Nouveau Virus Gendarmerie Fermé

Question

Bonjour à tous,
 
Je sollicite votre aide pour un problème survenu cet après-midi sur mon Pc portable Toshiba (OS : Windows 7). J'ai attrapé ce qui ressemble à un virus Gendarmerie / Hadopi nouvelle génération. Après avoir écumé les forums avec de multiples recherches Google je ne pense pas avoir trouvé de solution c'est pourquoi je me tourne vers vous ce soir.
 
Quand j'allume mon PC j'accède au démarrage windows classiquement, je rentre mon MDP pour accéder à ma session normalement. Une fois ceci fait tout est bloqué avec, à la place de mon bureau, l'image que je joins à ce message (ici : http://www.heberger-image.fr/images/32696_virus.jpg.html). Il y a carrément ma photo qui a été prise avec ma webcam (je m'en suis rendu compte, j'ai vu la diode s'allumer au moment où la photo a été prise) lorsque mon ordinateur a été infecté.
 
J'ai la possibilité de clore ma session en faisant un CTRL+ALT+SUPR mais c'est tout, je ne peux pas ouvrir le gestionnaire des tâches et je ne peux faire aucun clic droit (chose qui a pu permettre de résoudre des versions antérieures de ce virus).
 
Je ne peux pas démarrer en "mode sans échec" ou en "mode sans échec avec prise en charge réseau" : lorsque j'essaie, le pc démarre normalement, me demande mon MDP de session et à ce moment la la session de ferme automatiquement avant de pouvoir apercevoir le bureau et windows se met en mode normal et me redemande mon MDP de session pour s'ouvrir sur la page du virus...
 
Je suis réellement dans l'impasse, merci d'avance à celles et ceux qui pourront me venir en aide.
 Bonne soirée !

Utilisateur anonyme · Answer

Bonsoir

Tu procèdes avec OTLPE sous environnement Seven.
Télécharge ici http://www.security-helpzone.com/Tools/g3n/7pe_x___86_E.exe => OTLPE sous environnement windows 7 en CD Live (Merci à "g3n-h@ckm@n")

double-clique sur le fichier , patiente quelques secondes , puis un logiciel de gravure va s'ouvrir

insère un cd dans ton graveur puis clique sur "BURN ISO"

(normalement le fichier à graver est déjà sélectionné)
 Note : Le CD gravé, il faut maintenant redémarrer la machine sur le lecteur CDROM 
Pour ce faire suivre ce lien : Booter sur un CD 

Tu lances l'iso d'OTLPE que tu as gravé. 
*	Double-clique sur l'icone OTLPE 
*	Une fenêtre s'ouvre:  « Choose Windows Directory »

Tu choisis le lecteur qui embarque Windows (C par défaut) et ensuite tu pointes vers ce fichier Windows.
Une autre fenêtre mentionne :"Do you wish to loadremote user profile(s) for scanning ?"
Tu cliques sur Oui 
Tu choisis ensuite ta session (logiquement la première ligne de cette fenêtre)
La ligne en bas du tableau est cochée (sinon le faire)

Cliquer sur Ok


Tu cliques sur OK

Ensuite
*	sous custom scans /fixes 
1) copie_colle le contenu du cadre ci dessous: 

netsvcs 
msconfig 
safebootminimal 
safebootnetwork 
activex 
drivers32 
%ALLUSERSPROFILE%\Application Data\*. 
%ALLUSERSPROFILE%\Application Data\*.exe /s 
%SYSTEMDRIVE%\*.exe 
/md5start 
eventlog.dll 
scecli.dll 
netlogon.dll 
cngaudit.dll 
sceclt.dll 
ntelogon.dll 
logevent.dll 
iaStor.sys 
nvstor.sys 
atapi.sys 
cdrom.sys 
disk.sys 
ndis.sys 
mountmgr.sys 
aec.sys 
rasacd.sys 
mrxsmb10.sys 
mrxsmb20.sys 
termdd.sys 
mrxsmb.sys 
win32k.sys 
storport.sys 
IdeChnDr.sys 
viasraid.sys 
explorer.exe 
winlogon.exe 
wininit.exe
AGP440.sys 
vaxscsi.sys 
nvatabus.sys 
viamraid.sys 
nvata.sys 
nvgts.sys 
iastorv.sys 
ViPrt.sys 
eNetHook.dll 
ahcix86.sys 
KR10N.sys 
nvstor32.sys 
ahcix86s.sys 
nvrd32.sys 
/md5stop 
%systemroot%\*. /mp /s 
%systemroot%\system32\*.dll /lockedfiles 
%systemroot%\Tasks\*.job /lockedfiles 
%systemroot%\system32\drivers\*.sys /lockedfiles 
%systemroot%\System32\config\*.sav 
CREATERESTOREPOINT 

*	copie colle ce texte dans un fichier texte|bloc note que tu enregistres sur clé usb que tu brancheras sous reatogo tu pourras alors facilement le copier\coller. 

*	2) Clic Run Scan pour démarrer le scan. 
*	Une fois terminé , le fichier se trouve là C:\OTL.txt 
*	Copie_colle le contenu dans ta prochaine réponse.

@+

Bazath · Answer

Salut Narva 32. 
Je ne connais pas cette nouvelle version mais on peut toujours tenter quelque chose avant qu'un expert ne puisse t'apporter une meilleur solution. 

L'idée est de démarrer l'utilitaire de restauration windows sans interface graphique. Dans les versions précédentes, ce fameux virus attaquait les paramètres liés au mode d'affichage personnalisé du système. C'est la raison pour laquelle, en mode sans échec, tu n'avais plus le problème. Dans ton cas, il semble que la bête ait contourné le problème... 

As-tu la possibilité de sélectionner l'"invite de commande en mode sans échec" (ça doit être la ligne en dessous de mode sans échec avec prise en charge réseau... je n'ai pas windows, je ne peux donc pas vérifier). Si tu peux, tu vas tomber sur un joli écran tout noir où tu vas pouvoir oeuvrer en lignes de commandes. 

Si ton système est windows XP, tu devrais pouvoir activer l'outil de restauration en tapant (ou en copiant/collant) :     %systemroot%/system32/restore/rstrui.exe

Si tu es sous Vista ou Seven :      %systemroot%/system32/rstrui.exe

Ca devrait ouvrir la fenêtre de restauration et tu devrais pouvoir sélectionner un point antérieur à l'attaque. 

Désolé, pas d'autre idée pour l'instant... 
Bon courage.

narva32 · Answer

Merci pour vos réponses et votre réactivité.

Concernant l'invité de commande, je parviens à accéder au panneau de configuration ce qui me redonne beaucoup d'espoirs ! Par contre impossible de restaurer les fichiers car "La protection du système est désactivée" et impossible de l'activer, il n'y a pas l'onglet "Protection Systeme" dans le menu de gauche du menu "Systeme".

Je suis en train de télécharger le logiciel conseillé par Guillaume5188

narva32 · Answer

@Guillaume5188 Voici le rapport du scan: OTL logfile created on: 13/05/2013 21:43:51 - Run OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Program Files\OTLPE Windows 7 Professional Service Pack 1 (Version = 6.1.7601) - Type = System Internet Explorer (Version = 9.0.8112.16421) Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 65,00% Memory free 2,00 Gb Paging File | 1,00 Gb Available in Paging File | 63,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files Drive C: | 300,00 Mb Total Space | 260,86 Mb Free Space | 86,95% Space Free | Partition Type: NTFS Drive D: | 80,00 Gb Total Space | 1,15 Gb Free Space | 1,44% Space Free | Partition Type: NTFS Drive E: | 217,80 Gb Total Space | 127,07 Gb Free Space | 58,34% Space Free | Partition Type: NTFS Drive F: | 327,04 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive G: | 298,09 Gb Total Space | 297,64 Gb Free Space | 99,85% Space Free | Partition Type: NTFS Drive X: | 255,26 Mb Total Space | 252,83 Mb Free Space | 99,05% Space Free | Partition Type: NTFS Computer Name: MININT-1SALSIN | User Name: Système Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days Using ControlSet: ControlSet001 [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2013/04/12 16:31:50 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand] -- D:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013/01/27 11:11:46 | 000,295,232 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv) SRV - [2013/01/27 11:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc) SRV - [2012/12/04 21:24:20 | 000,580,576 | ---- | M] () [Auto] -- D:\ProgramData\IBUpdaterService\ibsvc.exe -- (IBUpdaterService) SRV - [2012/09/20 13:28:48 | 030,785,672 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service) SRV - [2011/08/03 12:50:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) [Auto] -- D:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService) SRV - [2011/08/03 02:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) [Auto] -- D:\Program Files\NVIDIA Corporation\3D Vision vSCPAPISvr.exe -- (Stereo Service) SRV - [2011/07/15 12:51:09 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc) SRV - [2010/12/24 19:16:30 | 000,513,536 | ---- | M] (TOSHIBA Corporation) [Auto] -- D:\Windows\System32\ThpSrv.exe -- (Thpsrv) SRV - [2009/07/14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\StorSvc.dll -- (StorSvc) SRV - [2009/07/14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009/07/14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009/07/14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2013/01/20 15:59:04 | 000,100,328 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- D:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv) DRV - [2011/08/03 12:50:00 | 010,304,104 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers vlddmkm.sys -- (nvlddmkm) DRV - [2011/03/12 09:54:18 | 002,158,592 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2011/02/10 13:52:10 | 000,141,952 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers usb3xhc.sys -- (nusb3xhc) DRV - [2011/02/10 13:52:10 | 000,063,872 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers usb3hub.sys -- (nusb3hub) DRV - [2011/01/27 12:35:04 | 001,281,152 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService) DRV - [2010/12/11 23:08:40 | 000,234,800 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand] -- D:\Windows\System32\drivers osrfbd.sys -- (tosrfbd) DRV - [2010/12/02 18:29:00 | 000,056,760 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand] -- D:\Windows\System32\drivers osrfusb.sys -- (tosrfusb) DRV - [2010/12/01 15:12:04 | 000,197,224 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- D:\Windows\System32\Drivers\RtsUStor.sys -- (RSUSBSTOR) DRV - [2010/11/30 13:40:04 | 000,226,408 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\RtsUVStor.sys -- (RSUSBVSTOR) DRV - [2010/11/20 13:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2010/11/20 13:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2010/11/20 13:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\system32\drivers\storvsc.sys -- (storvsc) DRV - [2010/11/20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010/11/20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2010/11/20 10:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2010/11/20 10:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\system32\drivers\vms3cap.sys -- (s3cap) DRV - [2010/11/12 07:10:52 | 000,122,984 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers vhda32v.sys -- (NVHDA) DRV - [2010/11/08 11:44:58 | 000,067,184 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\L1C60x86.sys -- (L1C) DRV - [2010/10/19 15:33:40 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\HECI.sys -- (MEI) Intel(R) DRV - [2010/06/18 15:44:00 | 000,015,160 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers osrfec.sys -- (tosrfec) DRV - [2009/06/29 15:16:22 | 000,013,120 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\Thpevm.sys -- (Thpevm) DRV - [2009/06/29 09:25:28 | 000,030,272 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers hpdrv.sys -- (Thpdrv) DRV - [2009/06/19 08:58:00 | 000,009,608 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand] -- D:\Windows\system32\drivers\Toshidpt.sys -- (toshidpt) DRV - [2009/06/17 10:59:00 | 000,046,984 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS osporte.sys -- (tosporte) DRV - [2007/11/09 04:00:52 | 000,023,640 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\TVALZ_O.SYS -- (TVALZ) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?pc=MSSE IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\ecenter_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://students.grenoble-em.com IE - HKU\ecenter_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?pc=MSSE IE - HKU\ecenter_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Etudiant2011_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://students.grenoble-em.com IE - HKU\Etudiant2011_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?pc=MSSE IE - HKU\Etudiant2011_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU ouby106710_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://scruter.net IE - HKU ouby106710_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = "http://scruter.net/result.php?cx=partner-pub-3128276511037541:8870723493&cof=GIMP:CCCCCC;T:000000;ALC:551a8b;GFNT:B7B7B7;LC:2200cc;BGC:FFFFFF;VLC:551a8b;GALT:008B45;FORID:10;DIV:#FFFFF0;&ie=UTF-8&q={searchTerms}&sa=Rechercher" IE - HKU ouby106710_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://scruter.net IE - HKU ouby106710_ON_D\Software\Microsoft\Internet Explorer\Main,Search Page = IE - HKU ouby106710_ON_D\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = http://scruter.net IE - HKU ouby106710_ON_D\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = "http://scruter.net/result.php?cx=partner-pub-3128276511037541:8870723493&cof=GIMP:CCCCCC;T:000000;ALC:551a8b;GFNT:B7B7B7;LC:2200cc;BGC:FFFFFF;VLC:551a8b;GALT:008B45;FORID:10;DIV:#FFFFF0;&ie=UTF-8&q={searchTerms}&sa=Rechercher" IE - HKU ouby106710_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?pc=MSSE IE - HKU ouby106710_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://scruter.net IE - HKU ouby106710_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU ouby106710_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU est_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://students.grenoble-em.com IE - HKU est_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?pc=MSSE IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://students.grenoble-em.com IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?pc=MSSE IE - HKU\UpdatusUser_ON_D\..\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - Reg Error: Key error. File not found IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.startup.homepage: "http://ww25.allssearch.com/" FF - user.js..browser.startup.homepage: "http://ww25.allssearch.com/" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\System32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: D:\Windows\System32\Adobe\Director p32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program Files\iTunes\Mozilla Plugins pitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Program Files\Java\jre6\bin ew_plugin pjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Program Files\Microsoft Silverlight\5.1.20125.0 pctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: D:\Program Files\NVIDIA Corporation\3D Vision pnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: D:\Program Files\NVIDIA Corporation\3D Vision pnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.4: D:\Program Files\VideoLAN\VLC pvlc.dll (VideoLAN) FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: D:\Users ouby106710\AppData\Local\Facebook\Video\Skype pFacebookVideoCalling.dll (Skype Limited) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145 pGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145 pGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\editions-eni.fr/EniEditionsMediaplusClientPluginProxy: D:\Users ouby106710\AppData\Roaming\Editions ENI\MEDIAplus Client pEniEditionsMediaplusClientPluginProxy.dll (Editions ENI) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\Components: C:\Program Files\Mozilla Firefox\components [2013/04/12 16:31:53 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\Plugins: C:\Program Files\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\specialsavings@vshsolutions.com: C:\Users ouby106710\AppData\Roaming\Mozilla\Extensions\specialsavings@vshsolutions.com [2012/12/04 21:25:31 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\Components: C:\Program Files\Mozilla Firefox\components [2013/04/12 16:31:53 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\Plugins: C:\Program Files\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\SeaMonkey\Extensions\mozilla_cc@internetdownloadmanager.com: C:\Users ouby106710\AppData\Roaming\IDM\idmmzcc5 [2012/12/04 21:25:31 | 000,000,000 | ---D | M] (No name found) -- D:\Users ouby106710\AppData\Roaming\mozilla\Extensions [2012/12/04 21:25:31 | 000,000,000 | ---D | M] (Special Savings) -- D:\Users ouby106710\AppData\Roaming\mozilla\Extensions\specialsavings@vshsolutions.com [2013/05/08 18:43:28 | 000,000,000 | ---D | M] (No name found) -- D:\Users ouby106710\AppData\Roaming\mozilla\Firefox\Profiles\f43gyd79.default\extensions [2012/12/04 21:25:40 | 000,002,432 | ---- | M] () -- D:\Users ouby106710\AppData\Roaming\Mozilla\Firefox\Profiles\f43gyd79.default\searchplugins\babylon1.xml [2012/12/04 21:25:40 | 000,002,432 | ---- | M] () -- D:\Users ouby106710\AppData\Roaming\Mozilla\Firefox\Profiles\f43gyd79.default\searchplugins\mngr.xml [2013/04/12 16:31:02 | 000,000,000 | ---D | M] (No name found) -- D:\Program Files\mozilla firefox\extensions File not found (No name found) -- [2013/04/12 16:31:53 | 000,263,064 | ---- | M] (Mozilla Foundation) -- D:\Program Files\mozilla firefox\components\browsercomps.dll [2013/01/11 22:10:47 | 000,001,609 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\amazon-france.xml [2012/12/04 21:25:14 | 000,002,349 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\babylon.xml [2012/09/16 12:43:13 | 000,002,465 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\bing.xml [2012/12/07 18:14:58 | 000,002,035 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\cnrtl-tlfi-fr.xml [2013/02/27 16:33:30 | 000,001,472 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\eBay-france.xml [2013/01/11 22:10:47 | 000,001,399 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\wikipedia-fr.xml [2012/12/07 18:14:58 | 000,001,169 | ---- | M] () -- D:\Program Files\mozilla firefox\searchplugins\yahoo-france.xml O1 HOSTS File: ([2009/06/10 22:39:37 | 000,000,824 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (no name) - {bb184e6d-26d1-461a-9226-b93ca8da2af9} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4 - HKLM..\Run: [agentantidote.exe] D:\Program Files\Druide\Antidote 7\Programmes32\agentantidote.exe (Druide informatique inc.) O4 - HKLM..\Run: [APSDaemon] D:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [MSC] File not found O4 - HKLM..\Run: [SmartAudio] D:\Program Files\CONEXANT\SAII\SAIICpl.exe (Conexant systems, Inc.) O4 - HKLM..\Run: [ThpSrv] D:\Windows\System32 hpsrv.exe (TOSHIBA Corporation) O4 - HKU\ecenter_ON_D..\Run: [SuperCopier2.exe] D:\Program Files\SuperCopier2\SuperCopier2.exe (SFX TEAM) O4 - HKU\Etudiant2011_ON_D..\Run: [SuperCopier2.exe] D:\Program Files\SuperCopier2\SuperCopier2.exe (SFX TEAM) O4 - HKU ouby106710_ON_D..\Run: [ApplePhotoStreams] D:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.) O4 - HKU ouby106710_ON_D..\Run: [com.apple.dav.bookmarks.daemon] D:\Program Files\Common Files\Apple\Internet Services\BookmarkDAV_client.exe (Apple Inc.) O4 - HKU ouby106710_ON_D..\Run: [Facebook Update] D:\Users ouby106710\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.) O4 - HKU ouby106710_ON_D..\Run: [iCloudServices] D:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) O4 - HKU ouby106710_ON_D..\Run: [RESTART_STICKY_NOTES] D:\Windows\System32\StikyNot.exe (Microsoft Corporation) O4 - HKU ouby106710_ON_D..\Run: [Spotify] D:\Users ouby106710\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd) O4 - HKU ouby106710_ON_D..\Run: [Spotify Web Helper] D:\Users ouby106710\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd) O4 - HKU ouby106710_ON_D..\Run: [SuperCopier2.exe] D:\Program Files\SuperCopier2\SuperCopier2.exe (SFX TEAM) O4 - HKU\UpdatusUser_ON_D..\Run: [BrowserChoice] D:\Windows\System32\browserchoice.exe (Microsoft Corporation) O4 - HKU\UpdatusUser_ON_D..\Run: [SuperCopier2.exe] D:\Program Files\SuperCopier2\SuperCopier2.exe (SFX TEAM) O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin] D:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - Startup: D:\Users ouby106710\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKU\ecenter_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Etudiant2011_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU ouby106710_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\UpdatusUser_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra Button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Notes &liées OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Notes &liées OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - D:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = student.grenoble-em.com O20 - AppInit_DLLs: (c:\progra~2\browse~1\25976~1.107\{c16c1~1\mngr.dll) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - D:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKU ouby106710_ON_D Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation) O20 - HKU ouby106710_ON_D Winlogon: Shell - (C:\Users ouby106710\AppData\Roaming\skype.dat) - D:\Users ouby106710\AppData\Roaming\skype.dat () O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - D:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2010/03/31 09:35:30 | 000,000,102 | ---- | M] () - G:\autorun.inf -- [ NTFS ] O33 - MountPoints2\{634cd5a4-9062-11e1-b4b0-e89a8f8f3c02}\Shell - "" = AutoRun O33 - MountPoints2\{634cd5a4-9062-11e1-b4b0-e89a8f8f3c02}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O33 - MountPoints2\{8d62d1a7-0ee6-11e1-8f56-e89a8f8f3c02}\Shell - "" = AutoRun O33 - MountPoints2\{8d62d1a7-0ee6-11e1-8f56-e89a8f8f3c02}\Shell\AutoRun\command - "" = F:\laucher.exe O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - File not found NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found MsConfig - StartUpReg: [b]Adobe ARM[/b] - hkey= - key= - D:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) MsConfig - StartUpReg: [b]Adobe Reader Speed Launcher[/b] - hkey= - key= - D:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) MsConfig - StartUpReg: [b]BCSSync[/b] - hkey= - key= - D:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation) MsConfig - StartUpReg: [b]SunJavaUpdateSched[/b] - hkey= - key= - D:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: MsMpSvc - D:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation) SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vmms - Service SafeBootMin: WinDefend - D:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: MsMpSvc - D:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation) SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WinDefend - D:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 10.1 ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.4 ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 10.1 ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32 egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32 hemeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD} - .NET Framework ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.0 ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32 undll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32: msacm.l3acm - D:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: MSVideo8 - D:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - D:\Windows\System32\iccvid.dll (Radius Inc.) [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2013/05/13 19:23:25 | 000,000,000 | ---D | C] -- D:\Users ouby106710\AppData\Local\ElevatedDiagnostics [2013/05/04 19:05:23 | 000,000,000 | ---D | C] -- D:\Users ouby106710\AppData\Local\85F104CF-9146-4FEE-9195-D5BAE63C98B2.aplzod [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2013/05/13 20:24:02 | 000,067,584 | --S- | M] () -- D:\Windows\bootstat.dat [2013/05/13 19:56:00 | 000,001,102 | ---- | M] () -- D:\Windows asks\GoogleUpdateTaskUserS-1-5-21-1834913581-721874356-3486338912-18422UA.job [2013/05/13 19:51:26 | 000,016,336 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013/05/13 19:51:26 | 000,016,336 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013/05/13 19:50:00 | 000,001,120 | ---- | M] () -- D:\Windows asks\FacebookUpdateTaskUserS-1-5-21-1834913581-721874356-3486338912-18422UA.job [2013/05/13 19:50:00 | 000,001,098 | ---- | M] () -- D:\Windows asks\FacebookUpdateTaskUserS-1-5-21-1834913581-721874356-3486338912-18422Core.job [2013/05/13 19:48:27 | 000,704,714 | ---- | M] () -- D:\Windows\System32\perfh00C.dat [2013/05/13 19:48:27 | 000,616,242 | ---- | M] () -- D:\Windows\System32\perfh009.dat [2013/05/13 19:48:27 | 000,130,988 | ---- | M] () -- D:\Windows\System32\perfc00C.dat [2013/05/13 19:48:27 | 000,106,622 | ---- | M] () -- D:\Windows\System32\perfc009.dat [2013/05/13 19:43:54 | 1596,346,368 | -HS- | M] () -- D:\hiberfil.sys [2013/05/13 18:25:08 | 000,000,004 | ---- | M] () -- D:\Users ouby106710\AppData\Roaming\skype.ini [2013/05/12 06:56:00 | 000,001,050 | ---- | M] () -- D:\Windows asks\GoogleUpdateTaskUserS-1-5-21-1834913581-721874356-3486338912-18422Core.job [2013/05/02 16:28:50 | 000,238,872 | ---- | M] (Microsoft Corporation) -- D:\Windows\System32\MpSigStub.exe [color=#E56717]========== Files Created - No Company Name ==========[/color] [2013/05/13 13:28:09 | 000,000,004 | ---- | C] () -- D:\Users ouby106710\AppData\Roaming\skype.ini [2012/09/10 15:00:05 | 000,021,930 | ---- | C] () -- D:\Users ouby106710\AppData\Roaming\Microsoft Excel 97-2003.ADR [2012/01/11 07:48:09 | 000,057,856 | ---- | C] () -- D:\Users ouby106710\AppData\Roaming\skype.dat [2011/09/22 13:46:45 | 000,066,048 | ---- | C] () -- D:\Windows\System32\PrintBrmUi.exe [2011/08/10 07:07:42 | 000,049,152 | ---- | C] () -- D:\Windows\System32\ITSUtils.dll [2011/08/10 07:07:40 | 000,029,184 | ---- | C] () -- D:\Windows\System32\ITSLauncher.dll [2011/08/10 07:07:40 | 000,028,672 | ---- | C] () -- D:\Windows\System32\ITSMAPI.dll [2011/08/10 07:07:40 | 000,017,920 | ---- | C] () -- D:\Windows\System32\IMPLODE.DLL [2011/08/03 02:31:54 | 000,311,912 | ---- | C] () -- D:\Windows\System32 vStreaming.exe [2011/07/15 12:45:03 | 000,002,412 | RHS- | C] () -- D:\ProgramData tuser.pol [2011/07/12 11:13:52 | 000,116,224 | ---- | C] () -- D:\Windows\System32\pdfcmnnt.dll [2011/07/12 11:04:14 | 000,000,051 | ---- | C] () -- D:\Windows\smsts.ini [2010/12/14 15:20:28 | 000,009,728 | ---- | C] () -- D:\Windows\System32\shortcut.dll [2010/10/28 12:22:18 | 000,030,895 | ---- | C] () -- D:\Windows\System32\drivers\Mixer.ini [2009/07/14 09:36:29 | 000,704,714 | ---- | C] () -- D:\Windows\System32\perfh00C.dat [2009/07/14 09:36:29 | 000,344,522 | ---- | C] () -- D:\Windows\System32\perfi00C.dat [2009/07/14 09:36:29 | 000,130,988 | ---- | C] () -- D:\Windows\System32\perfc00C.dat [2009/07/14 09:36:29 | 000,038,160 | ---- | C] () -- D:\Windows\System32\perfd00C.dat [2009/07/14 05:57:37 | 000,067,584 | --S- | C] () -- D:\Windows\bootstat.dat [2009/07/14 05:33:53 | 000,408,616 | ---- | C] () -- D:\Windows\System32\FNTCACHE.DAT [2009/07/14 03:05:48 | 000,616,242 | ---- | C] () -- D:\Windows\System32\perfh009.dat [2009/07/14 03:05:48 | 000,291,294 | ---- | C] () -- D:\Windows\System32\perfi009.dat [2009/07/14 03:05:48 | 000,106,622 | ---- | C] () -- D:\Windows\System32\perfc009.dat [2009/07/14 03:05:48 | 000,031,548 | ---- | C] () -- D:\Windows\System32\perfd009.dat [2009/07/14 03:05:05 | 000,000,741 | ---- | C] () -- D:\Windows\System32\NOISE.DAT [2009/07/14 03:04:11 | 000,215,943 | ---- | C] () -- D:\Windows\System32\dssec.dat [2009/07/14 01:55:09 | 001,332,736 | ---- | C] () -- D:\Windows\System32\hpotiop1.dll [2009/07/14 01:55:09 | 000,587,776 | ---- | C] () -- D:\Windows\System32\hpotscl1.dll [2009/07/14 00:55:01 | 000,043,131 | ---- | C] () -- D:\Windows\mib.bin [2009/07/14 00:51:43 | 000,073,728 | ---- | C] () -- D:\Windows\System32\BthpanContextHandler.dll [2009/07/14 00:42:10 | 000,064,000 | ---- | C] () -- D:\Windows\System32\BWContextHandler.dll [2009/06/10 22:26:10 | 000,673,088 | ---- | C] () -- D:\Windows\System32\mlang.dat [color=#E56717]========== LOP Check ==========[/color] [2013/02/25 19:48:30 | 000,000,000 | ---D | M] -- D:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1 [2009/07/14 05:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Application Data [2012/06/19 19:23:31 | 000,000,000 | ---D | M] -- D:\ProgramData\Babylon [2011/07/12 11:03:21 | 000,000,000 | -HSD | M] -- D:\ProgramData\Bureau [2012/06/20 14:30:37 | 000,000,000 | -H-D | M] -- D:\ProgramData\CanonBJ [2009/07/14 05:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop [2009/07/14 05:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Documents [2011/10/26 16:18:14 | 000,000,000 | ---D | M] -- D:\ProgramData\Downloaded Installations [2011/07/12 11:03:21 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favoris [2009/07/14 05:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favorites [2012/12/04 21:24:52 | 000,000,000 | ---D | M] -- D:\ProgramData\IBUpdaterService [2011/07/12 11:03:21 | 000,000,000 | -HSD | M] -- D:\ProgramData\Menu Démarrer [2011/07/12 11:03:22 | 000,000,000 | -HSD | M] -- D:\ProgramData\Modèles [2009/07/14 05:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Start Menu [2012/12/28 15:10:12 | 000,000,000 | ---D | M] -- D:\ProgramData\Tarma Installer [2009/07/14 05:53:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Templates [2011/07/15 10:12:42 | 000,000,000 | ---D | M] -- D:\ProgramData\Xerox [2011/10/26 18:03:47 | 000,000,000 | ---D | M] -- D:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2013/05/13 19:50:00 | 000,001,098 | ---- | M] () -- D:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1834913581-721874356-3486338912-18422Core.job [2013/05/13 19:50:00 | 000,001,120 | ---- | M] () -- D:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1834913581-721874356-3486338912-18422UA.job [2013/02/03 18:43:49 | 000,032,496 | ---- | M] () -- D:\Windows\Tasks\SCHEDLGU.TXT [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Custom Scans ==========[/color] Invalid Environment Variable: %ALLUSERSPROFILE%\Application Data\*. Invalid Environment Variable: %ALLUSERSPROFILE%\Application Data\*.exe [color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color] [color=#A23BEC]< MD5 for: AGP440.SYS >[/color] [2009/07/14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- D:\Windows\System32\drivers\AGP440.sys [2009/07/14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- D:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys [2009/07/14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- D:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys [2009/07/14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- D:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys [color=#A23BEC]< MD5 for: ATAPI.SYS >[/color] [2009/07/14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- D:\Windows\System32\drivers\atapi.sys [2009/07/14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- D:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys [2009/07/14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- D:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys [2009/07/14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- D:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16552_none_dd2bf0ef82c7be83\atapi.sys [2009/07/14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- D:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16593_none_dd01b18982e7479e\atapi.sys [2009/07/14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- D:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.20669_none_ddb1bfd49be72b9f\atapi.sys [2009/07/14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- D:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.20713_none_dde1cf9a9bc40507\atapi.sys [2009/07/14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- D:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.20776_none_dda3f0f09bf1f8b2\atapi.sys [2009/07/14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- D:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys [color=#A23BEC]< MD5 for: CDROM.SYS >[/color] [2009/07/14 00:11:26 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=BA6E70AA0E6091BC39DE29477D866A77 -- D:\Windows\winsxs\x86_cdrom.inf_31bf3856ad364e35_6.1.7600.16385_none_5f7fb206051affbb\cdrom.sys [2010/11/20 09:38:10 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=BE167ED0FDB9C1FA1133953C18D5A6C9 -- D:\Windows\System32\drivers\cdrom.sys [2010/11/20 09:38:10 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=BE167ED0FDB9C1FA1133953C18D5A6C9 -- D:\Windows\System32\DriverStore\FileRepository\cdrom.inf_x86_neutral_6381e09675524225\cdrom.sys [2010/11/20 09:38:10 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=BE167ED0FDB9C1FA1133953C18D5A6C9 -- D:\Windows\winsxs\x86_cdrom.inf_31bf3856ad364e35_6.1.7601.17514_none_61b0c5ce02098355\cdrom.sys [color=#A23BEC]< MD5 for: CNGAUDIT.DLL >[/color] [2009/07/14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- D:\Windows\System32\cngaudit.dll [2009/07/14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- D:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll [color=#A23BEC]< MD5 for: DISK.SYS >[/color] [2009/07/14 02:20:27 | 000,057,424 | ---- | M] (Microsoft Corporation) MD5=565003F326F99802E68CA78F2A68E9FF -- D:\Windows\System32\drivers\disk.sys [2009/07/14 02:20:27 | 000,057,424 | ---- | M] (Microsoft Corporation) MD5=565003F326F99802E68CA78F2A68E9FF -- D:\Windows\System32\DriverStore\FileRepository\disk.inf_x86_neutral_b431b61a11f8df6c\disk.sys [2009/07/14 02:20:27 | 000,057,424 | ---- | M] (Microsoft Corporation) MD5=565003F326F99802E68CA78F2A68E9FF -- D:\Windows\winsxs\x86_disk.inf_31bf3856ad364e35_6.1.7600.16385_none_f99cd807d58018cb\disk.sys [color=#A23BEC]< MD5 for: EXPLORER.EXE >[/color] [2011/02/26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe [2009/07/14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe [2011/02/26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe [2009/10/31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe [2011/02/26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe [2010/11/20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe [2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- D:\Windows\explorer.exe [2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe [2009/08/03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe [2009/08/03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe [2009/10/31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- D:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe [color=#A23BEC]< MD5 for: IASTORV.SYS >[/color] [2010/05/12 10:05:35 | 000,332,168 | ---- | M] (Intel Corporation) MD5=2D2918606673C46769FB516A5ACE958E -- D:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16592_none_aed9db9de9265a3a\iaStorV.sys [2011/03/11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- D:\Windows\System32\drivers\iaStorV.sys [2011/03/11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- D:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys [2011/03/11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- D:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys [2011/03/11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- D:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys [2011/03/11 06:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- D:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys [2009/07/14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- D:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys [2010/11/20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- D:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys [2010/11/20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- D:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys [2011/03/11 06:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- D:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys [2010/05/12 10:20:41 | 000,332,160 | ---- | M] (Intel Corporation) MD5=FE8186428F0AB44F0E500C7AA33E9B51 -- D:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20712_none_afb9f9af020317a3\iaStorV.sys [color=#A23BEC]< MD5 for: MOUNTMGR.SYS >[/color] [2009/07/14 02:20:44 | 000,078,416 | ---- | M] (Microsoft Corporation) MD5=921C18727C5920D6C0300736646931C2 -- D:\Windows\winsxs\x86_microsoft-windows-mountpointmanager_31bf3856ad364e35_6.1.7600.16385_none_f26e7ae968595905\mountmgr.sys [2010/11/20 13:30:00 | 000,078,208 | ---- | M] (Microsoft Corporation) MD5=FC8771F45ECCCFD89684E38842539B9B -- D:\Windows\System32\drivers\mountmgr.sys [2010/11/20 13:30:00 | 000,078,208 | ---- | M] (Microsoft Corporation) MD5=FC8771F45ECCCFD89684E38842539B9B -- D:\Windows\winsxs\x86_microsoft-windows-mountpointmanager_31bf3856ad364e35_6.1.7601.17514_none_f49f8eb16547dc9f\mountmgr.sys [color=#A23BEC]< MD5 for: MRXSMB.SYS >[/color] [2011/04/27 03:15:30 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=39A8FF477B3F5D0EDFE814155841C735 -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7601.21714_none_822275d1c87d251f\mrxsmb.sys [2011/04/27 03:17:22 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=5D16C921E3671636C0EBA3BBAAC5FD25 -- D:\Windows\System32\drivers\mrxsmb.sys [2011/04/27 03:17:22 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=5D16C921E3671636C0EBA3BBAAC5FD25 -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7601.17605_none_81a4a93caf5682bb\mrxsmb.sys [2011/02/23 04:37:32 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=5DC06CEB9AA4B65E724376766EB410AB -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7600.20907_none_8049e995cb4be947\mrxsmb.sys [2011/05/04 03:23:56 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=AE6248D356C6C1DE1623F0610B7FB0A3 -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7600.20959_none_8015da8dcb72a7aa\mrxsmb.sys [2010/11/20 09:42:42 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=B272B4C3E085EA860C12F2E4FAF2FFA2 -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7601.17514_none_8198d720af5f882e\mrxsmb.sys [2011/02/23 06:05:31 | 000,123,392 | ---- | M] (Microsoft Corporation) MD5=B4C76EF46322A9711C7B0F4E21EF6EA5 -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7600.16765_none_7f7d6ac8b260c14e\mrxsmb.sys [2011/02/23 04:09:47 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=C76FD653DB8B90DA85EAD12B12FFFC9F -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7601.21666_none_81ee64e3c8a3e65b\mrxsmb.sys [2011/05/04 03:43:41 | 000,123,392 | ---- | M] (Microsoft Corporation) MD5=CA7570E42522E24324A12161DB14EC02 -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7600.16808_none_7fc14d14b22d62d4\mrxsmb.sys [2011/02/23 05:47:36 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=ED3D3419B064F28D812995ED8CADC541 -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7601.17565_none_8163c7ceaf872d3a\mrxsmb.sys [2009/07/14 00:14:26 | 000,123,392 | ---- | M] (Microsoft Corporation) MD5=F4A054BE78AF7F410129C4B64B07DC9B -- D:\Windows\winsxs\x86_microsoft-windows-smbminirdr_31bf3856ad364e35_6.1.7600.16385_none_7f67c358b2710494\mrxsmb.sys [color=#A23BEC]< MD5 for: MRXSMB10.SYS >[/color] [2011/05/04 03:24:08 | 000,223,232 | ---- | M] (Microsoft Corporation) MD5=2FD4E6599970CC66D54C97BFE1FD8B4B -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7600.20959_none_8928f8e1c5c3e60c\mrxsmb10.sys [2011/02/23 04:37:48 | 000,222,208 | ---- | M] (Microsoft Corporation) MD5=383A8E2DBE6A3CE587B18AE00B77069C -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7600.20907_none_895d07e9c59d27a9\mrxsmb10.sys [2011/07/09 03:30:00 | 000,223,744 | ---- | M] (Microsoft Corporation) MD5=6D17A4791ACA19328C685D256349FEFC -- D:\Windows\System32\drivers\mrxsmb10.sys [2011/07/09 03:30:00 | 000,223,744 | ---- | M] (Microsoft Corporation) MD5=6D17A4791ACA19328C685D256349FEFC -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7601.17647_none_8a8e8874a9c6638f\mrxsmb10.sys [2011/07/09 03:20:52 | 000,223,232 | ---- | M] (Microsoft Corporation) MD5=6D8AB5E1EF631470014CB167C426A38F -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7600.21005_none_895adf77c59f283d\mrxsmb10.sys [2011/04/27 03:15:44 | 000,223,744 | ---- | M] (Microsoft Corporation) MD5=91C0082B614090FEA7EFD3E86A97BD5D -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7601.21714_none_8b359425c2ce6381\mrxsmb10.sys [2010/11/20 09:44:18 | 000,223,232 | ---- | M] (Microsoft Corporation) MD5=9AC33EF26C8A3AD0F117D00EB7301D03 -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7601.17514_none_8aabf574a9b0c690\mrxsmb10.sys [2011/04/27 03:17:36 | 000,223,744 | ---- | M] (Microsoft Corporation) MD5=A70C828A93CCE4C11617F6249F4D87FC -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7601.17605_none_8ab7c790a9a7c11d\mrxsmb10.sys [2011/07/09 04:15:40 | 000,223,744 | ---- | M] (Microsoft Corporation) MD5=AC8EB88C4176892062CF7A8952943662 -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7601.21767_none_8b028567c2f43b3b\mrxsmb10.sys [2011/05/04 03:43:59 | 000,222,720 | ---- | M] (Microsoft Corporation) MD5=C108952D3660375DCB716B222912E868 -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7600.16808_none_88d46b68ac7ea136\mrxsmb10.sys [2011/02/23 05:47:45 | 000,223,232 | ---- | M] (Microsoft Corporation) MD5=DC914446049169A964E27FD8888FFAEE -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7601.17565_none_8a76e622a9d86b9c\mrxsmb10.sys [2009/07/14 00:14:37 | 000,221,184 | ---- | M] (Microsoft Corporation) MD5=DEFFA295BD1895C6ED8E3078412AC60B -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7600.16385_none_887ae1acacc242f6\mrxsmb10.sys [2011/02/23 06:05:41 | 000,221,696 | ---- | M] (Microsoft Corporation) MD5=E593D45024A3FDD11E93CC4A6CA91101 -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7600.16765_none_8890891cacb1ffb0\mrxsmb10.sys [2011/07/09 03:26:10 | 000,222,720 | ---- | M] (Microsoft Corporation) MD5=F965C3AB2B2AE5C378F4562486E35051 -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7600.16847_none_88a82b6eac9ff7a3\mrxsmb10.sys [2011/02/23 04:10:01 | 000,223,232 | ---- | M] (Microsoft Corporation) MD5=FF9C1079052D007EF6650BD526437F08 -- D:\Windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.1.7601.21666_none_8b018337c2f524bd\mrxsmb10.sys [color=#A23BEC]< MD5 for: MRXSMB20.SYS >[/color] [2011/05/04 03:23:59 | 000,097,280 | ---- | M] (Microsoft Corporation) MD5=05FCF029FB6915DF707222D3806C760A -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7600.20959_none_8b5f62f4041b197d\mrxsmb20.sys [2009/07/14 00:14:31 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=24D76ABE5DCAD22F19D105F76FDF0CE1 -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7600.16385_none_8ab14bbeeb197667\mrxsmb20.sys [2011/05/04 03:43:48 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=25C38264A3C72594DD21D355D70D7A5D -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7600.16808_none_8b0ad57aead5d4a7\mrxsmb20.sys [2011/02/23 04:09:55 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=86CF607351BF18DB7B0B3FE593F5791E -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7601.21666_none_8d37ed4a014c582e\mrxsmb20.sys [2011/02/23 04:37:41 | 000,097,280 | ---- | M] (Microsoft Corporation) MD5=8C8081CAD5C46D0AFA483F2D26AA61EA -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7600.20907_none_8b9371fc03f45b1a\mrxsmb20.sys [2011/04/27 03:15:40 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=94191E6C88850E7E8C6713B04FF01006 -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7601.21714_none_8d6bfe38012596f2\mrxsmb20.sys [2011/02/23 06:05:35 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=A9F86C82C9CC3B679CC3957E1183A30F -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7600.16765_none_8ac6f32eeb093321\mrxsmb20.sys [2011/04/27 03:17:28 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=B81F204D146000BE76651A50670A5E9E -- D:\Windows\System32\drivers\mrxsmb20.sys [2011/04/27 03:17:28 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=B81F204D146000BE76651A50670A5E9E -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7601.17605_none_8cee31a2e7fef48e\mrxsmb20.sys [2010/11/20 09:44:09 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=E0ABDB5ED7E199E242A7D028E76C1D3A -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7601.17514_none_8ce25f86e807fa01\mrxsmb20.sys [2011/02/23 05:47:40 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=E7D90388D14FAE057C166C1801E0BF94 -- D:\Windows\winsxs\x86_microsoft-windows-smb20-minirdr_31bf3856ad364e35_6.1.7601.17565_none_8cad5034e82f9f0d\mrxsmb20.sys [color=#A23BEC]< MD5 for: NDIS.SYS >[/color] [2012/08/22 18:05:16 | 000,712,048 | ---- | M] (Microsoft Corporation) MD5=15B74B6283CEBCCE3054C1001CA01B5E -- D:\Windows\winsxs\x86_microsoft-windows-ndis_31bf3856ad364e35_6.1.7601.22097_none_aa0491cf93ad1c31 dis.sys [2009/07/14 02:20:44 | 000,710,720 | ---- | M] (Microsoft Corporation) MD5=23759D175A0A9BAAF04D05047BC135A8 -- D:\Windows\winsxs\x86_microsoft-windows-ndis_31bf3856ad364e35_6.1.7600.16385_none_a79d81ea7d62a289 dis.sys [2012/08/22 18:16:46 | 000,712,048 | ---- | M] (Microsoft Corporation) MD5=8C9C922D71F1CD4DEF73F186416B7896 -- D:\Windows\System32\drivers dis.sys [2012/08/22 18:16:46 | 000,712,048 | ---- | M] (Microsoft Corporation) MD5=8C9C922D71F1CD4DEF73F186416B7896 -- D:\Windows\winsxs\x86_microsoft-windows-ndis_31bf3856ad364e35_6.1.7601.17939_none_a9bdfee47a5cd154 dis.sys [2010/11/20 13:30:06 | 000,712,576 | ---- | M] (Microsoft Corporation) MD5=E7C54812A2AAF43316EB6930C1FFA108 -- D:\Windows\winsxs\x86_microsoft-windows-ndis_31bf3856ad364e35_6.1.7601.17514_none_a9ce95b27a512623 dis.sys [color=#A23BEC]< MD5 for: NETLOGON.DLL >[/color] [2010/11/20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- D:\Windows\System32 etlogon.dll [2010/11/20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- D:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162 etlogon.dll [2009/07/14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- D:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8 etlogon.dll [color=#A23BEC]< MD5 for: NVSTOR.SYS >[/color] [2010/05/12 10:05:45 | 000,143,752 | ---- | M] (NVIDIA Corporation) MD5=1D8B6A440DFF2BDEAA4EB209FCBA21BF -- D:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16592_none_39a34c4d205d0412 vstor.sys [2011/03/11 06:39:00 | 000,143,744

narva32 · Answer

Quelle est alors la marche à suivre ?

Utilisateur anonyme · Answer

Re

*	Double-clique sur l'icone OTLPE 
* quand demandé "Do you wish to load the remote registry", selectionne "Yes" 
* quand demandé "Do you wish to load remote user profile(s) for scanning", selectionne "Yes" 
* verifier que "Automatically Load All Remaining Users" est sélectionné et presse OK 


http://imagesup.org/image 

* sous Custom Scan box copie_colle le tout ci dessous et clic RUNFIX 

:OTL
O20 - HKU\rouby106710_ON_D Winlogon: Shell - (C:\Users\rouby106710\AppData\Roaming\skype.dat) - D:\Users\rouby106710\AppData\Roaming\skype.dat ()
[2012/01/11 07:48:09 | 000,057,856 | ---- | C] () -- D:\Users\rouby106710\AppData\Roaming\skype.dat
D:\Users\rouby106710\AppData\Roaming\skype.dat



tu conserves le rapport qui s'affiche ; et tu le copies et colles dans ta prochaine réponse
 
@+

narva32 · Answer

Problème : il ne me propose pas "Do you wish to load the remote registry".

Peut-être parce que j'ai fermé le programme avant de le re-lancer ?

narva32 · Answer

Par contre j'ai une icone "Remote Registry" sur mon bureau.

Utilisateur anonyme · Answer

Re

tu relances mais tu choisis RunFix après avoir collé ces lignes

@+

narva32 · Answer

Voici le fichier text :

========== OTL ==========
Registry value HKEY_USERSouby106710_ON_D\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell:C:\Usersouby106710\AppData\Roaming\skype.dat deleted successfully.
D:\Usersouby106710\AppData\Roaming\skype.dat moved successfully.
File D:\Usersouby106710\AppData\Roaming\skype.dat not found.
 
OTLPE by OldTimer - Version 3.1.48.0 log created on 05132013_222954

Utilisateur anonyme · Answer

Re

Démarre ton PC normalement cela devrait fonctionner

Tiens moi au courant;merci

@+

narva32 · Answer

Yes ! Ca remarche, je te remercie infiniement !

Y-a-t-il des analyses complémentaires à effectuer ?

Utilisateur anonyme · Answer

Re

Oui; 

Pour de plus amples informations, fait ceci stp

Ouvre ce lien et télécharge ZHPDiag de Nicolas Coolman : 

https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

Ou

https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/

en bas de la page ZHP avec un numéro de version.
 
Une fois le téléchargement achevé, 

Double-clique sur l'icône pour lancer le programme.  Sous Vista ; Seven ou Windows 8 clic droit «  exécuter en tant que administrateur » 

 
Clique sur  la loupe avec le signe +   pour lancer l'analyse.

Laisse l'outil travailler, il peut être assez long. 

Ferme ZHPDiag en fin d'analyse. 


Pour transmettre le rapport clique sur ce lien: 
http://pjjoint.malekal.com/

Si problème utilise un des suivants

https://forums-fec.be/upload 
 https://www.cjoint.com/


Regarde sur le bureau
 
Sélectionne le fichier ZHPDiag.txt. 

Clique sur "Cliquez ici pour déposer le fichier". 

Un lien de cette forme : 

http://www.cijoint.com/cjlink.php?file=cj200905/cijSKAP5fU.txt 

est ajouté dans la page. 

Copie ce lien dans ta réponse.

Merci

@+

narva32 · Answer

Voici le lien pour le rapport obtenu : 

https://pjjoint.malekal.com/files.php?id=ZHPDiag_20130513_y15y12m10e12p11

Utilisateur anonyme · Answer

Re

1) Pour ton information, ton ordinateur est infecté par plusieurs logiciels publicitaires... Pour éviter ce genre de problème : 
- Ne télécharge aucun programme proposé dans des publicités ou sur des sites suspects.
- A noter que certains sites connus comme   O1net, Softronic, Tuto4PC, etc   modifient parfois les programmes proposés au téléchargement pour y ajouter des logiciels publicitaires ==> Préfère   toujours   le téléchargement directement sur le site de l'éditeur. 

- Au cours de l'installation d'un programme gratuit,   lis bien attentivement et décoche tous les programmes additionnels qui sont proposés, en particulier les barres d'outils.   


Télécharge AdwCleaner ( d'Xplode ) sur ton bureau. 
Lance le, clique sur [Suppression]   puis patiente le temps du scan. 
Lorsque le message indiquant qu'AdwCleaner a détecté une variante spécifique d'adware s'affiche, clique sur  [OK]   
- L'ordinateur va redémarrer tout seul. Redémarre-le en mode normal. 
- AdwCleaner s'ouvrira normalement, avec comme seul choix possible [Suppression] 
- Clique dessus, puis patiente pendant la suppression. 
- Une fois la suppression effectuée, AdwCleaner t'invitera à redémarrer l'ordinateur 
- Au redémarrage, un rapport s'ouvrira. Poste le sur le forum. 


Note : Le rapport est également sauvegardé sous C:\AdwCleaner[S1].txt

A lire :
Les toolbars, c'est pas obligatoire ( par Malekal ) :https://forum.malekal.com/viewtopic.php?t=6173&start= 
Les programmes potentiellement indésirables :
https://forum.malekal.com/viewtopic.php?t=33776&start=


2)Tu disposes de Malwaresbytes,met le à jour et lance une analyse rapide et poste ce rapport après suppression


Merci

@+

narva32 · Answer

Voici le rapport AdwCleaner : 

# AdwCleaner v2.300 - Rapport créé le 13/05/2013 à 23:52:02
# Mis à jour le 28/04/2013 par Xplode
# Système d'exploitation : Windows 7 Professional Service Pack 1 (32 bits)
# Nom d'utilisateur : rouby106710 - ESC-111519
# Mode de démarrage : Normal
# Exécuté depuis : C:\Users\rouby106710\Downloads\adwcleaner.exe
# Option [Suppression]


***** [Services] *****

Arrêté & Supprimé : IBUpdaterService

***** [Fichiers / Dossiers] *****

Dossier Supprimé : C:\Program Files\allsearch
Dossier Supprimé : C:\Program Files\DealPly
Dossier Supprimé : C:\Program Files\file scout
Dossier Supprimé : C:\Program Files\SpecialSavings
Dossier Supprimé : C:\ProgramData\Babylon
Dossier Supprimé : C:\ProgramData\IBUpdaterService
Dossier Supprimé : C:\ProgramData\Tarma Installer
Dossier Supprimé : C:\Users\rouby106710\AppData\Local\Google\Chrome\User Data\Default\Extensions\aidbbndgjnlaclnmhkdimcdjiebjpdel
Dossier Supprimé : C:\Users\rouby106710\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje
Dossier Supprimé : C:\Users\rouby106710\AppData\Roaming\Babylon
Dossier Supprimé : C:\Users\rouby106710\AppData\Roaming\DealPly
Dossier Supprimé : C:\Users\rouby106710\AppData\Roaming\file scout
Dossier Supprimé : C:\Users\rouby106710\AppData\Roaming\SpecialSavings
Fichier Supprimé : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
Fichier Supprimé : C:\user.js
Fichier Supprimé : C:\Users\rouby106710\AppData\Roaming\Mozilla\Firefox\Profiles\f43gyd79.default\searchplugins\babylon1.xml
Fichier Supprimé : C:\Users\rouby106710\AppData\Roaming\Mozilla\Firefox\Profiles\f43gyd79.default\searchplugins\mngr.xml

***** [Registre] *****

Clé Supprimée : HKCU\Software\a48c88e13bee43
Clé Supprimée : HKCU\Software\DataMngr
Clé Supprimée : HKCU\Software\DataMngr_Toolbar
Clé Supprimée : HKCU\Software\DealPly
Clé Supprimée : HKCU\Software\Google\Chrome\Extensions\gaiilaahiahdejapggenmdmafpmbipje
Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BB184E6D-26D1-461A-9226-B93CA8DA2AF9}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BB184E6D-26D1-461A-9226-B93CA8DA2AF9}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DealPly
Clé Supprimée : HKCU\Software\SpecialSavings
Clé Supprimée : HKLM\SOFTWARE\a48c88e13bee43
Clé Supprimée : HKLM\Software\Babylon
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Clé Supprimée : HKLM\SOFTWARE\Classes\Prod.cap
Clé Supprimée : HKLM\Software\DataMngr
Clé Supprimée : HKLM\Software\DealPly
Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\aidbbndgjnlaclnmhkdimcdjiebjpdel
Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\gaiilaahiahdejapggenmdmafpmbipje
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BB184E6D-26D1-461A-9226-B93CA8DA2AF9}
Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{09C14BAE-2D45-4133-B0FA-5EA4FE5CF978}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Updater Service
Clé Supprimée : HKLM\Software\Tarma Installer
Valeur Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]
Valeur Supprimée : HKCU\Software\Mozilla\Firefox\Extensions [specialsavings@vshsolutions.com]

***** [Navigateurs] *****

-\ Internet Explorer v9.0.8112.16476

Remplacé : [HKCU\Software\Microsoft\Internet Explorer\Main - Default_Page_URL] = hxxp://scruter.net --> hxxp://www.google.com
Remplacé : [HKCU\Software\Microsoft\Internet Explorer\Main - Default_Search_URL] = "hxxp://scruter.net/result.php?cx=partner-pub-3128276511037541:8870723493&cof=GIMP:CCCCCC;T:000000;ALC:551a8b;GFNT:B7B7B7;LC:2200cc;BGC:FFFFFF;VLC:551a8b;GALT:008B45;FORID:10;DIV:#FFFFF0;&ie=UTF-8&q={searchTerms}&sa=Rechercher" --> hxxp://www.google.com
Remplacé : [HKCU\Software\Microsoft\Internet Explorer\Main - Default_Secondary_Page_URL] = hxxp://scruter.net --> hxxp://www.google.com
Remplacé : [HKCU\Software\Microsoft\Internet Explorer\Main - SearchMigratedDefaultName] = hxxp://scruter.net --> hxxp://www.google.com
Remplacé : [HKCU\Software\Microsoft\Internet Explorer\Main - SearchMigratedDefaultURL] = "hxxp://scruter.net/result.php?cx=partner-pub-3128276511037541:8870723493&cof=GIMP:CCCCCC;T:000000;ALC:551a8b;GFNT:B7B7B7;LC:2200cc;BGC:FFFFFF;VLC:551a8b;GALT:008B45;FORID:10;DIV:#FFFFF0;&ie=UTF-8&q={searchTerms}&sa=Rechercher" --> hxxp://www.google.com
Remplacé : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page_bak] = hxxp://scruter.net --> hxxp://www.google.com
Remplacé : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://allssearch.com/ --> hxxp://www.google.com
Remplacé : [HKCU\Software\Microsoft\Internet Explorer\SearchUrl - SearchAssistant] = scruter.net --> hxxp://www.google.com

-\ Mozilla Firefox v20.0.1 (fr)

Fichier : C:\Users\rouby106710\AppData\Roaming\Mozilla\Firefox\Profiles\f43gyd79.default\prefs.js

C:\Users\rouby106710\AppData\Roaming\Mozilla\Firefox\Profiles\f43gyd79.default\user.js ... Supprimé !

Supprimée : user_pref("browser.startup.homepage", "hxxp://allssearch.com/");
Supprimée : user_pref("extensions.BabylonToolbar.admin", false);
Supprimée : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Supprimée : user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");
Supprimée : user_pref("extensions.BabylonToolbar.autoRvrt", "false");
Supprimée : user_pref("extensions.BabylonToolbar.babExt", "");
Supprimée : user_pref("extensions.BabylonToolbar.babTrack", "affID=115303&tt=201208_mnt_n_3412_8");
Supprimée : user_pref("extensions.BabylonToolbar.bbDpng", "10");
Supprimée : user_pref("extensions.BabylonToolbar.cntry", "FR");
Supprimée : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Supprimée : user_pref("extensions.BabylonToolbar.dp_alert", "newBlk");
Supprimée : user_pref("extensions.BabylonToolbar.dpkLst", "");
Supprimée : user_pref("extensions.BabylonToolbar.envrmnt", "production");
Supprimée : user_pref("extensions.BabylonToolbar.excTlbr", false);
Supprimée : user_pref("extensions.BabylonToolbar.hdrMd5", "CE435CAEF4D4DEF5C5F826442406CE31");
Supprimée : user_pref("extensions.BabylonToolbar.hmpg", false);
Supprimée : user_pref("extensions.BabylonToolbar.id", "a2bae722000000000000d0df9a87684f");
Supprimée : user_pref("extensions.BabylonToolbar.instlDay", "15678");
Supprimée : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Supprimée : user_pref("extensions.BabylonToolbar.isdcmntcmplt", true);
Supprimée : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.6.9.1220:32:13");
Supprimée : user_pref("extensions.BabylonToolbar.mntrvrsn", "1.3.1");
Supprimée : user_pref("extensions.BabylonToolbar.newTab", false);
Supprimée : user_pref("extensions.BabylonToolbar.pnu_base", "{\"newVrsn\":\"59\",\"lastVrsn\":\"59\",\"vrsnLoad\[...]
Supprimée : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Supprimée : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Supprimée : user_pref("extensions.BabylonToolbar.rvrt", "false");
Supprimée : user_pref("extensions.BabylonToolbar.sg", "azb");
Supprimée : user_pref("extensions.BabylonToolbar.smplGrp", "azb");
Supprimée : user_pref("extensions.BabylonToolbar.srcExt", "ss");
Supprimée : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Supprimée : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=[...]
Supprimée : user_pref("extensions.BabylonToolbar.vrsn", "1.8.4.9");
Supprimée : user_pref("extensions.BabylonToolbar.vrsnTs", "1.6.9.1220:32:13");
Supprimée : user_pref("extensions.BabylonToolbar.vrsni", "1.8.4.9");
Supprimée : user_pref("extensions.BabylonToolbar_i.babExt", "");
Supprimée : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=117116&tt=4912_5");
Supprimée : user_pref("extensions.BabylonToolbar_i.excTlbr", false);
Supprimée : user_pref("extensions.BabylonToolbar_i.newTab", false);
Supprimée : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Supprimée : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Supprimée : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.4.921:25:37");

-\ Google Chrome v26.0.1410.64

Fichier : C:\Users\rouby106710\AppData\Local\Google\Chrome\User Data\Default\Preferences

Supprimée [l.35] : icon_url = "hxxp://www.babylon.com/favicon.ico",
Supprimée [l.38] : keyword = "babylon.com",
Supprimée [l.42] : search_url = "hxxp://search.babylon.com/?q={searchTerms}&affID=117116&tt=4912_5&babsrc=SP_ss&[...]
Supprimée [l.2056] : homepage = "hxxp://search.babylon.com/?affID=117116&tt=4912_5&babsrc=HP_ss&mntrId=a2bae722000000[...]
Supprimée [l.2322] : urls_to_restore_on_startup = [ "hxxp://search.babylon.com/?affID=117116&tt=4912_5&babsrc=HP_s[...]

*************************

AdwCleaner[S1].txt - [9996 octets] - [13/05/2013 23:52:02]

########## EOF - C:\AdwCleaner[S1].txt - [10056 octets] ##########


Je mets maintenant Malwarebytes à jour pour procéder au scan.

narva32 · Answer

Voici le rapport Malwarebytes : 

Malwarebytes Anti-Malware (Essai) 1.75.0.1300
www.malwarebytes.org

Version de la base de données: v2013.05.13.08

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
rouby106710 :: ESC-111519 [administrateur]

Protection: Activé

14/05/2013 00:04:26
mbam-log-2013-05-14 (00-04-26).txt

Type d'examen: Examen rapide
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 327616
Temps écoulé: 17 minute(s), 38 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 1
C:\Users\rouby106710\AppData\Local\Temp\luxtstl (Trojan.Zbot.ED) -> Mis en quarantaine et supprimé avec succès.

(fin)


Tu penses que tout est ok ?

Utilisateur anonyme · Answer

Bonjour

Poste moi un nouveau rapport ZHPDiag;merci

@+

narva32 · Answer

Voici le nouveau rapport : Rapport de ZHPDiag v2013.5.13.114 par Nicolas Coolman, Update du 13/05/2013 Run by rouby106710 at 14/05/2013 12:56:06 State : Version à jour. WhiteList : Enable High Elevated Privileges : OK UAC : Activate by user ---\ Web Browser MSIE: Internet Explorer v9.0.8112.16421 MFIE: Mozilla Firefox 20.0.1 (Defaut) GCIE: Google Chrome v26.0.1410.64 ---\ Windows Product Information ~ Langage: Français Windows 7 Business Edition, 32-bit Service Pack 1 (Build 7601) Windows Server License Manager Script : OK ~ Windows(R) 7, VOLUME_MAK channel Windows ID Activation : OK ~ Windows Partial Key : M26GM Windows License : OK ~ Windows Remaining Initializations Number : 3 Software Protection Service (Protection logicielle) : OK Windows Automatic Updates : OK Windows Activation Technologies : OK ---\ System Protection Malwarebytes Anti-Malware version 1.75.0.1300 Microsoft Security Client FR-FR Language Pack v2.1.1116.0 Windows Defender W7 ---\ System Optimizer CCleaner v3.01 =>Piriform Ltd ---\ Peer To Peer (P2P) µTorrent v3.1.3 ---\ Software Update Adobe Flash Player 10 ActiveX Adobe Reader X ---\ System Information ~ Processor: x86 Family 6 Model 42 Stepping 7, GenuineIntel ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 2029 MB (33% free) System Restore: Désactivé (Disabled) System drive C: has 1 GB (1%) free of 80 GB ---\ Logged in mode ~ Computer Name: ESC-111519 ~ User Name: rouby106710 ~ All Users Names: UpdatusUser, ecenter, Administrateur, ~ Unselected Option: None Logged in as Administrator ---\ Environnement Variables ~ System Unit : C:\ ~ %AppData% : C:\Users ouby106710\AppData\Roaming\ ~ %Desktop% : C:\Users ouby106710\Desktop\ ~ %Favorites% : C:\Users ouby106710\Favorites\ ~ %LocalAppData% : C:\Users ouby106710\AppData\Local\ ~ %StartMenu% : C:\Users ouby106710\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\ DOS/Devices C:\ Hard drive, Flash drive, Thumb drive (Free 1 Go of 80 Go) D:\ Hard drive, Flash drive, Thumb drive (Free 127 Go of 218 Go) E:\ CD-ROM drive (Not Inserted) ---\ Security Center & Tools Informations [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date ~ Security Center: 34 Legitimates Filtered in 00mn 04s ---\ Recherche particulière de fichiers génériques [MD5.8B88EBBB05A0E56B7DCC708498C02B3E] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 06:30:54.) -- C:\Windows\Explorer.exe [2616320] [MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:14:45.) -- C:\Windows\System32\Wininit.exe [96256] [MD5.C5B6468422DB1C8AA36C32CBB0197E5E] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.22/02/2013 - 04:38:00.) -- C:\Windows\System32\wininet.dll [1129472] [MD5.6D13E1406F50C66E2A95D97F22C47560] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.20/11/2010 - 13:17:54.) -- C:\Windows\System32\Winlogon.exe [286720] [MD5.E3AE23569749DE12D45BA3B489A036AE] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 13:21:24.) -- C:\Windows\System32\sppcomapi.dll [193536] [MD5.9EBBBA55060F786F0FCAA3893BFA2806] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.25/04/2011 - 03:18:03.) -- C:\Windows\system32\Drivers\AFD.sys [338944] [MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:26:15.) -- C:\Windows\system32\Drivers\atapi.sys [21584] [MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:11:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656] [MD5.BE167ED0FDB9C1FA1133953C18D5A6C9] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 09:38:10.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544] [MD5.F024449C97EC1E464AAFFDA18593DB88] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 09:42:32.) -- C:\Windows\system32\Drivers\DfsC.sys [78336] [MD5.9036377B8A6C15DC2EEC53E489D159B5] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 10:59:29.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544] [MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:11:24.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896] [MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 00:54:29.) -- C:\Windows\system32\Drivers\IpNat.sys [101888] [MD5.5D16C921E3671636C0EBA3BBAAC5FD25] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:17:22.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123904] [MD5.280122DDCF04B378EDD1AD54D71C1E54] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 09:39:44.) -- C:\Windows\system32\Drivers etBT.sys [187904] [MD5.5E43D2B0EE64123D4880DFA6626DEFDE] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 14:45:29.) -- C:\Windows\system32\Drivers tfs.sys [1211752] [MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 00:45:35.) -- C:\Windows\system32\Drivers\Parport.sys [79360] [MD5.D9F91EAFEC2815365CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.14/07/2009 - 00:54:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848] [MD5.B973FCFC50DC1434E1970A146F7E3885] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.20/11/2010 - 11:24:46.) -- C:\Windows\system32\Drivers dpdr.sys [133632] [MD5.3E21C083B8A01CB70BA1F09303010FCE] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 00:53:41.) -- C:\Windows\system32\Drivers\smb.sys [71168] [MD5.B459575348C20E8121D6039DA063C704] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 09:39:17.) -- C:\Windows\system32\Drivers dx.sys [74752] [MD5.F497F67932C6FA693D7DE2780631CFE7] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 13:30:16.) -- C:\Windows\system32\Drivers\volsnap.sys [245632] ~ Generic Processes: Scanned in 00mn 05s ---\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 1/591 ~ Mes musiques (My Musics) : 1/1479 ~ Mes Favoris (My Favorites) : 1/36 ~ Mes Documents (My Documents) : 5/1192 ~ Mon Bureau (My Desktop) : 1/32 ~ Menu demarrer (Programs) : 1/39 ~ Hidden Files: Scanned in 00mn 21s ---\ Processus lancés [MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.2592] [MD5.B2BCB4A5553E137B026F095D5260EDFC] - (.NVIDIA Corporation - NVIDIA Settings.) -- C:\Program Files\NVIDIA Corporation\Display vtray.exe [373864] [PID.2636] [MD5.B7D18DE454219E1C08480578AFFD725D] - (.TOSHIBA Corporation - TOSHIBA HDD Protection Service.) -- C:\Windows\System32\ThpSrv.exe [513536] [PID.1760] [MD5.09CCC4EEBF28D763AD1E4F9824DA9FEC] - (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2184488] [PID.2976] [MD5.721F0968FE8281EF36001FE92E747313] - (.Synaptics Incorporated - Synaptics Pointing Device Helper.) -- C:\Program Files\Synaptics\SynTP\SynTPHelper.exe [107816] [PID.3228] [MD5.8E2A7F1F62467A7DCB8AB2C0642F47CA] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe [152392] [PID.3904] [MD5.229922C9FE865E952A5C101B29F33D8A] - (.Druide informatique inc. - AgentAntidote.) -- C:\Program Files\Druide\Antidote 7\Programmes32\agentantidote.exe [942656] [PID.4028] [MD5.F6987FF6C6D683F79FDCE707B071A997] - (.SFX TEAM - SuperCopier 2 (explorer file copy replaceme.) -- C:\Program Files\SuperCopier2\SuperCopier2.exe [955392] [PID.4056] [MD5.F10ADB851EF1BD5144FE6D1691CD7576] - (.Spotify Ltd - SpotifyWebHelper.) -- C:\Users ouby106710\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1105408] [PID.3544] [MD5.2F0EAAF91FC7A5C70D1F4BE9B18A1CF5] - (.Microsoft Corporation - Pense-bête.) -- C:\Windows\System32\StikyNot.exe [354304] [PID.3588] [MD5.C7391769FCD6E04196EE8CA831E2C7E8] - (.Apple Inc. - iCloud.) -- C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [59872] [PID.3744] [MD5.19384B2D2976C16971DA567653D5DF95] - (.Apple Inc. - ApplePhotoStreams.exe.) -- C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59872] [PID.3776] [MD5.5ED88C99410A8262112F7550402151DF] - (.Apple Inc. - BookmarkDAV_client.exe.) -- C:\Program Files\Common Files\Apple\Internet Services\BookmarkDAV_client.exe [59872] [PID.3832] [MD5.5E118E606E2AF56419A699210DFCF450] - (.Dropbox, Inc. - Dropbox.) -- C:\Users ouby106710\AppData\Roaming\Dropbox\bin\Dropbox.exe [29106336] [PID.2764] [MD5.46DA8E7484AC7A52CE1D6E428398724B] - (.Apple Inc. - Apple Push.) -- C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720] [PID.3564] [MD5.6F5386A655598F71BAAB2D6B63A69D6A] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe [920472] [PID.5752] [MD5.BAD6BEA0DE1F69C82BDB74378CE0C20A] - (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288] [PID.5332] [MD5.8DEA9B1919CD66DD2B4D4B8C13B335EC] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7335424] [PID.5104] ~ Processes Running: Scanned in 00mn 02s ---\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2) C:\Users ouby106710\AppData\Local\Google\Chrome\User Data\Default\Preferences G2 - GCE: Preference [User Data\Default] [aidbbndgjnlaclnmhkdimcdjiebjpdel] SpecialSavings.com v.2.0.0 (Activé) =>PUP.SpecialSavings G2 - GCE: Preference [User Data\Default] [gaiilaahiahdejapggenmdmafpmbipje] DealPly v.3.3.7.2 (Activé) =>PUP.DealPly ~ Google Browser: 12 Legitimates Filtered in 00mn 10s ---\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) C:\Users ouby106710\AppData\Roaming\Mozilla\Firefox\Profiles\f43gyd79.default\prefs.js P2 - FPN: [HKCU] [editions-eni.fr/EniEditionsMediaplusClientPluginProxy] - (.Editions ENI - Mediaplus plugin for all browsers.) -- C:\Users ouby106710\AppData\Roaming\Editions ENI\MEDIAplus Client pEniEditionsMediaplusClientPluginProxy.dll ~ Firefox Browser: 21 Legitimates Filtered in 00mn 00s ---\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4) R0 - HKCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page = http://ww25.allssearch.com/ =>Adware.SocialSkinz R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Editions ENI - Mediaplus plugin for all browsers.) (No version) -- (.not file.) ~ IE Browser: 13 Legitimates Filtered in 00mn 00s ---\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe ~ Keys: Scanned in 00mn 00s ---\ Redirection du fichier Hosts (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 00s ~ Nombre de lignes (Lines number): 21 ---\ Applications démarrées par registre & par dossier (O4) O4 - HKLM\..\Run: [ThpSrv] Clé orpheline O4 - HKLM\..\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe O4 - HKLM\..\Run: [MSC] C:\Program Files\Microsoft Security Client\mssecex.exe (.not file.) O4 - HKLM\..\Run: [SynTPEnh] . (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SmartAudio] . (.Conexant systems, Inc. - SmartAudio Control Panel application.) -- C:\Program Files\CONEXANT\SAII\SAIICpl.exe O4 - HKLM\..\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe O4 - HKLM\..\Run: [agentantidote.exe] . (.Druide informatique inc. - AgentAntidote.) -- C:\Program Files\Druide\Antidote 7\Programmes32\agentantidote.exe O4 - HKCU\..\Run: [SuperCopier2.exe] . (.SFX TEAM - SuperCopier 2 (explorer file copy replaceme.) -- C:\Program Files\SuperCopier2\SuperCopier2.exe O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users ouby106710\AppData\Local\Google\Update\GoogleUpdate.exe O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Users ouby106710\AppData\Local\Facebook\Update\FacebookUpdate.exe O4 - HKCU\..\Run: [Spotify Web Helper] . (.Spotify Ltd - SpotifyWebHelper.) -- C:\Users ouby106710\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe O4 - HKCU\..\Run: [RESTART_STICKY_NOTES] . (.Microsoft Corporation - Pense-bête.) -- C:\Windows\System32\StikyNot.exe O4 - HKCU\..\Run: [Spotify] . (.Spotify Ltd - Spotify.) -- C:\Users ouby106710\AppData\Roaming\Spotify\Spotify.exe O4 - HKCU\..\Run: [iCloudServices] . (.Apple Inc. - iCloud.) -- C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe O4 - HKCU\..\Run: [ApplePhotoStreams] . (.Apple Inc. - ApplePhotoStreams.exe.) -- C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe O4 - HKCU\..\Run: [com.apple.dav.bookmarks.daemon] . (.Apple Inc. - BookmarkDAV_client.exe.) -- C:\Program Files\Common Files\Apple\Internet Services\BookmarkDAV_client.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe O4 - HKUS\S-1-5-21-1872547231-1045620487-2165137088-1003\..\Run: [SuperCopier2.exe] . (.SFX TEAM - SuperCopier 2 (explorer file copy replaceme.) -- C:\Program Files\SuperCopier2\SuperCopier2.exe O4 - HKUS\S-1-5-21-1872547231-1045620487-2165137088-1003\..\Run: [BrowserChoice] . (.Microsoft Corporation - Choix de navigateur .) -- C:\Windows\System32\browserchoice.exe ~ Application: Scanned in 00mn 00s ---\ Autres liens utilisateurs (O4) O4 - GS\TaskBar: Microsoft Excel 2010.lnk . (...) -- C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\Icon.36323BBA.1B09.4DF5.81E9.7E50C49501F3.exe O4 - GS\TaskBar: Microsoft Outlook 2010.lnk . (...) -- C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\Icon.BBFBDF3E.AD9D.404E.A737.B99F118A0BDD.exe O4 - GS\TaskBar: Microsoft PowerPoint 2010.lnk . (...) -- C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\Icon.80E9B42A.6AA2.40FB.9401.67ED29230E18.exe O4 - GS\TaskBar: Microsoft Word 2010.lnk . (...) -- C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\Icon.2762CB40.8129.440E.B036.499525945971.exe O4 - GS\TaskBar: Windows Explorer.lnk . (.Microsoft Corporation - Explorateur Windows.) -- C:\Windows\explorer.exe O4 - GS\TaskBar: Windows Media Player.lnk . (.Microsoft Corporation - Lecteur Windows Media.) -- C:\Program Files\Windows Media Player\wmplayer.exe O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\QuickLaunch: XnView.lnk . (...) -- C:\Program Files\XnView\xnview.exe (.not file.) O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Accessories: Private Character Editor.lnk . (.Microsoft Corporation - Éditeur de caractères privés.) -- C:\Windows\system32\eudcedit.exe O4 - GS\SendTo: Fax Recipient.lnk . (.Microsoft Corporation - Microsoft Windows Fax and Scan.) -- C:\Windows\system32\WFS.exe O4 - GS\SendTo: Skype.lnk . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe ~ Global Startup: Scanned in 00mn 01s ---\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office14\ONBttnIE.dll O9 - Extra button: Notes &liées OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office14\ONBTTN~1.dll ~ IE Extra Buttons: Scanned in 00mn 00s ---\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{4779272A-95C9-480A-8C98-4CA19EB56B94}: DhcpNameServer = 192.168.1.254 O17 - HKLM\System\CCS\Services\Tcpip\..\{E91BF1AD-5AA0-4B57-A64D-15FB13E404E5}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{4779272A-95C9-480A-8C98-4CA19EB56B94}: DhcpNameServer = 192.168.1.254 O17 - HKLM\System\CS1\Services\Tcpip\..\{E91BF1AD-5AA0-4B57-A64D-15FB13E404E5}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{4779272A-95C9-480A-8C98-4CA19EB56B94}: DhcpNameServer = 192.168.1.254 O17 - HKLM\System\CS2\Services\Tcpip\..\{E91BF1AD-5AA0-4B57-A64D-15FB13E404E5}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = student.grenoble-em.com O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 ~ Domain: Scanned in 00mn 00s ---\ Protocole additionnel (O18) O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll O18 - Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll ~ Protocole Additionnel: Scanned in 00mn 00s ---\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - AppInit_DLLs: . (...) - C:\Program Files\browse~1\25976~1.107\{c16c1~1\mngr.dll (.not file.) ~ AppInit DLL: Scanned in 00mn 00s ---\ Tâches planifiées en automatique (O39) [MD5.00000000000000000000000000000000] [APT] [DealPly] (...) -- C:\Users ouby106710\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.exe (.not file.) [0] =>PUP.DealPly [MD5.00000000000000000000000000000000] [APT] [DealPlyUpdate] (...) -- C:\Program Files\DealPly\DealPlyUpdate.exe (.not file.) [0] =>PUP.DealPly [MD5.00000000000000000000000000000000] [APT] [{CBB9A2C2-CB93-4C7D-B89C-7351B64ADE84}] (...) -- C:\Users ouby106710\Desktop\Windows_Movie_Maker_2.0.exe (.not file.) [0] ~ Scheduled Task: 12 Legitimates Filtered in 00mn 10s ---\ HKCU & HKLM Software Keys [HKCU\Software\PerformerSoft LLC] [HKCU\Software\SkillCheck Professional] [HKCU\Software\StarterInfo] [HKLM\Software\930] [HKLM\Software\Certiport] ~ Key Software: 131 Legitimates Filtered in 00mn 00s ---\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 03/01/2012 - 22:48:41 - [152,140] ----D C:\Users ouby106710\AppData\Roaming\Editions ENI O43 - CFD: 03/01/2012 - 23:32:54 - [0,001] ----D C:\Users ouby106710\AppData\Roaming\Google Inc O43 - CFD: 14/05/2013 - 00:11:12 - [0,480] ----D C:\Users ouby106710\AppData\Local\85F104CF-9146-4FEE-9195-D5BAE63C98B2.aplzod ~ 1 Dossiers CLSID vides (CLSID Empty Folders) ~ Program Folder: 141 Legitimates Filtered in 00mn 40s ---\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.D93883A374E8FC2C5FEC9DF5ABEF7B4A] - 13/05/2013 - 21:56:18 ---A- . (...) -- C:\OTL.Txt [164142] O44 - LFC:[MD5.08962E0D5527F7DA6B28FC701AC1352F] - 13/05/2013 - 19:23:38 ---A- . (...) -- C:\Windows tbtlog.txt [772766] ~ Files: 14 Legitimates Filtered in 00mn 11s ---\ Derniers fichiers créés dans Windows Prefetcher (O45) O45 - LFCP:[MD5.78F6DDCDD1C16A2DB1E1D5102FE37A8D] - 05/05/2013 - 10:19:14 ---A- - C:\Windows\Prefetch\SPOTIFY_NEW.EXE-17372599.pf O45 - LFCP:[MD5.7D7FE60B2EAEAC27E6C36FFA000610F9] - 09/05/2013 - 19:35:00 ---A- - C:\Windows\Prefetch\IBSVC.EXE-01CFB7AC.pf O45 - LFCP:[MD5.016FA75D70DB20FFFDC65D8489FB96AE] - 13/05/2013 - 13:22:57 ---A- - C:\Windows\Prefetch\LUXTSTL-49887029.pf O45 - LFCP:[MD5.CD53E44B3359D31D8901A25DB3ADC99F] - 13/05/2013 - 14:12:02 ---A- - C:\Windows\Prefetch\SPOTIFY.EXE-2EF1C5DC.pf O45 - LFCP:[MD5.A05D650CC71131BD50969BF18F09530D] - 13/05/2013 - 22:06:11 ---A- - C:\Windows\Prefetch\ANTIDO32.EXE-0690FC5B.pf ~ Prefetcher: 142 Legitimates Filtered in 00mn 02s ---\ Opérations et fonctions au démarrage de Windows Explorer (O46) O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL ~ ShellExecuteHooks: Scanned in 00mn 00s ---\ MountPoints2 Shell Key (O51) O51 - MPSK:{634cd5a4-9062-11e1-b4b0-e89a8f8f3c02}\AutoRun\command. (...) -- F:\LaunchU3.exe (.not file.) O51 - MPSK:{8d62d1a7-0ee6-11e1-8f56-e89a8f8f3c02}\AutoRun\command. (...) -- F:\laucher.exe (.not file.) ~ Keys: Scanned in 00mn 00s ---\ Microsoft Windows Policies System (O55) O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0 O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 ~ MWPS: 17 Legitimates Filtered in 00mn 00s ---\ Liste des Drivers Système (O58) O58 - SDL:[MD5.21E785EBD7DC90A06391141AAC7892FB] - 14/07/2009 - 02:26:15 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [422976] O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 13/07/2009 - 22:40:41 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029] ~ Drivers: Scanned in 00mn 00s ---\ Derniers fichiers modifiés ou crées (Utilisateur) (O61) O61 - LFC: 12/05/2013 - 06:51:24 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\GoogleCrashHandler.exe [216968] O61 - LFC: 12/05/2013 - 06:51:24 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\GoogleUpdate.exe [116648] O61 - LFC: 12/05/2013 - 06:51:25 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\GoogleUpdateBroker.exe [59784] O61 - LFC: 12/05/2013 - 06:51:25 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\GoogleUpdateOnDemand.exe [59784] O61 - LFC: 12/05/2013 - 06:51:25 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdate.dll [848776] O61 - LFC: 12/05/2013 - 06:51:25 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145 pGoogleUpdate3.dll [585608] O61 - LFC: 12/05/2013 - 06:51:26 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\GoogleCrashHandler64.exe [287624] O61 - LFC: 12/05/2013 - 06:51:26 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_am.dll [25480] O61 - LFC: 12/05/2013 - 06:51:26 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ar.dll [27016] O61 - LFC: 12/05/2013 - 06:51:26 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\psmachine.dll [162184] O61 - LFC: 12/05/2013 - 06:51:26 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\psuser.dll [162184] O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_bg.dll [30600] O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_bn.dll [29064] O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ca.dll [30088] O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_cs.dll [29064] O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_da.dll [29576] O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_de.dll [31624] O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_el.dll [31112] O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_en-GB.dll [28552] O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_en.dll [28040] O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_es-419.dll [29576] O61 - LFC: 12/05/2013 - 06:51:27 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_es.dll [31624] O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_et.dll [28552] O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_fa.dll [28040] O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_fi.dll [29576] O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_fil.dll [30600] O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_fr.dll [31112] O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_gu.dll [29064] O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_hi.dll [29576] O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_hr.dll [30088] O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_hu.dll [30088] O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_id.dll [28552] O61 - LFC: 12/05/2013 - 06:51:28 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_is.dll [29064] O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_it.dll [31112] O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_iw.dll [26504] O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ja.dll [24968] O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_kn.dll [30088] O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ko.dll [23944] O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_lt.dll [28552] O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_lv.dll [30600] O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ml.dll [32136] O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_mr.dll [29064] O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ms.dll [28552] O61 - LFC: 12/05/2013 - 06:51:29 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_nl.dll [30600] O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_no.dll [29576] O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_pl.dll [30600] O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_pt-BR.dll [29576] O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_pt-PT.dll [29576] O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ro.dll [30088] O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ru.dll [29064] O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_sk.dll [30088] O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_sl.dll [30088] O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_sr.dll [29576] O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_sv.dll [29576] O61 - LFC: 12/05/2013 - 06:51:30 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_sw.dll [29576] O61 - LFC: 12/05/2013 - 06:51:31 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ta.dll [30600] O61 - LFC: 12/05/2013 - 06:51:31 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_te.dll [29576] O61 - LFC: 12/05/2013 - 06:51:31 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_th.dll [28040] O61 - LFC: 12/05/2013 - 06:51:31 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_tr.dll [29576] O61 - LFC: 12/05/2013 - 06:51:31 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_uk.dll [29064] O61 - LFC: 12/05/2013 - 06:51:31 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_ur.dll [29064] O61 - LFC: 12/05/2013 - 06:51:31 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_vi.dll [28552] O61 - LFC: 12/05/2013 - 06:51:31 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_zh-CN.dll [22408] O61 - LFC: 12/05/2013 - 06:51:31 ---A- C:\Users ouby106710\AppData\Local\Google\Update\1.3.21.145\goopdateres_zh-TW.dll [22408] O61 - LFC: 12/05/2013 - 14:31:26 ---A- C:\Users ouby106710\Documents\Dahu\DELEGATION DE SIGNATURE.docx [19743] O61 - LFC: 13/05/2013 - 22:05:25 ---A- C:\Users ouby106710\AppData\Local\85F104CF-9146-4FEE-9195-D5BAE63C98B2.aplzod\alarms.db [6144] O61 - LFC: 13/05/2013 - 22:50:08 ---A- C:\Users ouby106710\Downloads\adwcleaner.exe [628743] O61 - LFC: 13/05/2013 - 23:10:21 ---A- C:\Users ouby106710\AppData\Local\85F104CF-9146-4FEE-9195-D5BAE63C98B2.aplzod\main.db [497664] O61 - LFC: 14/05/2013 - 11:30:59 ---A- C:\Users ouby106710\Links\Flux de photos.lnk [154] ~ 83 Fichiers temporaires (Temporary files) ~ 2 Fichiers cookies (Cookies files) ~ Files: 371 Legitimates Filtered in 09mn 39s ---\ Liste des outils de nettoyage (O63) O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 ~ ADS: Scanned in 00mn 00s ---\ Start Menu Internet (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\ Search Browser Infection (O69) O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8 O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8 ~ Keys: Scanned in 00mn 00s ---\ Recherche particuliere à la racine de certains dossiers (O84) [MD5.348C3DAC42050E3E0BB2AE5CC0F1F4ED] [SPRF][26/08/2012] (.Microsoft Corporation - Windows Live Installer.) -- C:\Users ouby106710\AppData\Local\Temp\36230-665911-windows-movie-maker.exe [1290600] [MD5.885E9EB42889CA547F4E3515DCDE5D3D] [SPRF][14/05/2006] (...) -- C:\Users ouby106710\AppData\Local\Temp\7za.exe [476672] [MD5.9123C84DF4DAB9C0707794E34B53A5C8] [SPRF][26/08/2012] (.DealPly - http://www.dealply.com/ -- C:\Users ouby106710\AppData\Local\Temp\dealply.exe [507328] =>PUP.DealPly [MD5.0985D6AFDFC3F0C21E743EDACBA283D4] [SPRF][12/05/2013] (...) -- C:\Users ouby106710\AppData\Local\Temp\ExchangePerflog_8484fa310d92ba4ecfcccd43.dat [28] [MD5.2CE6EEF84B7F306858C23000F017E2A0] [SPRF][19/03/2012] (...) -- C:\Users ouby106710\AppData\Local\Temp\Extract.bat [80] [MD5.54F530FC8928E532C437F2AB931306EF] [SPRF][25/05/2012] (...) -- C:\Users ouby106710\AppData\Local\Temp\gghelp.exe [1479504] [MD5.05FECA1B4B1F7F9D924191716AD3F0BA] [SPRF][28/12/2012] (.Pas de propriétaire - IncrediMail Installer.) -- C:\Users ouby106710\AppData\Local\Temp\incredibar_installer.exe [463184] =>Adware.IncrediBar [MD5.18C1D6BA5C38DEAC378773FB3A329717] [SPRF][21/10/2010] (.Adobe Systems, Inc. - Adobe® Flash® Player Installer/Uninstaller 10.1 r102.) -- C:\Users ouby106710\AppData\Local\Temp\InstallAX.exe [2822144] [MD5.2FF9B590342C62748885D459D082295F] [SPRF][01/04/2013] (.Adobe Systems, Inc. - Adobe® Flash® Player Installer/Uninstaller 11.0 r1.) -- C:\Users ouby106710\AppData\Local\Temp\InstallFlashPlayer.exe [89248] [MD5.D3CE052451EDD2349982BFFAE1BCFD6B] [SPRF][21/10/2010] (.Adobe Systems, Inc. - Adobe® Flash® Player Installer/Uninstaller 10.1 r102.) -- C:\Users ouby106710\AppData\Local\Temp\InstallPlugin.exe [2785280] [MD5.F8EF0845D86A6D88F940FB1780E29420] [SPRF][24/08/2012] (...) -- C:\Users ouby106710\AppData\Local\Temp\instloffer.exe [65096] [MD5.166887A03E14A737943803F358030639] [SPRF][26/08/2012] (...) -- C:\Users ouby106710\AppData\Local\Temp\m3tmpreg.reg [135407] [MD5.0BF369C8765A03092F0337D80BA519C6] [SPRF][29/03/2012] (.Babylon Ltd. - Babylon Client Setup.) -- C:\Users ouby106710\AppData\Local\Temp\MyBabylonTB.exe [862832] =>Toolbar.Babylon [MD5.77DFB27D68CE46659A3D5E93410C0B75] [SPRF][28/12/2012] (.Babylon Ltd. - Babylon Client Setup.) -- C:\Users ouby106710\AppData\Local\Temp\MyBabylonTB_google_20120807.exe [899224] =>Toolbar.Babylon [MD5.514B4609AD18D73CC06AF6F00E08E9C8] [SPRF][10/05/2012] (.Adobe Systems, Inc. - Adobe Flash Player 10.1 r52.) -- C:\Users ouby106710\AppData\Local\Temp\push.exe [5203150] [MD5.872E9D3DC886561AF1D27C72C4166727] [SPRF][12/06/2012] (...) -- C:\Users ouby106710\AppData\Local\Temp\Setup.exe [818424] [MD5.54320427500DC7B9CE1EE0D2AF048706] [SPRF][02/04/2012] (.Spotify Ltd - Spotify Installer.) -- C:\Users ouby106710\AppData\Local\Temp\SpotifyUpgrader.exe [18709016] [MD5.F580CCB06C180AF131BB3D2A01368545] [SPRF][03/11/2010] (.TOSHIBA Corporation - StartMen Application.) -- C:\Users ouby106710\AppData\Local\Temp\StartMenu.exe [86016] [MD5.77DFB27D68CE46659A3D5E93410C0B75] [SPRF][26/08/2012] (.Babylon Ltd. - Babylon Client Setup.) -- C:\Users ouby106710\AppData\Local\Temp bbabylonv3.exe [899224] =>Toolbar.Babylon [MD5.E35C4CA0FC282238E0A2BAFB1CAAFE5A] [SPRF][17/10/2012] (.Babylon Ltd. - Uninstaller Application.) -- C:\Users ouby106710\AppData\Local\Temp\uninst1.exe [340632] =>Toolbar.Babylon [MD5.FF6E0179F60F08B648AEBD597EF0CAF1] [SPRF][28/12/2012] (.Somoto Ltd. - FilesFrog Update Checker.) -- C:\Users ouby106710\AppData\Local\Temp\UpdateCheckerSetup.exe [260040] =>Adware.MegaSearch [MD5.C7B41F3508667C1526D2874210E28892] [SPRF][02/09/2012] (...) -- C:\Users ouby106710\AppData\Local\Temp\uttE12A.tmp.bat [74] [MD5.B936F0F378B9A35489353E878154E899] [SPRF][26/01/2012] (.Microsoft Corporation - Microsoft Visual C++ 2008 Redistributable Setup.) -- C:\Users ouby106710\AppData\Local\Temp\vcredist_x86.exe [1821192] [MD5.69D2894206516657B7A06EEEA5B917E5] [SPRF][28/12/2012] (...) -- C:\Users ouby106710\AppData\Local\Temp\vlc-2.0.2-win32.exe [22630361] [MD5.E03F2F24BCA457A35E1E26732AFE4A2F] [SPRF][04/01/2013] (...) -- C:\Users ouby106710\AppData\Local\Temp\vlc-2.0.4-win32.exe [22912657] [MD5.AE7E0C99C5BC7D28325C0CD7885C851F] [SPRF][24/10/2012] (.Yontoo LLC - Installer.) -- C:\Users ouby106710\AppData\Local\Temp\YontooSetup-S.exe [1062504] =>PUP.Yontoo [MD5.D345332276C4C3474F1164E90AB370D0] [SPRF][22/05/2012] (...) -- C:\Users ouby106710\Desktop\mirc7-22.exe [119] ~ Files: Scanned in 00mn 04s ---\ Scan Additionnel (O88) Database Version : v2.12091 - (13/05/2013) Clés trouvées (Keys found) : 0 Valeurs trouvées (Values found) : 0 Dossiers trouvés (Folders found) : 1 Fichiers trouvés (Files found) : 23 C:\Users ouby106710\AppData\Local\Google\Chrome\User Data\Default\Extensions\aidbbndgjnlaclnmhkdimcdjiebjpdel =>PUP.SpecialSavings C:\Users ouby106710\AppData\Local\Temp\instloffer.exe =>PUP.OfferBox C:\Users ouby106710\AppData\Local\Temp\uninst1.exe =>Toolbar.Babylon C:\Users ouby106710\AppData\Local\Temp\incredibar_installer.exe =>Adware.IncrediBar C:\Users ouby106710\AppData\Local\Temp\YontooSetup-S.exe =>Adware.Yontoo C:\Users ouby106710\AppData\Local\Temp\MyBabylonTB.exe =>PUP.SweetIM C:\Users ouby106710\AppData\Local\Temp\MyBabylonTB_google_20120807.exe =>PUP.SweetIM C:\Users ouby106710\AppData\Local\Temp\square_babylonv2.bmp =>PUP.SweetIM C:\Users ouby106710\AppData\Local\Temp\square_babylonv3.bmp =>PUP.SweetIM C:\Users ouby106710\AppData\Local\Temp bbabylonv3.exe =>PUP.SweetIM C:\Users ouby106710\AppData\Local\Temp\square_lollipop.bmp =>Adware.Lollipop C:\Users ouby106710\AppData\Local\Temp\cl09lTr3.exe.part =>Adware.Bandoo C:\Users ouby106710\AppData\Local\Temp\dealply.exe =>PUP.DealPly C:\Users ouby106710\AppData\Local\Temp\S6PgHCwK.exe.part =>PUP.SweetIM C:\Users ouby106710\AppData\Local\Temp\UpdateCheckerSetup.exe =>Adware.MegaSearch ~ Additionnel Scan: 365075 Items scanned in 01mn 07s ---\ Product Upgrade Codes (O90) O90 - PUC: "710790612757DB8468EABEAEA1BC3D0A" . (.iQsystem 7.000 French.) -- C:\Windows\Installer\{16097017-7572-48BD-86AE-EBEA1ACBD3A0}\ARPPRODUCTICON.exe ~ Update Products: 42 Legitimates Filtered in 00mn 00s ---\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped) SR - | Auto 21/12/2012 57008 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe SR - | Auto 30/08/2011 390504 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe SR - | Demand 20/02/2013 553288 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe SS - | Demand 12/04/2013 115608 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe SR - | Auto 03/08/2011 599144 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32 vvsvc.exe SR - | Auto 03/08/2011 2255464 | (nvUpdatusService) . (.NVIDIA Corporation.) - C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe SR - | Auto 03/08/2011 379496 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files\NVIDIA Corporation\3D Vision vSCPAPISvr.exe SR - | Auto 24/12/2010 513536 | (Thpsrv) . (.TOSHIBA Corporation.) - C:\Windows\system32\ThpSrv.exe SS - | Demand 14/07/2009 20992 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 14/07/2009 20992 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe ~ Services: Scanned in 00mn 02s ---\ Recherche Master Boot Record Infection (MBR)(O80) Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net Run by rouby106710 at 14/05/2013 13:10:39 device: opened successfully user: MBR read successfully Disk trace: called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys thpdrv.sys halmacpi.dll ataport.SYS PCIIDEX.SYS msahci.sys C:\Windows\system32\DRIVERS hpdrv.sys TOSHIBA Corporation TOSHIBA HDD Protection 1 ntkrnlpa!IofCallDriver[0x83270BC5] >> \Device\Harddisk0\DR0[0x85F23AC8] 5 thpdrv[0x895EDBD9] >> ntkrnlpa!IofCallDriver[0x83270BC5] >> \Device\Ide\IdeDeviceP0T0L0-0[0x859DF030] kernel: MBR read successfully user & kernel MBR OK ~ MBR: 14 Legitimates Filtered in 00mn 02s ---\ Recherche Master Boot Record Infection (MBRCheck)(O80) Written by ad13, http://ad13.geekstog Run by rouby106710 at 14/05/2013 13:10:41 ********* Dump file Name ********* C:\PhysicalDisk0_MBR.bin ~ MBR: Scanned in 00mn 04s ~ 1243 Legitimates filtered by white list End of the scan (545 lines in 14mn 35s)(0)

Utilisateur anonyme · Answer

Re

Utilisation de l'outil ZHPFix : 

* Copie  tout le texte présent dans l'encadré ci-dessous (tu le sélectionnes avec ta souris / Clique droit dessus et choisis "copier" ou fait Ctrl+C ) 
-------------------------------------------------------------------------------------------------


G2 - GCE: Preference [User Data\Default] [aidbbndgjnlaclnmhkdimcdjiebjpdel] SpecialSavings.com v.2.0.0 (Activé)  
G2 - GCE: Preference [User Data\Default] [gaiilaahiahdejapggenmdmafpmbipje] DealPly v.3.3.7.2 (Activé)  
R0 - HKCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page = http://ww25.allssearch.com/  
[MD5.00000000000000000000000000000000] [APT] [DealPly] (...) -- C:\Usersouby106710\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.exe (.not file.) [0]  
[MD5.00000000000000000000000000000000] [APT] [DealPlyUpdate] (...) -- C:\Program Files\DealPly\DealPlyUpdate.exe (.not file.) [0]  
O45 - LFCP:[MD5.7D7FE60B2EAEAC27E6C36FFA000610F9] - 09/05/2013 - 19:35:00 ---A- - C:\Windows\Prefetch\IBSVC.EXE-01CFB7AC.pf     
[MD5.9123C84DF4DAB9C0707794E34B53A5C8] [SPRF][26/08/2012] (.DealPly - http://www.dealply.com/ -- C:\Usersouby106710\AppData\Local\Temp\dealply.exe [507328]  
[MD5.05FECA1B4B1F7F9D924191716AD3F0BA] [SPRF][28/12/2012] (.Pas de propriétaire - IncrediMail Installer.) -- C:\Usersouby106710\AppData\Local\Temp\incredibar_installer.exe [463184]  
[MD5.F8EF0845D86A6D88F940FB1780E29420] [SPRF][24/08/2012] (...) -- C:\Usersouby106710\AppData\Local\Temp\instloffer.exe [65096]     
[MD5.0BF369C8765A03092F0337D80BA519C6] [SPRF][29/03/2012] (.Babylon Ltd. - Babylon Client Setup.) -- C:\Usersouby106710\AppData\Local\Temp\MyBabylonTB.exe [862832]  
[MD5.77DFB27D68CE46659A3D5E93410C0B75] [SPRF][28/12/2012] (.Babylon Ltd. - Babylon Client Setup.) -- C:\Usersouby106710\AppData\Local\Temp\MyBabylonTB_google_20120807.exe [899224]  
[MD5.77DFB27D68CE46659A3D5E93410C0B75] [SPRF][26/08/2012] (.Babylon Ltd. - Babylon Client Setup.) -- C:\Usersouby106710\AppData\Local\Temp	bbabylonv3.exe [899224]  
[MD5.E35C4CA0FC282238E0A2BAFB1CAAFE5A] [SPRF][17/10/2012] (.Babylon Ltd. - Uninstaller Application.) -- C:\Usersouby106710\AppData\Local\Temp\uninst1.exe [340632]  
[MD5.FF6E0179F60F08B648AEBD597EF0CAF1] [SPRF][28/12/2012] (.Somoto Ltd. - FilesFrog Update Checker.) -- C:\Usersouby106710\AppData\Local\Temp\UpdateCheckerSetup.exe [260040]  
[MD5.AE7E0C99C5BC7D28325C0CD7885C851F] [SPRF][24/10/2012] (.Yontoo LLC - Installer.) -- C:\Usersouby106710\AppData\Local\Temp\YontooSetup-S.exe [1062504]  
C:\Usersouby106710\AppData\Local\Google\Chrome\User Data\Default\Extensions\aidbbndgjnlaclnmhkdimcdjiebjpdel  
C:\Usersouby106710\AppData\Local\Temp\instloffer.exe  
C:\Usersouby106710\AppData\Local\Temp\uninst1.exe  
C:\Usersouby106710\AppData\Local\Temp\incredibar_installer.exe  
C:\Usersouby106710\AppData\Local\Temp\YontooSetup-S.exe  
C:\Usersouby106710\AppData\Local\Temp\MyBabylonTB.exe  
C:\Usersouby106710\AppData\Local\Temp\MyBabylonTB_google_20120807.exe  
C:\Usersouby106710\AppData\Local\Temp\square_babylonv2.bmp  
C:\Usersouby106710\AppData\Local\Temp\square_babylonv3.bmp  
C:\Usersouby106710\AppData\Local\Temp	bbabylonv3.exe  
C:\Usersouby106710\AppData\Local\Temp\square_lollipop.bmp  
C:\Usersouby106710\AppData\Local\Temp\cl09lTr3.exe.part  
C:\Usersouby106710\AppData\Local\Temp\dealply.exe  
C:\Usersouby106710\AppData\Local\Temp\S6PgHCwK.exe.part  
C:\Usersouby106710\AppData\Local\Temp\UpdateCheckerSetup.exe  
[MD5.00000000000000000000000000000000] [APT] [{CBB9A2C2-CB93-4C7D-B89C-7351B64ADE84}] (...) -- C:\Usersouby106710\Desktop\Windows_Movie_Maker_2.0.exe (.not file.) [0] 

FirewallRAZ
Emptytemp
EmptyCLSID


--------------------------------------------------------------------------------------------
* Lance ZHPFix à partir du raccourci sur ton Bureau (si tu es sous Windows Vista ou Windows 7, fais le par un clic-droit --> Exécuter en tant qu'administrateur) 

* Clique sur l'icone représentant le presse-papier ("coller le presse-papier") 
le script doit automatiquement apparaitre dans ZHPFix, sinon, colle-le (Ctrl+v) 
* Clique sur le bouton GO pour lancer le nettoyage 
* Copie/colle la totalité du rapport dans ta prochaine réponse.

-> laisse travailler l'outil et ne touche à rien ... 


-> S'il t'est demandé de redémarrer le PC pour finir le nettoyage, fais le ! 

Une fois terminé, un nouveau rapport s'affiche : poste le contenu de ce dernier dans ta prochaine réponse ... 

( ce rapport est en outre sauvegardé dans ce dossier  C:/ZHP/ZHPFix(R1) 



@+

narva32 · Answer

Bonsoir, 

Voici le dernier rapport, en m'excusant du délai de réponse :

Rapport de ZHPFix 2013.5.11.1 par Nicolas Coolman, Update du 11/05/2013
Fichier d'export Registre : C:\ZHP\ZHPExportRegistry-16-05-2013-18-25-40.txt
Run by rouby106710 at 16/05/2013 18:25:40
High Elevated Privileges : OK
Windows 7 Business Edition, 32-bit Service Pack 1 (Build 7601)

Corbeille vidée

========== Processus mémoire ==========
SUPPRIME Memory Process: C:\Usersouby106710\AppData\Local\Temp\dealply.exe
SUPPRIME Memory Process: C:\Usersouby106710\AppData\Local\Temp\incredibar_installer.exe
SUPPRIME Memory Process: C:\Usersouby106710\AppData\Local\Temp\instloffer.exe
SUPPRIME Memory Process: C:\Usersouby106710\AppData\Local\Temp\MyBabylonTB.exe
SUPPRIME Memory Process: C:\Usersouby106710\AppData\Local\Temp\MyBabylonTB_google_20120807.exe
SUPPRIME Memory Process: C:\Usersouby106710\AppData\Local\Temp	bbabylonv3.exe
SUPPRIME Memory Process: C:\Usersouby106710\AppData\Local\Temp\uninst1.exe
SUPPRIME Memory Process: C:\Usersouby106710\AppData\Local\Temp\UpdateCheckerSetup.exe
SUPPRIME Memory Process: C:\Usersouby106710\AppData\Local\Temp\YontooSetup-S.exe
SUPPRIME Memory Process: C:\Usersouby106710\AppData\Local\Temp\cl09lTr3.exe.part
SUPPRIME Memory Process: C:\Usersouby106710\AppData\Local\Temp\S6PgHCwK.exe.part

========== Valeur(s) du Registre ==========
ABSENT Valeur Standard Profile: FirewallRaz : 
ABSENT Valeur Domain Profile: FirewallRaz : 

========== Elément(s) de donnée du Registre ==========
SUPPRIME R0 - HKCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page

========== Préférences navigateur ==========
SUPPRIME Folder Chrome: C:\Usersouby106710\AppData\Local\Google\Chrome\User Data\Default\Extensions\aidbbndgjnlaclnmhkdimcdjiebjpdel
SUPPRIME Folder Chrome: C:\Usersouby106710\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje

========== Dossier(s) ==========
SUPPRIME Folder: C:\Usersouby106710\AppData\Local\{0F771FEF-E901-4409-ACA0-39A6AC6B7C7A}

========== Fichier(s) ==========
ABSENT File: c:\windows\prefetch\ibsvc.exe-01cfb7ac.pf
SUPPRIME File*: c:\usersouby106710\appdata\local	emp\dealply.exe
SUPPRIME File*: c:\usersouby106710\appdata\local	emp\incredibar_installer.exe
SUPPRIME File*: c:\usersouby106710\appdata\local	emp\instloffer.exe
SUPPRIME File*: c:\usersouby106710\appdata\local	emp\mybabylontb.exe
SUPPRIME File*: c:\usersouby106710\appdata\local	emp\mybabylontb_google_20120807.exe
SUPPRIME File*: c:\usersouby106710\appdata\local	emp	bbabylonv3.exe
SUPPRIME File*: c:\usersouby106710\appdata\local	emp\uninst1.exe
SUPPRIME File: c:\usersouby106710\appdata\local	emp\updatecheckersetup.exe
SUPPRIME File*: c:\usersouby106710\appdata\local	emp\yontoosetup-s.exe
ABSENT Folder/File: c:\usersouby106710\appdata\local\google\chrome\user data\default\extensions\aidbbndgjnlaclnmhkdimcdjiebjpdel
ABSENT Folder/File: c:\usersouby106710\appdata\local	emp\instloffer.exe
ABSENT Folder/File: c:\usersouby106710\appdata\local	emp\uninst1.exe
ABSENT Folder/File: c:\usersouby106710\appdata\local	emp\incredibar_installer.exe
ABSENT Folder/File: c:\usersouby106710\appdata\local	emp\yontoosetup-s.exe
ABSENT Folder/File: c:\usersouby106710\appdata\local	emp\mybabylontb.exe
ABSENT Folder/File: c:\usersouby106710\appdata\local	emp\mybabylontb_google_20120807.exe
SUPPRIME File: C:\Usersouby106710\AppData\Local\Temp\square_babylonv2.bmp
SUPPRIME File*: c:\usersouby106710\appdata\local	emp\square_babylonv2.bmp
SUPPRIME File: C:\Usersouby106710\AppData\Local\Temp\square_babylonv3.bmp
SUPPRIME File*: c:\usersouby106710\appdata\local	emp\square_babylonv3.bmp
ABSENT Folder/File: c:\usersouby106710\appdata\local	emp	bbabylonv3.exe
SUPPRIME File: C:\Usersouby106710\AppData\Local\Temp\square_lollipop.bmp
SUPPRIME File*: c:\usersouby106710\appdata\local	emp\square_lollipop.bmp
SUPPRIME File*: c:\usersouby106710\appdata\local	emp\cl09ltr3.exe.part
ABSENT Folder/File: c:\usersouby106710\appdata\local	emp\dealply.exe
SUPPRIME File*: c:\usersouby106710\appdata\local	emp\s6pghcwk.exe.part
ABSENT Folder/File: c:\usersouby106710\appdata\local	emp\updatecheckersetup.exe
SUPPRIME Temporaires Windows

========== Tache planifiée ==========
SUPPRIME Task: DealPly
SUPPRIME Task: DealPlyUpdate
SUPPRIME Task: {CBB9A2C2-CB93-4C7D-B89C-7351B64ADE84}


========== Récapitulatif ==========
11 : Processus mémoire
2 : Valeur(s) du Registre
1 : Elément(s) de donnée du Registre
1 : Dossier(s)
29 : Fichier(s)
2 : Préférences navigateur
3 : Tache planifiée


End of clean in 01mn 25s

========== Chemin de fichier rapport ==========
C:\ZHP\ZHPFix[R1].txt - 16/05/2013 18:25:40 [4680]

Utilisateur anonyme · Answer

Bonsoir

Pour vérifier les mises à jour logiciels à appliquer sur ton PC
https://www.flexera.com/products/operations/software-vulnerability-management.html
Divers liens te seront proposés pour les logiciels non à jour.

Tiens moi au courant;merci

@+

narva32 · Answer

Voici le rapport de ce site :


	

Microsoft Windows 7	Microsoft Windows 7	Microsoft Windows 7	Microsoft Windows 7
	
This installation of Microsoft Windows 7 is insecure and potentially exposes your system to security threats!

Your system does not have all security related patches from Microsoft installed. Please see list below for details about the missing patches.

Update Instructions:
You do not have the following Microsoft security updates installed:
KB2830290
KB2829361

Visit Windows Update to install the missing patches.
	Skype for Windows 5.x	Skype for Windows 5.x	5.0.32.152	Skype for Windows 5.x
	
This installation of Skype for Windows 5.x is insecure and potentially exposes your system to security threats!

The detected version installed on your system is 5.0.32.152, however, the latest patched version released by the vendor, fixing one or more vulnerabilities, is 6.x.

Update Instructions:
Download


Installed on Your System in:
C:\Program Files\Skype\Phone\Skype.exe
	Adobe Flash Player 10.x	Adobe Flash Player 10.x	10.1.102.64 (ActiveX)	Adobe Flash Player 10.x
	
This installation of Adobe Flash Player 10.x is insecure and potentially exposes your system to security threats!

The detected version installed on your system is 10.1.102.64 (ActiveX), however, the latest patched version released by the vendor, fixing one or more vulnerabilities, is 10.3.183.68 (ActiveX).

Update Instructions:
Download


Installed on Your System in:
C:\Windows\SYSTEM32\Macromed\Flash\Flash10l.ocx
	Sun Java JRE 1.6.x / 6.x	Sun Java JRE 1.6.x / 6.x	6.0.240.7	Sun Java JRE 1.6.x / 6.x
	
This installation of Sun Java JRE 1.6.x / 6.x is insecure and potentially exposes your system to security threats!

The detected version installed on your system is 6.0.240.7, however, the latest patched version released by the vendor, fixing one or more vulnerabilities, is 6.0.450.6.

Update Instructions:
Download


Installed on Your System in:
C:\Program Files\Java\jre6\bin\java.exe

Utilisateur anonyme · Answer

Bonjour

Tu sais ce qu'il te reste à faire. 
Tu mets à jour tous ces programmes;merci

@+

Nouveau Virus Gendarmerie

24 réponses

Discussions similaires