PC très lent

J'ai éssayé au moins 10 fois de faire le rapport avec la loupe et le + et à chaque fois ca a bloqué à 61% j'ai donc fait avec la loupe et le - , et voici le rapport qu'il m'a donné:

Rapport de ZHPDiag v2013.7.30.44 par Nicolas Coolman, Update du 30/07/2013
Run by user at 01/08/2013 22:46:31
WebSite: http://nicolascoolman.webs.com
State : Version à jour.
WhiteList : Enable
High Elevated Privileges : OK
UAC : Deactivate by program


---\\ Web Browser
MSIE: Internet Explorer v9.0.8112.16421
MFIE: Mozilla Firefox 22.0 (Defaut)
GCIE: Google Chrome v28.0.1500.95

---\\ Windows Product Information
~ Langage: Français
Windows Vista Home Premium Edition, 32-bit Service Pack 2 (Build 6002)
Windows Server License Manager Script : OK
~ Vista, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 6CJ97
Windows License : OK
Windows Automatic Updates : OK

---\\ System Protection
Microsoft Security Client v4.2.0223.1

---\\ System Optimizer
CCleaner v2.28 =>Piriform Ltd

---\\ Peer To Peer (P2P)

---\\ Software Update
Adobe Flash Player 11 Plugin
Adobe Reader XI
Java 7 Update 21

---\\ System Information
~ Processor: x86 Family 6 Model 23 Stepping 10, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3000 MB (37% free)
System Restore: Activé (Enable)
System drive C: has 43 GB (15%) free of 288 GB

---\\ Logged in mode
~ Computer Name: PC-DE-USER
~ User Name: user
~ All Users Names: user, ASPNET, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Users\user\AppData\Roaming\
~ %Desktop% : C:\Users\user\Desktop\
~ %Favorites% : C:\Users\user\Favorites\
~ %LocalAppData% : C:\Users\user\AppData\Local\
~ %StartMenu% : C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 43 Go of 288 Go)
G:\ CD-ROM drive (Free 0 Go of 4 Go)



---\\ Security Center & Tools Informations
[HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] Load: Modified
~ Security Center: 35 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.D07D4C3038F3578FFCE1C0237F2A1253] - (.Microsoft Corporation - Explorateur Windows.) (.11/04/2009 - 07:27:36.) -- C:\Windows\Explorer.exe [2926592]
[MD5.101BA3EA053480BB5D957EF37C06B5ED] - (.Microsoft Corporation - Application de démarrage de Windows.) (.21/01/2008 - 03:23:42.) -- C:\Windows\System32\Wininit.exe [96768]
[MD5.EA952A5C277CABCBA69EA806146BB984] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.29/05/2013 - 02:41:08.) -- C:\Windows\System32\wininet.dll [1129472]
[MD5.898E7C06A350D4A1A64A9EA264D55452] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.11/04/2009 - 07:28:13.) -- C:\Windows\System32\Winlogon.exe [314368]
[MD5.3911B972B55FEA0478476B2E777B29FA] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.21/04/2011 - 14:58:27.) -- C:\Windows\system32\Drivers\AFD.sys [273408]
[MD5.2D9C903DC76A66813D350A562DE40ED9] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.21/01/2008 - 03:23:00.) -- C:\Windows\system32\Drivers\atapi.sys [21560]
[MD5.7ADD03E75BEB9E6DD102C3081D29840A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.21/01/2008 - 03:23:51.) -- C:\Windows\system32\Drivers\Cdfs.sys [70144]
[MD5.6B4BFFB9BECD728097024276430DB314] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.11/04/2009 - 05:39:17.) -- C:\Windows\system32\Drivers\Cdrom.sys [67072]
[MD5.622C41A07CA7E6DD91770F50D532CB6C] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.14/04/2011 - 15:59:03.) -- C:\Windows\system32\Drivers\DfsC.sys [75264]
[MD5.062452B7FFD68C8C042A6261FE8DFF4A] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.11/04/2009 - 05:42:42.) -- C:\Windows\system32\Drivers\HDAudBus.sys [561152]
[MD5.22D56C8184586B7A1F6FA60BE5F5A2BD] - (.Microsoft Corporation - Pilote de port i8042.) (.21/01/2008 - 03:23:20.) -- C:\Windows\system32\Drivers\i8042prt.sys [54784]
[MD5.8793643A67B42CEC66490B2A0CF92D68] - (.Microsoft Corporation - IP Network Address Translator.) (.21/01/2008 - 03:24:25.) -- C:\Windows\system32\Drivers\IpNat.sys [100864]
[MD5.1E94971C4B446AB2290DEB71D01CF0C2] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.29/04/2011 - 14:24:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [106496]
[MD5.ECD64230A59CBD93C85F1CD1CAB9F3F6] - (.Microsoft Corporation - MBT Transport driver.) (.11/04/2009 - 05:45:37.) -- C:\Windows\system32\Drivers\netBT.sys [185856]
[MD5.2C1121F2B87E9A6B12485DF53CD848C7] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.03/03/2013 - 20:07:52.) -- C:\Windows\system32\Drivers\ntfs.sys [1082232]
[MD5.0FA9B5055484649D63C303FE404E5F4D] - (.Microsoft Corporation - Pilote de port parallèle.) (.02/11/2006 - 09:51:30.) -- C:\Windows\system32\Drivers\Parport.sys [79360]
[MD5.A214ADBAF4CB47DD2728859EF31F26B0] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/01/2008 - 03:24:55.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [76288]
[MD5.FBC0BACD9C3D7F6956853F64A66E252D] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.21/01/2008 - 03:23:01.) -- C:\Windows\system32\Drivers\rdpdr.sys [248832]
[MD5.7B75299A4D201D6A6533603D6914AB04] - (.Microsoft Corporation - SMB Transport driver.) (.11/04/2009 - 05:45:22.) -- C:\Windows\system32\Drivers\smb.sys [66560]
[MD5.76B06EB8A01FC8624D699E7045303E54] - (.Microsoft Corporation - TDI Translation Driver.) (.11/04/2009 - 05:45:56.) -- C:\Windows\system32\Drivers\tdx.sys [72192]
[MD5.786DB5771F05EF300390399F626BF30A] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/08/2012 - 12:47:42.) -- C:\Windows\system32\Drivers\volsnap.sys [224640]
~ Generic Processes: Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/3506
~ Mes musiques (My Musics) : 51/307
~ Mes Videos (My Videos) : 1/239
~ Mes Favoris (My Favorites) : 1/21
~ Mes Documents (My Documents) : 1/5233
~ Mon Bureau (My Desktop) : 10/3029
~ Menu demarrer (Programs) : 1/43
~ Hidden Files: Scanned in 00mn 13s



---\\ Processus lancés
[MD5.DEFEFD7E02D5CDF42F4B4FE45B64C15B] - (.Pas de propriétaire - MotoHelperAgent.) -- C:\Program Files\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe [694168] [PID.2356]
[MD5.3BE8C00F8834FB2EC5D00DED729C2061] - (.Intel Corporation - Event Monitor User Notification Tool.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [186904] [PID.4032]
[MD5.DA0FF8FB84309306FBAC1A5FF2070C70] - (.Intel Corporation - persistence Module.) -- C:\Windows\System32\igfxpers.exe [153624] [PID.4092]
[MD5.77FA27D99D23F457879FFD13C163DE5B] - (.Realtek Semiconductor - HD Audio Control Panel.) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7399968] [PID.1612]
[MD5.1ABF80D4F4941ECEE600AEC768173523] - (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1430824] [PID.1864]
[MD5.E7704CBF568815C1CAA6E513387BD3F2] - (.Advanced Micro Devices Inc. - Catalyst Control Center: Monitoring program.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [65536] [PID.3656]
[MD5.E97676B29EAB4C1EA6219C6430BCB109] - (.Intel Corporation - igfxsrvc Module.) -- C:\Windows\system32\igfxsrvc.exe [253976] [PID.2312]
[MD5.175DCB28BE4AC0E5C6F7AB4073AF574E] - (.Dritek System Inc. - Launch Manager Keyboard Application.) -- C:\Program Files\Launch Manager\LManager.exe [1071624] [PID.3608]
[MD5.2F2DF068BED6E62E4C007DF7446B4F19] - (.Pas de propriétaire - DefaultSettingEXE MFC Application.) -- C:\Windows\PLFSetI.exe [200704] [PID.3436]
[MD5.169B653E357001EC415B0ECF8A5CAF01] - (.NewTech Infosystems, Inc. - Acer Backup Manager.) -- C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [253696] [PID.3392]
[MD5.ABF2D789623C780F3CC30649E9F3E395] - (.Acer Incorporated - ODDPWR.) -- C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe [176128] [PID.3496]
[MD5.05C7B4108B6C4EE95D41B7DFCBE7D39A] - (.Egis Technology Inc. - EgisUpdate Release Application.) -- C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe [199464] [PID.1328]
[MD5.0BF547F313B248FFFB3AC858318054CB] - (.Egis Technology Inc. - mwlDaemon Application.) -- C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [345384] [PID.264]
[MD5.7746FF4871C7EE3C169D19B424A47710] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe [421736] [PID.1588]
[MD5.FE705668DEB9318DF0B8DA5BFE0C0974] - (.Vodafone - MobileBroadband.) -- C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe [252928] [PID.2960]
[MD5.D63797E8E7781EE1500A810CB6194FA6] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816] [PID.3864]
[MD5.BF08674925F151BD4537B89A493E3E0C] - (.Microsoft Corporation - Media Center Tray Applet.) -- C:\Windows\ehome\ehtray.exe [125952] [PID.2364]
[MD5.DD9EAE1C80561C509A8B8801E16BAA38] - (.Spotify Ltd - SpotifyWebHelper.) -- C:\Users\user\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384] [PID.2908]
[MD5.070753E47E04181DD440EA2FEFE3115C] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe [18678376] [PID.940]
[MD5.975BA8331408F9AB25D9EE0712DAF7F0] - (.Spotify Ltd - Spotify.) -- C:\Users\user\AppData\Roaming\Spotify\spotify.exe [4640768] [PID.2636]
[MD5.4B555106290BD117334E9A08761C035A] - (...) -- ystem32\rundll32.exe [0] [PID.2904]
[MD5.7D726324E6403AD7A3933D713731A6A7] - (.Acer Incorporated - Acer VCM.) -- C:\Program Files\Acer\Acer VCM\AcerVCM.exe [565248] [PID.3228]
[MD5.0F4195B9B348DE5CF9B822F81704B20E] - (.Microsoft Corporation - Media Center Media Status Aggregator Servic.) -- C:\Windows\ehome\ehmsas.exe [37376] [PID.1064]
[MD5.C8D28F8B498CADBB9445AC4545BD41B7] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe [920472] [PID.5608]
[MD5.0B0D331B8662C0E630D807E4B6A4C90B] - (.Acer Incorporated - ePowerTray.) -- C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe [707104] [PID.5824]
[MD5.F92871A389230747AC6348C64D41AD57] - (.Synaptics Incorporated - Synaptics Pointing Device Helper.) -- C:\Program Files\Synaptics\SynTP\SynTPHelper.exe [103720] [PID.6020]
[MD5.6B9A12AE398F311FAE738D48F12C0E92] - (.Intel Corporation - igfxext Module.) -- C:\Windows\system32\igfxext.exe [173080] [PID.6092]
[MD5.74EF310FAC89341CE2897B7F2C4A7B0F] - (.ATI Technologies Inc. - Catalyst Control Centre: Host application.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [65536] [PID.4244]
[MD5.E9349A03FD81B4806714A16796B5E20A] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files\Mozilla Firefox\plugin-container.exe [17304] [PID.4256]
[MD5.D8425B8D6DC2AA8D871363B0775BCF18] - (.Adobe Systems, Inc. - Adobe Flash Player 11.8 r800.) -- C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe [1861512] [PID.3780]
[MD5.6080A176D09435FC8E6E800996656E18] - (.Microsoft Corporation - Console IME.) -- C:\Windows\system32\conime.exe [69120] [PID.5568]
[MD5.2A1E2C93C28F67E0BC964256DBED1C34] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7554048] [PID.5952]
[MD5.C1F19D2BACBEE9AB64D9AE69E9859AC0] - (.Microsoft Corporation - Antimalware Service Executable.) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456] [PID.1004]
[MD5.0FF34F07379FBEB7AFE0B2487C12B5A5] - (.AMD - AMD External Events Service Module.) -- C:\Windows\system32\atiesrxx.exe [176128] [PID.1176]
[MD5.862BB4CBC05D80C5B45BE430E5EF872F] - (.Microsoft Corporation - Service de gestion des licences Microsoft.) -- C:\Windows\system32\SLsvc.exe [3408896] [PID.1376]
[MD5.0064215D530E4D08C457F4BA6A80D324] - (.AMD - AMD External Events Client Module.) -- C:\Windows\system32\atieclxx.exe [348160] [PID.1456]
[MD5.2C711D5D912E0998355DB30D6F26E210] - (.Wsys Co., Ltd. - Wsys Control 1.0.0.2557.) -- C:\ProgramData\eSafe\eGdpSvc.exe [376896] [PID.1980] =>PUP.eSafeSecurity
[MD5.3927397AC60D943DAF8808AFFED582B7] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [65192] [PID.1352]
[MD5.7EF47644B74EBE721CC32211D3C35E76] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [55144] [PID.1104]
[MD5.DB5BEA73EDAF19AC68B2C0FAD0F92B1A] - (.Apple Inc. - Bonjour Service.) -- C:\Program Files\Bonjour\mDNSResponder.exe [390504] [PID.1608]
[MD5.D8ECF13E587619CDF716B2AE8E12DDBB] - (.Dritek System Inc. - Dritek WMI Service.) -- C:\Program Files\Launch Manager\dsiwmis.exe [117256] [PID.2056]
[MD5.6D49242536F8397AE9AF2A2A360E2EDD] - (.Acer Incorporated - ePowerSvc.) -- C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [703008] [PID.2076]
[MD5.0436535F8F37650BD4DADC3397CBEE3E] - (.MAGIX AG - Verzeichnisüberwachung und Hilfsaufgaben fü.) -- C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1155072] [PID.2184]
[MD5.AC9D6E3629E4388A9EA9B4172493AAEE] - (.Pas de propriétaire - MotoHelper Service.) -- C:\Program Files\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [120728] [PID.2236]
[MD5.FD257CD94057D02108B954156D7B2770] - (.Egis Technology Inc. - MyWinLocker Service.) -- C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe [305448] [PID.2260]
[MD5.0F0F75069C8016645DFCAE93A190CACF] - (.NewTech Infosystems, Inc. - Backup Manager Module.) -- C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [62208] [PID.2288]
[MD5.58751F9248D50BCE1053976C9E2F0859] - (.NewTech Infosystems, Inc. - NTI Backup Now 5 SchedulerSvc NT Service.) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144632] [PID.2384]
[MD5.69316583D4CC032B3E4E72FD86C2FFA8] - (.Acer Incorporated - ODDPwr service.) -- C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe [118784] [PID.2396]
[MD5.EA735BF6DF13A857A83C99BF27A422AD] - (.Motorola - ForwardDemon.) -- C:\Program Files\Motorola\MotForwardDaemon\ForwardDaemon.exe [65657] [PID.2484]
[MD5.8E250687E5F020CD337CC9D8252C0B56] - (.Acer Incorporated - Raw Socket Service.) -- C:\Program Files\Acer\Acer VCM\RS_Service.exe [237568] [PID.2520]
[MD5.52E8A3CC8269ADB27D25182284C5E650] - (.Intel Corporation - RAID Monitor.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [354840] [PID.2856]
[MD5.26DC11428CE061766D00B7254547869B] - (.Vodafone - VmbService.) -- C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe [9216] [PID.2940]
[MD5.E570ECA850F30EB740C2E9699DF3D2BD] - (.Microsoft Corporation - Microsoft Network Realtime Inspection Servi.) -- c:\Program Files\Microsoft Security Client\NisSrv.exe [295232] [PID.3112]
[MD5.CE004777B92DEA56FE14EC900D20BAA4] - (.Apple Inc. - iPodService Module (32-bit).) -- C:\Program Files\iPod\bin\iPodService.exe [821608] [PID.4660]
[MD5.84B40786E4F94E2D05A4E323C1CA888D] - (.Acer Incorporated - ePowerEvent.) -- C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe [453152] [PID.3372]
~ Processes Running: Scanned in 00mn 27s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences
G1 - GCS: Preference [User Data\Default] http://search.babylon.com =>Toolbar.Babylon
G0 - GCSP: Preference [User Data\Default][HomePage] http://search.babylon.com =>Toolbar.Babylon
G0 - GCSP: Preference [User Data\Default] http://search.babylon.com =>Toolbar.Babylon
G2 - GCE: Preference [User Data\Default] [algmakeomkafjglfhpomolfhjppoojff] Pricora v.1.23.46, (Activé) =>Adware.Pricora
G2 - GCE: Preference [User Data\Default] [bbahlibdkigfcalmedmoegpamcmldpbe] ADDICT-THING v.1.0 (Désactivé) =>Adware.JustPlugIt
G2 - GCE: Preference [User Data\Default] [dlnembnfbcpjnepmfjmngjenhhajpdfd] Web Assistant v.2.0.0.485 (Activé) =>Adware.IncrediBar
G2 - GCE: Preference [User Data\Default] [eooncjejnppfjjklapaamhcdmjbilmde] Delta Toolbar v.1.4 (Désactivé) =>Toolbar.DeltaSearch
G2 - GCE: Preference [User Data\Default] [incfcgceegpikennjoplhfghaaikdgei] StartNow v.2.5.0 (Activé) =>Adware.Zugo
G2 - GCE: Preference [User Data\Default] [khialnikbocfgkohdegnebhmmaifoglp] Lyrics-Monkey v.1.125 (Activé) =>Adware.AddLyrics
~ Google Browser: 15 Legitimates Filtered in 00mn 20s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\xidc8uay.default\prefs.js
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\xidc8uay.default\user.js
~ Firefox Browser: 22 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (...) (No version) -- (.not file.)
~ IE Browser: 11 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;192.168.*.*
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Keys: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F3 - REG:win.ini: load=c:\users\user\dxriaxyhu.exe
~ Keys: Scanned in 00mn 00s



---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 20



---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: Lyrics-Monkey - {69C0E130-9F25-437B-9522-192970C0D4FA} . (.LyricsMonkey WebSoft - Lyrics-Monkey.) -- C:\Program Files\Lyrics_Monkey\125.dll =>Adware.AddLyrics
~ BHO: 14 Legitimates Filtered in 00mn 05s



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: &TerraTec Home Cinema - [HKLM]{AD6E6555-FB2C-47D4-8339-3E2965509877} . (.TerraTec Electronic GmbH - DeskBand for TerraTec Home Cinema.) -- C:\Program Files\TerraTec\TerraTec Home Cinema\THCDeskBand.dll
O3 - Toolbar: Bing Bar - [HKLM]{8dcb7100-df86-4384-8842-8fa844297b3f} . (.Microsoft Corporation. - Extensions du client Bing.) -- C:\Program Files\Microsoft\BingBar\7.2.233.0\BingExt.dll =>Toolbar.Bing
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{21FA44EF-376D-4D53-9B0F-8A89D3229068} Clé orpheline
~ Toolbar: Scanned in 00mn 01s



---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [Windows Defender] . (.Microsoft Corporation - Windows Defender User Interface.) -- C:\Program Files\Windows Defender\MSASCui.exe
O4 - HKLM\..\Run: [IAAnotif] . (.Intel Corporation - Event Monitor User Notification Tool.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - HD Audio Control Panel.) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] . (.Realtek Semiconductor Corp. - Realtek Voice Manager.) -- C:\Program Files\Realtek\Audio\HDA\Skytel.exe
O4 - HKLM\..\Run: [SynTPEnh] . (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] . (.Dritek System Inc. - Launch Manager Keyboard Application.) -- C:\Program Files\Launch Manager\LManager.exe
O4 - HKLM\..\Run: [PLFSetI] . (.Pas de propriétaire - DefaultSettingEXE MFC Application.) -- C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [BackupManagerTray] . (.NewTech Infosystems, Inc. - Acer Backup Manager.) -- C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
O4 - HKLM\..\Run: [LanguageShortcut] . (.Pas de propriétaire - Language Application.) -- C:\Program Files\CyberLink\PowerDVD\Language\Language.exe
O4 - HKLM\..\Run: [Acer ePower Management] . (.Acer Incorporated - ePowerTrayLauncher.) -- C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe
O4 - HKLM\..\Run: [ODDPwr] . (.Acer Incorporated - ODDPWR.) -- C:\Program Files\Acer\Optical Drive Power Management\ODDPwr.exe
O4 - HKLM\..\Run: [EgisTecLiveUpdate] . (.Egis Technology Inc. - EgisUpdate Release Application.) -- C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
O4 - HKLM\..\Run: [mwlDaemon] . (.Egis Technology Inc. - mwlDaemon Application.) -- C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
O4 - HKLM\..\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe
O4 - HKLM\..\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [MobileBroadband] . (.Vodafone - MobileBroadband.) -- C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
O4 - HKCU\..\Run: [ProductReg] . (.Acer - ProductR Application.) -- C:\Program Files\Acer\WR_PopUp\ProductReg.exe
O4 - HKCU\..\Run: [ehTray.exe] . (.Microsoft Corporation - Media Center Tray Applet.) -- C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Users\user\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKCU\..\Run: [Spotify Web Helper] . (.Spotify Ltd - SpotifyWebHelper.) -- C:\Users\user\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
O4 - HKCU\..\Run: [Driver Pro] . (.PC Utilities Pro - Driver Pro - Update your drivers now!.) -- C:\Program Files\Driver Pro\DPLauncher.exe
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe
O4 - HKCU\..\Run: [Spotify] . (.Spotify Ltd - Spotify.) -- C:\Users\user\AppData\Roaming\Spotify\Spotify.exe
O4 - HKCU\..\Run: [Regedit32] C:\Windows\system32\regedit.exe (.not file.)
O4 - HKCU\..\Run: [WMPNSCFG] . (.Microsoft Corporation - Application de configuration du service Par.) -- C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [NTRedirect] . (...) -- C:\Users\user\AppData\Roaming\BabSolution\Shared\NTRedirect.dll =>Hijacker.BabSolution
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] oobefldr.dll
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] oobefldr.dll
O4 - HKUS\S-1-5-21-1776047989-3753290508-551865282-1000\..\Run: [ProductReg] . (.Acer - ProductR Application.) -- C:\Program Files\Acer\WR_PopUp\ProductReg.exe
O4 - HKUS\S-1-5-21-1776047989-3753290508-551865282-1000\..\Run: [ehTray.exe] . (.Microsoft Corporation - Media Center Tray Applet.) -- C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-21-1776047989-3753290508-551865282-1000\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Users\user\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKUS\S-1-5-21-1776047989-3753290508-551865282-1000\..\Run: [Spotify Web Helper] . (.Spotify Ltd - SpotifyWebHelper.) -- C:\Users\user\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
O4 - HKUS\S-1-5-21-1776047989-3753290508-551865282-1000\..\Run: [Driver Pro] . (.PC Utilities Pro - Driver Pro - Update your drivers now!.) -- C:\Program Files\Driver Pro\DPLauncher.exe
O4 - HKUS\S-1-5-21-1776047989-3753290508-551865282-1000\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe
O4 - HKUS\S-1-5-21-1776047989-3753290508-551865282-1000\..\Run: [Spotify] . (.Spotify Ltd - Spotify.) -- C:\Users\user\AppData\Roaming\Spotify\Spotify.exe
O4 - HKUS\S-1-5-21-1776047989-3753290508-551865282-1000\..\Run: [Regedit32] C:\Windows\system32\regedit.exe (.not file.)
O4 - HKUS\S-1-5-21-1776047989-3753290508-551865282-1000\..\Run: [WMPNSCFG] . (.Microsoft Corporation - Application de configuration du service Par.) -- C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-21-1776047989-3753290508-551865282-1000\..\Run: [NTRedirect] . (...) -- C:\Users\user\AppData\Roaming\BabSolution\Shared\NTRedirect.dll =>Hijacker.BabSolution
~ Application: Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Programs: Windows Mail.lnk . (.Microsoft Corporation - Windows Mail.) -- C:\Program Files\Windows Mail\WinMail.exe
O4 - GS\Programs: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe
O4 - GS\QuickLaunch: Easy Audio Cutter.lnk . (.Koyote Soft - Pas de description.) -- C:\Program Files\Free Audio Pack\Easy Audio Cutter\AudioCutter.exe
O4 - Global Startup: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Envoyé depuis un mobile.URL . (.Koyote Soft - Pas de description.) -- C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Envoyé depuis un mobile.URL
O4 - GS\QuickLaunch: Free CD Ripper.lnk . (.Koyote Soft - FreeCDRipper.) -- C:\Program Files\Free Audio Pack\Free CD Ripper\FreeCDRipper.exe
O4 - GS\QuickLaunch: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe http://www.qvo6.com =>Hijacker.Qvo6
O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe http://www.qvo6.com =>Hijacker.Qvo6
O4 - GS\QuickLaunch: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe http://www.qvo6.com =>Hijacker.Qvo6
O4 - GS\QuickLaunch: Picasa 3.lnk . (.Google Inc. - Picasa.) -- C:\Program Files\Google\Picasa3\Picasa3.exe
O4 - GS\QuickLaunch: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe
O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SendTo: AVS Mobile Uploader.lnk . (.Online Media Technologies Ltd. - AVS Mobile Uploader.) -- C:\Program Files\Common Files\AVSMedia\MobileUploader\AVSMobileUploader.exe
O4 - GS\SendTo: AVS Video Burner.lnk . (.Online Media Technologies Ltd. - AVS Video Burner.) -- C:\Program Files\Common Files\AVSMedia\BurnerService\AVSVideoBurner.exe
O4 - GS\SendTo: AVS Video Uploader.lnk . (.Online Media Technologies Ltd. - AVS Video Uploader.) -- C:\Program Files\Common Files\AVSMedia\VideoUploader\AVSVideoUploader.exe
O4 - GS\SendTo: Format Factory.lnk . (.Free Time - FormatFactory.) -- C:\Program Files\FreeTime\FormatFactory\FormatFactory.exe
O4 - GS\SendTo: Skype.lnk . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe
O4 - GS\Desktop: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe http://www.google.com
O4 - GS\Desktop: Ordinateur - Raccourci.lnk - Clé orpheline
O4 - GS\Desktop: Spotify.lnk . (.Spotify Ltd - Spotify.) -- C:\Program Files\Spotify\spotify.exe
~ Global Startup: Scanned in 00mn 00s



---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} . (.Microsoft Corporation - Windows Live Messenger Companion core resources.) -- C:\Program Files\Windows Live\Companion\companionres.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} . (.Microsoft Corporation - Windows Live Writer Blog This Extension.) -- C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft Office OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} ((no name)) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
~ Objets ActiveX: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E784850-B1EA-4FED-87F6-96EAEADF33C0}: DhcpNameServer = 212.73.32.3 212.73.32.67
O17 - HKLM\System\CCS\Services\Tcpip\..\{9EA580CE-A358-46EC-8E17-B0DDA707A004}: DhcpNameServer = 212.73.32.3 212.73.32.67
O17 - HKLM\System\CCS\Services\Tcpip\..\{BB6E453A-3210-48E0-8E74-E168276EDFDC}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{D6257A90-ED9E-47ED-B5E9-00A3BCBD1928}: DhcpNameServer = 212.73.32.3 212.73.32.67
O17 - HKLM\System\CS1\Services\Tcpip\..\{7E784850-B1EA-4FED-87F6-96EAEADF33C0}: DhcpNameServer = 212.73.32.3 212.73.32.67
O17 - HKLM\System\CS1\Services\Tcpip\..\{9EA580CE-A358-46EC-8E17-B0DDA707A004}: DhcpNameServer = 212.73.32.3 212.73.32.67
O17 - HKLM\System\CS1\Services\Tcpip\..\{BB6E453A-3210-48E0-8E74-E168276EDFDC}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{D6257A90-ED9E-47ED-B5E9-00A3BCBD1928}: DhcpNameServer = 212.73.32.3 212.73.32.67
O17 - HKLM\System\CS2\Services\Tcpip\..\{7E784850-B1EA-4FED-87F6-96EAEADF33C0}: DhcpNameServer = 212.73.32.3 212.73.32.67
O17 - HKLM\System\CS2\Services\Tcpip\..\{9EA580CE-A358-46EC-8E17-B0DDA707A004}: DhcpNameServer = 212.73.32.3 212.73.32.67
O17 - HKLM\System\CS2\Services\Tcpip\..\{BB6E453A-3210-48E0-8E74-E168276EDFDC}: DhcpNameServer = 109.0.66.20 109.0.66.10
O17 - HKLM\System\CS2\Services\Tcpip\..\{D6257A90-ED9E-47ED-B5E9-00A3BCBD1928}: DhcpNameServer = 212.73.32.3 212.73.32.67
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (.Microsoft Corporation - Windows Live Album Download Protocol Handle.) -- C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.dll
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s



---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\Windows\System32\browseui.dll
~ STS/SSO: Scanned in 00mn 00s



---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: MyWinLocker Service (MWLService) . (.Egis Technology Inc. - MyWinLocker Service.) - C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
O23 - Service: Acer ODD Power Service (ODDPwrSvc) . (.Acer Incorporated - ODDPwr service.) - C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
O23 - Service: Service Vodafone Mobile Broadband (VmbService) . (.Vodafone - VmbService.) - C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
O23 - Service: Wsys Service (WsysSvc) . (.Wsys Co., Ltd. - Wsys Control 1.0.0.2557.) - C:\ProgramData\eSafe\eGdpSvc.exe =>PUP.eSafeSecurity
~ Services: 19 Legitimates Filtered in 00mn 15s



---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Lyrics-Monkey Update.job [376] =>Adware.AddLyrics
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-chromeinstaller.job [1846] =>Adware.Pricora
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-codedownloader.job [1160] =>Adware.Pricora
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-enabler.job [1060] =>Adware.Pricora
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-firefoxinstaller.job [1772] =>Adware.Pricora
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-updater.job [1156] =>Adware.Pricora
[MD5.00000000000000000000000000000000] [APT] [Desk 365 RunAsStdUser] (...) -- C:\Program Files\Desk 365\desk365.exe (.not file.) [0] =>Hijacker.22Find
[MD5.71D490C463014E4FB88B8CBA700B111E] [APT] [EPUpdater] (...) -- C:\users\user\AppData\Roaming\BabSolution\Shared\BabMaint.exe [4608] =>Hijacker.BabSolution
[MD5.F0742FC356771BDFCBCFD4E234EC28E4] [APT] [Lyrics-Monkey Update] (.LyricsMonkey WebSoft.) -- C:\Program Files\Lyrics_Monkey\LyrMonkeyUpd.exe [235520] =>Adware.AddLyrics
[MD5.3102F06AE7F530BA7A1ED79E1CF5A03D] [APT] [Motorola Device Manager Engine] (...) -- C:\Program Files\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [196504]
[MD5.3102F06AE7F530BA7A1ED79E1CF5A03D] [APT] [Motorola Device Manager Initial Update] (...) -- C:\Program Files\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [196504]
[MD5.3102F06AE7F530BA7A1ED79E1CF5A03D] [APT] [Motorola Device Manager Update] (...) -- C:\Program Files\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [196504]
[MD5.59BE5C8AD4758A4405E13BCE1D3BE665] [APT] [Pricora-chromeinstaller] (.Corporate Inc.) -- C:\Program Files\Pricora\Pricora-chromeinstaller.exe [460800] =>Adware.Pricora
[MD5.DAA7EAAEEB67125192A16FCCE7EEDD9D] [APT] [Pricora-codedownloader] (.Corporate Inc.) -- C:\Program Files\Pricora\Pricora-codedownloader.exe [476672] =>Adware.Pricora
[MD5.1696645FDB0519682C3D79DACA321A71] [APT] [Pricora-enabler] (.Corporate Inc.) -- C:\Program Files\Pricora\Pricora-enabler.exe [342528] =>Adware.Pricora
[MD5.D724F163E9FE2848318E0807B3CE563D] [APT] [Pricora-firefoxinstaller] (.Corporate Inc.) -- C:\Program Files\Pricora\Pricora-firefoxinstaller.exe [722432] =>Adware.Pricora
[MD5.38D5A3A91582699F43193E3D754DECE9] [APT] [Pricora-updater] (.Corporate Inc.) -- C:\Program Files\Pricora\Pricora-updater.exe [362496] =>Adware.Pricora
[MD5.00000000000000000000000000000000] [APT] [Scheduled Update for Ask Toolbar] (...) -- C:\Program Files\Ask.com\UpdateTask.exe (.not file.) [0] =>Toolbar.Ask
[MD5.00000000000000000000000000000000] [APT] [{976BE768-3540-4257-B341-3940B5401BEE}] (...) -- F:\setup.exe (.not file.) [0]
~ Scheduled Task: 52 Legitimates Filtered in 00mn 05s



---\\ Pilotes lancés au démarrage (O41)
O41 - Driver: (mwlPSDFilter) . (.Egis Incorporated. - PSD Filter Driver.) - C:\Windows\System32\DRIVERS\mwlPSDFilter.sys
O41 - Driver: (mwlPSDNServ) . (.Egis Incorporated. - MyWinLocker PSD Named Pipe Driver.) - C:\Windows\System32\DRIVERS\mwlPSDNServ.sys
O41 - Driver: (mwlPSDVDisk) . (.Egis Incorporated. - MyWinLocker PSD Virtual Disk Driver.) - C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys
~ Drivers: 66 Legitimates Filtered in 00mn 00s



---\\ Logiciels installés (O42)
O42 - Logiciel: Pricora - (.Corporate Inc.) [HKLM] -- Pricora =>Adware.Pricora
O42 - Logiciel: Wsys Control 1.0.0.2557 - (.Wsys Co., Ltd..) [HKLM] -- WsysControl =>PUP.eSafeSecurity
~ Logic: 127 Legitimates Filtered in 00mn 02s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\AppDataLow\Software\Lyrics_Monkey] =>Adware.AddLyrics
[HKCU\Software\AppDataLow\Software\Pricora] =>Adware.Pricora
[HKCU\Software\IncrediMail]
[HKCU\Software\LERTDMon]
[HKCU\Software\MSOLoad]
[HKCU\Software\Scr]
[HKCU\Software\delta LTD]
[HKCU\Software\fAfvfSfP [fVf#f" fEfBfU [fh'Å ¶ ¬'³'ê'½f [fJf< fAfvfSfP [fVf#f"]
[HKLM\Software\IncrediMail]
[HKLM\Software\eSafeSecControl] =>PUP.eSafeSecurity
~ Key Software: 229 Legitimates Filtered in 00mn 02s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 07/07/2009 - 23:49:03 - [15,047] ----D C:\Program Files\Convesoft =>PUP.Convesoft
O43 - CFD: 24/07/2013 - 19:44:32 - [0,000] ----D C:\Program Files\LimeWire
O43 - CFD: 24/07/2013 - 18:50:07 - [1,117] ----D C:\Program Files\Lyrics_Monkey =>Adware.AddLyrics
O43 - CFD: 24/07/2013 - 18:40:54 - [7,484] ----D C:\Program Files\Pricora =>Adware.Pricora
O43 - CFD: 19/02/2013 - 08:51:45 - [2,201] ----D C:\Program Files\StartNow Toolbar =>Adware.Zugo
O43 - CFD: 22/08/2012 - 14:37:16 - [0,006] ----D C:\ProgramData\6F638C1A000D2207F28519052F3B707C
O43 - CFD: 01/08/2013 - 19:47:38 - [0,414] ----D C:\ProgramData\eSafe
O43 - CFD: 27/06/2012 - 01:00:28 - [1,694] ----D C:\ProgramData\InstallMate
O43 - CFD: 27/06/2012 - 01:00:15 - [0,000] ----D C:\ProgramData\OptimizerPro =>PUP.OptimizerPro
O43 - CFD: 14/04/2011 - 00:37:57 - [0] ----D C:\Users\user\AppData\Roaming\Axeddy
O43 - CFD: 24/07/2013 - 18:41:51 - [1,630] ----D C:\Users\user\AppData\Roaming\BabSolution =>Hijacker.BabSolution
O43 - CFD: 24/05/2012 - 20:11:46 - [0,010] ----D C:\Users\user\AppData\Roaming\Babylon =>Toolbar.Babylon
O43 - CFD: 24/05/2012 - 20:11:55 - [0,467] ----D C:\Users\user\AppData\Roaming\Complitly =>Adware.PredictAd
O43 - CFD: 29/07/2013 - 19:48:25 - [0,259] ----D C:\Users\user\AppData\Roaming\Delta
O43 - CFD: 24/07/2013 - 18:49:40 - [5,187] ----D C:\Users\user\AppData\Roaming\eIntaller
O43 - CFD: 14/04/2011 - 04:08:56 - [4,265] ----D C:\Users\user\AppData\Roaming\Kiuv
O43 - CFD: 27/11/2012 - 01:15:15 - [24,348] ----D C:\Users\user\AppData\Roaming\OpenCandy =>Adware.OpenCandy
O43 - CFD: 29/08/2012 - 11:30:52 - [0,032] ----D C:\Users\user\AppData\Roaming\StartNow Toolbar =>Adware.Zugo
O43 - CFD: 24/07/2013 - 18:43:49 - [0,039] ----D C:\Users\user\AppData\Roaming\WebPlayerBdd =>Adware.SocialSkinz
O43 - CFD: 04/02/2012 - 21:09:40 - [3,363] ----D C:\Users\user\AppData\Local\AskToolbar
O43 - CFD: 06/12/2011 - 22:54:07 - [0] ----D C:\Users\user\AppData\Local\nyrfmuux
O43 - CFD: 31/05/2012 - 22:58:56 - [14,523] ----D C:\Users\user\AppData\Local\{2D225037-C0D0-43C8-B342-97DBD5107324}
O43 - CFD: 18/08/2012 - 12:00:52 - [0,002] ----D C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum
~ 1 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 259 Legitimates Filtered in 00mn 09s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.7F245D6769A4C4270228FC4474093CF2] - 01/08/2013 - 18:39:07 ---A- . (...) -- C:\Windows\DeleteOnReboot.bat [166]
~ Files: 31 Legitimates Filtered in 00mn 04s



---\\ MountPoints2 Shell Key (O51)
O51 - MPSK:{13e304d6-a834-11e1-95d1-001f16af7e5e}\AutoRun\command. (...) -- D:\setup_vmb_lite.exe (.not file.)
O51 - MPSK:{13e304dd-a834-11e1-95d1-001e101f5adc}\AutoRun\command. (...) -- D:\setup_vmb_lite.exe (.not file.)
O51 - MPSK:{1e31e120-e59c-11df-a96a-001f16af7e5e}\AutoRun\command - Clé orpheline
O51 - MPSK:{56a13037-e819-11de-9c23-001f16af7e5e}\AutoRun\command. (...) -- C:\Windows\system32\USB2.0.exe (.not file.)
O51 - MPSK:{71165eef-be3c-11de-8afa-0022fb5c6f9e}\AutoRun\command. (...) -- E:\StartVMCLite.exe (.not file.)
O51 - MPSK:{71165ef1-be3c-11de-8afa-0022fb5c6f9e}\AutoRun\command. (...) -- E:\StartVMCLite.exe (.not file.)
O51 - MPSK:{7c750d35-567b-11e2-bd2d-001f16af7e5e}\AutoRun\command. (...) -- D:\MotorolaDeviceManagerSetup.exe (.not file.)
O51 - MPSK:{977a8447-afa9-11e1-9835-001e101f2c0e}\AutoRun\command. (...) -- D:\setup_vmb_lite.exe (.not file.)
O51 - MPSK:{9eb0b706-f96a-11de-81aa-001f16af7e5e}\AutoRun\command. (...) -- G:\LaunchU3.exe (.not file.)
O51 - MPSK:{ac8421ba-885d-11df-9870-001f16af7e5e}\AutoRun\command. (...) -- C:\Windows\system32\D:\kav6.0.1.411en (.not file.)
O51 - MPSK:{df75e151-acf9-11e1-af1d-001e101f3315}\AutoRun\command. (...) -- D:\setup_vmb_lite.exe (.not file.)
O51 - MPSK:{f898665b-f1bc-11de-906f-001f16af7e5e}\AutoRun\command. (...) -- E:\Launcher.exe (.not file.)
~ Keys: Scanned in 00mn 00s



---\\ Microsoft Windows Policies System (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s



---\\ Liste des Drivers Système (O58)
O58 - SDL:[MD5.04F0FCAC69C7C71A3AC4EB97FAFC8303] - 21/01/2008 - 03:23:21 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [422968]
O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 02/11/2006 - 08:09:42 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029]
~ Drivers: Scanned in 00mn 00s



---\\ Liste des outils de nettoyage (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
~ ADS: Scanned in 00mn 00s



---\\ Liste des services Legacy (O64)
O64 - Services: CurCS - ??\??\???? - Pas de propriétaire (Profos) .(...) - LEGACY_PROFOS
~ Legacy: 135 Legitimates Filtered in 00mn 08s



---\\ Start Menu Internet (O68)
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s



---\\ Search Browser Infection (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {67A2568C-7A0A-4EED-AECC-B5405DE63B64} - (Google) - http://www.google.com
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {c1d89ae7-449d-4929-b24b-fded04adbe06} - (Glary Search) - http://isearch.glarysoft.com
~ Keys: Scanned in 00mn 00s



---\\ Recherche particuliere à la racine de certains dossiers (O84)
[MD5.C92254D0429A413FBA9EAF4DFCC64287] [SPRF][07/02/2010] (...) -- C:\ProgramData\ezsidmv.dat [56]
[MD5.741814AB826C3DF2DEA027BCB64B13CE] [SPRF][08/04/2013] (...) -- C:\Users\user\AppData\Local\d3d9caps.dat [1356]
[MD5.3E581E049826FEDCEBC3F8EF4164C938] [SPRF][19/01/2010] (...) -- C:\Users\user\AppData\Roaming\wklnhst.dat [266]
[MD5.FE9176A1C2B4A81AFDE6EDD74A6A1DEE] [SPRF][27/10/2009] (.Adobe Systems Incorporated - Adobe® Flash® Player ActiveX Installer.) -- C:\Windows\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe [1956816]
~ Files: Scanned in 00mn 00s



---\\ Recherche d'infection Rogue (O86)
O43 - CFD: 22/08/2012 - 14:37:16 - [0,006] ----D C:\ProgramData\6F638C1A000D2207F28519052F3B707C
~ Files: Scanned in 00mn 00s



---\\ Firewall Active Exception List (FirewallRules) (O87)
O87 - FAEL: "{EFD44065-1530-42B2-B9C6-8B8554AE88BE}" |In - Public - P6 - TRUE | .(...) -- C:\Users\user\AppData\Local\Temp\{8E056043-A278-4DFD-8009-C5E02BC989F2}\{63B9BAB5-F36A-4A3B-9E5C-68A7F212BFB9}\CinergyDvrHelper.exe (.not file.)
O87 - FAEL: "{3667DD9E-9466-453C-860F-BBDB650A8727}" |In - Public - P17 - TRUE | .(...) -- C:\Users\user\AppData\Local\Temp\{8E056043-A278-4DFD-8009-C5E02BC989F2}\{63B9BAB5-F36A-4A3B-9E5C-68A7F212BFB9}\CinergyDvrHelper.exe (.not file.)
O87 - FAEL: "{9CF8C013-200F-4C16-B6B7-31215D561194}" | In - Private - P6 - TRUE | .(.Magix AG - UPnPService Module.) -- C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
O87 - FAEL: "{8E9B30E5-0789-4EC4-8CC3-42E8E52D3EB9}" | In - Private - P17 - TRUE | .(.Magix AG - UPnPService Module.) -- C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
O87 - FAEL: "{810649B3-9F3D-4647-B13C-25CA682A7EE0}" | In - Public - P6 - TRUE | .(.Magix AG - UPnPService Module.) -- C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
O87 - FAEL: "{32322B76-6461-4A8E-A038-10269AD758E2}" | In - Public - P17 - TRUE | .(.Magix AG - UPnPService Module.) -- C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
O87 - FAEL: "TCP Query User{384D2974-594B-4A06-8D72-B84FB591B14D}C:\program files\limewire\limewire.exe" |In - Private - P6 - TRUE | .(...) -- C:\program files\limewire\limewire.exe (.not file.)
O87 - FAEL: "UDP Query User{9AEFFD55-F806-45E7-9D47-1A0BCDEAA39D}C:\program files\limewire\limewire.exe" |In - Private - P17 - TRUE | .(...) -- C:\program files\limewire\limewire.exe (.not file.)
O87 - FAEL: "{2C4E4837-D939-4D1D-B71F-C7CBA1DA7B9B}" | In - Private - P6 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe
O87 - FAEL: "{D84D8F61-DDA1-42DA-B41A-C0B8E1F56A8D}" | In - Private - P17 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe
O87 - FAEL: "{C0C0D579-F027-49C0-B3DF-CC868170749D}" | In - Public - P6 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe
O87 - FAEL: "{5E6CF0A9-32DF-48BF-96EE-B000D8626B69}" | In - Public - P17 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe
O87 - FAEL: "{81804FE1-3C5C-4EAE-9DCF-1F9B9DE39590}" | In - Public - P6 - TRUE | .(.Wsys Co., Ltd. - Wsys Control 1.0.0.2557.) -- C:\ProgramData\eSafe\eGdpSvc.exe =>PUP.eSafeSecurity
~ Firewall: 271 Legitimates Filtered in 00mn 06s



---\\ Product Upgrade Codes (O90)
O90 - PUC: "A54E164E84B2AF24091EF6638DD51F10" . (.Bing Bar.) -- C:\Windows\Installer\{E461E45A-2B48-42FA-90E1-6F36D85DF101}\icon_installer_ico =>Toolbar.Bing
~ Update Products: 155 Legitimates Filtered in 00mn 00s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 18/12/2012 65192 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 01/08/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 15/06/2009 176128 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 27/02/2012 55144 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SS - | Auto 02/04/2013 193672 | (BBSvc) . (.Microsoft Corporation..) - C:\Program Files\Microsoft\BingBar\7.2.233.0\BBSvc.exe
SR - | Demand 02/04/2013 240264 | (BBUpdate) . (.Microsoft Corporation..) - C:\Program Files\Microsoft\BingBar\7.2.233.0\SeaPort.exe
SR - | Auto 30/08/2011 390504 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Auto 11/04/2009 117256 | (DsiWMIService) . (.Dritek System Inc..) - C:\Program Files\Launch Manager\dsiwmis.exe
SR - | Auto 15/05/2009 703008 | (ePowerSvc) . (.Acer Incorporated.) - C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
SR - | Auto 03/02/2009 1155072 | (Fabs) . (.MAGIX AG.) - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
SS - | Demand 07/08/2008 3276800 | (FirebirdServerMAGIXInstance) . (.MAGIX®.) - C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe
SS - | Auto 04/10/2010 135664 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 04/10/2010 135664 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 08/02/2011 136120 | (gusvc) . (.Google.) - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
SR - | Auto 12/02/2009 354840 | (IAANTMON) . (.Intel Corporation.) - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
SR - | Demand 06/03/2012 821608 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SR - | Auto 120728 | (Motorola Device Manager) . (...) - C:\Program Files\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
SS - | Demand 16/07/2013 117144 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
SR - | Auto 14/05/2009 305448 | (MWLService) . (.Egis Technology Inc..) - C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
SR - | Auto 26/05/2009 62208 | (NTI IScheduleSvc) . (.NewTech Infosystems, Inc..) - C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
SS - | Demand 23/09/2008 50424 | (NTIBackupSvc) . (.NewTech InfoSystems, Inc..) - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
SR - | Auto 23/09/2008 144632 | (NTISchedulerSvc) . (.NewTech Infosystems, Inc..) - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
SR - | Auto 29/04/2009 118784 | (ODDPwrSvc) . (.Acer Incorporated.) - C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
SR - | Auto 02/09/2011 65657 | (PST Service) . (.Motorola.) - C:\Program Files\Motorola\MotForwardDaemon\ForwardDaemon.exe
SR - | Auto 05/02/2009 237568 | (RS_Service) . (.Acer Incorporated.) - C:\Program Files\Acer\Acer VCM\RS_Service.exe
SS - | Auto 28/02/2013 161384 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe
SS - | Demand 21/10/2008 548864 | (UPnPService) . (.Magix AG.) - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
SR - | Auto 28/04/2010 9216 | (VmbService) . (.Vodafone.) - C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
SS - | Auto 21/01/2008 21504 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 24/07/2013 376896 | (WsysSvc) . (.Wsys Co., Ltd..) - C:\ProgramData\eSafe\eGdpSvc.exe =>PUP.eSafeSecurity
SR - | Auto 21/01/2008 21504 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 04s



---\\ Scan Additionnel (O88)
Database Version : v2.12805 - (30/07/2013)
Clés trouvées (Keys found) : 25
Valeurs trouvées (Values found) : 2
Dossiers trouvés (Folders found) : 24
Fichiers trouvés (Files found) : 22

[HKLM\Software\Google\Chrome\Extensions\algmakeomkafjglfhpomolfhjppoojff] =>Adware.Pricora^
[HKLM\Software\Google\Chrome\Extensions\bbahlibdkigfcalmedmoegpamcmldpbe] =>Adware.JustPlugIt^
[HKLM\Software\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd] =>Adware.IncrediBar^
[HKLM\Software\Google\Chrome\Extensions\eooncjejnppfjjklapaamhcdmjbilmde] =>Toolbar.DeltaSearch^
[HKLM\Software\Google\Chrome\Extensions\incfcgceegpikennjoplhfghaaikdgei] =>Adware.Zugo^
[HKLM\Software\Google\Chrome\Extensions\khialnikbocfgkohdegnebhmmaifoglp] =>Adware.AddLyrics^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{69C0E130-9F25-437B-9522-192970C0D4FA}] =>Adware.AddLyrics^
[HKLM\SYSTEM\CurrentControlSet\Services\WsysSvc] =>PUP.eSafeSecurity^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pricora] =>Adware.Pricora^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\WsysControl] =>PUP.eSafeSecurity^
[HKCU\Software\delta LTD] =>Toolbar.DeltaSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{5B63A470-9334-44D1-AF61-6CE2DB565AE9}] =>PUP.Convesoft
[HKCU\Software\MSOLoad] =>Trojan.Agent
[HKLM\Software\Classes\Installer\Features\074A36B543391D44FA16C62EBD65A59E] =>PUP.Convesoft
[HKLM\Software\Classes\Installer\Products\074A36B543391D44FA16C62EBD65A59E] =>PUP.Convesoft
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\074A36B543391D44FA16C62EBD65A59E] =>PUP.Convesoft
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Glarysoft Toolbar_is1] =>Toolbar.Glarysoft
[HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\desksvc] =>Hijacker.22find
[HKLM\Software\eSafeSecControl] =>PUP.eSafeSecurity
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\464AA55239C100F32AF2D438EDDC0F47] =>Adware.IMBooster
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5652BA3D5FB98AE31B337BF0AF939856] =>Adware.IMBooster
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EB95E1AFCBABE3DB9ECCC669B99494] =>Adware.IMBooster
[HKCU\Software\LERTDMon] =>Trojan.Asprox
[HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc] =>PUP.eSafeSecurity
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311531129}] =>PUP.CrossRider
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{8dcb7100-df86-4384-8842-8fa844297b3f} =>Toolbar.Bing^
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:NTRedirect =>Hijacker.BabSolution^
C:\Program Files\Convesoft =>PUP.Convesoft^
C:\Program Files\Lyrics_Monkey =>Adware.AddLyrics^
C:\Program Files\Pricora =>Adware.Pricora^
C:\Program Files\StartNow Toolbar =>Adware.Zugo^
C:\ProgramData\OptimizerPro =>PUP.OptimizerPro^
C:\Users\user\AppData\Roaming\BabSolution =>Hijacker.BabSolution^
C:\Users\user\AppData\Roaming\Babylon =>Toolbar.Babylon^
C:\Users\user\AppData\Roaming\Complitly =>Adware.PredictAd^
C:\Users\user\AppData\Roaming\OpenCandy =>Adware.OpenCandy^
C:\Users\user\AppData\Roaming\StartNow Toolbar =>Adware.Zugo^
C:\Users\user\AppData\Roaming\WebPlayerBdd =>Adware.SocialSkinz^
C:\ProgramData\InstallMate =>Toolbar.Tarma
C:\Users\user\AppData\Roaming\eIntaller =>PUP.eSafeSecurity
C:\Users\user\AppData\Local\AskToolbar =>Toolbar.AskTBar
C:\Users\user\AppData\LocalLow\AskToolbar =>Toolbar.AskTBar
C:\Users\user\AppData\LocalLow\BabylonToolbar =>Toolbar.Babylon
C:\Users\user\AppData\LocalLow\Conduit =>Toolbar.Conduit
C:\Users\user\AppData\LocalLow\PriceGong =>Adware.PriceGong
C:\Users\user\AppData\LocalLow\Softonic_France =>Toolbar.Conduit
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlfienamagdnkekbbbocojppncdambda =>Adware.PredictAd
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde =>Toolbar.DeltaSearch
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\khialnikbocfgkohdegnebhmmaifoglp =>Adware.AddLyrics
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\incfcgceegpikennjoplhfghaaikdgei =>Adware.Zugo
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\algmakeomkafjglfhpomolfhjppoojff =>Adware.Pricora
C:\ProgramData\eSafe\eGdpSvc.exe =>PUP.eSafeSecurity^
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbahlibdkigfcalmedmoegpamcmldpbe =>Adware.JustPlugIt^
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd =>Adware.IncrediBar^
C:\Program Files\Lyrics_Monkey\125.dll =>Adware.AddLyrics^
C:\Program Files\Microsoft\BingBar\7.2.233.0\BingExt.dll =>Toolbar.Bing^
C:\Users\user\AppData\Roaming\BabSolution\Shared\NTRedirect.dll =>Hijacker.BabSolution^
C:\Windows\Tasks\Lyrics-Monkey Update.job =>Adware.AddLyrics^
C:\Windows\Tasks\Pricora-chromeinstaller.job =>Adware.Pricora^
C:\Windows\Tasks\Pricora-codedownloader.job =>Adware.Pricora^
C:\Windows\Tasks\Pricora-enabler.job =>Adware.Pricora^
C:\Windows\Tasks\Pricora-firefoxinstaller.job =>Adware.Pricora^
C:\Windows\Tasks\Pricora-updater.job =>Adware.Pricora^
C:\users\user\AppData\Roaming\BabSolution\Shared\BabMaint.exe =>Hijacker.BabSolution^
C:\Program Files\Lyrics_Monkey\LyrMonkeyUpd.exe =>Adware.AddLyrics^
C:\Program Files\Pricora\Pricora-chromeinstaller.exe =>Adware.Pricora^
C:\Program Files\Pricora\Pricora-codedownloader.exe =>Adware.Pricora^
C:\Program Files\Pricora\Pricora-enabler.exe =>Adware.Pricora^
C:\Program Files\Pricora\Pricora-firefoxinstaller.exe =>Adware.Pricora^
C:\Program Files\Pricora\Pricora-updater.exe =>Adware.Pricora^
[HKCU\Software\AppDataLow\Software\Lyrics_Monkey] =>Adware.AddLyrics^
[HKCU\Software\AppDataLow\Software\Pricora] =>Adware.Pricora^
C:\Windows\Installer\{E461E45A-2B48-42FA-90E1-6F36D85DF101}\icon_installer_ico =>Toolbar.Bing^
~ Additionnel Scan: 346737 Items scanned in 01mn 21s



---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com/apps/blog/show/27588628-pup-esafesecurity =>PUP.eSafeSecurity
~ http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon =>Toolbar.Babylon
~ http://nicolascoolman.webs.com/apps/blog/show/29294184-adware-pricora =>Adware.Pricora
~ http://nicolascoolman.webs.com/apps/blog/show/26764545-adware-justplugit =>Adware.JustPlugIt
~ http://nicolascoolman.webs.com/apps/blog/show/26898222-adware-incredibar =>Adware.Incredibar
~ http://nicolascoolman.webs.com/apps/blog/show/27875657-toolbar-deltasearch =>Toolbar.DeltaSearch
~ http://nicolascoolman.webs.com/apps/blog/show/26828293-adware-zugo =>Adware.Zugo
~ http://nicolascoolman.webs.com/apps/blog/show/26601058-adware-addlyrics =>Adware.AddLyrics
~ http://nicolascoolman.webs.com/apps/blog/show/26678994-hijacker-babsolution =>Hijacker.BabSolution
~ http://nicolascoolman.webs.com/apps/blog/show/26631242-hijacker-qvo6 =>Hijacker.Qvo6
~ http://nicolascoolman.webs.com/apps/blog/show/26630379-hijacker-22find =>Hijacker.22Find
~ http://nicolascoolman.webs.com/apps/blog/show/28927746-toolbar-ask =>Toolbar.Ask
~ http://nicolascoolman.webs.com/apps/blog/show/31039710-pup-convesoft =>PUP.Convesoft
~ http://nicolascoolman.webs.com/apps/blog/show/28204239-pup-optimizerpro =>PUP.OptimizerPro
~ http://nicolascoolman.webs.com/apps/blog/show/27229962-adware-predictad =>Adware.PredictAd
~ http://nicolascoolman.webs.com/apps/blog/show/26770694-adware-opencandy =>Adware.OpenCandy
~ http://nicolascoolman.webs.com/apps/blog/show/27480243-adware-socialskinz =>Adware.SocialSkinz
~ http://nicolascoolman.webs.com/apps/blog/show/26684723-adware-imbooster =>Adware.IMBooster
~ http://nicolascoolman.webs.com/apps/blog/show/27583526-pup-crossrider =>PUP.CrossR

il est incomplet , du fait du nombre de ligne
et pour nous , on ne peut pas le sélectionner

> Pour faire parvenir ce rapport, rends toi sur ce site : https://www.cjoint.com/
ou sur http://pjjoint.malekal.com/

* Clique sur "parcourir" et va jusqu'au rapport ZHPDiag.txt qui est sauvegardé sur le bureau .
* Clique ensuite sur "cliquer ici pour déposer le fichier" et patiente ...
* Une fois l'upload finit , un lien en bleu apparait > copie/colle le dans ta prochaine réponse

tu as cliqué sur la première loupe avec le moins

tu fais de la navigation par téléphone en Espagne ?

tu as installé un screensaver (.scr ) ???
pour utiliser de la ressource => oui

tu te sers de eSafe ???
c'est pour la protection des données ?

tu as un logiciel du nom de Delta ???
ce qui correspondrait à https://www.deltaww.com/tw/

oui ca m'est arrivé de faire de la navigation par telephone en Espagne.. mais je n'en referais pas avant plusieurs mois. Je ne sais pas ce qu'est un screensaver, donc j'en ai peut étre installé un mais ca serait sans le vouloir. Je ne me suis jamais servit d'esafe. Pour ce qui est de Delta je n'ai aucun logiciel de ce nom, en revanche parfois quand je me connecte à internet en utilisant mozilla la page de garde a delta dans son adresse.. ca ressemble un peu à google, sauf qu'il y'a un logo avec une grenouille et l'adresse n'est pas la même..

celui-ci est mieux
https://www.cjoint.com/c/CHfbvMEzmPA


as-tu ce ZHPDiag ???
http://www.forum-entraide-informatique.com/support/zhpdiag-tutoriel-t4831.html

tu peux refaire un rapport , stp

tu as cliqué directement sur "RECHERCHER"

tu en réinstalles là
_______________________________________________________________

refait un AdwCleaner (merci à Xplode)
http://general-changelog-team.fr/fr/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner
Ferme tous tes programmes
Lance AdwCleaner
Cliques sur le bouton Suppression
Patiente...
redémarres le PC comme demandé
Postes le rapport qui apparait en fin de suppression.
(Le rapport est sauvegardé aussi sous C:\ AdwCleaner[SX].Txt)
_______________________________________________________________

faire un ZHP Fix = http://www.premiumorange.com/zeb-help-process/zhpfix.html

Copie tout le texte présent en gras ci-dessous ( tu le sélectionnes avec ta souris / Clique droit dessus et choisis "copier" ou fait "Ctrl + C" )

G1 - GCS: Preference [User Data\Default] http://search.babylon.com =>Toolbar.Babylon
[HKCU\Software\delta LTD]
[HKLM\Software\BabylonToolbar] =>Toolbar.Babylon
[HKLM\Software\Pricora] =>Adware.Pricora
[HKLM\Software\babylontoolbar] =>Toolbar.Babylon
O87 - FAEL: "{2C4E4837-D939-4D1D-B71F-C7CBA1DA7B9B}" | In - Private - P6 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe
O87 - FAEL: "{D84D8F61-DDA1-42DA-B41A-C0B8E1F56A8D}" | In - Private - P17 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe
O87 - FAEL: "{C0C0D579-F027-49C0-B3DF-CC868170749D}" | In - Public - P6 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe
O87 - FAEL: "{5E6CF0A9-32DF-48BF-96EE-B000D8626B69}" | In - Public - P17 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe

FirewallRAZ
EmptyCLSID
EmptyTemp
EmptyFlash

Puis Lance ZHPFix depuis le raccourci du bureau .

* Une fois l'outil ZHPFix ouvert , clique sur le 2ème bouton en haut à gauche ( "coller le presse papier" ) .

* Dans l'encadré principal tu verras donc les lignes que tu as copié précédemment apparaître .

Vérifie que toutes les lignes que je t'ai demandé de copier (et seulement elles) sont dans la fenêtre.

Clique sur le bouton GO , en bas à gauche

Copie/Colle le rapport à l'écran dans ton prochain message.
_______________________________________________________________

dans la foulée , faire au moins deux scannes en ligne ,
toutes sources externes de branchées

scanner spyware

http://www.secuser.com/antivirus/
http://www.secuser.com/outils/antivirus.htm
sur la première page , tu cliques sur l'image et les outils de diagnostique vont se charger
puis dans la fenêtre "Poste de travail" , tu sélectionnes toutes les unités et tu coches "Auto Clean"
https://www.trendmicro.com/en_us/forHome/products/housecall.html ( nécessite Java )
tu as aussi
http://assiste.com.free.fr/
http://www.bitdefender.fr/bd/site/search.php# (option Online Scanner)
tuto = https://forum.pcastuces.com/default.asp
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
sujet sur CCM : https://www.commentcamarche.net/faq/11487-61-scans-anti-malwares-en-ligne-pour-xp-vista
https://www.malekal.com/scan-antivirus-ligne-nod32/
http://security.symantec.com/sscv6/home.asp?langid=fr&venid=sym&plfid=23&pkj=JZOVBMRSJRFSKLUKUMX&bhcp=1
avec Internet Explorer , pour accepter l'installation des "activeX" , dans Outils ; Options Internet ; Sécurité ; mettre le niveau de sécurité bas
après Sites de confiance ; Sites ; décocher Exiger un serveur..."https" ; Ajouter ; Fermer , et mettre le niveau de sécurité bas , valider
relancer IE
relancer le scann ( sélection des disques ou répertoires suivant les sites )
puis une fois fait , remettre les niveaux de sécurité normaux ( possible quand le scann est démarré )
Les scan antivirus en ligne = https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId237368
_______________________________________________________________

installe WOT sur tes navigateurs pour indiquer la dangerosité des sites visités
https://chrome.google.com/webstore/detail/wot-web-of-trust-website/bhmmomiinigofkjcapegjjndpbikblnp

sélectionner son navigateur , et télécharger