analyse rapport ZHPdiag Fermé

Question

Bonjour, j'aurais besoin de votre qaide pour analyser mon rapport ZHPdiag et supprimer les virus que je encontre sur mon PC Rapport de ZHPDiag v2013.7.5.7 par Nicolas Coolman, Update du 05/07/2013 Run by emachines at 06/07/2013 19:41:50 WebSite: https://nicolascoolman.webs.com/ State : Version à jour. WhiteList : Enable High Elevated Privileges : OK UAC : Activate by user ---\ Web Browser MSIE: Internet Explorer v10.0.9200.16618 GCIE: Google Chrome v26.0.1410.64 (Defaut) ---\ Windows Product Information ~ Langage: Français Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601) Windows Server License Manager Script : OK ~ Windows(R) 7, OEM_SLP channel System Locked Preinstallation (OEM_SLP) : OK Windows ID Activation : OK ~ Windows Partial Key : 7QJB7 Windows License : OK ~ Windows Remaining Initializations Number : 3 Software Protection Service (Protection logicielle) : OK Windows Automatic Updates : OK Windows Activation Technologies : OK ---\ System Protection Microsoft Security Client v4.2.0223.1 Windows Defender W7 ---\ System Optimizer CCleaner v4.02 =>Piriform Ltd ---\ Peer To Peer (P2P) ---\ Software Update Adobe Flash Player 11 ActiveX Adobe Reader 9.5.5 MUI Java 7 Update 21 ---\ System Information ~ Processor: Intel64 Family 6 Model 28 Stepping 10, GenuineIntel ~ Operating System: 64 Bits Boot mode: Normal (Normal boot) Total RAM: 2046 MB (28% free) System Restore: Activé (Enable) System drive C: has 179 GB (81%) free of 220 GB ---\ Logged in mode ~ Computer Name: EMACHINES-PC ~ User Name: emachines ~ All Users Names: UpdatusUser, emachines, Administrateur, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\ Environnement Variables ~ System Unit : C:\ ~ %AppData% : C:\Users\emachines\AppData\Roaming\ ~ %Desktop% : C:\Users\emachines\Desktop\ ~ %Favorites% : C:\Users\emachines\Favorites\ ~ %LocalAppData% : C:\Users\emachines\AppData\Local\ ~ %StartMenu% : C:\Users\emachines\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\ DOS/Devices C:\ Hard drive, Flash drive, Thumb drive (Free 179 Go of 220 Go) D:\ CD-ROM drive (Free 3 Go of 4 Go) ---\ Security Center & Tools Informations [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date ~ Security Center: 37 Legitimates Filtered in 00mn 00s ---\ Recherche particulière de fichiers génériques [MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808] [MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024] [MD5.12716D987D475B051F35895659159705] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.17/05/2013 - 01:59:03.) -- C:\Windows\System32\wininet.dll [2241024] [MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656] [MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448] [MD5.1C7857B62DE5994A75B054A9FD4C3825] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/12/2011 - 04:59:24.) -- C:\Windows\system32\Drivers\AFD.sys [498688] [MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128] [MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160] [MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456] [MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400] [MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368] [MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472] [MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224] [MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208] [MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers etBT.sys [261632] [MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers tfs.sys [1656680] [MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280] [MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536] [MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184] [MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers dx.sys [119296] [MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808] ~ Generic Processes: Scanned in 00mn 01s ---\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 1/248 ~ Mes Favoris (My Favorites) : 1/31 ~ Mes Documents (My Documents) : 1/37 ~ Mon Bureau (My Desktop) : 1/187 ~ Menu demarrer (Programs) : 1/26 ~ Hidden Files: Scanned in 00mn 02s ---\ Processus lancés [MD5.2DC64A3446C8C6E020E781456B46573D] - (.Microsoft Corporation - Tablet PC Input Panel Helper.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe [10240] [PID.2036] [MD5.D1930CA970D4250D891F432419E3D6C9] - (.Intel Corporation - Event Monitor User Notification Tool.) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe [186904] [PID.2288] [MD5.6E95474CB9E22BC9768EFA176C6A0A29] - (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208] [PID.2704] [MD5.C1F58BA7D8D663274665E813EF733B53] - (.TreeCardGames.com - SolSuite.) -- C:\Users\emachines\Documents\123\SolSuite.exe [4734464] [PID.2940] [MD5.58D914B40F0DE43A16BB34091A0FE0AC] - (.Mozilla Corporation - Thunderbird.) -- C:\Program Files (x86)\Mozilla Thunderbird hunderbird.exe [389016] [PID.2980] [MD5.C1DB9BDF885C2F1ADC15264FBEA2788F] - (.Pas de propriétaire - HOSTS Anti-PUPs/Adwares.) -- C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe [302961] [PID.2784] [MD5.4E9592BB2C100E571F82640E59E9ECD5] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1312720] [PID.3264] [MD5.E5A7EA8C5C063943231A071789956893] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [7667712] [PID.3108] [MD5.F0359F7CE712D69ACEF0886BDB4792ED] - (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision vSCPAPISvr.exe [382824] [PID.856] [MD5.816FD5A6F3C2F3D600900096632FC60E] - (.Acer Incorporated - Global Registration Service.) -- C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe [1150496] [PID.1876] [MD5.506708142BC63DABA64F2D3AD1DCD5BF] - (.Google Inc. - Programme d'installation de Google.) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [116648] [PID.2152] [MD5.2960400094498DAE47B36173286D76A0] - (.Pas de propriétaire - Updater.) -- C:\ProgramData\BetterSoft\OptimizerPro\OptimizerPro.exe [348160] [PID.2428] =>PUP.OptimizerPro [MD5.F9EC9ACD504D823D9B9CA98A4F8D3CA2] - (.Acer Group - Updater Service.) -- C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe [243232] [PID.1040] [MD5.660BF3255A1EB18ED803FD2FBA6AE400] - (.Intel Corporation - RAID Monitor.) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe [354840] [PID.2488] [MD5.84E035225474E48CD3A6A3CE52332095] - (.NVIDIA Corporation - NVIDIA Settings Update Manager.) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [1258856] [PID.3980] ~ Processes Running: Scanned in 00mn 24s ---\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2) C:\Users\emachines\AppData\Local\Google\Chrome\User Data\Default\Preferences ~ Google Browser: 0 Legitimates Filtered in 00mn 01s ---\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4) R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.searchgol.com/ R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.acer-group.com/selection.html ~ IE Browser: 16 Legitimates Filtered in 00mn 00s ---\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe ~ Keys: Scanned in 00mn 00s ---\ Redirection du fichier Hosts (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 24s ~ Nombre de lignes (Lines number): 19861 ---\ Browser Helper Objects de navigateur (O2) O2 - BHO: ccoonTiinUeetyosave [64Bits] - {7081218F-1AF8-DCD5-8DDB-41D3001FB1A8} . (...) -- C:\ProgramData\ccoonTiinUeetyosave\51b8980123afb.dll =>PUP.OfferWare ~ BHO: 7 Legitimates Filtered in 00mn 01s ---\ Applications démarrées par registre & par dossier (O4) O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe O4 - HKLM\..\Run: [IAAnotif] . (.Intel Corporation - Event Monitor User Notification Tool.) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe O4 - HKCU\..\Run: [HP Deskjet 3050A J611 series (NET)] . (.Hewlett-Packard Co. - ScanToPCActivationApp.) -- C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe O4 - HKLM\..\Wow6432Node\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe O4 - HKLM\..\Wow6432Node\Run: [IdeaCom Calibration] . (.IdeaCom Technology Inc. - ByPass UAC caller.) -- C:\Program Files (x86)\IdeaCom\IDCMgr\StartUT.exe O4 - HKLM\..\Wow6432Node\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe O4 - HKLM\..\Wow6432Node\Run: [HOSTS Anti-Adware_PUPs] . (.Pas de propriétaire - HOSTS Anti-PUPs/Adwares.) -- C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe O4 - HKUS\S-1-5-21-677196848-1908659845-702874315-1001\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe O4 - HKUS\S-1-5-21-677196848-1908659845-702874315-1001\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe O4 - HKUS\S-1-5-21-677196848-1908659845-702874315-1001\..\RunOnce: [ScrSav] . (.Pas de propriétaire - run_NB Application.) -- C:\Program Files (x86)\eMachines\Screensaver un_eMachines.exe ~ Application: Scanned in 00mn 01s ---\ Autres liens utilisateurs (O4) O4 - GS\Accessories: Private Character Editor.lnk . (.Microsoft Corporation - Éditeur de caractères privés.) -- C:\Windows\system32\eudcedit.exe O4 - GS\SendTo: Fax Recipient.lnk . (.Microsoft Corporation - Microsoft Windows Fax and Scan.) -- C:\Windows\system32\WFS.exe O4 - GS\TaskBar: Adobe Reader 9.lnk . (...) -- C:\Windows\Installer\{AC76BA86-7AD7-FFFF-7B44-A91000000001}\SC_Reader.ico O4 - GS\TaskBar: CyberLink PowerDVD 9.lnk . (.CyberLink Corp. - PDVDLaunchPolicy Application.) -- C:\Program Files (x86)\CyberLink\PowerDVD9\PDVDLaunchPolicy.exe O4 - GS\TaskBar: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe O4 - GS\TaskBar: HP Deskjet 3050A J611 series.lnk . (...) -- C:\Program Files (x86)\HP\HP Deskjet 3050A J611 series\Bin\HP Deskjet 3050A J611 series.exe (.not file.) O4 - GS\TaskBar: Microsoft Office Word 2007.lnk . (...) -- C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\wordicon.exe O4 - GS\TaskBar: Mozilla Thunderbird.lnk . (.Mozilla Corporation - Thunderbird.) -- C:\Program Files (x86)\Mozilla Thunderbird hunderbird.exe O4 - GS\TaskBar: SolSuite - Raccourci.lnk . (.TreeCardGames.com - SolSuite.) -- C:\Users\emachines\Documents\123\SolSuite.exe O4 - GS\TaskBar: Welcome Center.lnk . (.Acer Incorporated - Welcome Center.) -- C:\Program Files (x86)\eMachines\Welcome Center\OEMWelcomeCenter.exe O4 - GS\TaskBar: Windows Explorer.lnk . (.Microsoft Corporation - Explorateur Windows.) -- C:\Windows\explorer.exe O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\QuickLaunch: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\QuickLaunch: Light Image Resizer 4.lnk . (.ObviousIdea SARL - ImageResizer.) -- C:\Program Files (x86)\ObviousIdea\Image Resizer 4\Resize.exe O4 - GS\QuickLaunch: Mozilla Thunderbird.lnk . (.Mozilla Corporation - Thunderbird.) -- C:\Program Files (x86)\Mozilla Thunderbird hunderbird.exe O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\SendTo: Skype.lnk . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O4 - Global Startup: C:\Users\emachines\Desktop\AnnuaireBtoB.url . (...) -- C:\Users\emachines\Desktop\AnnuaireBtoB.url O4 - Global Startup: C:\Users\emachines\Desktop\année 60 70.url . (...) -- C:\Users\emachines\Desktop\année 60 70.url O4 - Global Startup: C:\Users\emachines\Desktop\enchèrespubliques.url . (...) -- C:\Users\emachines\Desktop\enchèrespubliques.url O4 - GS\Desktop: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe O4 - Global Startup: C:\Users\emachines\Desktop\interenchères.url . (.Google Inc. - Google Chrome.) -- C:\Users\emachines\Desktop\interenchères.url O4 - GS\Desktop: Light Image Resizer 4.lnk . (.ObviousIdea SARL - ImageResizer.) -- C:\Program Files (x86)\ObviousIdea\Image Resizer 4\Resize.exe O4 - Global Startup: C:\Users\emachines\Desktop oticeellypse600.url . (...) -- C:\Users\emachines\Desktop oticeellypse600.url O4 - Global Startup: C:\Users\emachines\Desktop\PNEU TIRENDO.url . (...) -- C:\Users\emachines\Desktop\PNEU TIRENDO.url O4 - Global Startup: C:\Users\emachines\Desktop\priceminister.url . (...) -- C:\Users\emachines\Desktop\priceminister.url O4 - GS\Desktop: Revo Uninstaller.lnk . (.VS Revo Group - Revo Uninstaller.) -- C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe O4 - Global Startup: C:\Users\emachines\Desktop\Référence CAAV.jpg.lnk.jpg . (...) -- C:\Users\emachines\Desktop\Référence CAAV.jpg.lnk.jpg O4 - Global Startup: C:\Users\emachines\Desktop\ZS Espagne occasion.url . (...) -- C:\Users\emachines\Desktop\ZS Espagne occasion.url ~ Global Startup: Scanned in 00mn 08s ---\ Objets ActiveX (Downloaded Program Files)(O16) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} ((no name)) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab ~ Objets ActiveX: Scanned in 00mn 00s ---\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{E4D53222-F472-4EC9-83F5-7D92E4C2B6C2}: DhcpNameServer = 192.168.1.254 O17 - HKLM\System\CS1\Services\Tcpip\..\{E4D53222-F472-4EC9-83F5-7D92E4C2B6C2}: DhcpNameServer = 192.168.1.254 O17 - HKLM\System\CS2\Services\Tcpip\..\{E4D53222-F472-4EC9-83F5-7D92E4C2B6C2}: DhcpNameServer = 192.168.1.254 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 ~ Domain: Scanned in 00mn 00s ---\ Protocole additionnel (O18) O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) -- O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll ~ Protocole Additionnel: Scanned in 00mn 00s ---\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: IDCSRV Service (IdcSrv) . (.IdeaCom Technology Inc. - IdeaCom Touch Screen Controller Service.) - C:\Program Files (x86)\IdeaCom\IDCMgr\IdcSrv.exe O23 - Service: Updater Service (Updater Service) . (.Acer Group - Updater Service.) - C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe ~ Services: 10 Legitimates Filtered in 00mn 49s ---\ Tâches planifiées en automatique (O39) O39 - APT:Automatic Planified Task - C:\Windows\Tasks\schedule!3036567561.job [424] [MD5.2960400094498DAE47B36173286D76A0] [APT] [schedule!3036567561] (...) -- C:\ProgramData\BetterSoft\OptimizerPro\OptimizerPro.exe [348160] =>PUP.OptimizerPro [MD5.00000000000000000000000000000000] [APT] [{10163511-1644-420A-8443-B2450944BBF7}] (...) -- C:\Users\emachines\Downloads\SmartST_Moov200_v5_65_0027 (2).exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [{DE25BBDC-5FE1-4296-99E8-B4373636578B}] (...) -- C:\Users\emachines\Downloads\SpyHunter-Installer (1).exe (.not file.) [0] =>Crapware.SpyHunter ~ Scheduled Task: 17 Legitimates Filtered in 00mn 12s ---\ Logiciels installés (O42) O42 - Logiciel: ContinueToSave 1.74 - (...) [HKLM][64Bits] -- SP_e14dcdfa =>PUP.Offerware O42 - Logiciel: OptimizerPro - (.BetterSoft.) [HKLM][64Bits] -- OptimizerPro =>PUP.OptimizerPro O42 - Logiciel: ccoonTiinUeetyosave - (.continue to save.) [HKLM][64Bits] -- {C1C6816E-CBB3-A748-85F9-A8B47B68985B} =>PUP.OfferWare ~ Logic: 107 Legitimates Filtered in 00mn 02s ---\ HKCU & HKLM Software Keys [HKCU\Software\AppDataLow\SProtector] =>PUP.Mocaflix [HKCU\Software\Duuqu] =>Toolbar.DeltaSearch [HKLM\Software\Wow6432Node\Duuqu] =>Toolbar.DeltaSearch [HKLM\Software\Wow6432Node\Iminent] =>Adware.IMBooster [HKLM\Software\Wow6432Node\SP Global] =>PUP.AdvancedSystemProtector [HKLM\Software\Wow6432Node\SProtector] =>PUP.Mocaflix ~ Key Software: 178 Legitimates Filtered in 00mn 02s ---\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 12/06/2013 - 17:45:39 - [1,473] ----D C:\Program Files (x86)\ContinueToSave =>PUP.Offerware O43 - CFD: 27/06/2013 - 17:16:11 - [0,191] ----D C:\ProgramData\ccoonTiinUeetyosave =>PUP.OfferWare O43 - CFD: 12/06/2013 - 17:47:01 - [2,169] ----D C:\ProgramData\InstallMate O43 - CFD: 22/05/2013 - 13:09:43 - [0] ----D C:\ProgramData\StarApp ~ Program Folder: 151 Legitimates Filtered in 00mn 16s ---\ Microsoft Windows Policies System (O55) O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 ~ MWPS: 17 Legitimates Filtered in 00mn 00s ---\ Microsoft Windows Policies Explorer (O56) O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1 ~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s ---\ Liste des Drivers Système (O58) O58 - SDL:[MD5.2F6B34B83843F0C5118B63AC634F5BF4] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [491088] ~ Drivers: Scanned in 00mn 00s ---\ Liste des outils de nettoyage (O63) O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 ~ ADS: Scanned in 00mn 00s ---\ Liste des services Legacy (O64) O64 - Services: CurCS - ??\??\???? - Pas de propriétaire (esgiguard) .(...) - LEGACY_ESGIGUARD ~ Legacy: 74 Legitimates Filtered in 00mn 08s ---\ File Associations Shell Spawning (O67) O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.Not Key.) ~ FASS Keys: 19 Legitimates Filtered in 00mn 00s ---\ Start Menu Internet (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\ Search Browser Infection (O69) O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8 O69 - SBI: SearchScopes [HKCU] {67A2568C-7A0A-4EED-AECC-B5405DE63B64} - (Google) - https://www.google.com/?gws_rd=ssl O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Google) - https://www.google.com/?gws_rd=ssl ~ Keys: Scanned in 00mn 00s ---\ Recherche particuliere à la racine de certains dossiers (O84) [MD5.3B32CAA07D672F8A2E0DF5CB3A873F45] [SPRF][22/06/2012] (...) -- C:\Users\emachines\AppData\Local\Temp\ESGScanner.sys [22704] [MD5.FBC207AD85D053D4FD9DD93C595D1A1D] [SPRF][07/06/2013] (.Pas de propriétaire - HOSTS Anti-PUPs/Adwares.) -- C:\Users\emachines\AppData\Local\Temp\Install_HOSTS_Anti-Adware.exe [285455] [MD5.98E1D63A539CA25A7614165126AD2906] [SPRF][04/06/2013] (...) -- C:\Users\emachines\AppData\Local\Temp\sh4plist.dat [68] [MD5.C8152A75A027AD99E291F71FFAEA5176] [SPRF][04/06/2013] (...) -- C:\Users\emachines\AppData\Local\Temp\SHSetup(0).exe [46317136] [MD5.C8152A75A027AD99E291F71FFAEA5176] [SPRF][04/06/2013] (...) -- C:\Users\emachines\AppData\Local\Temp\SHSetup.exe [46317136] [MD5.6C5A390C370D2AD3AEA78234B32C4BE7] [SPRF][03/06/2013] (...) -- C:\Users\emachines\Desktop\winmail.dat [536099] ~ Files: Scanned in 00mn 39s ---\ Firewall Active Exception List (FirewallRules) (O87) O87 - FAEL: "{5F969A1B-54F6-4121-A0C2-20141ACFAE9E}" |In - Public - P6 - TRUE | .(...) -- C:\Users\emachines\AppData\Local\Temp\7zS79BA\hppiw.exe (.not file.) O87 - FAEL: "{1C113BCE-35BD-453F-9053-A1B0DD9F8D5D}" |In - Public - P17 - TRUE | .(...) -- C:\Users\emachines\AppData\Local\Temp\7zS79BA\hppiw.exe (.not file.) ~ Firewall: 182 Legitimates Filtered in 00mn 02s ---\ Scan Additionnel (O88) Database Version : v2.12676 - (05/07/2013) Clés trouvées (Keys found) : 21 Valeurs trouvées (Values found) : 0 Dossiers trouvés (Folders found) : 4 Fichiers trouvés (Files found) : 1 [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E] =>Toolbar.Ask [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6] =>Toolbar.Ask [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852] =>Toolbar.Ask [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0] =>Toolbar.Ask [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA] =>Toolbar.Ask [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96] =>Toolbar.Ask [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59] =>Toolbar.Ask [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC] =>Toolbar.Ask [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA] =>Toolbar.Ask [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E] =>Toolbar.Ask [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF] =>Toolbar.Ask [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E] =>Toolbar.Ask [HKLM\Software\Wow6432Node\Iminent] =>Adware.IMBooster [HKLM\Software\Wow6432Node\SP Global] =>PUP.AdvancedSystemProtector [HKCU\Software\AppDataLow\SProtector] =>PUP.AdvancedSystemProtector [HKLM\Software\Wow6432Node\SProtector] =>PUP.AdvancedSystemProtector [HKLM\Software\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}] =>Adware.Agent [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375] =>Toolbar.Agent [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5] =>Toolbar.Agent [HKLM\Software\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}] =>Adware.MagniPic [HKLM\Software\Wow6432Node\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}] =>Adware.MagniPic C:\Program Files (x86)\continuetosave =>PUP.Offerware C:\ProgramData\InstallMate =>Toolbar.Agent C:\Users\emachines\AppData\Local\Temp\Iminent =>Adware.IMBooster C:\ProgramData\ccoonTiinUeetyosave =>PUP.Offerware^ C:\Windows\Tasks\schedule!3036567561.job =>PUP.Offerware^ ~ Additionnel Scan: 207681 Items scanned in 01mn 27s ---\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Demand 12/06/2013 256904 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe SR - | Auto 28/08/2009 1150496 | (Greg_Service) . (.Acer Incorporated.) - C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe SS - | Auto 09/04/2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe SS - | Demand 09/04/2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe SS - | Auto 285795 | (HOSTS Anti-PUPs) . (...) - C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware.exe SR - | Demand 14/07/2009 27136 | C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll (hpqcxs08) . (.Hewlett-Packard Co..) - C:\Windows\System32\svchost.exe SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll (hpqddsvc) . (.Hewlett-Packard Co..) - C:\Windows\System32\svchost.exe SR - | Auto 14/07/2009 27136 | C:\Users\emachines\AppData\Local\Temp\7zS79BA\HPSLPSVC64.dll (HPSLPSVC) . (.Hewlett-Packard Co..) - C:\Windows\System32\svchost.exe SR - | Auto 13/10/2009 354840 | (IAANTMON) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe SR - | Auto 02/06/2010 252416 | (IdcSrv) . (.IdeaCom Technology Inc..) - C:\Program Files (x86)\IdeaCom\IDCMgr\IdcSrv.exe SS - | Demand 26/06/2013 117144 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe SS - | Demand 15/01/2010 935208 | (Nero BackItUp Scheduler 4.0) . (.Nero AG.) - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe SS - | Auto 14/07/2009 27136 | C:\Windows\system32\HPZinw12.dll (Net Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe SR - | Auto 02/10/2012 891240 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32 vvsvc.exe SR - | Auto 10/10/2012 1258856 | (nvUpdatusService) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe SS - | Auto 14/07/2009 27136 | C:\Windows\system32\HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe SS - | Auto 28/02/2013 161384 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe SR - | Auto 02/10/2012 382824 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision vSCPAPISvr.exe SR - | Auto 29/01/2010 243232 | (Updater Service) . (.Acer Group.) - C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SS - | Demand 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe ~ Services: Scanned in 00mn 04s ---\ Malicius Software Information ~ http://nicolascoolman.webs.com/apps/blog/show/28204239-pup-optimizerpro =>PUP.OptimizerPro ~ http://nicolascoolman.webs.com/apps/blog/show/27332348-pup-offerware =>PUP.Offerware ~ http://nicolascoolman.webs.com/apps/blog/show/26609241-crapware-spyhunter =>Crapware.SpyHunter ~ http://nicolascoolman.webs.com/apps/blog/show/28486577-pup-mocaflix =>PUP.MocaFlix ~ http://nicolascoolman.webs.com/apps/blog/show/27875657-toolbar-deltasearch =>Toolbar.DeltaSearch ~ http://nicolascoolman.webs.com/apps/blog/show/26684723-adware-imbooster =>Adware.IMBooster ~ http://nicolascoolman.webs.com/apps/blog/show/26630283-pup-advancedsystemprotector =>PUP.AdvancedSystemProtector ~ http://nicolascoolman.webs.com/apps/blog/show/28927746-toolbar-ask =>Toolbar.Ask ~ http://nicolascoolman.webs.com/apps/blog/show/26632189-adware-magnipic =>Adware.MagniPic ~ MSI: 9 link(s) detected in 00mn 05s ~ 979 Legitimates filtered by white list End of the scan (446 lines in 06mn 29s)(0) Configuration: Windows 7 / Chrome 26.0.1410.64

2011N2 · Answer

Salut,

Ton ordinateur est infecté par des PUPs/LPIs.

Les PUPs/LPIs (Logiciels Potentiellement Indésirables) sont des programmes indésirables qui généralement, affichent des publicités et installent des barres d'outils (toolbars). Ils s'installent en même temps que l'installation d'autres logiciels, en général, gratuits.
Ils modifient les paramètres des navigateurs (page de démarrage et de recherche).
Afin d'éviter cela, il faut donc faire attention lors de l'installation des logiciels (surtout ceux gratuits), et ne pas installer les modules complémentaires proposés avec ceux-là (en décochant les cases, souvent pré-cochées). Il est également fortement conseillé de télécharger les logiciels sur le site de l'éditeur (et non Softonic, 01Net, etc... qui incluent dans leurs installations ce genre de programmes néfastes).

Nous allons nous occuper de les éradiquer.

- Télécharge AdwCleaner (d'Xplode) sur ton bureau.
- Lance le, clique sur [Recherche] puis patiente le temps du scan.
- Une fois le scan fini, un rapport s'ouvrira. Poste moi son contenu dans ta prochaine réponse.

Note : Le rapport est également sauvegardé sous C:\AdwCleaner[R1].txt

Aide en vidéo ici : https://www.youtube.com/watch?v=vOa47SdO7Zk&feature=youtu.be

Si tu as des questions, n'hésite pas à les poser !

@+

Gabriel.

Analyse rapport ZHPdiag

1 réponse

Discussions similaires