PC très lent Résolu/Fermé

Question

Bonjour, 

Depuis mon retour de vacances, je trouve mon pc très lent.
J'ai fait un scan le 9 août avec Malwarebytes qui a décelé 5 fichiers infectés. Ils ont été mis en quarantaine et supprimés. Je n'ai pas vu d'amélioration.

J'ai refait un autre scan rien qui n'a rien décelé.

Je trouve que la souris ne réagit pas bien à mes clics, et les pages longues à s'afficher, la roue a côté de l'onglet ouvert tourne encore alors que la page est des fois affichée.

Que me conseillez-vous de faire ? 



Configuration: Windows XP / Firefox 23.0

2011N2 · Answer

Salut,

Tu as le rapport MBAM ?

Fais un diagnostic de ton PC avec ZHPDiag comme ceci : http://www.forum-entraide-informatique.com/support/zhpdiag-tutoriel-t4831.html

Tu me posteras le rapport hébergé sur cjoint.

Gabriel.

giadou · Answer

Voici déjà le rapport MBAM /

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Version de la base de données: v2013.08.09.04

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Sylvaine :: SYLVAINE-G [administrateur]

09/08/2013 17:00:15
mbam-log-2013-08-09 (17-00-15).txt

Type d'examen: Examen complet (C:\|G:\|)
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 280187
Temps écoulé: 2 heure(s), 59 minute(s), 41 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 5
C:\System Volume Information\_restore{454A164D-B383-4041-8448-32EDC9506595}\RP1332\A0317244.exe (PUP.Optional.OpenCandy) -> Mis en quarantaine et supprimé avec succès.
C:\WINDOWS\Installer\MSI4C0.tmp (PUP.Optional.SweetIM) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\Sylvaine\Local Settings\Temp\AskPIP_FF_.exe (PUP.Optional.BundledToolBar.A) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\Sylvaine\Local Settings\Temp\is-IPQ5D.tmp\OCSetupHlp.dll (PUP.Optional.OpenCandy) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\Sylvaine\Mes documents\Téléchargements\yosetup.exe (PUP.Optional.OpenCandy) -> Mis en quarantaine et supprimé avec succès.

(fin)

2011N2 · Answer

Re,

Ok, en attente du ZHPDiag. :)

Gabriel.

giadou · Answer

Je ne sais pas comment poursuivre l'examen avec ZHPDiag. En cours de scan à 82 % , j'ai ce message :
Windows pas de disque
Exception Processing Message c0000013Parameters 7AFBF7c
Annuler/recommencer/continuer

En cliquant sur continuer, je suis au même point, ça ne continue pas !

2011N2 · Answer

Re,

Essaye en mode sans échec avec prise en charge réseau : http://www.forum-entraide-informatique.com/support/demarrer-en-mode-sans-echec-avec-prise-en-charge-reseau-t8200.html

Gabriel.

giadou · Answer

OK, comme il se fait tard, je verrai cela demain matin.
En attendant merci pour ton aide et bonne nuit. 
A plus.

2011N2 · Answer

Pas de problème, passe une bonne nuit.

À demain,

Gabriel.

giadou · Answer

Bonjour Gabriel,

Désolée, même en mode sans échec, j'ai le même message précité.

2011N2 · Answer

Salut,

Ok je vois ça avec le développeur, je reviens dès que possible.

Gabriel.

2011N2 · Answer

Re,

Il est possible que le problème soit corrigé. Désinstalle ZHPDiag et réinstalle-le.
Puis retente pour voir ce que cela donne.

Gabriel.

giadou · Answer

Non du tout, même erreur de message

2011N2 · Answer

Re,

Tu as bien installé la nouvelle version ?
Je vais faire le retour au développeur de nouveau.

Merci pour ta patience.

Gabriel.

2011N2 · Answer

Re,

Voici une autre solution : Ouvre ZHPDiag, clique sur Configurer, clique sur Tous. Descends et décoche la case "Enumère les fichiers cracks & keygen (CKF) (O82)".
Puis tu cliques sur Rechercher.

Gabriel.

giadou · Answer

Bonjour Gabriel,

Ce matin, j'ai repris tout depuis le début.
J'ai donc bien installé la dernière version.
Quand j'ouvre ZHPDiag, j'ai deux grandes cases Rechercher et Configurer.
Quand je clique sur configurer , en bas à gauche, j'ai :
- diagnostic par défaut
- diagnostic toutes options
 -diagnostic par défaut avec légitimes
à droite, je vois :
- ZHP Search
- ZHP Diag
- Accéder aux options
- Période de recherche
- Sélectionner une langue
Quand j'ai cliqué dans accéder aux options, j'ai vu que la case Énumère les fichiers cracks était bien décochée
J'ai refait le scan, avec hélas le même résultat.

2011N2 · Answer

Bonjour,

C'est étrange ça. Après avoir tout coché sauf la O82, tu cliques bien sur la grosse case Rechercher (et non sur la loupe la plus à droite) ? Et lorsque tu as le message d'erreur c'est encore à 82% ?

Retente en faisant comme ceci, sinon procède ainsi :

Désinstalle puis réinstalle ZHPDiag, ouvre-le et clique directement sur Rechercher.

Gabriel.

giadou · Answer

Là ça a fonctionné, voici le rapport : ~ Rapport de ZHPDiag v2013.8.17.25 - Nicolas Coolman (17/08/2013) ~ Lancé par Sylvaine (18/08/2013 12:24:38) ~ Adresse du Site Web https://nicolascoolman.webs.com/ ~ Traduit par Nicolas Coolman ~ Etat de la version : Version à jour. ~ Liste blanche : Activée par le programme ~ Elévation des Privilèges : OK ~ User Account Control (UAC): Not Found ---\ Navigateurs Internet MSIE: Internet Explorer v8.0.6001.18702 MFIE: Mozilla Firefox 23.0.1 (Defaut) ---\ Informations sur les produits Windows ~ Langage: Français Windows XP Professional Service Pack 3 (Build 2600) Windows Automatic Updates : OK Windows Genuine Advantage : OK ---\ Logiciels de protection du système avast! Free Antivirus v8.0.1489.0 Malwarebytes Anti-Malware version 1.75.0.1300 ---\ Logiciels d'optimisation du système CCleaner v4.04 =>Piriform Ltd ---\ Logiciels de partage PeerToPeer ---\ Surveillance de Logiciels Adobe Flash Player 11 Plugin Adobe Reader XI Java 7 Update 25 ---\ Informations sur le système ~ Processor: x86 Family 15 Model 2 Stepping 9, GenuineIntel ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 767 MB (55% free) System Restore: Activé (Enable) System drive C: has 47 GB (60%) free of 78 GB ---\ Mode de connexion au système ~ Computer Name: SYLVAINE-G ~ User Name: Sylvaine ~ All Users Names: Sylvaine, SUPPORT_388945a0, HelpAssistant, Administrateur, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\ Variables d'environnement ~ System Unit : C:\ ~ %AppData% : C:\Documents and Settings\Sylvaine\Application Data\ ~ %Desktop% : C:\Documents and Settings\Sylvaine\Bureau\ ~ %Favorites% : C:\Documents and Settings\Sylvaine\Favoris\ ~ %LocalAppData% : C:\Documents and Settings\Sylvaine\Local Settings\Application Data\ ~ %StartMenu% : C:\Documents and Settings\Sylvaine\Menu Démarrer\ ~ %Windir% : C:\WINDOWS\ ~ %System% : C:\WINDOWS\system32\ ---\ Enumération des unités disques A:\ Floppy drive, Flash card reader, USB Key (Not Inserted) C:\ Hard drive, Flash drive, Thumb drive (Free 47 Go of 78 Go) D:\ CD-ROM drive (Not Inserted) E:\ CD-ROM drive (Not Inserted) F:\ Hard drive, Flash drive, Thumb drive (Free 49 Go of 49 Go) G:\ Hard drive, Flash drive, Thumb drive (Free 450 Go of 466 Go) H:\ Hard drive, Flash drive, Thumb drive (Free 39 Go of 39 Go) I:\ Hard drive, Flash drive, Thumb drive (Free 32 Go of 32 Go) J:\ Hard drive, Flash drive, Thumb drive (Free 79 Go of 79 Go) M:\ Floppy drive, Flash card reader, USB Key (Not Inserted) N:\ Floppy drive, Flash card reader, USB Key (Not Inserted) O:\ Hard drive, Flash drive, Thumb drive (Free 17 Go of 21 Go) ---\ Etat du Centre de Sécurité Windows [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date ~ Security Center: 33 Legitimates Filtered in 00mn 00s ---\ Recherche particulière de fichiers génériques [MD5.F2317622D29F9FF0F88AEECD5F60F0DD] - (.Microsoft Corporation - Explorateur Windows.) (.14/04/2008 - 03:34:03.) -- C:\WINDOWS\Explorer.exe [1037824] [MD5.E1948293F7CBC38987270432935D8D05] - (.Microsoft Corporation - Internet Extensions for Win32.) (.26/07/2013 - 03:47:15.) -- C:\WINDOWS\system32\wininet.dll [920064] [MD5.DD73D6B9F6B4CB630CF35B438B540174] - (.Microsoft Corporation - Application d'ouverture de session Windows NT.) (.14/04/2008 - 03:34:28.) -- C:\WINDOWS\system32\Winlogon.exe [512000] [MD5.1E44BC1E83D8FD2305F8D452DB109CF9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.17/08/2011 - 14:49:54.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496] [MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.13/04/2008 - 19:40:30.) -- C:\WINDOWS\system32\Drivers\atapi.sys [96512] [MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/04/2008 - 20:14:21.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744] [MD5.1F4260CC5B42272D71F79E570A27A4FE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.13/04/2008 - 19:40:46.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [62976] [MD5.31F923EB2170FC172C81ABDA0045D18C] - (.Microsoft Corporation - Pilote de cryptographie FIPS.) (.14/04/2008 - 02:57:38.) -- C:\WINDOWS\system32\Drivers\Fips.sys [44672] [MD5.573C7D0A32852B48F3058CFD8026F511] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.13/04/2008 - 17:36:05.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [144384] [MD5.A09BDC4ED10E3B2E0EC27BB94AF32516] - (.Microsoft Corporation - Pilote de port i8042.) (.14/04/2008 - 03:00:52.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [54144] [MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.13/04/2008 - 19:40:58.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [42112] [MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.13/04/2008 - 19:57:15.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [152832] [MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.13/04/2008 - 20:19:42.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [75264] [MD5.7D304A5EB4344EBEEAB53A2FE3FFB9F0] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.15/07/2011 - 14:29:31.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [456320] [MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.13/04/2008 - 20:21:00.) -- C:\WINDOWS\system32\Drivers etBT.sys [162816] [MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.13/04/2008 - 20:15:53.) -- C:\WINDOWS\system32\Drivers tfs.sys [574976] [MD5.8FD0BDBEA875D06CCF6C945CA9ABAF75] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/04/2008 - 03:09:40.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80384] [MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13/04/2008 - 20:19:43.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328] [MD5.15CABD0F7C00C47C70124907916AF3F1] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.13/04/2008 - 19:32:51.) -- C:\WINDOWS\system32\Drivers dpdr.sys [196224] [MD5.D8EB2A7904DB6C916EB5361878DDCBAE] - (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) (.14/04/2008 - 02:57:34.) -- C:\WINDOWS\system32\Drivers edbook.sys [58752] [MD5.46DE1126684369BACE4849E4FC8C43CA] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.14/04/2008 - 02:56:04.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [53376] ~ Generic Processes: Scanned in 00mn 01s ---\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 2/27 ~ Mes musiques (My Musics) : 1/2 ~ Mes Videos (My Videos) : 1/21 ~ Mes Favoris (My Favorites) : 1/358 ~ Mes Documents (My Documents) : 2/1024 ~ Mon Bureau (My Desktop) : 0/26 ~ Menu demarrer (Programs) : 0/35 ~ Hidden Files: Scanned in 00mn 04s ---\ Processus lancés au démarrage su système [MD5.28D6701C710AD7BA3CB95E75F8F1A9AA] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808] [PID.1444] [MD5.3F11B20D12D89365D7721BDC860CE5F0] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968] [PID.168] [MD5.D63797E8E7781EE1500A810CB6194FA6] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe [253816] [PID.248] [MD5.0796C1E47ADB9825269E64B9DAB4E741] - (.Teruten - FsUsbDevice.) -- C:\WINDOWS\system32\FsUsbExService.exe [233472] [PID.1712] [MD5.9ECF00E19736054E019C532AED8228FC] - (.Oracle Corporation - Java Quick Starter Service.) -- C:\Program Files\Java\jre7\bin\jqs.exe [182184] [PID.1840] [MD5.97A4A2A00B1FAD261E7DAC0136E7EE31] - (.Yuna Software - Service - Messenger Plus! for Skype.) -- C:\Program Files\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe [125952] [PID.1748] [MD5.25E40292DD289F644660F440F38239BE] - (.RealNetworks, Inc. - Online Games Manager.) -- C:\Program Files\Online Games Manager\ogmservice.exe [559552] [PID.2036] [MD5.D5CDEA452982FC61E21EE978AAB134DD] - (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files\IncrediMail\Bin\IncMail.exe [367016] [PID.3652] [MD5.312707A513F86ED20642F43F8EF4DD14] - (.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files\IncrediMail\Bin\ImApp.exe [264616] [PID.3824] [MD5.31EC2C367F440422C93FBF31B7D1314F] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7824896] [PID.2148] [MD5.5E9A6658A2A69AE7EB195113B7A2E7A9] - (.Microsoft Corporation - Application Layer Gateway Service.) -- C:\WINDOWS\System32\alg.exe [44544] [PID.2544] ~ Processes Running: Scanned in 00mn 01s ---\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) C:\Documents and Settings\Sylvaine\Application Data\Mozilla\Firefox\Profiles\u69j6ewu.default-1354115506843\prefs.js C:\Documents and Settings\Sylvaine\Application Data\Mozilla\Firefox\Profiles\z4dbkilm.default-1369850942796\prefs.js M3 - MFPP: Plugins - [Sylvaine] -- C:\Documents and Settings\Sylvaine\Application Data\Mozilla\Firefox\Profiles\z4dbkilm.default-1369850942796\searchplugins\amazon.xml ~ Firefox Browser: 16 Legitimates Filtered in 00mn 00s ---\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4) R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.amazon.fr/ ~ IE Browser: 13 Legitimates Filtered in 00mn 00s ---\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\WINDOWS\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl" ~ Keys: Scanned in 00mn 00s ---\ Hosts file redirection (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 02s ~ Nombre de lignes (Lines number): 15260 ---\ Internet Explorer Toolbars (O3) O3 - Toolbar: (no name) - [HKLM]{4daac69c-cba7-45e2-9bc8-1044483d3352} Clé orpheline O3 - Toolbar: avast! Online Security - [HKLM]{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} . (.AVAST Software - IE Webrep plugin.) -- C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll O3 - Toolbar: Barre de confiance - [HKLM]{55BDF3B0-C0A8-481A-B8A6-01CD2BE0F3FD} . (.Euro-Information - Barre de Confiance.) -- C:\Program Files\Barre de Confiance\TAPBar.dll O3 - Toolbar\WebBrowser: (no name) - [HKCU]{01E04581-4EEE-11D0-BFE9-00AA005B4383} Clé orpheline O3 - Toolbar\WebBrowser: (no name) - [HKCU]{0E5CBF21-D15F-11D0-8301-00AA005B4383} Clé orpheline O3 - Toolbar\WebBrowser: (no name) - [HKCU]{4DAAC69C-CBA7-45E2-9BC8-1044483D3352} Clé orpheline ~ Toolbar: Scanned in 00mn 00s ---\ Applications démarrées par registre & par dossier (O4) O4 - HKLM\..\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe O4 - HKLM\..\Run: [NvCplDaemon] . (.NVIDIA Corporation - NVIDIA Display Properties Extension.) -- C:\WINDOWS\system32\NvCpl.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe O4 - HKUS\S-1-5-21-1715567821-343818398-725345543-1003\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe ~ Application: Scanned in 00mn 00s ---\ Autres liens utilisateurs (O4) O4 - GS\Programs: Adobe Reader XI.lnk . (...) -- C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-AB0000000001}\SC_Reader.ico O4 - GS\Programs: IncrediMail.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files\IncrediMail\Bin\IncMail.exe O4 - GS\Programs: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O4 - GS\Programs: Windows Movie Maker.lnk . (.Microsoft Corporation - Windows Movie Maker.) -- C:\Program Files\Movie Maker\moviemk.exe O4 - GS\Programs: Assistance à distance.lnk . (.Microsoft Corporation - Assistance à distance Microsoft.) -- C:\WINDOWS\system32 cimlby.exe O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Programs: Outlook Express.lnk . (.Microsoft Corporation - Outlook Express.) -- C:\Program Files\Outlook Express\msimn.exe O4 - GS\Programs: Screenpresso.lnk . (.Learnpulse - Screenpresso.) -- C:\Documents and Settings\Sylvaine\Local Settings\Application Data\LearnPulse\Screenpresso\Screenpresso.exe O4 - GS\Programs: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe ~ Global Startup: Scanned in 00mn 01s ---\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} -- Clé orpheline O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO O9 - Extra button: Afficher ou masquer l'HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} . (.Hewlett-Packard Co. - HP Smart Web Printing add-on for Internet Explorer.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O9 - Extra button: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -- Clé orpheline O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe ~ IE Extra Buttons: Scanned in 00mn 00s ---\ Objets ActiveX (Downloaded Program Files)(O16) O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} ((no name)) - http://download.bitdefender.com/resources/scanner/sources/fr/scan8/oscan8.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} ((no name)) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1342001082843 O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} ((no name)) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} ((no name)) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab ~ Objets ActiveX: Scanned in 00mn 00s ---\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{4A1C820D-9919-4270-B137-41F5C811FF37}: DhcpNameServer = 212.27.40.240 212.27.40.241 O17 - HKLM\System\CS1\Services\Tcpip\..\{4A1C820D-9919-4270-B137-41F5C811FF37}: DhcpNameServer = 212.27.40.240 212.27.40.241 O17 - HKLM\System\CS3\Services\Tcpip\..\{4A1C820D-9919-4270-B137-41F5C811FF37}: DhcpNameServer = 212.27.40.240 212.27.40.241 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.240 212.27.40.241 ~ Domain: Scanned in 00mn 00s ---\ Titr_HJT34=Protocole additionnel (O18) O18 - Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} . (.Microsoft Corporation - Windows Live Mail.) -- C:\Program Files\Windows Live\Mail\mailcomm.dll O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\MSOXMLMF.dll ~ Protocole Additionnel: Scanned in 00mn 00s ---\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dll O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dll O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agent réseau hors connexion.) -- C:\WINDOWS\system32\cscdll.dll O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\system32\dimsntfy.dll O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL secondaire de notification de service d.) -- C:\WINDOWS\system32\sclgntfy.dll O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\WlNotify.dll O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll ~ Winlogon: Scanned in 00mn 00s ---\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: Online Games Manager (ogmservice) . (.RealNetworks, Inc. - Online Games Manager.) - C:\Program Files\Online Games Manager\ogmservice.exe O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files\Skype\Updater\Updater.exe ~ Services: 8 Legitimates Filtered in 00mn 09s ---\ Enumération Active Desktop & MHTML Editor (O24) O24 - Desktop General: BackupWallPaper - .(...) - C:\Documents and Settings\Sylvaine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop General: WallPaper - .(...) - C:\Documents and Settings\Sylvaine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp ~ Desktop Component: 4 Legitimates Filtered in 00mn 00s ---\ Tâches planifiées en automatique (O39) O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\ProgramRefresh-ATFST.job [456] O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\ProgramUpdateCheck.job [400] [MD5.CEC66E3CA216A4783C6FC54B4FE36DBD] [APT] [ProgramRefresh-ATFST] (...) -- C:\Program Files\File Type Assistant\TSASetup.exe [1492080] ~ Scheduled Task: 20 Legitimates Filtered in 00mn 01s ---\ Logiciels installés (O42) O42 - Logiciel: IncrediMail - (.IncrediMail.) [HKLM] -- {2CF22C94-1369-4C04-9A5F-A4BC6D91B508} O42 - Logiciel: IncrediMail 2.0 - (.IncrediMail Ltd..) [HKLM] -- IncrediMail ~ Logic: 124 Legitimates Filtered in 00mn 01s ---\ HKCU & HKLM Software Keys [HKCU\Software\IM] [HKCU\Software\IncrediMail] [HKCU\Software\Plasmoo.com] =>Hijacker.Plasmoo [HKCU\Software\bbrs_002.tb] [HKLM\Software\Trymedia Systems] =>Adware.Trymedia [HKLM\Software\imagecapture] ~ Key Software: 235 Legitimates Filtered in 00mn 01s ---\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 16/02/2010 - 14:06:53 - [187,986] ----D C:\Program Files\Drivers O43 - CFD: 22/03/2011 - 11:37:10 - [5,280] ----D C:\Program Files\Fichier content down O43 - CFD: 02/08/2013 - 11:41:19 - [26,259] ----D C:\Program Files\IncrediMail O43 - CFD: 16/12/2012 - 23:56:48 - [0,760] ----D C:\Program Files\IncrediMail(2) O43 - CFD: 25/07/2012 - 22:03:53 - [1,674] ----D C:\Program Files\lang O43 - CFD: 15/02/2010 - 14:56:23 - [4,693] ----D C:\Program Files\util O43 - CFD: 05/02/2010 - 20:11:24 - [0,000] ----D C:\Documents and Settings\All Users\Application Data\IM O43 - CFD: 18/06/2010 - 10:43:11 - [11,404] ----D C:\Documents and Settings\All Users\Application Data\IncrediMail O43 - CFD: 18/06/2010 - 10:43:04 - [6,573] ----D C:\Documents and Settings\All Users\Application Data\IncrediMail(2) O43 - CFD: 25/05/2011 - 16:08:15 - [0,206] ----D C:\Documents and Settings\Sylvaine\Application Data\com.codeode O43 - CFD: 02/08/2013 - 11:40:17 - [875,415] ----D C:\Documents and Settings\Sylvaine\Local Settings\Application Data\IM ~ Program Folder: 190 Legitimates Filtered in 01mn 24s ---\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.B9D5A6C482CD7692902E27DE13C5CC63] - 18/08/2013 - 08:36:37 ---A- . (...) -- C:\WINDOWS\wiadebug.log [159] O44 - LFC:[MD5.71D1822D3E3FB8854A34E62E017D6E55] - 18/08/2013 - 08:36:36 ---A- . (...) -- C:\WINDOWS\wiaservc.log [50] O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 18/08/2013 - 08:36:26 ---A- . (...) -- C:\WINDOWS\system32\NvApps.xml [0] O44 - LFC:[MD5.254FFD9FE6CACC8E9D9EC8547973C924] - 17/08/2013 - 09:24:48 ---A- . (...) -- C:\WINDOWS\system.ini [246] O44 - LFC:[MD5.1085B023D2A982AD1A3EC13076290756] - 17/08/2013 - 09:24:48 ---A- . (...) -- C:\WINDOWS\win.ini [637] O44 - LFC:[MD5.D6670F07513B0599CF3EC0AE155A558F] - 14/08/2013 - 13:42:23 ---A- . (...) -- C:\WINDOWS\comsetup.log [10153] O44 - LFC:[MD5.E358C2A4001A95ABC5248135F0379E2A] - 14/08/2013 - 13:42:23 ---A- . (...) -- C:\WINDOWS\iis6.log [33278] O44 - LFC:[MD5.468BBD9B34327393003562E44107B033] - 14/08/2013 - 13:42:22 ---A- . (...) -- C:\WINDOWS\imsins.log [1374] O44 - LFC:[MD5.4CE2C633BAF9E3D4EE1DDEEBC1CA63EB] - 14/08/2013 - 13:42:22 ---A- . (...) -- C:\WINDOWS tdtcsetup.log [6157] O44 - LFC:[MD5.CBE10B77443E13EBBB21BFB6CAD400EB] - 14/08/2013 - 13:42:22 ---A- . (...) -- C:\WINDOWS\ocmsn.log [1710] O44 - LFC:[MD5.CFC620437156C96D241F9F3026D9F508] - 14/08/2013 - 13:42:22 ---A- . (...) -- C:\WINDOWS abletoc.log [1555] O44 - LFC:[MD5.1DBDCF35061AA0EA6387ECC03911CE18] - 14/08/2013 - 13:42:22 ---A- . (...) -- C:\WINDOWS soc.log [14105] O44 - LFC:[MD5.1A8B166D79A0A2C2D9BEDE6C10EBB906] - 14/08/2013 - 13:42:21 ---A- . (...) -- C:\WINDOWS\MedCtrOC.log [2125] O44 - LFC:[MD5.B93579AE2381025C4A798405693D35D8] - 14/08/2013 - 13:42:21 ---A- . (...) -- C:\WINDOWS\msgsocm.log [1545] O44 - LFC:[MD5.02CA43E6C351E16984BF099F8E9079E5] - 14/08/2013 - 13:42:21 ---A- . (...) -- C:\WINDOWS etfxocm.log [5415] O44 - LFC:[MD5.48FAD5EBEB59269ACF7D05E05A59D1A1] - 14/08/2013 - 13:42:21 ---A- . (...) -- C:\WINDOWS\ocgen.log [14780] O44 - LFC:[MD5.574EAC12F003D0BFA91D022FABD0AF09] - 14/08/2013 - 13:42:20 ---A- . (...) -- C:\WINDOWS\FaxSetup.log [30917] O44 - LFC:[MD5.A18BCFCA75B491EED070C51FD17E50ED] - 14/08/2013 - 13:42:15 ---A- . (...) -- C:\WINDOWS\msmqinst.log [9518] O44 - LFC:[MD5.E0A873AEEE710C58B0D2DE2D04D5DB57] - 14/08/2013 - 13:41:55 ---A- . (...) -- C:\WINDOWS\updspapi.log [5726] O44 - LFC:[MD5.965C5140BE87991C68662DFFBD7B7C18] - 14/08/2013 - 13:08:57 ---A- . (...) -- C:\WINDOWS\imsins.BAK [1374] O44 - LFC:[MD5.40BF6F4C6426723A914EEFD9CB983FB5] - 14/08/2013 - 13:08:56 ---A- . (...) -- C:\WINDOWS\system32\TZLog.log [48366] O44 - LFC:[MD5.F1C1DB885313D9C329E48EA5DC02D6F9] - 13/08/2013 - 10:58:05 ---A- . (...) -- C:\WINDOWS\wmsetup.log [1212] ~ Files: 52 Legitimates Filtered in 00mn 22s ---\ Opérations et fonctions au démarrage de Windows Explorer (O46) O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll ~ ShellExecuteHooks: Scanned in 00mn 00s ---\ Export de clé d'application autorisée (O47) O47 - AAKE:Key Export SP - "C:\Program Files\IncrediMail\Bin\IncMail.exe" [Enabled] .(.IncrediMail, Ltd..) -- C:\Program Files\IncrediMail\Bin\IncMail.exe O47 - AAKE:Key Export SP - "C:\Documents and Settings\Sylvaine\Application Data\HiYo\Data\hiyo_install.exe" [Enabled] .(...) -- C:\Documents and Settings\Sylvaine\Application Data\HiYo\Data\hiyo_install.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Program Files\Ubi Soft\Scrabble\Scrabble.exe" [Enabled] .(...) -- C:\Program Files\Ubi Soft\Scrabble\Scrabble.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Program Files rend micro\HijackThis\HijackThis.exe" [Enabled] .(.Trend Micro Inc..) -- C:\Program Files rend micro\HijackThis\HijackThis.exe O47 - AAKE:Key Export SP - "C:\Program Files\IncrediMail\Bin\ImApp.exe" [Enabled] .(.IncrediMail, Ltd..) -- C:\Program Files\IncrediMail\Bin\ImApp.exe O47 - AAKE:Key Export SP - "C:\Program Files\IncrediMail\Bin\ImpCnt.exe" [Enabled] .(.IncrediMail, Ltd..) -- C:\Program Files\IncrediMail\Bin\ImpCnt.exe O47 - AAKE:Key Export SP - "C:\Documents and Settings\Sylvaine\Local Settings\Temp\OnlineUpdate8\SetupXu.exe" [Enabled] .(...) -- C:\Documents and Settings\Sylvaine\Local Settings\Temp\OnlineUpdate8\SetupXu.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Program Files\File Type Assistant sassist.exe" [Enabled] .(.Trusted Software ApS.) -- C:\Program Files\File Type Assistant sassist.exe ~ Keys Export: 51 Legitimates Filtered in 00mn 02s ---\ Image File Execution Options (IFEO) (O50) O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d ~ IFEO: Scanned in 00mn 00s ---\ Enumération des clés de registre StartupReg (SMSR) (O53) O53 - SMSR:HKLM\...\startupreg\Browser Infrastructure Helper [Key] . (...) -- C:\Documents and Settings\Sylvaine\Local Settings\Application Data\Smartbar\Application\QuickShare.exe (.not file.) =>PUP.QuickShare O53 - SMSR:HKLM\...\startupreg\DriverFinder [Key] . (...) -- C:\Program Files\DriverFinder\DriverFinder.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\DriverMax [Key] . (...) -- C:\Program Files\Innovative Solutions\DriverMax\drivermax.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\DriverMax_RESTART [Key] . (...) -- C:\Program Files\Innovative Solutions\DriverMax\drivermax.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\IncrediMail [Key] . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files\IncrediMail\bin\IncMail.exe O53 - SMSR:HKLM\...\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} [Key] . (...) -- C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\Memeo AutoSync [Key] . (...) -- C:\Program Files\Memeo\AutoSync\MemeoLauncher2.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\Memeo Instant Backup [Key] . (...) -- C:\Program Files\Memeo\AutoBackup\MemeoLauncher2.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\Screenpresso [Key] . (.Learnpulse - Screenpresso.) -- C:\Documents and Settings\Sylvaine\Local Settings\Application Data\LearnPulse\Screenpresso\Screenpresso.exe O53 - SMSR:HKLM\...\startupreg\Seagate Dashboard [Key] . (...) -- C:\Program Files\Seagate\Seagate Dashboard\MemeoLauncher.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\vProt [Key] . (...) -- C:\Program Files\AVG Secure Search\vprot.exe (.not file.) =>Toolbar.AVGSearch ~ SMSR Keys: 36 Legitimates Filtered in 00mn 01s ---\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56) O56 - MWPE:[HKCU\...\policies\Explorer] - "HonorAutoRunSetting"=0 O56 - MWPE:[HKLM\...\policies\Explorer] - "HonorAutoRunSetting"=0 ~ MWPE Keys: 7 Legitimates Filtered in 00mn 00s ---\ Liste des pilotes du système (SDL) (O58) O58 - SDL:[MD5.DD8520280304B6145A6BE31008748C7C] - 24/09/2008 - 10:40:22 R--A- . (.Realtek Semiconductor Corp. - Realtek AC'97 Audio Driver (WDM).) -- C:\WINDOWS\system32\Drivers\alcxwdm.sys [4122368] O58 - SDL:[MD5.6D3ADA4CE95CECA7BCE527A08C4C474E] - 02/03/2006 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ansi.sys [9037] ~ Drivers: Scanned in 00mn 00s ---\ Liste des outils de désinfection (LATC) (O63) O63 - Logiciel: HijackThis 2.0.2 - (.TrendMicro.) [HKLM] -- HijackThis O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 ~ ADS: Scanned in 00mn 00s ---\ Liste les services legacy du registre (LALS) (O64) O64 - Services: CurCS - ??\??\???? - Pas de propriétaire (esgiguard) .(...) - LEGACY_ESGIGUARD =>Crapware.SpyHunter O64 - Services: CurCS - 23/01/2013 - C:\Program Files\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe (MsgPlusService) .(.Yuna Software - Service - Messenger Plus! for Skype.) - LEGACY_MSGPLUSSERVICE O64 - Services: CurCS - 08/08/2013 - C:\Program Files\Online Games Manager\ogmservice.exe (ogmservice) .(.RealNetworks, Inc. - Online Games Manager.) - LEGACY_OGMSERVICE ~ Legacy: 158 Legitimates Filtered in 00mn 02s ---\ Menu de démarrage Internet (SMI) (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\ Recherche d'infection sur les navigateurs internet (SBI) (O69) O69 - SBI: SearchScopes [HKCU] ${searchCLSID} - (@ieframe.dll,-12512) - https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8 O69 - SBI: SearchScopes [HKCU] Plasmoo - (Plasmoo) - http://plasmoo.com =>Hijacker.Plasmoo O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (@ieframe.dll,-12512) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8 O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8 O69 - SBI: SearchScopes [HKCU] {9B6103C1-F818-48a8-9683-314055BE6075} - (MyStart Search) - http://mystart.hiyo.com =>Spyware.VMNToolbar O69 - SBI: SearchScopes [HKCU] {9D5BD211-422C-4164-9298-BB4186A30F31} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8 O69 - SBI: SearchScopes [HKCU] {B3B3A6AC-74EC-BD56-BCDB-EFA4799FB9DF} - (Amazon) - https://www.amazon.fr/ ~ Keys: Scanned in 00mn 00s ---\ Recherche particulière à la racine du système (SPRF) (O84) [MD5.3098FC81036796741FC1CF8397664776] [SPRF][23/11/2010] (.Adobe Systems Incorporated - Adobe Self Extractor.) -- C:\Program Files\AdbeRdr1000_fr_FR.exe [36181912] [MD5.329C2307685A8D97E2B3D35DDD39EFBE] [SPRF][23/01/2011] (.Lavalys, Inc. - EVEREST Home Edition.) -- C:\Program Files\everesthome220.exe [4179293] [MD5.3E4F11818976EAA9E897CCA83A3ADF6D] [SPRF][23/10/2012] (...) -- C:\Program Files\FFSetup3.0.1.exe [53466540] [MD5.1AECD7495620E1FB03E8C017475C478F] [SPRF][09/06/2013] (...) -- C:\Program Files\FFSetupMultilingual3.1.0.exe [51201320] [MD5.1C114302B853D7AE690CF2E2FC7B0834] [SPRF][22/04/2003] (...) -- C:\Program Files\hpomdl01.dat [16606] [MD5.023CCE4C523DD026EDDF7DE57578F4BC] [SPRF][09/03/2003] (.Hewlett-Packard Co. - HP OfficeJet SendFax Interface.) -- C:\Program Files\hpzc3212.dll [237568] [MD5.1F25D1777F33C9C4000F64E07B7E7F8E] [SPRF][09/03/2003] (.HP - Pas de description.) -- C:\Program Files\hpzglu07.exe [274432] [MD5.3EF50DC371F5CB2F4BA8EFF307D9398D] [SPRF][09/09/2002] (.Hewlett-Packard - SDILog DLL.) -- C:\Program Files\hpzjlog.dll [28722] [MD5.1CCD19B94831D9367709727B6831BE3E] [SPRF][09/09/2002] (.Hewlett-Packard - SDIPrintPath DLL.) -- C:\Program Files\hpzjpp01.dll [417849] [MD5.1904EC97CB651FCE7E895B217C1CAC68] [SPRF][09/09/2002] (.Hewlett-Packard - SDIUtilities DLL.) -- C:\Program Files\hpzjut01.dll [249913] [MD5.69FF6F3FA7862AFE8B56B4B8512EF43E] [SPRF][09/09/2002] (.Hewlett-Packard - SDIPrintPath DLL.) -- C:\Program Files\hpzjvp01.dll [49212] [MD5.1A800ADC5172B6E6A5DCBAC1F7849C93] [SPRF][09/09/2002] (.HP - Pas de description.) -- C:\Program Files\hpzpnp07.dll [212992] [MD5.BFF33648E41A5C13017073C62DCEAC97] [SPRF][09/03/2003] (.HP - Pas de description.) -- C:\Program Files\hpzscr07.dll [184320] [MD5.ACC1E2DCC38EF00452EB0B754351226E] [SPRF][21/02/2010] (.Microsoft Corporation - Auto-extraction de fichier CAB.) -- C:\Program Files\IE8-WindowsXP-x86-FRA.exe [17001840] [MD5.EA2419D0D5C80F668450551C6AD9958A] [SPRF][10/11/2010] (.IncrediMail Ltd. - IncrediMail Setup.) -- C:\Program Files\IncrediMailSetup.exe [14469064] [MD5.8BC07B24203A9FCB6A661D7C1307D2F2] [SPRF][19/11/2010] (...) -- C:\Program Files\IncrediMailSetup_fr.exe [15069640] [MD5.D0F3133DFE419A885C1C4FC063DB3F9D] [SPRF][14/01/2011] (.Pas de propriétaire - IncrediMail Installer.) -- C:\Program Files\incredimail_install.exe [449360] [MD5.6E23EADBA1E84F43E5D28053A8BA27A9] [SPRF][23/06/2010] (.Adobe Systems, Inc. - Adobe® Flash® Player Installer/Uninstaller 10.1 r53.) -- C:\Program Files\install_flash_player.exe [2568656] [MD5.DF7507AAF7991CE25565CB9175B166E2] [SPRF][22/12/2010] (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Program Files\mbam-setup-1.50.1.exe [7734208] [MD5.A8294075E6FC848779BF37E921635DB6] [SPRF][09/09/2002] (.Microsoft Corporation - Microsoft (R) C++ Runtime Library.) -- C:\Program Files\msvcirt.dll [70656] [MD5.2B151F1551A46D5A01DBFB8ED0D8574F] [SPRF][09/09/2002] (.Microsoft Corporation - Microsoft (R) C Runtime Library.) -- C:\Program Files\msvcrt.dll [254005] [MD5.3E144F01528DFEB887FB6DEFD68D58C3] [SPRF][28/10/2010] (.Pas de propriétaire - PhotoMail Content Pack Installer.) -- C:\Program Files\photomail_cp_install.exe [666864] [MD5.4F42027B6B7F73E49F2608869A008970] [SPRF][28/10/2010] (.Pas de propriétaire - PhotoMail Maker Installer.) -- C:\Program Files\photomail_install.exe [656080] [MD5.8377FA7E5AFE48D93BD646446EFD22D8] [SPRF][04/12/2010] (.Pas de propriétaire - Photo Notifier and Animation Creator Installer.) -- C:\Program Files\pnac_install.exe [444240] [MD5.15B9DE0B65F03AFE4235B261FE4E28DC] [SPRF][26/11/2009] (...) -- C:\Program Files\portable.dat [10] [MD5.9353FE7988E1D81A6584802CF6CC25A5] [SPRF][19/07/2009] (.--- - Capture les images incluses dans les fichiers PPT ou PPS.) -- C:\Program Files\PowerpointImageCopier.exe [636416] [MD5.15D1ED3110CAAAD7AF321C4C8FB697F9] [SPRF][03/12/2010] (.LearnPulse - Screenpresso.) -- C:\Program Files\Screenpresso.exe [5292032] [MD5.8A04CEF51AF9D57CFD8E2416E2786B4F] [SPRF][19/04/2011] (.Pas de propriétaire - AVAST Software Setup Engine.) -- C:\Program Files\setup_av_free.exe [66297216] [MD5.7FED9CC66EC9A2BB312BB9E6EEF3C55C] [SPRF][13/01/2011] (.Pas de propriétaire - AVAST Software Setup Engine.) -- C:\Program Files\setup_av_free_fre.exe [49985000] [MD5.C0F6E64036E609D2326D045C497D695C] [SPRF][09/09/2002] (.Microsoft Corporation - Standard USB printing Port Monitor DLL.) -- C:\Program Files\usbmon.dll [12288] [MD5.BDCF7F43ABD107E8F7D31D78C1B096A8] [SPRF][09/09/2002] (.Microsoft Corporation - USB Printer driver.) -- C:\Program Files\usbprint.sys [22608] [MD5.9E8E8B2FB9178DC9D6AB69D685D8F1E8] [SPRF][06/01/2011] (...) -- C:\Program Files\vente_flash_setup.exe [2506243] [MD5.18075B2C9F0F300BEE209744A8BEC353] [SPRF][05/01/2009] (...) -- C:\WINDOWS\Downloaded Program Files\bdcore.dll [32] [MD5.3FEA9D2EDF23B0283C7A66C8DEA380BD] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player Module.) -- C:\WINDOWS\Downloaded Program Files\dwusplay.dll [24576] [MD5.CDBE35EA59BC9223E4F800BD1DB82D27] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player.) -- C:\WINDOWS\Downloaded Program Files\dwusplay.exe [196608] [MD5.245E2761D02D2FC40B857D71F8A96616] [SPRF][08/06/2010] (.Adobe Systems, Inc. - Adobe® Flash® Player Installer/Uninstaller 10.1 r53.) -- C:\WINDOWS\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe [2605008] [MD5.CDE357CD3FC047F5C7D8B8345B6A42BF] [SPRF][18/10/2007] (.Hewlett-Packard Co. - HPDEXADO.) -- C:\WINDOWS\Downloaded Program Files\HPDEXAXO.dll [341296] [MD5.2B1C4C87EB20ADDBA59DCA975E28DFFB] [SPRF][05/01/2009] (...) -- C:\WINDOWS\Downloaded Program Files\ipsupd.dll [741376] [MD5.5002991ADA7920B35E46E7EA80C134FE] [SPRF][16/06/2004] (.InstallShield Software Corporation - InstallShield Update Service Web Agent.) -- C:\WINDOWS\Downloaded Program Files\isusweb.dll [323584] [MD5.18075B2C9F0F300BEE209744A8BEC353] [SPRF][05/01/2009] (...) -- C:\WINDOWS\Downloaded Program Files\libfn.dll [32] ~ Files: Scanned in 00mn 26s ---\ Enumère les codes produits des logiciels (PUC) (O90) O90 - PUC: "49C22FC2963140C4A9F54ACBD6195B80" . (.IncrediMail.) -- C:\WINDOWS\Installer\{2CF22C94-1369-4C04-9A5F-A4BC6D91B508}\ARPPRODUCTICON.exe O90 - PUC: "4A4A2EB6BF99DE84EAE1E45830988F40" . (.PartitionMagic.) -- C:\WINDOWS\Installer\{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}\ARPPRODUCTICON.exe ~ Update Products: 86 Legitimates Filtered in 00mn 00s ---\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS) [MD5.4755E91433A3B67E78B40534BA1722AC] [WIS][01/08/2013] (.Skype Technologies S.A. - Skype.) -- C:\Windows\Installer\1684619.msi [1615360] [MD5.681EE195E1C3DDCC7E336B04C2C060C2] [WIS][27/09/2012] (.Babylon Ltd - BabylonObjectInstaller.) -- C:\Windows\Installer\18fa52d.msi [22528] =>Toolbar.Babylon [MD5.E6A67DB53DBC333344C541404A82722E] [WIS][07/08/2013] (.Google - Google Earth.) -- C:\Windows\Installer\1e36435.msi [916992] [MD5.04788FBCE78C8437CD09183D6324F780] [WIS][30/07/2013] (.IncrediMail - IncrediMail.) -- C:\Windows\Installer\3800c0.msi [2682880] [MD5.16002007500E1265F3112001FE22AB0B] [WIS][31/01/2013] (.IncrediMail - IncrediMail.) -- C:\Windows\Installer\54742d.msi [2684416] [MD5.2EC0BB50E60145F6C2B67D3E16EBD5C6] [WIS][09/06/2012] (.Nom de votre société - Photo Notifier and Animation Creator.) -- C:\Windows\Installer\66573a.msi [1106944] [MD5.3EA245BEC7704E53C25C682DDCADB949] [WIS][09/03/2013] (.Facebook - Facebook Messenger 2.1.4814.0.) -- C:\Windows\Installer\93fabe.msi [196096] [MD5.38B81C5E01379FB2EC270ACA4697FD9F] [WIS][28/10/2010] (.Nom de votre société - PhotoMail Maker.) -- C:\Windows\Installer\a733a4.msi [1152512] [MD5.775ADB0D4A7316EBA8B71E7C03A39633] [WIS][23/06/2010] (.Builds the Destinations MSI - Builds the Destinations MSI.) -- C:\Windows\Installer\ad7a96.msi [522752] [MD5.FE47BCB7D33B91125C891C2CB7D6EB21] [WIS][06/02/2010] (.PowerQuest Corporation - PartitionMagic.) -- C:\Windows\Installer\bce6d2.msi [2300416] ~ WIS: 93 Legitimates Filtered in 00mn 42s ---\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Demand 15/08/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe SR - | Auto 09/05/2013 46808 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe SS - | Demand 14/04/2008 225280 | (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\system32\dmadmin.exe SR - | Auto 20/03/2013 233472 | (FsUsbExService) . (.Teruten.) - C:\WINDOWS\system32\FsUsbExService.exe SS - | Auto 07/08/2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 07/08/2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SR - | Demand 14/04/2008 14336 | C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqcxs08.dll (hpqcxs08) . (.Hewlett-Packard Co..) - C:\WINDOWS\system32\svchost.exe SR - | Auto 14/04/2008 14336 | C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqddsvc.dll (hpqddsvc) . (.Hewlett-Packard Co..) - C:\WINDOWS\system32\svchost.exe SR - | Auto 15/08/2013 182184 | (JavaQuickStarterService) . (.Oracle Corporation.) - C:\Program Files\Java\jre7\bin\jqs.exe SS - | Demand 05/02/2013 312704 | (maconfservice) . (.CybelSoft.) - C:\Program Files\ma-config.com\maconfservice.exe SS - | Demand 17/08/2013 117656 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe SR - | Auto 23/01/2013 125952 | (MsgPlusService) . (.Yuna Software.) - C:\Program Files\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe SR - | Auto 14/04/2008 14336 | C:\WINDOWS\system32\HPZinw12.dll (Net Driver HPZ12) . (.Hewlett-Packard.) - C:\WINDOWS\system32\svchost.exe SS - | Auto 16/11/2006 159811 | (NVSvc) . (.NVIDIA Corporation.) - C:\WINDOWS\system32 vsvc32.exe SR - | Auto 08/08/2013 559552 | (ogmservice) . (.RealNetworks, Inc..) - C:\Program Files\Online Games Manager\ogmservice.exe SR - | Auto 14/04/2008 14336 | C:\WINDOWS\system32\HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) - C:\WINDOWS\system32\svchost.exe SS - | Auto 25/07/2013 162672 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe ~ Services: Scanned in 00mn 44s ---\ Scan Additionnel (O88) Database Version : v2.12859 - (17/08/2013) Clés trouvées (Keys found) : 16 Valeurs trouvées (Values found) : 0 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 2 [HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\Browser Infrastructure Helper] =>PUP.QuickShare^ [HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\vProt] =>Toolbar.AVGSearch^ [HKCU\Software\bbrs_002.tb] =>PUP.Blabbers [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ESGIGUARD] =>Crapware.SpyHunter [HKLM\Software\Classes\.bdc] =>Toolbar.Conduit [HKLM\Software\Classes\.bgl] =>Toolbar.Conduit [HKLM\Software\Classes\.bof] =>Toolbar.Conduit [HKCU\Software\Plasmoo.com] =>Hijacker.Plasmoo [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}] =>Toolbar.Avast [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}] =>Toolbar.Avast [HKLM\Software\Classes\CLSID\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}] =>Toolbar.Avast [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}] =>Toolbar.Avast [HKLM\Software\Classes\IncrediSpooler.DeltaSync] =>toolbar.DeltaSearch [HKLM\Software\Classes\IncrediSpooler.DeltaSync.1] =>toolbar.DeltaSearch [HKLM\Software\Classes\AppID\Iminent.LinkToContentFF.DLL] =>Adware.IMBooster [HKLM\Software\Classes\AppID\Iminent.WinCore.Aim.Plugin.DLL] =>Adware.IMBooster [HKLM\Software\Trymedia Systems] =>Adware.Trymedia^ Windows\Installer\18fa52d.msi =>Toolbar.Babylon^ ~ Additionnel Scan: 257452 Items scanned in 01mn 09s ---\ Récapitulatif des détections trouvées sur votre station ~ http://nicolascoolman.webs.com/apps/blog/show/30414055-hijacker-plasmoo =>Hijacker.Plasmoo ~ http://nicolascoolman.webs.com/apps/blog/show/29710349-adware-trymedia =>Adware.Trymedia ~ http://nicolascoolman.webs.com/apps/blog/show/28577022-pup-quickshare =>PUP.QuickShare ~ http://nicolascoolman.webs.com/apps/blog/show/26609241-crapware-spyhunter =>Crapware.SpyHunter ~ http://nicolascoolman.webs.com/apps/blog/show/27985391-spyware-vmntoolbar =>Spyware.VMNToolbar ~ http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon =>Toolbar.Babylon ~ http://nicolascoolman.webs.com/apps/blog/show/27280149-pup-blabbers =>PUP.Blabbers ~ http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit ~ http://nicolascoolman.webs.com/apps/blog/show/30898585-toolbar-avast =>Toolbar.Avast ~ http://nicolascoolman.webs.com/apps/blog/show/27875657-toolbar-deltasearch =>Toolbar.DeltaSearch ~ http://nicolascoolman.webs.com/apps/blog/show/26684723-adware-imbooster =>Adware.IMBooster ~ MSI: 11 link(s) detected in 01mn 09s ~ 1130 Legitimates filtered by white list End of the scan (569 lines in 05mn 00s)(0)

2011N2 · Answer

Re,

Ok, passe AdwCleaner comme ceci : http://www.forum-entraide-informatique.com/support/adwcleaner-tutoriel-t875.html
Le développeur vient de repasser à une version plus ancienne, il te faudra donc cliquer sur Suppression, et le PC redémarrera à la fin de l'opération.

Gabriel.

giadou · Answer

Peux-tu me confirmer que cela ne me désinstallera pas Incredimail ?

2011N2 · Answer

Oui pas de souci pour ça. :)
La seule chose qui pourra être modifiée, c'est la page MyStart de Incredimail sur ton navigateur (remplacée par Google).

Gabriel.

giadou · Answer

Suppression faite avec AdwCleaner.

2011N2 · Answer

Tu as le rapport ?

Gabriel.

giadou · Answer

Oui, le voici :

# AdwCleaner v2.306 - Rapport créé le 18/08/2013 à 15:30:14
# Mis à jour le 19/07/2013 par Xplode
# Système d'exploitation : Microsoft Windows XP Service Pack 3 (32 bits)
# Nom d'utilisateur : Sylvaine - SYLVAINE-G
# Mode de démarrage : Normal
# Exécuté depuis : C:\Documents and Settings\Sylvaine\Mes documents\Téléchargements\adwcleaner(3).exe
# Option [Suppression]


***** [Services] *****


***** [Fichiers / Dossiers] *****


***** [Registre] *****

Clé Supprimée : HKCU\Software\IM

***** [Navigateurs] *****

-\ Internet Explorer v8.0.6001.18702

[OK] Le registre ne contient aucune entrée illégitime.

-\ Mozilla Firefox v23.0.1 (fr)

Fichier : C:\Documents and Settings\Sylvaine\Application Data\Mozilla\Firefox\Profiles\u69j6ewu.default-1354115506843\prefs.js

[OK] Le fichier ne contient aucune entrée illégitime.

Fichier : C:\Documents and Settings\Sylvaine\Application Data\Mozilla\Firefox\Profiles\z4dbkilm.default-1369850942796\prefs.js

[OK] Le fichier ne contient aucune entrée illégitime.

*************************

AdwCleaner[S35].txt - [1415 octets] - [16/08/2013 17:05:34]
AdwCleaner[S36].txt - [1137 octets] - [18/08/2013 15:30:14]

########## EOF - C:\AdwCleaner[S36].txt - [1198 octets] ##########

2011N2 · Answer

Re,

Ok fais ceci à présent : http://www.forum-entraide-informatique.com/support/junkware-removal-tool-tutoriel-t8260.html
Il est similaire à AdwCleaner, mais il détectera probablement d'autres éléments. 

Gabriel.

giadou · Answer

Voilà le rapport :

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.4.9 (08.17.2013:3)
OS: Microsoft Windows XP x86
Ran by Sylvaine on 18/08/2013 at 16:56:42,10
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\{4DAAC69C-CBA7-45E2-9BC8-1044483D3352}
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\distromatic
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9B6103C1-F818-48a8-9683-314055BE6075}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9D5BD211-422C-4164-9298-BB4186A30F31}



~~~ Files

Successfully deleted: [File] "C:\WINDOWS\wininit.ini"



~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\Sylvaine\start menu\programs\browser manager"



~~~ FireFox

Successfully deleted the following from C:\Documents and Settings\Sylvaine\Application Data\mozilla\firefox\profiles\z4dbkilm.default-1369850942796\prefs.js

user_pref("extensions.AMAZONNEW_NS_PH.searchconf", "{
  \"google\" : {
    \"urlexp\" : \"hxxp(s)?:\\/\\/www\\.google\\..*\\/.*[?#&]q=([^&]+)\",
    \"rankometer\
Emptied folder: C:\Documents and Settings\Sylvaine\Application Data\mozilla\firefox\profiles\z4dbkilm.default-1369850942796\minidumps [1 files]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 18/08/2013 at 17:08:20,54
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2011N2 · Answer

Re,

Ok fais moi un nouveau ZHPDiag. :)

Gabriel.

giadou · Answer

Voici le nouveau rapport ZHPDiag : ~ Rapport de ZHPDiag v2013.8.18.26 - Nicolas Coolman (18/08/2013) ~ Lancé par Sylvaine (18/08/2013 17:28:02) ~ Adresse du Site Web https://nicolascoolman.webs.com/ ~ Traduit par Nicolas Coolman ~ Etat de la version : Version à jour. ~ Liste blanche : Activée par le programme ~ Elévation des Privilèges : OK ~ User Account Control (UAC): Not Found ---\ Navigateurs Internet MSIE: Internet Explorer v8.0.6001.18702 MFIE: Mozilla Firefox 23.0.1 (Defaut) ---\ Informations sur les produits Windows ~ Langage: Français Windows XP Professional Service Pack 3 (Build 2600) Windows Automatic Updates : OK Windows Genuine Advantage : OK ---\ Logiciels de protection du système avast! Free Antivirus v8.0.1489.0 Malwarebytes Anti-Malware version 1.75.0.1300 ---\ Logiciels d'optimisation du système CCleaner v4.04 =>Piriform Ltd ---\ Logiciels de partage PeerToPeer ---\ Surveillance de Logiciels Adobe Flash Player 11 Plugin Adobe Reader XI Java 7 Update 25 ---\ Informations sur le système ~ Processor: x86 Family 15 Model 2 Stepping 9, GenuineIntel ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 767 MB (53% free) System Restore: Activé (Enable) System drive C: has 48 GB (61%) free of 78 GB ---\ Mode de connexion au système ~ Computer Name: SYLVAINE-G ~ User Name: Sylvaine ~ All Users Names: Sylvaine, SUPPORT_388945a0, HelpAssistant, Administrateur, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\ Variables d'environnement ~ System Unit : C:\ ~ %AppData% : C:\Documents and Settings\Sylvaine\Application Data\ ~ %Desktop% : C:\Documents and Settings\Sylvaine\Bureau\ ~ %Favorites% : C:\Documents and Settings\Sylvaine\Favoris\ ~ %LocalAppData% : C:\Documents and Settings\Sylvaine\Local Settings\Application Data\ ~ %StartMenu% : C:\Documents and Settings\Sylvaine\Menu Démarrer\ ~ %Windir% : C:\WINDOWS\ ~ %System% : C:\WINDOWS\system32\ ---\ Enumération des unités disques A:\ Floppy drive, Flash card reader, USB Key (Not Inserted) C:\ Hard drive, Flash drive, Thumb drive (Free 48 Go of 78 Go) D:\ CD-ROM drive (Not Inserted) E:\ CD-ROM drive (Not Inserted) F:\ Hard drive, Flash drive, Thumb drive (Free 49 Go of 49 Go) G:\ Hard drive, Flash drive, Thumb drive (Free 450 Go of 466 Go) H:\ Hard drive, Flash drive, Thumb drive (Free 39 Go of 39 Go) I:\ Hard drive, Flash drive, Thumb drive (Free 32 Go of 32 Go) J:\ Hard drive, Flash drive, Thumb drive (Free 79 Go of 79 Go) M:\ Floppy drive, Flash card reader, USB Key (Not Inserted) N:\ Floppy drive, Flash card reader, USB Key (Not Inserted) O:\ Hard drive, Flash drive, Thumb drive (Free 17 Go of 21 Go) ---\ Etat du Centre de Sécurité Windows [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date ~ Security Center: 33 Legitimates Filtered in 00mn 00s ---\ Recherche particulière de fichiers génériques [MD5.F2317622D29F9FF0F88AEECD5F60F0DD] - (.Microsoft Corporation - Explorateur Windows.) (.14/04/2008 - 03:34:03.) -- C:\WINDOWS\Explorer.exe [1037824] [MD5.E1948293F7CBC38987270432935D8D05] - (.Microsoft Corporation - Internet Extensions for Win32.) (.26/07/2013 - 03:47:15.) -- C:\WINDOWS\system32\wininet.dll [920064] [MD5.DD73D6B9F6B4CB630CF35B438B540174] - (.Microsoft Corporation - Application d'ouverture de session Windows NT.) (.14/04/2008 - 03:34:28.) -- C:\WINDOWS\system32\Winlogon.exe [512000] [MD5.1E44BC1E83D8FD2305F8D452DB109CF9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.17/08/2011 - 14:49:54.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496] [MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.13/04/2008 - 19:40:30.) -- C:\WINDOWS\system32\Drivers\atapi.sys [96512] [MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/04/2008 - 20:14:21.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744] [MD5.1F4260CC5B42272D71F79E570A27A4FE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.13/04/2008 - 19:40:46.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [62976] [MD5.31F923EB2170FC172C81ABDA0045D18C] - (.Microsoft Corporation - Pilote de cryptographie FIPS.) (.14/04/2008 - 02:57:38.) -- C:\WINDOWS\system32\Drivers\Fips.sys [44672] [MD5.573C7D0A32852B48F3058CFD8026F511] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.13/04/2008 - 17:36:05.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [144384] [MD5.A09BDC4ED10E3B2E0EC27BB94AF32516] - (.Microsoft Corporation - Pilote de port i8042.) (.14/04/2008 - 03:00:52.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [54144] [MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.13/04/2008 - 19:40:58.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [42112] [MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.13/04/2008 - 19:57:15.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [152832] [MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.13/04/2008 - 20:19:42.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [75264] [MD5.7D304A5EB4344EBEEAB53A2FE3FFB9F0] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.15/07/2011 - 14:29:31.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [456320] [MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.13/04/2008 - 20:21:00.) -- C:\WINDOWS\system32\Drivers etBT.sys [162816] [MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.13/04/2008 - 20:15:53.) -- C:\WINDOWS\system32\Drivers tfs.sys [574976] [MD5.8FD0BDBEA875D06CCF6C945CA9ABAF75] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/04/2008 - 03:09:40.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80384] [MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13/04/2008 - 20:19:43.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328] [MD5.15CABD0F7C00C47C70124907916AF3F1] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.13/04/2008 - 19:32:51.) -- C:\WINDOWS\system32\Drivers dpdr.sys [196224] [MD5.D8EB2A7904DB6C916EB5361878DDCBAE] - (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) (.14/04/2008 - 02:57:34.) -- C:\WINDOWS\system32\Drivers edbook.sys [58752] [MD5.46DE1126684369BACE4849E4FC8C43CA] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.14/04/2008 - 02:56:04.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [53376] ~ Generic Processes: Scanned in 00mn 01s ---\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 2/27 ~ Mes musiques (My Musics) : 1/2 ~ Mes Videos (My Videos) : 1/21 ~ Mes Favoris (My Favorites) : 1/358 ~ Mes Documents (My Documents) : 2/1027 ~ Mon Bureau (My Desktop) : 0/26 ~ Menu demarrer (Programs) : 0/35 ~ Hidden Files: Scanned in 00mn 12s ---\ Processus lancés au démarrage du système [MD5.28D6701C710AD7BA3CB95E75F8F1A9AA] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808] [PID.1484] [MD5.0796C1E47ADB9825269E64B9DAB4E741] - (.Teruten - FsUsbDevice.) -- C:\WINDOWS\system32\FsUsbExService.exe [233472] [PID.1156] [MD5.9ECF00E19736054E019C532AED8228FC] - (.Oracle Corporation - Java Quick Starter Service.) -- C:\Program Files\Java\jre7\bin\jqs.exe [182184] [PID.1312] [MD5.97A4A2A00B1FAD261E7DAC0136E7EE31] - (.Yuna Software - Service - Messenger Plus! for Skype.) -- C:\Program Files\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe [125952] [PID.1148] [MD5.948C21C77FAD271CC6F851FC46029DD4] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 93.81.) -- C:\WINDOWS\system32 vsvc32.exe [159811] [PID.1936] [MD5.25E40292DD289F644660F440F38239BE] - (.RealNetworks, Inc. - Online Games Manager.) -- C:\Program Files\Online Games Manager\ogmservice.exe [559552] [PID.1948] [MD5.3F11B20D12D89365D7721BDC860CE5F0] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968] [PID.3024] [MD5.D63797E8E7781EE1500A810CB6194FA6] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe [253816] [PID.3296] [MD5.D5CDEA452982FC61E21EE978AAB134DD] - (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files\IncrediMail\Bin\IncMail.exe [367016] [PID.1160] [MD5.312707A513F86ED20642F43F8EF4DD14] - (.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files\IncrediMail\Bin\ImApp.exe [264616] [PID.364] [MD5.3A528C8FA188E1398976C5470C17B225] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7828992] [PID.3752] [MD5.5E9A6658A2A69AE7EB195113B7A2E7A9] - (.Microsoft Corporation - Application Layer Gateway Service.) -- C:\WINDOWS\System32\alg.exe [44544] [PID.2424] ~ Processes Running: Scanned in 00mn 02s ---\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) C:\Documents and Settings\Sylvaine\Application Data\Mozilla\Firefox\Profiles\u69j6ewu.default-1354115506843\prefs.js C:\Documents and Settings\Sylvaine\Application Data\Mozilla\Firefox\Profiles\z4dbkilm.default-1369850942796\prefs.js M3 - MFPP: Plugins - [Sylvaine] -- C:\Documents and Settings\Sylvaine\Application Data\Mozilla\Firefox\Profiles\z4dbkilm.default-1369850942796\searchplugins\amazon.xml ~ Firefox Browser: 16 Legitimates Filtered in 00mn 00s ---\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4) R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.amazon.fr/ ~ IE Browser: 13 Legitimates Filtered in 00mn 00s ---\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\WINDOWS\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl" ~ Keys: Scanned in 00mn 00s ---\ Hosts file redirection (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 02s ~ Nombre de lignes (Lines number): 15260 ---\ Internet Explorer Toolbars (O3) O3 - Toolbar: avast! Online Security - [HKLM]{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} . (.AVAST Software - IE Webrep plugin.) -- C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll O3 - Toolbar: Barre de confiance - [HKLM]{55BDF3B0-C0A8-481A-B8A6-01CD2BE0F3FD} . (.Euro-Information - Barre de Confiance.) -- C:\Program Files\Barre de Confiance\TAPBar.dll O3 - Toolbar\WebBrowser: (no name) - [HKCU]{01E04581-4EEE-11D0-BFE9-00AA005B4383} Clé orpheline O3 - Toolbar\WebBrowser: (no name) - [HKCU]{0E5CBF21-D15F-11D0-8301-00AA005B4383} Clé orpheline O3 - Toolbar\WebBrowser: (no name) - [HKCU]{4DAAC69C-CBA7-45E2-9BC8-1044483D3352} Clé orpheline ~ Toolbar: Scanned in 00mn 00s ---\ Applications démarrées par registre & par dossier (O4) O4 - HKLM\..\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe O4 - HKLM\..\Run: [NvCplDaemon] . (.NVIDIA Corporation - NVIDIA Display Properties Extension.) -- C:\WINDOWS\system32\NvCpl.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe O4 - HKUS\S-1-5-21-1715567821-343818398-725345543-1003\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe ~ Application: Scanned in 00mn 00s ---\ Autres liens utilisateurs (O4) O4 - GS\Programs: Adobe Reader XI.lnk . (...) -- C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-AB0000000001}\SC_Reader.ico O4 - GS\Programs: IncrediMail.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files\IncrediMail\Bin\IncMail.exe O4 - GS\Programs: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O4 - GS\Programs: Windows Movie Maker.lnk . (.Microsoft Corporation - Windows Movie Maker.) -- C:\Program Files\Movie Maker\moviemk.exe O4 - GS\Programs: Assistance à distance.lnk . (.Microsoft Corporation - Assistance à distance Microsoft.) -- C:\WINDOWS\system32 cimlby.exe O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Programs: Outlook Express.lnk . (.Microsoft Corporation - Outlook Express.) -- C:\Program Files\Outlook Express\msimn.exe O4 - GS\Programs: Screenpresso.lnk . (.Learnpulse - Screenpresso.) -- C:\Documents and Settings\Sylvaine\Local Settings\Application Data\LearnPulse\Screenpresso\Screenpresso.exe O4 - GS\Programs: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe ~ Global Startup: Scanned in 00mn 00s ---\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} -- Clé orpheline O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO O9 - Extra button: Afficher ou masquer l'HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} . (.Hewlett-Packard Co. - HP Smart Web Printing add-on for Internet Explorer.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O9 - Extra button: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -- Clé orpheline O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe ~ IE Extra Buttons: Scanned in 00mn 00s ---\ Objets ActiveX (Downloaded Program Files)(O16) O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} ((no name)) - http://download.bitdefender.com/resources/scanner/sources/fr/scan8/oscan8.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} ((no name)) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1342001082843 O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} ((no name)) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} ((no name)) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab ~ Objets ActiveX: Scanned in 00mn 00s ---\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{4A1C820D-9919-4270-B137-41F5C811FF37}: DhcpNameServer = 212.27.40.240 212.27.40.241 O17 - HKLM\System\CS1\Services\Tcpip\..\{4A1C820D-9919-4270-B137-41F5C811FF37}: DhcpNameServer = 212.27.40.240 212.27.40.241 O17 - HKLM\System\CS3\Services\Tcpip\..\{4A1C820D-9919-4270-B137-41F5C811FF37}: DhcpNameServer = 212.27.40.240 212.27.40.241 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.240 212.27.40.241 ~ Domain: Scanned in 00mn 00s ---\ Titr_HJT34=Protocole additionnel (O18) O18 - Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} . (.Microsoft Corporation - Windows Live Mail.) -- C:\Program Files\Windows Live\Mail\mailcomm.dll O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\MSOXMLMF.dll ~ Protocole Additionnel: Scanned in 00mn 00s ---\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dll O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dll O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agent réseau hors connexion.) -- C:\WINDOWS\system32\cscdll.dll O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\system32\dimsntfy.dll O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL secondaire de notification de service d.) -- C:\WINDOWS\system32\sclgntfy.dll O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\WlNotify.dll O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll ~ Winlogon: Scanned in 00mn 00s ---\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: Online Games Manager (ogmservice) . (.RealNetworks, Inc. - Online Games Manager.) - C:\Program Files\Online Games Manager\ogmservice.exe O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files\Skype\Updater\Updater.exe ~ Services: 8 Legitimates Filtered in 00mn 08s ---\ Enumération Active Desktop & MHTML Editor (O24) O24 - Desktop General: BackupWallPaper - .(...) - C:\Documents and Settings\Sylvaine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop General: WallPaper - .(...) - C:\Documents and Settings\Sylvaine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp ~ Desktop Component: 4 Legitimates Filtered in 00mn 00s ---\ Tâches planifiées en automatique (O39) O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\ProgramRefresh-ATFST.job [456] O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\ProgramUpdateCheck.job [400] [MD5.CEC66E3CA216A4783C6FC54B4FE36DBD] [APT] [ProgramRefresh-ATFST] (...) -- C:\Program Files\File Type Assistant\TSASetup.exe [1492080] ~ Scheduled Task: 20 Legitimates Filtered in 00mn 04s ---\ Logiciels installés (O42) O42 - Logiciel: IncrediMail - (.IncrediMail.) [HKLM] -- {2CF22C94-1369-4C04-9A5F-A4BC6D91B508} O42 - Logiciel: IncrediMail 2.0 - (.IncrediMail Ltd..) [HKLM] -- IncrediMail ~ Logic: 124 Legitimates Filtered in 00mn 01s ---\ HKCU & HKLM Software Keys [HKCU\Software\IncrediMail] [HKCU\Software\Plasmoo.com] =>Hijacker.Plasmoo [HKCU\Software\bbrs_002.tb] [HKLM\Software\Trymedia Systems] =>Adware.Trymedia [HKLM\Software\imagecapture] ~ Key Software: 233 Legitimates Filtered in 00mn 01s ---\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 16/02/2010 - 14:06:53 - [187,986] ----D C:\Program Files\Drivers O43 - CFD: 22/03/2011 - 11:37:10 - [5,280] ----D C:\Program Files\Fichier content down O43 - CFD: 02/08/2013 - 11:41:19 - [26,259] ----D C:\Program Files\IncrediMail O43 - CFD: 16/12/2012 - 23:56:48 - [0,760] ----D C:\Program Files\IncrediMail(2) O43 - CFD: 25/07/2012 - 22:03:53 - [1,674] ----D C:\Program Files\lang O43 - CFD: 15/02/2010 - 14:56:23 - [4,693] ----D C:\Program Files\util O43 - CFD: 05/02/2010 - 20:11:24 - [0,000] ----D C:\Documents and Settings\All Users\Application Data\IM O43 - CFD: 18/06/2010 - 10:43:11 - [11,404] ----D C:\Documents and Settings\All Users\Application Data\IncrediMail O43 - CFD: 18/06/2010 - 10:43:04 - [6,573] ----D C:\Documents and Settings\All Users\Application Data\IncrediMail(2) O43 - CFD: 25/05/2011 - 16:08:15 - [0,206] ----D C:\Documents and Settings\Sylvaine\Application Data\com.codeode O43 - CFD: 02/08/2013 - 11:40:17 - [876,651] ----D C:\Documents and Settings\Sylvaine\Local Settings\Application Data\IM ~ Program Folder: 190 Legitimates Filtered in 01mn 47s ---\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 18/08/2013 - 14:33:46 ---A- . (...) -- C:\WINDOWS\system32\NvApps.xml [0] O44 - LFC:[MD5.E45A70146059D837468AA98B22F1CF38] - 18/08/2013 - 14:32:38 ---A- . (...) -- C:\WINDOWS\wiadebug.log [159] O44 - LFC:[MD5.B7BB25C3CE48A1FDCD7BBB94C5BB05B5] - 18/08/2013 - 14:32:37 ---A- . (...) -- C:\WINDOWS\wiaservc.log [50] O44 - LFC:[MD5.254FFD9FE6CACC8E9D9EC8547973C924] - 17/08/2013 - 09:24:48 ---A- . (...) -- C:\WINDOWS\system.ini [246] O44 - LFC:[MD5.1085B023D2A982AD1A3EC13076290756] - 17/08/2013 - 09:24:48 ---A- . (...) -- C:\WINDOWS\win.ini [637] O44 - LFC:[MD5.D6670F07513B0599CF3EC0AE155A558F] - 14/08/2013 - 13:42:23 ---A- . (...) -- C:\WINDOWS\comsetup.log [10153] O44 - LFC:[MD5.E358C2A4001A95ABC5248135F0379E2A] - 14/08/2013 - 13:42:23 ---A- . (...) -- C:\WINDOWS\iis6.log [33278] O44 - LFC:[MD5.468BBD9B34327393003562E44107B033] - 14/08/2013 - 13:42:22 ---A- . (...) -- C:\WINDOWS\imsins.log [1374] O44 - LFC:[MD5.4CE2C633BAF9E3D4EE1DDEEBC1CA63EB] - 14/08/2013 - 13:42:22 ---A- . (...) -- C:\WINDOWS tdtcsetup.log [6157] O44 - LFC:[MD5.CBE10B77443E13EBBB21BFB6CAD400EB] - 14/08/2013 - 13:42:22 ---A- . (...) -- C:\WINDOWS\ocmsn.log [1710] O44 - LFC:[MD5.CFC620437156C96D241F9F3026D9F508] - 14/08/2013 - 13:42:22 ---A- . (...) -- C:\WINDOWS abletoc.log [1555] O44 - LFC:[MD5.1DBDCF35061AA0EA6387ECC03911CE18] - 14/08/2013 - 13:42:22 ---A- . (...) -- C:\WINDOWS soc.log [14105] O44 - LFC:[MD5.1A8B166D79A0A2C2D9BEDE6C10EBB906] - 14/08/2013 - 13:42:21 ---A- . (...) -- C:\WINDOWS\MedCtrOC.log [2125] O44 - LFC:[MD5.B93579AE2381025C4A798405693D35D8] - 14/08/2013 - 13:42:21 ---A- . (...) -- C:\WINDOWS\msgsocm.log [1545] O44 - LFC:[MD5.02CA43E6C351E16984BF099F8E9079E5] - 14/08/2013 - 13:42:21 ---A- . (...) -- C:\WINDOWS etfxocm.log [5415] O44 - LFC:[MD5.48FAD5EBEB59269ACF7D05E05A59D1A1] - 14/08/2013 - 13:42:21 ---A- . (...) -- C:\WINDOWS\ocgen.log [14780] O44 - LFC:[MD5.574EAC12F003D0BFA91D022FABD0AF09] - 14/08/2013 - 13:42:20 ---A- . (...) -- C:\WINDOWS\FaxSetup.log [30917] O44 - LFC:[MD5.A18BCFCA75B491EED070C51FD17E50ED] - 14/08/2013 - 13:42:15 ---A- . (...) -- C:\WINDOWS\msmqinst.log [9518] O44 - LFC:[MD5.E0A873AEEE710C58B0D2DE2D04D5DB57] - 14/08/2013 - 13:41:55 ---A- . (...) -- C:\WINDOWS\updspapi.log [5726] O44 - LFC:[MD5.965C5140BE87991C68662DFFBD7B7C18] - 14/08/2013 - 13:08:57 ---A- . (...) -- C:\WINDOWS\imsins.BAK [1374] O44 - LFC:[MD5.40BF6F4C6426723A914EEFD9CB983FB5] - 14/08/2013 - 13:08:56 ---A- . (...) -- C:\WINDOWS\system32\TZLog.log [48366] O44 - LFC:[MD5.F1C1DB885313D9C329E48EA5DC02D6F9] - 13/08/2013 - 10:58:05 ---A- . (...) -- C:\WINDOWS\wmsetup.log [1212] ~ Files: 53 Legitimates Filtered in 00mn 26s ---\ Opérations et fonctions au démarrage de Windows Explorer (O46) O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll ~ ShellExecuteHooks: Scanned in 00mn 00s ---\ Export de clé d'application autorisée (O47) O47 - AAKE:Key Export SP - "C:\Program Files\IncrediMail\Bin\IncMail.exe" [Enabled] .(.IncrediMail, Ltd..) -- C:\Program Files\IncrediMail\Bin\IncMail.exe O47 - AAKE:Key Export SP - "C:\Documents and Settings\Sylvaine\Application Data\HiYo\Data\hiyo_install.exe" [Enabled] .(...) -- C:\Documents and Settings\Sylvaine\Application Data\HiYo\Data\hiyo_install.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Program Files\Ubi Soft\Scrabble\Scrabble.exe" [Enabled] .(...) -- C:\Program Files\Ubi Soft\Scrabble\Scrabble.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Program Files rend micro\HijackThis\HijackThis.exe" [Enabled] .(.Trend Micro Inc..) -- C:\Program Files rend micro\HijackThis\HijackThis.exe O47 - AAKE:Key Export SP - "C:\Program Files\IncrediMail\Bin\ImApp.exe" [Enabled] .(.IncrediMail, Ltd..) -- C:\Program Files\IncrediMail\Bin\ImApp.exe O47 - AAKE:Key Export SP - "C:\Program Files\IncrediMail\Bin\ImpCnt.exe" [Enabled] .(.IncrediMail, Ltd..) -- C:\Program Files\IncrediMail\Bin\ImpCnt.exe O47 - AAKE:Key Export SP - "C:\Documents and Settings\Sylvaine\Local Settings\Temp\OnlineUpdate8\SetupXu.exe" [Enabled] .(...) -- C:\Documents and Settings\Sylvaine\Local Settings\Temp\OnlineUpdate8\SetupXu.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Program Files\File Type Assistant sassist.exe" [Enabled] .(.Trusted Software ApS.) -- C:\Program Files\File Type Assistant sassist.exe ~ Keys Export: 51 Legitimates Filtered in 00mn 02s ---\ Image File Execution Options (IFEO) (O50) O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d ~ IFEO: Scanned in 00mn 00s ---\ Enumération des clés de registre StartupReg (SMSR) (O53) O53 - SMSR:HKLM\...\startupreg\Browser Infrastructure Helper [Key] . (...) -- C:\Documents and Settings\Sylvaine\Local Settings\Application Data\Smartbar\Application\QuickShare.exe (.not file.) =>PUP.QuickShare O53 - SMSR:HKLM\...\startupreg\DriverFinder [Key] . (...) -- C:\Program Files\DriverFinder\DriverFinder.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\DriverMax [Key] . (...) -- C:\Program Files\Innovative Solutions\DriverMax\drivermax.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\DriverMax_RESTART [Key] . (...) -- C:\Program Files\Innovative Solutions\DriverMax\drivermax.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\IncrediMail [Key] . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files\IncrediMail\bin\IncMail.exe O53 - SMSR:HKLM\...\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} [Key] . (...) -- C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\Memeo AutoSync [Key] . (...) -- C:\Program Files\Memeo\AutoSync\MemeoLauncher2.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\Memeo Instant Backup [Key] . (...) -- C:\Program Files\Memeo\AutoBackup\MemeoLauncher2.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\Screenpresso [Key] . (.Learnpulse - Screenpresso.) -- C:\Documents and Settings\Sylvaine\Local Settings\Application Data\LearnPulse\Screenpresso\Screenpresso.exe O53 - SMSR:HKLM\...\startupreg\Seagate Dashboard [Key] . (...) -- C:\Program Files\Seagate\Seagate Dashboard\MemeoLauncher.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\vProt [Key] . (...) -- C:\Program Files\AVG Secure Search\vprot.exe (.not file.) =>Toolbar.AVGSearch ~ SMSR Keys: 36 Legitimates Filtered in 00mn 02s ---\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56) O56 - MWPE:[HKCU\...\policies\Explorer] - "HonorAutoRunSetting"=0 O56 - MWPE:[HKLM\...\policies\Explorer] - "HonorAutoRunSetting"=0 ~ MWPE Keys: 7 Legitimates Filtered in 00mn 00s ---\ Liste des pilotes du système (SDL) (O58) O58 - SDL:[MD5.DD8520280304B6145A6BE31008748C7C] - 24/09/2008 - 10:40:22 R--A- . (.Realtek Semiconductor Corp. - Realtek AC'97 Audio Driver (WDM).) -- C:\WINDOWS\system32\Drivers\alcxwdm.sys [4122368] O58 - SDL:[MD5.6D3ADA4CE95CECA7BCE527A08C4C474E] - 02/03/2006 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ansi.sys [9037] ~ Drivers: Scanned in 00mn 06s ---\ Liste des outils de désinfection (LATC) (O63) O63 - Logiciel: HijackThis 2.0.2 - (.TrendMicro.) [HKLM] -- HijackThis O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 ~ ADS: Scanned in 00mn 00s ---\ Liste les services legacy du registre (LALS) (O64) O64 - Services: CurCS - ??\??\???? - Pas de propriétaire (esgiguard) .(...) - LEGACY_ESGIGUARD =>Crapware.SpyHunter O64 - Services: CurCS - 23/01/2013 - C:\Program Files\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe (MsgPlusService) .(.Yuna Software - Service - Messenger Plus! for Skype.) - LEGACY_MSGPLUSSERVICE O64 - Services: CurCS - 08/08/2013 - C:\Program Files\Online Games Manager\ogmservice.exe (ogmservice) .(.RealNetworks, Inc. - Online Games Manager.) - LEGACY_OGMSERVICE ~ Legacy: 158 Legitimates Filtered in 00mn 03s ---\ Menu de démarrage Internet (SMI) (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\ Recherche d'infection sur les navigateurs internet (SBI) (O69) O69 - SBI: SearchScopes [HKCU] ${searchCLSID} - (@ieframe.dll,-12512) - https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8 O69 - SBI: SearchScopes [HKCU] Plasmoo - (Plasmoo) - http://plasmoo.com =>Hijacker.Plasmoo O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (@ieframe.dll,-12512) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8 O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8 O69 - SBI: SearchScopes [HKCU] {B3B3A6AC-74EC-BD56-BCDB-EFA4799FB9DF} - (Amazon) - https://www.amazon.fr/ ~ Keys: Scanned in 00mn 00s ---\ Recherche particulière à la racine du système (SPRF) (O84) [MD5.3098FC81036796741FC1CF8397664776] [SPRF][23/11/2010] (.Adobe Systems Incorporated - Adobe Self Extractor.) -- C:\Program Files\AdbeRdr1000_fr_FR.exe [36181912] [MD5.329C2307685A8D97E2B3D35DDD39EFBE] [SPRF][23/01/2011] (.Lavalys, Inc. - EVEREST Home Edition.) -- C:\Program Files\everesthome220.exe [4179293] [MD5.3E4F11818976EAA9E897CCA83A3ADF6D] [SPRF][23/10/2012] (...) -- C:\Program Files\FFSetup3.0.1.exe [53466540] [MD5.1AECD7495620E1FB03E8C017475C478F] [SPRF][09/06/2013] (...) -- C:\Program Files\FFSetupMultilingual3.1.0.exe [51201320] [MD5.1C114302B853D7AE690CF2E2FC7B0834] [SPRF][22/04/2003] (...) -- C:\Program Files\hpomdl01.dat [16606] [MD5.023CCE4C523DD026EDDF7DE57578F4BC] [SPRF][09/03/2003] (.Hewlett-Packard Co. - HP OfficeJet SendFax Interface.) -- C:\Program Files\hpzc3212.dll [237568] [MD5.1F25D1777F33C9C4000F64E07B7E7F8E] [SPRF][09/03/2003] (.HP - Pas de description.) -- C:\Program Files\hpzglu07.exe [274432] [MD5.3EF50DC371F5CB2F4BA8EFF307D9398D] [SPRF][09/09/2002] (.Hewlett-Packard - SDILog DLL.) -- C:\Program Files\hpzjlog.dll [28722] [MD5.1CCD19B94831D9367709727B6831BE3E] [SPRF][09/09/2002] (.Hewlett-Packard - SDIPrintPath DLL.) -- C:\Program Files\hpzjpp01.dll [417849] [MD5.1904EC97CB651FCE7E895B217C1CAC68] [SPRF][09/09/2002] (.Hewlett-Packard - SDIUtilities DLL.) -- C:\Program Files\hpzjut01.dll [249913] [MD5.69FF6F3FA7862AFE8B56B4B8512EF43E] [SPRF][09/09/2002] (.Hewlett-Packard - SDIPrintPath DLL.) -- C:\Program Files\hpzjvp01.dll [49212] [MD5.1A800ADC5172B6E6A5DCBAC1F7849C93] [SPRF][09/09/2002] (.HP - Pas de description.) -- C:\Program Files\hpzpnp07.dll [212992] [MD5.BFF33648E41A5C13017073C62DCEAC97] [SPRF][09/03/2003] (.HP - Pas de description.) -- C:\Program Files\hpzscr07.dll [184320] [MD5.ACC1E2DCC38EF00452EB0B754351226E] [SPRF][21/02/2010] (.Microsoft Corporation - Auto-extraction de fichier CAB.) -- C:\Program Files\IE8-WindowsXP-x86-FRA.exe [17001840] [MD5.EA2419D0D5C80F668450551C6AD9958A] [SPRF][10/11/2010] (.IncrediMail Ltd. - IncrediMail Setup.) -- C:\Program Files\IncrediMailSetup.exe [14469064] [MD5.8BC07B24203A9FCB6A661D7C1307D2F2] [SPRF][19/11/2010] (...) -- C:\Program Files\IncrediMailSetup_fr.exe [15069640] [MD5.D0F3133DFE419A885C1C4FC063DB3F9D] [SPRF][14/01/2011] (.Pas de propriétaire - IncrediMail Installer.) -- C:\Program Files\incredimail_install.exe [449360] [MD5.6E23EADBA1E84F43E5D28053A8BA27A9] [SPRF][23/06/2010] (.Adobe Systems, Inc. - Adobe® Flash® Player Installer/Uninstaller 10.1 r53.) -- C:\Program Files\install_flash_player.exe [2568656] [MD5.DF7507AAF7991CE25565CB9175B166E2] [SPRF][22/12/2010] (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Program Files\mbam-setup-1.50.1.exe [7734208] [MD5.A8294075E6FC848779BF37E921635DB6] [SPRF][09/09/2002] (.Microsoft Corporation - Microsoft (R) C++ Runtime Library.) -- C:\Program Files\msvcirt.dll [70656] [MD5.2B151F1551A46D5A01DBFB8ED0D8574F] [SPRF][09/09/2002] (.Microsoft Corporation - Microsoft (R) C Runtime Library.) -- C:\Program Files\msvcrt.dll [254005] [MD5.3E144F01528DFEB887FB6DEFD68D58C3] [SPRF][28/10/2010] (.Pas de propriétaire - PhotoMail Content Pack Installer.) -- C:\Program Files\photomail_cp_install.exe [666864] [MD5.4F42027B6B7F73E49F2608869A008970] [SPRF][28/10/2010] (.Pas de propriétaire - PhotoMail Maker Installer.) -- C:\Program Files\photomail_install.exe [656080] [MD5.8377FA7E5AFE48D93BD646446EFD22D8] [SPRF][04/12/2010] (.Pas de propriétaire - Photo Notifier and Animation Creator Installer.) -- C:\Program Files\pnac_install.exe [444240] [MD5.15B9DE0B65F03AFE4235B261FE4E28DC] [SPRF][26/11/2009] (...) -- C:\Program Files\portable.dat [10] [MD5.9353FE7988E1D81A6584802CF6CC25A5] [SPRF][19/07/2009] (.--- - Capture les images incluses dans les fichiers PPT ou PPS.) -- C:\Program Files\PowerpointImageCopier.exe [636416] [MD5.15D1ED3110CAAAD7AF321C4C8FB697F9] [SPRF][03/12/2010] (.LearnPulse - Screenpresso.) -- C:\Program Files\Screenpresso.exe [5292032] [MD5.8A04CEF51AF9D57CFD8E2416E2786B4F] [SPRF][19/04/2011] (.Pas de propriétaire - AVAST Software Setup Engine.) -- C:\Program Files\setup_av_free.exe [66297216] [MD5.7FED9CC66EC9A2BB312BB9E6EEF3C55C] [SPRF][13/01/2011] (.Pas de propriétaire - AVAST Software Setup Engine.) -- C:\Program Files\setup_av_free_fre.exe [49985000] [MD5.C0F6E64036E609D2326D045C497D695C] [SPRF][09/09/2002] (.Microsoft Corporation - Standard USB printing Port Monitor DLL.) -- C:\Program Files\usbmon.dll [12288] [MD5.BDCF7F43ABD107E8F7D31D78C1B096A8] [SPRF][09/09/2002] (.Microsoft Corporation - USB Printer driver.) -- C:\Program Files\usbprint.sys [22608] [MD5.9E8E8B2FB9178DC9D6AB69D685D8F1E8] [SPRF][06/01/2011] (...) -- C:\Program Files\vente_flash_setup.exe [2506243] [MD5.18075B2C9F0F300BEE209744A8BEC353] [SPRF][05/01/2009] (...) -- C:\WINDOWS\Downloaded Program Files\bdcore.dll [32] [MD5.3FEA9D2EDF23B0283C7A66C8DEA380BD] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player Module.) -- C:\WINDOWS\Downloaded Program Files\dwusplay.dll [24576] [MD5.CDBE35EA59BC9223E4F800BD1DB82D27] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player.) -- C:\WINDOWS\Downloaded Program Files\dwusplay.exe [196608] [MD5.245E2761D02D2FC40B857D71F8A96616] [SPRF][08/06/2010] (.Adobe Systems, Inc. - Adobe® Flash® Player Installer/Uninstaller 10.1 r53.) -- C:\WINDOWS\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe [2605008] [MD5.CDE357CD3FC047F5C7D8B8345B6A42BF] [SPRF][18/10/2007] (.Hewlett-Packard Co. - HPDEXADO.) -- C:\WINDOWS\Downloaded Program Files\HPDEXAXO.dll [341296] [MD5.2B1C4C87EB20ADDBA59DCA975E28DFFB] [SPRF][05/01/2009] (...) -- C:\WINDOWS\Downloaded Program Files\ipsupd.dll [741376] [MD5.5002991ADA7920B35E46E7EA80C134FE] [SPRF][16/06/2004] (.InstallShield Software Corporation - InstallShield Update Service Web Agent.) -- C:\WINDOWS\Downloaded Program Files\isusweb.dll [323584] [MD5.18075B2C9F0F300BEE209744A8BEC353] [SPRF][05/01/2009] (...) -- C:\WINDOWS\Downloaded Program Files\libfn.dll [32] ~ Files: Scanned in 00mn 32s ---\ Enumère les codes produits des logiciels (PUC) (O90) O90 - PUC: "49C22FC2963140C4A9F54ACBD6195B80" . (.IncrediMail.) -- C:\WINDOWS\Installer\{2CF22C94-1369-4C04-9A5F-A4BC6D91B508}\ARPPRODUCTICON.exe O90 - PUC: "4A4A2EB6BF99DE84EAE1E45830988F40" . (.PartitionMagic.) -- C:\WINDOWS\Installer\{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}\ARPPRODUCTICON.exe ~ Update Products: 86 Legitimates Filtered in 00mn 00s ---\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS) [MD5.4755E91433A3B67E78B40534BA1722AC] [WIS][01/08/2013] (.Skype Technologies S.A. - Skype.) -- C:\Windows\Installer\1684619.msi [1615360] [MD5.681EE195E1C3DDCC7E336B04C2C060C2] [WIS][27/09/2012] (.Babylon Ltd - BabylonObjectInstaller.) -- C:\Windows\Installer\18fa52d.msi [22528] =>Toolbar.Babylon [MD5.E6A67DB53DBC333344C541404A82722E] [WIS][07/08/2013] (.Google - Google Earth.) -- C:\Windows\Installer\1e36435.msi [916992] [MD5.04788FBCE78C8437CD09183D6324F780] [WIS][30/07/2013] (.IncrediMail - IncrediMail.) -- C:\Windows\Installer\3800c0.msi [2682880] [MD5.16002007500E1265F3112001FE22AB0B] [WIS][31/01/2013] (.IncrediMail - IncrediMail.) -- C:\Windows\Installer\54742d.msi [2684416] [MD5.2EC0BB50E60145F6C2B67D3E16EBD5C6] [WIS][09/06/2012] (.Nom de votre société - Photo Notifier and Animation Creator.) -- C:\Windows\Installer\66573a.msi [1106944] [MD5.3EA245BEC7704E53C25C682DDCADB949] [WIS][09/03/2013] (.Facebook - Facebook Messenger 2.1.4814.0.) -- C:\Windows\Installer\93fabe.msi [196096] [MD5.38B81C5E01379FB2EC270ACA4697FD9F] [WIS][28/10/2010] (.Nom de votre société - PhotoMail Maker.) -- C:\Windows\Installer\a733a4.msi [1152512] [MD5.775ADB0D4A7316EBA8B71E7C03A39633] [WIS][23/06/2010] (.Builds the Destinations MSI - Builds the Destinations MSI.) -- C:\Windows\Installer\ad7a96.msi [522752] [MD5.FE47BCB7D33B91125C891C2CB7D6EB21] [WIS][06/02/2010] (.PowerQuest Corporation - PartitionMagic.) -- C:\Windows\Installer\bce6d2.msi [2300416] ~ WIS: 93 Legitimates Filtered in 00mn 53s ---\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Demand 15/08/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe SR - | Auto 09/05/2013 46808 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe SS - | Demand 14/04/2008 225280 | (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\system32\dmadmin.exe SR - | Auto 20/03/2013 233472 | (FsUsbExService) . (.Teruten.) - C:\WINDOWS\system32\FsUsbExService.exe SS - | Auto 07/08/2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 07/08/2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SR - | Demand 14/04/2008 14336 | C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqcxs08.dll (hpqcxs08) . (.Hewlett-Packard Co..) - C:\WINDOWS\system32\svchost.exe SR - | Auto 14/04/2008 14336 | C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqddsvc.dll (hpqddsvc) . (.Hewlett-Packard Co..) - C:\WINDOWS\system32\svchost.exe SR - | Auto 15/08/2013 182184 | (JavaQuickStarterService) . (.Oracle Corporation.) - C:\Program Files\Java\jre7\bin\jqs.exe SS - | Demand 05/02/2013 312704 | (maconfservice) . (.CybelSoft.) - C:\Program Files\ma-config.com\maconfservice.exe SS - | Demand 17/08/2013 117656 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe SR - | Auto 23/01/2013 125952 | (MsgPlusService) . (.Yuna Software.) - C:\Program Files\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe SR - | Auto 14/04/2008 14336 | C:\WINDOWS\system32\HPZinw12.dll (Net Driver HPZ12) . (.Hewlett-Packard.) - C:\WINDOWS\system32\svchost.exe SR - | Auto 16/11/2006 159811 | (NVSvc) . (.NVIDIA Corporation.) - C:\WINDOWS\system32 vsvc32.exe SR - | Auto 08/08/2013 559552 | (ogmservice) . (.RealNetworks, Inc..) - C:\Program Files\Online Games Manager\ogmservice.exe SR - | Auto 14/04/2008 14336 | C:\WINDOWS\system32\HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) - C:\WINDOWS\system32\svchost.exe SS - | Auto 25/07/2013 162672 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe ~ Services: Scanned in 00mn 57s ---\ Scan Additionnel (O88) Database Version : v2.12859 - (18/08/2013) Clés trouvées (Keys found) : 16 Valeurs trouvées (Values found) : 0 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 2 [HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\Browser Infrastructure Helper] =>PUP.QuickShare^ [HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\vProt] =>Toolbar.AVGSearch^ [HKCU\Software\bbrs_002.tb] =>PUP.Blabbers [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ESGIGUARD] =>Crapware.SpyHunter [HKLM\Software\Classes\.bdc] =>Toolbar.Conduit [HKLM\Software\Classes\.bgl] =>Toolbar.Conduit [HKLM\Software\Classes\.bof] =>Toolbar.Conduit [HKCU\Software\Plasmoo.com] =>Hijacker.Plasmoo [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}] =>Toolbar.Avast [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}] =>Toolbar.Avast [HKLM\Software\Classes\CLSID\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}] =>Toolbar.Avast [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}] =>Toolbar.Avast [HKLM\Software\Classes\IncrediSpooler.DeltaSync] =>toolbar.DeltaSearch [HKLM\Software\Classes\IncrediSpooler.DeltaSync.1] =>toolbar.DeltaSearch [HKLM\Software\Classes\AppID\Iminent.LinkToContentFF.DLL] =>Adware.IMBooster [HKLM\Software\Classes\AppID\Iminent.WinCore.Aim.Plugin.DLL] =>Adware.IMBooster [HKLM\Software\Trymedia Systems] =>Adware.Trymedia^ Windows\Installer\18fa52d.msi =>Toolbar.Babylon^ ~ Additionnel Scan: 257367 Items scanned in 01mn 08s ---\ Récapitulatif des détections trouvées sur votre station ~ http://nicolascoolman.webs.com/apps/blog/show/30414055-hijacker-plasmoo =>Hijacker.Plasmoo ~ http://nicolascoolman.webs.com/apps/blog/show/29710349-adware-trymedia =>Adware.Trymedia ~ http://nicolascoolman.webs.com/apps/blog/show/28577022-pup-quickshare =>PUP.QuickShare ~ http://nicolascoolman.webs.com/apps/blog/show/26609241-crapware-spyhunter =>Crapware.SpyHunter ~ http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon =>Toolbar.Babylon ~ http://nicolascoolman.webs.com/apps/blog/show/27280149-pup-blabbers =>PUP.Blabbers ~ http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit ~ http://nicolascoolman.webs.com/apps/blog/show/30898585-toolbar-avast =>Toolbar.Avast ~ http://nicolascoolman.webs.com/apps/blog/show/27875657-toolbar-deltasearch =>Toolbar.DeltaSearch ~ http://nicolascoolman.webs.com/apps/blog/show/26684723-adware-imbooster =>Adware.IMBooster ~ MSI: 10 link(s) detected in 01mn 08s ~ 1131 Legitimates filtered by white list End of the scan (565 lines in 06mn 11s)(0)

2011N2 · Answer

Re,

Fais ZHPFix comme ceci avec ces lignes.
Poste moi le rapport obtenu.

Gabriel.

giadou · Answer

Voici le rapport ZHPFix :

Rapport de ZHPFix 2013.7.20.5 par Nicolas Coolman, Update du 20/07/2013
Fichier d'export Registre : C:\ZHP\ZHPExportRegistry-18-08-2013-18-35-05.txt
Run by Sylvaine at 18/08/2013 18:34:55
High Elevated Privileges : OK
Windows XP Professional Service Pack 3 (Build 2600)

Corbeille vidée

========== Clé(s) du Registre ==========
SUPPRIME Key: HKCU\Software\Plasmoo.com
SUPPRIME Key: HKCU\Software\bbrs_002.tb
SUPPRIME Key: HKLM\Software\Trymedia Systems
SUPPRIME Key:  StartupReg: Browser Infrastructure Helper
SUPPRIME Key: Service Legacy: LEGACY_ESGIGUARD
ABSENT SearchScopes :BI: SearchScopes [HKCU] Plasmoo
ABSENT Key: HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\Browser Infrastructure Helper
ABSENT Key: HKCU\Software\bbrs_002.tb
ABSENT Key: HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ESGIGUARD
SUPPRIME Key: HKLM\Software\Classes\AppID\Iminent.LinkToContentFF.DLL
SUPPRIME Key: HKLM\Software\Classes\AppID\Iminent.WinCore.Aim.Plugin.DLL
ABSENT Key: HKLM\Software\Trymedia Systems
SUPPRIME Key:  StartupReg: vProt
ABSENT Key: HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\vProt
SUPPRIME Key: HKLM\Software\Classes\.bdc
SUPPRIME Key: HKLM\Software\Classes\.bgl
SUPPRIME Key: HKLM\Software\Classes\.bof
SUPPRIME Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}
SUPPRIME Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}
SUPPRIME Key: HKLM\Software\Classes\CLSID\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}
SUPPRIME Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}
SUPPRIME Key: HKLM\Software\Classes\IncrediSpooler.DeltaSync
SUPPRIME Key: HKLM\Software\Classes\IncrediSpooler.DeltaSync.1
SUPPRIME Key: CLSID Extra Buttons: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2}
SUPPRIME Key:  StartupReg: DriverFinder

========== Valeur(s) du Registre ==========
SUPPRIME RunValue: ctfmon.exe
ABSENT RunValue: ctfmon.exe
SUPPRIME Toolbar: {4DAAC69C-CBA7-45E2-9BC8-1044483D3352}

========== Dossier(s) ==========
Aucun dossiers CLSID Local utilisateur vide

========== Fichier(s) ==========
ABSENT File: c:\documents and settings\sylvaine\local settings\application data\smartbar\application\quickshare.exe
SUPPRIME File: C:\Windows\Installer\18fa52d.msi
ABSENT File: c:\program files\avg secure search\vprot.exe
ABSENT File: c:\program files\driverfinder\driverfinder.exe
SUPPRIME Temporaires Windows
SUPPRIME Flash Cookies

========== Restauration Système ==========
Point de restauration du système créé avec succès

========== Autre ==========
NON TRAITE Windows\Installer\18fa52d.msi


========== Récapitulatif ==========
25 : Clé(s) du Registre
3 : Valeur(s) du Registre
1 : Dossier(s)
6 : Fichier(s)
1 : Restauration Système
1 : Autre


End of clean in 01mn 16s

========== Chemin de fichier rapport ==========
C:\ZHP\ZHPFix[R1].txt - 18/08/2013 18:35:05 [2929]

2011N2 · Answer

Re,

Ok, mets à jour Malwarebytes puis fais un examen complet sur tous les disques. Supprime les éléments détectés et poste moi le rapport.

Si tu as besoin d'un tutoriel : http://www.forum-entraide-informatique.com/support/malwarebytes-anti-malware-mbam-tutoriel-t6.html

Gabriel.

giadou · Answer

Voici le rapport Malwarebytes :

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Version de la base de données: v2013.08.18.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Sylvaine :: SYLVAINE-G [administrateur]

18/08/2013 19:11:30
mbam-log-2013-08-18 (19-11-30).txt

Type d'examen: Examen complet (A:\|C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|M:\|N:\|O:\|)
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 279722
Temps écoulé: 3 heure(s), 10 minute(s), 48 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 2
C:\Documents and Settings\Sylvaine\Mes documents\Téléchargements\yosetup(1).exe (PUP.Optional.OpenCandy) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\Sylvaine\Mes documents\Téléchargements\yosetup.exe (PUP.Optional.OpenCandy) -> Mis en quarantaine et supprimé avec succès.

(fin)

2011N2 · Answer

Re,

Ok fais moi un nouveau ZHPDiag pour voir si tout est ok.
Comment se comporte le PC ?

Gabriel.

giadou · Answer

OK, mais je le ferais demain matin car là il se fait tard.

Je trouve toujours que les messages reçus dans ma messagerie Incredimail sont longs à s'afficher quand je veux les lire.

Merci de ta patience.

Bonne nuit.

2011N2 · Answer

Re,

Ok bonne nuit et à demain. :)

Gabriel.

giadou · Answer

Bonjour Gabriel, Ce matin, j'ai pu lire mes messages reçus sur Incredimail sans peiner. J'ai remarqué que ma barre d'outils sur Firefox a été modifiée, avant j'avais suite à la dernière mise à jour " outils d'administration " maintenant j'ai " outils " tout court comme avant. Je te poste mon nouveau rapport ZHPDiag : ~ Rapport de ZHPDiag v2013.8.18.26 - Nicolas Coolman (18/08/2013) ~ Lancé par Sylvaine (19/08/2013 09:21:52) ~ Adresse du Site Web https://nicolascoolman.webs.com/ ~ Traduit par Nicolas Coolman ~ Etat de la version : Version à jour. ~ Liste blanche : Activée par le programme ~ Elévation des Privilèges : OK ~ User Account Control (UAC): Not Found ---\ Navigateurs Internet MSIE: Internet Explorer v8.0.6001.18702 MFIE: Mozilla Firefox 23.0.1 (Defaut) ---\ Informations sur les produits Windows ~ Langage: Français Windows XP Professional Service Pack 3 (Build 2600) Windows Automatic Updates : OK Windows Genuine Advantage : OK ---\ Logiciels de protection du système avast! Free Antivirus v8.0.1489.0 Malwarebytes Anti-Malware version 1.75.0.1300 ---\ Logiciels d'optimisation du système CCleaner v4.04 =>Piriform Ltd ---\ Logiciels de partage PeerToPeer ---\ Surveillance de Logiciels Adobe Flash Player 11 Plugin Adobe Reader XI Java 7 Update 25 ---\ Informations sur le système ~ Processor: x86 Family 15 Model 2 Stepping 9, GenuineIntel ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 767 MB (54% free) System Restore: Activé (Enable) System drive C: has 50 GB (63%) free of 78 GB ---\ Mode de connexion au système ~ Computer Name: SYLVAINE-G ~ User Name: Sylvaine ~ All Users Names: Sylvaine, SUPPORT_388945a0, HelpAssistant, Administrateur, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\ Variables d'environnement ~ System Unit : C:\ ~ %AppData% : C:\Documents and Settings\Sylvaine\Application Data\ ~ %Desktop% : C:\Documents and Settings\Sylvaine\Bureau\ ~ %Favorites% : C:\Documents and Settings\Sylvaine\Favoris\ ~ %LocalAppData% : C:\Documents and Settings\Sylvaine\Local Settings\Application Data\ ~ %StartMenu% : C:\Documents and Settings\Sylvaine\Menu Démarrer\ ~ %Windir% : C:\WINDOWS\ ~ %System% : C:\WINDOWS\system32\ ---\ Enumération des unités disques A:\ Floppy drive, Flash card reader, USB Key (Not Inserted) C:\ Hard drive, Flash drive, Thumb drive (Free 50 Go of 78 Go) D:\ CD-ROM drive (Not Inserted) E:\ CD-ROM drive (Not Inserted) F:\ Hard drive, Flash drive, Thumb drive (Free 49 Go of 49 Go) G:\ Hard drive, Flash drive, Thumb drive (Free 450 Go of 466 Go) H:\ Hard drive, Flash drive, Thumb drive (Free 39 Go of 39 Go) I:\ Hard drive, Flash drive, Thumb drive (Free 32 Go of 32 Go) J:\ Hard drive, Flash drive, Thumb drive (Free 79 Go of 79 Go) M:\ Floppy drive, Flash card reader, USB Key (Not Inserted) N:\ Floppy drive, Flash card reader, USB Key (Not Inserted) O:\ Hard drive, Flash drive, Thumb drive (Free 17 Go of 21 Go) ---\ Etat du Centre de Sécurité Windows [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date ~ Security Center: 33 Legitimates Filtered in 00mn 00s ---\ Recherche particulière de fichiers génériques [MD5.F2317622D29F9FF0F88AEECD5F60F0DD] - (.Microsoft Corporation - Explorateur Windows.) (.14/04/2008 - 03:34:03.) -- C:\WINDOWS\Explorer.exe [1037824] [MD5.E1948293F7CBC38987270432935D8D05] - (.Microsoft Corporation - Internet Extensions for Win32.) (.26/07/2013 - 03:47:15.) -- C:\WINDOWS\system32\wininet.dll [920064] [MD5.DD73D6B9F6B4CB630CF35B438B540174] - (.Microsoft Corporation - Application d'ouverture de session Windows NT.) (.14/04/2008 - 03:34:28.) -- C:\WINDOWS\system32\Winlogon.exe [512000] [MD5.1E44BC1E83D8FD2305F8D452DB109CF9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.17/08/2011 - 14:49:54.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496] [MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.13/04/2008 - 19:40:30.) -- C:\WINDOWS\system32\Drivers\atapi.sys [96512] [MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/04/2008 - 20:14:21.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744] [MD5.1F4260CC5B42272D71F79E570A27A4FE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.13/04/2008 - 19:40:46.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [62976] [MD5.31F923EB2170FC172C81ABDA0045D18C] - (.Microsoft Corporation - Pilote de cryptographie FIPS.) (.14/04/2008 - 02:57:38.) -- C:\WINDOWS\system32\Drivers\Fips.sys [44672] [MD5.573C7D0A32852B48F3058CFD8026F511] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.13/04/2008 - 17:36:05.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [144384] [MD5.A09BDC4ED10E3B2E0EC27BB94AF32516] - (.Microsoft Corporation - Pilote de port i8042.) (.14/04/2008 - 03:00:52.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [54144] [MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.13/04/2008 - 19:40:58.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [42112] [MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.13/04/2008 - 19:57:15.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [152832] [MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.13/04/2008 - 20:19:42.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [75264] [MD5.7D304A5EB4344EBEEAB53A2FE3FFB9F0] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.15/07/2011 - 14:29:31.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [456320] [MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.13/04/2008 - 20:21:00.) -- C:\WINDOWS\system32\Drivers etBT.sys [162816] [MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.13/04/2008 - 20:15:53.) -- C:\WINDOWS\system32\Drivers tfs.sys [574976] [MD5.8FD0BDBEA875D06CCF6C945CA9ABAF75] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/04/2008 - 03:09:40.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80384] [MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13/04/2008 - 20:19:43.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328] [MD5.15CABD0F7C00C47C70124907916AF3F1] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.13/04/2008 - 19:32:51.) -- C:\WINDOWS\system32\Drivers dpdr.sys [196224] [MD5.D8EB2A7904DB6C916EB5361878DDCBAE] - (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) (.14/04/2008 - 02:57:34.) -- C:\WINDOWS\system32\Drivers edbook.sys [58752] [MD5.46DE1126684369BACE4849E4FC8C43CA] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.14/04/2008 - 02:56:04.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [53376] ~ Generic Processes: Scanned in 00mn 00s ---\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 2/27 ~ Mes musiques (My Musics) : 1/2 ~ Mes Videos (My Videos) : 1/21 ~ Mes Favoris (My Favorites) : 1/358 ~ Mes Documents (My Documents) : 2/1034 ~ Mon Bureau (My Desktop) : 0/27 ~ Menu demarrer (Programs) : 0/32 ~ Hidden Files: Scanned in 00mn 06s ---\ Processus lancés au démarrage du système [MD5.28D6701C710AD7BA3CB95E75F8F1A9AA] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808] [PID.1492] [MD5.0796C1E47ADB9825269E64B9DAB4E741] - (.Teruten - FsUsbDevice.) -- C:\WINDOWS\system32\FsUsbExService.exe [233472] [PID.1184] [MD5.9ECF00E19736054E019C532AED8228FC] - (.Oracle Corporation - Java Quick Starter Service.) -- C:\Program Files\Java\jre7\bin\jqs.exe [182184] [PID.1332] [MD5.97A4A2A00B1FAD261E7DAC0136E7EE31] - (.Yuna Software - Service - Messenger Plus! for Skype.) -- C:\Program Files\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe [125952] [PID.1480] [MD5.25E40292DD289F644660F440F38239BE] - (.RealNetworks, Inc. - Online Games Manager.) -- C:\Program Files\Online Games Manager\ogmservice.exe [559552] [PID.1984] [MD5.3F11B20D12D89365D7721BDC860CE5F0] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968] [PID.3256] [MD5.D63797E8E7781EE1500A810CB6194FA6] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe [253816] [PID.3464] [MD5.D5CDEA452982FC61E21EE978AAB134DD] - (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files\IncrediMail\Bin\IncMail.exe [367016] [PID.3736] [MD5.312707A513F86ED20642F43F8EF4DD14] - (.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files\IncrediMail\Bin\ImApp.exe [264616] [PID.3460] [MD5.3A528C8FA188E1398976C5470C17B225] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7828992] [PID.164] [MD5.5E9A6658A2A69AE7EB195113B7A2E7A9] - (.Microsoft Corporation - Application Layer Gateway Service.) -- C:\WINDOWS\System32\alg.exe [44544] [PID.2320] ~ Processes Running: Scanned in 00mn 02s ---\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) C:\Documents and Settings\Sylvaine\Application Data\Mozilla\Firefox\Profiles\u69j6ewu.default-1354115506843\prefs.js C:\Documents and Settings\Sylvaine\Application Data\Mozilla\Firefox\Profiles\z4dbkilm.default-1369850942796\prefs.js M3 - MFPP: Plugins - [Sylvaine] -- C:\Documents and Settings\Sylvaine\Application Data\Mozilla\Firefox\Profiles\z4dbkilm.default-1369850942796\searchplugins\amazon.xml ~ Firefox Browser: 16 Legitimates Filtered in 00mn 00s ---\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4) R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.amazon.fr/ ~ IE Browser: 13 Legitimates Filtered in 00mn 00s ---\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\WINDOWS\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl" ~ Keys: Scanned in 00mn 00s ---\ Hosts file redirection (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 02s ~ Nombre de lignes (Lines number): 15260 ---\ Internet Explorer Toolbars (O3) O3 - Toolbar: (no name) - [HKLM]{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} Clé orpheline O3 - Toolbar: Barre de confiance - [HKLM]{55BDF3B0-C0A8-481A-B8A6-01CD2BE0F3FD} . (.Euro-Information - Barre de Confiance.) -- C:\Program Files\Barre de Confiance\TAPBar.dll O3 - Toolbar\WebBrowser: (no name) - [HKCU]{01E04581-4EEE-11D0-BFE9-00AA005B4383} Clé orpheline O3 - Toolbar\WebBrowser: (no name) - [HKCU]{0E5CBF21-D15F-11D0-8301-00AA005B4383} Clé orpheline ~ Toolbar: Scanned in 00mn 00s ---\ Applications démarrées par registre & par dossier (O4) O4 - HKLM\..\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe O4 - HKLM\..\Run: [NvCplDaemon] . (.NVIDIA Corporation - NVIDIA Display Properties Extension.) -- C:\WINDOWS\system32\NvCpl.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe ~ Application: Scanned in 00mn 00s ---\ Autres liens utilisateurs (O4) O4 - GS\Programs: Adobe Reader XI.lnk . (...) -- C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-AB0000000001}\SC_Reader.ico O4 - GS\Programs: IncrediMail.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files\IncrediMail\Bin\IncMail.exe O4 - GS\Programs: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O4 - GS\Programs: Windows Movie Maker.lnk . (.Microsoft Corporation - Windows Movie Maker.) -- C:\Program Files\Movie Maker\moviemk.exe O4 - GS\Programs: Assistance à distance.lnk . (.Microsoft Corporation - Assistance à distance Microsoft.) -- C:\WINDOWS\system32 cimlby.exe O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Programs: Outlook Express.lnk . (.Microsoft Corporation - Outlook Express.) -- C:\Program Files\Outlook Express\msimn.exe O4 - GS\Programs: Screenpresso.lnk . (.Learnpulse - Screenpresso.) -- C:\Documents and Settings\Sylvaine\Local Settings\Application Data\LearnPulse\Screenpresso\Screenpresso.exe O4 - GS\Programs: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe ~ Global Startup: Scanned in 00mn 00s ---\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} -- Clé orpheline O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO O9 - Extra button: Afficher ou masquer l'HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} . (.Hewlett-Packard Co. - HP Smart Web Printing add-on for Internet Explorer.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe ~ IE Extra Buttons: Scanned in 00mn 00s ---\ Objets ActiveX (Downloaded Program Files)(O16) O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} ((no name)) - http://download.bitdefender.com/resources/scanner/sources/fr/scan8/oscan8.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} ((no name)) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1342001082843 O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} ((no name)) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} ((no name)) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab ~ Objets ActiveX: Scanned in 00mn 00s ---\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{4A1C820D-9919-4270-B137-41F5C811FF37}: DhcpNameServer = 212.27.40.240 212.27.40.241 O17 - HKLM\System\CS1\Services\Tcpip\..\{4A1C820D-9919-4270-B137-41F5C811FF37}: DhcpNameServer = 212.27.40.240 212.27.40.241 O17 - HKLM\System\CS3\Services\Tcpip\..\{4A1C820D-9919-4270-B137-41F5C811FF37}: DhcpNameServer = 212.27.40.240 212.27.40.241 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.240 212.27.40.241 ~ Domain: Scanned in 00mn 00s ---\ Titr_HJT34=Protocole additionnel (O18) O18 - Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} . (.Microsoft Corporation - Windows Live Mail.) -- C:\Program Files\Windows Live\Mail\mailcomm.dll O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\MSOXMLMF.dll ~ Protocole Additionnel: Scanned in 00mn 00s ---\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dll O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dll O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agent réseau hors connexion.) -- C:\WINDOWS\system32\cscdll.dll O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\system32\dimsntfy.dll O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL secondaire de notification de service d.) -- C:\WINDOWS\system32\sclgntfy.dll O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\WlNotify.dll O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll ~ Winlogon: Scanned in 00mn 00s ---\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: Online Games Manager (ogmservice) . (.RealNetworks, Inc. - Online Games Manager.) - C:\Program Files\Online Games Manager\ogmservice.exe O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files\Skype\Updater\Updater.exe ~ Services: 8 Legitimates Filtered in 00mn 08s ---\ Enumération Active Desktop & MHTML Editor (O24) O24 - Desktop General: BackupWallPaper - .(...) - C:\Documents and Settings\Sylvaine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop General: WallPaper - .(...) - C:\Documents and Settings\Sylvaine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp ~ Desktop Component: 4 Legitimates Filtered in 00mn 00s ---\ Tâches planifiées en automatique (O39) O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\ProgramRefresh-ATFST.job [456] O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\ProgramUpdateCheck.job [400] [MD5.CEC66E3CA216A4783C6FC54B4FE36DBD] [APT] [ProgramRefresh-ATFST] (...) -- C:\Program Files\File Type Assistant\TSASetup.exe [1492080] ~ Scheduled Task: 20 Legitimates Filtered in 00mn 01s ---\ Logiciels installés (O42) O42 - Logiciel: IncrediMail - (.IncrediMail.) [HKLM] -- {2CF22C94-1369-4C04-9A5F-A4BC6D91B508} O42 - Logiciel: IncrediMail 2.0 - (.IncrediMail Ltd..) [HKLM] -- IncrediMail ~ Logic: 123 Legitimates Filtered in 00mn 01s ---\ HKCU & HKLM Software Keys [HKCU\Software\IncrediMail] [HKLM\Software\imagecapture] ~ Key Software: 226 Legitimates Filtered in 00mn 01s ---\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 16/02/2010 - 14:06:53 - [187,986] ----D C:\Program Files\Drivers O43 - CFD: 22/03/2011 - 11:37:10 - [5,280] ----D C:\Program Files\Fichier content down O43 - CFD: 02/08/2013 - 11:41:19 - [26,259] ----D C:\Program Files\IncrediMail O43 - CFD: 16/12/2012 - 23:56:48 - [0,760] ----D C:\Program Files\IncrediMail(2) O43 - CFD: 25/07/2012 - 22:03:53 - [1,674] ----D C:\Program Files\lang O43 - CFD: 15/02/2010 - 14:56:23 - [4,693] ----D C:\Program Files\util O43 - CFD: 05/02/2010 - 20:11:24 - [0,000] ----D C:\Documents and Settings\All Users\Application Data\IM O43 - CFD: 18/06/2010 - 10:43:11 - [11,404] ----D C:\Documents and Settings\All Users\Application Data\IncrediMail O43 - CFD: 18/06/2010 - 10:43:04 - [6,573] ----D C:\Documents and Settings\All Users\Application Data\IncrediMail(2) O43 - CFD: 25/05/2011 - 16:08:15 - [0,206] ----D C:\Documents and Settings\Sylvaine\Application Data\com.codeode O43 - CFD: 02/08/2013 - 11:40:17 - [855,080] ----D C:\Documents and Settings\Sylvaine\Local Settings\Application Data\IM ~ Program Folder: 189 Legitimates Filtered in 01mn 50s ---\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 19/08/2013 - 07:39:09 ---A- . (...) -- C:\WINDOWS\system32\NvApps.xml [0] O44 - LFC:[MD5.650E4637D12B7DE5C33124433AC6DE1B] - 19/08/2013 - 07:37:44 ---A- . (...) -- C:\WINDOWS\wiadebug.log [159] O44 - LFC:[MD5.A999AE5B1C31C3D6E4E98ADB3F760E91] - 19/08/2013 - 07:37:43 ---A- . (...) -- C:\WINDOWS\wiaservc.log [50] O44 - LFC:[MD5.254FFD9FE6CACC8E9D9EC8547973C924] - 17/08/2013 - 09:24:48 ---A- . (...) -- C:\WINDOWS\system.ini [246] O44 - LFC:[MD5.1085B023D2A982AD1A3EC13076290756] - 17/08/2013 - 09:24:48 ---A- . (...) -- C:\WINDOWS\win.ini [637] O44 - LFC:[MD5.D6670F07513B0599CF3EC0AE155A558F] - 14/08/2013 - 13:42:23 ---A- . (...) -- C:\WINDOWS\comsetup.log [10153] O44 - LFC:[MD5.E358C2A4001A95ABC5248135F0379E2A] - 14/08/2013 - 13:42:23 ---A- . (...) -- C:\WINDOWS\iis6.log [33278] O44 - LFC:[MD5.468BBD9B34327393003562E44107B033] - 14/08/2013 - 13:42:22 ---A- . (...) -- C:\WINDOWS\imsins.log [1374] O44 - LFC:[MD5.4CE2C633BAF9E3D4EE1DDEEBC1CA63EB] - 14/08/2013 - 13:42:22 ---A- . (...) -- C:\WINDOWS tdtcsetup.log [6157] O44 - LFC:[MD5.CBE10B77443E13EBBB21BFB6CAD400EB] - 14/08/2013 - 13:42:22 ---A- . (...) -- C:\WINDOWS\ocmsn.log [1710] O44 - LFC:[MD5.CFC620437156C96D241F9F3026D9F508] - 14/08/2013 - 13:42:22 ---A- . (...) -- C:\WINDOWS abletoc.log [1555] O44 - LFC:[MD5.1DBDCF35061AA0EA6387ECC03911CE18] - 14/08/2013 - 13:42:22 ---A- . (...) -- C:\WINDOWS soc.log [14105] O44 - LFC:[MD5.1A8B166D79A0A2C2D9BEDE6C10EBB906] - 14/08/2013 - 13:42:21 ---A- . (...) -- C:\WINDOWS\MedCtrOC.log [2125] O44 - LFC:[MD5.B93579AE2381025C4A798405693D35D8] - 14/08/2013 - 13:42:21 ---A- . (...) -- C:\WINDOWS\msgsocm.log [1545] O44 - LFC:[MD5.02CA43E6C351E16984BF099F8E9079E5] - 14/08/2013 - 13:42:21 ---A- . (...) -- C:\WINDOWS etfxocm.log [5415] O44 - LFC:[MD5.48FAD5EBEB59269ACF7D05E05A59D1A1] - 14/08/2013 - 13:42:21 ---A- . (...) -- C:\WINDOWS\ocgen.log [14780] O44 - LFC:[MD5.574EAC12F003D0BFA91D022FABD0AF09] - 14/08/2013 - 13:42:20 ---A- . (...) -- C:\WINDOWS\FaxSetup.log [30917] O44 - LFC:[MD5.A18BCFCA75B491EED070C51FD17E50ED] - 14/08/2013 - 13:42:15 ---A- . (...) -- C:\WINDOWS\msmqinst.log [9518] O44 - LFC:[MD5.E0A873AEEE710C58B0D2DE2D04D5DB57] - 14/08/2013 - 13:41:55 ---A- . (...) -- C:\WINDOWS\updspapi.log [5726] O44 - LFC:[MD5.965C5140BE87991C68662DFFBD7B7C18] - 14/08/2013 - 13:08:57 ---A- . (...) -- C:\WINDOWS\imsins.BAK [1374] O44 - LFC:[MD5.40BF6F4C6426723A914EEFD9CB983FB5] - 14/08/2013 - 13:08:56 ---A- . (...) -- C:\WINDOWS\system32\TZLog.log [48366] O44 - LFC:[MD5.F1C1DB885313D9C329E48EA5DC02D6F9] - 13/08/2013 - 10:58:05 ---A- . (...) -- C:\WINDOWS\wmsetup.log [1212] ~ Files: 53 Legitimates Filtered in 00mn 24s ---\ Opérations et fonctions au démarrage de Windows Explorer (O46) O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll ~ ShellExecuteHooks: Scanned in 00mn 00s ---\ Export de clé d'application autorisée (O47) O47 - AAKE:Key Export SP - "C:\Program Files\IncrediMail\Bin\IncMail.exe" [Enabled] .(.IncrediMail, Ltd..) -- C:\Program Files\IncrediMail\Bin\IncMail.exe O47 - AAKE:Key Export SP - "C:\Documents and Settings\Sylvaine\Application Data\HiYo\Data\hiyo_install.exe" [Enabled] .(...) -- C:\Documents and Settings\Sylvaine\Application Data\HiYo\Data\hiyo_install.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Program Files\Ubi Soft\Scrabble\Scrabble.exe" [Enabled] .(...) -- C:\Program Files\Ubi Soft\Scrabble\Scrabble.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Program Files rend micro\HijackThis\HijackThis.exe" [Enabled] .(.Trend Micro Inc..) -- C:\Program Files rend micro\HijackThis\HijackThis.exe O47 - AAKE:Key Export SP - "C:\Program Files\IncrediMail\Bin\ImApp.exe" [Enabled] .(.IncrediMail, Ltd..) -- C:\Program Files\IncrediMail\Bin\ImApp.exe O47 - AAKE:Key Export SP - "C:\Program Files\IncrediMail\Bin\ImpCnt.exe" [Enabled] .(.IncrediMail, Ltd..) -- C:\Program Files\IncrediMail\Bin\ImpCnt.exe O47 - AAKE:Key Export SP - "C:\Documents and Settings\Sylvaine\Local Settings\Temp\OnlineUpdate8\SetupXu.exe" [Enabled] .(...) -- C:\Documents and Settings\Sylvaine\Local Settings\Temp\OnlineUpdate8\SetupXu.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Program Files\File Type Assistant sassist.exe" [Enabled] .(.Trusted Software ApS.) -- C:\Program Files\File Type Assistant sassist.exe ~ Keys Export: 51 Legitimates Filtered in 00mn 01s ---\ Image File Execution Options (IFEO) (O50) O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d ~ IFEO: Scanned in 00mn 00s ---\ Enumération des clés de registre StartupReg (SMSR) (O53) O53 - SMSR:HKLM\...\startupreg\DriverMax [Key] . (...) -- C:\Program Files\Innovative Solutions\DriverMax\drivermax.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\DriverMax_RESTART [Key] . (...) -- C:\Program Files\Innovative Solutions\DriverMax\drivermax.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\IncrediMail [Key] . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files\IncrediMail\bin\IncMail.exe O53 - SMSR:HKLM\...\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} [Key] . (...) -- C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\Memeo AutoSync [Key] . (...) -- C:\Program Files\Memeo\AutoSync\MemeoLauncher2.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\Memeo Instant Backup [Key] . (...) -- C:\Program Files\Memeo\AutoBackup\MemeoLauncher2.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\Screenpresso [Key] . (.Learnpulse - Screenpresso.) -- C:\Documents and Settings\Sylvaine\Local Settings\Application Data\LearnPulse\Screenpresso\Screenpresso.exe O53 - SMSR:HKLM\...\startupreg\Seagate Dashboard [Key] . (...) -- C:\Program Files\Seagate\Seagate Dashboard\MemeoLauncher.exe (.not file.) ~ SMSR Keys: 33 Legitimates Filtered in 00mn 01s ---\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56) O56 - MWPE:[HKCU\...\policies\Explorer] - "HonorAutoRunSetting"=0 O56 - MWPE:[HKLM\...\policies\Explorer] - "HonorAutoRunSetting"=0 ~ MWPE Keys: 7 Legitimates Filtered in 00mn 00s ---\ Liste des pilotes du système (SDL) (O58) O58 - SDL:[MD5.DD8520280304B6145A6BE31008748C7C] - 24/09/2008 - 10:40:22 R--A- . (.Realtek Semiconductor Corp. - Realtek AC'97 Audio Driver (WDM).) -- C:\WINDOWS\system32\Drivers\alcxwdm.sys [4122368] O58 - SDL:[MD5.6D3ADA4CE95CECA7BCE527A08C4C474E] - 02/03/2006 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ansi.sys [9037] ~ Drivers: Scanned in 00mn 00s ---\ Liste des outils de désinfection (LATC) (O63) O63 - Logiciel: HijackThis 2.0.2 - (.TrendMicro.) [HKLM] -- HijackThis O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 ~ ADS: Scanned in 00mn 00s ---\ Liste les services legacy du registre (LALS) (O64) O64 - Services: CurCS - 23/01/2013 - C:\Program Files\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe (MsgPlusService) .(.Yuna Software - Service - Messenger Plus! for Skype.) - LEGACY_MSGPLUSSERVICE O64 - Services: CurCS - 08/08/2013 - C:\Program Files\Online Games Manager\ogmservice.exe (ogmservice) .(.RealNetworks, Inc. - Online Games Manager.) - LEGACY_OGMSERVICE ~ Legacy: 157 Legitimates Filtered in 00mn 01s ---\ Menu de démarrage Internet (SMI) (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\ Recherche d'infection sur les navigateurs internet (SBI) (O69) O69 - SBI: SearchScopes [HKCU] ${searchCLSID} - (@ieframe.dll,-12512) - https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8 O69 - SBI: SearchScopes [HKCU] Plasmoo - (Plasmoo) - http://plasmoo.com =>Hijacker.Plasmoo O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (@ieframe.dll,-12512) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8 O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8 O69 - SBI: SearchScopes [HKCU] {B3B3A6AC-74EC-BD56-BCDB-EFA4799FB9DF} - (Amazon) - https://www.amazon.fr/ ~ Keys: Scanned in 00mn 00s ---\ Recherche particulière à la racine du système (SPRF) (O84) [MD5.3098FC81036796741FC1CF8397664776] [SPRF][23/11/2010] (.Adobe Systems Incorporated - Adobe Self Extractor.) -- C:\Program Files\AdbeRdr1000_fr_FR.exe [36181912] [MD5.329C2307685A8D97E2B3D35DDD39EFBE] [SPRF][23/01/2011] (.Lavalys, Inc. - EVEREST Home Edition.) -- C:\Program Files\everesthome220.exe [4179293] [MD5.3E4F11818976EAA9E897CCA83A3ADF6D] [SPRF][23/10/2012] (...) -- C:\Program Files\FFSetup3.0.1.exe [53466540] [MD5.1AECD7495620E1FB03E8C017475C478F] [SPRF][09/06/2013] (...) -- C:\Program Files\FFSetupMultilingual3.1.0.exe [51201320] [MD5.1C114302B853D7AE690CF2E2FC7B0834] [SPRF][22/04/2003] (...) -- C:\Program Files\hpomdl01.dat [16606] [MD5.023CCE4C523DD026EDDF7DE57578F4BC] [SPRF][09/03/2003] (.Hewlett-Packard Co. - HP OfficeJet SendFax Interface.) -- C:\Program Files\hpzc3212.dll [237568] [MD5.1F25D1777F33C9C4000F64E07B7E7F8E] [SPRF][09/03/2003] (.HP - Pas de description.) -- C:\Program Files\hpzglu07.exe [274432] [MD5.3EF50DC371F5CB2F4BA8EFF307D9398D] [SPRF][09/09/2002] (.Hewlett-Packard - SDILog DLL.) -- C:\Program Files\hpzjlog.dll [28722] [MD5.1CCD19B94831D9367709727B6831BE3E] [SPRF][09/09/2002] (.Hewlett-Packard - SDIPrintPath DLL.) -- C:\Program Files\hpzjpp01.dll [417849] [MD5.1904EC97CB651FCE7E895B217C1CAC68] [SPRF][09/09/2002] (.Hewlett-Packard - SDIUtilities DLL.) -- C:\Program Files\hpzjut01.dll [249913] [MD5.69FF6F3FA7862AFE8B56B4B8512EF43E] [SPRF][09/09/2002] (.Hewlett-Packard - SDIPrintPath DLL.) -- C:\Program Files\hpzjvp01.dll [49212] [MD5.1A800ADC5172B6E6A5DCBAC1F7849C93] [SPRF][09/09/2002] (.HP - Pas de description.) -- C:\Program Files\hpzpnp07.dll [212992] [MD5.BFF33648E41A5C13017073C62DCEAC97] [SPRF][09/03/2003] (.HP - Pas de description.) -- C:\Program Files\hpzscr07.dll [184320] [MD5.ACC1E2DCC38EF00452EB0B754351226E] [SPRF][21/02/2010] (.Microsoft Corporation - Auto-extraction de fichier CAB.) -- C:\Program Files\IE8-WindowsXP-x86-FRA.exe [17001840] [MD5.EA2419D0D5C80F668450551C6AD9958A] [SPRF][10/11/2010] (.IncrediMail Ltd. - IncrediMail Setup.) -- C:\Program Files\IncrediMailSetup.exe [14469064] [MD5.8BC07B24203A9FCB6A661D7C1307D2F2] [SPRF][19/11/2010] (...) -- C:\Program Files\IncrediMailSetup_fr.exe [15069640] [MD5.D0F3133DFE419A885C1C4FC063DB3F9D] [SPRF][14/01/2011] (.Pas de propriétaire - IncrediMail Installer.) -- C:\Program Files\incredimail_install.exe [449360] [MD5.6E23EADBA1E84F43E5D28053A8BA27A9] [SPRF][23/06/2010] (.Adobe Systems, Inc. - Adobe® Flash® Player Installer/Uninstaller 10.1 r53.) -- C:\Program Files\install_flash_player.exe [2568656] [MD5.DF7507AAF7991CE25565CB9175B166E2] [SPRF][22/12/2010] (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Program Files\mbam-setup-1.50.1.exe [7734208] [MD5.A8294075E6FC848779BF37E921635DB6] [SPRF][09/09/2002] (.Microsoft Corporation - Microsoft (R) C++ Runtime Library.) -- C:\Program Files\msvcirt.dll [70656] [MD5.2B151F1551A46D5A01DBFB8ED0D8574F] [SPRF][09/09/2002] (.Microsoft Corporation - Microsoft (R) C Runtime Library.) -- C:\Program Files\msvcrt.dll [254005] [MD5.3E144F01528DFEB887FB6DEFD68D58C3] [SPRF][28/10/2010] (.Pas de propriétaire - PhotoMail Content Pack Installer.) -- C:\Program Files\photomail_cp_install.exe [666864] [MD5.4F42027B6B7F73E49F2608869A008970] [SPRF][28/10/2010] (.Pas de propriétaire - PhotoMail Maker Installer.) -- C:\Program Files\photomail_install.exe [656080] [MD5.8377FA7E5AFE48D93BD646446EFD22D8] [SPRF][04/12/2010] (.Pas de propriétaire - Photo Notifier and Animation Creator Installer.) -- C:\Program Files\pnac_install.exe [444240] [MD5.15B9DE0B65F03AFE4235B261FE4E28DC] [SPRF][26/11/2009] (...) -- C:\Program Files\portable.dat [10] [MD5.9353FE7988E1D81A6584802CF6CC25A5] [SPRF][19/07/2009] (.--- - Capture les images incluses dans les fichiers PPT ou PPS.) -- C:\Program Files\PowerpointImageCopier.exe [636416] [MD5.15D1ED3110CAAAD7AF321C4C8FB697F9] [SPRF][03/12/2010] (.LearnPulse - Screenpresso.) -- C:\Program Files\Screenpresso.exe [5292032] [MD5.8A04CEF51AF9D57CFD8E2416E2786B4F] [SPRF][19/04/2011] (.Pas de propriétaire - AVAST Software Setup Engine.) -- C:\Program Files\setup_av_free.exe [66297216] [MD5.7FED9CC66EC9A2BB312BB9E6EEF3C55C] [SPRF][13/01/2011] (.Pas de propriétaire - AVAST Software Setup Engine.) -- C:\Program Files\setup_av_free_fre.exe [49985000] [MD5.C0F6E64036E609D2326D045C497D695C] [SPRF][09/09/2002] (.Microsoft Corporation - Standard USB printing Port Monitor DLL.) -- C:\Program Files\usbmon.dll [12288] [MD5.BDCF7F43ABD107E8F7D31D78C1B096A8] [SPRF][09/09/2002] (.Microsoft Corporation - USB Printer driver.) -- C:\Program Files\usbprint.sys [22608] [MD5.9E8E8B2FB9178DC9D6AB69D685D8F1E8] [SPRF][06/01/2011] (...) -- C:\Program Files\vente_flash_setup.exe [2506243] [MD5.18075B2C9F0F300BEE209744A8BEC353] [SPRF][05/01/2009] (...) -- C:\WINDOWS\Downloaded Program Files\bdcore.dll [32] [MD5.3FEA9D2EDF23B0283C7A66C8DEA380BD] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player Module.) -- C:\WINDOWS\Downloaded Program Files\dwusplay.dll [24576] [MD5.CDBE35EA59BC9223E4F800BD1DB82D27] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player.) -- C:\WINDOWS\Downloaded Program Files\dwusplay.exe [196608] [MD5.245E2761D02D2FC40B857D71F8A96616] [SPRF][08/06/2010] (.Adobe Systems, Inc. - Adobe® Flash® Player Installer/Uninstaller 10.1 r53.) -- C:\WINDOWS\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe [2605008] [MD5.CDE357CD3FC047F5C7D8B8345B6A42BF] [SPRF][18/10/2007] (.Hewlett-Packard Co. - HPDEXADO.) -- C:\WINDOWS\Downloaded Program Files\HPDEXAXO.dll [341296] [MD5.2B1C4C87EB20ADDBA59DCA975E28DFFB] [SPRF][05/01/2009] (...) -- C:\WINDOWS\Downloaded Program Files\ipsupd.dll [741376] [MD5.5002991ADA7920B35E46E7EA80C134FE] [SPRF][16/06/2004] (.InstallShield Software Corporation - InstallShield Update Service Web Agent.) -- C:\WINDOWS\Downloaded Program Files\isusweb.dll [323584] [MD5.18075B2C9F0F300BEE209744A8BEC353] [SPRF][05/01/2009] (...) -- C:\WINDOWS\Downloaded Program Files\libfn.dll [32] ~ Files: Scanned in 03mn 12s ---\ Enumère les codes produits des logiciels (PUC) (O90) O90 - PUC: "49C22FC2963140C4A9F54ACBD6195B80" . (.IncrediMail.) -- C:\WINDOWS\Installer\{2CF22C94-1369-4C04-9A5F-A4BC6D91B508}\ARPPRODUCTICON.exe O90 - PUC: "4A4A2EB6BF99DE84EAE1E45830988F40" . (.PartitionMagic.) -- C:\WINDOWS\Installer\{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}\ARPPRODUCTICON.exe ~ Update Products: 86 Legitimates Filtered in 00mn 00s ---\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS) [MD5.4755E91433A3B67E78B40534BA1722AC] [WIS][01/08/2013] (.Skype Technologies S.A. - Skype.) -- C:\Windows\Installer\1684619.msi [1615360] [MD5.E6A67DB53DBC333344C541404A82722E] [WIS][07/08/2013] (.Google - Google Earth.) -- C:\Windows\Installer\1e36435.msi [916992] [MD5.04788FBCE78C8437CD09183D6324F780] [WIS][30/07/2013] (.IncrediMail - IncrediMail.) -- C:\Windows\Installer\3800c0.msi [2682880] [MD5.16002007500E1265F3112001FE22AB0B] [WIS][31/01/2013] (.IncrediMail - IncrediMail.) -- C:\Windows\Installer\54742d.msi [2684416] [MD5.2EC0BB50E60145F6C2B67D3E16EBD5C6] [WIS][09/06/2012] (.Nom de votre société - Photo Notifier and Animation Creator.) -- C:\Windows\Installer\66573a.msi [1106944] [MD5.3EA245BEC7704E53C25C682DDCADB949] [WIS][09/03/2013] (.Facebook - Facebook Messenger 2.1.4814.0.) -- C:\Windows\Installer\93fabe.msi [196096] [MD5.38B81C5E01379FB2EC270ACA4697FD9F] [WIS][28/10/2010] (.Nom de votre société - PhotoMail Maker.) -- C:\Windows\Installer\a733a4.msi [1152512] [MD5.775ADB0D4A7316EBA8B71E7C03A39633] [WIS][23/06/2010] (.Builds the Destinations MSI - Builds the Destinations MSI.) -- C:\Windows\Installer\ad7a96.msi [522752] [MD5.FE47BCB7D33B91125C891C2CB7D6EB21] [WIS][06/02/2010] (.PowerQuest Corporation - PartitionMagic.) -- C:\Windows\Installer\bce6d2.msi [2300416] ~ WIS: 92 Legitimates Filtered in 00mn 11s ---\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Demand 15/08/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe SR - | Auto 09/05/2013 46808 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe SS - | Demand 14/04/2008 225280 | (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\system32\dmadmin.exe SR - | Auto 20/03/2013 233472 | (FsUsbExService) . (.Teruten.) - C:\WINDOWS\system32\FsUsbExService.exe SS - | Auto 07/08/2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 07/08/2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SR - | Demand 14/04/2008 14336 | C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqcxs08.dll (hpqcxs08) . (.Hewlett-Packard Co..) - C:\WINDOWS\system32\svchost.exe SR - | Auto 14/04/2008 14336 | C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqddsvc.dll (hpqddsvc) . (.Hewlett-Packard Co..) - C:\WINDOWS\system32\svchost.exe SR - | Auto 15/08/2013 182184 | (JavaQuickStarterService) . (.Oracle Corporation.) - C:\Program Files\Java\jre7\bin\jqs.exe SS - | Demand 05/02/2013 312704 | (maconfservice) . (.CybelSoft.) - C:\Program Files\ma-config.com\maconfservice.exe SS - | Demand 17/08/2013 117656 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe SR - | Auto 23/01/2013 125952 | (MsgPlusService) . (.Yuna Software.) - C:\Program Files\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe SR - | Auto 14/04/2008 14336 | C:\WINDOWS\system32\HPZinw12.dll (Net Driver HPZ12) . (.Hewlett-Packard.) - C:\WINDOWS\system32\svchost.exe SS - | Auto 16/11/2006 159811 | (NVSvc) . (.NVIDIA Corporation.) - C:\WINDOWS\system32 vsvc32.exe SR - | Auto 08/08/2013 559552 | (ogmservice) . (.RealNetworks, Inc..) - C:\Program Files\Online Games Manager\ogmservice.exe SR - | Auto 14/04/2008 14336 | C:\WINDOWS\system32\HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) - C:\WINDOWS\system32\svchost.exe SS - | Auto 25/07/2013 162672 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe ~ Services: Scanned in 00mn 13s ---\ Scan Additionnel (O88) Database Version : v2.12859 - (18/08/2013) Clés trouvées (Keys found) : 0 Valeurs trouvées (Values found) : 0 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 0 ~ Additionnel Scan: 256286 Items scanned in 01mn 03s ---\ Récapitulatif des détections trouvées sur votre station ~ http://nicolascoolman.webs.com/apps/blog/show/30414055-hijacker-plasmoo =>Hijacker.Plasmoo ~ MSI: 1 link(s) detected in 01mn 03s ~ 1117 Legitimates filtered by white list End of the scan (522 lines in 07mn 39s)(0)

2011N2 · Answer

Bonjour,

D'accord tant mieux. :)
Bizarre pour Firefox, tu as vérifié si tu avais la dernière version ?

Ensuite, dans Firefox, supprime tous moteurs de recherche sauf Google (il y a des petits restes de Plasmoo visiblement). Jette un oeil aussi aux plugins et extensions si y'a rien de suspect.
Des liens pour t'aider :

http://www.forum-entraide-informatique.com/support/gerer-les-moteurs-recherche-sur-mozilla-firefox-t8244.html
http://www.forum-entraide-informatique.com/support/gerer-les-extensions-sur-mozilla-firefox-t8247.html
http://www.forum-entraide-informatique.com/t8248-gerer-les-plugins-sur-mozilla-firefox

Après il nous restera à finaliser et ce sera terminé.

@+ 

Gabriel.

giadou · Answer

Oui, j'ai la dernière version de Firefox installée (23 ).

Je suis allée dans les modules complémentaires pour vérifier si il y a lieu de faire des mises à jour des extensions et plugins.
Il y en avait une à faire de VLC, elle a échoué, j'ai reçu un message d'échec en anglais.

Je ne connais pas Plasmoo.

D'autre part je suis allée dans Software Updater d'Avast, il y a une mise à jour à faire de Java Runtime Environment, comment la faire ?
Etat de Software Updater : CRITIQUE.

2011N2 · Answer

Re,

Les mises à jour on fait tout juste après, dans la finalisation.

Mais je ne te demandais pas exactement ceci. Donne moi la liste des moteurs de recherche installés stp. :)

Merci,

Gabriel.

giadou · Answer

Voici la liste que j'ai trouvée :

Yahoo, Bing, Amazon, EBay France, Portail lexical CNRTL, Wikipédia (Fr)

2011N2 · Answer

Y'a pas Google ?

Bon rien de méchant tu peux laisser alors.
Le PC se comporte bien ?

Gabriel.

giadou · Answer

Oui, il y a Google dans la fenêtre mais pas dans le menu déroulant où j'ai trouvé les autres.

Pour l'instant ça va, à part que j'ai oublié de te dire que ce matin quand j'étais sur Facebook, la page s'est effacé pour afficher ma boîte de réception Incredimail sans que je fasse quoi que ce soit !

2011N2 · Answer

Re,

Ok, sur Firefox ?
Si oui, réinitialise-le comme ceci : http://www.forum-entraide-informatique.com/support/comment-reinitialiser-mozilla-firefox-t7746.html

Pas d'autres problèmes sinon, on peut finaliser ?

Gabriel.

giadou · Answer

Réinitialisation de Firefox faite.

Je n'ai plus le problème de la roue sans cette entrain de tourner une fois la page ouverte sur Facebook.. C'est bon.

2011N2 · Answer

Re,

Ok. :)
Voici la procédure de finalisation : http://www.forum-entraide-informatique.com/support/finalisation-t8237.html

Tu as donc 2 rapports à me fournir : Delfix et Security Check.

Gabriel.

giadou · Answer

Me voilà revenue !

Voici le rapport Delfix :

# DelFix v10.4 - Rapport créé le 19/08/2013 à 22:40:14
# Mis à jour le 19/07/2013 par Xplode
# Nom d'utilisateur : Sylvaine - SYLVAINE-G
# Système d'exploitation : Microsoft Windows XP Service Pack 3 (32 bits)

~ Suppression des outils de désinfection ...

Supprimé : C:\ZHP
Supprimé : C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Hijackthis
Supprimé : C:\Program Files\ZHPDiag
Supprimé : C:\Program Files\Trend Micro\Hijackthis
Supprimé : C:\AdwCleaner[S35].txt
Supprimé : C:\AdwCleaner[S36].txt
Supprimé : C:\PhysicalDisk0_MBR.bin
Supprimé : C:\Documents and Settings\Sylvaine\Bureau\ZHPDiag.txt
Supprimé : C:\Documents and Settings\Sylvaine\Bureau\ZHPFixReport.txt
Supprimé : C:\Documents and Settings\All Users\Bureau\MBRCheck.lnk
Supprimé : C:\Documents and Settings\All Users\Bureau\ZHPDiag.lnk
Supprimé : C:\Documents and Settings\All Users\Bureau\ZHPFix.lnk
Supprimé : C:\Documents and Settings\Sylvaine\Mes documents\Téléchargements\adwcleaner(1).exe
Supprimé : C:\Documents and Settings\Sylvaine\Mes documents\Téléchargements\adwcleaner(2).exe
Supprimé : C:\Documents and Settings\Sylvaine\Mes documents\Téléchargements\adwcleaner(3).exe
Supprimé : C:\Documents and Settings\Sylvaine\Mes documents\Téléchargements\adwcleaner.exe
Supprimé : C:\Documents and Settings\Sylvaine\Mes documents\Téléchargements\JRT.exe
Supprimé : C:\Documents and Settings\Sylvaine\Mes documents\Téléchargements\ZHPDiag2(1).exe
Supprimé : C:\Documents and Settings\Sylvaine\Mes documents\Téléchargements\ZHPDiag2(2).exe
Supprimé : C:\Documents and Settings\Sylvaine\Mes documents\Téléchargements\ZHPDiag2(3).exe
Supprimé : C:\Documents and Settings\Sylvaine\Mes documents\Téléchargements\ZHPDiag2(4).exe
Supprimé : C:\Documents and Settings\Sylvaine\Mes documents\Téléchargements\ZHPDiag2.exe
Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\HijackThis
Supprimée : HKLM\SOFTWARE\AdwCleaner
Supprimée : HKLM\SOFTWARE\TrendMicro\Hijackthis
Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Hijackthis
Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1
Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\HijackThis.exe

########## - EOF - ##########

giadou · Answer

Et voici le rapport Security Check:

 Results of screen317's Security Check version 0.99.72  
 Windows XP Service Pack 3 x86   
 Internet Explorer 8  
[b][u]''''''''''''''Antivirus/Firewall Check:''''''''''''''[/b][/u] 
avast! Antivirus   
 Antivirus up to date!  
[b][u]'''''''''Anti-malware/Other Utilities Check:'''''''''[/b][/u] 
 MVPS Hosts File  
 Malwarebytes Anti-Malware version 1.75.0.1300  
 CCleaner     
 Java(TM) 6 Update 39  
 Java 7 Update 25  
 Adobe Flash Player 	11.8.800.94  
 Adobe Reader XI  
 Mozilla Firefox (23.0.1) 
[b][u]''''''''Process Check: objlist.exe by Laurent''''''''[/b][/u]  
 Online Games Manager ogmservice.exe   
 AVAST Software Avast AvastSvc.exe  
 AVAST Software Avast avastUI.exe  
[b][u]'''''''''''''''''System Health check'''''''''''''''''[/b][/u] 
 Total Fragmentation on Drive C:: 15% [color=red][b]Defragment your hard drive soon! (Do NOT defrag if SSD!)[/b][/color]
[b][u]''''''''''''''''''''End of Log''''''''''''''''''''''[/b][/u]

2011N2 · Answer

Re,

Ok pour ces rapports, tu peux désinstaller ceci : Java(TM) 6 Update 39 

Tu as défragmenté le PC ? Où en es-tu dans la procédure ?

Gabriel.

giadou · Answer

Je viens de désinstaller Java avec Revo Uninstaller.

Je ne savais pas qu'il fallait défragmenter le pc. C'est une opération qui dure je crois, je la ferai demain matin.

2011N2 · Answer

Re,

Si, c'est la 2ème étape du point 4/ de la procédure de finalisation que je t'ai donnée. ;)

Ok, à demain. En effet ça risque de durer un peu, ton PC a l'air d'être pas mal fragmenté.

Bonne soirée,

Gabriel.

giadou · Answer

Concernant la procédure de finalisation que tu m'as présentée je croyais qu'il ne fallait qu'exécuter Delfix et Security Check.
Mais sans faute, je ferai le défragmentation demain matin.
Je peux te dire que le pc fonctionne déjà nettement mieux !

Bonne nuit.

2011N2 · Answer

Re,

Ok pas de problème. :)
Non, il faut tout faire sur la procédure de finalisation, je t'ai juste dit que tu avais 2 rapports à me poster suite à tout ça. Mais tu as raison, j'aurai du être un peu plus précis, je le serai lors de mes prochaines désinfections grâce à toi. ^^

Gabriel.

giadou · Answer

Bonjour Gabriel,

Je viens de terminer la défragmentation, et avant cela j'ai utilisé Ccleaner.

2011N2 · Answer

Bonjour,

Ok très bien. :)
Tu as tout terminé ?

Gabriel.

giadou · Answer

Oui, j'ai tout terminé.

2011N2 · Answer

Nicke.

As-tu des questions sur la désinfection ou tout est bon ?

Gabriel.

giadou · Answer

Non, je n'ai pas de questions.
Je remarque que le pc est plus rapide que ces derniers jours.

2011N2 · Answer

Re,

Ok, tant mieux.
J'ai passé ce sujet en résolu.

Bonne continuation. :)

Gabriel.

giadou · Answer

Je te remercie vivement pour ta patience et ton aide qui m'ont été très utiles pour retrouver un pc avec un fonctionnement normal.

Bonne fin de journée.

giadou · Answer

Bonjour Gabriel,

Je me permets de revenir vers toi car ce matin en voulant faire une mise à jour de Skype suite à un message reçu en bas à droite de mon écran, l'installation n'a pu être finalisée car Avast m'a détecté un virus.
Et maintenant j'ai sur l'écran PC Utilities Pro dont je n'arrive pas à m'en débarrasser.
Peux-tu m'aider ?

giadou · Answer

J'ai réussi à désinstaller Optimizer Pro V3.1 avec Revo Uninstaller.
Ensuite en page d'accueil, j'avais QV06, après des recherches j'ai lu qu'il fallait s'en débarrasser avec Adwcleaner, ce que j'ai fait, je te poste le rapport :

# AdwCleaner v3.000 - Rapport créé le21/08/2013à10:14:19
# Mis à jour le 13/08/2013 par Xplode
# Système d'exploitation : Microsoft Windows XP Service Pack 3 (32 bits)
# Nom d'utilisateur : Sylvaine - SYLVAINE-G
# Exécuté depuis : C:\Documents and Settings\Sylvaine\Mes documents\Téléchargements\AdwCleaner-3.000.exe

***** [ Services ] *****

Service Supprimé : WsysSvc

***** [ Fichiers / Dossiers ] *****

Dossier Supprimé : C:\Documents and Settings\All Users\Application Data\eSafe
Dossier Supprimé : C:\DOCUME~1\Sylvaine\LOCALS~1\Temp\eIntaller

***** [ Raccourcis ] *****

Raccourci Désinfecté : C:\Documents and Settings\Sylvaine\Bureau\Raccourcis Bureau non utilisés\Internet Explorer.lnk
Raccourci Désinfecté : C:\Documents and Settings\Sylvaine\Bureau\Raccourcis Bureau non utilisés\Mozilla Firefox.lnk
Raccourci Désinfecté : C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Mozilla Firefox.lnk
Raccourci Désinfecté : C:\Documents and Settings\Sylvaine\Menu Démarrer\Programmes\Internet Explorer.lnk
Raccourci Désinfecté : C:\Documents and Settings\Sylvaine\Menu Démarrer\Programmes\Accessoires\Outils système\Internet Explorer (Aucun module complémentaire).lnk
Raccourci Désinfecté : C:\Documents and Settings\Sylvaine\Menu Démarrer\Programmes\Accessoires\Outils système\Internet Explorer (sans module complémentaire).lnk
Raccourci Désinfecté : C:\Documents and Settings\Sylvaine\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk

***** [ Registre ] *****

Donnée Supprimée : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command [(Default)] - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=ST3160215A_9RXKR8Y0XXXX9RXKR8Y0&ts=1377069723
Donnée Supprimée : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command [(Default)] - "C:\Program Files\Mozilla Firefox\firefox.exe" hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=ST3160215A_9RXKR8Y0XXXX9RXKR8Y0&ts=1377069723
Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\375ae085-e0e3-43ee-96a8-6dd125e5b28b
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0242CD8-77B0-4AA2-8B4A-5FEE60C02BFA}
Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\Plasmoo
Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Clé Supprimée : HKLM\SOFTWARE\Classes\pdfforge.PDF.PDFText
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{07E5D249-A0D5-3608-9C25-95C0F36A29DB}
Clé Supprimée : HKLM\SOFTWARE\Classes\pdfforge.PDF.PDFEncryptor
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{37F9A39A-EC99-3331-A610-B5BD3E0E91B0}
Clé Supprimée : HKLM\SOFTWARE\Classes\pdfforge.PDF.PDF.X509
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{49909D0A-F20E-3C0B-A1AE-AD34E7067769}
Clé Supprimée : HKLM\SOFTWARE\Classes\pdfforge.PDF.PDFLine
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{61830212-E19E-3783-AC68-893DFF758743}
Clé Supprimée : HKLM\SOFTWARE\Classes\pdfforge.X509.X509
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{8587A0F8-58AC-3477-805B-899111467617}
Clé Supprimée : HKLM\SOFTWARE\Classes\pdfforge.DllInfo
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{994CF935-A35C-3D94-B75D-D905D8F24EB2}
Clé Supprimée : HKLM\SOFTWARE\Classes\pdfforge.PDF.PDF.X509.Signing
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{A1496F24-34C3-30E8-BDA8-E43D5F4FAC6E}
Clé Supprimée : HKLM\SOFTWARE\Classes\pdfforge.PDF.PDF
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{CD338B61-6644-38B0-858D-557C9DA5F420}
Clé Supprimée : HKLM\SOFTWARE\Classes\pdfforge.Tools
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{F2187C9E-AC12-3050-9656-ED4CF105C48E}
Valeur Supprimée : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [C:\Documents and Settings\All Users\Application Data\eSafe\eGdpSvc.exe]
Clé Supprimée : HKCU\Software\InstallCore
Clé Supprimée : HKLM\Software\eSafeSecControl
Clé Supprimée : HKLM\Software\qvo6Software
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WSysControl

***** [ Navigateurs ] *****

-\ Internet Explorer v8.0.6001.18702

Paramètre Supprimé : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant] - hxxp://www.bing.com/search?q={searchTerms}
Paramètre Supprimé : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [CustomizeSearch] - hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&from=cor&uid=ST3160215A_9RXKR8Y0XXXX9RXKR8Y0&ts=1377069723
Paramètre Supprimé : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [SearchAssistant] - hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&from=cor&uid=ST3160215A_9RXKR8Y0XXXX9RXKR8Y0&ts=1377069723
Paramètre Réinitialisé : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Paramètre Réinitialisé : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
Paramètre Réinitialisé : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Paramètre Réinitialisé : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]

-\ Mozilla Firefox v23.0.1 (fr)

Fichier Supprimé : C:\Documents and Settings\Sylvaine\Application Data\Mozilla\Firefox\Profiles\hqrnmxsc.default-1376927135484\user.js
Fichier Supprimé : C:\Documents and Settings\Sylvaine\Application Data\Mozilla\Firefox\Profiles\u69j6ewu.default-1354115506843\user.js
Impossible d'ouvrir le fichier !

[ Fichier : C:\Documents and Settings\Sylvaine\Application Data\Mozilla\Firefox\Profiles\hqrnmxsc.default-1376927135484\prefs.js ]

Ligne Supprimée : user_pref("browser.search.defaultenginename", "qvo6");
Ligne Supprimée : user_pref("browser.search.order.1", "qvo6");
Ligne Supprimée : user_pref("browser.search.selectedEngine", "qvo6");

[ Fichier : C:\Documents and Settings\Sylvaine\Application Data\Mozilla\Firefox\Profiles\u69j6ewu.default-1354115506843\prefs.js ]

Ligne Supprimée : user_pref("extensions.xnotifier.accounts.[yahoo#giacomsyl].inboxOnly", true);
Impossible d'ouvrir le fichier !

*************************

AdwCleaner[0].txt - [6414 octets] - [21/08/2013 10:14:19]

########## EOF - C:\AdwCleaner\AdwCleaner[0].txt - [6473 octets] ##########

2011N2 · Answer

Salut,

Ok, est-ce que QV06 est toujours là ?

Fais moi un nouveau rapport ZHPDiag.

Gabriel.

giadou · Answer

Non QV06 ne s'affiche plus. Voici le nouveau rapport ZHPDiag : ~ Rapport de ZHPDiag v2013.8.20.29 - Nicolas Coolman (20/08/2013) ~ Lancé par Sylvaine (21/08/2013 13:04:23) ~ Adresse du Site Web https://nicolascoolman.webs.com/ ~ Traduit par Nicolas Coolman ~ Etat de la version : Version à jour. ~ Liste blanche : Activée par le programme ~ Elévation des Privilèges : OK ~ User Account Control (UAC): Not Found ---\ Navigateurs Internet MSIE: Internet Explorer v8.0.6001.18702 MFIE: Mozilla Firefox 23.0.1 (Defaut) ---\ Informations sur les produits Windows ~ Langage: Français Windows XP Professional Service Pack 3 (Build 2600) Windows Automatic Updates : OK Windows Genuine Advantage : OK ---\ Logiciels de protection du système avast! Free Antivirus v8.0.1489.0 Malwarebytes Anti-Malware version 1.75.0.1300 ---\ Logiciels d'optimisation du système CCleaner v4.04 =>Piriform Ltd ---\ Logiciels de partage PeerToPeer ---\ Surveillance de Logiciels Adobe Flash Player 11 Plugin Adobe Reader XI Java 7 Update 25 ---\ Informations sur le système ~ Processor: x86 Family 15 Model 2 Stepping 9, GenuineIntel ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 767 MB (59% free) System Restore: Activé (Enable) System drive C: has 51 GB (64%) free of 78 GB ---\ Mode de connexion au système ~ Computer Name: SYLVAINE-G ~ User Name: Sylvaine ~ All Users Names: Sylvaine, SUPPORT_388945a0, HelpAssistant, Administrateur, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\ Variables d'environnement ~ System Unit : C:\ ~ %AppData% : C:\Documents and Settings\Sylvaine\Application Data\ ~ %Desktop% : C:\Documents and Settings\Sylvaine\Bureau\ ~ %Favorites% : C:\Documents and Settings\Sylvaine\Favoris\ ~ %LocalAppData% : C:\Documents and Settings\Sylvaine\Local Settings\Application Data\ ~ %StartMenu% : C:\Documents and Settings\Sylvaine\Menu Démarrer\ ~ %Windir% : C:\WINDOWS\ ~ %System% : C:\WINDOWS\system32\ ---\ Enumération des unités disques A:\ Floppy drive, Flash card reader, USB Key (Not Inserted) C:\ Hard drive, Flash drive, Thumb drive (Free 51 Go of 78 Go) D:\ CD-ROM drive (Not Inserted) E:\ CD-ROM drive (Not Inserted) F:\ Hard drive, Flash drive, Thumb drive (Free 49 Go of 49 Go) G:\ Hard drive, Flash drive, Thumb drive (Free 450 Go of 466 Go) H:\ Hard drive, Flash drive, Thumb drive (Free 39 Go of 39 Go) I:\ Hard drive, Flash drive, Thumb drive (Free 32 Go of 32 Go) J:\ Hard drive, Flash drive, Thumb drive (Free 79 Go of 79 Go) L:\ Floppy drive, Flash card reader, USB Key (Not Inserted) M:\ Floppy drive, Flash card reader, USB Key (Not Inserted) N:\ Floppy drive, Flash card reader, USB Key (Not Inserted) O:\ Hard drive, Flash drive, Thumb drive (Free 17 Go of 21 Go) ---\ Etat du Centre de Sécurité Windows [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date ~ Security Center: 33 Legitimates Filtered in 00mn 00s ---\ Recherche particulière de fichiers génériques [MD5.F2317622D29F9FF0F88AEECD5F60F0DD] - (.Microsoft Corporation - Explorateur Windows.) (.14/04/2008 - 03:34:03.) -- C:\WINDOWS\Explorer.exe [1037824] [MD5.E1948293F7CBC38987270432935D8D05] - (.Microsoft Corporation - Internet Extensions for Win32.) (.26/07/2013 - 03:47:15.) -- C:\WINDOWS\system32\wininet.dll [920064] [MD5.DD73D6B9F6B4CB630CF35B438B540174] - (.Microsoft Corporation - Application d'ouverture de session Windows NT.) (.14/04/2008 - 03:34:28.) -- C:\WINDOWS\system32\Winlogon.exe [512000] [MD5.1E44BC1E83D8FD2305F8D452DB109CF9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.17/08/2011 - 14:49:54.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496] [MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.13/04/2008 - 19:40:30.) -- C:\WINDOWS\system32\Drivers\atapi.sys [96512] [MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/04/2008 - 20:14:21.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744] [MD5.1F4260CC5B42272D71F79E570A27A4FE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.13/04/2008 - 19:40:46.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [62976] [MD5.31F923EB2170FC172C81ABDA0045D18C] - (.Microsoft Corporation - Pilote de cryptographie FIPS.) (.14/04/2008 - 02:57:38.) -- C:\WINDOWS\system32\Drivers\Fips.sys [44672] [MD5.573C7D0A32852B48F3058CFD8026F511] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.13/04/2008 - 17:36:05.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [144384] [MD5.A09BDC4ED10E3B2E0EC27BB94AF32516] - (.Microsoft Corporation - Pilote de port i8042.) (.14/04/2008 - 03:00:52.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [54144] [MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.13/04/2008 - 19:40:58.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [42112] [MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.13/04/2008 - 19:57:15.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [152832] [MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.13/04/2008 - 20:19:42.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [75264] [MD5.7D304A5EB4344EBEEAB53A2FE3FFB9F0] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.15/07/2011 - 14:29:31.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [456320] [MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.13/04/2008 - 20:21:00.) -- C:\WINDOWS\system32\Drivers etBT.sys [162816] [MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.13/04/2008 - 20:15:53.) -- C:\WINDOWS\system32\Drivers tfs.sys [574976] [MD5.8FD0BDBEA875D06CCF6C945CA9ABAF75] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/04/2008 - 03:09:40.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80384] [MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13/04/2008 - 20:19:43.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328] [MD5.15CABD0F7C00C47C70124907916AF3F1] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.13/04/2008 - 19:32:51.) -- C:\WINDOWS\system32\Drivers dpdr.sys [196224] [MD5.D8EB2A7904DB6C916EB5361878DDCBAE] - (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) (.14/04/2008 - 02:57:34.) -- C:\WINDOWS\system32\Drivers edbook.sys [58752] [MD5.46DE1126684369BACE4849E4FC8C43CA] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.14/04/2008 - 02:56:04.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [53376] ~ Generic Processes: Scanned in 00mn 01s ---\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 2/23 ~ Mes musiques (My Musics) : 1/2 ~ Mes Videos (My Videos) : 1/21 ~ Mes Favoris (My Favorites) : 1/358 ~ Mes Documents (My Documents) : 2/1023 ~ Mon Bureau (My Desktop) : 0/93 ~ Menu demarrer (Programs) : 0/31 ~ Hidden Files: Scanned in 00mn 06s ---\ Processus lancés au démarrage du système [MD5.28D6701C710AD7BA3CB95E75F8F1A9AA] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808] [PID.1480] [MD5.0796C1E47ADB9825269E64B9DAB4E741] - (.Teruten - FsUsbDevice.) -- C:\WINDOWS\system32\FsUsbExService.exe [233472] [PID.1928] [MD5.97A4A2A00B1FAD261E7DAC0136E7EE31] - (.Yuna Software - Service - Messenger Plus! for Skype.) -- C:\Program Files\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe [125952] [PID.1620] [MD5.948C21C77FAD271CC6F851FC46029DD4] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 93.81.) -- C:\WINDOWS\system32 vsvc32.exe [159811] [PID.976] [MD5.25E40292DD289F644660F440F38239BE] - (.RealNetworks, Inc. - Online Games Manager.) -- C:\Program Files\Online Games Manager\ogmservice.exe [559552] [PID.988] [MD5.3F11B20D12D89365D7721BDC860CE5F0] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968] [PID.3336] [MD5.D5CDEA452982FC61E21EE978AAB134DD] - (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files\IncrediMail\Bin\IncMail.exe [367016] [PID.4040] [MD5.312707A513F86ED20642F43F8EF4DD14] - (.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files\IncrediMail\Bin\ImApp.exe [264616] [PID.4084] [MD5.D00EA3CBEB3E81CD14BB7A9EA9396FD7] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7851008] [PID.4464] [MD5.5E9A6658A2A69AE7EB195113B7A2E7A9] - (.Microsoft Corporation - Application Layer Gateway Service.) -- C:\WINDOWS\System32\alg.exe [44544] [PID.2716] ~ Processes Running: Scanned in 00mn 03s ---\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\WINDOWS\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl" ~ Keys: Scanned in 00mn 00s ---\ Hosts file redirection (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 02s ~ Nombre de lignes (Lines number): 15260 ---\ Internet Explorer Toolbars (O3) O3 - Toolbar: (no name) - [HKLM]{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} Clé orpheline O3 - Toolbar: Barre de confiance - [HKLM]{55BDF3B0-C0A8-481A-B8A6-01CD2BE0F3FD} . (.Euro-Information - Barre de Confiance.) -- C:\Program Files\Barre de Confiance\TAPBar.dll O3 - Toolbar\WebBrowser: (no name) - [HKCU]{01E04581-4EEE-11D0-BFE9-00AA005B4383} Clé orpheline O3 - Toolbar\WebBrowser: (no name) - [HKCU]{0E5CBF21-D15F-11D0-8301-00AA005B4383} Clé orpheline ~ Toolbar: Scanned in 00mn 00s ---\ Applications démarrées par registre & par dossier (O4) O4 - HKLM\..\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe O4 - HKLM\..\Run: [NvCplDaemon] . (.NVIDIA Corporation - NVIDIA Display Properties Extension.) -- C:\WINDOWS\system32\NvCpl.dll ~ Application: Scanned in 00mn 00s ---\ Autres liens utilisateurs (O4) O4 - GS\Programs: Adobe Reader XI.lnk . (...) -- C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-AB0000000001}\SC_Reader.ico O4 - GS\Programs: IncrediMail.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files\IncrediMail\Bin\IncMail.exe O4 - GS\Programs: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O4 - GS\Programs: Windows Movie Maker.lnk . (.Microsoft Corporation - Windows Movie Maker.) -- C:\Program Files\Movie Maker\moviemk.exe O4 - GS\Programs: Assistance à distance.lnk . (.Microsoft Corporation - Assistance à distance Microsoft.) -- C:\WINDOWS\system32 cimlby.exe O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Programs: Outlook Express.lnk . (.Microsoft Corporation - Outlook Express.) -- C:\Program Files\Outlook Express\msimn.exe O4 - GS\Programs: Screenpresso.lnk . (.Learnpulse - Screenpresso.) -- C:\Documents and Settings\Sylvaine\Local Settings\Application Data\LearnPulse\Screenpresso\Screenpresso.exe O4 - GS\Programs: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe ~ Global Startup: Scanned in 00mn 01s ---\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} -- Clé orpheline O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO O9 - Extra button: Afficher ou masquer l'HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} . (.Hewlett-Packard Co. - HP Smart Web Printing add-on for Internet Explorer.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe ~ IE Extra Buttons: Scanned in 00mn 00s ---\ Objets ActiveX (Downloaded Program Files)(O16) O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} ((no name)) - http://download.bitdefender.com/resources/scanner/sources/fr/scan8/oscan8.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} ((no name)) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1342001082843 O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} ((no name)) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} ((no name)) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab ~ Objets ActiveX: Scanned in 00mn 00s ---\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{4A1C820D-9919-4270-B137-41F5C811FF37}: DhcpNameServer = 212.27.40.240 212.27.40.241 O17 - HKLM\System\CS1\Services\Tcpip\..\{4A1C820D-9919-4270-B137-41F5C811FF37}: DhcpNameServer = 212.27.40.240 212.27.40.241 O17 - HKLM\System\CS3\Services\Tcpip\..\{4A1C820D-9919-4270-B137-41F5C811FF37}: DhcpNameServer = 212.27.40.240 212.27.40.241 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.240 212.27.40.241 ~ Domain: Scanned in 00mn 00s ---\ Titr_HJT34=Protocole additionnel (O18) O18 - Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} . (.Microsoft Corporation - Windows Live Mail.) -- C:\Program Files\Windows Live\Mail\mailcomm.dll O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\MSOXMLMF.dll ~ Protocole Additionnel: Scanned in 00mn 00s ---\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dll O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dll O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agent réseau hors connexion.) -- C:\WINDOWS\system32\cscdll.dll O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\system32\dimsntfy.dll O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL secondaire de notification de service d.) -- C:\WINDOWS\system32\sclgntfy.dll O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\WlNotify.dll O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll ~ Winlogon: Scanned in 00mn 00s ---\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: Online Games Manager (ogmservice) . (.RealNetworks, Inc. - Online Games Manager.) - C:\Program Files\Online Games Manager\ogmservice.exe O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files\Skype\Updater\Updater.exe ~ Services: 7 Legitimates Filtered in 00mn 08s ---\ Enumération Active Desktop & MHTML Editor (O24) O24 - Desktop General: BackupWallPaper - .(...) - C:\Documents and Settings\Sylvaine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop General: WallPaper - .(...) - C:\Documents and Settings\Sylvaine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp ~ Desktop Component: 4 Legitimates Filtered in 00mn 00s ---\ Tâches planifiées en automatique (O39) O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\ProgramRefresh-ATFST.job [456] O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\ProgramUpdateCheck.job [400] [MD5.CEC66E3CA216A4783C6FC54B4FE36DBD] [APT] [ProgramRefresh-ATFST] (...) -- C:\Program Files\File Type Assistant\TSASetup.exe [1492080] ~ Scheduled Task: 16 Legitimates Filtered in 00mn 01s ---\ Logiciels installés (O42) O42 - Logiciel: IncrediMail - (.IncrediMail.) [HKLM] -- {2CF22C94-1369-4C04-9A5F-A4BC6D91B508} O42 - Logiciel: IncrediMail 2.0 - (.IncrediMail Ltd..) [HKLM] -- IncrediMail ~ Logic: 121 Legitimates Filtered in 00mn 01s ---\ HKCU & HKLM Software Keys [HKCU\Software\IncrediMail] [HKLM\Software\imagecapture] ~ Key Software: 221 Legitimates Filtered in 00mn 01s ---\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 16/02/2010 - 14:06:53 - [187,986] ----D C:\Program Files\Drivers O43 - CFD: 22/03/2011 - 11:37:10 - [5,280] ----D C:\Program Files\Fichier content down O43 - CFD: 02/08/2013 - 11:41:19 - [26,259] ----D C:\Program Files\IncrediMail O43 - CFD: 16/12/2012 - 23:56:48 - [0,760] ----D C:\Program Files\IncrediMail(2) O43 - CFD: 25/07/2012 - 22:03:53 - [1,674] ----D C:\Program Files\lang O43 - CFD: 15/02/2010 - 14:56:23 - [4,693] ----D C:\Program Files\util O43 - CFD: 05/02/2010 - 20:11:24 - [0,000] ----D C:\Documents and Settings\All Users\Application Data\IM O43 - CFD: 18/06/2010 - 10:43:11 - [11,404] ----D C:\Documents and Settings\All Users\Application Data\IncrediMail O43 - CFD: 18/06/2010 - 10:43:04 - [6,573] ----D C:\Documents and Settings\All Users\Application Data\IncrediMail(2) O43 - CFD: 25/05/2011 - 16:08:15 - [0,206] ----D C:\Documents and Settings\Sylvaine\Application Data\com.codeode O43 - CFD: 02/08/2013 - 11:40:17 - [873,466] ----D C:\Documents and Settings\Sylvaine\Local Settings\Application Data\IM ~ Program Folder: 189 Legitimates Filtered in 02mn 01s ---\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 21/08/2013 - 09:05:10 ---A- . (...) -- C:\WINDOWS\system32\NvApps.xml [0] O44 - LFC:[MD5.E6BA731BAC38B71A99004653969CC94A] - 21/08/2013 - 09:03:59 ---A- . (...) -- C:\WINDOWS\wiaservc.log [50] O44 - LFC:[MD5.C2D65943D3311FF7B0CDB865BB5887DD] - 21/08/2013 - 09:03:58 ---A- . (...) -- C:\WINDOWS\wiadebug.log [159] O44 - LFC:[MD5.6541102498B72D9A9C40132B4F93A302] - 19/08/2013 - 21:40:20 ---A- . (...) -- C:\DelFix.txt [2304] O44 - LFC:[MD5.254FFD9FE6CACC8E9D9EC8547973C924] - 17/08/2013 - 09:24:48 ---A- . (...) -- C:\WINDOWS\system.ini [246] O44 - LFC:[MD5.1085B023D2A982AD1A3EC13076290756] - 17/08/2013 - 09:24:48 ---A- . (...) -- C:\WINDOWS\win.ini [637] O44 - LFC:[MD5.40BF6F4C6426723A914EEFD9CB983FB5] - 14/08/2013 - 13:08:56 ---A- . (...) -- C:\WINDOWS\system32\TZLog.log [48366] ~ Files: 28 Legitimates Filtered in 00mn 31s ---\ Opérations et fonctions au démarrage de Windows Explorer (O46) O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll ~ ShellExecuteHooks: Scanned in 00mn 00s ---\ Export de clé d'application autorisée (O47) O47 - AAKE:Key Export SP - "C:\Program Files\IncrediMail\Bin\IncMail.exe" [Enabled] .(.IncrediMail, Ltd..) -- C:\Program Files\IncrediMail\Bin\IncMail.exe O47 - AAKE:Key Export SP - "C:\Documents and Settings\Sylvaine\Application Data\HiYo\Data\hiyo_install.exe" [Enabled] .(...) -- C:\Documents and Settings\Sylvaine\Application Data\HiYo\Data\hiyo_install.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Program Files\Ubi Soft\Scrabble\Scrabble.exe" [Enabled] .(...) -- C:\Program Files\Ubi Soft\Scrabble\Scrabble.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Program Files rend micro\HijackThis\HijackThis.exe" [Enabled] .(...) -- C:\Program Files rend micro\HijackThis\HijackThis.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Program Files\IncrediMail\Bin\ImApp.exe" [Enabled] .(.IncrediMail, Ltd..) -- C:\Program Files\IncrediMail\Bin\ImApp.exe O47 - AAKE:Key Export SP - "C:\Program Files\IncrediMail\Bin\ImpCnt.exe" [Enabled] .(.IncrediMail, Ltd..) -- C:\Program Files\IncrediMail\Bin\ImpCnt.exe O47 - AAKE:Key Export SP - "C:\Documents and Settings\Sylvaine\Local Settings\Temp\OnlineUpdate8\SetupXu.exe" [Enabled] .(...) -- C:\Documents and Settings\Sylvaine\Local Settings\Temp\OnlineUpdate8\SetupXu.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Program Files\File Type Assistant sassist.exe" [Enabled] .(.Trusted Software ApS.) -- C:\Program Files\File Type Assistant sassist.exe ~ Keys Export: 51 Legitimates Filtered in 00mn 03s ---\ Image File Execution Options (IFEO) (O50) O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d ~ IFEO: Scanned in 00mn 00s ---\ Enumération des clés de registre StartupReg (SMSR) (O53) O53 - SMSR:HKLM\...\startupreg\DriverMax [Key] . (...) -- C:\Program Files\Innovative Solutions\DriverMax\drivermax.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\DriverMax_RESTART [Key] . (...) -- C:\Program Files\Innovative Solutions\DriverMax\drivermax.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\IncrediMail [Key] . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files\IncrediMail\bin\IncMail.exe O53 - SMSR:HKLM\...\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} [Key] . (...) -- C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\Memeo AutoSync [Key] . (...) -- C:\Program Files\Memeo\AutoSync\MemeoLauncher2.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\Memeo Instant Backup [Key] . (...) -- C:\Program Files\Memeo\AutoBackup\MemeoLauncher2.exe (.not file.) O53 - SMSR:HKLM\...\startupreg\Screenpresso [Key] . (.Learnpulse - Screenpresso.) -- C:\Documents and Settings\Sylvaine\Local Settings\Application Data\LearnPulse\Screenpresso\Screenpresso.exe O53 - SMSR:HKLM\...\startupreg\Seagate Dashboard [Key] . (...) -- C:\Program Files\Seagate\Seagate Dashboard\MemeoLauncher.exe (.not file.) ~ SMSR Keys: 33 Legitimates Filtered in 00mn 01s ---\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56) O56 - MWPE:[HKCU\...\policies\Explorer] - "HonorAutoRunSetting"=0 O56 - MWPE:[HKLM\...\policies\Explorer] - "HonorAutoRunSetting"=0 ~ MWPE Keys: 7 Legitimates Filtered in 00mn 00s ---\ Liste des pilotes du système (SDL) (O58) O58 - SDL:[MD5.DD8520280304B6145A6BE31008748C7C] - 24/09/2008 - 10:40:22 R--A- . (.Realtek Semiconductor Corp. - Realtek AC'97 Audio Driver (WDM).) -- C:\WINDOWS\system32\Drivers\alcxwdm.sys [4122368] O58 - SDL:[MD5.6D3ADA4CE95CECA7BCE527A08C4C474E] - 02/03/2006 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ansi.sys [9037] ~ Drivers: Scanned in 00mn 04s ---\ Liste des outils de désinfection (LATC) (O63) O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 ~ ADS: Scanned in 00mn 00s ---\ Liste les services legacy du registre (LALS) (O64) O64 - Services: CurCS - 23/01/2013 - C:\Program Files\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe (MsgPlusService) .(.Yuna Software - Service - Messenger Plus! for Skype.) - LEGACY_MSGPLUSSERVICE O64 - Services: CurCS - 08/08/2013 - C:\Program Files\Online Games Manager\ogmservice.exe (ogmservice) .(.RealNetworks, Inc. - Online Games Manager.) - LEGACY_OGMSERVICE ~ Legacy: 157 Legitimates Filtered in 00mn 03s ---\ Menu de démarrage Internet (SMI) (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\ Recherche d'infection sur les navigateurs internet (SBI) (O69) O69 - SBI: SearchScopes [HKCU] ${searchCLSID} - (@ieframe.dll,-12512) - https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8 O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (@ieframe.dll,-12512) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8 O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8 O69 - SBI: SearchScopes [HKCU] {B3B3A6AC-74EC-BD56-BCDB-EFA4799FB9DF} - (Amazon) - https://www.amazon.fr/ ~ Keys: Scanned in 00mn 00s ---\ Recherche particulière à la racine du système (SPRF) (O84) [MD5.3098FC81036796741FC1CF8397664776] [SPRF][23/11/2010] (.Adobe Systems Incorporated - Adobe Self Extractor.) -- C:\Program Files\AdbeRdr1000_fr_FR.exe [36181912] [MD5.329C2307685A8D97E2B3D35DDD39EFBE] [SPRF][23/01/2011] (.Lavalys, Inc. - EVEREST Home Edition.) -- C:\Program Files\everesthome220.exe [4179293] [MD5.3E4F11818976EAA9E897CCA83A3ADF6D] [SPRF][23/10/2012] (...) -- C:\Program Files\FFSetup3.0.1.exe [53466540] [MD5.1AECD7495620E1FB03E8C017475C478F] [SPRF][09/06/2013] (...) -- C:\Program Files\FFSetupMultilingual3.1.0.exe [51201320] [MD5.1C114302B853D7AE690CF2E2FC7B0834] [SPRF][22/04/2003] (...) -- C:\Program Files\hpomdl01.dat [16606] [MD5.023CCE4C523DD026EDDF7DE57578F4BC] [SPRF][09/03/2003] (.Hewlett-Packard Co. - HP OfficeJet SendFax Interface.) -- C:\Program Files\hpzc3212.dll [237568] [MD5.1F25D1777F33C9C4000F64E07B7E7F8E] [SPRF][09/03/2003] (.HP - Pas de description.) -- C:\Program Files\hpzglu07.exe [274432] [MD5.3EF50DC371F5CB2F4BA8EFF307D9398D] [SPRF][09/09/2002] (.Hewlett-Packard - SDILog DLL.) -- C:\Program Files\hpzjlog.dll [28722] [MD5.1CCD19B94831D9367709727B6831BE3E] [SPRF][09/09/2002] (.Hewlett-Packard - SDIPrintPath DLL.) -- C:\Program Files\hpzjpp01.dll [417849] [MD5.1904EC97CB651FCE7E895B217C1CAC68] [SPRF][09/09/2002] (.Hewlett-Packard - SDIUtilities DLL.) -- C:\Program Files\hpzjut01.dll [249913] [MD5.69FF6F3FA7862AFE8B56B4B8512EF43E] [SPRF][09/09/2002] (.Hewlett-Packard - SDIPrintPath DLL.) -- C:\Program Files\hpzjvp01.dll [49212] [MD5.1A800ADC5172B6E6A5DCBAC1F7849C93] [SPRF][09/09/2002] (.HP - Pas de description.) -- C:\Program Files\hpzpnp07.dll [212992] [MD5.BFF33648E41A5C13017073C62DCEAC97] [SPRF][09/03/2003] (.HP - Pas de description.) -- C:\Program Files\hpzscr07.dll [184320] [MD5.ACC1E2DCC38EF00452EB0B754351226E] [SPRF][21/02/2010] (.Microsoft Corporation - Auto-extraction de fichier CAB.) -- C:\Program Files\IE8-WindowsXP-x86-FRA.exe [17001840] [MD5.EA2419D0D5C80F668450551C6AD9958A] [SPRF][10/11/2010] (.IncrediMail Ltd. - IncrediMail Setup.) -- C:\Program Files\IncrediMailSetup.exe [14469064] [MD5.8BC07B24203A9FCB6A661D7C1307D2F2] [SPRF][19/11/2010] (...) -- C:\Program Files\IncrediMailSetup_fr.exe [15069640] [MD5.D0F3133DFE419A885C1C4FC063DB3F9D] [SPRF][14/01/2011] (.Pas de propriétaire - IncrediMail Installer.) -- C:\Program Files\incredimail_install.exe [449360] [MD5.6E23EADBA1E84F43E5D28053A8BA27A9] [SPRF][23/06/2010] (.Adobe Systems, Inc. - Adobe® Flash® Player Installer/Uninstaller 10.1 r53.) -- C:\Program Files\install_flash_player.exe [2568656] [MD5.DF7507AAF7991CE25565CB9175B166E2] [SPRF][22/12/2010] (.Malwarebytes Corporation - Malwarebytes' Anti-Malware.) -- C:\Program Files\mbam-setup-1.50.1.exe [7734208] [MD5.A8294075E6FC848779BF37E921635DB6] [SPRF][09/09/2002] (.Microsoft Corporation - Microsoft (R) C++ Runtime Library.) -- C:\Program Files\msvcirt.dll [70656] [MD5.2B151F1551A46D5A01DBFB8ED0D8574F] [SPRF][09/09/2002] (.Microsoft Corporation - Microsoft (R) C Runtime Library.) -- C:\Program Files\msvcrt.dll [254005] [MD5.3E144F01528DFEB887FB6DEFD68D58C3] [SPRF][28/10/2010] (.Pas de propriétaire - PhotoMail Content Pack Installer.) -- C:\Program Files\photomail_cp_install.exe [666864] [MD5.4F42027B6B7F73E49F2608869A008970] [SPRF][28/10/2010] (.Pas de propriétaire - PhotoMail Maker Installer.) -- C:\Program Files\photomail_install.exe [656080] [MD5.8377FA7E5AFE48D93BD646446EFD22D8] [SPRF][04/12/2010] (.Pas de propriétaire - Photo Notifier and Animation Creator Installer.) -- C:\Program Files\pnac_install.exe [444240] [MD5.15B9DE0B65F03AFE4235B261FE4E28DC] [SPRF][26/11/2009] (...) -- C:\Program Files\portable.dat [10] [MD5.9353FE7988E1D81A6584802CF6CC25A5] [SPRF][19/07/2009] (.--- - Capture les images incluses dans les fichiers PPT ou PPS.) -- C:\Program Files\PowerpointImageCopier.exe [636416] [MD5.15D1ED3110CAAAD7AF321C4C8FB697F9] [SPRF][03/12/2010] (.LearnPulse - Screenpresso.) -- C:\Program Files\Screenpresso.exe [5292032] [MD5.8A04CEF51AF9D57CFD8E2416E2786B4F] [SPRF][19/04/2011] (.Pas de propriétaire - AVAST Software Setup Engine.) -- C:\Program Files\setup_av_free.exe [66297216] [MD5.7FED9CC66EC9A2BB312BB9E6EEF3C55C] [SPRF][13/01/2011] (.Pas de propriétaire - AVAST Software Setup Engine.) -- C:\Program Files\setup_av_free_fre.exe [49985000] [MD5.C0F6E64036E609D2326D045C497D695C] [SPRF][09/09/2002] (.Microsoft Corporation - Standard USB printing Port Monitor DLL.) -- C:\Program Files\usbmon.dll [12288] [MD5.BDCF7F43ABD107E8F7D31D78C1B096A8] [SPRF][09/09/2002] (.Microsoft Corporation - USB Printer driver.) -- C:\Program Files\usbprint.sys [22608] [MD5.9E8E8B2FB9178DC9D6AB69D685D8F1E8] [SPRF][06/01/2011] (...) -- C:\Program Files\vente_flash_setup.exe [2506243] [MD5.18075B2C9F0F300BEE209744A8BEC353] [SPRF][05/01/2009] (...) -- C:\WINDOWS\Downloaded Program Files\bdcore.dll [32] [MD5.3FEA9D2EDF23B0283C7A66C8DEA380BD] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player Module.) -- C:\WINDOWS\Downloaded Program Files\dwusplay.dll [24576] [MD5.CDBE35EA59BC9223E4F800BD1DB82D27] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player.) -- C:\WINDOWS\Downloaded Program Files\dwusplay.exe [196608] [MD5.245E2761D02D2FC40B857D71F8A96616] [SPRF][08/06/2010] (.Adobe Systems, Inc. - Adobe® Flash® Player Installer/Uninstaller 10.1 r53.) -- C:\WINDOWS\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe [2605008] [MD5.CDE357CD3FC047F5C7D8B8345B6A42BF] [SPRF][18/10/2007] (.Hewlett-Packard Co. - HPDEXADO.) -- C:\WINDOWS\Downloaded Program Files\HPDEXAXO.dll [341296] [MD5.2B1C4C87EB20ADDBA59DCA975E28DFFB] [SPRF][05/01/2009] (...) -- C:\WINDOWS\Downloaded Program Files\ipsupd.dll [741376] [MD5.5002991ADA7920B35E46E7EA80C134FE] [SPRF][16/06/2004] (.InstallShield Software Corporation - InstallShield Update Service Web Agent.) -- C:\WINDOWS\Downloaded Program Files\isusweb.dll [323584] [MD5.18075B2C9F0F300BEE209744A8BEC353] [SPRF][05/01/2009] (...) -- C:\WINDOWS\Downloaded Program Files\libfn.dll [32] ~ Files: Scanned in 00mn 53s ---\ Enumère les codes produits des logiciels (PUC) (O90) O90 - PUC: "49C22FC2963140C4A9F54ACBD6195B80" . (.IncrediMail.) -- C:\WINDOWS\Installer\{2CF22C94-1369-4C04-9A5F-A4BC6D91B508}\ARPPRODUCTICON.exe O90 - PUC: "4A4A2EB6BF99DE84EAE1E45830988F40" . (.PartitionMagic.) -- C:\WINDOWS\Installer\{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}\ARPPRODUCTICON.exe ~ Update Products: 85 Legitimates Filtered in 00mn 00s ---\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS) [MD5.4755E91433A3B67E78B40534BA1722AC] [WIS][01/08/2013] (.Skype Technologies S.A. - Skype.) -- C:\Windows\Installer\1684619.msi [1615360] [MD5.E6A67DB53DBC333344C541404A82722E] [WIS][07/08/2013] (.Google - Google Earth.) -- C:\Windows\Installer\1e36435.msi [916992] [MD5.04788FBCE78C8437CD09183D6324F780] [WIS][30/07/2013] (.IncrediMail - IncrediMail.) -- C:\Windows\Installer\3800c0.msi [2682880] [MD5.16002007500E1265F3112001FE22AB0B] [WIS][31/01/2013] (.IncrediMail - IncrediMail.) -- C:\Windows\Installer\54742d.msi [2684416] [MD5.38B81C5E01379FB2EC270ACA4697FD9F] [WIS][28/10/2010] (.Nom de votre société - PhotoMail Maker.) -- C:\Windows\Installer\a733a4.msi [1152512] [MD5.775ADB0D4A7316EBA8B71E7C03A39633] [WIS][23/06/2010] (.Builds the Destinations MSI - Builds the Destinations MSI.) -- C:\Windows\Installer\ad7a96.msi [522752] [MD5.FE47BCB7D33B91125C891C2CB7D6EB21] [WIS][06/02/2010] (.PowerQuest Corporation - PartitionMagic.) -- C:\Windows\Installer\bce6d2.msi [2300416] ~ WIS: 90 Legitimates Filtered in 00mn 24s ---\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Demand 15/08/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe SR - | Auto 09/05/2013 46808 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe SS - | Demand 14/04/2008 225280 | (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\system32\dmadmin.exe SR - | Auto 20/03/2013 233472 | (FsUsbExService) . (.Teruten.) - C:\WINDOWS\system32\FsUsbExService.exe SS - | Auto 07/08/2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 07/08/2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SR - | Demand 14/04/2008 14336 | C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqcxs08.dll (hpqcxs08) . (.Hewlett-Packard Co..) - C:\WINDOWS\system32\svchost.exe SR - | Auto 14/04/2008 14336 | C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqddsvc.dll (hpqddsvc) . (.Hewlett-Packard Co..) - C:\WINDOWS\system32\svchost.exe SS - | Demand 05/02/2013 312704 | (maconfservice) . (.CybelSoft.) - C:\Program Files\ma-config.com\maconfservice.exe SS - | Demand 17/08/2013 117656 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe SR - | Auto 23/01/2013 125952 | (MsgPlusService) . (.Yuna Software.) - C:\Program Files\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe SR - | Auto 14/04/2008 14336 | C:\WINDOWS\system32\HPZinw12.dll (Net Driver HPZ12) . (.Hewlett-Packard.) - C:\WINDOWS\system32\svchost.exe SR - | Auto 16/11/2006 159811 | (NVSvc) . (.NVIDIA Corporation.) - C:\WINDOWS\system32 vsvc32.exe SR - | Auto 08/08/2013 559552 | (ogmservice) . (.RealNetworks, Inc..) - C:\Program Files\Online Games Manager\ogmservice.exe SR - | Auto 14/04/2008 14336 | C:\WINDOWS\system32\HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) - C:\WINDOWS\system32\svchost.exe SS - | Auto 25/07/2013 162672 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe ~ Services: Scanned in 00mn 28s ---\ Scan Additionnel (O88) Database Version : v2.12862 - (20/08/2013) Clés trouvées (Keys found) : 0 Valeurs trouvées (Values found) : 0 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 0 ~ Additionnel Scan: 245860 Items scanned in 00mn 56s ~ 1073 Legitimates filtered by white list End of the scan (481 lines in 05mn 54s)(0)

2011N2 · Answer

Ok, rien de spécial sur le rapport ça a l'air bon. :)

Gabriel.

giadou · Answer

OK, merci, tu me rassures.

On repasse donc en RESOLU.