Finaliser un nettoyage avec zhpfix aprés infection par pricora

slt
fais passer le rapport zhpdiag pour savoir la procédure

voila le rapport

https://vsozwc.1fichier.com/

Lance ZHPFix (soit via le raccourci sur ton Bureau, soit via ZHPDiag en cliquant sur l'écusson vert)
Copie/colle les lignes en gras suivantes :

----------------------------------------------------------


O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-codedownloader.job [1178] =>Adware.Pricora
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-enabler.job [1078] =>Adware.Pricora
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-firefoxinstaller.job [1802] =>Adware.Pricora
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-updater.job [1174] =>Adware.Pricora
[MD5.DAA7EAAEEB67125192A16FCCE7EEDD9D] [APT] [Pricora-codedownloader] (.Corporate Inc.) -- C:\Program Files (x86)\Pricora\Pricora-codedownloader.exe [476672] =>Adware.Pricora
[MD5.1696645FDB0519682C3D79DACA321A71] [APT] [Pricora-enabler] (.Corporate Inc.) -- C:\Program Files (x86)\Pricora\Pricora-enabler.exe [342528] =>Adware.Pricora
[MD5.D724F163E9FE2848318E0807B3CE563D] [APT] [Pricora-firefoxinstaller] (.Corporate Inc.) -- C:\Program Files (x86)\Pricora\Pricora-firefoxinstaller.exe [722432] =>Adware.Pricora
[MD5.38D5A3A91582699F43193E3D754DECE9] [APT] [Pricora-updater] (.Corporate Inc.) -- C:\Program Files (x86)\Pricora\Pricora-updater.exe [362496] =>Adware.Pricora

[HKCU\Software\AppDataLow\Software\Pricora] =>Adware.Pricora
[HKLM\Software\Wow6432Node\Pricora] =>Adware.Pricora

O43 - CFD: 15/07/2013 - 18:57:07 - [6,621] ----D C:\Program Files (x86)\Pricora =>Adware.Pricora

O69 - SBI: prefs.js [bob - dyqpw3ts.default] user_pref("extensions.crossrider.bic", "140063d7919028fdde1da140dabe8bbe"); =>PUP.CrossRider

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-codedownloader.job [1178]] =>Adware.Pricora^
[HKLM
~ http://nicolascoolman.webs.com/apps/blog/show/29294184-adware-pricora =>Adware.Pricora
~ http://nicolascoolman.webs.com/apps/blog/show/27583526-pup-crossrider =>PUP.CrossRider\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-enabler.job [1078]] =>Adware.Pricora^
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-firefoxinstaller.job [1802]] =>Adware.Pricora^
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-updater.job [1174]] =>Adware.Pricora^
C:\Program Files (x86)\Pricora =>Adware.Pricora^
C:\ProgramData\FreeRide Games =>Toolbar.FreeRide
C:\Windows\Tasks\Pricora-codedownloader.job =>Adware.Pricora^
C:\Windows\Tasks\Pricora-enabler.job =>Adware.Pricora^
C:\Windows\Tasks\Pricora-firefoxinstaller.job =>Adware.Pricora^
C:\Windows\Tasks\Pricora-updater.job =>Adware.Pricora^
C:\Program Files (x86)\Pricora\Pricora-codedownloader.exe =>Adware.Pricora^
C:\Program Files (x86)\Pricora\Pricora-enabler.exe =>Adware.Pricora^
C:\Program Files (x86)\Pricora\Pricora-firefoxinstaller.exe =>Adware.Pricora^
C:\Program Files (x86)\Pricora\Pricora-updater.exe =>Adware.Pricora^
[HKCU\Software\AppDataLow\Software\Pricora] =>Adware.Pricora^
[HKLM\Software\Wow6432Node\Pricora] =>Adware.Pricora^
EmptyCLSID
EmptyFlash
EmptyTemp _____________________________________________

* Lance ZHPFix à partir du raccourci sur ton Bureau (si tu es sous Windows Vista ou Windows 7, fais le par un clic-droit --> Exécuter en tant qu'administrateur)
* Clique sur l'icone représentant le presse-papier ("coller le presse-papier")
e script doit automatiquement apparaitre dans ZHPFix, sinon, colle-le (Ctrl+v)
* Clique sur le bouton GO pour lancer le nettoyage
* Copie/colle la totalité du rapport dans ta prochaine réponse.Ajouter un commentaire - Lien (#6)

voila le nouveau rapport:

Rapport de ZHPFix 2013.7.20.5 par Nicolas Coolman, Update du 20/07/2013
Fichier d'export Registre : C:\ZHP\ZHPExportRegistry-22-07-2013-16-49-25.txt
Run by bob at 22/07/2013 16:49:24
High Elevated Privileges : OK
Windows 8 Home Premium Edition, 64-bit (Build 9200)

Corbeille vidée

========== Processus mémoire ==========
SUPPRIME Memory Process: C:\Program Files (x86)\Pricora\Pricora-codedownloader.exe
SUPPRIME Memory Process: C:\Program Files (x86)\Pricora\Pricora-enabler.exe
SUPPRIME Memory Process: C:\Program Files (x86)\Pricora\Pricora-firefoxinstaller.exe
SUPPRIME Memory Process: C:\Program Files (x86)\Pricora\Pricora-updater.exe

========== Clé(s) du Registre ==========
SUPPRIME Key: HKCU\Software\AppDataLow\Software\Pricora
SUPPRIME Key: HKLM\Software\Wow6432Node\Pricora
ABSENT Key: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-codedownloader.job [1178
ABSENT Key: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-firefoxinstaller.job [1802
ABSENT Key: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-updater.job [1174
ABSENT Key: HKCU\Software\AppDataLow\Software\Pricora
ABSENT Key: HKLM\Software\Wow6432Node\Pricora

========== Préférences navigateur ==========
ABSENT Mozilla Pref: user_pref("extensions.crossrider.bic", "140063d7919028fdde1da140dabe8bbe");

========== Dossier(s) ==========
Aucun dossiers CLSID Local utilisateur vide
SUPPRIME Flash Cookies

========== Fichier(s) ==========
SUPPRIME File: c:\windows\tasks\pricora-codedownloader.job
SUPPRIME File: c:\windows\tasks\pricora-enabler.job
SUPPRIME File: c:\windows\tasks\pricora-firefoxinstaller.job
SUPPRIME File: c:\windows\tasks\pricora-updater.job
SUPPRIME File: c:\program files (x86)\pricora\pricora-codedownloader.exe
SUPPRIME File***: c:\program files (x86)\pricora\pricora-firefoxinstaller.exe
ABSENT Folder/File: c:\program files (x86)\pricora
ABSENT Folder/File: c:\windows\tasks\pricora-codedownloader.job
ABSENT Folder/File: c:\windows\tasks\pricora-enabler.job
ABSENT Folder/File: c:\windows\tasks\pricora-firefoxinstaller.job
ABSENT Folder/File: c:\windows\tasks\pricora-updater.job
SUPPRIME Flash Cookies

========== Tache planifiée ==========
SUPPRIME Task: Pricora-codedownloader
SUPPRIME Task: Pricora-enabler
SUPPRIME Task: Pricora-firefoxinstaller
SUPPRIME Task: Pricora-updater

========== Autre ==========
NON TRAITE [HKLM
NON TRAITE ~ http://nicolascoolman.webs.com/apps/blog/show/29294184-adware-pricora
NON TRAITE ~ http://nicolascoolman.webs.com/apps/blog/show/27583526-pup-crossrider
NON TRAITE EmptyTemp _____________________________________________

========== Récapitulatif ==========
4 : Processus mémoire
7 : Clé(s) du Registre
2 : Dossier(s)
12 : Fichier(s)
1 : Préférences navigateur
4 : Tache planifiée
4 : Autre

End of clean in 01mn 55s

========== Chemin de fichier rapport ==========
C:\ZHP\ZHPFix[R1].txt - 22/07/2013 14:07:11 [415]
C:\ZHP\ZHPFix[R2].txt - 22/07/2013 16:49:25 [3139]

j'imagine que le PC est clean n'est ce pas?

remets un rapport zhpdiag tout neuf pour controler

comment va le pc?

https://1ezwl2.1fichier.com/

voila le nouveau rapport;

ceci est encore un bout de pricora? :

M2 - MFEP: prefs.js [bob - dyqpw3ts.default\94ae0976-89df-4347-9771-5371c6e203bf@3796dc63-d06d-4575-a997-9b5c935fe915.com] [] Pricora v (..) =>Adware.Pricora

il s'agit de l'extention sur mozilla qui réapparait dans les options

je me suis permis de coller cette ligne dans zhpfix
j'ai refait un nouveau rapport zhpdiag ou elle n'apparait plus visiblement; voila le dernier rapport
http://up2.1fichier.com/end.pl?xid=K3Ntb

le lien marche pas

Rapport de ZHPDiag v2013.7.22.36 par Nicolas Coolman, Update du 22/07/2013
Run by bob at 22/07/2013 18:29:41
WebSite: https://nicolascoolman.webs.com/
State : Version à jour.
WhiteList : Enable
High Elevated Privileges : OK
UAC : Activate by user

---\\ Web Browser
MSIE: Internet Explorer v10.0.9200.16599
MFIE: Mozilla Firefox 22.0 (Defaut)

---\\ Windows Product Information
~ Langage: Français
Windows 8 Home Premium Edition, 64-bit (Build 9200)
Windows Server License Manager Script : OK
~ ion : Windows(R) Operating System, OEM_DM channel
Windows ID Activation : OK
~ Windows Partial Key : 3C736
Windows License : OK
~ Windows Remaining Initializations Number : 999
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ System Protection
Malwarebytes Anti-Malware version 1.75.0.1300
Windows Defender W8

---\\ System Optimizer
CCleaner v4.02 =>Piriform Ltd

---\\ Peer To Peer (P2P)

---\\ Software Update
Adobe Flash Player 11 Plugin

---\\ System Information
~ Processor: AMD64 Family 20 Model 2 Stepping 0, AuthenticAMD
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3658 MB (81% free)
System Restore: Activé (Enable)
System drive C: has 349 GB (79%) free of 440 GB

---\\ Logged in mode
~ Computer Name: BOB
~ User Name: bob
~ All Users Names: bob, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Users\bob\AppData\Roaming\
~ %Desktop% : C:\Users\bob\Desktop\
~ %Favorites% : C:\Users\bob\Favorites\
~ %LocalAppData% : C:\Users\bob\AppData\Local\
~ %StartMenu% : C:\Users\bob\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 349 Go of 440 Go)
E:\ CD-ROM drive (Not Inserted)

---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: 29 Legitimates Filtered in 00mn 00s

---\\ Recherche particulière de fichiers génériques
[MD5.E13A31D5254C25406A7946BDD9B06364] - (.Microsoft Corporation - Explorateur Windows.) (.11/10/2012 - 08:35:16.) -- C:\Windows\Explorer.exe [2380944]
[MD5.FE9AB232B56A12224E8A3F3F9878C9A3] - (.Microsoft Corporation - Application de démarrage de Windows.) (.26/07/2012 - 04:08:50.) -- C:\Windows\System32\Wininit.exe [132608]
[MD5.36050B1CDF2DAE0B44286C7C46E4883E] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.28/04/2013 - 23:28:33.) -- C:\Windows\System32\wininet.dll [2241024]
[MD5.BCF2036A0DD579E47C008C133550283E] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.11/10/2012 - 06:46:58.) -- C:\Windows\System32\Winlogon.exe [517120]
[MD5.9448F5740A037EC0C18F0E9177232DD0] - (.Microsoft Corporation - Bibliothèque de licences.) (.26/07/2012 - 04:07:20.) -- C:\Windows\System32\sppcomapi.dll [273408]
[MD5.36D6A3201721558A8AFBCC09C2DA4C2C] - (.Microsoft Corporation - Pilote de fonction connexe pour WinSock.) (.06/11/2012 - 04:53:44.) -- C:\Windows\system32\Drivers\AFD.sys [560640]
[MD5.A721FF570C2387E383BDDEA9632863C9] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.26/07/2012 - 06:00:48.) -- C:\Windows\system32\Drivers\atapi.sys [25840]
[MD5.990B1BABE6E81FB18E65A87EBEFB1772] - (.Microsoft Corporation - CD-ROM File System Driver.) (.26/07/2012 - 03:30:10.) -- C:\Windows\system32\Drivers\Cdfs.sys [108544]
[MD5.339BFF85D788268752DA8C9644B188EE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.26/07/2012 - 03:26:36.) -- C:\Windows\system32\Drivers\Cdrom.sys [174080]
[MD5.09D9EB9E7898F8E6561473A20CC808B9] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.26/07/2012 - 03:26:53.) -- C:\Windows\system32\Drivers\DfsC.sys [118784]
[MD5.7D87B5B6C7188D553E11B59DC7F0B111] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/09/2012 - 07:08:44.) -- C:\Windows\system32\Drivers\HDAudBus.sys [71168]
[MD5.C9E9CBF73AFFBFE3E801EFB516787BA3] - (.Microsoft Corporation - Pilote de port i8042.) (.26/07/2012 - 03:28:51.) -- C:\Windows\system32\Drivers\i8042prt.sys [112640]
[MD5.3969B9C218DD3FAA9F4ED2FFC3651C02] - (.Microsoft Corporation - IP Network Address Translator.) (.26/07/2012 - 03:23:01.) -- C:\Windows\system32\Drivers\IpNat.sys [145920]
[MD5.93179D48066918323628CB016D8C94DC] - (.Microsoft Corporation - Minirdr SMB Windows NT.) (.05/02/2013 - 23:29:09.) -- C:\Windows\system32\Drivers\MRxSmb.sys [370688]
[MD5.7CEC25C682D319D484630B3952C31A11] - (.Microsoft Corporation - MBT Transport driver.) (.26/07/2012 - 03:24:28.) -- C:\Windows\system32\Drivers\netBT.sys [331776]
[MD5.76929F4A69E425911A63B407E26C2589] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.02/02/2013 - 11:54:54.) -- C:\Windows\system32\Drivers\ntfs.sys [1933544]
[MD5.4563DAF8C6A740AD7F501E219BD10766] - (.Microsoft Corporation - Pilote de port parallèle.) (.26/07/2012 - 03:29:53.) -- C:\Windows\system32\Drivers\Parport.sys [105984]
[MD5.A14D625C5AEE5FFE0F47D1A1D419FAAE] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.26/07/2012 - 03:23:17.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [124928]
[MD5.B2A3AD74FF2E2FFA73AF2567108231B3] - (.Microsoft Corporation - Redirecteur de périphérique de Microsoft RDP.) (.26/07/2012 - 03:25:18.) -- C:\Windows\system32\Drivers\rdpdr.sys [179712]
[MD5.73DC722CE5DF26D7638CE2446F2655C7] - (.Microsoft Corporation - TDI Translation Driver.) (.26/07/2012 - 06:26:47.) -- C:\Windows\system32\Drivers\tdx.sys [117248]
[MD5.2FB3CDFD5EAF4CD9D4AFAF96877D13AE] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.26/07/2012 - 05:57:09.) -- C:\Windows\system32\Drivers\volsnap.sys [332016]
~ Generic Processes: Scanned in 00mn 00s

---\\ Etat des fichiers cachés (Caché/Total)
~ Mes Videos (My Videos) : 1/2
~ Mes Favoris (My Favorites) : 1/10
~ Mes Documents (My Documents) : 1/10
~ Mon Bureau (My Desktop) : 1/9031
~ Menu demarrer (Programs) : 1/40
~ Hidden Files: Scanned in 00mn 04s

---\\ Processus lancés
[MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.2916]
[MD5.392C496D80D57B6DA347148D3A4A1D11] - (.Pas de propriétaire - ChangeIcon MFC Application.) -- C:\Windows\SysWOW64\UMonit.exe [28672] [PID.2812]
[MD5.C72FB9CC856ECFF3B6459B27CB674638] - (.PixArt Imaging Incorporation - Registry Monitor.) -- C:\Windows\PixArt\PAC207\Monitor.exe [323584] [PID.2216]
[MD5.1F6BA41827A6262F668B436B6A5D9317] - (.Lenovo - Lenovo Black Silk USB Keyboard.) -- C:\Windows\jmesoft\hotkey.exe [118784] [PID.2636]
[MD5.0B427D9943C838620AFA30CBB24A6D77] - (.CyberLink - CyberLink MediaLibray Service.) -- C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [103720] [PID.292]
[MD5.B7995C675014EEBE77A0BEB7AFCCFC08] - (.CyberLink Corp. - PowerDVD RC Service.) -- C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [91432] [PID.1996]
[MD5.9265DC583D291B5C5C5631231BFD14B2] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [7748096] [PID.2080]
~ Processes Running: Scanned in 00mn 00s

---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\bob\AppData\Roaming\Mozilla\Firefox\Profiles\dyqpw3ts.default\prefs.js
~ Firefox Browser: 2 Legitimates Filtered in 00mn 00s

---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s

---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s

---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21

---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
O4 - HKLM\..\Run: [UMonit] . (.Pas de propriétaire - ChangeIcon MFC Application.) -- C:\WINDOWS\SysWOW64\UMonit.exe
O4 - HKLM\..\Run: [PAC207_Monitor] . (.PixArt Imaging Incorporation - Registry Monitor.) -- C:\WINDOWS\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Wow6432Node\Run: [jmekey] . (.Lenovo - Lenovo Black Silk USB Keyboard.) -- C:\WINDOWS\jmesoft\hotkey.exe
O4 - HKLM\..\Wow6432Node\Run: [jmesoft] . (...) -- C:\Windows\jmesoft\ServiceLoader.exe
O4 - HKLM\..\Wow6432Node\Run: [CLMLServer] . (.CyberLink - CyberLink MediaLibray Service.) -- C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
O4 - HKLM\..\Wow6432Node\Run: [UpdateP2GoShortCut] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Wow6432Node\Run: [RemoteControl10] . (.CyberLink Corp. - PowerDVD RC Service.) -- C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
O4 - HKLM\..\Wow6432Node\Run: [Intel AppUp(SM) center] . (.Intel Corporation - Intel Services Manager.) -- C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe
~ Application: Scanned in 00mn 00s

---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{DC766068-8FFD-4EAE-B483-6453FAD1EC22}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{DC766068-8FFD-4EAE-B483-6453FAD1EC22}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s

---\\ Protocole additionnel (O18)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll
~ Protocole Additionnel: Scanned in 00mn 00s

---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: JME Keyboard Driver (JME Keyboard) . (...) - C:\Windows\jmesoft\Service.exe
O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
~ Services: 6 Legitimates Filtered in 00mn 11s

---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 03/06/2013 - 21:48:33 - [9,693] ----D C:\Program Files (x86)\Common Files\PAC207
~ Program Folder: 93 Legitimates Filtered in 00mn 00s

---\\ Microsoft Windows Policies System (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 17 Legitimates Filtered in 00mn 00s

---\\ Liste des Drivers Système (O58)
O58 - SDL:[MD5.4F18D4C7EA14F11A7211F60D553C03DB] - 26/07/2012 - 06:00:49 ---A- . (.LSI - LSI 3ware SCSI Storport Driver.) -- C:\Windows\System32\Drivers\3ware.sys [106736]
~ Drivers: Scanned in 00mn 00s

---\\ Liste des outils de nettoyage (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
~ ADS: Scanned in 00mn 00s

---\\ Start Menu Internet (O68)
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s

---\\ Product Upgrade Codes (O90)
O90 - PUC: "421D4F645E0221D4EB25CE71A7A7B424" . (.OneKey Recovery.) -- C:\WINDOWS\Installer\{46F4D124-20E5-4D12-BE52-EC177A7A4B42}\ARPPRODUCTICON.exe
~ Update Products: 42 Legitimates Filtered in 00mn 00s

---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 11/07/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 01/08/2012 239616 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 06/08/2012 361984 | (AMD FUEL Service) . (.Advanced Micro Devices, Inc..) - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
SR - | Auto 32768 | (JME Keyboard) . (...) - C:\Windows\jmesoft\Service.exe
SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
SS - | Demand 18/06/2013 117144 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Auto 21/06/2013 162408 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Demand 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe
SS - | Demand 20/09/2012 29696 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 00s

---\\ Scan Additionnel (O88)
Database Version : v2.12804 - (22/07/2013)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 0

~ Additionnel Scan: 127375 Items scanned in 00mn 31s

~ 680 Legitimates filtered by white list
End of the scan (257 lines in 01mn 20s)(0)

voila le rapport de nouveau

ok c'est bon

pour supprimer ce qui a été utilisé:

http://www.commentcamarche.net/faq/24877-supprimer-les-logiciels-de-desinfection#q=supprimer+logiciel+desinfection&cur=1&url=%2F

merci beaucoup pour le coup de main; le pc est comme neuf!