Bonjour, comment exploiter le rapport ZHPdiag? Résolu/Fermé

Question

Bonjour, comment exploiter le rapport zhpdiag? à qui l'adresser?

merci de votre aide

irongege · Answer

Bonjour

Il suffit de le poster dans un message et attendre que quelqu'un vous prenne en charge.

novice6433 · Answer

Voici le lien pour la rapport.

Merci pour votre aide.

https://www.cjoint.com/?3EBrBlKfIOy

g3n-h@ckm@n · Answer

salut 

Télécharge et enregistre ADWCleaner sur ton bureau :

(la grosse flèche verte en milieu de page)

Lance le,(Pour vista/7/8 => clic droit "executer en tant qu'administrateur")

clique sur suppression et poste C:\Adwcleaner[Sx].txt

g3n-h@ckm@n · Answer

fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.


&#9654 Télécharge ici :

Malwarebytes  

&#9654 Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

relance malwarebytes en suivant scrupuleusement ces consignes :

! Déconnecte toi et ferme toutes applications en cours !

&#9654 Lance Malwarebyte's .

Fais un examen dit "Complet" .

&#9654 Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
&#9654 à la fin tu cliques sur "résultat" .
&#9654 Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

&#9654 Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !


&#9654 Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

novice6433 · Answer

Bonsoir, voici le dernier rapport

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Version de la base de données: v2013.05.27.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
xyzxyz :: PC-DE-XYZXYZ [administrateur]

27/05/2013 18:44:38
mbam-log-2013-05-27 (18-44-38).txt

Type d'examen: Examen complet (C:\|D:\|E:\|)
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM | P2P
Options d'examen désactivées: 
Elément(s) analysé(s): 356866
Temps écoulé: 1 heure(s), 34 minute(s), 15 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 0
(Aucun élément nuisible détecté)

(fin)

g3n-h@ckm@n · Answer

refais zhpdiag en cochant toutes les options au tournevis, heberge le rapport sur cjoint et donne lien

novice6433 · Answer

Bonsoir, je vais repasser un zhpdiag

en attendant j'ai toujours les fichiers suivant dans le dossier Prefetch : 
AgAppLaunch, 
AgGlFaultHistory, 
AgGlFgAppHistory, 
AgGlGlobalHistory, 
AgGlUAD_P_S-1-5-21-1430075414-1570763820-2450149755-1000, 
AgGlUAD_S-1-5-21-1430075414-1570763820-2450149755-1000, 
AgRobust

quand je les efface avec Ccleaner, les fichiers ci-dessus apparaîssent en .db.

Merci encore pour ton aide, je t'adresse le rapport du zhpdiag rapidement.

novice6433 · Answer

Voici le dernier rapport zhpdiag, merci encore pour ton aide Rapport de ZHPDiag v2013.5.25.152 par Nicolas Coolman, Update du 25/05/2013 Run by xyzxyz at 27/05/2013 23:26:07 WebSite: https://nicolascoolman.webs.com/ State : Version à jour. WhiteList : Enable High Elevated Privileges : OK UAC : Activate by user ---\ Web Browser MSIE: Internet Explorer v9.0.8112.16421 MFIE: Mozilla Firefox 21.0 ---\ Windows Product Information ~ Langage: Français Windows Vista Home Premium Edition, 32-bit Service Pack 2 (Build 6002) Windows Server License Manager Script : OK ~ Vista, OEM_SLP channel System Locked Preinstallation (OEM_SLP) : OK Windows ID Activation : OK ~ Windows Partial Key : WQD8Q Windows License : OK Windows Automatic Updates : OK ---\ System Protection avast! Free Antivirus v8.0.1489.0 Malwarebytes Anti-Malware version 1.75.0.1300 Spybot - Search & Destroy v1.6.2 ---\ System Optimizer CCleaner v4.02 =>Piriform Ltd ---\ Peer To Peer (P2P) ---\ Software Update Adobe Flash Player 11 Plugin Adobe Reader X ---\ System Information ~ Processor: x86 Family 6 Model 15 Stepping 11, GenuineIntel ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 2045 MB (54% free) System Restore: Activé (Enable) System drive C: has 80 GB (56%) free of 142 GB ---\ Logged in mode ~ Computer Name: PC-DE-XYZXYZ ~ User Name: xyzxyz ~ All Users Names: xyzxyz, Administrateur, ~ Unselected Option: None Logged in as Administrator ---\ Environnement Variables ~ System Unit : C:\ ~ %AppData% : C:\Users\xyzxyz\AppData\Roaming\ ~ %Desktop% : C:\Users\xyzxyz\Desktop\ ~ %Favorites% : C:\Users\xyzxyz\Favorites\ ~ %LocalAppData% : C:\Users\xyzxyz\AppData\Local\ ~ %StartMenu% : C:\Users\xyzxyz\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\ DOS/Devices C:\ Hard drive, Flash drive, Thumb drive (Free 80 Go of 142 Go) D:\ Hard drive, Flash drive, Thumb drive (Free 146 Go of 147 Go) E:\ Hard drive, Flash drive, Thumb drive (Free 7 Go of 7 Go) F:\ CD-ROM drive (Not Inserted) ---\ Security Center & Tools Informations [HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: Modified ~ Security Center: 35 Legitimates Filtered in 00mn 00s ---\ Recherche particulière de fichiers génériques [MD5.D07D4C3038F3578FFCE1C0237F2A1253] - (.Microsoft Corporation - Explorateur Windows.) (.11/04/2009 - 07:27:36.) -- C:\Windows\Explorer.exe [2926592] [MD5.101BA3EA053480BB5D957EF37C06B5ED] - (.Microsoft Corporation - Application de démarrage de Windows.) (.19/01/2008 - 08:33:37.) -- C:\Windows\System32\Wininit.exe [96768] [MD5.2C96B3921B4CDE10DBAED5AAD760DB67] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.04/04/2013 - 23:02:17.) -- C:\Windows\System32\wininet.dll [1129472] [MD5.898E7C06A350D4A1A64A9EA264D55452] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.11/04/2009 - 07:28:13.) -- C:\Windows\System32\Winlogon.exe [314368] [MD5.3911B972B55FEA0478476B2E777B29FA] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.21/04/2011 - 14:58:27.) -- C:\Windows\system32\Drivers\AFD.sys [273408] [MD5.1F05B78AB91C9075565A9D8A4B880BC4] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.11/04/2009 - 07:32:26.) -- C:\Windows\system32\Drivers\atapi.sys [19944] [MD5.7ADD03E75BEB9E6DD102C3081D29840A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.19/01/2008 - 06:28:02.) -- C:\Windows\system32\Drivers\Cdfs.sys [70144] [MD5.6B4BFFB9BECD728097024276430DB314] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.11/04/2009 - 05:39:17.) -- C:\Windows\system32\Drivers\Cdrom.sys [67072] [MD5.622C41A07CA7E6DD91770F50D532CB6C] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.14/04/2011 - 15:59:03.) -- C:\Windows\system32\Drivers\DfsC.sys [75264] [MD5.062452B7FFD68C8C042A6261FE8DFF4A] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.11/04/2009 - 05:42:42.) -- C:\Windows\system32\Drivers\HDAudBus.sys [561152] [MD5.22D56C8184586B7A1F6FA60BE5F5A2BD] - (.Microsoft Corporation - Pilote de port i8042.) (.19/01/2008 - 06:49:18.) -- C:\Windows\system32\Drivers\i8042prt.sys [54784] [MD5.8793643A67B42CEC66490B2A0CF92D68] - (.Microsoft Corporation - IP Network Address Translator.) (.19/01/2008 - 06:56:28.) -- C:\Windows\system32\Drivers\IpNat.sys [100864] [MD5.1E94971C4B446AB2290DEB71D01CF0C2] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.29/04/2011 - 14:24:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [106496] [MD5.ECD64230A59CBD93C85F1CD1CAB9F3F6] - (.Microsoft Corporation - MBT Transport driver.) (.11/04/2009 - 05:45:37.) -- C:\Windows\system32\Drivers etBT.sys [185856] [MD5.2C1121F2B87E9A6B12485DF53CD848C7] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.03/03/2013 - 20:07:52.) -- C:\Windows\system32\Drivers tfs.sys [1082232] [MD5.0FA9B5055484649D63C303FE404E5F4D] - (.Microsoft Corporation - Pilote de port parallèle.) (.02/11/2006 - 09:51:30.) -- C:\Windows\system32\Drivers\Parport.sys [79360] [MD5.A214ADBAF4CB47DD2728859EF31F26B0] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.19/01/2008 - 06:56:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [76288] [MD5.E8BD98D46F2ED77132BA927FCCB47D8B] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.02/11/2006 - 10:03:00.) -- C:\Windows\system32\Drivers dpdr.sys [242688] [MD5.7B75299A4D201D6A6533603D6914AB04] - (.Microsoft Corporation - SMB Transport driver.) (.11/04/2009 - 05:45:22.) -- C:\Windows\system32\Drivers\smb.sys [66560] [MD5.76B06EB8A01FC8624D699E7045303E54] - (.Microsoft Corporation - TDI Translation Driver.) (.11/04/2009 - 05:45:56.) -- C:\Windows\system32\Drivers dx.sys [72192] [MD5.786DB5771F05EF300390399F626BF30A] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/08/2012 - 12:47:42.) -- C:\Windows\system32\Drivers\volsnap.sys [224640] ~ Generic Processes: Scanned in 00mn 00s ---\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 1/179 ~ Mes musiques (My Musics) : 1/304 ~ Mes Videos (My Videos) : 1/2 ~ Mes Favoris (My Favorites) : 1/2 ~ Mes Documents (My Documents) : 1/2080 ~ Mon Bureau (My Desktop) : 1/5 ~ Menu demarrer (Programs) : 1/33 ~ Hidden Files: Scanned in 00mn 01s ---\ Processus lancés [MD5.3F91D1056D2CEBEF374BE0E55428190A] - (.Cognizance Corporation - Global Virtual Card Host.) -- c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe [65536] [PID.3816] [MD5.0D392EDE3B97E0B3131B2F63EF1DB94E] - (.Microsoft Corporation - Windows Defender User Interface.) -- C:\Program Files\Windows Defender\MSASCui.exe [1008184] [PID.1632] [MD5.0AE3673E1C450359490CF47D6AA3AF7F] - (.Motorola Inc. - SM56 Modem Helper.) -- C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe [1458176] [PID.3248] [MD5.94444693EA13A72F6820DFF844A1122E] - (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2299176] [PID.1000] [MD5.C7C70AE1DE8F0FCC8F2431C5D15632DF] - (.Intel Corporation - Event Monitor User Notification Tool.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [174872] [PID.3520] [MD5.AF849798ECA383184C88ED436CF3EFB2] - (.Hewlett-Packard Development Company, L.P. - HPWAMain Module.) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [472776] [PID.1596] [MD5.C637FC4638A96165256B28D38DE7B953] - (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files\HP\HP Software Update\hpwuschd2.exe [49208] [PID.3620] [MD5.3F11B20D12D89365D7721BDC860CE5F0] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe [4858968] [PID.3812] [MD5.BF08674925F151BD4537B89A493E3E0C] - (.Microsoft Corporation - Media Center Tray Applet.) -- C:\Windows\ehome\ehtray.exe [125952] [PID.3184] [MD5.0F4195B9B348DE5CF9B822F81704B20E] - (.Microsoft Corporation - Media Center Media Status Aggregator Servic.) -- C:\Windows\ehome\ehmsas.exe [37376] [PID.2236] [MD5.241B74792CC295DFDCB7940BBF52B226] - (.Pas de propriétaire - HpqToaster Module.) -- C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe [677576] [PID.3956] [MD5.3E802CE450D0E7A234978E9A2EA4772A] - (.Synaptics Incorporated - Synaptics Pointing Device Helper.) -- C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.exe [107816] [PID.3600] [MD5.518545E8CBD79EBF42891A6066578118] - (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner.exe [3591960] [PID.1484] =>Piriform Ltd [MD5.6080A176D09435FC8E6E800996656E18] - (.Microsoft Corporation - Console IME.) -- C:\Windows\system32\conime.exe [69120] [PID.5080] [MD5.F72DD84DD69DF001CF4D1B909685A136] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7402496] [PID.5172] [MD5.C4D17F11526F87BC762F31DA5BD2580B] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 187.6.) -- C:\Windows\system32 vvsvc.exe [219752] [PID.1064] [MD5.862BB4CBC05D80C5B45BE430E5EF872F] - (.Microsoft Corporation - Service de gestion des licences Microsoft.) -- C:\Windows\system32\SLsvc.exe [3408896] [PID.1436] [MD5.28D6701C710AD7BA3CB95E75F8F1A9AA] - (.AVAST Software - avast! Service.) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [46808] [PID.1900] [MD5.ADDA5E1951B90D3D23C56D3CF0622ADC] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [65640] [PID.580] [MD5.DBAFC6734C054FEEF9087754BD80F847] - (.Pas de propriétaire - CLCapSvc Module.) -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe [262243] [PID.1376] [MD5.582F2D900A3AC34C98FBDC2C0ABEF6B9] - (.Intel Corporation - RAID Monitor.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [355096] [PID.2308] [MD5.559C9B7800FAC92FC515CD0003D7C631] - (.Hewlett-Packard Company - Pas de description.) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440] [PID.2488] [MD5.11F714F85530A2BD134074DC30E99FCA] - (.Microsoft Corporation - Machine Debug Manager.) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.exe [322120] [PID.2572] [MD5.04C1DCBB226C6AE647B794833CE3CEB6] - (.Hewlett-Packard Development Company, L.P. - hpqwmiex Module.) -- C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [135168] [PID.3100] [MD5.E67F8F036FD882E4AB62501C0D45B536] - (.Pas de propriétaire - CLSched Module.) -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe [106593] [PID.3284] [MD5.2CEEB349216FEBD91A907013D4ABCFF7] - (.Hewlett-Packard - HP Health Check Service.) -- C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [62984] [PID.3712] ~ Processes Running: Scanned in 00mn 00s ---\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4) R4 - HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,Enabled = 1 ~ IE Browser: 10 Legitimates Filtered in 00mn 00s ---\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl" ~ Keys: Scanned in 00mn 00s ---\ Redirection du fichier Hosts (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 03s ~ Nombre de lignes (Lines number): 10584 ---\ Browser Helper Objects de navigateur (O2) O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} . (.AVAST Software - IE Webrep plugin.) -- C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll ~ BHO: 1 Legitimates Filtered in 00mn 00s ---\ Internet Explorer Toolbars (O3) O3 - Toolbar: avast! WebRep - [HKLM]{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} . (.AVAST Software - IE Webrep plugin.) -- C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll ~ Toolbar: Scanned in 00mn 00s ---\ Applications démarrées par registre & par dossier (O4) O4 - HKLM\..\Run: [Windows Defender] . (.Microsoft Corporation - Windows Defender User Interface.) -- C:\Program Files\Windows Defender\MSASCui.exe O4 - HKLM\..\Run: [SMSERIAL] . (.Motorola Inc. - SM56 Modem Helper.) -- C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [SynTPEnh] . (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [IAAnotif] . (.Intel Corporation - Event Monitor User Notification Tool.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [HP Health Check Scheduler] . (.Hewlett-Packard - HP Health Check Scheduler.) -- C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe O4 - HKLM\..\Run: [hpWirelessAssistant] . (.Hewlett-Packard Development Company, L.P. - HPWAMain Module.) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [CognizanceTS] . (.Cognizance Corporation - Terminal Services Virtual Channel Client.) -- C:\Program Files\Bioscrypt\VeriSoft\Bin\ASTSVCC.dll O4 - HKLM\..\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [avast5] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe O4 - HKCU\..\Run: [ehTray.exe] . (.Microsoft Corporation - Media Center Tray Applet.) -- C:\Windows\ehome\ehTray.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] oobefldr.dll O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] oobefldr.dll O4 - HKUS\S-1-5-21-1430075414-1570763820-2450149755-1000\..\Run: [ehTray.exe] . (.Microsoft Corporation - Media Center Tray Applet.) -- C:\Windows\ehome\ehTray.exe ~ Application: Scanned in 00mn 00s ---\ Autres liens utilisateurs (O4) O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Programs: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe O4 - GS\QuickLaunch: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O4 - GS\QuickLaunch: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\SendTo: Assistant Transfert de fichiers Bluetooth.LNK . (.Microsoft Corporation - Pas de description.) -- C:\Windows\System32\fsquirt.exe O4 - GS\Desktop: OpenOffice.org 3.4.1.lnk . (.OpenOffice.org - OpenOffice.org 3.4.1.) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe O4 - GS\Desktop: Spybot - Search & Destroy.lnk . (.Safer Networking Limited - Spybot - Search & Destroy.) -- C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe O4 - GS\Desktop: Wordbiz.lnk . (.Internet Scrabble Club - Wordbiz.) -- C:\Program Files\WordBiz\WordBiz.exe ~ Global Startup: Scanned in 00mn 00s ---\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -- Clé orpheline ~ IE Extra Buttons: Scanned in 00mn 00s ---\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{42DF069B-7975-410A-9355-0EB0162F8E31}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{6D3C2686-FDD5-495A-9177-A9C3CF88A778}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{42DF069B-7975-410A-9355-0EB0162F8E31}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{6D3C2686-FDD5-495A-9177-A9C3CF88A778}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{42DF069B-7975-410A-9355-0EB0162F8E31}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{EFECB41B-4609-497D-B1DA-0FDD4FBEF216}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS3\Services\Tcpip\..\{42DF069B-7975-410A-9355-0EB0162F8E31}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS3\Services\Tcpip\..\{EFECB41B-4609-497D-B1DA-0FDD4FBEF216}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 ~ Domain: Scanned in 00mn 00s ---\ Protocole additionnel (O18) O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\system32\mshtml.dll O18 - Filter: application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll ~ Protocole Additionnel: Scanned in 00mn 00s ---\ Clé de Registre autorun SharedTaskScheduler (STS) (O22) O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\Windows\System32\browseui.dll ~ STS/SSO: Scanned in 00mn 00s ---\ Enumération Active Desktop & MHTML Editor (O24) O24 - Default MHTML Editor: Last - .(...) - C:\Program Files\Microsoft Office\OFFICE11\WINWORD.exe (.not file.) O24 - Desktop General: BackupWallPaper - .(...) - C:\Users\xyzxyz\Documents\Dossier entier\dossier Photo Sarah\Photo 112.jpg O24 - Desktop General: WallPaper - .(...) - C:\Users\xyzxyz\Documents\Dossier entier\dossier Photo Sarah\Photo 112.jpg ~ Desktop Component: 4 Legitimates Filtered in 00mn 00s ---\ Tâches planifiées en automatique (O39) [MD5.00000000000000000000000000000000] [APT] [Ad-Aware Update (Daily 1)] (...) -- C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [Ad-Aware Update (Daily 2)] (...) -- C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [Ad-Aware Update (Daily 3)] (...) -- C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [Ad-Aware Update (Daily 4)] (...) -- C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [Ad-Aware Update (Weekly)] (...) -- C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [{784D92B0-87B1-411B-B4BA-41E8DFB3EE8D}] (...) -- C:\Program Files\Everest Poker\cstart.exe (.not file.) [0] =>PUP.Casino [MD5.00000000000000000000000000000000] [APT] [{99512EC3-73DE-42C2-BD7E-B4459C32D55E}] (...) -- F:\setup.exe (.not file.) [0] ~ Scheduled Task: 16 Legitimates Filtered in 00mn 03s ---\ Logiciels installés (O42) O42 - Logiciel: VeriSoft Access Manager - (.Bioscrypt Inc..) [HKLM] -- {0ABA40AF-288D-41F1-B735-C5155692CD7D} ~ Logic: 81 Legitimates Filtered in 00mn 00s ---\ HKCU & HKLM Software Keys [HKCU\Software\mc] [HKLM\Software\InstallationKit] ~ Key Software: 171 Legitimates Filtered in 00mn 00s ---\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 08/12/2007 - 19:12:07 - [17,991] ----D C:\Program Files\Bioscrypt O43 - CFD: 19/05/2009 - 19:54:40 - [13,721] ----D C:\Program Files\CapAlpha O43 - CFD: 30/12/2007 - 23:46:38 - [10,349] ----D C:\Program Files\SP38015 O43 - CFD: 05/02/2010 - 14:26:28 - [0,178] ----D C:\Program Files\Common Files\Akamai O43 - CFD: 10/08/2008 - 01:40:40 - [0] ----D C:\Users\xyzxyz\AppData\Roaming\VeriSoft Access Manager O43 - CFD: 17/12/2009 - 15:30:47 - [1,791] ----D C:\Users\xyzxyz\AppData\Local\PokerStars.NET ~ 209 Dossiers CLSID vides (CLSID Empty Folders) ~ Program Folder: 413 Legitimates Filtered in 00mn 22s ---\ MountPoints2 Shell Key (O51) O51 - MPSK:{d0688e78-e382-11de-b707-001b24d0b6c6}\AutoRun\command. (...) -- G:\InstallTomTomHOME.exe (.not file.) ~ Keys: Scanned in 00mn 00s ---\ Microsoft Windows Policies System (O55) O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 ~ MWPS: 16 Legitimates Filtered in 00mn 00s ---\ Liste des Drivers Système (O58) O58 - SDL:[MD5.2EDC5BBAC6C651ECE337BDE8ED97C9FB] - 02/11/2006 - 10:51:38 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [420968] O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 02/11/2006 - 08:09:42 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029] ~ Drivers: Scanned in 00mn 00s ---\ Derniers fichiers modifiés ou crées (Utilisateur) (O61) O61 - LFC: 27/05/2013 - 16:51:08 ---A- C:\Users\xyzxyz\Downloads\adwcleaner.exe [632031] O61 - LFC: 27/05/2013 - 17:11:04 ---A- C:\Users\xyzxyz\Downloads\ccsetup402.exe [4378864] ~ 1 Fichiers temporaires (Temporary files) ~ Files: 10 Legitimates Filtered in 01mn 26s ---\ Liste des outils de nettoyage (O63) O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 ~ ADS: Scanned in 00mn 00s ---\ Liste des services Legacy (O64) O64 - Services: CurCS - ??\??\???? - Pas de propriétaire (Lbd) .(...) - LEGACY_LBD ~ Legacy: 70 Legitimates Filtered in 00mn 00s ---\ File Associations Shell Spawning (O67) O67 - Shell Spawning: <.html> [HKLM\..\open\Command] (.Not Key.) O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.Not Key.) O67 - Shell Spawning: <.html> [HKCR\..\open\Command] (.Not Key.) ~ FASS Keys: 19 Legitimates Filtered in 00mn 00s ---\ Start Menu Internet (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\ Search Browser Infection (O69) O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8 O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8 O69 - SBI: SearchScopes [HKCU] {DAE1F01E-CDBA-4583-BDD0-F32DADF35661} - (Yahoo! France) - https://fr.search.yahoo.com/ ~ Keys: Scanned in 00mn 00s ---\ Recherche particuliere à la racine de certains dossiers (O84) [MD5.25CB492EAF08F65EC4CB4409BEDE34E2] [SPRF][24/06/2009] (...) -- C:\ProgramData\ezsidmv.dat [56] [MD5.6E05A7A738A120D1FB38EAA2B0F078E4] [SPRF][23/04/2010] (...) -- C:\ProgramData tuser.dat [262144] [MD5.E0E17D083043FF3B713FFC9A30D1E22C] [SPRF][27/05/2013] (...) -- C:\ProgramData vModes.dat [63174] [MD5.418E9841D9F625FC098A7DB95CED83D9] [SPRF][17/06/2012] (...) -- C:\Users\xyzxyz\AppData\Local\d3d9caps.dat [680] [MD5.CA56F21584E944979F7AA9F4F441553C] [SPRF][15/03/2009] (...) -- C:\Users\xyzxyz\AppData\Roaming vModes.dat [27430] [MD5.91B8FC060C68BFEEA138BE4B2E5F3470] [SPRF][02/03/2011] (...) -- C:\Users\xyzxyz\AppData\Roaming\wklnhst.dat [146] [MD5.9802B937DD7C102CC5F21E0D0979CE41] [SPRF][18/09/2011] (.Adobe Systems, Inc. - Adobe® Flash® Player Installer/Uninstaller 10.3 r183.) -- C:\Windows\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe [3126944] ~ Files: Scanned in 00mn 00s ---\ Scan Additionnel (O88) Database Version : v2.12362 - (25/05/2013) Clés trouvées (Keys found) : 1 Valeurs trouvées (Values found) : 0 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 0 [HKLM\Software\Classes\Interface\{D6094FC6-821F-474C-8D73-C13066CD178D}] =>Toolbar.Agent ~ Additionnel Scan: 247415 Items scanned in 00mn 21s ---\ Product Upgrade Codes (O90) O90 - PUC: "FA04ABA0D8821F147B535C516529DCD7" . (.VeriSoft Access Manager.) -- c:\Windows\Installer\{0ABA40AF-288D-41F1-B735-C5155692CD7D}\ARPPRODUCTICON.exe ~ Update Products: 71 Legitimates Filtered in 00mn 00s ---\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped) SR - | Auto 10/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe SR - | Auto 19/01/2008 21504 | c:\Program Files\Bioscrypt\VeriSoft\Bin\ASWLNPkg.dll (ASBroker) . (.Cognizance Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 19/01/2008 21504 | c:\Program Files\Bioscrypt\VeriSoft\Bin\AsChnl.dll (ASChannel) . (.Cognizance Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 09/05/2013 46808 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe SR - | Auto 262243 | (CLCapSvc) . (...) - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe SR - | Auto 106593 | (CLSched) . (...) - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe SR - | Auto 14/03/2007 62984 | (HP Health Check Service) . (.Hewlett-Packard.) - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe SR - | Demand 19/01/2008 21504 | C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll (hpqcxs08) . (.Hewlett-Packard Co..) - C:\Windows\System32\svchost.exe SR - | Auto 19/01/2008 21504 | C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll (hpqddsvc) . (.Hewlett-Packard Co..) - C:\Windows\System32\svchost.exe SR - | Auto 02/05/2006 135168 | (hpqwmiex) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe SR - | Auto 12/02/2007 355096 | (IAANTMON) . (.Intel Corporation.) - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe SS - | Demand 04/04/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe SR - | Auto 14/12/2006 61440 | (LightScribeService) . (.Hewlett-Packard Company.) - C:\Program Files\Common Files\LightScribe\LSSrvc.exe SR - | Auto 19/01/2008 21504 | C:\Windows\system32\HPZinw12.dll (Net Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe SR - | Auto 03/10/2009 219752 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\System32 vvsvc.exe SR - | Auto 19/01/2008 21504 | C:\Windows\system32\HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe SS - | Demand 12/02/2007 880640 | (RoxMediaDB9) . (.Sonic Solutions.) - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe SS - | Demand 17/02/2007 74656 | (stllssvr) . (.MicroVision Development, Inc..) - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe SR - | Auto 19/01/2008 21504 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 19/01/2008 21504 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe ~ Services: Scanned in 00mn 01s ---\ Recherche Master Boot Record Infection (MBR)(O80) Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net Run by xyzxyz at 27/05/2013 23:29:57 device: opened successfully user: MBR read successfully Disk trace: called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys C:\Windows\system32\DRIVERS\iaStor.sys Intel Corporation Intel Matrix Storage Manager driver 1 ntkrnlpa!IofCallDriver[0x83093926] >> \Device\Harddisk0\DR0[0x8719BAC8] kernel: MBR read successfully user & kernel MBR OK ~ MBR: 14 Legitimates Filtered in 00mn 02s ---\ Recherche Master Boot Record Infection (MBRCheck)(O80) Written by ad13, http://ad13.geekstog Run by xyzxyz at 27/05/2013 23:29:59 ********* Dump file Name ********* C:\PhysicalDisk0_MBR.bin ~ MBR: Scanned in 00mn 04s ~ 1293 Legitimates filtered by white list End of the scan (449 lines in 03mn 52s)(0)

g3n-h@ckm@n · Answer

je répète :

ECRIS A LA SUITE

et pour le zhpdiag fais comme tu as fait ici 

https://forums.commentcamarche.net/forum/affich-27895718-bonjour-comment-exploiter-le-rapport-zhpdiag#3

novice6433 · Answer

Bonjour, tu veux que j'écrive à la suite ok tu veux dire directement sur le forum? désolé je suis novice. je te remercie encore pour ton aide. voici le dernier rapport zhpdiag : Rapport de ZHPDiag v2013.5.25.152 par Nicolas Coolman, Update du 25/05/2013 Run by xyzxyz at 27/05/2013 23:26:07 WebSite: https://nicolascoolman.webs.com/ State : Version à jour. WhiteList : Enable High Elevated Privileges : OK UAC : Activate by user ---\ Web Browser MSIE: Internet Explorer v9.0.8112.16421 MFIE: Mozilla Firefox 21.0 ---\ Windows Product Information ~ Langage: Français Windows Vista Home Premium Edition, 32-bit Service Pack 2 (Build 6002) Windows Server License Manager Script : OK ~ Vista, OEM_SLP channel System Locked Preinstallation (OEM_SLP) : OK Windows ID Activation : OK ~ Windows Partial Key : WQD8Q Windows License : OK Windows Automatic Updates : OK ---\ System Protection avast! Free Antivirus v8.0.1489.0 Malwarebytes Anti-Malware version 1.75.0.1300 Spybot - Search & Destroy v1.6.2 ---\ System Optimizer CCleaner v4.02 =>Piriform Ltd ---\ Peer To Peer (P2P) ---\ Software Update Adobe Flash Player 11 Plugin Adobe Reader X ---\ System Information ~ Processor: x86 Family 6 Model 15 Stepping 11, GenuineIntel ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 2045 MB (54% free) System Restore: Activé (Enable) System drive C: has 80 GB (56%) free of 142 GB ---\ Logged in mode ~ Computer Name: PC-DE-XYZXYZ ~ User Name: xyzxyz ~ All Users Names: xyzxyz, Administrateur, ~ Unselected Option: None Logged in as Administrator ---\ Environnement Variables ~ System Unit : C:\ ~ %AppData% : C:\Users\xyzxyz\AppData\Roaming\ ~ %Desktop% : C:\Users\xyzxyz\Desktop\ ~ %Favorites% : C:\Users\xyzxyz\Favorites\ ~ %LocalAppData% : C:\Users\xyzxyz\AppData\Local\ ~ %StartMenu% : C:\Users\xyzxyz\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\ DOS/Devices C:\ Hard drive, Flash drive, Thumb drive (Free 80 Go of 142 Go) D:\ Hard drive, Flash drive, Thumb drive (Free 146 Go of 147 Go) E:\ Hard drive, Flash drive, Thumb drive (Free 7 Go of 7 Go) F:\ CD-ROM drive (Not Inserted) ---\ Security Center & Tools Informations [HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: Modified ~ Security Center: 35 Legitimates Filtered in 00mn 00s ---\ Recherche particulière de fichiers génériques [MD5.D07D4C3038F3578FFCE1C0237F2A1253] - (.Microsoft Corporation - Explorateur Windows.) (.11/04/2009 - 07:27:36.) -- C:\Windows\Explorer.exe [2926592] [MD5.101BA3EA053480BB5D957EF37C06B5ED] - (.Microsoft Corporation - Application de démarrage de Windows.) (.19/01/2008 - 08:33:37.) -- C:\Windows\System32\Wininit.exe [96768] [MD5.2C96B3921B4CDE10DBAED5AAD760DB67] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.04/04/2013 - 23:02:17.) -- C:\Windows\System32\wininet.dll [1129472] [MD5.898E7C06A350D4A1A64A9EA264D55452] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.11/04/2009 - 07:28:13.) -- C:\Windows\System32\Winlogon.exe [314368] [MD5.3911B972B55FEA0478476B2E777B29FA] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.21/04/2011 - 14:58:27.) -- C:\Windows\system32\Drivers\AFD.sys [273408] [MD5.1F05B78AB91C9075565A9D8A4B880BC4] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.11/04/2009 - 07:32:26.) -- C:\Windows\system32\Drivers\atapi.sys [19944] [MD5.7ADD03E75BEB9E6DD102C3081D29840A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.19/01/2008 - 06:28:02.) -- C:\Windows\system32\Drivers\Cdfs.sys [70144] [MD5.6B4BFFB9BECD728097024276430DB314] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.11/04/2009 - 05:39:17.) -- C:\Windows\system32\Drivers\Cdrom.sys [67072] [MD5.622C41A07CA7E6DD91770F50D532CB6C] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.14/04/2011 - 15:59:03.) -- C:\Windows\system32\Drivers\DfsC.sys [75264] [MD5.062452B7FFD68C8C042A6261FE8DFF4A] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.11/04/2009 - 05:42:42.) -- C:\Windows\system32\Drivers\HDAudBus.sys [561152] [MD5.22D56C8184586B7A1F6FA60BE5F5A2BD] - (.Microsoft Corporation - Pilote de port i8042.) (.19/01/2008 - 06:49:18.) -- C:\Windows\system32\Drivers\i8042prt.sys [54784] [MD5.8793643A67B42CEC66490B2A0CF92D68] - (.Microsoft Corporation - IP Network Address Translator.) (.19/01/2008 - 06:56:28.) -- C:\Windows\system32\Drivers\IpNat.sys [100864] [MD5.1E94971C4B446AB2290DEB71D01CF0C2] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.29/04/2011 - 14:24:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [106496] [MD5.ECD64230A59CBD93C85F1CD1CAB9F3F6] - (.Microsoft Corporation - MBT Transport driver.) (.11/04/2009 - 05:45:37.) -- C:\Windows\system32\Drivers etBT.sys [185856] [MD5.2C1121F2B87E9A6B12485DF53CD848C7] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.03/03/2013 - 20:07:52.) -- C:\Windows\system32\Drivers tfs.sys [1082232] [MD5.0FA9B5055484649D63C303FE404E5F4D] - (.Microsoft Corporation - Pilote de port parallèle.) (.02/11/2006 - 09:51:30.) -- C:\Windows\system32\Drivers\Parport.sys [79360] [MD5.A214ADBAF4CB47DD2728859EF31F26B0] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.19/01/2008 - 06:56:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [76288] [MD5.E8BD98D46F2ED77132BA927FCCB47D8B] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.02/11/2006 - 10:03:00.) -- C:\Windows\system32\Drivers dpdr.sys [242688] [MD5.7B75299A4D201D6A6533603D6914AB04] - (.Microsoft Corporation - SMB Transport driver.) (.11/04/2009 - 05:45:22.) -- C:\Windows\system32\Drivers\smb.sys [66560] [MD5.76B06EB8A01FC8624D699E7045303E54] - (.Microsoft Corporation - TDI Translation Driver.) (.11/04/2009 - 05:45:56.) -- C:\Windows\system32\Drivers dx.sys [72192] [MD5.786DB5771F05EF300390399F626BF30A] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/08/2012 - 12:47:42.) -- C:\Windows\system32\Drivers\volsnap.sys [224640] ~ Generic Processes: Scanned in 00mn 00s ---\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 1/179 ~ Mes musiques (My Musics) : 1/304 ~ Mes Videos (My Videos) : 1/2 ~ Mes Favoris (My Favorites) : 1/2 ~ Mes Documents (My Documents) : 1/2080 ~ Mon Bureau (My Desktop) : 1/5 ~ Menu demarrer (Programs) : 1/33 ~ Hidden Files: Scanned in 00mn 01s ---\ Processus lancés [MD5.3F91D1056D2CEBEF374BE0E55428190A] - (.Cognizance Corporation - Global Virtual Card Host.) -- c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe [65536] [PID.3816] [MD5.0D392EDE3B97E0B3131B2F63EF1DB94E] - (.Microsoft Corporation - Windows Defender User Interface.) -- C:\Program Files\Windows Defender\MSASCui.exe [1008184] [PID.1632] [MD5.0AE3673E1C450359490CF47D6AA3AF7F] - (.Motorola Inc. - SM56 Modem Helper.) -- C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe [1458176] [PID.3248] [MD5.94444693EA13A72F6820DFF844A1122E] - (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2299176] [PID.1000] [MD5.C7C70AE1DE8F0FCC8F2431C5D15632DF] - (.Intel Corporation - Event Monitor User Notification Tool.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [174872] [PID.3520] [MD5.AF849798ECA383184C88ED436CF3EFB2] - (.Hewlett-Packard Development Company, L.P. - HPWAMain Module.) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [472776] [PID.1596] [MD5.C637FC4638A96165256B28D38DE7B953] - (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files\HP\HP Software Update\hpwuschd2.exe [49208] [PID.3620] [MD5.3F11B20D12D89365D7721BDC860CE5F0] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe [4858968] [PID.3812] [MD5.BF08674925F151BD4537B89A493E3E0C] - (.Microsoft Corporation - Media Center Tray Applet.) -- C:\Windows\ehome\ehtray.exe [125952] [PID.3184] [MD5.0F4195B9B348DE5CF9B822F81704B20E] - (.Microsoft Corporation - Media Center Media Status Aggregator Servic.) -- C:\Windows\ehome\ehmsas.exe [37376] [PID.2236] [MD5.241B74792CC295DFDCB7940BBF52B226] - (.Pas de propriétaire - HpqToaster Module.) -- C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe [677576] [PID.3956] [MD5.3E802CE450D0E7A234978E9A2EA4772A] - (.Synaptics Incorporated - Synaptics Pointing Device Helper.) -- C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.exe [107816] [PID.3600] [MD5.518545E8CBD79EBF42891A6066578118] - (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner.exe [3591960] [PID.1484] =>Piriform Ltd [MD5.6080A176D09435FC8E6E800996656E18] - (.Microsoft Corporation - Console IME.) -- C:\Windows\system32\conime.exe [69120] [PID.5080] [MD5.F72DD84DD69DF001CF4D1B909685A136] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7402496] [PID.5172] [MD5.C4D17F11526F87BC762F31DA5BD2580B] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 187.6.) -- C:\Windows\system32 vvsvc.exe [219752] [PID.1064] [MD5.862BB4CBC05D80C5B45BE430E5EF872F] - (.Microsoft Corporation - Service de gestion des licences Microsoft.) -- C:\Windows\system32\SLsvc.exe [3408896] [PID.1436] [MD5.28D6701C710AD7BA3CB95E75F8F1A9AA] - (.AVAST Software - avast! Service.) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [46808] [PID.1900] [MD5.ADDA5E1951B90D3D23C56D3CF0622ADC] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [65640] [PID.580] [MD5.DBAFC6734C054FEEF9087754BD80F847] - (.Pas de propriétaire - CLCapSvc Module.) -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe [262243] [PID.1376] [MD5.582F2D900A3AC34C98FBDC2C0ABEF6B9] - (.Intel Corporation - RAID Monitor.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [355096] [PID.2308] [MD5.559C9B7800FAC92FC515CD0003D7C631] - (.Hewlett-Packard Company - Pas de description.) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440] [PID.2488] [MD5.11F714F85530A2BD134074DC30E99FCA] - (.Microsoft Corporation - Machine Debug Manager.) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.exe [322120] [PID.2572] [MD5.04C1DCBB226C6AE647B794833CE3CEB6] - (.Hewlett-Packard Development Company, L.P. - hpqwmiex Module.) -- C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [135168] [PID.3100] [MD5.E67F8F036FD882E4AB62501C0D45B536] - (.Pas de propriétaire - CLSched Module.) -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe [106593] [PID.3284] [MD5.2CEEB349216FEBD91A907013D4ABCFF7] - (.Hewlett-Packard - HP Health Check Service.) -- C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [62984] [PID.3712] ~ Processes Running: Scanned in 00mn 00s ---\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4) R4 - HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,Enabled = 1 ~ IE Browser: 10 Legitimates Filtered in 00mn 00s ---\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl" ~ Keys: Scanned in 00mn 00s ---\ Redirection du fichier Hosts (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 03s ~ Nombre de lignes (Lines number): 10584 ---\ Browser Helper Objects de navigateur (O2) O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} . (.AVAST Software - IE Webrep plugin.) -- C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll ~ BHO: 1 Legitimates Filtered in 00mn 00s ---\ Internet Explorer Toolbars (O3) O3 - Toolbar: avast! WebRep - [HKLM]{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} . (.AVAST Software - IE Webrep plugin.) -- C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll ~ Toolbar: Scanned in 00mn 00s ---\ Applications démarrées par registre & par dossier (O4) O4 - HKLM\..\Run: [Windows Defender] . (.Microsoft Corporation - Windows Defender User Interface.) -- C:\Program Files\Windows Defender\MSASCui.exe O4 - HKLM\..\Run: [SMSERIAL] . (.Motorola Inc. - SM56 Modem Helper.) -- C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [SynTPEnh] . (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [IAAnotif] . (.Intel Corporation - Event Monitor User Notification Tool.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [HP Health Check Scheduler] . (.Hewlett-Packard - HP Health Check Scheduler.) -- C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe O4 - HKLM\..\Run: [hpWirelessAssistant] . (.Hewlett-Packard Development Company, L.P. - HPWAMain Module.) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [CognizanceTS] . (.Cognizance Corporation - Terminal Services Virtual Channel Client.) -- C:\Program Files\Bioscrypt\VeriSoft\Bin\ASTSVCC.dll O4 - HKLM\..\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [avast5] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe O4 - HKCU\..\Run: [ehTray.exe] . (.Microsoft Corporation - Media Center Tray Applet.) -- C:\Windows\ehome\ehTray.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] oobefldr.dll O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] oobefldr.dll O4 - HKUS\S-1-5-21-1430075414-1570763820-2450149755-1000\..\Run: [ehTray.exe] . (.Microsoft Corporation - Media Center Tray Applet.) -- C:\Windows\ehome\ehTray.exe ~ Application: Scanned in 00mn 00s ---\ Autres liens utilisateurs (O4) O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Programs: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe O4 - GS\QuickLaunch: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O4 - GS\QuickLaunch: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\SendTo: Assistant Transfert de fichiers Bluetooth.LNK . (.Microsoft Corporation - Pas de description.) -- C:\Windows\System32\fsquirt.exe O4 - GS\Desktop: OpenOffice.org 3.4.1.lnk . (.OpenOffice.org - OpenOffice.org 3.4.1.) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe O4 - GS\Desktop: Spybot - Search & Destroy.lnk . (.Safer Networking Limited - Spybot - Search & Destroy.) -- C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe O4 - GS\Desktop: Wordbiz.lnk . (.Internet Scrabble Club - Wordbiz.) -- C:\Program Files\WordBiz\WordBiz.exe ~ Global Startup: Scanned in 00mn 00s ---\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -- Clé orpheline ~ IE Extra Buttons: Scanned in 00mn 00s ---\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{42DF069B-7975-410A-9355-0EB0162F8E31}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{6D3C2686-FDD5-495A-9177-A9C3CF88A778}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{42DF069B-7975-410A-9355-0EB0162F8E31}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{6D3C2686-FDD5-495A-9177-A9C3CF88A778}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{42DF069B-7975-410A-9355-0EB0162F8E31}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{EFECB41B-4609-497D-B1DA-0FDD4FBEF216}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS3\Services\Tcpip\..\{42DF069B-7975-410A-9355-0EB0162F8E31}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS3\Services\Tcpip\..\{EFECB41B-4609-497D-B1DA-0FDD4FBEF216}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 ~ Domain: Scanned in 00mn 00s ---\ Protocole additionnel (O18) O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\system32\mshtml.dll O18 - Filter: application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll ~ Protocole Additionnel: Scanned in 00mn 00s ---\ Clé de Registre autorun SharedTaskScheduler (STS) (O22) O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\Windows\System32\browseui.dll ~ STS/SSO: Scanned in 00mn 00s ---\ Enumération Active Desktop & MHTML Editor (O24) O24 - Default MHTML Editor: Last - .(...) - C:\Program Files\Microsoft Office\OFFICE11\WINWORD.exe (.not file.) O24 - Desktop General: BackupWallPaper - .(...) - C:\Users\xyzxyz\Documents\Dossier entier\dossier Photo Sarah\Photo 112.jpg O24 - Desktop General: WallPaper - .(...) - C:\Users\xyzxyz\Documents\Dossier entier\dossier Photo Sarah\Photo 112.jpg ~ Desktop Component: 4 Legitimates Filtered in 00mn 00s ---\ Tâches planifiées en automatique (O39) [MD5.00000000000000000000000000000000] [APT] [Ad-Aware Update (Daily 1)] (...) -- C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [Ad-Aware Update (Daily 2)] (...) -- C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [Ad-Aware Update (Daily 3)] (...) -- C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [Ad-Aware Update (Daily 4)] (...) -- C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [Ad-Aware Update (Weekly)] (...) -- C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [{784D92B0-87B1-411B-B4BA-41E8DFB3EE8D}] (...) -- C:\Program Files\Everest Poker\cstart.exe (.not file.) [0] =>PUP.Casino [MD5.00000000000000000000000000000000] [APT] [{99512EC3-73DE-42C2-BD7E-B4459C32D55E}] (...) -- F:\setup.exe (.not file.) [0] ~ Scheduled Task: 16 Legitimates Filtered in 00mn 03s ---\ Logiciels installés (O42) O42 - Logiciel: VeriSoft Access Manager - (.Bioscrypt Inc..) [HKLM] -- {0ABA40AF-288D-41F1-B735-C5155692CD7D} ~ Logic: 81 Legitimates Filtered in 00mn 00s ---\ HKCU & HKLM Software Keys [HKCU\Software\mc] [HKLM\Software\InstallationKit] ~ Key Software: 171 Legitimates Filtered in 00mn 00s ---\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 08/12/2007 - 19:12:07 - [17,991] ----D C:\Program Files\Bioscrypt O43 - CFD: 19/05/2009 - 19:54:40 - [13,721] ----D C:\Program Files\CapAlpha O43 - CFD: 30/12/2007 - 23:46:38 - [10,349] ----D C:\Program Files\SP38015 O43 - CFD: 05/02/2010 - 14:26:28 - [0,178] ----D C:\Program Files\Common Files\Akamai O43 - CFD: 10/08/2008 - 01:40:40 - [0] ----D C:\Users\xyzxyz\AppData\Roaming\VeriSoft Access Manager O43 - CFD: 17/12/2009 - 15:30:47 - [1,791] ----D C:\Users\xyzxyz\AppData\Local\PokerStars.NET ~ 209 Dossiers CLSID vides (CLSID Empty Folders) ~ Program Folder: 413 Legitimates Filtered in 00mn 22s ---\ MountPoints2 Shell Key (O51) O51 - MPSK:{d0688e78-e382-11de-b707-001b24d0b6c6}\AutoRun\command. (...) -- G:\InstallTomTomHOME.exe (.not file.) ~ Keys: Scanned in 00mn 00s ---\ Microsoft Windows Policies System (O55) O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 ~ MWPS: 16 Legitimates Filtered in 00mn 00s ---\ Liste des Drivers Système (O58) O58 - SDL:[MD5.2EDC5BBAC6C651ECE337BDE8ED97C9FB] - 02/11/2006 - 10:51:38 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [420968] O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 02/11/2006 - 08:09:42 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029] ~ Drivers: Scanned in 00mn 00s ---\ Derniers fichiers modifiés ou crées (Utilisateur) (O61) O61 - LFC: 27/05/2013 - 16:51:08 ---A- C:\Users\xyzxyz\Downloads\adwcleaner.exe [632031] O61 - LFC: 27/05/2013 - 17:11:04 ---A- C:\Users\xyzxyz\Downloads\ccsetup402.exe [4378864] ~ 1 Fichiers temporaires (Temporary files) ~ Files: 10 Legitimates Filtered in 01mn 26s ---\ Liste des outils de nettoyage (O63) O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 ~ ADS: Scanned in 00mn 00s ---\ Liste des services Legacy (O64) O64 - Services: CurCS - ??\??\???? - Pas de propriétaire (Lbd) .(...) - LEGACY_LBD ~ Legacy: 70 Legitimates Filtered in 00mn 00s ---\ File Associations Shell Spawning (O67) O67 - Shell Spawning: <.html> [HKLM\..\open\Command] (.Not Key.) O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.Not Key.) O67 - Shell Spawning: <.html> [HKCR\..\open\Command] (.Not Key.) ~ FASS Keys: 19 Legitimates Filtered in 00mn 00s ---\ Start Menu Internet (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\ Search Browser Infection (O69) O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8 O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8 O69 - SBI: SearchScopes [HKCU] {DAE1F01E-CDBA-4583-BDD0-F32DADF35661} - (Yahoo! France) - https://fr.search.yahoo.com/ ~ Keys: Scanned in 00mn 00s ---\ Recherche particuliere à la racine de certains dossiers (O84) [MD5.25CB492EAF08F65EC4CB4409BEDE34E2] [SPRF][24/06/2009] (...) -- C:\ProgramData\ezsidmv.dat [56] [MD5.6E05A7A738A120D1FB38EAA2B0F078E4] [SPRF][23/04/2010] (...) -- C:\ProgramData tuser.dat [262144] [MD5.E0E17D083043FF3B713FFC9A30D1E22C] [SPRF][27/05/2013] (...) -- C:\ProgramData vModes.dat [63174] [MD5.418E9841D9F625FC098A7DB95CED83D9] [SPRF][17/06/2012] (...) -- C:\Users\xyzxyz\AppData\Local\d3d9caps.dat [680] [MD5.CA56F21584E944979F7AA9F4F441553C] [SPRF][15/03/2009] (...) -- C:\Users\xyzxyz\AppData\Roaming vModes.dat [27430] [MD5.91B8FC060C68BFEEA138BE4B2E5F3470] [SPRF][02/03/2011] (...) -- C:\Users\xyzxyz\AppData\Roaming\wklnhst.dat [146] [MD5.9802B937DD7C102CC5F21E0D0979CE41] [SPRF][18/09/2011] (.Adobe Systems, Inc. - Adobe® Flash® Player Installer/Uninstaller 10.3 r183.) -- C:\Windows\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe [3126944] ~ Files: Scanned in 00mn 00s ---\ Scan Additionnel (O88) Database Version : v2.12362 - (25/05/2013) Clés trouvées (Keys found) : 1 Valeurs trouvées (Values found) : 0 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 0 [HKLM\Software\Classes\Interface\{D6094FC6-821F-474C-8D73-C13066CD178D}] =>Toolbar.Agent ~ Additionnel Scan: 247415 Items scanned in 00mn 21s ---\ Product Upgrade Codes (O90) O90 - PUC: "FA04ABA0D8821F147B535C516529DCD7" . (.VeriSoft Access Manager.) -- c:\Windows\Installer\{0ABA40AF-288D-41F1-B735-C5155692CD7D}\ARPPRODUCTICON.exe ~ Update Products: 71 Legitimates Filtered in 00mn 00s ---\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped) SR - | Auto 10/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe SR - | Auto 19/01/2008 21504 | c:\Program Files\Bioscrypt\VeriSoft\Bin\ASWLNPkg.dll (ASBroker) . (.Cognizance Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 19/01/2008 21504 | c:\Program Files\Bioscrypt\VeriSoft\Bin\AsChnl.dll (ASChannel) . (.Cognizance Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 09/05/2013 46808 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe SR - | Auto 262243 | (CLCapSvc) . (...) - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe SR - | Auto 106593 | (CLSched) . (...) - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe SR - | Auto 14/03/2007 62984 | (HP Health Check Service) . (.Hewlett-Packard.) - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe SR - | Demand 19/01/2008 21504 | C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll (hpqcxs08) . (.Hewlett-Packard Co..) - C:\Windows\System32\svchost.exe SR - | Auto 19/01/2008 21504 | C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll (hpqddsvc) . (.Hewlett-Packard Co..) - C:\Windows\System32\svchost.exe SR - | Auto 02/05/2006 135168 | (hpqwmiex) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe SR - | Auto 12/02/2007 355096 | (IAANTMON) . (.Intel Corporation.) - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe SS - | Demand 04/04/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe SR - | Auto 14/12/2006 61440 | (LightScribeService) . (.Hewlett-Packard Company.) - C:\Program Files\Common Files\LightScribe\LSSrvc.exe SR - | Auto 19/01/2008 21504 | C:\Windows\system32\HPZinw12.dll (Net Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe SR - | Auto 03/10/2009 219752 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\System32 vvsvc.exe SR - | Auto 19/01/2008 21504 | C:\Windows\system32\HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe SS - | Demand 12/02/2007 880640 | (RoxMediaDB9) . (.Sonic Solutions.) - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe SS - | Demand 17/02/2007 74656 | (stllssvr) . (.MicroVision Development, Inc..) - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe SR - | Auto 19/01/2008 21504 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 19/01/2008 21504 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe ~ Services: Scanned in 00mn 01s ---\ Recherche Master Boot Record Infection (MBR)(O80) Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net Run by xyzxyz at 27/05/2013 23:29:57 device: opened successfully user: MBR read successfully Disk trace: called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys C:\Windows\system32\DRIVERS\iaStor.sys Intel Corporation Intel Matrix Storage Manager driver 1 ntkrnlpa!IofCallDriver[0x83093926] >> \Device\Harddisk0\DR0[0x8719BAC8] kernel: MBR read successfully user & kernel MBR OK ~ MBR: 14 Legitimates Filtered in 00mn 02s ---\ Recherche Master Boot Record Infection (MBRCheck)(O80) Written by ad13, http://ad13.geekstog Run by xyzxyz at 27/05/2013 23:29:59 ********* Dump file Name ********* C:\PhysicalDisk0_MBR.bin ~ MBR: Scanned in 00mn 04s ~ 1293 Legitimates filtered by white list End of the scan (449 lines in 03mn 52s)(0)

g3n-h@ckm@n · Answer

tu peux pas desinstaller spybot ?

novice6433 · Answer

je viens de desinstaller spybot

merci encore pour ton aide

g3n-h@ckm@n · Answer

sélectionne les lignes ci-dessous et copie les dans le Presse-papier (Ctrl C) [HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: Modified OPT:O4 - HKLM\..\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - GS\Desktop: Spybot - Search & Destroy.lnk . (.Safer Networking Limited - Spybot - Search & Destroy.) -- C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe [MD5.00000000000000000000000000000000] [APT] [Ad-Aware Update (Daily 1)] (...) -- C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [Ad-Aware Update (Daily 2)] (...) -- C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [Ad-Aware Update (Daily 3)] (...) -- C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [Ad-Aware Update (Daily 4)] (...) -- C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [Ad-Aware Update (Weekly)] (...) -- C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [{784D92B0-87B1-411B-B4BA-41E8DFB3EE8D}] (...) -- C:\Program Files\Everest Poker\cstart.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [{99512EC3-73DE-42C2-BD7E-B4459C32D55E}] (...) -- F:\setup.exe (.not file.) [0] [HKCU\Software\mc] O64 - Services: CurCS - ??\??\???? - Pas de propriétaire (Lbd) .(...) - LEGACY_LBD O67 - Shell Spawning: <.html> [HKLM\..\open\Command] (.Not Key.) O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.Not Key.) O67 - Shell Spawning: <.html> [HKCR\..\open\Command] (.Not Key.) [HKLM\Software\Classes\Interface\{D6094FC6-821F-474C-8D73-C13066CD178D}] Pour Xp : Double clique sur l'icône ZHPFix.exe sur ton Bureau. Pour Vista : Clique droit sur l'icône ZHPFix.exe sur ton Bureau, puis sélectionne 'Exécuter en tant qu'administrateur'. - Clique sur l'icone représentant la lettre H (« coller les lignes Helper ») - Les lignes se collent automatiquement dans ZHPFix, sinon colle les lignes - Clique sur le bouton « GO » pour lancer le nettoyage, - Copie/colle la totalité du rapport dans ta prochaine réponse

novice6433 · Answer

rebonjour,

voici le rapport de zhpfix. merci encore une fois

Rapport de ZHPFix 2013.5.24.2 par Nicolas Coolman, Update du 24/05/2013
Fichier d'export Registre : C:\ZHP\ZHPExportRegistry-28-05-2013-11-45-21.txt
Run by xyzxyz at 28/05/2013 11:45:21
High Elevated Privileges : OK
Windows Vista Home Premium Edition, 32-bit Service Pack 2 (Build 6002)

Corbeille vidée

========== Clé(s) du Registre ==========
SUPPRIME Key: HKCU\Software\mc
ERREUR Key: Service Legacy: LEGACY_LBD
ABSENT Pointeurs: ChromeHTML(html) Default=
SUPPRIME Key: HKLM\Software\Classes\Interface\{D6094FC6-821F-474C-8D73-C13066CD178D}

========== Valeur(s) du Registre ==========
ABSENT Value Key: AntiVirusOverride
SUPPRIME RunValue: HP Software Update

========== Fichier(s) ==========
ABSENT File: c:\users\xyzxyz\desktop\spybot - search & destroy.lnk
ABSENT File: c:\program files\spybot - search & destroy\spybotsd.exe

========== Tache planifiée ==========
SUPPRIME Task: Ad-Aware Update (Daily 1)
SUPPRIME Task: Ad-Aware Update (Daily 2)
SUPPRIME Task: Ad-Aware Update (Daily 3)
SUPPRIME Task: Ad-Aware Update (Daily 4)
SUPPRIME Task: Ad-Aware Update (Weekly)
SUPPRIME Task: {784D92B0-87B1-411B-B4BA-41E8DFB3EE8D}
SUPPRIME Task: {99512EC3-73DE-42C2-BD7E-B4459C32D55E}


========== Récapitulatif ==========
4 : Clé(s) du Registre
2 : Valeur(s) du Registre
2 : Fichier(s)
7 : Tache planifiée


End of clean in 00mn 07s

========== Chemin de fichier rapport ==========
C:\ZHP\ZHPFix[R1].txt - 28/05/2013 11:45:21 [1377]

g3n-h@ckm@n · Answer

bien tu peux faire le ménage

https://forums-fec.be/entraide/viewtopic.php?f=11&t=229

novice6433 · Answer

rebonjour,

voici le rapport delfix.txt. merci encore pour ton aide

# DelFix v10.2 - Rapport créé le 28/05/2013 à 12:13:21
# Mis à jour le 02/04/2013 par Xplode
# Nom d'utilisateur : xyzxyz - PC-DE-XYZXYZ
# Système d'exploitation : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)

~ Activation de l'UAC ... OK

~ Suppression des outils de désinfection ...

Supprimé : C:\ZHP
Supprimé : C:\Program Files\ZHPDiag
Supprimé : C:\AdwCleaner[S1].txt
Supprimé : C:\AdwCleaner[S2].txt
Supprimé : C:\PhysicalDisk0_MBR.bin
Supprimé : C:\Users\xyzxyz\Desktop\ZHPDiag.txt
Supprimé : C:\Users\xyzxyz\Desktop\ZHPDiag27052013
Supprimé : C:\Users\xyzxyz\Desktop\ZHPFixReport.txt
Supprimé : C:\Users\Public\Desktop\MBRCheck.lnk
Supprimé : C:\Users\Public\Desktop\ZHPDiag.lnk
Supprimé : C:\Users\Public\Desktop\ZHPFix.lnk
Supprimé : C:\Users\xyzxyz\Downloads\adwcleaner.exe
Supprimée : HKLM\SOFTWARE\AdwCleaner
Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1

~ Sauvegarde de la base de registre ... OK

~ Purge de la restauration système ...

Supprimé : RP #2112 [Point de contrôle planifié | 05/18/2013 12:30:55]
Supprimé : RP #2113 [Point de contrôle planifié | 05/19/2013 12:18:33]
Supprimé : RP #2114 [Point de contrôle planifié | 05/20/2013 12:34:01]
Supprimé : RP #2115 [Windows Update | 05/21/2013 09:59:04]
Supprimé : RP #2116 [Point de contrôle planifié | 05/22/2013 14:56:37]
Supprimé : RP #2117 [Point de contrôle planifié | 05/23/2013 12:53:05]
Supprimé : RP #2118 [Windows Update | 05/24/2013 12:46:12]
Supprimé : RP #2119 [Point de contrôle planifié | 05/25/2013 15:30:32]
Supprimé : RP #2120 [Point de contrôle planifié | 05/26/2013 11:03:48]
Supprimé : RP #2121 [Point de contrôle planifié | 05/27/2013 10:27:19]
Supprimé : RP #2122 [Windows Update | 05/28/2013 09:00:54]
Supprimé : RP #2123 [Installed Java 7 Update 21 | 05/28/2013 10:06:13]

Nouveau point de restauration créé !

~ Réinitialisation des paramètres système ... OK

########## - EOF - ##########

g3n-h@ckm@n · Answer

formidable:)

novice6433 · Answer

merci encore pour ton aide g3n-h@ckm@n.

je redemare l'ordi...

j'aurai une dernière question pour toi

encore merci

novice6433 · Answer

merci encore.

une derniere question je te prie

dans le dossier Prefetch, je me retrouve avec les fichiers suivants (est ce grave?):

AgAppLaunch.db
AgGlFaultHistory.db
AgGlFgAppHistory.db
AgGlGlobalHistory.db
AgRobust.db

Peux tu stp me dire à quoi correspondent ces fichiers.
Merci encore pour ton aide

g3n-h@ckm@n · Answer

aucune idée , par contre si tu as bien parametré ccleaner il devrait les virer.

 sinon ouvres-en un avec le bloc notes tu devrait pouvoir lire ce à quoi ils correspondent

novice6433 · Answer

merci encore g3n-h@ckm@n pour ton aide.

bonne fin de journée

g3n-h@ckm@n · Answer

au plaisir...:)

Bonjour, comment exploiter le rapport ZHPdiag?

22 réponses

Discussions similaires