Pubs incessantes sur Chrome.

Voila, j'ai le rapport :

http://cjoint.com/?CGgiUHg24Mt

Re, le logiciel commence à 10% et ne répond plus.
Dois-je tout de même faire la suite ?

(Sachant que je branche rarement des appareils à mon PC)

Suppression :

RogueKiller V8.6.2 [Jul 5 2013] par Tigzy
mail : tigzyRK<at>gmail<dot>com
Remontees : http://www.adlice.com/forum/
Site Web : https://www.luanagames.com/index.fr.html
Blog : http://tigzyrk.blogspot.com/

Systeme d'exploitation : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Demarrage : Mode normal
Utilisateur : Utilisateur [Droits d'admin]
Mode : Recherche -- Date : 07/06/2013 13:04:31
| ARK || FAK || MBR |

¤¤¤ Processus malicieux : 0 ¤¤¤

¤¤¤ Entrees de registre : 0 ¤¤¤

¤¤¤ Tâches planifiées : 0 ¤¤¤

¤¤¤ Entrées Startup : 0 ¤¤¤

¤¤¤ Navigateurs web : 0 ¤¤¤

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤

¤¤¤ Driver : [NON CHARGE 0x0] ¤¤¤

¤¤¤ Ruches Externes: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ Fichier HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 findgala.com/
127.0.0.1 www.webgains.com
127.0.0.1 words.eanswers.com/
::1 hxxp://words.eanswers.com/
127.0.0.1 www.eanswers.com
::1 www.eanswers.com
234.3.24.187 www.eanswers.com
::1 www.eanswers.com
127.0.0.1 eAnswers.com
::1 eAnswers.com


¤¤¤ MBR Verif: ¤¤¤

+++++ PhysicalDrive0: ST9500325AS +++++
--- User ---
[MBR] 972a0c5c5ab8d644ce9fb00e88f9d316
[BSP] 7bd49e0be343aed6cef7765347589b69 : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 18432 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 37750784 | Size: 100 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 37955584 | Size: 458406 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Termine : << RKreport[0]_S_07062013_130430.txt >>
RKreport[0]_D_07062013_130306.txt;RKreport[0]_S_07062013_123144.txt







========================================================







Host raz :

RogueKiller V8.6.2 [Jul 5 2013] par Tigzy
mail : tigzyRK<at>gmail<dot>com
Remontees : http://www.adlice.com/forum/
Site Web : https://www.luanagames.com/index.fr.html
Blog : http://tigzyrk.blogspot.com/

Systeme d'exploitation : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Demarrage : Mode normal
Utilisateur : Utilisateur [Droits d'admin]
Mode : HOSTS RAZ -- Date : 07/06/2013 13:04:42
| ARK || FAK || MBR |

¤¤¤ Processus malicieux : 0 ¤¤¤

¤¤¤ Entrees de registre : 0 ¤¤¤

¤¤¤ Driver : [NON CHARGE 0x0] ¤¤¤

¤¤¤ Ruches Externes: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ Fichier HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 findgala.com/
127.0.0.1 www.webgains.com
127.0.0.1 words.eanswers.com/
::1 hxxp://words.eanswers.com/
127.0.0.1 www.eanswers.com
::1 www.eanswers.com
234.3.24.187 www.eanswers.com
::1 www.eanswers.com
127.0.0.1 eAnswers.com
::1 eAnswers.com


¤¤¤ Nouveau fichier HOSTS: ¤¤¤
127.0.0.1 localhost


Termine : << RKreport[0]_H_07062013_130442.txt >>
RKreport[0]_D_07062013_130306.txt;RKreport[0]_S_07062013_123144.txt;RKreport[0]_S_07062013_130430.txt

Il semble que je ne reçoive plus de pubs ou quoi que ce soit d'autres qui soit dérangeant et inhabituel.

Est-ce que je peux désinstaller tous les logiciels que j'ai installé pour régler ce problème ?

Je poste quand même le rapport :

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Version de la base de données: v2013.07.06.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16618
Utilisateur :: UTILISATEUR-PC [administrateur]

06/07/2013 14:00:46
mbam-log-2013-07-06 (14-00-46).txt

Type d'examen: Examen complet (C:\|D:\|)
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 411153
Temps écoulé: 51 minute(s), 13 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 11
HKCR\CLSID\{4344571D-4871-464B-AD82-D69B7AD1EAFA} (Trojan.BHO) -> Mis en quarantaine et supprimé avec succès.
HKCR\CLSID\{4344571D-4871-464B-AD82-D69B7AD14344} (Trojan.BHO) -> Mis en quarantaine et supprimé avec succès.
HKCR\TypeLib\{96A68966-F439-4C66-8BFA-0967FACE4F7A} (Trojan.BHO) -> Mis en quarantaine et supprimé avec succès.
HKCR\Interface\{39434AF1-56D9-448E-B4D0-272EB8F70B4F} (Trojan.BHO) -> Mis en quarantaine et supprimé avec succès.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4344571D-4871-464B-AD82-D69B7AD14344} (Trojan.BHO) -> Mis en quarantaine et supprimé avec succès.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{4344571D-4871-464B-AD82-D69B7AD14344} (Trojan.BHO) -> Mis en quarantaine et supprimé avec succès.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4344571D-4871-464B-AD82-D69B7AD14344} (Trojan.BHO) -> Mis en quarantaine et supprimé avec succès.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4344571D-4871-464B-AD82-D69B7AD14344} (Trojan.BHO) -> Mis en quarantaine et supprimé avec succès.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4344571D-4871-464B-AD82-D69B7AD1EAFA} (Trojan.BHO) -> Mis en quarantaine et supprimé avec succès.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{4344571D-4871-464B-AD82-D69B7AD1EAFA} (Trojan.BHO) -> Mis en quarantaine et supprimé avec succès.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4344571D-4871-464B-AD82-D69B7AD1EAFA} (Trojan.BHO) -> Mis en quarantaine et supprimé avec succès.

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 8
C:\Users\Utilisateur\AppData\Roaming\kmjuiuin.dll (Trojan.BHO) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Utilisateur\AppData\Roaming\main.dll (Trojan.BHO) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files (x86)\Splice\TDU500.exe (Packer.ModifiedUPX) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Utilisateur\Documents\Terraria v1.1.2.zip (Packer.ModifiedUPX) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Utilisateur\Downloads\setup (1).exe (Trojan.Downloader) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Utilisateur\Downloads\setup (2).exe (Trojan.Downloader) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Utilisateur\Downloads\setup (3).exe (Trojan.Downloader) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Utilisateur\Downloads\setup.exe (Trojan.Downloader) -> Mis en quarantaine et supprimé avec succès.

(fin)

Finalement, elles ne sont pas parties..

Oui, j'ai redémaré, voici le nouveau rapport :

Rapport de ZHPDiag v2013.7.5.7 par Nicolas Coolman, Update du 05/07/2013
Run by Utilisateur at 06/07/2013 16:01:42
WebSite: https://nicolascoolman.webs.com/
State : Version à jour.
WhiteList : Enable
High Elevated Privileges : OK
UAC : Deactivate by program


---\\ Web Browser
MSIE: Internet Explorer v10.0.9200.16618
GCIE: Google Chrome v27.0.1453.116 (Defaut)

---\\ Windows Product Information
~ Langage: Français
Windows Vista Home Premium Edition, 64-bit (Build 6000)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 7QJB7
Windows License : OK
~ Windows Remaining Initializations Number : 2
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK

---\\ System Protection
Malwarebytes Anti-Malware version 1.75.0.1300

---\\ System Optimizer
CCleaner v4.03 =>Piriform Ltd

---\\ Peer To Peer (P2P)

---\\ Software Update
Adobe Flash Player 11 ActiveX
Adobe Reader X MUI
Java 7 Update 15
Java 7 Update 25

---\\ System Information
~ Processor: Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3947 MB (25% free)
System Restore: Activé (Enable)
System drive C: has 285 GB (63%) free of 448 GB

---\\ Logged in mode
~ Computer Name: UTILISATEUR-PC
~ User Name: Utilisateur
~ All Users Names: Utilisateur, UpdatusUser, Administrateur,
~ Unselected Option: None
Logged in as Administrator

---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Users\Utilisateur\AppData\Roaming\
~ %Desktop% : C:\Users\Utilisateur\Desktop\
~ %Favorites% : C:\Users\Utilisateur\Favorites\
~ %LocalAppData% : C:\Users\Utilisateur\AppData\Local\
~ %StartMenu% : C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 285 Go of 448 Go)
D:\ CD-ROM drive (Not Inserted)



---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 34 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.14/07/2011 - 06:30:29.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.12716D987D475B051F35895659159705] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.17/05/2013 - 01:59:03.) -- C:\Windows\System32\wininet.dll [2241024]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.21/11/2010 - 04:24:29.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.21/11/2010 - 04:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.1C7857B62DE5994A75B054A9FD4C3825] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/12/2011 - 04:59:24.) -- C:\Windows\system32\Drivers\AFD.sys [498688]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.14/07/2011 - 06:33:59.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 04:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 04:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/4714
~ Mes musiques (My Musics) : 3/466
~ Mes Videos (My Videos) : 1/7
~ Mes Favoris (My Favorites) : 1/17
~ Mes Documents (My Documents) : 1/6350
~ Mon Bureau (My Desktop) : 1/368
~ Menu demarrer (Programs) : 1/12
~ Hidden Files: Scanned in 00mn 13s



---\\ Processus lancés
[MD5.AB8420D9EFF346DDD72E9C985BE2FC5B] - (.Sony - Sony PC Companion.) -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [449248] [PID.928]
[MD5.97D965A341C76FCB35B4344BFA2CBC06] - (.Valve Corporation - Steam Client Bootstrapper (buildbot_winslav.) -- C:\Program Files (x86)\Steam\Steam.exe [1641896] [PID.2176]
[MD5.B99CDC564C75D27C9188EADAB8928F10] - (.Bogdan Sharkov - Clownfish for Skype.) -- C:\Program Files (x86)\Clownfish\Clownfish.exe [1276152] [PID.2144]
[MD5.14AB31B4F673A3AF348A40B20BB2F587] - (...) -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe [70832] [PID.2220]
[MD5.1F3A8448323CFA5E66AF02B1EDC2EEE4] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe [19603048] [PID.552]
[MD5.FBAF93425D4B5A6C48ABB5B7F81088CD] - (.F-Secure Corporation - F-Secure Settings and Statistics.) -- C:\Program Files (x86)\Pack Sérénité\Sécurité\Common\FSM32.exe [201128] [PID.1512]
[MD5.D63797E8E7781EE1500A810CB6194FA6] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816] [PID.504]
[MD5.A9F9D081518AC03A51C1195986076F42] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392] [PID.1412]
[MD5.A63DC5C2EA944E6657203E0C8EDEAF61] - (.Microsoft Corporation - COM Surrogate.) -- C:\Windows\SysWOW64\DllHost.exe [7168] [PID.2228]
[MD5.5521928AA79079565B7CB8FCE6806131] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [825808] [PID.3952]
[MD5.E5A7EA8C5C063943231A071789956893] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [7667712] [PID.4424]
[MD5.4FE5C6D40664AE07BE5105874357D2ED] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [57008] [PID.1396]
[MD5.76B35CB0F3A4E69D6DFF27F542B9F856] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files (x86)\Google\Update\1.3.21.145\GoogleCrashHandler.exe [216968] [PID.2936]
[MD5.C97ECD94DD6F2562553304781C21F01D] - (.Valve Corporation - Steam Client Service (buildbot_winslave04_s.) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe [543656] [PID.3440]
~ Processes Running: Scanned in 00mn 00s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Utilisateur\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [bcfjehbfanfhgoehogmbiebedkidedjb] IMVU Inc v.10.16.4.17, (Désactivé)
G2 - GCE: Preference [User Data\Default] [fajfiabcfidbbaelfcficghfgheddefo] Jenny Holzer v.3 (Activé)
G2 - GCE: Preference [User Data\Default] [fcgdjaajoajmniboghkmkdeocpedheja] Flash Player v.11 (Activé)
G2 - GCE: Preference [User Data\Default] [kmgeophbbmfgkjghdgfgelpipdoclljo] LyricsSpeaker v.1.116 (Désactivé)
G2 - GCE: Preference [User Data\Default] [leahdjjpjmnamomgpojikeapflgbmjab] cacaoweb v.1.13 (Désactivé) =>PUP.CacaoWeb
G2 - GCE: Preference [User Data\Default] [niapdbllcanepiiimjjndipklodoedlc] Yontoo v.1.0.3 (Désactivé) =>Adware.Yontoo
~ Google Browser: 17 Legitimates Filtered in 00mn 22s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 19



---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: LyricsSpeaker [64Bits] - {15467C9F-3784-4109-89C9-6ED7100B96B8} . (.LyricsSpeaker LTD - LyricsSpeaker.) -- C:\Program Files (x86)\LyricsSpeaker\116.dll
~ BHO: 5 Legitimates Filtered in 00mn 00s



---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKCU\..\Run: [Sony PC Companion] . (.Sony - Sony PC Companion.) -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
O4 - HKCU\..\Run: [Steam] . (.Valve Corporation - Steam Client Bootstrapper (buildbot_winslav.) -- C:\Program Files (x86)\Steam\steam.exe
O4 - HKCU\..\Run: [Clownfish] . (.Bogdan Sharkov - Clownfish for Skype.) -- C:\Program Files (x86)\Clownfish\Clownfish.exe
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O4 - HKLM\..\Wow6432Node\Run: [F-Secure Manager] . (.F-Secure Corporation - F-Secure Settings and Statistics.) -- C:\Program Files (x86)\Pack Sérénité\Sécurité\Common\FSM32.exe
O4 - HKLM\..\Wow6432Node\Run: [F-Secure TNB] . (.F-Secure Corporation - TNBUtil.) -- C:\Program Files (x86)\Pack Sérénité\Sécurité\FSGUI\TNBUtil.exe
O4 - HKLM\..\Wow6432Node\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
O4 - HKLM\..\Wow6432Node\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [IsMyWinLockerReboot] . (.Microsoft Corporation - Installateur Windows®.) -- C:\Windows\System32\msiexec.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [IsMyWinLockerReboot] . (.Microsoft Corporation - Installateur Windows®.) -- C:\Windows\System32\msiexec.exe
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-20\..\RunOnce: [IsMyWinLockerReboot] . (.Microsoft Corporation - Installateur Windows®.) -- C:\Windows\System32\msiexec.exe
O4 - HKUS\S-1-5-21-3257015746-1317280491-3138929029-1001\..\Run: [Sony PC Companion] . (.Sony - Sony PC Companion.) -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
O4 - HKUS\S-1-5-21-3257015746-1317280491-3138929029-1001\..\Run: [Steam] . (.Valve Corporation - Steam Client Bootstrapper (buildbot_winslav.) -- C:\Program Files (x86)\Steam\steam.exe
O4 - HKUS\S-1-5-21-3257015746-1317280491-3138929029-1001\..\Run: [Clownfish] . (.Bogdan Sharkov - Clownfish for Skype.) -- C:\Program Files (x86)\Clownfish\Clownfish.exe
O4 - HKUS\S-1-5-21-3257015746-1317280491-3138929029-1001\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
~ Application: Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\TaskBar: Dragonica.lnk . (.Gravity Games - Dragonica Patcher.) -- C:\gPotato.eu\Dragonica\Patcher.exe
O4 - GS\TaskBar: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\TaskBar: Minecraft.lnk . (...) -- C:\Users\Utilisateur\Desktop\Minecraft.exe
O4 - GS\TaskBar: Mumble.lnk . (.Thorvald Natvig - Mumble - Low-latency VoIP client.) -- C:\Program Files (x86)\Mumble\mumble.exe
O4 - GS\TaskBar: PokeMMO - Raccourci.lnk . (...) -- C:\Users\Utilisateur\Desktop\PokeMMO\PokeMMO.exe
O4 - GS\TaskBar: Skype.lnk . (...) -- C:\Windows\Installer\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}\SkypeIcon.exe
O4 - GS\TaskBar: TeamSpeak 3 Client.lnk . (.TeamSpeak Systems GmbH - TeamSpeak 3 Client.) -- C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe
O4 - GS\TaskBar: Wow o.O.lnk . (.Blizzard Entertainment - World of Warcraft Retail.) -- C:\Program Files (x86)\World of Warcraft\Wow.exe
O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SendTo: Skype.lnk . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O4 - GS\Desktop: .minecraft - Raccourci.lnk . (...) -- C:\Users\Utilisateur\AppData\Roaming\.minecraft
O4 - GS\Desktop: Musique - Raccourci.lnk . (...) -- C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms
O4 - GS\Desktop: PokeMMO - Raccourci.lnk . (...) -- C:\Users\Utilisateur\Desktop\PokeMMO\PokeMMO.exe
O4 - GS\Desktop: realmlist - Raccourci.lnk . (...) -- C:\Program Files (x86)\World of Warcraft\Data\frFR\realmlist.wtf
O4 - Global Startup: C:\Users\Utilisateur\Desktop\Reprendre le téléchargement de League of Legends.url . (...) -- C:\Users\Utilisateur\Desktop\Reprendre le téléchargement de League of Legends.url
O4 - GS\Desktop: Téléchargements.lnk . (...) -- C:\Users\Utilisateur\Downloads
O4 - GS\Desktop: World of Warcraft.lnk . (.Blizzard Entertainment - World of Warcraft Retail.) -- C:\Program Files (x86)\World of Warcraft\Wow.exe
O4 - GS\Accessories: Private Character Editor.lnk . (.Microsoft Corporation - Éditeur de caractères privés.) -- C:\Windows\system32\eudcedit.exe
O4 - GS\Desktop: Clownfish.lnk . (.Bogdan Sharkov - Clownfish for Skype.) -- C:\Program Files (x86)\Clownfish\Clownfish.exe
O4 - GS\Desktop: Dofus2.lnk . (...) -- C:\Program Files (x86)\Dofus2\app\UpLauncher.exe
O4 - GS\Desktop: Installeur de World of Warcraft.lnk . (...) -- C:\Users\Public\Documents\Blizzard Entertainment\World of Warcraft Installer
O4 - GS\Desktop: SuperTux.lnk . (...) -- C:\Program Files (x86)\SuperTux\supertux.exe
~ Global Startup: Scanned in 00mn 00s



---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} ((no name)) - http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
~ Objets ActiveX: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{2839BEFA-CBCC-4DF2-BD81-73BF649FBC1D}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CCS\Services\Tcpip\..\{E92977B7-E17A-49D7-99A7-19ACA6A1451A}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{E92977B7-E17A-49D7-99A7-19ACA6A1451A}: DhcpDomain = lan
O17 - HKLM\System\CS1\Services\Tcpip\..\{2839BEFA-CBCC-4DF2-BD81-73BF649FBC1D}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CS1\Services\Tcpip\..\{E92977B7-E17A-49D7-99A7-19ACA6A1451A}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{E92977B7-E17A-49D7-99A7-19ACA6A1451A}: DhcpDomain = lan
O17 - HKLM\System\CS2\Services\Tcpip\..\{2839BEFA-CBCC-4DF2-BD81-73BF649FBC1D}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CS2\Services\Tcpip\..\{E92977B7-E17A-49D7-99A7-19ACA6A1451A}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{E92977B7-E17A-49D7-99A7-19ACA6A1451A}: DhcpDomain = lan
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - AppInit_DLLs: . (.NVIDIA Corporation - NVIDIA Compatible NVIDIA shim initializatio.) - C:\Windows\system32\nvinitx.dll
~ AppInit DLL: Scanned in 00mn 00s



---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\LyricsSpeaker Update.job [408]
[MD5.2DB572BA2FE303FB62944F371B5EEAF4] [APT] [LyricsSpeaker Update] (.LyricsSpeaker LTD.) -- C:\Program Files (x86)\LyricsSpeaker\LyricsUpd.exe [253440]
[MD5.00000000000000000000000000000000] [APT] [{0C3A2F73-92F5-44E8-B003-09ED9856D3EE}] (...) -- C:\Users\Utilisateur\AppData\Local\Temp\VSD5C1C.tmp\DotNetFx35Client\DotNetFx35ClientSetup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{3271B03F-93C0-4D7E-BDE2-175B756289C4}] (...) -- C:\Users\Utilisateur\AppData\Local\Temp\VSD91C8.tmp\DotNetFx35Client\DotNetFx35ClientSetup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{33A0F2CC-011D-4260-9C23-326BE1328A95}] (...) -- C:\Users\Utilisateur\Documents\Blizzard Entertainment\World of Warcraft Installer\Installer.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{37AAF67D-9656-488E-BA07-9FE76EE98784}] (...) -- C:\Users\Utilisateur\Downloads\InstallWoW (6).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{85D020A4-018D-477B-BFDC-DB1A27E7D010}] (...) -- C:\Users\Utilisateur\AppData\Local\Temp\VSDACB7.tmp\DotNetFx35Client\DotNetFx35ClientSetup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{9B517BAB-31D8-4A68-A9C2-ED5E597CAE9D}] (...) -- C:\Users\Utilisateur\AppData\Local\Temp\VSDBC54.tmp\DotNetFx35Client\DotNetFx35ClientSetup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{AF36370E-62A4-479A-A7ED-81819D89C1F5}] (...) -- C:\Users\Utilisateur\Desktop\Sonic Ether's Unbelievable Shaders v08 (Windows)\INSTALLER.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{AFB947F8-5CA5-44F4-989F-3417A052550D}] (...) -- C:\Users\Utilisateur\AppData\Local\Temp\VSDC0C8.tmp\DotNetFx35Client\DotNetFx35ClientSetup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{B1501477-4CDC-451C-B99D-79F1C2CFB150}] (...) -- C:\Users\Utilisateur\AppData\Local\Temp\VSD16A5.tmp\DotNetFx35Client\DotNetFx35ClientSetup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{D05ADA09-AC08-404D-ACDB-4C79ED1B3B5F}] (...) -- C:\Users\Utilisateur\AppData\Local\Temp\VSDD5BD.tmp\DotNetFx35Client\DotNetFx35ClientSetup.exe (.not file.) [0]
~ Scheduled Task: 35 Legitimates Filtered in 00mn 13s



---\\ Logiciels installés (O42)
O42 - Logiciel: LyricsSpeaker - (.LyricsSpeaker LTD.) [HKLM][64Bits] -- lspeaker@lyricsspeaker.net
O42 - Logiciel: Sauvegarde - (...) [HKLM][64Bits] -- adbackup5
O42 - Logiciel: SuperTux 0.1.3 - (.SuperTux Development Team.) [HKLM][64Bits] -- SuperTux_is1
~ Logic: 104 Legitimates Filtered in 00mn 01s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\AppDataLow\Software\LyricsSpeaker]
[HKCU\Software\Cipher Prime Studios, Inc.]
[HKCU\Software\DCUtility]
[HKCU\Software\L0pht Holdings LLC]
[HKCU\Software\PerformerSoft LLC]
[HKCU\Software\SweetIM] =>PUP.SweetIM
[HKCU\Software\darty_serenite]
[HKLM\Software\Wow6432Node\Darty]
[HKLM\Software\Wow6432Node\SweetIM] =>PUP.SweetIM
[HKLM\Software\Wow6432Node\Toribash]
[HKLM\Software\Wow6432Node\Visicom Media]
~ Key Software: 267 Legitimates Filtered in 00mn 01s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 07/07/2012 - 07:45:20 - [0,634] ----D C:\Program Files (x86)\Lock Folder XP
O43 - CFD: 04/07/2013 - 13:24:16 - [1,174] ----D C:\Program Files (x86)\LyricsSpeaker
O43 - CFD: 17/08/2012 - 18:20:23 - [815,374] ----D C:\Program Files (x86)\Pack Sérénité
O43 - CFD: 20/08/2012 - 12:16:32 - [424,912] ----D C:\Program Files (x86)\Splice
O43 - CFD: 10/02/2013 - 00:48:00 - [15,498] ----D C:\Program Files (x86)\SuperTux
O43 - CFD: 08/08/2012 - 13:27:05 - [0] ----D C:\Program Files (x86)\Visicom Media
O43 - CFD: 18/01/2012 - 10:19:39 - [0,163] ----D C:\ProgramData\Darty
O43 - CFD: 18/01/2012 - 10:19:39 - [0,007] ----D C:\Users\Utilisateur\AppData\Roaming\Darty
O43 - CFD: 29/08/2012 - 21:43:27 - [0] ----D C:\Users\Utilisateur\AppData\Roaming\Toribash
~ 65 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 268 Legitimates Filtered in 00mn 29s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.54F3B4FF66E3EE96044F1E5A79F41857] - 06/07/2013 - 10:10:43 ---A- . (...) -- C:\UsbFix [Clean 4] UTILISATEUR-PC.txt [10861]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 06/07/2013 - 10:10:34 ---A- . (...) -- C:\Upload_UsbFix.zip [1819254061]
O44 - LFC:[MD5.FCE448EDBCE9A4CFDFC028DD94BB0A44] - 06/07/2013 - 10:02:11 ----- . (...) -- C:\UsbFix [Clean 3] UTILISATEUR-PC.txt [5527]
O44 - LFC:[MD5.D08A87C3B7BC272769DA960AE8764E8D] - 06/07/2013 - 09:58:57 ----- . (...) -- C:\UsbFix [Clean 2] UTILISATEUR-PC.txt [3440]
~ Files: 22 Legitimates Filtered in 00mn 04s



---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.0F2D823A378A7043C7861733D6982F5D] - 01/07/2013 - 13:10:50 ---A- - C:\Windows\Prefetch\SCS.EXE-A573F778.pf
O45 - LFCP:[MD5.4322AE558A9D4DF2531912510E1EA504] - 02/07/2013 - 15:09:07 ---A- - C:\Windows\Prefetch\PATCHERPATCH.EXE-85D2F335.pf
O45 - LFCP:[MD5.16E5231A9B412A658528531B1E8E4716] - 02/07/2013 - 15:09:18 ---A- - C:\Windows\Prefetch\PATCHER.EXE-1AEB695D.pf
O45 - LFCP:[MD5.CA0EC370E7EF79D8E60677467C94AECB] - 02/07/2013 - 18:48:51 ---A- - C:\Windows\Prefetch\LEAGUEOFLEGENDS.EXE-0B412B95.pf
O45 - LFCP:[MD5.DB0CDE61CB966511B188F932D08F0D16] - 02/07/2013 - 18:48:53 ---A- - C:\Windows\Prefetch\PMB.EXE-B9083A8E.pf
O45 - LFCP:[MD5.3765F0BEF451F1164EBE5653829F8041] - 04/07/2013 - 12:30:07 ---A- - C:\Windows\Prefetch\CFSETUP330 (1).EXE-316BB5AA.pf
O45 - LFCP:[MD5.2ED854857B9C4593FA3745435E7D4CB7] - 04/07/2013 - 14:21:08 ---A- - C:\Windows\Prefetch\UNINST.EXE-8DC59180.pf
O45 - LFCP:[MD5.F10A79E0B04C4D868A052E525FE24017] - 04/07/2013 - 14:25:46 ---A- - C:\Windows\Prefetch\27.0.1453.116_CHROME_INSTALLE-8D8E7600.pf
O45 - LFCP:[MD5.84F7B6CB2E9CFEB4BB39A33C5BBE9B90] - 04/07/2013 - 14:32:16 ---A- - C:\Windows\Prefetch\POKEMMO.EXE-BD3012CF.pf
O45 - LFCP:[MD5.5FFA31EB309B21462FF3AC2CB7764837] - 04/07/2013 - 19:28:35 ---A- - C:\Windows\Prefetch\INSTALLIMVU_488.0_ST.EXE-A6829BDB.pf
O45 - LFCP:[MD5.82A5DE89EA223647DB374ADE89D4B3D7] - 04/07/2013 - 19:30:28 ---A- - C:\Windows\Prefetch\NSQ631B.TMP-FE6FD714.pf
O45 - LFCP:[MD5.99A80EF4C109C29884DE5CF881DF8D4E] - 04/07/2013 - 19:30:46 ---A- - C:\Windows\Prefetch\MISM.EXE-EDDF5111.pf
O45 - LFCP:[MD5.A3E90ADBE2F79C469A831866AE359D61] - 04/07/2013 - 19:32:48 ---A- - C:\Windows\Prefetch\MCONDUITINSTALLER.EXE-203A27A8.pf
O45 - LFCP:[MD5.A81062505954DCAE550696D36C2F7BAC] - 04/07/2013 - 19:32:49 ---A- - C:\Windows\Prefetch\STUB.EXE-797D9980.pf
O45 - LFCP:[MD5.2013C4A749CEF64237F7D18634670B9F] - 04/07/2013 - 19:33:30 ---A- - C:\Windows\Prefetch\CTBE.EXE-C1B33AB8.pf
O45 - LFCP:[MD5.31FA53B8ABC51D31EDFFB7DA4EE7BB30] - 04/07/2013 - 19:33:48 ---A- - C:\Windows\Prefetch\DEVICEFINGERPRINT.EXE-2B3A8A19.pf
O45 - LFCP:[MD5.2907AA3CA56EC66B8F3BDC8F6935C3B2] - 30/06/2013 - 21:02:30 ---A- - C:\Windows\Prefetch\GTA_SA.EXE-ED4CCC9A.pf
~ Prefetcher: 140 Legitimates Filtered in 00mn 00s



---\\ ShareTools MSconfig StartupReg (O53)
O53 - SMSR:HKLM\...\startupreg\Dolby Advanced Audio v2 [Key] . (.Dolby Laboratories Inc. - Dolby Profile Selector.) -- C:\Dolby PCEE4\pcee4.exe
O53 - SMSR:HKLM\...\startupreg\Free Hide IP [Key] . (...) -- C:\Program Files (x86)\FreeHideIP\FreeHideIP.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\ProfilerU [Key] . (.Saitek - Saitek SST Profile Launcher.) -- C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
O53 - SMSR:HKLM\...\startupreg\SaiMfd [Key] . (.Saitek - Saitek MFD File System Driver.) -- C:\Program Files\Saitek\SD6\Software\SaiMfd.exe
O53 - SMSR:HKLM\...\startupreg\SearchSettings [Key] . (...) -- C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (.not file.) =>Adware.SearchSettings
O53 - SMSR:HKLM\...\startupreg\SweetIM [Key] . (...) -- C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe (.not file.) =>PUP.SweetIM
O53 - SMSR:HKLM\...\startupreg\Sweetpacks Communicator [Key] . (...) -- C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe (.not file.) =>PUP.SweetIM
~ SMSR Keys: 23 Legitimates Filtered in 00mn 00s



---\\ Microsoft Windows Policies System (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s



---\\ Microsoft Windows Policies Explorer (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 7 Legitimates Filtered in 00mn 00s



---\\ Liste des Drivers Système (O58)
O58 - SDL:[MD5.2F6B34B83843F0C5118B63AC634F5BF4] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [491088]
O58 - SDL:[MD5.1E6438D4EA6E1174A3B3B1EDC4DE660B] - 18/03/2009 - 16:35:42 --HA- . (.LogMeIn, Inc. - Hamachi Virtual Network Interface Driver.) -- C:\Windows\System32\hamachi.sys [33856]
O58 - SDL:[MD5.9131FE60ADFAB595C8DA53AD6A06AA31] - 04/01/2005 - 01:43:08 ---A- . (.INCA Internet Co., Ltd. - nProtect NPSC Kernel Mode Driver for NT.) -- C:\Windows\SysWOW64\npptNT2.sys [4682]
~ Drivers: Scanned in 00mn 00s



---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 04/07/2013 - 12:27:08 ---A- C:\Users\Utilisateur\Downloads\CFSetup330.exe [669024]
O61 - LFC: 04/07/2013 - 12:29:55 ---A- C:\Users\Utilisateur\Downloads\CFSetup330 (1).exe [669024]
O61 - LFC: 04/07/2013 - 14:09:51 ---A- C:\Users\Utilisateur\Documents\favoris_04_07_13.html [491119]
O61 - LFC: 04/07/2013 - 14:25:51 ---A- C:\Users\Utilisateur\AppData\Local\Google\Chrome\User Data\Local State~RF704f1b.TMP [1552]
O61 - LFC: 04/07/2013 - 14:25:52 ---A- C:\Users\Utilisateur\AppData\Local\Google\Chrome\User Data\First Run [0]
O61 - LFC: 04/07/2013 - 16:47:36 ---A- C:\Users\Utilisateur\AppData\Local\CRE\bcfjehbfanfhgoehogmbiebedkidedjb.crx [2776061]
O61 - LFC: 04/07/2013 - 19:28:13 ---A- C:\Users\Utilisateur\Downloads\InstallIMVU_488.0_st.exe [78944]
O61 - LFC: 04/07/2013 - 20:35:26 ---A- C:\Users\Utilisateur\Downloads\GODF_Wingmen_Alpha_Preview.rar [52871168]
O61 - LFC: 04/07/2013 - 20:35:28 ---A- C:\Users\Utilisateur\Downloads\iwbtgbeta(slomo).exe [72133492]
O61 - LFC: 05/07/2013 - 12:29:55 ---A- C:\Users\Utilisateur\Downloads\X-RayMod_v041.zip [65954]
O61 - LFC: 05/07/2013 - 23:42:59 ---A- C:\Users\Utilisateur\Downloads\X-RayMod_v041 (1).zip [65954]
O61 - LFC: 05/07/2013 - 23:43:56 ---A- C:\Users\Utilisateur\Downloads\X-RayMod_v041 (2).zip [65954]
O61 - LFC: 06/07/2013 - 07:29:01 ---A- C:\Users\Utilisateur\Downloads\adwcleaner.exe [650027]
O61 - LFC: 06/07/2013 - 09:53:05 ---A- C:\Users\Utilisateur\Downloads\usbfix.exe [1030081]
O61 - LFC: 06/07/2013 - 10:17:12 ---A- C:\Users\Utilisateur\AppData\Local\Google\Chrome\User Data\Certificate Revocation Lists [266527]
O61 - LFC: 06/07/2013 - 11:28:46 ---A- C:\Users\Utilisateur\Downloads\RogueKiller.exe [915456]
O61 - LFC: 06/07/2013 - 12:33:18 ---A- C:\Users\Utilisateur\Downloads\mbam-setup-1.75.0.1300.exe [10285040]
O61 - LFC: 06/07/2013 - 15:03:23 ---A- C:\Users\Utilisateur\AppData\Local\Google\Chrome\User Data\Local State [38451]
~ 12 Fichiers temporaires (Temporary files)
~ Files: 1329 Legitimates Filtered in 00mn 25s



---\\ Liste des outils de nettoyage (O63)
O63 - Logiciel: UsbFix By El Desaparecido - (.El Desaparecido - SosVirus.net.) [HKLM] -- Usbfix
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
~ ADS: Scanned in 00mn 00s



---\\ File Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 19 Legitimates Filtered in 00mn 00s



---\\ Start Menu Internet (O68)
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s



---\\ Search Browser Infection (O69)
O69 - SBI: SearchScopes [HKCU] ${searchCLSID} - (@ieframe.dll,-12512) - https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8
O69 - SBI: SearchScopes [HKCU] {736D64A4-E358-460D-8A32-6492CFD8E244} - (Yahoo! Search) - https://search.yahoo.com/
O69 - SBI: SearchScopes [HKCU] {F8AAE699-2218-4CE4-B35A-258186A8E4A4} - (Ask Search) - http://www.search.ask.com/?o=10148&l=dis
~ Keys: Scanned in 00mn 00s



---\\ Recherche particuliere à la racine de certains dossiers (O84)
[MD5.605A171C61A0607BDCF6BE80ED07CF95] [SPRF][12/12/2012] (.AnjoCaido - Free launcher for Minecraft Alpha.) -- C:\Users\Utilisateur\Desktop\Minecraft Cracké.exe [695296]
[MD5.3389F0C8717E7438BFB0B03498756F27] [SPRF][05/07/2013] (...) -- C:\Users\Utilisateur\Desktop\Minecraft.exe [484992]
[MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][04/05/2013] (...) -- C:\Program Files (x86)\Dragonica_FR_Phoenix_20120720-1a.bin [1565406080]
[MD5.90575727487AF16475BD34D0704C0C68] [SPRF][05/05/2013] (...) -- C:\Program Files (x86)\Dragonica_FR_Phoenix_20120720-1b.bin [1147174126]
[MD5.64D3AC1C82CC4F25890D09439594F3E3] [SPRF][05/05/2013] (.Gala Networks Europe Ltd. - Dragonica Setup.) -- C:\Program Files (x86)\Dragonica_FR_Phoenix_20120720.exe [599344]
[MD5.9E0711BED229B60A853BCC5D10DEAAFC] [SPRF][02/06/2010] (.Microsoft Corporation - Direct driver preloader.) -- C:\Program Files (x86)\DSETUP.dll [89944]
[MD5.0F58CCD58A29827B5D406874360E4C08] [SPRF][02/06/2010] (...) -- C:\Program Files (x86)\dsetup32.dll [1801048]
[MD5.DDCE338BB173B32024679D61FB4F2BA6] [SPRF][02/06/2010] (...) -- C:\Program Files (x86)\DXSETUP.exe [537432]
~ Files: Scanned in 00mn 21s



---\\ Firewall Active Exception List (FirewallRules) (O87)
O87 - FAEL: "{37D5EDC0-5DAE-4B5A-ACC3-8AFD968B52D2}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe (.not file.) =>PUP.SweetIM
O87 - FAEL: "{4AED50F0-69E0-4B69-8B5D-F9F60AEC9BEC}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe (.not file.) =>PUP.SweetIM
O87 - FAEL: "{20F4F275-2CB6-413E-B39E-3731A09E8BE1}" |In - None - P17 - TRUE | .(...) -- c:\BrickForce\BfLauncher.exe (.not file.)
O87 - FAEL: "{857E5A04-00E4-42CA-9C0B-19FEFEAA3DD2}" |In - None - P17 - TRUE | .(...) -- c:\BrickForce\BrickForce.exe (.not file.)
~ Firewall: 217 Legitimates Filtered in 00mn 01s



---\\ Scan Additionnel (O88)
Database Version : v2.12676 - (05/07/2013)
Clés trouvées (Keys found) : 26
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 1

[HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASMANCS] =>Toolbar.Bing
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E] =>Toolbar.Ask
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\SearchSettings] =>PUP.Dealio
[HKCU\Software\SweetIM] =>PUP.SweetIM
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\SweetIM] =>PUP.SweetIM
[HKLM\Software\Wow6432Node\SweetIM] =>PUP.SweetIM
[HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASAPI32] =>Toolbar.Bing
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375] =>Toolbar.Agent
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5] =>Toolbar.Agent
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\00E944CB89111313EAF35A0553F547F9] =>PUP.Dealio
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\53F55AF3F4049ED3FA6EA6F88E414E24] =>PUP.Dealio
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E4BF4B11615E03C97732FD581AB607] =>PUP.Dealio
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CE3DDAB2D152683FBCEB4866BCD2B0F] =>PUP.Dealio
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF6CE16AFEA5C9A39B766468A8B35C21] =>PUP.Dealio
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FB1E44269B58F433A8C8E671E37CFDCF] =>PUP.Dealio
C:\Users\Utilisateur\Downloads\cacaoweb.exe =>PUP.CacaoWeb
~ Additionnel Scan: 269080 Items scanned in 01mn 14s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 12/06/2013 256904 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 21/12/2012 57008 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 30/08/2011 462184 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SS - | Disabled 01/07/2011 353360 | (DsiWMIService) . (.Dritek System Inc..) - C:\Program Files (x86)\Launch Manager\dsiwmis.exe
SS - | Disabled 10/05/2011 872552 | (ePowerSvc) . (.Acer Incorporated.) - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
SS - | Disabled 07/09/2011 655624 | (FLEXnet Licensing Service) . (.Acresso Software Inc..) - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
SS - | Demand 18/11/2009 846248 | (FSDFWD) . (.F-Secure Corporation.) - C:\Program Files (x86)\Pack Sérénité\Sécurité\FWES\Program\fsdfwd.exe
SS - | Disabled 18/11/2009 188840 | (FSMA) . (.F-Secure Corporation.) - C:\Program Files (x86)\Pack Sérénité\Sécurité\Common\FSMA32.exe
SS - | Demand 18/11/2009 57768 | (FSORSPClient) . (.F-Secure Corporation.) - C:\Program Files (x86)\Pack Sérénité\Sécurité\ORSP Client\fsorsp.exe
SS - | Disabled 26/05/2011 29696 | (GREGService) . (.Acer Incorporated.) - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
SS - | Auto 16/04/2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 16/04/2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Disabled 30/04/2011 13592 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
SR - | Demand 31/05/2013 641352 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SS - | Demand 0 | (LcAgent) . (...) - C:\Windows\Temp\lcagent.exe
SS - | Disabled 22/04/2011 244624 | (Live Updater Service) . (.Acer Incorporated.) - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
SS - | Disabled 01/02/2011 326168 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
SS - | Auto 0 | (McAfee SiteAdvisor Service) . (...) - C:\Program Files (x86)\mcafee\SITEAD~1\mcsacore.exe
SS - | Demand ??\??\???? 0 | (npggsvc) . (.INCA Internet Co., Ltd..) - C:\Windows\system32\GameMon.des
SS - | Disabled 05/01/2012 256536 | (NTI IScheduleSvc) . (.NTI Corporation.) - C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
SS - | Disabled 31/03/2011 993896 | (NVSvc) . (.NVIDIA Corporation.) - C:\Windows\System32\nvvsvc.exe
SS - | Disabled 30/03/2011 2009704 | (nvUpdatusService) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
SS - | Demand 06/11/2007 92792 | (rpcapd) . (.CACE Technologies.) - C:\Program Files (x86)\WinPcap\rpcapd.exe
SS - | Auto 03/06/2013 162408 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Demand 04/02/2013 155824 | (Sony PC Companion) . (.Avanquest Software.) - C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe
SR - | Demand 06/06/2013 543656 | (Steam Client Service) . (.Valve Corporation.) - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
SS - | Disabled 29/11/2010 149504 | (TurboBoost) . (.Intel(R) Corporation.) - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
SS - | Disabled 01/02/2011 2656280 | (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 02s



---\\ Recherche Master Boot Record Infection (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by Utilisateur at 06/07/2013 16:07:29

device: opened successfully
user: error reading MBR

Disk trace:
error: Read Descripteur non valide
kernel: error reading MBR
~ MBR: 9 Legitimates Filtered in 00mn 02s



---\\ Recherche Master Boot Record Infection (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Utilisateur at 06/07/2013 16:07:31

********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 04s



---\\ Malicius Software Information
~ http://nicolascoolman.webs.com/apps/blog/show/27566847-pup-cacaoweb =>PUP.CacaoWeb
~ http://nicolascoolman.webs.com/apps/blog/show/26811836-adware-yontoo =>Adware.Yontoo
~ http://nicolascoolman.webs.com/apps/blog/show/29216159-pup-sweetim =>PUP.SweetIM
~ http://nicolascoolman.webs.com/apps/blog/show/27529295-adware-searchsettings =>Adware.SearchSettings
~ http://nicolascoolman.webs.com/apps/blog/show/28927746-toolbar-ask =>Toolbar.Ask
~ http://nicolascoolman.webs.com/apps/blog/show/27443462-pup-dealio =>PUP.Dealio
~ MSI: 6 link(s) detected in 00mn 04s



~ 3056 Legitimates filtered by white list
End of the scan (578 lines in 05mn 48s)(0)

Re, voici le lien cjoin : https://www.cjoint.com/c/CGgv3aLxSV5

J'ai fais tout ce que tu m'as dit.

Et bien là, je reçois toujours les pubs..
Au pire, je peux prendre un screen.

Bonsoir,

Pour suivre le sujet.

https://www.cjoint.com/c/CGhq5MtCu7D

Re, voici le rapport : https://www.cjoint.com/c/CGibM5LJTZf

Tu penses que j'aurais bientôt réglé mon problème ? Car ça fait long là. x)