_microsoft-windows-mountpointmanager_31bf3856ad364e35_6.1.7600.16385_none_f26e7ae968595905\mountmgr.sys
[2010/11/20 13:30:00 | 000,078,208 | ---- | M] (Microsoft Corporation) MD5=FC8771F45ECCCFD89684E38842539B9B -- D:\Windows\System32\drivers\mountmgr.sys
[2010/11/20 13:30:00 | 000,078,208 | ---- | M] (Microsoft Corporation) MD5=FC8771F45ECCCFD89684E38842539B9B -- D:\Windows\winsxs\x86_microsoft-windows-mountpointmanager_31bf3856ad364e35_6.1.7601.17514_none_f49f8eb16547dc9f\mountmgr.sys

[color=#A23BEC]< MD5 for: MRXSMB.SYS >[/color]
[2011/04/27 03:15:30 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=39A8FF477B3F5D0EDFE814155841C735 -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7601.21714_none_822275d1c87d251f\mrxsmb.sys
[2011/04/27 03:17:22 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=5D16C921E3671636C0EBA3BBAAC5FD25 -- D:\Windows\System32\drivers\mrxsmb.sys
[2011/04/27 03:17:22 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=5D16C921E3671636C0EBA3BBAAC5FD25 -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7601.17605_none_81a4a93caf5682bb\mrxsmb.sys
[2011/02/23 04:37:32 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=5DC06CEB9AA4B65E724376766EB410AB -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7600.20907_none_8049e995cb4be947\mrxsmb.sys
[2011/05/04 03:23:56 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=AE6248D356C6C1DE1623F0610B7FB0A3 -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7600.20959_none_8015da8dcb72a7aa\mrxsmb.sys
[2010/11/20 09:42:42 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=B272B4C3E085EA860C12F2E4FAF2FFA2 -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7601.17514_none_8198d720af5f882e\mrxsmb.sys
[2011/02/23 06:05:31 | 000,123,392 | ---- | M] (Microsoft Corporation) MD5=B4C76EF46322A9711C7B0F4E21EF6EA5 -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7600.16765_none_7f7d6ac8b260c14e\mrxsmb.sys
[2011/02/23 04:09:47 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=C76FD653DB8B90DA85EAD12B12FFFC9F -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7601.21666_none_81ee64e3c8a3e65b\mrxsmb.sys
[2011/05/04 03:43:41 | 000,123,392 | ---- | M] (Microsoft Corporation) MD5=CA7570E42522E24324A12161DB14EC02 -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7600.16808_none_7fc14d14b22d62d4\mrxsmb.sys
[2011/02/23 05:47:36 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=ED3D3419B064F28D812995ED8CADC541 -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7601.17565_none_8163c7ceaf872d3a\mrxsmb.sys
[2009/07/14 00:14:26 | 000,123,392 | ---- | M] (Microsoft Corporation) MD5=F4A054BE78AF7F410129C4B64B07DC9B -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7600.16385_none_7f67c358b2710494\mrxsmb.sys

[color=#A23BEC]< MD5 for: MRXSMB10.SYS >[/color]
[2011/05/04 03:24:08 | 000,223,232 | ---- | M] (Microsoft Corporation) MD5=2FD4E6599970CC66D54C97BFE1FD8B4B -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7600.20959_none_8928f8e1c5c3e60c\mrxsmb10.sys
[2011/02/23 04:37:48 | 000,222,208 | ---- | M] (Microsoft Corporation) MD5=383A8E2DBE6A3CE587B18AE00B77069C -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7600.20907_none_895d07e9c59d27a9\mrxsmb10.sys
[2011/07/09 03:30:00 | 000,223,744 | ---- | M] (Microsoft Corporation) MD5=6D17A4791ACA19328C685D256349FEFC -- D:\Windows\System32\drivers\mrxsmb10.sys
[2011/07/09 03:30:00 | 000,223,744 | ---- | M] (Microsoft Corporation) MD5=6D17A4791ACA19328C685D256349FEFC -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7601.17647_none_8a8e8874a9c6638f\mrxsmb10.sys
[2011/07/09 03:20:52 | 000,223,232 | ---- | M] (Microsoft Corporation) MD5=6D8AB5E1EF631470014CB167C426A38F -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7600.21005_none_895adf77c59f283d\mrxsmb10.sys
[2011/04/27 03:15:44 | 000,223,744 | ---- | M] (Microsoft Corporation) MD5=91C0082B614090FEA7EFD3E86A97BD5D -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7601.21714_none_8b359425c2ce6381\mrxsmb10.sys
[2010/11/20 09:44:18 | 000,223,232 | ---- | M] (Microsoft Corporation) MD5=9AC33EF26C8A3AD0F117D00EB7301D03 -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7601.17514_none_8aabf574a9b0c690\mrxsmb10.sys
[2011/04/27 03:17:36 | 000,223,744 | ---- | M] (Microsoft Corporation) MD5=A70C828A93CCE4C11617F6249F4D87FC -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7601.17605_none_8ab7c790a9a7c11d\mrxsmb10.sys
[2011/07/09 04:15:40 | 000,223,744 | ---- | M] (Microsoft Corporation) MD5=AC8EB88C4176892062CF7A8952943662 -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7601.21767_none_8b028567c2f43b3b\mrxsmb10.sys
[2011/05/04 03:43:59 | 000,222,720 | ---- | M] (Microsoft Corporation) MD5=C108952D3660375DCB716B222912E868 -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7600.16808_none_88d46b68ac7ea136\mrxsmb10.sys
[2011/02/23 05:47:45 | 000,223,232 | ---- | M] (Microsoft Corporation) MD5=DC914446049169A964E27FD8888FFAEE -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7601.17565_none_8a76e622a9d86b9c\mrxsmb10.sys
[2009/07/14 00:14:37 | 000,221,184 | ---- | M] (Microsoft Corporation) MD5=DEFFA295BD1895C6ED8E3078412AC60B -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7600.16385_none_887ae1acacc242f6\mrxsmb10.sys
[2011/02/23 06:05:41 | 000,221,696 | ---- | M] (Microsoft Corporation) MD5=E593D45024A3FDD11E93CC4A6CA91101 -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7600.16765_none_8890891cacb1ffb0\mrxsmb10.sys
[2011/07/09 03:26:10 | 000,222,720 | ---- | M] (Microsoft Corporation) MD5=F965C3AB2B2AE5C378F4562486E35051 -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7600.16847_none_88a82b6eac9ff7a3\mrxsmb10.sys
[2011/02/23 04:10:01 | 000,223,232 | ---- | M] (Microsoft Corporation) MD5=FF9C1079052D007EF6650BD526437F08 -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7601.21666_none_8b018337c2f524bd\mrxsmb10.sys

[color=#A23BEC]< MD5 for: MRXSMB20.SYS >[/color]
[2011/05/04 03:23:59 | 000,097,280 | ---- | M] (Microsoft Corporation) MD5=05FCF029FB6915DF707222D3806C760A -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7600.20959_none_8b5f62f4041b197d\mrxsmb20.sys
[2009/07/14 00:14:31 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=24D76ABE5DCAD22F19D105F76FDF0CE1 -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7600.16385_none_8ab14bbeeb197667\mrxsmb20.sys
[2011/05/04 03:43:48 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=25C38264A3C72594DD21D355D70D7A5D -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7600.16808_none_8b0ad57aead5d4a7\mrxsmb20.sys
[2011/02/23 04:09:55 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=86CF607351BF18DB7B0B3FE593F5791E -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7601.21666_none_8d37ed4a014c582e\mrxsmb20.sys
[2011/02/23 04:37:41 | 000,097,280 | ---- | M] (Microsoft Corporation) MD5=8C8081CAD5C46D0AFA483F2D26AA61EA -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7600.20907_none_8b9371fc03f45b1a\mrxsmb20.sys
[2011/04/27 03:15:40 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=94191E6C88850E7E8C6713B04FF01006 -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7601.21714_none_8d6bfe38012596f2\mrxsmb20.sys
[2011/02/23 06:05:35 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=A9F86C82C9CC3B679CC3957E1183A30F -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7600.16765_none_8ac6f32eeb093321\mrxsmb20.sys
[2011/04/27 03:17:28 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=B81F204D146000BE76651A50670A5E9E -- D:\Windows\System32\drivers\mrxsmb20.sys
[2011/04/27 03:17:28 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=B81F204D146000BE76651A50670A5E9E -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7601.17605_none_8cee31a2e7fef48e\mrxsmb20.sys
[2010/11/20 09:44:09 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=E0ABDB5ED7E199E242A7D028E76C1D3A -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7601.17514_none_8ce25f86e807fa01\mrxsmb20.sys
[2011/02/23 05:47:40 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=E7D90388D14FAE057C166C1801E0BF94 -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7601.17565_none_8cad5034e82f9f0d\mrxsmb20.sys

[color=#A23BEC]< MD5 for: NDIS.SYS >[/color]
[2012/08/22 18:05:16 | 000,712,048 | ---- | M] (Microsoft Corporation) MD5=15B74B6283CEBCCE3054C1001CA01B5E -- D:\Windows\winsxs\x86_microsoft-windows-ndis_31bf3856ad364e35_6.1.7601.22097_none_aa0491cf93ad1c31\ndis.sys
[2009/07/14 02:20:44 | 000,710,720 | ---- | M] (Microsoft Corporation) MD5=23759D175A0A9BAAF04D05047BC135A8 -- D:\Windows\winsxs\x86_microsoft-windows-ndis_31bf3856ad364e35_6.1.7600.16385_none_a79d81ea7d62a289\ndis.sys
[2012/08/22 18:16:46 | 000,712,048 | ---- | M] (Microsoft Corporation) MD5=8C9C922D71F1CD4DEF73F186416B7896 -- D:\Windows\System32\drivers\ndis.sys
[2012/08/22 18:16:46 | 000,712,048 | ---- | M] (Microsoft Corporation) MD5=8C9C922D71F1CD4DEF73F186416B7896 -- D:\Windows\winsxs\x86_microsoft-windows-ndis_31bf3856ad364e35_6.1.7601.17939_none_a9bdfee47a5cd154\ndis.sys
[2010/11/20 13:30:06 | 000,712,576 | ---- | M] (Microsoft Corporation) MD5=E7C54812A2AAF43316EB6930C1FFA108 -- D:\Windows\winsxs\x86_microsoft-windows-ndis_31bf3856ad364e35_6.1.7601.17514_none_a9ce95b27a512623\ndis.sys

[color=#A23BEC]< MD5 for: NETLOGON.DLL >[/color]
[2010/11/20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- D:\Windows\System32\netlogon.dll
[2010/11/20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- D:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009/07/14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- D:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

[color=#A23BEC]< MD5 for: NVSTOR.SYS >[/color]
[2010/05/12 10:05:45 | 000,143,752 | ---- | M] (NVIDIA Corporation) MD5=1D8B6A440DFF2BDEAA4EB209FCBA21BF -- D:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16592_none_39a34c4d205d0412\nvstor.sys
[2011/03/11 06:39:00 | 000,143,744

Quelle est alors la marche à suivre ?

Re

* Double-clique sur l'icone OTLPE
* quand demandé "Do you wish to load the remote registry", selectionne "Yes"
* quand demandé "Do you wish to load remote user profile(s) for scanning", selectionne "Yes"
* verifier que "Automatically Load All Remaining Users" est sélectionné et presse OK

http://imagesup.org/image

* sous Custom Scan box copie_colle le tout ci dessous et clic RUNFIX

:OTL
O20 - HKU\rouby106710_ON_D Winlogon: Shell - (C:\Users\rouby106710\AppData\Roaming\skype.dat) - D:\Users\rouby106710\AppData\Roaming\skype.dat ()
[2012/01/11 07:48:09 | 000,057,856 | ---- | C] () -- D:\Users\rouby106710\AppData\Roaming\skype.dat
D:\Users\rouby106710\AppData\Roaming\skype.dat

tu conserves le rapport qui s'affiche ; et tu le copies et colles dans ta prochaine réponse

@+

Problème : il ne me propose pas "Do you wish to load the remote registry".

Peut-être parce que j'ai fermé le programme avant de le re-lancer ?

Par contre j'ai une icone "Remote Registry" sur mon bureau.

Re

tu relances mais tu choisis RunFix après avoir collé ces lignes

@+

Voici le fichier text :

========== OTL ==========
Registry value HKEY_USERS\rouby106710_ON_D\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\rouby106710\AppData\Roaming\skype.dat deleted successfully.
D:\Users\rouby106710\AppData\Roaming\skype.dat moved successfully.
File D:\Users\rouby106710\AppData\Roaming\skype.dat not found.

OTLPE by OldTimer - Version 3.1.48.0 log created on 05132013_222954

Re

Démarre ton PC normalement cela devrait fonctionner

Tiens moi au courant;merci

@+

Yes ! Ca remarche, je te remercie infiniement !

Y-a-t-il des analyses complémentaires à effectuer ?

Re

Oui;

Pour de plus amples informations, fait ceci stp

Ouvre ce lien et télécharge ZHPDiag de Nicolas Coolman :

https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

Ou

https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/

en bas de la page ZHP avec un numéro de version.

Une fois le téléchargement achevé,

Double-clique sur l'icône pour lancer le programme. Sous Vista ; Seven ou Windows 8 clic droit « exécuter en tant que administrateur »

Clique sur la loupe avec le signe + pour lancer l'analyse.

Laisse l'outil travailler, il peut être assez long.

Ferme ZHPDiag en fin d'analyse.

Pour transmettre le rapport clique sur ce lien:
http://pjjoint.malekal.com/

Si problème utilise un des suivants

https://forums-fec.be/upload
https://www.cjoint.com/

Regarde sur le bureau

Sélectionne le fichier ZHPDiag.txt.

Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.com/cjlink.php?file=cj200905/cijSKAP5fU.txt

est ajouté dans la page.

Copie ce lien dans ta réponse.

Merci

@+

Voici le lien pour le rapport obtenu :

https://pjjoint.malekal.com/files.php?id=ZHPDiag_20130513_y15y12m10e12p11

Re

1) Pour ton information, ton ordinateur est infecté par plusieurs logiciels publicitaires... Pour éviter ce genre de problème :
- Ne télécharge aucun programme proposé dans des publicités ou sur des sites suspects.
- A noter que certains sites connus comme O1net, Softronic, Tuto4PC, etc modifient parfois les programmes proposés au téléchargement pour y ajouter des logiciels publicitaires ==> Préfère toujours le téléchargement directement sur le site de l'éditeur.

- Au cours de l'installation d'un programme gratuit, lis bien attentivement et décoche tous les programmes additionnels qui sont proposés, en particulier les barres d'outils.

Télécharge AdwCleaner ( d'Xplode ) sur ton bureau.
Lance le, clique sur [Suppression] puis patiente le temps du scan.
Lorsque le message indiquant qu'AdwCleaner a détecté une variante spécifique d'adware s'affiche, clique sur [OK]
- L'ordinateur va redémarrer tout seul. Redémarre-le en mode normal.
- AdwCleaner s'ouvrira normalement, avec comme seul choix possible [Suppression]
- Clique dessus, puis patiente pendant la suppression.
- Une fois la suppression effectuée, AdwCleaner t'invitera à redémarrer l'ordinateur
- Au redémarrage, un rapport s'ouvrira. Poste le sur le forum.

Note : Le rapport est également sauvegardé sous C:\AdwCleaner[S1].txt

A lire :
Les toolbars, c'est pas obligatoire ( par Malekal ) :https://forum.malekal.com/viewtopic.php?t=6173&start=
Les programmes potentiellement indésirables :
https://forum.malekal.com/viewtopic.php?t=33776&start=


2)Tu disposes de Malwaresbytes,met le à jour et lance une analyse rapide et poste ce rapport après suppression

Merci

@+

Voici le rapport AdwCleaner :

# AdwCleaner v2.300 - Rapport créé le 13/05/2013 à 23:52:02
# Mis à jour le 28/04/2013 par Xplode
# Système d'exploitation : Windows 7 Professional Service Pack 1 (32 bits)
# Nom d'utilisateur : rouby106710 - ESC-111519
# Mode de démarrage : Normal
# Exécuté depuis : C:\Users\rouby106710\Downloads\adwcleaner.exe
# Option [Suppression]

***** [Services] *****

Arrêté & Supprimé : IBUpdaterService

***** [Fichiers / Dossiers] *****

Dossier Supprimé : C:\Program Files\allsearch
Dossier Supprimé : C:\Program Files\DealPly
Dossier Supprimé : C:\Program Files\file scout
Dossier Supprimé : C:\Program Files\SpecialSavings
Dossier Supprimé : C:\ProgramData\Babylon
Dossier Supprimé : C:\ProgramData\IBUpdaterService
Dossier Supprimé : C:\ProgramData\Tarma Installer
Dossier Supprimé : C:\Users\rouby106710\AppData\Local\Google\Chrome\User Data\Default\Extensions\aidbbndgjnlaclnmhkdimcdjiebjpdel
Dossier Supprimé : C:\Users\rouby106710\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje
Dossier Supprimé : C:\Users\rouby106710\AppData\Roaming\Babylon
Dossier Supprimé : C:\Users\rouby106710\AppData\Roaming\DealPly
Dossier Supprimé : C:\Users\rouby106710\AppData\Roaming\file scout
Dossier Supprimé : C:\Users\rouby106710\AppData\Roaming\SpecialSavings
Fichier Supprimé : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
Fichier Supprimé : C:\user.js
Fichier Supprimé : C:\Users\rouby106710\AppData\Roaming\Mozilla\Firefox\Profiles\f43gyd79.default\searchplugins\babylon1.xml
Fichier Supprimé : C:\Users\rouby106710\AppData\Roaming\Mozilla\Firefox\Profiles\f43gyd79.default\searchplugins\mngr.xml

***** [Registre] *****

Clé Supprimée : HKCU\Software\a48c88e13bee43
Clé Supprimée : HKCU\Software\DataMngr
Clé Supprimée : HKCU\Software\DataMngr_Toolbar
Clé Supprimée : HKCU\Software\DealPly
Clé Supprimée : HKCU\Software\Google\Chrome\Extensions\gaiilaahiahdejapggenmdmafpmbipje
Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BB184E6D-26D1-461A-9226-B93CA8DA2AF9}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BB184E6D-26D1-461A-9226-B93CA8DA2AF9}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DealPly
Clé Supprimée : HKCU\Software\SpecialSavings
Clé Supprimée : HKLM\SOFTWARE\a48c88e13bee43
Clé Supprimée : HKLM\Software\Babylon
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Clé Supprimée : HKLM\SOFTWARE\Classes\Prod.cap
Clé Supprimée : HKLM\Software\DataMngr
Clé Supprimée : HKLM\Software\DealPly
Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\aidbbndgjnlaclnmhkdimcdjiebjpdel
Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\gaiilaahiahdejapggenmdmafpmbipje
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BB184E6D-26D1-461A-9226-B93CA8DA2AF9}
Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{09C14BAE-2D45-4133-B0FA-5EA4FE5CF978}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Updater Service
Clé Supprimée : HKLM\Software\Tarma Installer
Valeur Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]
Valeur Supprimée : HKCU\Software\Mozilla\Firefox\Extensions [specialsavings@vshsolutions.com]

***** [Navigateurs] *****

-\\ Internet Explorer v9.0.8112.16476

Remplacé : [HKCU\Software\Microsoft\Internet Explorer\Main - Default_Page_URL] = hxxp://scruter.net --> hxxp://www.google.com
Remplacé : [HKCU\Software\Microsoft\Internet Explorer\Main - Default_Search_URL] = "hxxp://scruter.net/result.php?cx=partner-pub-3128276511037541:8870723493&cof=GIMP:CCCCCC;T:000000;ALC:551a8b;GFNT:B7B7B7;LC:2200cc;BGC:FFFFFF;VLC:551a8b;GALT:008B45;FORID:10;DIV:#FFFFF0;&ie=UTF-8&q={searchTerms}&sa=Rechercher" --> hxxp://www.google.com
Remplacé : [HKCU\Software\Microsoft\Internet Explorer\Main - Default_Secondary_Page_URL] = hxxp://scruter.net --> hxxp://www.google.com
Remplacé : [HKCU\Software\Microsoft\Internet Explorer\Main - SearchMigratedDefaultName] = hxxp://scruter.net --> hxxp://www.google.com
Remplacé : [HKCU\Software\Microsoft\Internet Explorer\Main - SearchMigratedDefaultURL] = "hxxp://scruter.net/result.php?cx=partner-pub-3128276511037541:8870723493&cof=GIMP:CCCCCC;T:000000;ALC:551a8b;GFNT:B7B7B7;LC:2200cc;BGC:FFFFFF;VLC:551a8b;GALT:008B45;FORID:10;DIV:#FFFFF0;&ie=UTF-8&q={searchTerms}&sa=Rechercher" --> hxxp://www.google.com
Remplacé : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page_bak] = hxxp://scruter.net --> hxxp://www.google.com
Remplacé : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://allssearch.com/ --> hxxp://www.google.com
Remplacé : [HKCU\Software\Microsoft\Internet Explorer\SearchUrl - SearchAssistant] = scruter.net --> hxxp://www.google.com

-\\ Mozilla Firefox v20.0.1 (fr)

Fichier : C:\Users\rouby106710\AppData\Roaming\Mozilla\Firefox\Profiles\f43gyd79.default\prefs.js

C:\Users\rouby106710\AppData\Roaming\Mozilla\Firefox\Profiles\f43gyd79.default\user.js ... Supprimé !

Supprimée : user_pref("browser.startup.homepage", "hxxp://allssearch.com/");
Supprimée : user_pref("extensions.BabylonToolbar.admin", false);
Supprimée : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Supprimée : user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");
Supprimée : user_pref("extensions.BabylonToolbar.autoRvrt", "false");
Supprimée : user_pref("extensions.BabylonToolbar.babExt", "");
Supprimée : user_pref("extensions.BabylonToolbar.babTrack", "affID=115303&tt=201208_mnt_n_3412_8");
Supprimée : user_pref("extensions.BabylonToolbar.bbDpng", "10");
Supprimée : user_pref("extensions.BabylonToolbar.cntry", "FR");
Supprimée : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Supprimée : user_pref("extensions.BabylonToolbar.dp_alert", "newBlk");
Supprimée : user_pref("extensions.BabylonToolbar.dpkLst", "");
Supprimée : user_pref("extensions.BabylonToolbar.envrmnt", "production");
Supprimée : user_pref("extensions.BabylonToolbar.excTlbr", false);
Supprimée : user_pref("extensions.BabylonToolbar.hdrMd5", "CE435CAEF4D4DEF5C5F826442406CE31");
Supprimée : user_pref("extensions.BabylonToolbar.hmpg", false);
Supprimée : user_pref("extensions.BabylonToolbar.id", "a2bae722000000000000d0df9a87684f");
Supprimée : user_pref("extensions.BabylonToolbar.instlDay", "15678");
Supprimée : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Supprimée : user_pref("extensions.BabylonToolbar.isdcmntcmplt", true);
Supprimée : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.6.9.1220:32:13");
Supprimée : user_pref("extensions.BabylonToolbar.mntrvrsn", "1.3.1");
Supprimée : user_pref("extensions.BabylonToolbar.newTab", false);
Supprimée : user_pref("extensions.BabylonToolbar.pnu_base", "{\"newVrsn\":\"59\",\"lastVrsn\":\"59\",\"vrsnLoad\[...]
Supprimée : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Supprimée : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Supprimée : user_pref("extensions.BabylonToolbar.rvrt", "false");
Supprimée : user_pref("extensions.BabylonToolbar.sg", "azb");
Supprimée : user_pref("extensions.BabylonToolbar.smplGrp", "azb");
Supprimée : user_pref("extensions.BabylonToolbar.srcExt", "ss");
Supprimée : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Supprimée : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=[...]
Supprimée : user_pref("extensions.BabylonToolbar.vrsn", "1.8.4.9");
Supprimée : user_pref("extensions.BabylonToolbar.vrsnTs", "1.6.9.1220:32:13");
Supprimée : user_pref("extensions.BabylonToolbar.vrsni", "1.8.4.9");
Supprimée : user_pref("extensions.BabylonToolbar_i.babExt", "");
Supprimée : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=117116&tt=4912_5");
Supprimée : user_pref("extensions.BabylonToolbar_i.excTlbr", false);
Supprimée : user_pref("extensions.BabylonToolbar_i.newTab", false);
Supprimée : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Supprimée : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Supprimée : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.4.921:25:37");

-\\ Google Chrome v26.0.1410.64

Fichier : C:\Users\rouby106710\AppData\Local\Google\Chrome\User Data\Default\Preferences

Supprimée [l.35] : icon_url = "hxxp://www.babylon.com/favicon.ico",
Supprimée [l.38] : keyword = "babylon.com",
Supprimée [l.42] : search_url = "hxxp://search.babylon.com/?q={searchTerms}&affID=117116&tt=4912_5&babsrc=SP_ss&[...]
Supprimée [l.2056] : homepage = "hxxp://search.babylon.com/?affID=117116&tt=4912_5&babsrc=HP_ss&mntrId=a2bae722000000[...]
Supprimée [l.2322] : urls_to_restore_on_startup = [ "hxxp://search.babylon.com/?affID=117116&tt=4912_5&babsrc=HP_s[...]

*************************

AdwCleaner[S1].txt - [9996 octets] - [13/05/2013 23:52:02]

########## EOF - C:\AdwCleaner[S1].txt - [10056 octets] ##########

Je mets maintenant Malwarebytes à jour pour procéder au scan.

Voici le rapport Malwarebytes :

Malwarebytes Anti-Malware (Essai) 1.75.0.1300
www.malwarebytes.org

Version de la base de données: v2013.05.13.08

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
rouby106710 :: ESC-111519 [administrateur]

Protection: Activé

14/05/2013 00:04:26
mbam-log-2013-05-14 (00-04-26).txt

Type d'examen: Examen rapide
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 327616
Temps écoulé: 17 minute(s), 38 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 1
C:\Users\rouby106710\AppData\Local\Temp\luxtstl (Trojan.Zbot.ED) -> Mis en quarantaine et supprimé avec succès.

(fin)

Tu penses que tout est ok ?

Bonjour

Poste moi un nouveau rapport ZHPDiag;merci

@+

Voici le nouveau rapport :

Rapport de ZHPDiag v2013.5.13.114 par Nicolas Coolman, Update du 13/05/2013
Run by rouby106710 at 14/05/2013 12:56:06
State : Version à jour.
WhiteList : Enable
High Elevated Privileges : OK
UAC : Activate by user

---\\ Web Browser
MSIE: Internet Explorer v9.0.8112.16421
MFIE: Mozilla Firefox 20.0.1 (Defaut)
GCIE: Google Chrome v26.0.1410.64

---\\ Windows Product Information
~ Langage: Français
Windows 7 Business Edition, 32-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, VOLUME_MAK channel
Windows ID Activation : OK
~ Windows Partial Key : M26GM
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ System Protection
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft Security Client FR-FR Language Pack v2.1.1116.0
Windows Defender W7

---\\ System Optimizer
CCleaner v3.01 =>Piriform Ltd

---\\ Peer To Peer (P2P)
µTorrent v3.1.3

---\\ Software Update
Adobe Flash Player 10 ActiveX
Adobe Reader X

---\\ System Information
~ Processor: x86 Family 6 Model 42 Stepping 7, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 2029 MB (33% free)
System Restore: Désactivé (Disabled)
System drive C: has 1 GB (1%) free of 80 GB

---\\ Logged in mode
~ Computer Name: ESC-111519
~ User Name: rouby106710
~ All Users Names: UpdatusUser, ecenter, Administrateur,
~ Unselected Option: None
Logged in as Administrator

---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Users\rouby106710\AppData\Roaming\
~ %Desktop% : C:\Users\rouby106710\Desktop\
~ %Favorites% : C:\Users\rouby106710\Favorites\
~ %LocalAppData% : C:\Users\rouby106710\AppData\Local\
~ %StartMenu% : C:\Users\rouby106710\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 1 Go of 80 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 127 Go of 218 Go)
E:\ CD-ROM drive (Not Inserted)

---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: 34 Legitimates Filtered in 00mn 04s

---\\ Recherche particulière de fichiers génériques
[MD5.8B88EBBB05A0E56B7DCC708498C02B3E] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 06:30:54.) -- C:\Windows\Explorer.exe [2616320]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:14:45.) -- C:\Windows\System32\Wininit.exe [96256]
[MD5.C5B6468422DB1C8AA36C32CBB0197E5E] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.22/02/2013 - 04:38:00.) -- C:\Windows\System32\wininet.dll [1129472]
[MD5.6D13E1406F50C66E2A95D97F22C47560] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.20/11/2010 - 13:17:54.) -- C:\Windows\System32\Winlogon.exe [286720]
[MD5.E3AE23569749DE12D45BA3B489A036AE] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 13:21:24.) -- C:\Windows\System32\sppcomapi.dll [193536]
[MD5.9EBBBA55060F786F0FCAA3893BFA2806] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.25/04/2011 - 03:18:03.) -- C:\Windows\system32\Drivers\AFD.sys [338944]
[MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:26:15.) -- C:\Windows\system32\Drivers\atapi.sys [21584]
[MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:11:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656]
[MD5.BE167ED0FDB9C1FA1133953C18D5A6C9] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 09:38:10.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544]
[MD5.F024449C97EC1E464AAFFDA18593DB88] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 09:42:32.) -- C:\Windows\system32\Drivers\DfsC.sys [78336]
[MD5.9036377B8A6C15DC2EEC53E489D159B5] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 10:59:29.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544]
[MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:11:24.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896]
[MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 00:54:29.) -- C:\Windows\system32\Drivers\IpNat.sys [101888]
[MD5.5D16C921E3671636C0EBA3BBAAC5FD25] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:17:22.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123904]
[MD5.280122DDCF04B378EDD1AD54D71C1E54] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 09:39:44.) -- C:\Windows\system32\Drivers\netBT.sys [187904]
[MD5.5E43D2B0EE64123D4880DFA6626DEFDE] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 14:45:29.) -- C:\Windows\system32\Drivers\ntfs.sys [1211752]
[MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 00:45:35.) -- C:\Windows\system32\Drivers\Parport.sys [79360]
[MD5.D9F91EAFEC2815365CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.14/07/2009 - 00:54:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848]
[MD5.B973FCFC50DC1434E1970A146F7E3885] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.20/11/2010 - 11:24:46.) -- C:\Windows\system32\Drivers\rdpdr.sys [133632]
[MD5.3E21C083B8A01CB70BA1F09303010FCE] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 00:53:41.) -- C:\Windows\system32\Drivers\smb.sys [71168]
[MD5.B459575348C20E8121D6039DA063C704] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 09:39:17.) -- C:\Windows\system32\Drivers\tdx.sys [74752]
[MD5.F497F67932C6FA693D7DE2780631CFE7] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 13:30:16.) -- C:\Windows\system32\Drivers\volsnap.sys [245632]
~ Generic Processes: Scanned in 00mn 05s

---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/591
~ Mes musiques (My Musics) : 1/1479
~ Mes Favoris (My Favorites) : 1/36
~ Mes Documents (My Documents) : 5/1192
~ Mon Bureau (My Desktop) : 1/32
~ Menu demarrer (Programs) : 1/39
~ Hidden Files: Scanned in 00mn 21s

---\\ Processus lancés
[MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.2592]
[MD5.B2BCB4A5553E137B026F095D5260EDFC] - (.NVIDIA Corporation - NVIDIA Settings.) -- C:\Program Files\NVIDIA Corporation\Display\nvtray.exe [373864] [PID.2636]
[MD5.B7D18DE454219E1C08480578AFFD725D] - (.TOSHIBA Corporation - TOSHIBA HDD Protection Service.) -- C:\Windows\System32\ThpSrv.exe [513536] [PID.1760]
[MD5.09CCC4EEBF28D763AD1E4F9824DA9FEC] - (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2184488] [PID.2976]
[MD5.721F0968FE8281EF36001FE92E747313] - (.Synaptics Incorporated - Synaptics Pointing Device Helper.) -- C:\Program Files\Synaptics\SynTP\SynTPHelper.exe [107816] [PID.3228]
[MD5.8E2A7F1F62467A7DCB8AB2C0642F47CA] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe [152392] [PID.3904]
[MD5.229922C9FE865E952A5C101B29F33D8A] - (.Druide informatique inc. - AgentAntidote.) -- C:\Program Files\Druide\Antidote 7\Programmes32\agentantidote.exe [942656] [PID.4028]
[MD5.F6987FF6C6D683F79FDCE707B071A997] - (.SFX TEAM - SuperCopier 2 (explorer file copy replaceme.) -- C:\Program Files\SuperCopier2\SuperCopier2.exe [955392] [PID.4056]
[MD5.F10ADB851EF1BD5144FE6D1691CD7576] - (.Spotify Ltd - SpotifyWebHelper.) -- C:\Users\rouby106710\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1105408] [PID.3544]
[MD5.2F0EAAF91FC7A5C70D1F4BE9B18A1CF5] - (.Microsoft Corporation - Pense-bête.) -- C:\Windows\System32\StikyNot.exe [354304] [PID.3588]
[MD5.C7391769FCD6E04196EE8CA831E2C7E8] - (.Apple Inc. - iCloud.) -- C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [59872] [PID.3744]
[MD5.19384B2D2976C16971DA567653D5DF95] - (.Apple Inc. - ApplePhotoStreams.exe.) -- C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59872] [PID.3776]
[MD5.5ED88C99410A8262112F7550402151DF] - (.Apple Inc. - BookmarkDAV_client.exe.) -- C:\Program Files\Common Files\Apple\Internet Services\BookmarkDAV_client.exe [59872] [PID.3832]
[MD5.5E118E606E2AF56419A699210DFCF450] - (.Dropbox, Inc. - Dropbox.) -- C:\Users\rouby106710\AppData\Roaming\Dropbox\bin\Dropbox.exe [29106336] [PID.2764]
[MD5.46DA8E7484AC7A52CE1D6E428398724B] - (.Apple Inc. - Apple Push.) -- C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720] [PID.3564]
[MD5.6F5386A655598F71BAAB2D6B63A69D6A] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe [920472] [PID.5752]
[MD5.BAD6BEA0DE1F69C82BDB74378CE0C20A] - (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288] [PID.5332]
[MD5.8DEA9B1919CD66DD2B4D4B8C13B335EC] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7335424] [PID.5104]
~ Processes Running: Scanned in 00mn 02s

---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\rouby106710\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [aidbbndgjnlaclnmhkdimcdjiebjpdel] SpecialSavings.com v.2.0.0 (Activé) =>PUP.SpecialSavings
G2 - GCE: Preference [User Data\Default] [gaiilaahiahdejapggenmdmafpmbipje] DealPly v.3.3.7.2 (Activé) =>PUP.DealPly
~ Google Browser: 12 Legitimates Filtered in 00mn 10s

---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\rouby106710\AppData\Roaming\Mozilla\Firefox\Profiles\f43gyd79.default\prefs.js
P2 - FPN: [HKCU] [editions-eni.fr/EniEditionsMediaplusClientPluginProxy] - (.Editions ENI - Mediaplus plugin for all browsers.) -- C:\Users\rouby106710\AppData\Roaming\Editions ENI\MEDIAplus Client\npEniEditionsMediaplusClientPluginProxy.dll
~ Firefox Browser: 21 Legitimates Filtered in 00mn 00s

---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page = http://ww25.allssearch.com/ =>Adware.SocialSkinz
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Editions ENI - Mediaplus plugin for all browsers.) (No version) -- (.not file.)
~ IE Browser: 13 Legitimates Filtered in 00mn 00s

---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s

---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s

---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21

---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [ThpSrv] Clé orpheline
O4 - HKLM\..\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe
O4 - HKLM\..\Run: [MSC] C:\Program Files\Microsoft Security Client\mssecex.exe (.not file.)
O4 - HKLM\..\Run: [SynTPEnh] . (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SmartAudio] . (.Conexant systems, Inc. - SmartAudio Control Panel application.) -- C:\Program Files\CONEXANT\SAII\SAIICpl.exe
O4 - HKLM\..\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [agentantidote.exe] . (.Druide informatique inc. - AgentAntidote.) -- C:\Program Files\Druide\Antidote 7\Programmes32\agentantidote.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] . (.SFX TEAM - SuperCopier 2 (explorer file copy replaceme.) -- C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\rouby106710\AppData\Local\Google\Update\GoogleUpdate.exe
O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Users\rouby106710\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKCU\..\Run: [Spotify Web Helper] . (.Spotify Ltd - SpotifyWebHelper.) -- C:\Users\rouby106710\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
O4 - HKCU\..\Run: [RESTART_STICKY_NOTES] . (.Microsoft Corporation - Pense-bête.) -- C:\Windows\System32\StikyNot.exe
O4 - HKCU\..\Run: [Spotify] . (.Spotify Ltd - Spotify.) -- C:\Users\rouby106710\AppData\Roaming\Spotify\Spotify.exe
O4 - HKCU\..\Run: [iCloudServices] . (.Apple Inc. - iCloud.) -- C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
O4 - HKCU\..\Run: [ApplePhotoStreams] . (.Apple Inc. - ApplePhotoStreams.exe.) -- C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
O4 - HKCU\..\Run: [com.apple.dav.bookmarks.daemon] . (.Apple Inc. - BookmarkDAV_client.exe.) -- C:\Program Files\Common Files\Apple\Internet Services\BookmarkDAV_client.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-21-1872547231-1045620487-2165137088-1003\..\Run: [SuperCopier2.exe] . (.SFX TEAM - SuperCopier 2 (explorer file copy replaceme.) -- C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKUS\S-1-5-21-1872547231-1045620487-2165137088-1003\..\Run: [BrowserChoice] . (.Microsoft Corporation - Choix de navigateur .) -- C:\Windows\System32\browserchoice.exe
~ Application: Scanned in 00mn 00s

---\\ Autres liens utilisateurs (O4)
O4 - GS\TaskBar: Microsoft Excel 2010.lnk . (...) -- C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\Icon.36323BBA.1B09.4DF5.81E9.7E50C49501F3.exe
O4 - GS\TaskBar: Microsoft Outlook 2010.lnk . (...) -- C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\Icon.BBFBDF3E.AD9D.404E.A737.B99F118A0BDD.exe
O4 - GS\TaskBar: Microsoft PowerPoint 2010.lnk . (...) -- C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\Icon.80E9B42A.6AA2.40FB.9401.67ED29230E18.exe
O4 - GS\TaskBar: Microsoft Word 2010.lnk . (...) -- C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\Icon.2762CB40.8129.440E.B036.499525945971.exe
O4 - GS\TaskBar: Windows Explorer.lnk . (.Microsoft Corporation - Explorateur Windows.) -- C:\Windows\explorer.exe
O4 - GS\TaskBar: Windows Media Player.lnk . (.Microsoft Corporation - Lecteur Windows Media.) -- C:\Program Files\Windows Media Player\wmplayer.exe
O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch: XnView.lnk . (...) -- C:\Program Files\XnView\xnview.exe (.not file.)
O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Accessories: Private Character Editor.lnk . (.Microsoft Corporation - Éditeur de caractères privés.) -- C:\Windows\system32\eudcedit.exe
O4 - GS\SendTo: Fax Recipient.lnk . (.Microsoft Corporation - Microsoft Windows Fax and Scan.) -- C:\Windows\system32\WFS.exe
O4 - GS\SendTo: Skype.lnk . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe
~ Global Startup: Scanned in 00mn 01s

---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office14\ONBttnIE.dll
O9 - Extra button: Notes &liées OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office14\ONBTTN~1.dll
~ IE Extra Buttons: Scanned in 00mn 00s

---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{4779272A-95C9-480A-8C98-4CA19EB56B94}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{E91BF1AD-5AA0-4B57-A64D-15FB13E404E5}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{4779272A-95C9-480A-8C98-4CA19EB56B94}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{E91BF1AD-5AA0-4B57-A64D-15FB13E404E5}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{4779272A-95C9-480A-8C98-4CA19EB56B94}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{E91BF1AD-5AA0-4B57-A64D-15FB13E404E5}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = student.grenoble-em.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
~ Domain: Scanned in 00mn 00s

---\\ Protocole additionnel (O18)
O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll
O18 - Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll
~ Protocole Additionnel: Scanned in 00mn 00s

---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - AppInit_DLLs: . (...) - C:\Program Files\browse~1\25976~1.107\{c16c1~1\mngr.dll (.not file.)
~ AppInit DLL: Scanned in 00mn 00s

---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [DealPly] (...) -- C:\Users\rouby106710\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.exe (.not file.) [0] =>PUP.DealPly
[MD5.00000000000000000000000000000000] [APT] [DealPlyUpdate] (...) -- C:\Program Files\DealPly\DealPlyUpdate.exe (.not file.) [0] =>PUP.DealPly
[MD5.00000000000000000000000000000000] [APT] [{CBB9A2C2-CB93-4C7D-B89C-7351B64ADE84}] (...) -- C:\Users\rouby106710\Desktop\Windows_Movie_Maker_2.0.exe (.not file.) [0]
~ Scheduled Task: 12 Legitimates Filtered in 00mn 10s

---\\ HKCU & HKLM Software Keys
[HKCU\Software\PerformerSoft LLC]
[HKCU\Software\SkillCheck Professional]
[HKCU\Software\StarterInfo]
[HKLM\Software\930]
[HKLM\Software\Certiport]
~ Key Software: 131 Legitimates Filtered in 00mn 00s

---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 03/01/2012 - 22:48:41 - [152,140] ----D C:\Users\rouby106710\AppData\Roaming\Editions ENI
O43 - CFD: 03/01/2012 - 23:32:54 - [0,001] ----D C:\Users\rouby106710\AppData\Roaming\Google Inc
O43 - CFD: 14/05/2013 - 00:11:12 - [0,480] ----D C:\Users\rouby106710\AppData\Local\85F104CF-9146-4FEE-9195-D5BAE63C98B2.aplzod
~ 1 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 141 Legitimates Filtered in 00mn 40s

---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.D93883A374E8FC2C5FEC9DF5ABEF7B4A] - 13/05/2013 - 21:56:18 ---A- . (...) -- C:\OTL.Txt [164142]
O44 - LFC:[MD5.08962E0D5527F7DA6B28FC701AC1352F] - 13/05/2013 - 19:23:38 ---A- . (...) -- C:\Windows\ntbtlog.txt [772766]
~ Files: 14 Legitimates Filtered in 00mn 11s

---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.78F6DDCDD1C16A2DB1E1D5102FE37A8D] - 05/05/2013 - 10:19:14 ---A- - C:\Windows\Prefetch\SPOTIFY_NEW.EXE-17372599.pf
O45 - LFCP:[MD5.7D7FE60B2EAEAC27E6C36FFA000610F9] - 09/05/2013 - 19:35:00 ---A- - C:\Windows\Prefetch\IBSVC.EXE-01CFB7AC.pf
O45 - LFCP:[MD5.016FA75D70DB20FFFDC65D8489FB96AE] - 13/05/2013 - 13:22:57 ---A- - C:\Windows\Prefetch\LUXTSTL-49887029.pf
O45 - LFCP:[MD5.CD53E44B3359D31D8901A25DB3ADC99F] - 13/05/2013 - 14:12:02 ---A- - C:\Windows\Prefetch\SPOTIFY.EXE-2EF1C5DC.pf
O45 - LFCP:[MD5.A05D650CC71131BD50969BF18F09530D] - 13/05/2013 - 22:06:11 ---A- - C:\Windows\Prefetch\ANTIDO32.EXE-0690FC5B.pf
~ Prefetcher: 142 Legitimates Filtered in 00mn 02s

---\\ Opérations et fonctions au démarrage de Windows Explorer (O46)
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
~ ShellExecuteHooks: Scanned in 00mn 00s

---\\ MountPoints2 Shell Key (O51)
O51 - MPSK:{634cd5a4-9062-11e1-b4b0-e89a8f8f3c02}\AutoRun\command. (...) -- F:\LaunchU3.exe (.not file.)
O51 - MPSK:{8d62d1a7-0ee6-11e1-8f56-e89a8f8f3c02}\AutoRun\command. (...) -- F:\laucher.exe (.not file.)
~ Keys: Scanned in 00mn 00s

---\\ Microsoft Windows Policies System (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 17 Legitimates Filtered in 00mn 00s

---\\ Liste des Drivers Système (O58)
O58 - SDL:[MD5.21E785EBD7DC90A06391141AAC7892FB] - 14/07/2009 - 02:26:15 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [422976]
O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 13/07/2009 - 22:40:41 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029]
~ Drivers: Scanned in 00mn 00s

---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 12/05/2013 - 06:51:24 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\GoogleCrashHandler.exe [216968]
O61 - LFC: 12/05/2013 - 06:51:24 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\GoogleUpdate.exe [116648]
O61 - LFC: 12/05/2013 - 06:51:25 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\GoogleUpdateBroker.exe [59784]
O61 - LFC: 12/05/2013 - 06:51:25 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\GoogleUpdateOnDemand.exe [59784]
O61 - LFC: 12/05/2013 - 06:51:25 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdate.dll [848776]
O61 - LFC: 12/05/2013 - 06:51:25 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll [585608]
O61 - LFC: 12/05/2013 - 06:51:26 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\GoogleCrashHandler64.exe [287624]
O61 - LFC: 12/05/2013 - 06:51:26 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_am.dll [25480]
O61 - LFC: 12/05/2013 - 06:51:26 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ar.dll [27016]
O61 - LFC: 12/05/2013 - 06:51:26 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\psmachine.dll [162184]
O61 - LFC: 12/05/2013 - 06:51:26 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\psuser.dll [162184]
O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_bg.dll [30600]
O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_bn.dll [29064]
O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ca.dll [30088]
O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_cs.dll [29064]
O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_da.dll [29576]
O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_de.dll [31624]
O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_el.dll [31112]
O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_en-GB.dll [28552]
O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_en.dll [28040]
O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_es-419.dll [29576]
O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_es.dll [31624]
O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_et.dll [28552]
O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_fa.dll [28040]
O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_fi.dll [29576]
O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_fil.dll [30600]
O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_fr.dll [31112]
O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_gu.dll [29064]
O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_hi.dll [29576]
O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_hr.dll [30088]
O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_hu.dll [30088]
O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_id.dll [28552]
O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_is.dll [29064]
O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_it.dll [31112]
O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_iw.dll [26504]
O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ja.dll [24968]
O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_kn.dll [30088]
O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ko.dll [23944]
O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_lt.dll [28552]
O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_lv.dll [30600]
O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ml.dll [32136]
O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_mr.dll [29064]
O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ms.dll [28552]
O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_nl.dll [30600]
O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_no.dll [29576]
O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_pl.dll [30600]
O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_pt-BR.dll [29576]
O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_pt-PT.dll [29576]
O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ro.dll [30088]
O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ru.dll [29064]
O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_sk.dll [30088]
O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_sl.dll [30088]
O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_sr.dll [29576]
O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_sv.dll [29576]
O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_sw.dll [29576]
O61 - LFC: 12/05/2013 - 06:51:31 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ta.dll [30600]
O61 - LFC: 12/05/2013 - 06:51:31 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_te.dll [29576]
O61 - LFC: 12/05/2013 - 06:51:31 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_th.dll [28040]
O61 - LFC: 12/05/2013 - 06:51:31 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_tr.dll [29576]
O61 - LFC: 12/05/2013 - 06:51:31 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_uk.dll [29064]
O61 - LFC: 12/05/2013 - 06:51:31 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ur.dll [29064]
O61 - LFC: 12/05/2013 - 06:51:31 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_vi.dll [28552]
O61 - LFC: 12/05/2013 - 06:51:31 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_zh-CN.dll [22408]
O61 - LFC: 12/05/2013 - 06:51:31 ---A- C:\Users\rouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_zh-TW.dll [22408]
O61 - LFC: 12/05/2013 - 14:31:26 ---A- C:\Users\rouby106710\Documents\Dahu\DELEGATION DE SIGNATURE.docx [19743]
O61 - LFC: 13/05/2013 - 22:05:25 ---A- C:\Users\rouby106710\AppData\Local\85F104CF-9146-4FEE-9195-D5BAE63C98B2.aplzod\alarms.db [6144]
O61 - LFC: 13/05/2013 - 22:50:08 ---A- C:\Users\rouby106710\Downloads\adwcleaner.exe [628743]
O61 - LFC: 13/05/2013 - 23:10:21 ---A- C:\Users\rouby106710\AppData\Local\85F104CF-9146-4FEE-9195-D5BAE63C98B2.aplzod\main.db [497664]
O61 - LFC: 14/05/2013 - 11:30:59 ---A- C:\Users\rouby106710\Links\Flux de photos.lnk [154]
~ 83 Fichiers temporaires (Temporary files)
~ 2 Fichiers cookies (Cookies files)
~ Files: 371 Legitimates Filtered in 09mn 39s

---\\ Liste des outils de nettoyage (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
~ ADS: Scanned in 00mn 00s

---\\ Start Menu Internet (O68)
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s

---\\ Search Browser Infection (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
~ Keys: Scanned in 00mn 00s

---\\ Recherche particuliere à la racine de certains dossiers (O84)
[MD5.348C3DAC42050E3E0BB2AE5CC0F1F4ED] [SPRF][26/08/2012] (.Microsoft Corporation - Windows Live Installer.) -- C:\Users\rouby106710\AppData\Local\Temp\36230-665911-windows-movie-maker.exe [1290600]
[MD5.885E9EB42889CA547F4E3515DCDE5D3D] [SPRF][14/05/2006] (...) -- C:\Users\rouby106710\AppData\Local\Temp\7za.exe [476672]
[MD5.9123C84DF4DAB9C0707794E34B53A5C8] [SPRF][26/08/2012] (.DealPly - http://www.dealply.com/ -- C:\Users\rouby106710\AppData\Local\Temp\dealply.exe [507328] =>PUP.DealPly
[MD5.0985D6AFDFC3F0C21E743EDACBA283D4] [SPRF][12/05/2013] (...) -- C:\Users\rouby106710\AppData\Local\Temp\ExchangePerflog_8484fa310d92ba4ecfcccd43.dat [28]
[MD5.2CE6EEF84B7F306858C23000F017E2A0] [SPRF][19/03/2012] (...) -- C:\Users\rouby106710\AppData\Local\Temp\Extract.bat [80]
[MD5.54F530FC8928E532C437F2AB931306EF] [SPRF][25/05/2012] (...) -- C:\Users\rouby106710\AppData\Local\Temp\gghelp.exe [1479504]
[MD5.05FECA1B4B1F7F9D924191716AD3F0BA] [SPRF][28/12/2012] (.Pas de propriétaire - IncrediMail Installer.) -- C:\Users\rouby106710\AppData\Local\Temp\incredibar_installer.exe [463184] =>Adware.IncrediBar
[MD5.18C1D6BA5C38DEAC378773FB3A329717] [SPRF][21/10/2010] (.Adobe Systems, Inc. - Adobe® Flash® Player Installer/Uninstaller 10.1 r102.) -- C:\Users\rouby106710\AppData\Local\Temp\InstallAX.exe [2822144]
[MD5.2FF9B590342C62748885D459D082295F] [SPRF][01/04/2013] (.Adobe Systems, Inc. - Adobe® Flash® Player Installer/Uninstaller 11.0 r1.) -- C:\Users\rouby106710\AppData\Local\Temp\InstallFlashPlayer.exe [89248]
[MD5.D3CE052451EDD2349982BFFAE1BCFD6B] [SPRF][21/10/2010] (.Adobe Systems, Inc. - Adobe® Flash® Player Installer/Uninstaller 10.1 r102.) -- C:\Users\rouby106710\AppData\Local\Temp\InstallPlugin.exe [2785280]
[MD5.F8EF0845D86A6D88F940FB1780E29420] [SPRF][24/08/2012] (...) -- C:\Users\rouby106710\AppData\Local\Temp\instloffer.exe [65096]
[MD5.166887A03E14A737943803F358030639] [SPRF][26/08/2012] (...) -- C:\Users\rouby106710\AppData\Local\Temp\m3tmpreg.reg [135407]
[MD5.0BF369C8765A03092F0337D80BA519C6] [SPRF][29/03/2012] (.Babylon Ltd. - Babylon Client Setup.) -- C:\Users\rouby106710\AppData\Local\Temp\MyBabylonTB.exe [862832] =>Toolbar.Babylon
[MD5.77DFB27D68CE46659A3D5E93410C0B75] [SPRF][28/12/2012] (.Babylon Ltd. - Babylon Client Setup.) -- C:\Users\rouby106710\AppData\Local\Temp\MyBabylonTB_google_20120807.exe [899224] =>Toolbar.Babylon
[MD5.514B4609AD18D73CC06AF6F00E08E9C8] [SPRF][10/05/2012] (.Adobe Systems, Inc. - Adobe Flash Player 10.1 r52.) -- C:\Users\rouby106710\AppData\Local\Temp\push.exe [5203150]
[MD5.872E9D3DC886561AF1D27C72C4166727] [SPRF][12/06/2012] (...) -- C:\Users\rouby106710\AppData\Local\Temp\Setup.exe [818424]
[MD5.54320427500DC7B9CE1EE0D2AF048706] [SPRF][02/04/2012] (.Spotify Ltd - Spotify Installer.) -- C:\Users\rouby106710\AppData\Local\Temp\SpotifyUpgrader.exe [18709016]
[MD5.F580CCB06C180AF131BB3D2A01368545] [SPRF][03/11/2010] (.TOSHIBA Corporation - StartMen Application.) -- C:\Users\rouby106710\AppData\Local\Temp\StartMenu.exe [86016]
[MD5.77DFB27D68CE46659A3D5E93410C0B75] [SPRF][26/08/2012] (.Babylon Ltd. - Babylon Client Setup.) -- C:\Users\rouby106710\AppData\Local\Temp\tbbabylonv3.exe [899224] =>Toolbar.Babylon
[MD5.E35C4CA0FC282238E0A2BAFB1CAAFE5A] [SPRF][17/10/2012] (.Babylon Ltd. - Uninstaller Application.) -- C:\Users\rouby106710\AppData\Local\Temp\uninst1.exe [340632] =>Toolbar.Babylon
[MD5.FF6E0179F60F08B648AEBD597EF0CAF1] [SPRF][28/12/2012] (.Somoto Ltd. - FilesFrog Update Checker.) -- C:\Users\rouby106710\AppData\Local\Temp\UpdateCheckerSetup.exe [260040] =>Adware.MegaSearch
[MD5.C7B41F3508667C1526D2874210E28892] [SPRF][02/09/2012] (...) -- C:\Users\rouby106710\AppData\Local\Temp\uttE12A.tmp.bat [74]
[MD5.B936F0F378B9A35489353E878154E899] [SPRF][26/01/2012] (.Microsoft Corporation - Microsoft Visual C++ 2008 Redistributable Setup.) -- C:\Users\rouby106710\AppData\Local\Temp\vcredist_x86.exe [1821192]
[MD5.69D2894206516657B7A06EEEA5B917E5] [SPRF][28/12/2012] (...) -- C:\Users\rouby106710\AppData\Local\Temp\vlc-2.0.2-win32.exe [22630361]
[MD5.E03F2F24BCA457A35E1E26732AFE4A2F] [SPRF][04/01/2013] (...) -- C:\Users\rouby106710\AppData\Local\Temp\vlc-2.0.4-win32.exe [22912657]
[MD5.AE7E0C99C5BC7D28325C0CD7885C851F] [SPRF][24/10/2012] (.Yontoo LLC - Installer.) -- C:\Users\rouby106710\AppData\Local\Temp\YontooSetup-S.exe [1062504] =>PUP.Yontoo
[MD5.D345332276C4C3474F1164E90AB370D0] [SPRF][22/05/2012] (...) -- C:\Users\rouby106710\Desktop\mirc7-22.exe [119]
~ Files: Scanned in 00mn 04s

---\\ Scan Additionnel (O88)
Database Version : v2.12091 - (13/05/2013)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 1
Fichiers trouvés (Files found) : 23

C:\Users\rouby106710\AppData\Local\Google\Chrome\User Data\Default\Extensions\aidbbndgjnlaclnmhkdimcdjiebjpdel =>PUP.SpecialSavings
C:\Users\rouby106710\AppData\Local\Temp\instloffer.exe =>PUP.OfferBox
C:\Users\rouby106710\AppData\Local\Temp\uninst1.exe =>Toolbar.Babylon
C:\Users\rouby106710\AppData\Local\Temp\incredibar_installer.exe =>Adware.IncrediBar
C:\Users\rouby106710\AppData\Local\Temp\YontooSetup-S.exe =>Adware.Yontoo
C:\Users\rouby106710\AppData\Local\Temp\MyBabylonTB.exe =>PUP.SweetIM
C:\Users\rouby106710\AppData\Local\Temp\MyBabylonTB_google_20120807.exe =>PUP.SweetIM
C:\Users\rouby106710\AppData\Local\Temp\square_babylonv2.bmp =>PUP.SweetIM
C:\Users\rouby106710\AppData\Local\Temp\square_babylonv3.bmp =>PUP.SweetIM
C:\Users\rouby106710\AppData\Local\Temp\tbbabylonv3.exe =>PUP.SweetIM
C:\Users\rouby106710\AppData\Local\Temp\square_lollipop.bmp =>Adware.Lollipop
C:\Users\rouby106710\AppData\Local\Temp\cl09lTr3.exe.part =>Adware.Bandoo
C:\Users\rouby106710\AppData\Local\Temp\dealply.exe =>PUP.DealPly
C:\Users\rouby106710\AppData\Local\Temp\S6PgHCwK.exe.part =>PUP.SweetIM
C:\Users\rouby106710\AppData\Local\Temp\UpdateCheckerSetup.exe =>Adware.MegaSearch
~ Additionnel Scan: 365075 Items scanned in 01mn 07s

---\\ Product Upgrade Codes (O90)
O90 - PUC: "710790612757DB8468EABEAEA1BC3D0A" . (.iQsystem 7.000 French.) -- C:\Windows\Installer\{16097017-7572-48BD-86AE-EBEA1ACBD3A0}\ARPPRODUCTICON.exe
~ Update Products: 42 Legitimates Filtered in 00mn 00s

---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 21/12/2012 57008 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 30/08/2011 390504 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Demand 20/02/2013 553288 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
SS - | Demand 12/04/2013 115608 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
SR - | Auto 03/08/2011 599144 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe
SR - | Auto 03/08/2011 2255464 | (nvUpdatusService) . (.NVIDIA Corporation.) - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
SR - | Auto 03/08/2011 379496 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
SR - | Auto 24/12/2010 513536 | (Thpsrv) . (.TOSHIBA Corporation.) - C:\Windows\system32\ThpSrv.exe
SS - | Demand 14/07/2009 20992 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 14/07/2009 20992 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 02s

---\\ Recherche Master Boot Record Infection (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by rouby106710 at 14/05/2013 13:10:39

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys thpdrv.sys halmacpi.dll ataport.SYS PCIIDEX.SYS msahci.sys
C:\Windows\system32\DRIVERS\thpdrv.sys TOSHIBA Corporation TOSHIBA HDD Protection
1 ntkrnlpa!IofCallDriver[0x83270BC5] >> \Device\Harddisk0\DR0[0x85F23AC8]
5 thpdrv[0x895EDBD9] >> ntkrnlpa!IofCallDriver[0x83270BC5] >> \Device\Ide\IdeDeviceP0T0L0-0[0x859DF030]
kernel: MBR read successfully
user & kernel MBR OK
~ MBR: 14 Legitimates Filtered in 00mn 02s

---\\ Recherche Master Boot Record Infection (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by rouby106710 at 14/05/2013 13:10:41

********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 04s

~ 1243 Legitimates filtered by white list
End of the scan (545 lines in 14mn 35s)(0)

Re

Utilisation de l'outil ZHPFix :

* Copie tout le texte présent dans l'encadré ci-dessous (tu le sélectionnes avec ta souris / Clique droit dessus et choisis "copier" ou fait Ctrl+C )
-------------------------------------------------------------------------------------------------


G2 - GCE: Preference [User Data\Default] [aidbbndgjnlaclnmhkdimcdjiebjpdel] SpecialSavings.com v.2.0.0 (Activé)
G2 - GCE: Preference [User Data\Default] [gaiilaahiahdejapggenmdmafpmbipje] DealPly v.3.3.7.2 (Activé)
R0 - HKCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page = http://ww25.allssearch.com/
[MD5.00000000000000000000000000000000] [APT] [DealPly] (...) -- C:\Users\rouby106710\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [DealPlyUpdate] (...) -- C:\Program Files\DealPly\DealPlyUpdate.exe (.not file.) [0]
O45 - LFCP:[MD5.7D7FE60B2EAEAC27E6C36FFA000610F9] - 09/05/2013 - 19:35:00 ---A- - C:\Windows\Prefetch\IBSVC.EXE-01CFB7AC.pf
[MD5.9123C84DF4DAB9C0707794E34B53A5C8] [SPRF][26/08/2012] (.DealPly - http://www.dealply.com/ -- C:\Users\rouby106710\AppData\Local\Temp\dealply.exe [507328]
[MD5.05FECA1B4B1F7F9D924191716AD3F0BA] [SPRF][28/12/2012] (.Pas de propriétaire - IncrediMail Installer.) -- C:\Users\rouby106710\AppData\Local\Temp\incredibar_installer.exe [463184]
[MD5.F8EF0845D86A6D88F940FB1780E29420] [SPRF][24/08/2012] (...) -- C:\Users\rouby106710\AppData\Local\Temp\instloffer.exe [65096]
[MD5.0BF369C8765A03092F0337D80BA519C6] [SPRF][29/03/2012] (.Babylon Ltd. - Babylon Client Setup.) -- C:\Users\rouby106710\AppData\Local\Temp\MyBabylonTB.exe [862832]
[MD5.77DFB27D68CE46659A3D5E93410C0B75] [SPRF][28/12/2012] (.Babylon Ltd. - Babylon Client Setup.) -- C:\Users\rouby106710\AppData\Local\Temp\MyBabylonTB_google_20120807.exe [899224]
[MD5.77DFB27D68CE46659A3D5E93410C0B75] [SPRF][26/08/2012] (.Babylon Ltd. - Babylon Client Setup.) -- C:\Users\rouby106710\AppData\Local\Temp\tbbabylonv3.exe [899224]
[MD5.E35C4CA0FC282238E0A2BAFB1CAAFE5A] [SPRF][17/10/2012] (.Babylon Ltd. - Uninstaller Application.) -- C:\Users\rouby106710\AppData\Local\Temp\uninst1.exe [340632]
[MD5.FF6E0179F60F08B648AEBD597EF0CAF1] [SPRF][28/12/2012] (.Somoto Ltd. - FilesFrog Update Checker.) -- C:\Users\rouby106710\AppData\Local\Temp\UpdateCheckerSetup.exe [260040]
[MD5.AE7E0C99C5BC7D28325C0CD7885C851F] [SPRF][24/10/2012] (.Yontoo LLC - Installer.) -- C:\Users\rouby106710\AppData\Local\Temp\YontooSetup-S.exe [1062504]
C:\Users\rouby106710\AppData\Local\Google\Chrome\User Data\Default\Extensions\aidbbndgjnlaclnmhkdimcdjiebjpdel
C:\Users\rouby106710\AppData\Local\Temp\instloffer.exe
C:\Users\rouby106710\AppData\Local\Temp\uninst1.exe
C:\Users\rouby106710\AppData\Local\Temp\incredibar_installer.exe
C:\Users\rouby106710\AppData\Local\Temp\YontooSetup-S.exe
C:\Users\rouby106710\AppData\Local\Temp\MyBabylonTB.exe
C:\Users\rouby106710\AppData\Local\Temp\MyBabylonTB_google_20120807.exe
C:\Users\rouby106710\AppData\Local\Temp\square_babylonv2.bmp
C:\Users\rouby106710\AppData\Local\Temp\square_babylonv3.bmp
C:\Users\rouby106710\AppData\Local\Temp\tbbabylonv3.exe
C:\Users\rouby106710\AppData\Local\Temp\square_lollipop.bmp
C:\Users\rouby106710\AppData\Local\Temp\cl09lTr3.exe.part
C:\Users\rouby106710\AppData\Local\Temp\dealply.exe
C:\Users\rouby106710\AppData\Local\Temp\S6PgHCwK.exe.part
C:\Users\rouby106710\AppData\Local\Temp\UpdateCheckerSetup.exe
[MD5.00000000000000000000000000000000] [APT] [{CBB9A2C2-CB93-4C7D-B89C-7351B64ADE84}] (...) -- C:\Users\rouby106710\Desktop\Windows_Movie_Maker_2.0.exe (.not file.) [0]

FirewallRAZ
Emptytemp
EmptyCLSID


--------------------------------------------------------------------------------------------
* Lance ZHPFix à partir du raccourci sur ton Bureau (si tu es sous Windows Vista ou Windows 7, fais le par un clic-droit --> Exécuter en tant qu'administrateur)

* Clique sur l'icone représentant le presse-papier ("coller le presse-papier")
le script doit automatiquement apparaitre dans ZHPFix, sinon, colle-le (Ctrl+v)
* Clique sur le bouton GO pour lancer le nettoyage
* Copie/colle la totalité du rapport dans ta prochaine réponse.

-> laisse travailler l'outil et ne touche à rien ...

-> S'il t'est demandé de redémarrer le PC pour finir le nettoyage, fais le !

Une fois terminé, un nouveau rapport s'affiche : poste le contenu de ce dernier dans ta prochaine réponse ...

( ce rapport est en outre sauvegardé dans ce dossier C:/ZHP/ZHPFix(R1)

@+