néttoyage demande d'aide Résolu/Fermé

Question

Bonjour, 
est ce qu'il y a une âme charitable pour m'aiguiller dans le nettoyage de mon pc merci


Configuration: Windows XP / Firefox 23.0

hub70 · Answer

j'en ai pas

hub70 · Answer

en fait si j'ai avira

hub70 · Answer

voici le lien
https://www.cjoint.com/?0HzxH7H03mv

hub70 · Answer

bonjour,
j'ai lancer antimalwerbytes j'ai fait rechercher mais je ne sais pas quoi faire de ce qu'il m'a trouvé il y a des file et des registry key
merci

hub70 · Answer

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Version de la base de données: v2013.08.25.06

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
paule :: CLAUDE [administrateur]

25/08/2013 23:44:26
mbam-log-2013-08-25 (23-44-26).txt

Type d'examen: Examen complet (C:\|)
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 289505
Temps écoulé: 3 heure(s), 56 minute(s), 36 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 7
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.EXE (PUP.Babylon.A) -> Mis en quarantaine et supprimé avec succès.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ab1bff2d-610e-4e80-b9f3-fd9086025e48} (PUP.Optional.LyricsAd.Gen) -> Mis en quarantaine et supprimé avec succès.
HKCR\CLSID\{ab1bff2d-610e-4e80-b9f3-fd9086025e48} (PUP.Optional.LyricsAd.Gen) -> Mis en quarantaine et supprimé avec succès.
HKCR\TypeLib\{2233839e-3478-4d33-bc1d-4da58bc53dc2} (PUP.Optional.LyricsAd.Gen) -> Mis en quarantaine et supprimé avec succès.
HKCR\Interface\{A10AFBAE-C1CB-474C-8B39-8595D3A139D6} (PUP.Optional.LyricsAd.Gen) -> Mis en quarantaine et supprimé avec succès.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{AB1BFF2D-610E-4E80-B9F3-FD9086025E48} (PUP.Optional.LyricsAd.Gen) -> Mis en quarantaine et supprimé avec succès.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{AB1BFF2D-610E-4E80-B9F3-FD9086025E48} (PUP.Optional.LyricsAd.Gen) -> Mis en quarantaine et supprimé avec succès.

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 22
C:\AdwCleaner\Quarantine\C\Program Files\Lyrics_Monkey\Uninstall.exe.vir (PUP.Optional.LyricsAd) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\paule\Application Data\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\stub_data\stubinst_pkg_en-eu.cab (PUP.Optional.OpenCandy) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\paule\Local Settings\Application Data\AddLyrics.exe (PUP.AddLyrics) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\paule\Local Settings\Application Data\DeltaToolbar.exe (PUP.Optional.DeltaTB) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\paule\Local Settings\Temp\LyricsMonkey_1060-1053_v120.exe (PUP.Optional.LyricsAd) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\paule\Local Settings\Temp\_ir_sf_temp_0\MyBabylonTB.exe (PUP.Optional.Babylon.A) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\paule\Local Settings\Temp\is1373634743\BoxoreInstaller.exe (Adware.Boxore) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\paule\Local Settings\Temp\082001C1-BAB0-7891-8C87-411D82230763\BabMaint.exe (PUP.Optional.Babylon.A) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\paule\Local Settings\Temp\082001C1-BAB0-7891-8C87-411D82230763\BUSolution.dll (PUP.Optional.BabSolution.A) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\paule\Local Settings\Temp\082001C1-BAB0-7891-8C87-411D82230763\MyDeltaTB.exe (PUP.Optional.Delta) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\paule\Local Settings\Temp\082001C1-BAB0-7891-8C87-411D82230763\Setup.exe (PUP.Babylon.A) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\paule\Mes documents\Téléchargements\rcpsetupmarm_marm0fr.exe (PUP.Optional.RegCleanerPro) -> Mis en quarantaine et supprimé avec succès.
C:\Documents and Settings\paule\Mes documents\Téléchargements\SoftonicDownloader_pour_apowersoft-youtube-music-converter.exe (PUP.Optional.Softonic) -> Mis en quarantaine et supprimé avec succès.
C:\System Volume Information\_restore{773DF7F7-65BE-4786-AEC4-B67DA000E659}\RP556\A0086686.exe (PUP.Optional.Babylon.A) -> Mis en quarantaine et supprimé avec succès.
C:\System Volume Information\_restore{773DF7F7-65BE-4786-AEC4-B67DA000E659}\RP556\A0086687.dll (PUP.Optional.BabSolution.A) -> Mis en quarantaine et supprimé avec succès.
C:\System Volume Information\_restore{773DF7F7-65BE-4786-AEC4-B67DA000E659}\RP556\A0086695.dll (PUP.Optional.Delta) -> Mis en quarantaine et supprimé avec succès.
C:\System Volume Information\_restore{773DF7F7-65BE-4786-AEC4-B67DA000E659}\RP556\A0086696.dll (PUP.Optional.Delta) -> Mis en quarantaine et supprimé avec succès.
C:\System Volume Information\_restore{773DF7F7-65BE-4786-AEC4-B67DA000E659}\RP556\A0086697.dll (PUP.Optional.Delta) -> Mis en quarantaine et supprimé avec succès.
C:\System Volume Information\_restore{773DF7F7-65BE-4786-AEC4-B67DA000E659}\RP556\A0086698.dll (PUP.Optional.Delta) -> Mis en quarantaine et supprimé avec succès.
C:\System Volume Information\_restore{773DF7F7-65BE-4786-AEC4-B67DA000E659}\RP556\A0086700.exe (PUP.Optional.Delta) -> Mis en quarantaine et supprimé avec succès.
C:\System Volume Information\_restore{773DF7F7-65BE-4786-AEC4-B67DA000E659}\RP558\A0087033.exe (PUP.BundleInstaller.IB) -> Mis en quarantaine et supprimé avec succès.
C:\System Volume Information\_restore{773DF7F7-65BE-4786-AEC4-B67DA000E659}\RP558\A0087565.exe (PUP.Optional.LyricsAd) -> Mis en quarantaine et supprimé avec succès.

(fin)

jacques.gache · Answer

hub70 bonjour, je te laisse continuer avec GT33
   puisque tu as fais malwarebytes le rapport de zhpdiag n'est plus valable car certaine choses on été supprimé par malwarebytes , je pense que GT33 sera heureux de te finir le nettoyage @+

PS: je me retire du sujet et mes intervenvions aussi

hub70 · Answer

bonjour,
je ne comprends pas tout, est ce qu'il aurait des choses que je n'aurai pas du faire?

hub70 · Answer

ok

hub70 · Answer

~ Rapport de ZHPDiag v2013.8.24.35 - Nicolas Coolman (24/08/2013) ~ Lancé par paule (26/08/2013 21:02:03) ~ Adresse du Site Web https://nicolascoolman.webs.com/ ~ Traduit par Nicolas Coolman ~ Etat de la version : Problème connexion internet ~ Liste blanche : Activée par le programme ~ Elévation des Privilèges : OK ~ User Account Control (UAC): Not Found ---\ Navigateurs Internet MSIE: Internet Explorer v8.0.6001.18702 MFIE: Mozilla Firefox 23.0.1 (Defaut) GCIE: Google Chrome v29.0.1547.57 ---\ Informations sur les produits Windows ~ Langage: Français Windows XP Home Edition Service Pack 3 (Build 2600) Windows Automatic Updates : OK Windows Genuine Advantage : KO ---\ Logiciels de protection du système Avira Free Antivirus v13.0.0.3885 Malwarebytes Anti-Malware version 1.75.0.1300 McAfee Security Scan Plus v3.0.318.3 ---\ Logiciels d'optimisation du système CCleaner v4.04 =>Piriform Ltd ---\ Logiciels de partage PeerToPeer µTorrent v3.2.0 =>P2P.µTorrent ---\ Surveillance de Logiciels Adobe Flash Player 11 Plugin Adobe Reader 9.5.5 - Français Java 7 Update 7 ---\ Informations sur le système ~ Processor: x86 Family 6 Model 28 Stepping 10, GenuineIntel ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 1013 MB (38% free) System Restore: Activé (Enable) System drive C: has 94 GB (67%) free of 139 GB ---\ Mode de connexion au système ~ Computer Name: CLAUDE ~ User Name: paule ~ All Users Names: SUPPORT_388945a0, paule, HelpAssistant, Administrateur, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\ Variables d'environnement ~ System Unit : C:\ ~ %AppData% : C:\Documents and Settings\paule\Application Data\ ~ %Desktop% : C:\Documents and Settings\paule\Bureau\ ~ %Favorites% : C:\Documents and Settings\paule\Favoris\ ~ %LocalAppData% : C:\Documents and Settings\paule\Local Settings\Application Data\ ~ %StartMenu% : C:\Documents and Settings\paule\Menu Démarrer\ ~ %Windir% : C:\WINDOWS\ ~ %System% : C:\WINDOWS\system32\ ---\ Enumération des unités disques C:\ Hard drive, Flash drive, Thumb drive (Free 94 Go of 139 Go) D:\ Floppy drive, Flash card reader, USB Key (Free 3 Go of 7 Go) ---\ Etat du Centre de Sécurité Windows ~ Security Center: 30 Legitimates Filtered in 00mn 00s ---\ Recherche particulière de fichiers génériques [MD5.F2317622D29F9FF0F88AEECD5F60F0DD] - (.Microsoft Corporation - Explorateur Windows.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\Explorer.exe [1037824] [MD5.E1948293F7CBC38987270432935D8D05] - (.Microsoft Corporation - Internet Extensions for Win32.) (.26/07/2013 - 03:47:15.) -- C:\WINDOWS\system32\wininet.dll [920064] [MD5.DD73D6B9F6B4CB630CF35B438B540174] - (.Microsoft Corporation - Application d'ouverture de session Windows NT.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Winlogon.exe [512000] [MD5.1E44BC1E83D8FD2305F8D452DB109CF9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.17/08/2011 - 14:49:54.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496] [MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.14/04/2008 - 00:40:32.) -- C:\WINDOWS\system32\Drivers\atapi.sys [96512] [MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744] [MD5.1F4260CC5B42272D71F79E570A27A4FE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [62976] [MD5.31F923EB2170FC172C81ABDA0045D18C] - (.Microsoft Corporation - Pilote de cryptographie FIPS.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Fips.sys [44672] [MD5.573C7D0A32852B48F3058CFD8026F511] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [144384] [MD5.A09BDC4ED10E3B2E0EC27BB94AF32516] - (.Microsoft Corporation - Pilote de port i8042.) (.14/04/2008 - 08:00:54.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [54144] [MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [42112] [MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [152832] [MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [75264] [MD5.7D304A5EB4344EBEEAB53A2FE3FFB9F0] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.15/07/2011 - 14:29:31.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [456320] [MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers etBT.sys [162816] [MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers tfs.sys [574976] [MD5.8FD0BDBEA875D06CCF6C945CA9ABAF75] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80384] [MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328] [MD5.15CABD0F7C00C47C70124907916AF3F1] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.14/04/2008 - 00:32:52.) -- C:\WINDOWS\system32\Drivers dpdr.sys [196224] [MD5.D8EB2A7904DB6C916EB5361878DDCBAE] - (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) (.13/04/2008 - 19:57:36.) -- C:\WINDOWS\system32\Drivers edbook.sys [58752] [MD5.46DE1126684369BACE4849E4FC8C43CA] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [53376] ~ Generic Processes: Scanned in 00mn 05s ---\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 2/1108 ~ Mes musiques (My Musics) : 1/30 ~ Mes Videos (My Videos) : 0/20 ~ Mes Favoris (My Favorites) : 1/18 ~ Mes Documents (My Documents) : 2/2477 ~ Mon Bureau (My Desktop) : 1/695 ~ Menu demarrer (Programs) : 1/25 ~ Hidden Files: Scanned in 00mn 47s ---\ Processus lancés au démarrage du système [MD5.0840ABBBDF438691EE65A20040635CBE] - (.Stardock Corporation - Dock Login Service.) -- C:\Program Files\Dell\DellDock\DockLogin.exe [155648] [PID.1276] [MD5.01FAE7E8176472FE359E86AB4FD039A9] - (...) -- C:\WINDOWS\System32\WLTRYSVC.exe [24576] [PID.1616] [MD5.C7F30BB20487765460865AEF466933EA] - (.Dell Inc. - Dell Wireless WLAN Card Wireless Network Co.) -- C:\WINDOWS\System32\bcmwltry.exe [2039808] [PID.1664] [MD5.99387251353598C939592FAF40DF8AA9] - (.Avira Operations GmbH & Co. KG - Avira Scheduler.) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024] [PID.1836] [MD5.8491FDA93507F2F27FFBA11372764086] - (.Avira Operations GmbH & Co. KG - Avira On-Access Service.) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088] [PID.172] [MD5.4FE5C6D40664AE07BE5105874357D2ED] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe [57008] [PID.276] [MD5.4B797AFC90A29C59308E260DBCCD5821] - (.Dell - Dell Device Monitor Service.) -- C:\Program Files\Dell\MFP_DELL\deMntrService.exe [131072] [PID.528] [MD5.777115C9CC675BD98127660712D2F784] - (.SupportSoft, Inc. - SupportSoft Agent Service.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe [201968] [PID.800] [MD5.2E0B0A051FFAA86E358465BB0880D453] - (.Microsoft Corporation - Windows Update.) -- C:\WINDOWS\system32\wuauclt.exe [53784] [PID.1584] [MD5.4631FF0EE2964CCDC646AF807CB778F5] - (.Avira Operations GmbH & Co. KG - Avira System Tray Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144] [PID.2480] [MD5.59ED06CB3DDB7E0D2265D49A20F6367D] - (.Dell - WSED.) -- C:\Program Files\WSED\WSED.exe [247080] [PID.2496] [MD5.CC66DB5B74E698EDE3ED032BB8F7F95F] - (.Realtek Semiconductor Corp. - Realtek HD Audio Control Panel.) -- C:\WINDOWS\RTHDCPL.exe [18782720] [PID.2508] [MD5.600541F460048CDEB6746E2F70FA04AF] - (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe [141336] [PID.2532] [MD5.CE42DFE915F78246364D464902E47360] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe [152392] [PID.2540] [MD5.98D486AF375F989DA5E9D60CE485643C] - (.Intel Corporation - igfxTray Module.) -- C:\WINDOWS\system32\igfxtray.exe [141336] [PID.2552] [MD5.17EFB293E5556DEE59D477CEA8C9A832] - (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe [173592] [PID.2560] [MD5.4C3139B8721BB560419A32D5EE327226] - (.Dell - Dell Device Status.) -- C:\Program Files\Dell\MFP_DELL\deDvcStatus.exe [286720] [PID.2676] [MD5.5FF22206ED03493F6214E0501B69FBBD] - (.Intel Corporation - igfxsrvc Module.) -- C:\WINDOWS\system32\igfxsrvc.exe [250392] [PID.2672] [MD5.00D1FB0073B4A8BD2989EA8FF4CC792B] - (.SupportSoft, Inc. - Dell Support Center Updates.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe [206064] [PID.2688] [MD5.64559B49CC85ABD75571533CF37B4A6B] - (.Dell - Pas de description.) -- C:\Program Files\Battery Meter\BTMeter.exe [632176] [PID.2728] [MD5.1818A2CD223603911970E667A5EACC9C] - (.Dell Inc. - Dell Wireless WLAN Card Wireless Network Tr.) -- C:\WINDOWS\system32\WLTRAY.exe [2289664] [PID.2740] [MD5.F4F7C86191A981C804326E2EF6F3604F] - (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056] [PID.2804] [MD5.B141F8F8B0FF37FFC51F9B71EE7A641B] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe [19875432] [PID.2868] [MD5.E13EA4860E8F2AA845B53BFD2B6FEC5B] - (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe [1695232] [PID.2904] [MD5.BD713579A87D698E1F2158CE10E48130] - (.McAfee, Inc. - McAfee Security Scanner Scheduler.) -- C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe [272248] [PID.3020] [MD5.68C105908A54D734D2B154DB546F562E] - (.Avira Operations GmbH & Co. KG - Avira Shadow Copy Service.) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe [76856] [PID.3488] [MD5.696EB1F22EC71262BB8188639DBEED3E] - (.Avira Operations GmbH & Co. KG - Avira WebGuard Service.) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.exe [589368] [PID.3676] [MD5.D8B8B5A8FE57CF4F307A540D9A153C23] - (.Apple Inc. - iPodService Module (32-bit).) -- C:\Program Files\iPod\bin\iPodService.exe [553288] [PID.4072] [MD5.11821BB2822BFDF2C8654A157A829C2F] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7836672] [PID.2888] [MD5.04BDC34F8E4191009CE66851CAE8B5D3] - (.Avira Operations GmbH & Co. KG - Avira Updater.) -- C:\Program Files\Avira\AntiVir Desktop\update.exe [598584] [PID.2580] [MD5.FC100C146D4E1F3D6F0EB3476EEBC61B] - (.Avira Operations GmbH & Co. KG - Avira Updater remote GUI.) -- C:\Program Files\Avira\AntiVir Desktop\updrgui.exe [44088] [PID.3896] [MD5.CEA8F7E45B7B098F5FB085BB6A6A4432] - (.Microsoft Corporation - Microsoft (R) Windows Based Script Host.) -- C:\WINDOWS\system32\wscript.exe [155648] [PID.1012] [MD5.1720F7D04929950624702562649FE0F6] - (.Avira Operations GmbH & Co. KG - Avira Notification Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avnotify.exe [284728] [PID.0] [MD5.49501C6BE752D5043ADA8667AC774F7A] - (.Microsoft Corporation - Windows User Mode Driver Manager.) -- C:\WINDOWS\system32\wdfmgr.exe [38912] [PID.1184] [MD5.5E9A6658A2A69AE7EB195113B7A2E7A9] - (.Microsoft Corporation - Application Layer Gateway Service.) -- C:\WINDOWS\System32\alg.exe [44544] [PID.1992] ~ Processes Running: Scanned in 00mn 40s ---\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2) C:\Documents and Settings\paule\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences ~ Google Browser: 0 Legitimates Filtered in 00mn 00s ---\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) C:\Documents and Settings\paule\Application Data\Mozilla\Firefox\Profiles\ztnxs5ap.default-1354458410000\prefs.js ~ Firefox Browser: 28 Legitimates Filtered in 00mn 04s ---\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4) R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.amazon.fr/ ~ IE Browser: 10 Legitimates Filtered in 00mn 00s ---\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\WINDOWS\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl" ~ Keys: Scanned in 00mn 00s ---\ Hosts file redirection (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 00s ~ Nombre de lignes (Lines number): 20 ---\ Internet Explorer Toolbars (O3) O3 - Toolbar: iGraal Toolbar - [HKLM]{D01B1F7D-9D7F-46C3-8DB9-5A55819E2A7F} . (...) -- (.not file.) O3 - Toolbar: Avira SearchFree Toolbar plus Web Protection - [HKLM]{41564952-412D-5637-00A7-7A786E7484D7} . (...) -- C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll =>Toolbar.Avira O3 - Toolbar\WebBrowser: (no name) - [HKCU]{01E04581-4EEE-11D0-BFE9-00AA005B4383} Clé orpheline O3 - Toolbar\WebBrowser: (no name) - [HKCU]{0E5CBF21-D15F-11D0-8301-00AA005B4383} Clé orpheline O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline ~ Toolbar: Scanned in 00mn 00s ---\ Applications démarrées par registre & par dossier (O4) O4 - HKLM\..\Run: [avgnt] . (.Avira Operations GmbH & Co. KG - Avira System Tray Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe O4 - HKLM\..\Run: [WSED] . (.Dell - WSED.) -- C:\Program Files\WSED\WSED.exe O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe (.not file.) O4 - HKLM\..\Run: [SynTPEnh] . (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [RTHDCPL] . (.Realtek Semiconductor Corp. - Realtek HD Audio Control Panel.) -- C:\WINDOWS\RTHDCPL.exe O4 - HKLM\..\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- C:\Program Files\QuickTime\qttask.exe O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (.not file.) O4 - HKLM\..\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [DeStatusMon] . (.Dell - Dell Device Status.) -- C:\Program Files\Dell\MFP_DELL\deDvcStatus.exe O4 - HKLM\..\Run: [dellsupportcenter] . (.SupportSoft, Inc. - Dell Support Center Updates.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe O4 - HKLM\..\Run: [CapsLKNotify] C:\Program Files\CapsLKNotify\CapsLKNotify.exe (.not file.) O4 - HKLM\..\Run: [BTMeter] . (.Dell - Pas de description.) -- C:\Program Files\Battery Meter\BTMeter.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] . (.Dell Inc. - Dell Wireless WLAN Card Wireless Network Tr.) -- C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe O4 - HKCU\..\Run: [uTorrent] C:\Documents and Settings\paule\Mes documents\photo , julie + chou\uTorrent.exe (.not file.) =>P2P.µTorrent O4 - HKCU\..\Run: [SystweakASP] C:\Program Files\RegClean Pro\SystweakASP.exe (.not file.) =>Rogue.RegistryPowerCleaner O4 - HKCU\..\Run: [Spotify] C:\Documents and Settings\paule\Application Data\Spotify\Spotify.exe (.not file.) O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe O4 - HKCU\..\Run: [msnmsgr] C:\Program Files\Windows Live\Messenger\msnmsgr.exe (.not file.) O4 - HKCU\..\Run: [MSMSGS] . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Documents and Settings\paule\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Akamai NetSession Interface] C:\Documents and Settings\paule\Local Settings\Application Data\Akamai etsession_win.exe (.not file.) O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [uTorrent] C:\Documents and Settings\paule\Mes documents\photo , julie + chou\uTorrent.exe (.not file.) =>P2P.µTorrent O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [SystweakASP] C:\Program Files\RegClean Pro\SystweakASP.exe (.not file.) =>Rogue.RegistryPowerCleaner O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [Spotify] C:\Documents and Settings\paule\Application Data\Spotify\Spotify.exe (.not file.) O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [msnmsgr] C:\Program Files\Windows Live\Messenger\msnmsgr.exe (.not file.) O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [MSMSGS] . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Documents and Settings\paule\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [Akamai NetSession Interface] C:\Documents and Settings\paule\Local Settings\Application Data\Akamai etsession_win.exe (.not file.) ~ Application: Scanned in 00mn 02s ---\ Autres liens utilisateurs (O4) O4 - GS\Programs: Adobe Download Assistant.lnk . (...) -- C:\Program Files\Adobe Download Assistant\Adobe Download Assistant.exe O4 - GS\Programs: Adobe Reader 9.lnk . (...) -- C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-A95000000001}\SC_Reader.ico O4 - GS\Programs: Audacity.lnk . (...) -- C:\Program Files\audacity\audacity.exe O4 - GS\Programs: Lanceur de tâches Microsoft Works.lnk . (.Microsoft® Corporation - Microsoft® Works.) -- C:\Program Files\Microsoft Works\MSWorks.exe O4 - GS\Programs: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O4 - GS\Programs: Paint.NET.lnk . (.dotPDN LLC - Paint.NET.) -- C:\Program Files\Paint.NET\PaintDotNet.exe O4 - GS\Programs: Visionneuse Microsoft Office PowerPoint 2007.lnk . (...) -- C:\WINDOWS\Installer\{95120000-00AF-040C-0000-0000000FF1CE}\ppvwicon.exe O4 - GS\Programs: Windows Search.lnk . (.Microsoft Corporation - Windows Search System Tray.) -- C:\Program Files\Windows Desktop Search\WindowsSearch.exe O4 - GS\Programs: Assistance à distance.LNK . (.Microsoft Corporation - Assistance à distance Microsoft.) -- C:\WINDOWS\system32 cimlby.exe O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Programs: Lecteur Windows Media.lnk . (.Microsoft Corporation - Lecteur Windows Media.) -- C:\Program Files\Windows Media Player\wmplayer.exe O4 - GS\Programs: Outlook Express.LNK . (.Microsoft Corporation - Outlook Express.) -- C:\Program Files\Outlook Express\msimn.exe ~ Global Startup: Scanned in 00mn 05s ---\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: iGraal - {32893F3D-2B10-4B09-BA6A-8F20E7D33925} -- C:\Documents and Settings\paule\Mes documents\Mes vidéos\Téléchargements RealPlayer\iGraal\Button.dll (.not file.) O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\OFFICE11\REFBARH.ICO O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -- Clé orpheline O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe ~ IE Extra Buttons: Scanned in 00mn 00s ---\ Objets ActiveX (Downloaded Program Files)(O16) O16 - DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} ((no name)) - http://support.euro.dell.com/systemprofiler/DellSystemLite.CAB ~ Objets ActiveX: Scanned in 00mn 00s ---\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{B58540CA-E496-42BB-8F2A-50656C6C0289}: NameServer = 178.33.41.181,46.4.70.20 O17 - HKLM\System\CCS\Services\Tcpip\..\{47A75EC0-95D4-4BF9-97D7-015513A6E793}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{B58540CA-E496-42BB-8F2A-50656C6C0289}: NameServer = 178.33.41.181,46.4.70.20 O17 - HKLM\System\CS1\Services\Tcpip\..\{47A75EC0-95D4-4BF9-97D7-015513A6E793}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CS3\Services\Tcpip\..\{B58540CA-E496-42BB-8F2A-50656C6C0289}: NameServer = 178.33.41.181,46.4.70.20 O17 - HKLM\System\CS3\Services\Tcpip\..\{47A75EC0-95D4-4BF9-97D7-015513A6E793}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1 ~ Domain: Scanned in 00mn 00s ---\ Titr_HJT34=Protocole additionnel (O18) O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} . (.Microsoft Corporation - WIA Scripting Layer.) -- C:\WINDOWS\system32\wiascr.dll O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.dll ~ Protocole Additionnel: Scanned in 00mn 00s ---\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dll O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dll O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agent réseau hors connexion.) -- C:\WINDOWS\system32\cscdll.dll O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\system32\dimsntfy.dll O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\WINDOWS\system32\igfxdev.dll O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL secondaire de notification de service d.) -- C:\WINDOWS\system32\sclgntfy.dll O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\WlNotify.dll O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll ~ Winlogon: Scanned in 00mn 00s ---\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: Service Google Update (gupdate) (gupdate) . (.Google Inc. - Programme d'installation de Google.) - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: SupportSoft Sprocket Service (DellSuppor (sprtsvc_DellSupportCenter) . (.SupportSoft, Inc. - SupportSoft Agent Service.) - C:\Program Files\Dell Support Center\bin\sprtsvc.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) . (...) - C:\WINDOWS\system32\WLTRYSVC.exe ~ Services: 11 Legitimates Filtered in 00mn 16s ---\ Enumération Active Desktop & MHTML Editor (O24) O24 - Desktop General: BackupWallPaper - .(...) - C:\Documents and Settings\paule\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop General: WallPaper - .(...) - C:\Documents and Settings\paule\Local Settings\Application Data\Microsoft\Wallpaper1.bmp ~ Desktop Component: 4 Legitimates Filtered in 00mn 00s ---\ Pilotes lancés au démarrage du système (O41) O41 - Driver: (appdrv01) . (.Protection Technology - Application Driver (01).) - C:\WINDOWS\system32\Drivers\appdrv01.sys ~ Drivers: 75 Legitimates Filtered in 00mn 02s ---\ Logiciels installés (O42) O42 - Logiciel: Jauge de batterie - (...) [HKLM] -- InstallShield_{543A4F31-9590-416A-A621-42CEB4C6A694} ~ Logic: 102 Legitimates Filtered in 00mn 02s ---\ HKCU & HKLM Software Keys [HKCU\Software\IncrediMail] [HKCU\Software\KeepVid] [HKLM\Software\54c] [HKLM\Software\Chaumet] [HKLM\Software\Function Keys] [HKLM\Software\IncrediMail] [HKLM\Software\SEJER] [HKLM\Software\WSED] [HKLM\Software\iGraal] ~ Key Software: 208 Legitimates Filtered in 00mn 02s ---\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 09/02/2010 - 08:43:02 - [0,603] ----D C:\Program Files\Battery Meter O43 - CFD: 09/02/2010 - 08:43:43 - [0,384] ----D C:\Program Files\Function Keys O43 - CFD: 09/02/2010 - 08:44:02 - [0,236] ----D C:\Program Files\WSED O43 - CFD: 09/02/2010 - 08:43:17 - [0,887] ----D C:\Documents and Settings\All Users\Application Data\Win732 O43 - CFD: 09/02/2010 - 08:43:17 - [1,427] ----D C:\Documents and Settings\All Users\Application Data\Win764 O43 - CFD: 09/02/2010 - 08:44:43 - [1,468] ----D C:\Documents and Settings\All Users\Application Data\XP32 O43 - CFD: 30/05/2010 - 18:10:19 - [0,045] ----D C:\Documents and Settings\paule\Application Data\cald2 O43 - CFD: 31/10/2012 - 17:50:41 - [0] ----D C:\Documents and Settings\paule\Application Data\ul_data O43 - CFD: 09/02/2010 - 08:43:44 - [0,001] ----D C:\Documents and Settings\paule\Menu Démarrer\Programmes\Touches de fonction ~ Program Folder: 186 Legitimates Filtered in 01mn 46s ---\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.1956642E63933F6782AB3B7C97BFE1C6] - 26/08/2013 - 19:59:48 ---A- . (...) -- C:\WINDOWS\wiadebug.log [157] O44 - LFC:[MD5.2628DF0BED6C7D47B96B54D5ED654625] - 26/08/2013 - 19:59:45 ---A- . (...) -- C:\WINDOWS\wiaservc.log [50] O44 - LFC:[MD5.C9DD76D0EF94637C77FF8CA5E0FB0684] - 26/08/2013 - 08:22:54 ---A- . (...) -- C:\WINDOWS\system.ini [227] O44 - LFC:[MD5.4D1E56E34C0D19EC9CBD2A471E3548C4] - 26/08/2013 - 08:22:54 ---A- . (...) -- C:\WINDOWS\win.ini [573] O44 - LFC:[MD5.26E14737C09E32CD46D970D8A2E20256] - 26/08/2013 - 02:14:18 ---A- . (...) -- C:\log.txt [1060749] O44 - LFC:[MD5.42EE400EAB8844B324EA04A26F91226C] - 25/08/2013 - 18:36:34 ---A- . (...) -- C:\WINDOWS\system32\ASOROSet.bin [2404] O44 - LFC:[MD5.B769F31F15544A455FA5A9DE4CB82829] - 25/08/2013 - 09:18:38 ---A- . (...) -- C:\WINDOWS\system32\mfc45.dat [74703] O44 - LFC:[MD5.2015783A18E1BE8D938298FACDB08D99] - 25/08/2013 - 09:04:01 ---A- . (...) -- C:\NTUser.dat [262144] O44 - LFC:[MD5.B0D063401D5128A2F4FC1AE12F62B0FF] - 25/08/2013 - 09:04:01 --HA- . (...) -- C:\NTUser.dat.LOG [1024] O44 - LFC:[MD5.22BA49C48A12D0EA923D042CD63BF3BF] - 24/08/2013 - 20:48:21 ---A- . (.Protection Technology - Application Driver (01).) -- C:\WINDOWS\system32\Drivers\appdrv01.sys [2256768] O44 - LFC:[MD5.C14D443940AAA5CC189F423FAC24ED41] - 24/08/2013 - 20:48:21 ---A- . (.Protection Technology - Application Driver Auto Removal Service (01.) -- C:\WINDOWS\system32\appdrvrem01.exe [318632] O44 - LFC:[MD5.65C50D03574D72C7E1860850C8933BEB] - 15/08/2013 - 02:11:27 ---A- . (...) -- C:\WINDOWS\system32\TZLog.log [59646] ~ Files: 32 Legitimates Filtered in 03mn 25s ---\ Opérations et fonctions au démarrage de Windows Explorer (O46) O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll O46 - SEH:ShellExecuteHooks - Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll ~ ShellExecuteHooks: Scanned in 00mn 00s ---\ Export de clé d'application autorisée (O47) O47 - AAKE:Key Export SP - "C:\Documents and Settings\paule\Mes documents\Téléchargements\microtorrent_torrent_3.1.3_build_26837_francais_18245.exe" [Enabled] .(...) -- C:\Documents and Settings\paule\Mes documents\Téléchargements\microtorrent_torrent_3.1.3_build_26837_francais_18245.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Documents and Settings\paule\Local Settings\Application Data\Akamai etsession_win.exe" [Disabled] .(...) -- C:\Documents and Settings\paule\Local Settings\Application Data\Akamai etsession_win.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Documents and Settings\paule\Mes documents\photo , julie + chou\EdenEternal-FR\_Launcher.exe" [Enabled] .(...) -- C:\Documents and Settings\paule\Mes documents\photo , julie + chou\EdenEternal-FR\_Launcher.exe (.not file.) ~ Keys Export: 22 Legitimates Filtered in 00mn 06s ---\ Image File Execution Options (IFEO) (O50) O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d ~ IFEO: Scanned in 00mn 00s ---\ Clé de registre Shell MountPoints2 (MPKS) (O51) O51 - MPSK:{afdad4a1-6c03-11df-b686-972967056867}\AutoRun\command. (...) -- C:\WINDOWS\system32\TF1VIDEO.hta (.not file.) O51 - MPSK:{b5b2e667-6af0-11df-b685-e5b09bd654b7}\AutoRun\command. (...) -- E:\LaunchU3.exe (.not file.) ~ Keys: Scanned in 00mn 00s ---\ Liste des pilotes du système (SDL) (O58) O58 - SDL:[MD5.F6AF59D6EEE5E1C304F7F73706AD11D8] - 17/11/2009 - 17:40:42 ---A- . (.Creative - Creative WDM 3D Audio Driver.) -- C:\WINDOWS\system32\Drivers\Ambfilt.sys [1684736] O58 - SDL:[MD5.6D3ADA4CE95CECA7BCE527A08C4C474E] - 14/04/2008 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ansi.sys [9037] ~ Drivers: 5 Legitimates Filtered in 00mn 01s ---\ Liste des outils de désinfection (LATC) (O63) O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 ~ ADS: Scanned in 00mn 00s ---\ Liste les services legacy du registre (LALS) (O64) O64 - Services: CurCS - 20/11/2011 - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe LM Service) .(.Adobe Systems - System Level Service Utility.) - LEGACY_ADOBE_LM_SERVICE O64 - Services: CurCS - 09/06/2009 - C:\Program Files\Dell\DellDock\DockLogin.exe (DockLoginService) .(.Stardock Corporation - Dock Login Service.) - LEGACY_DOCKLOGINSERVICE ~ Legacy: 192 Legitimates Filtered in 00mn 11s ---\ Menu de démarrage Internet (SMI) (O68) O68 - StartMenuInternet: <>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\ Recherche d'infection sur les navigateurs internet (SBI) (O69) O69 - SBI: SearchScopes [HKCU] 419CACB854694A8AA9405A250F77380E - (uTorrentBar_FR Customized Web Search) - http://search.conduit.com =>P2P.µTorrent O69 - SBI: SearchScopes [HKCU] {3207E767-03AD-43F6-99A5-8441FECC86CA} - (Ask Search) - http://www.search.ask.com/?o=10148&l=dis =>Toolbar.Ask O69 - SBI: SearchScopes [HKCU] {79B2CD94-5655-8129-42C5-4F150E4A6A48} - (Google) - https://www.google.com/?gws_rd=ssl O69 - SBI: SearchScopes [HKCU] {7CB4DA7B-F6CF-452B-855D-88F37C12FB74} - (Google) - https://www.google.com/?gws_rd=ssl O69 - SBI: SearchScopes [HKCU] {B3B3A6AC-74EC-BD56-BCDB-EFA4799FB9DF} - (Amazon) - http://www.amazon.frhTerms} O69 - SBI: SearchScopes [HKCU] {EEE46F33-1B64-40F1-A0E7-E19DDBA245D3} - (Google) - https://www.google.com/?gws_rd=ssl ~ Keys: Scanned in 00mn 00s ---\ Recherche particulière à la racine du système (SPRF) (O84) [MD5.D81AC8D32D3609176D96D669D1777035] [SPRF][30/04/2008] (...) -- C:\Documents and Settings\paule\Local Settings\Application Data\fusioncache.dat [135] [MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][28/05/2010] (...) -- C:\Documents and Settings\paule\Application Data\wklnhst.dat [0] ~ Files: 2 Legitimates Filtered in 00mn 01s ---\ Enumère les codes produits des logiciels (PUC) (O90) O90 - PUC: "13F4A3450959A6146A1224EC4B6C6A49" . (.Battery Meter.) -- C:\WINDOWS\Installer\{543A4F31-9590-416A-A621-42CEB4C6A694}\ARPPRODUCTICON.exe O90 - PUC: "25946514D2147365007A7A857BC02020" . (.Avira SearchFree Toolbar plus Web Protection.) -- C:\WINDOWS\Installer\{41564952-412D-5637-00A7-A758B70C0202}\ToolbarIcon.exe =>Toolbar.Avira O90 - PUC: "3D15E350D588C5245968AE15384C6C88" . (.Function Keys.) -- C:\WINDOWS\Installer\{053E51D3-885D-425C-9586-EA5183C4C688}\ARPPRODUCTICON.exe O90 - PUC: "6216BC6E021D5BF4D9B12E1E09306EC6" . (.WSED.) -- C:\WINDOWS\Installer\{E6CB6126-D120-4FB5-9D1B-E2E19003E66C}\ARPPRODUCTICON.exe ~ Update Products: 58 Legitimates Filtered in 00mn 00s ---\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS) [MD5.993F9C3B4FF62AD7DDFA2DCF3C9E52D7] [WIS][25/08/2013] (.Ask Partner Network - Avira SearchFree Toolbar plus Web Protection.) -- C:\Windows\Installer\10c27c.msi [755200] =>Toolbar.Avira [MD5.3BFF707630742282B54AC0509CE3063B] [WIS][23/03/2011] (.Olivetti Enginering - Dell Photo AIO 928.) -- C:\Windows\Installer\7d9bb8.msi [2080768] [MD5.9E0AD3E31DAB3438A2C02E638574C546] [WIS][23/03/2011] (.Olivetti Engineering - .) -- C:\Windows\Installer\7d9bbf.msi [4174336] [MD5.F93A65FBEF40515319C1F648E37AB6B2] [WIS][09/02/2010] (.COMPAL - EMSC-Common-Driver.) -- C:\Windows\Installer\81a4a.msi [884224] [MD5.7EDFA03387F061E5805A0ABF1CD74F9D] [WIS][18/09/2012] (.roddy2000@hotbox.ru - DVD Decoder Pak for Windows XP.) -- C:\Windows\Installer\b4bb6a3.msi [220160] ~ WIS: 61 Legitimates Filtered in 02mn 32s ---\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Demand 20/11/2011 72704 | (Adobe LM Service) . (.Adobe Systems.) - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe SS - | Demand 20/08/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe SR - | Auto 25/08/2013 84024 | (AntiVirSchedulerService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\sched.exe SR - | Auto 25/08/2013 108088 | (AntiVirService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\avguard.exe SR - | Auto 25/08/2013 589368 | (AntiVirWebService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.exe SS - | Auto 24/08/2013 318632 | (appdrvrem01) . (.Protection Technology.) - C:\WINDOWS\system32\appdrvrem01.exe SR - | Auto 21/12/2012 57008 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe SR - | Auto 28/06/2007 131072 | (deMntrService) . (.Dell.) - C:\Program Files\Dell\MFP_DELL\deMntrService.exe SS - | Demand 14/04/2008 225280 | (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\system32\dmadmin.exe SR - | Auto 09/06/2009 155648 | (DockLoginService) . (.Stardock Corporation.) - C:\Program Files\Dell\DellDock\DockLogin.exe SS - | Auto 27/11/2011 136176 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 27/11/2011 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 03/04/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe SR - | Demand 16/08/2013 553288 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe SS - | Demand 05/02/2013 235216 | (McComponentHostService) . (.McAfee, Inc..) - C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe SS - | Demand 17/08/2013 117656 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe SS - | Auto 21/06/2013 162408 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe SR - | Auto 03/06/2009 201968 | (sprtsvc_DellSupportCenter) . (.SupportSoft, Inc..) - C:\Program Files\Dell Support Center\bin\sprtsvc.exe SR - | Auto 07/01/2009 24576 | (wltrysvc) . (...) - C:\WINDOWS\system32\WLTRYSVC.exe ~ Services: Scanned in 02mn 35s ---\ Scan Additionnel (O88) Database Version : v2.12865 - (24/08/2013) Clés trouvées (Keys found) : 15 Valeurs trouvées (Values found) : 2 Dossiers trouvés (Folders found) : 3 Fichiers trouvés (Files found) : 3 [HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110011441179}] =>Adware.GamePlayLabs [HKLM\Software\Classes\AppID\{F5BC53C9-AA01-4579-9927-EA50B636C820}] =>Adware.DoubleD [HKLM\Software\Classes\BHO.iGraalBHO] =>Toolbar.iGraal [HKLM\Software\Classes\BHO.iGraalBHO.1] =>Toolbar.iGraal [HKLM\Software\Classes\Toolbar.iGraalToolbar] =>Toolbar.iGraal [HKLM\Software\Classes\Toolbar.iGraalToolbar.1] =>Toolbar.iGraal [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375] =>Toolbar.Tarma [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5] =>Toolbar.Tarma [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{47B614AF-B4CC-485B-B331-BE26F02ED4CC}] =>Toolbar.Babylon [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{47B614AF-B4CC-485B-B331-BE26F02ED4CC}] =>Toolbar.Babylon [HKLM\Software\Classes\Toolbar.CT2851639] =>Toolbar.Conduit [HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011441179}] =>PUP.CrossRider [HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011441179}] =>PUP.CrossRider [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011441179}] =>PUP.CrossRider [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CA0054A5AB3EFFE4CB5660E44A1E7DCC] =>Adware.Boxore^ [HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{41564952-412D-5637-00A7-7A786E7484D7} =>Toolbar.Avira^ [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:SystweakASP =>Rogue.RegistryPowerCleaner^ C:\Program Files\Software =>Adware.Boxore C:\Documents and Settings\All Users\Application Data\Software =>Adware.Boxore C:\Documents and Settings\paule\Local Settings\Application Data\Software =>Adware.Boxore C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll =>Toolbar.Avira^ C:\WINDOWS\Installer\{41564952-412D-5637-00A7-A758B70C0202}\ToolbarIcon.exe =>Toolbar.Avira^ C:\Windows\Installer\10c27c.msi =>Toolbar.Avira^ ~ Additionnel Scan: 253951 Items scanned in 02mn 14s ---\ Récapitulatif des détections trouvées sur votre station ~ http://nicolascoolman.webs.com28419247-toolbar-avira =>Toolbar.Avira ~ http://nicolascoolman.webs.com29295819-rogue-registrypowercleaner =>Rogue.RegistryPowerCleaner ~ http://nicolascoolman.webs.com28927746-toolbar-ask =>Toolbar.Ask ~ http://nicolascoolman.webs.com26820943-adware-gameplaylabs =>Adware.GamePlayLabs ~ http://nicolascoolman.webs.com26668292-adware-doubled =>Adware.DoubleD ~ http://nicolascoolman.webs.com31121403-toolbar-igraal =>Toolbar.iGraal ~ http://nicolascoolman.webs.com29637859-toolbar-tarma =>Toolbar.Tarma ~ http://nicolascoolman.webs.com26627369-toolbar-babylon =>Toolbar.Babylon ~ http://nicolascoolman.webs.com29507721-toolbar-conduit =>Toolbar.Conduit ~ http://nicolascoolman.webs.com27583526-pup-crossrider =>PUP.CrossRider ~ http://nicolascoolman.webs.com26626977-adware-boxore =>Adware.Boxore ~ MSI: 11 link(s) detected in 02mn 14s ~ 1024 Legitimates filtered by white list End of the scan (558 lines in 12mn 58s)(0)

hub70 · Answer

j'ai fait directement copier coller le bloc note sur le forum j'espère que cela va

hub70 · Answer

en regardant ce qui est sorti dans le bloc note je n'y comprends rien mais je vois U torrent alors qu'il est désinstaller depuis longtemps

hub70 · Answer

c'est fait je n'ai pas redémarer mais dans programme file   zhpdiag je n'ai pas trouver le fichier zhpfixrepot
donc j'ai fais un copier coller de ce qui est apparut à la fin dans zpfix
j'espère que c'est cela qu'il faut


Rapport de ZHPFix 2013.7.20.5 par Nicolas Coolman, Update du 20/07/2013
Fichier d'export Registre : C:\ZHP\ZHPExportRegistry-26-08-2013-22-21-25.txt
Run by paule at 26/08/2013 22:20:57
High Elevated Privileges : OK
Windows XP Home Edition Service Pack 3 (Build 2600)

Corbeille vidée

========== Clé(s) du Registre ==========
SUPPRIME  Key: CLSID: [HKLM\SOFTWARE\Classes\CLSID\{D01B1F7D-9D7F-46C3-8DB9-5A55819E2A7F}]
SUPPRIME Key: CLSID Extra Buttons: {32893F3D-2B10-4B09-BA6A-8F20E7D33925}
SUPPRIME  Key: CLSID: [HKLM\SOFTWARE\Classes\CLSID\{32893F3D-2B10-4B09-BA6A-8F20E7D33925}]
SUPPRIME CLSID MPSK: {afdad4a1-6c03-11df-b686-972967056867}
SUPPRIME Key: SearchScopes :{3207E767-03AD-43F6-99A5-8441FECC86CA}
SUPPRIME Key: HKLM\Software\iGraal
SUPPRIME Key: HKLM\Software\Classes\BHO.iGraalBHO
SUPPRIME Key: HKLM\Software\Classes\BHO.iGraalBHO.1
SUPPRIME Key: HKLM\Software\Classes\Toolbar.iGraalToolbar
SUPPRIME Key: HKLM\Software\Classes\Toolbar.iGraalToolbar.1
SUPPRIME Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375
SUPPRIME Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5
SUPPRIME Key: HKLM\Software\Classes\Toolbar.CT2851639
SUPPRIME Key: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110011441179}
SUPPRIME Key: HKLM\Software\Classes\AppID\{F5BC53C9-AA01-4579-9927-EA50B636C820}
SUPPRIME Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{47B614AF-B4CC-485B-B331-BE26F02ED4CC}
SUPPRIME Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{47B614AF-B4CC-485B-B331-BE26F02ED4CC}
SUPPRIME Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011441179}
SUPPRIME Key: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011441179}
SUPPRIME Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CA0054A5AB3EFFE4CB5660E44A1E7DCC
SUPPRIME Key: Service: McComponentHostService

========== Valeur(s) du Registre ==========
SUPPRIME Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F}
SUPPRIME Toolbar: {D01B1F7D-9D7F-46C3-8DB9-5A55819E2A7F}
SUPPRIME RunValue: TkBellExe
SUPPRIME RunValue: RTHDCPL
SUPPRIME RunValue: QuickTime Task
SUPPRIME RunValue: iTunesHelper
SUPPRIME RunValue: Adobe Reader Speed Launcher
SUPPRIME RunValue: ctfmon.exe
ABSENT RunValue: ctfmon.exe
SUPPRIME RunValue: Akamai NetSession Interface
ABSENT RunValue: Akamai NetSession Interface
SUPPRIME RunValue: SystweakASP
ABSENT RunValue: SystweakASP
ABSENT TCPIP: NameServer
ABSENT [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:SystweakASP
SUPPRIME FirewallRaz (SP) : %windir%\Network Diagnostic\xpnetdiag.exe
SUPPRIME FirewallRaz (SP) : %windir%\system32\sessmgr.exe
SUPPRIME FirewallRaz (SP) : C:\Documents and Settings\paule\Mes documents\Téléchargements\Remote Mouse Server\RemoteMouse.exe
SUPPRIME FirewallRaz (SP) : C:\Documents and Settings\paule\Application Data\Spotify\spotify.exe
SUPPRIME FirewallRaz (SP) : D:\fscommand\CKSocketServer.exe
SUPPRIME FirewallRaz (SP) : C:\Documents and Settings\paule\Mes documents\photo , julie + chou\uTorrent.exe
SUPPRIME FirewallRaz (SP) : C:\Documents and Settings\paule\Mes documents\Téléchargements\microtorrent_torrent_3.1.3_build_26837_francais_18245.exe
SUPPRIME FirewallRaz (SP) : C:\Documents and Settings\paule\Local Settings\Application Data\Akamai
etsession_win.exe
SUPPRIME FirewallRaz (SP) : C:\Documents and Settings\paule\Mes documents\photo , julie + chou\EdenEternal-FR\_Launcher.exe
SUPPRIME FirewallRaz (DP) : %windir%\Network Diagnostic\xpnetdiag.exe
SUPPRIME FirewallRaz (DP) : %windir%\system32\sessmgr.exe
Aucune valeur présente dans la clé d'exception du registre (FirewallRaz)

========== Elément(s) de donnée du Registre ==========
SUPPRIME TCPIP: NameServer = 178.33.41.181,46.4.70.20

========== Dossier(s) ==========
Aucun dossiers CLSID Local utilisateur vide
SUPPRIME Temporaires Windows
SUPPRIME Flash Cookies

========== Fichier(s) ==========
ABSENT File: c:\documents and settings\paule\local settings\application data\akamai
etsession_win.exe
ABSENT File: c:\program filesegclean pro\systweakasp.exe
ABSENT File: c:\documents and settings\paule\mes documents\mes vidéos	éléchargements realplayer\igraal\button.dll
SUPPRIME File: c:\program files\mcafee security scan\3.0.318\mcchsvc.exe 
SUPPRIME Temporaires Windows
SUPPRIME Flash Cookies

========== Restauration Système ==========
Point de restauration du système créé avec succès


========== Récapitulatif ==========
21 : Clé(s) du Registre
27 : Valeur(s) du Registre
1 : Elément(s) de donnée du Registre
3 : Dossier(s)
6 : Fichier(s)
1 : Restauration Système


End of clean in 04mn 50s

========== Chemin de fichier rapport ==========
C:\ZHP\ZHPFix[R1].txt - 26/08/2013 22:20:57 [4950]

hub70 · Answer

est ce que je peux éteindre et redémarer?

hub70 · Answer

~ Rapport de ZHPDiag v2013.8.24.35 - Nicolas Coolman (24/08/2013) ~ Lancé par paule (26/08/2013 23:08:46) ~ Adresse du Site Web https://nicolascoolman.webs.com/ ~ Traduit par Nicolas Coolman ~ Etat de la version : Problème connexion internet ~ Liste blanche : Activée par le programme ~ Elévation des Privilèges : OK ~ User Account Control (UAC): Not Found ---\ Navigateurs Internet MSIE: Internet Explorer v8.0.6001.18702 MFIE: Mozilla Firefox 23.0.1 (Defaut) GCIE: Google Chrome v29.0.1547.57 ---\ Informations sur les produits Windows ~ Langage: Français Windows XP Home Edition Service Pack 3 (Build 2600) Windows Automatic Updates : OK Windows Genuine Advantage : KO ---\ Logiciels de protection du système Avira Free Antivirus v13.0.0.3885 Malwarebytes Anti-Malware version 1.75.0.1300 McAfee Security Scan Plus v3.0.318.3 ---\ Logiciels d'optimisation du système CCleaner v4.04 =>Piriform Ltd ---\ Logiciels de partage PeerToPeer µTorrent v3.2.0 =>P2P.µTorrent ---\ Surveillance de Logiciels Adobe Flash Player 11 Plugin Adobe Reader 9.5.5 - Français Java 7 Update 7 ---\ Informations sur le système ~ Processor: x86 Family 6 Model 28 Stepping 10, GenuineIntel ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 1013 MB (43% free) System Restore: Activé (Enable) System drive C: has 99 GB (71%) free of 139 GB ---\ Mode de connexion au système ~ Computer Name: CLAUDE ~ User Name: paule ~ All Users Names: SUPPORT_388945a0, paule, HelpAssistant, Administrateur, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\ Variables d'environnement ~ System Unit : C:\ ~ %AppData% : C:\Documents and Settings\paule\Application Data\ ~ %Desktop% : C:\Documents and Settings\paule\Bureau\ ~ %Favorites% : C:\Documents and Settings\paule\Favoris\ ~ %LocalAppData% : C:\Documents and Settings\paule\Local Settings\Application Data\ ~ %StartMenu% : C:\Documents and Settings\paule\Menu Démarrer\ ~ %Windir% : C:\WINDOWS\ ~ %System% : C:\WINDOWS\system32\ ---\ Enumération des unités disques C:\ Hard drive, Flash drive, Thumb drive (Free 99 Go of 139 Go) D:\ Floppy drive, Flash card reader, USB Key (Free 3 Go of 7 Go) ---\ Etat du Centre de Sécurité Windows ~ Security Center: 30 Legitimates Filtered in 00mn 00s ---\ Recherche particulière de fichiers génériques [MD5.F2317622D29F9FF0F88AEECD5F60F0DD] - (.Microsoft Corporation - Explorateur Windows.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\Explorer.exe [1037824] [MD5.E1948293F7CBC38987270432935D8D05] - (.Microsoft Corporation - Internet Extensions for Win32.) (.26/07/2013 - 03:47:15.) -- C:\WINDOWS\system32\wininet.dll [920064] [MD5.DD73D6B9F6B4CB630CF35B438B540174] - (.Microsoft Corporation - Application d'ouverture de session Windows NT.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Winlogon.exe [512000] [MD5.1E44BC1E83D8FD2305F8D452DB109CF9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.17/08/2011 - 14:49:54.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496] [MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.14/04/2008 - 00:40:32.) -- C:\WINDOWS\system32\Drivers\atapi.sys [96512] [MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744] [MD5.1F4260CC5B42272D71F79E570A27A4FE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [62976] [MD5.31F923EB2170FC172C81ABDA0045D18C] - (.Microsoft Corporation - Pilote de cryptographie FIPS.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Fips.sys [44672] [MD5.573C7D0A32852B48F3058CFD8026F511] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [144384] [MD5.A09BDC4ED10E3B2E0EC27BB94AF32516] - (.Microsoft Corporation - Pilote de port i8042.) (.14/04/2008 - 08:00:54.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [54144] [MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [42112] [MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [152832] [MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [75264] [MD5.7D304A5EB4344EBEEAB53A2FE3FFB9F0] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.15/07/2011 - 14:29:31.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [456320] [MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers etBT.sys [162816] [MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers tfs.sys [574976] [MD5.8FD0BDBEA875D06CCF6C945CA9ABAF75] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80384] [MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328] [MD5.15CABD0F7C00C47C70124907916AF3F1] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.14/04/2008 - 00:32:52.) -- C:\WINDOWS\system32\Drivers dpdr.sys [196224] [MD5.D8EB2A7904DB6C916EB5361878DDCBAE] - (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) (.13/04/2008 - 19:57:36.) -- C:\WINDOWS\system32\Drivers edbook.sys [58752] [MD5.46DE1126684369BACE4849E4FC8C43CA] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [53376] ~ Generic Processes: Scanned in 01mn 53s ---\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 2/1108 ~ Mes musiques (My Musics) : 1/30 ~ Mes Videos (My Videos) : 0/20 ~ Mes Favoris (My Favorites) : 1/18 ~ Mes Documents (My Documents) : 2/2477 ~ Mon Bureau (My Desktop) : 1/697 ~ Menu demarrer (Programs) : 1/25 ~ Hidden Files: Scanned in 04mn 04s ---\ Processus lancés au démarrage du système [MD5.0840ABBBDF438691EE65A20040635CBE] - (.Stardock Corporation - Dock Login Service.) -- C:\Program Files\Dell\DellDock\DockLogin.exe [155648] [PID.1268] [MD5.01FAE7E8176472FE359E86AB4FD039A9] - (...) -- C:\WINDOWS\System32\WLTRYSVC.exe [24576] [PID.1604] [MD5.C7F30BB20487765460865AEF466933EA] - (.Dell Inc. - Dell Wireless WLAN Card Wireless Network Co.) -- C:\WINDOWS\System32\bcmwltry.exe [2039808] [PID.1660] [MD5.99387251353598C939592FAF40DF8AA9] - (.Avira Operations GmbH & Co. KG - Avira Scheduler.) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024] [PID.1816] [MD5.8491FDA93507F2F27FFBA11372764086] - (.Avira Operations GmbH & Co. KG - Avira On-Access Service.) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088] [PID.1976] [MD5.4FE5C6D40664AE07BE5105874357D2ED] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe [57008] [PID.260] [MD5.4B797AFC90A29C59308E260DBCCD5821] - (.Dell - Dell Device Monitor Service.) -- C:\Program Files\Dell\MFP_DELL\deMntrService.exe [131072] [PID.604] [MD5.777115C9CC675BD98127660712D2F784] - (.SupportSoft, Inc. - SupportSoft Agent Service.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe [201968] [PID.852] [MD5.2E0B0A051FFAA86E358465BB0880D453] - (.Microsoft Corporation - Windows Update.) -- C:\WINDOWS\system32\wuauclt.exe [53784] [PID.1988] [MD5.4631FF0EE2964CCDC646AF807CB778F5] - (.Avira Operations GmbH & Co. KG - Avira System Tray Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144] [PID.2232] [MD5.59ED06CB3DDB7E0D2265D49A20F6367D] - (.Dell - WSED.) -- C:\Program Files\WSED\WSED.exe [247080] [PID.2276] [MD5.600541F460048CDEB6746E2F70FA04AF] - (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe [141336] [PID.2336] [MD5.98D486AF375F989DA5E9D60CE485643C] - (.Intel Corporation - igfxTray Module.) -- C:\WINDOWS\system32\igfxtray.exe [141336] [PID.2376] [MD5.17EFB293E5556DEE59D477CEA8C9A832] - (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe [173592] [PID.2384] [MD5.4C3139B8721BB560419A32D5EE327226] - (.Dell - Dell Device Status.) -- C:\Program Files\Dell\MFP_DELL\deDvcStatus.exe [286720] [PID.2396] [MD5.00D1FB0073B4A8BD2989EA8FF4CC792B] - (.SupportSoft, Inc. - Dell Support Center Updates.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe [206064] [PID.2436] [MD5.64559B49CC85ABD75571533CF37B4A6B] - (.Dell - Pas de description.) -- C:\Program Files\Battery Meter\BTMeter.exe [632176] [PID.2464] [MD5.1818A2CD223603911970E667A5EACC9C] - (.Dell Inc. - Dell Wireless WLAN Card Wireless Network Tr.) -- C:\WINDOWS\system32\WLTRAY.exe [2289664] [PID.2472] [MD5.5FF22206ED03493F6214E0501B69FBBD] - (.Intel Corporation - igfxsrvc Module.) -- C:\WINDOWS\system32\igfxsrvc.exe [250392] [PID.2596] [MD5.B141F8F8B0FF37FFC51F9B71EE7A641B] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe [19875432] [PID.2604] [MD5.E13EA4860E8F2AA845B53BFD2B6FEC5B] - (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe [1695232] [PID.2652] [MD5.BD713579A87D698E1F2158CE10E48130] - (.McAfee, Inc. - McAfee Security Scanner Scheduler.) -- C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe [272248] [PID.2888] [MD5.EE8E76761A4AEE5685D92A770A3B4B1F] - (.SupportSoft, Inc. - Dell Support Center.) -- C:\Program Files\Dell Support Center\gs_agent\dsc.exe [1025264] [PID.0] [MD5.68C105908A54D734D2B154DB546F562E] - (.Avira Operations GmbH & Co. KG - Avira Shadow Copy Service.) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe [76856] [PID.3368] [MD5.696EB1F22EC71262BB8188639DBEED3E] - (.Avira Operations GmbH & Co. KG - Avira WebGuard Service.) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.exe [589368] [PID.3580] [MD5.11821BB2822BFDF2C8654A157A829C2F] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7836672] [PID.1180] [MD5.49501C6BE752D5043ADA8667AC774F7A] - (.Microsoft Corporation - Windows User Mode Driver Manager.) -- C:\WINDOWS\system32\wdfmgr.exe [38912] [PID.1332] [MD5.5E9A6658A2A69AE7EB195113B7A2E7A9] - (.Microsoft Corporation - Application Layer Gateway Service.) -- C:\WINDOWS\System32\alg.exe [44544] [PID.420] ~ Processes Running: Scanned in 00mn 27s ---\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2) C:\Documents and Settings\paule\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences ~ Google Browser: 0 Legitimates Filtered in 00mn 00s ---\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) C:\Documents and Settings\paule\Application Data\Mozilla\Firefox\Profiles\ztnxs5ap.default-1354458410000\prefs.js ~ Firefox Browser: 28 Legitimates Filtered in 00mn 06s ---\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4) R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.amazon.fr/ ~ IE Browser: 10 Legitimates Filtered in 00mn 00s ---\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\WINDOWS\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl" ~ Keys: Scanned in 00mn 00s ---\ Hosts file redirection (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 00s ~ Nombre de lignes (Lines number): 20 ---\ Internet Explorer Toolbars (O3) O3 - Toolbar: Avira SearchFree Toolbar plus Web Protection - [HKLM]{41564952-412D-5637-00A7-7A786E7484D7} . (...) -- C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll =>Toolbar.Avira O3 - Toolbar\WebBrowser: (no name) - [HKCU]{01E04581-4EEE-11D0-BFE9-00AA005B4383} Clé orpheline O3 - Toolbar\WebBrowser: (no name) - [HKCU]{0E5CBF21-D15F-11D0-8301-00AA005B4383} Clé orpheline ~ Toolbar: Scanned in 00mn 00s ---\ Applications démarrées par registre & par dossier (O4) O4 - HKLM\..\Run: [avgnt] . (.Avira Operations GmbH & Co. KG - Avira System Tray Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe O4 - HKLM\..\Run: [WSED] . (.Dell - WSED.) -- C:\Program Files\WSED\WSED.exe O4 - HKLM\..\Run: [SynTPEnh] . (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (.not file.) O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [DeStatusMon] . (.Dell - Dell Device Status.) -- C:\Program Files\Dell\MFP_DELL\deDvcStatus.exe O4 - HKLM\..\Run: [dellsupportcenter] . (.SupportSoft, Inc. - Dell Support Center Updates.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe O4 - HKLM\..\Run: [CapsLKNotify] C:\Program Files\CapsLKNotify\CapsLKNotify.exe (.not file.) O4 - HKLM\..\Run: [BTMeter] . (.Dell - Pas de description.) -- C:\Program Files\Battery Meter\BTMeter.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] . (.Dell Inc. - Dell Wireless WLAN Card Wireless Network Tr.) -- C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe O4 - HKCU\..\Run: [uTorrent] C:\Documents and Settings\paule\Mes documents\photo , julie + chou\uTorrent.exe (.not file.) =>P2P.µTorrent O4 - HKCU\..\Run: [Spotify] C:\Documents and Settings\paule\Application Data\Spotify\Spotify.exe (.not file.) O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe O4 - HKCU\..\Run: [msnmsgr] C:\Program Files\Windows Live\Messenger\msnmsgr.exe (.not file.) O4 - HKCU\..\Run: [MSMSGS] . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Documents and Settings\paule\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [uTorrent] C:\Documents and Settings\paule\Mes documents\photo , julie + chou\uTorrent.exe (.not file.) =>P2P.µTorrent O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [Spotify] C:\Documents and Settings\paule\Application Data\Spotify\Spotify.exe (.not file.) O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [msnmsgr] C:\Program Files\Windows Live\Messenger\msnmsgr.exe (.not file.) O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [MSMSGS] . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Documents and Settings\paule\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe ~ Application: Scanned in 00mn 02s ---\ Autres liens utilisateurs (O4) O4 - GS\Programs: Adobe Download Assistant.lnk . (...) -- C:\Program Files\Adobe Download Assistant\Adobe Download Assistant.exe O4 - GS\Programs: Adobe Reader 9.lnk . (...) -- C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-A95000000001}\SC_Reader.ico O4 - GS\Programs: Audacity.lnk . (...) -- C:\Program Files\audacity\audacity.exe O4 - GS\Programs: Lanceur de tâches Microsoft Works.lnk . (.Microsoft® Corporation - Microsoft® Works.) -- C:\Program Files\Microsoft Works\MSWorks.exe O4 - GS\Programs: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O4 - GS\Programs: Paint.NET.lnk . (.dotPDN LLC - Paint.NET.) -- C:\Program Files\Paint.NET\PaintDotNet.exe O4 - GS\Programs: Visionneuse Microsoft Office PowerPoint 2007.lnk . (...) -- C:\WINDOWS\Installer\{95120000-00AF-040C-0000-0000000FF1CE}\ppvwicon.exe O4 - GS\Programs: Windows Search.lnk . (.Microsoft Corporation - Windows Search System Tray.) -- C:\Program Files\Windows Desktop Search\WindowsSearch.exe O4 - GS\Programs: Assistance à distance.LNK . (.Microsoft Corporation - Assistance à distance Microsoft.) -- C:\WINDOWS\system32 cimlby.exe O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Programs: Lecteur Windows Media.lnk . (.Microsoft Corporation - Lecteur Windows Media.) -- C:\Program Files\Windows Media Player\wmplayer.exe O4 - GS\Programs: Outlook Express.LNK . (.Microsoft Corporation - Outlook Express.) -- C:\Program Files\Outlook Express\msimn.exe ~ Global Startup: Scanned in 00mn 02s ---\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\OFFICE11\REFBARH.ICO O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -- Clé orpheline O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe ~ IE Extra Buttons: Scanned in 00mn 00s ---\ Objets ActiveX (Downloaded Program Files)(O16) O16 - DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} ((no name)) - http://support.euro.dell.com/systemprofiler/DellSystemLite.CAB ~ Objets ActiveX: Scanned in 00mn 00s ---\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{47A75EC0-95D4-4BF9-97D7-015513A6E793}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{47A75EC0-95D4-4BF9-97D7-015513A6E793}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CS3\Services\Tcpip\..\{47A75EC0-95D4-4BF9-97D7-015513A6E793}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1 ~ Domain: Scanned in 00mn 00s ---\ Titr_HJT34=Protocole additionnel (O18) O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} . (.Microsoft Corporation - WIA Scripting Layer.) -- C:\WINDOWS\system32\wiascr.dll O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.dll ~ Protocole Additionnel: Scanned in 00mn 00s ---\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dll O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dll O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agent réseau hors connexion.) -- C:\WINDOWS\system32\cscdll.dll O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\system32\dimsntfy.dll O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\WINDOWS\system32\igfxdev.dll O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL secondaire de notification de service d.) -- C:\WINDOWS\system32\sclgntfy.dll O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\WlNotify.dll O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll ~ Winlogon: Scanned in 00mn 00s ---\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: Service Google Update (gupdate) (gupdate) . (.Google Inc. - Programme d'installation de Google.) - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: SupportSoft Sprocket Service (DellSuppor (sprtsvc_DellSupportCenter) . (.SupportSoft, Inc. - SupportSoft Agent Service.) - C:\Program Files\Dell Support Center\bin\sprtsvc.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) . (...) - C:\WINDOWS\system32\WLTRYSVC.exe ~ Services: 11 Legitimates Filtered in 00mn 14s ---\ Enumération Active Desktop & MHTML Editor (O24) O24 - Desktop General: BackupWallPaper - .(...) - C:\Documents and Settings\paule\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop General: WallPaper - .(...) - C:\Documents and Settings\paule\Local Settings\Application Data\Microsoft\Wallpaper1.bmp ~ Desktop Component: 4 Legitimates Filtered in 00mn 04s ---\ Pilotes lancés au démarrage du système (O41) O41 - Driver: (appdrv01) . (.Protection Technology - Application Driver (01).) - C:\WINDOWS\system32\Drivers\appdrv01.sys ~ Drivers: 75 Legitimates Filtered in 00mn 14s ---\ Logiciels installés (O42) O42 - Logiciel: Jauge de batterie - (...) [HKLM] -- InstallShield_{543A4F31-9590-416A-A621-42CEB4C6A694} ~ Logic: 102 Legitimates Filtered in 00mn 02s ---\ HKCU & HKLM Software Keys [HKCU\Software\IncrediMail] [HKCU\Software\KeepVid] [HKLM\Software\54c] [HKLM\Software\Chaumet] [HKLM\Software\Function Keys] [HKLM\Software\IncrediMail] [HKLM\Software\SEJER] [HKLM\Software\WSED] ~ Key Software: 207 Legitimates Filtered in 00mn 02s ---\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 09/02/2010 - 08:43:02 - [0,603] ----D C:\Program Files\Battery Meter O43 - CFD: 09/02/2010 - 08:43:43 - [0,384] ----D C:\Program Files\Function Keys O43 - CFD: 09/02/2010 - 08:44:02 - [0,236] ----D C:\Program Files\WSED O43 - CFD: 09/02/2010 - 08:43:17 - [0,887] ----D C:\Documents and Settings\All Users\Application Data\Win732 O43 - CFD: 09/02/2010 - 08:43:17 - [1,427] ----D C:\Documents and Settings\All Users\Application Data\Win764 O43 - CFD: 09/02/2010 - 08:44:43 - [1,468] ----D C:\Documents and Settings\All Users\Application Data\XP32 O43 - CFD: 30/05/2010 - 18:10:19 - [0,045] ----D C:\Documents and Settings\paule\Application Data\cald2 O43 - CFD: 31/10/2012 - 17:50:41 - [0] ----D C:\Documents and Settings\paule\Application Data\ul_data O43 - CFD: 09/02/2010 - 08:43:44 - [0,001] ----D C:\Documents and Settings\paule\Menu Démarrer\Programmes\Touches de fonction ~ Program Folder: 183 Legitimates Filtered in 06mn 19s ---\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.9EEFE3432E1447D05932977044C4C155] - 26/08/2013 - 22:06:31 ---A- . (...) -- C:\WINDOWS\wiadebug.log [159] O44 - LFC:[MD5.67C4AEA3A6420B40E7C8A0E63D288C02] - 26/08/2013 - 22:06:26 ---A- . (...) -- C:\WINDOWS\wiaservc.log [50] O44 - LFC:[MD5.26E14737C09E32CD46D970D8A2E20256] - 26/08/2013 - 20:06:34 ---A- . (...) -- C:\log.txt [1060953] O44 - LFC:[MD5.C9DD76D0EF94637C77FF8CA5E0FB0684] - 26/08/2013 - 08:22:54 ---A- . (...) -- C:\WINDOWS\system.ini [227] O44 - LFC:[MD5.4D1E56E34C0D19EC9CBD2A471E3548C4] - 26/08/2013 - 08:22:54 ---A- . (...) -- C:\WINDOWS\win.ini [573] O44 - LFC:[MD5.42EE400EAB8844B324EA04A26F91226C] - 25/08/2013 - 18:36:34 ---A- . (...) -- C:\WINDOWS\system32\ASOROSet.bin [2404] O44 - LFC:[MD5.B769F31F15544A455FA5A9DE4CB82829] - 25/08/2013 - 09:18:38 ---A- . (...) -- C:\WINDOWS\system32\mfc45.dat [74703] O44 - LFC:[MD5.2015783A18E1BE8D938298FACDB08D99] - 25/08/2013 - 09:04:01 ---A- . (...) -- C:\NTUser.dat [262144] O44 - LFC:[MD5.B0D063401D5128A2F4FC1AE12F62B0FF] - 25/08/2013 - 09:04:01 --HA- . (...) -- C:\NTUser.dat.LOG [1024] O44 - LFC:[MD5.22BA49C48A12D0EA923D042CD63BF3BF] - 24/08/2013 - 20:48:21 ---A- . (.Protection Technology - Application Driver (01).) -- C:\WINDOWS\system32\Drivers\appdrv01.sys [2256768] O44 - LFC:[MD5.C14D443940AAA5CC189F423FAC24ED41] - 24/08/2013 - 20:48:21 ---A- . (.Protection Technology - Application Driver Auto Removal Service (01.) -- C:\WINDOWS\system32\appdrvrem01.exe [318632] O44 - LFC:[MD5.65C50D03574D72C7E1860850C8933BEB] - 15/08/2013 - 02:11:27 ---A- . (...) -- C:\WINDOWS\system32\TZLog.log [59646] ~ Files: 32 Legitimates Filtered in 12mn 28s ---\ Opérations et fonctions au démarrage de Windows Explorer (O46) O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll O46 - SEH:ShellExecuteHooks - Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll ~ ShellExecuteHooks: Scanned in 00mn 00s ---\ Image File Execution Options (IFEO) (O50) O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d ~ IFEO: Scanned in 00mn 00s ---\ Clé de registre Shell MountPoints2 (MPKS) (O51) O51 - MPSK:{b5b2e667-6af0-11df-b685-e5b09bd654b7}\AutoRun\command. (...) -- E:\LaunchU3.exe (.not file.) ~ Keys: Scanned in 00mn 00s ---\ Liste des pilotes du système (SDL) (O58) O58 - SDL:[MD5.F6AF59D6EEE5E1C304F7F73706AD11D8] - 17/11/2009 - 17:40:42 ---A- . (.Creative - Creative WDM 3D Audio Driver.) -- C:\WINDOWS\system32\Drivers\Ambfilt.sys [1684736] O58 - SDL:[MD5.6D3ADA4CE95CECA7BCE527A08C4C474E] - 14/04/2008 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ansi.sys [9037] ~ Drivers: 5 Legitimates Filtered in 00mn 01s ---\ Liste des outils de désinfection (LATC) (O63) O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 ~ ADS: Scanned in 00mn 00s ---\ Liste les services legacy du registre (LALS) (O64) O64 - Services: CurCS - 20/11/2011 - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe LM Service) .(.Adobe Systems - System Level Service Utility.) - LEGACY_ADOBE_LM_SERVICE O64 - Services: CurCS - 09/06/2009 - C:\Program Files\Dell\DellDock\DockLogin.exe (DockLoginService) .(.Stardock Corporation - Dock Login Service.) - LEGACY_DOCKLOGINSERVICE ~ Legacy: 192 Legitimates Filtered in 00mn 12s ---\ Menu de démarrage Internet (SMI) (O68) O68 - StartMenuInternet: <>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\ Recherche d'infection sur les navigateurs internet (SBI) (O69) O69 - SBI: SearchScopes [HKCU] 419CACB854694A8AA9405A250F77380E - (uTorrentBar_FR Customized Web Search) - http://search.conduit.com =>P2P.µTorrent O69 - SBI: SearchScopes [HKCU] {79B2CD94-5655-8129-42C5-4F150E4A6A48} - (Google) - https://www.google.com/?gws_rd=ssl O69 - SBI: SearchScopes [HKCU] {7CB4DA7B-F6CF-452B-855D-88F37C12FB74} - (Google) - https://www.google.com/?gws_rd=ssl O69 - SBI: SearchScopes [HKCU] {B3B3A6AC-74EC-BD56-BCDB-EFA4799FB9DF} - (Amazon) - http://www.amazon.frhTerms} O69 - SBI: SearchScopes [HKCU] {EEE46F33-1B64-40F1-A0E7-E19DDBA245D3} - (Google) - https://www.google.com/?gws_rd=ssl ~ Keys: Scanned in 00mn 00s ---\ Recherche particulière à la racine du système (SPRF) (O84) [MD5.D81AC8D32D3609176D96D669D1777035] [SPRF][30/04/2008] (...) -- C:\Documents and Settings\paule\Local Settings\Application Data\fusioncache.dat [135] [MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][28/05/2010] (...) -- C:\Documents and Settings\paule\Application Data\wklnhst.dat [0] ~ Files: 2 Legitimates Filtered in 00mn 01s ---\ Enumère les codes produits des logiciels (PUC) (O90) O90 - PUC: "13F4A3450959A6146A1224EC4B6C6A49" . (.Battery Meter.) -- C:\WINDOWS\Installer\{543A4F31-9590-416A-A621-42CEB4C6A694}\ARPPRODUCTICON.exe O90 - PUC: "25946514D2147365007A7A857BC02020" . (.Avira SearchFree Toolbar plus Web Protection.) -- C:\WINDOWS\Installer\{41564952-412D-5637-00A7-A758B70C0202}\ToolbarIcon.exe =>Toolbar.Avira O90 - PUC: "3D15E350D588C5245968AE15384C6C88" . (.Function Keys.) -- C:\WINDOWS\Installer\{053E51D3-885D-425C-9586-EA5183C4C688}\ARPPRODUCTICON.exe O90 - PUC: "6216BC6E021D5BF4D9B12E1E09306EC6" . (.WSED.) -- C:\WINDOWS\Installer\{E6CB6126-D120-4FB5-9D1B-E2E19003E66C}\ARPPRODUCTICON.exe ~ Update Products: 58 Legitimates Filtered in 00mn 00s ---\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS) [MD5.993F9C3B4FF62AD7DDFA2DCF3C9E52D7] [WIS][25/08/2013] (.Ask Partner Network - Avira SearchFree Toolbar plus Web Protection.) -- C:\Windows\Installer\10c27c.msi [755200] =>Toolbar.Avira [MD5.3BFF707630742282B54AC0509CE3063B] [WIS][23/03/2011] (.Olivetti Enginering - Dell Photo AIO 928.) -- C:\Windows\Installer\7d9bb8.msi [2080768] [MD5.9E0AD3E31DAB3438A2C02E638574C546] [WIS][23/03/2011] (.Olivetti Engineering - .) -- C:\Windows\Installer\7d9bbf.msi [4174336] [MD5.F93A65FBEF40515319C1F648E37AB6B2] [WIS][09/02/2010] (.COMPAL - EMSC-Common-Driver.) -- C:\Windows\Installer\81a4a.msi [884224] [MD5.7EDFA03387F061E5805A0ABF1CD74F9D] [WIS][18/09/2012] (.roddy2000@hotbox.ru - DVD Decoder Pak for Windows XP.) -- C:\Windows\Installer\b4bb6a3.msi [220160] ~ WIS: 61 Legitimates Filtered in 02mn 31s ---\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Demand 20/11/2011 72704 | (Adobe LM Service) . (.Adobe Systems.) - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe SS - | Demand 20/08/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe SR - | Auto 25/08/2013 84024 | (AntiVirSchedulerService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\sched.exe SR - | Auto 25/08/2013 108088 | (AntiVirService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\avguard.exe SR - | Auto 25/08/2013 589368 | (AntiVirWebService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.exe SS - | Auto 24/08/2013 318632 | (appdrvrem01) . (.Protection Technology.) - C:\WINDOWS\system32\appdrvrem01.exe SR - | Auto 21/12/2012 57008 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe SR - | Auto 28/06/2007 131072 | (deMntrService) . (.Dell.) - C:\Program Files\Dell\MFP_DELL\deMntrService.exe SS - | Demand 14/04/2008 225280 | (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\system32\dmadmin.exe SR - | Auto 09/06/2009 155648 | (DockLoginService) . (.Stardock Corporation.) - C:\Program Files\Dell\DellDock\DockLogin.exe SS - | Auto 27/11/2011 136176 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 27/11/2011 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 03/04/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe SS - | Demand 16/08/2013 553288 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe SS - | Demand 17/08/2013 117656 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe SS - | Auto 21/06/2013 162408 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe SR - | Auto 03/06/2009 201968 | (sprtsvc_DellSupportCenter) . (.SupportSoft, Inc..) - C:\Program Files\Dell Support Center\bin\sprtsvc.exe SR - | Auto 07/01/2009 24576 | (wltrysvc) . (...) - C:\WINDOWS\system32\WLTRYSVC.exe ~ Services: Scanned in 02mn 34s ---\ Scan Additionnel (O88) Database Version : v2.12865 - (24/08/2013) Clés trouvées (Keys found) : 1 Valeurs trouvées (Values found) : 1 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 3 [HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011441179}] =>PUP.CrossRider [HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{41564952-412D-5637-00A7-7A786E7484D7} =>Toolbar.Avira^ C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll =>Toolbar.Avira^ C:\WINDOWS\Installer\{41564952-412D-5637-00A7-A758B70C0202}\ToolbarIcon.exe =>Toolbar.Avira^ C:\Windows\Installer\10c27c.msi =>Toolbar.Avira^ ~ Additionnel Scan: 253822 Items scanned in 00mn 54s ---\ Récapitulatif des détections trouvées sur votre station ~ http://nicolascoolman.webs.com28419247-toolbar-avira =>Toolbar.Avira ~ http://nicolascoolman.webs.com27583526-pup-crossrider =>PUP.CrossRider ~ MSI: 2 link(s) detected in 00mn 54s ~ 1009 Legitimates filtered by white list End of the scan (492 lines in 31mn 04s)(0)

hub70 · Answer

bonjours,
démarrage on va dire correct  lancement de word très lent pour le premier lancement car vider la liste de démarrage.lancement de Firefox plutôt lent mais il faut dire que je suis en adsl étendu 512 
pourquoi au démarage avira me donne un message que je n'ai pas de protection web  et j'ai un autre message qui me dit que je  n'ai pas de par feux donc je suis obliger de l'activer chaque fois 
au démarrage j'ai souvent le message comme quoi Firefox ne répond pas je ne sais pas si c'est lier à la connexion ?
pourquoi quand je vais sur ce site CCM je suis déjà connecté alors que j'ai étain l'ordi
merci

hub70 · Answer

bonsoir,
j'ai fait ce qu'il fallait pour macfee
la je vais faire la suite mais la mise ne route de Firefox est très très lente 
je pensais que ça allais mais pour l'instant c'est de pire en pire.
même ouvert il plante, taper un mot dans une barre de recherche prend une plombe
j'utilise un autre ordi pour répondre

hub70 · Answer

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.4 (08.22.2013:1)
OS: Microsoft Windows XP x86
Ran by paule on 27/08/2013 at 20:42:59,25
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted [Registry Value] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\bProtectTabs



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110011441179}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110011441179}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011441179}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{EEE46F33-1B64-40F1-A0E7-E19DDBA245D3}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{7CB4DA7B-F6CF-452B-855D-88F37C12FB74}



~~~ Files

Successfully deleted [File] C:\Documents and Settings\All Users\Microsoft\DRM\LOG2.tmp [TDL4 Trace]
Successfully deleted [File] C:\Documents and Settings\All Users\Microsoft\DRM\LOGA.tmp [TDL4 Trace]



~~~ Folders

Successfully deleted: [Folder] "C:\WINDOWS\system32\ai_recyclebin"



~~~ FireFox

Successfully deleted: [File] C:\user.js
Successfully deleted: [File] C:\Documents and Settings\paule\Application Data\mozilla\firefox\profiles\ztnxs5ap.default-1354458410000\extensions	oolbar_avira-v7@apn.ask.com.xpi
Emptied folder: C:\Documents and Settings\paule\Application Data\mozilla\firefox\profiles\ztnxs5ap.default-1354458410000\minidumps [5 files]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27/08/2013 at 21:23:35,70
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

hub70 · Answer

voici le rapport de usbfix

############################## | UsbFix V 7.133 | [Suppression]

Utilisateur: paule (Administrateur) # CLAUDE
Mis à jour le 27/08/2013 par El Desaparecido
Lancé à 21:43:44 | 27/08/2013

Site Web: https://www.sosvirus.net/
Upload Malware: http://sosvirus.net/viewtopic.php?f=6&t=489
Contact: eldesaparecido@sosvirus.net

PC: Dell Inc. (Inspiron 1012) (X86-based PC)
CPU:          Intel(R) Atom(TM) CPU N450   @ 1.66GHz (1662)
RAM -> [Total : 1013 | Free : 461]
BIOS: Ver 1.00PARTTBL
BOOT: Normal boot

OS: Microsoft Windows XP Édition familiale (5.1.2600 32-Bit) # Service Pack 3
WB: Windows Internet Explorer 8.0.6001.18702

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 139 Go (99 Go libre(s) - 71%) [OS] # NTFS
D:\ -> Disque fixe # 15 Go (3 Go libre(s) - 19%) [AFPA] # FAT32
E:\ -> Disque fixe # 98 Go (48 Go libre(s) - 49%) [ARCHIVE] # NTFS
F:\ -> Disque fixe # 121 Go (53 Go libre(s) - 44%) [PERSO] # NTFS
G:\ -> Disque amovible # 7 Go (3 Go libre(s) - 44%) [PELCY] # FAT32

################## | El Desaparecido Section |

HKLM\SOFTWARE | Run : [avgnt] - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM\SOFTWARE | Run : [WSED] - C:\Program Files\WSED\WSED.exe
HKLM\SOFTWARE | Run : [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
HKLM\SOFTWARE | Run : [Persistence] - C:\WINDOWS\system32\igfxpers.exe
HKLM\SOFTWARE | Run : [IgfxTray] - C:\WINDOWS\system32\igfxtray.exe
HKLM\SOFTWARE | Run : [HotKeysCmds] - C:\WINDOWS\system32\hkcmd.exe
HKLM\SOFTWARE | Run : [DeStatusMon] - "C:\Program Files\Dell\MFP_DELL\deDvcStatus.exe" dvcStatusMinimize
HKLM\SOFTWARE | Run : [dellsupportcenter] - "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
HKLM\SOFTWARE | Run : [CapsLKNotify] - C:\Program Files\CapsLKNotify\CapsLKNotify.exe
HKLM\SOFTWARE | Run : [BTMeter] - C:\Program Files\Battery Meter\BTMeter.exe
HKLM\SOFTWARE | Run : [Broadcom Wireless Manager UI] - C:\WINDOWS\system32\WLTRAY.exe
HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe"
HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE | RunOnce : [] - 
HKU\S-1-5-21-2661660657-132674061-1654209337-1006\SOFTWARE | Run : [uTorrent] - "C:\Documents and Settings\paule\Mes documents\photo , julie + chou\uTorrent.exe"  /MINIMIZED
HKU\S-1-5-21-2661660657-132674061-1654209337-1006\SOFTWARE | Run : [Spotify] - "C:\Documents and Settings\paule\Application Data\Spotify\Spotify.exe" /uri spotify:autostart
HKU\S-1-5-21-2661660657-132674061-1654209337-1006\SOFTWARE | Run : [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
HKU\S-1-5-21-2661660657-132674061-1654209337-1006\SOFTWARE | Run : [msnmsgr] - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
HKU\S-1-5-21-2661660657-132674061-1654209337-1006\SOFTWARE | Run : [MSMSGS] - "C:\Program Files\Messenger\msmsgs.exe" /background
HKU\S-1-5-21-2661660657-132674061-1654209337-1006\SOFTWARE | Run : [Facebook Update] - "C:\Documents and Settings\paule\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
HKU\S-1-5-21-2661660657-132674061-1654209337-1006\SOFTWARE | Run : [ctfmon.exe] - C:\WINDOWS\system32\ctfmon.exe

################## | Processus Stoppés |

Stoppé! C:\Program Files\Dell\DellDock\DockLogin.exe (1268)
Stoppé! C:\WINDOWS\System32\WLTRYSVC.EXE (1604)
Stoppé! C:\WINDOWS\System32\bcmwltry.exe (1652)
Stoppé! C:\WINDOWS\system32\spoolsv.exe (1720)
Stoppé! C:\Program Files\Avira\AntiVir Desktop\sched.exe (1812)
Stoppé! C:\Program Files\Avira\AntiVir Desktop\avguard.exe (180)
Stoppé! C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe (220)
Stoppé! C:\Program Files\Dell\MFP_DELL\deMntrService.exe (532)
Stoppé! C:\Program Files\Dell Support Center\bin\sprtsvc.exe (1056)
Stoppé! C:\WINDOWS\system32\SearchIndexer.exe (1484)
Stoppé! C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (2340)
Stoppé! C:\Program Files\WSED\WSED.exe (2360)
Stoppé! C:\WINDOWS\system32\igfxpers.exe (2448)
Stoppé! C:\WINDOWS\system32\igfxsrvc.exe (2472)
Stoppé! C:\WINDOWS\system32\igfxtray.exe (2480)
Stoppé! C:\WINDOWS\system32\hkcmd.exe (2532)
Stoppé! C:\Program Files\Dell\MFP_DELL\deDvcStatus.exe (2540)
Stoppé! C:\Program Files\Dell Support Center\bin\sprtcmd.exe (2580)
Stoppé! C:\Program Files\Battery Meter\BTMeter.exe (2588)
Stoppé! C:\WINDOWS\system32\WLTRAY.exe (2604)
Stoppé! C:\Program Files\Skype\Phone\Skype.exe (2832)
Stoppé! C:\Program Files\Messenger\msmsgs.exe (2876)
Stoppé! C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe (2924)
Stoppé! C:\Program Files\Windows Desktop Search\WindowsSearch.exe (2964)
Stoppé! C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (3768)
Stoppé! C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE (3792)
Stoppé! C:\WINDOWS\system32\ctfmon.exe (3372)
Stoppé! C:\WINDOWS\system32\wuauclt.exe (3132)
Stoppé! C:\Program Files\Mozilla Firefox\firefox.exe (1644)

################## | Éléments infectieux |


(!) Fichiers temporaires supprimés.

################## | Registre |

Supprimé! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr

################## | Mountpoints2 |

Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{b5b2e667-6af0-11df-b685-e5b09bd654b7}

################## | Listing |

[01/06/2010 - 19:35:20 | D ] 	C:\612272dcbad84dc7f453
[25/08/2013 - 22:09:13 | D ] 	C:\AdwCleaner
[23/03/2011 - 21:50:45 | N | 916748] 	C:\aio928drv.log
[23/03/2011 - 21:51:07 | N | 754132] 	C:\aio928tb.log
[30/04/2008 - 01:03:11 | N | 0] 	C:\AUTOEXEC.BAT
[26/08/2013 - 09:22:54 | N | 216] 	C:\boot.ini
[14/04/2008 - 14:00:00 | N | 4952] 	C:\Bootfont.bin
[23/07/2013 - 10:56:17 | N | 45001] 	C:\BROM_DLL.log
[26/08/2013 - 09:00:13 | D ] 	C:\Config.Msi
[30/04/2008 - 01:03:11 | N | 0] 	C:\CONFIG.SYS
[22/04/2013 - 07:32:25 | N | 0] 	C:\cookies.sqlite
[23/03/2011 - 21:46:26 | D ] 	C:\dell
[09/02/2010 - 10:23:13 | N | 5387] 	C:\dell.sdr
[28/05/2010 - 19:44:50 | D ] 	C:\Documents and Settings
[09/02/2010 - 14:25:43 | D ] 	C:\drivers
[27/08/2013 - 19:45:59 | ASH | 1062580224] 	C:\hiberfil.sys
[09/02/2010 - 10:17:11 | D ] 	C:\I386
[09/02/2010 - 08:47:14 | D ] 	C:\Intel
[30/04/2008 - 01:03:11 | N | 0] 	C:\IO.SYS
[27/08/2013 - 15:43:27 | N | 1062381] 	C:\log.txt
[19/04/2012 - 21:47:27 | N | 478] 	C:\LOG15C.log
[19/04/2012 - 21:47:27 | N | 0] 	C:\LOG15C.tmp
[12/05/2012 - 20:06:01 | N | 478] 	C:\LOG170.log
[12/05/2012 - 20:06:01 | N | 0] 	C:\LOG170.tmp
[26/02/2011 - 10:54:25 | N | 478] 	C:\LOG2.log
[18/05/2012 - 13:08:00 | N | 478] 	C:\LOG2AA.log
[18/05/2012 - 13:08:00 | N | 0] 	C:\LOG2AA.tmp
[29/05/2010 - 10:59:41 | N | 478] 	C:\LOG653.log
[29/05/2010 - 10:59:41 | N | 0] 	C:\LOG653.tmp
[14/05/2012 - 08:06:02 | N | 478] 	C:\LOGA.log
[17/04/2012 - 06:45:09 | N | 478] 	C:\LOGA5.log
[17/04/2012 - 06:45:09 | N | 0] 	C:\LOGA5.tmp
[08/05/2012 - 20:14:10 | N | 478] 	C:\LOGE0.log
[08/05/2012 - 20:14:10 | N | 0] 	C:\LOGE0.tmp
[30/04/2008 - 01:03:11 | N | 0] 	C:\MSDOS.SYS
[30/05/2010 - 20:57:59 | RHD ] 	C:\MSOCache
[28/08/2010 - 10:36:39 | D ] 	C:\Nathan
[14/04/2008 - 14:00:00 | N | 47564] 	C:\NTDETECT.COM
[14/04/2008 - 14:00:00 | N | 252240] 	C:
tldr
[25/08/2013 - 10:04:01 | N | 262144] 	C:\NTUser.dat
[25/08/2013 - 10:04:01 | N | 1024] 	C:\NTUser.dat.LOG
[27/08/2013 - 19:45:58 | ASH | 1598029824] 	C:\pagefile.sys
[27/08/2013 - 19:43:06 | D ] 	C:\Program Files
[18/06/2012 - 20:07:57 | D ] 	C:\ProgramData
[02/01/2013 - 12:53:49 | D ] 	C:\PRONOTE Réseau 2011
[02/01/2013 - 12:47:35 | D ] 	C:\PRONOTE Réseau 2012
[29/05/2010 - 10:53:22 | SHD ] 	C:\RECYCLER
[05/02/2011 - 09:04:34 | D ] 	C:\Remote Mouse Server
[03/11/2012 - 12:10:37 | SHD ] 	C:\System Volume Information
[27/08/2013 - 21:47:07 | D ] 	C:\UsbFix
[27/08/2013 - 21:48:16 | A | 8036] 	C:\UsbFix [Clean 1] CLAUDE.txt
[27/08/2013 - 20:37:01 | D ] 	C:\WINDOWS
[26/08/2013 - 23:14:55 | D ] 	C:\ZHP

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | E.O.F | https://www.sosvirus.net/ |

hub70 · Answer

rapport de zhpdiag ~ Rapport de ZHPDiag v2013.8.26.36 - Nicolas Coolman (26/08/2013) ~ Lancé par paule (27/08/2013 22:08:50) ~ Adresse du Site Web https://nicolascoolman.webs.com/ ~ Traduit par Nicolas Coolman ~ Etat de la version : Version à jour. ~ Liste blanche : Activée par le programme ~ Elévation des Privilèges : OK ~ User Account Control (UAC): Not Found ---\ Navigateurs Internet MSIE: Internet Explorer v8.0.6001.18702 MFIE: Mozilla Firefox 23.0.1 (Defaut) GCIE: Google Chrome v29.0.1547.57 ---\ Informations sur les produits Windows ~ Langage: Français Windows XP Home Edition Service Pack 3 (Build 2600) Windows Automatic Updates : OK Windows Genuine Advantage : KO ---\ Logiciels de protection du système Avira Free Antivirus v13.0.0.3885 Malwarebytes Anti-Malware version 1.75.0.1300 ---\ Logiciels d'optimisation du système CCleaner v4.04 =>Piriform Ltd ---\ Logiciels de partage PeerToPeer µTorrent v3.2.0 =>P2P.µTorrent ---\ Surveillance de Logiciels Adobe Flash Player 11 Plugin Adobe Reader 9.5.5 - Français Java 7 Update 7 ---\ Informations sur le système ~ Processor: x86 Family 6 Model 28 Stepping 10, GenuineIntel ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 1013 MB (52% free) System Restore: Activé (Enable) System drive C: has 99 GB (71%) free of 139 GB ---\ Mode de connexion au système ~ Computer Name: CLAUDE ~ User Name: paule ~ All Users Names: SUPPORT_388945a0, paule, HelpAssistant, Administrateur, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\ Variables d'environnement ~ System Unit : C:\ ~ %AppData% : C:\Documents and Settings\paule\Application Data\ ~ %Desktop% : C:\Documents and Settings\paule\Bureau\ ~ %Favorites% : C:\Documents and Settings\paule\Favoris\ ~ %LocalAppData% : C:\Documents and Settings\paule\Local Settings\Application Data\ ~ %StartMenu% : C:\Documents and Settings\paule\Menu Démarrer\ ~ %Windir% : C:\WINDOWS\ ~ %System% : C:\WINDOWS\system32\ ---\ Enumération des unités disques C:\ Hard drive, Flash drive, Thumb drive (Free 99 Go of 139 Go) ---\ Etat du Centre de Sécurité Windows ~ Security Center: 33 Legitimates Filtered in 00mn 00s ---\ Recherche particulière de fichiers génériques [MD5.F2317622D29F9FF0F88AEECD5F60F0DD] - (.Microsoft Corporation - Explorateur Windows.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\Explorer.exe [1037824] [MD5.E1948293F7CBC38987270432935D8D05] - (.Microsoft Corporation - Internet Extensions for Win32.) (.26/07/2013 - 03:47:15.) -- C:\WINDOWS\system32\wininet.dll [920064] [MD5.DD73D6B9F6B4CB630CF35B438B540174] - (.Microsoft Corporation - Application d'ouverture de session Windows NT.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Winlogon.exe [512000] [MD5.1E44BC1E83D8FD2305F8D452DB109CF9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.17/08/2011 - 14:49:54.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496] [MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.14/04/2008 - 00:40:32.) -- C:\WINDOWS\system32\Drivers\atapi.sys [96512] [MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744] [MD5.1F4260CC5B42272D71F79E570A27A4FE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [62976] [MD5.31F923EB2170FC172C81ABDA0045D18C] - (.Microsoft Corporation - Pilote de cryptographie FIPS.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Fips.sys [44672] [MD5.573C7D0A32852B48F3058CFD8026F511] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [144384] [MD5.A09BDC4ED10E3B2E0EC27BB94AF32516] - (.Microsoft Corporation - Pilote de port i8042.) (.14/04/2008 - 08:00:54.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [54144] [MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [42112] [MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [152832] [MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [75264] [MD5.7D304A5EB4344EBEEAB53A2FE3FFB9F0] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.15/07/2011 - 14:29:31.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [456320] [MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers etBT.sys [162816] [MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers tfs.sys [574976] [MD5.8FD0BDBEA875D06CCF6C945CA9ABAF75] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80384] [MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328] [MD5.15CABD0F7C00C47C70124907916AF3F1] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.14/04/2008 - 00:32:52.) -- C:\WINDOWS\system32\Drivers dpdr.sys [196224] [MD5.D8EB2A7904DB6C916EB5361878DDCBAE] - (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) (.13/04/2008 - 19:57:36.) -- C:\WINDOWS\system32\Drivers edbook.sys [58752] [MD5.46DE1126684369BACE4849E4FC8C43CA] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [53376] ~ Generic Processes: Scanned in 00mn 01s ---\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 2/1108 ~ Mes musiques (My Musics) : 1/30 ~ Mes Videos (My Videos) : 0/20 ~ Mes Favoris (My Favorites) : 1/18 ~ Mes Documents (My Documents) : 2/2481 ~ Mon Bureau (My Desktop) : 1/698 ~ Menu demarrer (Programs) : 1/25 ~ Hidden Files: Scanned in 00mn 03s ---\ Processus lancés au démarrage du système [MD5.99387251353598C939592FAF40DF8AA9] - (.Avira Operations GmbH & Co. KG - Avira Scheduler.) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024] [PID.1812] [MD5.8491FDA93507F2F27FFBA11372764086] - (.Avira Operations GmbH & Co. KG - Avira On-Access Service.) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088] [PID.180] [MD5.4631FF0EE2964CCDC646AF807CB778F5] - (.Avira Operations GmbH & Co. KG - Avira System Tray Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144] [PID.2340] [MD5.68C105908A54D734D2B154DB546F562E] - (.Avira Operations GmbH & Co. KG - Avira Shadow Copy Service.) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe [76856] [PID.3768] [MD5.696EB1F22EC71262BB8188639DBEED3E] - (.Avira Operations GmbH & Co. KG - Avira WebGuard Service.) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.exe [589368] [PID.3792] [MD5.4FE5C6D40664AE07BE5105874357D2ED] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe [57008] [PID.1224] [MD5.2E0B0A051FFAA86E358465BB0880D453] - (.Microsoft Corporation - Windows Update.) -- C:\WINDOWS\system32\wuauclt.exe [53784] [PID.2324] [MD5.B4CF3FB7E9B8EA69757541DCE6CA20ED] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe [276376] [PID.1628] [MD5.80A5A61530384C6A3614C745217919DE] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7837184] [PID.576] [MD5.49501C6BE752D5043ADA8667AC774F7A] - (.Microsoft Corporation - Windows User Mode Driver Manager.) -- C:\WINDOWS\system32\wdfmgr.exe [38912] [PID.1336] ~ Processes Running: Scanned in 00mn 01s ---\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2) C:\Documents and Settings\paule\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences ~ Google Browser: 11 Legitimates Filtered in 00mn 32s ---\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) C:\Documents and Settings\paule\Application Data\Mozilla\Firefox\Profiles\ztnxs5ap.default-1354458410000\prefs.js ~ Firefox Browser: 28 Legitimates Filtered in 00mn 02s ---\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\WINDOWS\system32\Userinit.exe, F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl" ~ Keys: Scanned in 00mn 00s ---\ Hosts file redirection (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 00s ~ Nombre de lignes (Lines number): 20 ---\ Internet Explorer Toolbars (O3) O3 - Toolbar: Avira SearchFree Toolbar plus Web Protection - [HKLM]{41564952-412D-5637-00A7-7A786E7484D7} . (...) -- C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll =>Toolbar.Avira O3 - Toolbar\WebBrowser: (no name) - [HKCU]{01E04581-4EEE-11D0-BFE9-00AA005B4383} Clé orpheline O3 - Toolbar\WebBrowser: (no name) - [HKCU]{0E5CBF21-D15F-11D0-8301-00AA005B4383} Clé orpheline ~ Toolbar: Scanned in 00mn 00s ---\ Applications démarrées par registre & par dossier (O4) O4 - HKLM\..\Run: [avgnt] . (.Avira Operations GmbH & Co. KG - Avira System Tray Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe O4 - HKLM\..\Run: [WSED] . (.Dell - WSED.) -- C:\Program Files\WSED\WSED.exe O4 - HKLM\..\Run: [SynTPEnh] . (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [DeStatusMon] . (.Dell - Dell Device Status.) -- C:\Program Files\Dell\MFP_DELL\deDvcStatus.exe O4 - HKLM\..\Run: [dellsupportcenter] . (.SupportSoft, Inc. - Dell Support Center Updates.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe O4 - HKLM\..\Run: [CapsLKNotify] C:\Program Files\CapsLKNotify\CapsLKNotify.exe (.not file.) O4 - HKLM\..\Run: [BTMeter] . (.Dell - Pas de description.) -- C:\Program Files\Battery Meter\BTMeter.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] . (.Dell Inc. - Dell Wireless WLAN Card Wireless Network Tr.) -- C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe O4 - HKCU\..\Run: [uTorrent] C:\Documents and Settings\paule\Mes documents\photo , julie + chou\uTorrent.exe (.not file.) =>P2P.µTorrent O4 - HKCU\..\Run: [Spotify] C:\Documents and Settings\paule\Application Data\Spotify\Spotify.exe (.not file.) O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe O4 - HKCU\..\Run: [msnmsgr] C:\Program Files\Windows Live\Messenger\msnmsgr.exe (.not file.) O4 - HKCU\..\Run: [MSMSGS] . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Documents and Settings\paule\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [uTorrent] C:\Documents and Settings\paule\Mes documents\photo , julie + chou\uTorrent.exe (.not file.) =>P2P.µTorrent O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [Spotify] C:\Documents and Settings\paule\Application Data\Spotify\Spotify.exe (.not file.) O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [msnmsgr] C:\Program Files\Windows Live\Messenger\msnmsgr.exe (.not file.) O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [MSMSGS] . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Documents and Settings\paule\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe ~ Application: Scanned in 00mn 03s ---\ Autres liens utilisateurs (O4) O4 - GS\Programs: Adobe Download Assistant.lnk . (...) -- C:\Program Files\Adobe Download Assistant\Adobe Download Assistant.exe O4 - GS\Programs: Adobe Reader 9.lnk . (...) -- C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-A95000000001}\SC_Reader.ico O4 - GS\Programs: Audacity.lnk . (...) -- C:\Program Files\audacity\audacity.exe O4 - GS\Programs: Lanceur de tâches Microsoft Works.lnk . (.Microsoft® Corporation - Microsoft® Works.) -- C:\Program Files\Microsoft Works\MSWorks.exe O4 - GS\Programs: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O4 - GS\Programs: Paint.NET.lnk . (.dotPDN LLC - Paint.NET.) -- C:\Program Files\Paint.NET\PaintDotNet.exe O4 - GS\Programs: Visionneuse Microsoft Office PowerPoint 2007.lnk . (...) -- C:\WINDOWS\Installer\{95120000-00AF-040C-0000-0000000FF1CE}\ppvwicon.exe O4 - GS\Programs: Windows Search.lnk . (.Microsoft Corporation - Windows Search System Tray.) -- C:\Program Files\Windows Desktop Search\WindowsSearch.exe O4 - GS\Programs: Assistance à distance.LNK . (.Microsoft Corporation - Assistance à distance Microsoft.) -- C:\WINDOWS\system32 cimlby.exe O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Programs: Lecteur Windows Media.lnk . (.Microsoft Corporation - Lecteur Windows Media.) -- C:\Program Files\Windows Media Player\wmplayer.exe O4 - GS\Programs: Outlook Express.LNK . (.Microsoft Corporation - Outlook Express.) -- C:\Program Files\Outlook Express\msimn.exe ~ Global Startup: Scanned in 00mn 01s ---\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\OFFICE11\REFBARH.ICO O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -- Clé orpheline O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe ~ IE Extra Buttons: Scanned in 00mn 00s ---\ Objets ActiveX (Downloaded Program Files)(O16) O16 - DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} ((no name)) - http://support.euro.dell.com/systemprofiler/DellSystemLite.CAB ~ Objets ActiveX: Scanned in 00mn 00s ---\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{47A75EC0-95D4-4BF9-97D7-015513A6E793}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{47A75EC0-95D4-4BF9-97D7-015513A6E793}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CS3\Services\Tcpip\..\{47A75EC0-95D4-4BF9-97D7-015513A6E793}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1 ~ Domain: Scanned in 00mn 00s ---\ Titr_HJT34=Protocole additionnel (O18) O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} . (.Microsoft Corporation - WIA Scripting Layer.) -- C:\WINDOWS\system32\wiascr.dll O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.dll ~ Protocole Additionnel: Scanned in 00mn 00s ---\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dll O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dll O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agent réseau hors connexion.) -- C:\WINDOWS\system32\cscdll.dll O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\system32\dimsntfy.dll O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\WINDOWS\system32\igfxdev.dll O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL secondaire de notification de service d.) -- C:\WINDOWS\system32\sclgntfy.dll O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\WlNotify.dll O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll ~ Winlogon: Scanned in 00mn 00s ---\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: Service Google Update (gupdate) (gupdate) . (.Google Inc. - Programme d'installation de Google.) - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: SupportSoft Sprocket Service (DellSuppor (sprtsvc_DellSupportCenter) . (.SupportSoft, Inc. - SupportSoft Agent Service.) - C:\Program Files\Dell Support Center\bin\sprtsvc.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) . (...) - C:\WINDOWS\system32\WLTRYSVC.exe ~ Services: 11 Legitimates Filtered in 00mn 08s ---\ Enumération Active Desktop & MHTML Editor (O24) O24 - Desktop General: BackupWallPaper - .(...) - C:\Documents and Settings\paule\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop General: WallPaper - .(...) - C:\Documents and Settings\paule\Local Settings\Application Data\Microsoft\Wallpaper1.bmp ~ Desktop Component: 4 Legitimates Filtered in 00mn 00s ---\ Pilotes lancés au démarrage du système (O41) O41 - Driver: (appdrv01) . (.Protection Technology - Application Driver (01).) - C:\WINDOWS\system32\Drivers\appdrv01.sys ~ Drivers: 75 Legitimates Filtered in 00mn 01s ---\ Logiciels installés (O42) O42 - Logiciel: Jauge de batterie - (...) [HKLM] -- InstallShield_{543A4F31-9590-416A-A621-42CEB4C6A694} ~ Logic: 101 Legitimates Filtered in 00mn 01s ---\ HKCU & HKLM Software Keys [HKCU\Software\IncrediMail] [HKCU\Software\KeepVid] [HKLM\Software\54c] [HKLM\Software\Chaumet] [HKLM\Software\Function Keys] [HKLM\Software\IncrediMail] [HKLM\Software\SEJER] [HKLM\Software\WSED] ~ Key Software: 207 Legitimates Filtered in 00mn 01s ---\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 09/02/2010 - 08:43:02 - [0,603] ----D C:\Program Files\Battery Meter O43 - CFD: 09/02/2010 - 08:43:43 - [0,384] ----D C:\Program Files\Function Keys O43 - CFD: 09/02/2010 - 08:44:02 - [0,236] ----D C:\Program Files\WSED O43 - CFD: 09/02/2010 - 08:43:17 - [0,887] ----D C:\Documents and Settings\All Users\Application Data\Win732 O43 - CFD: 09/02/2010 - 08:43:17 - [1,427] ----D C:\Documents and Settings\All Users\Application Data\Win764 O43 - CFD: 09/02/2010 - 08:44:43 - [1,468] ----D C:\Documents and Settings\All Users\Application Data\XP32 O43 - CFD: 30/05/2010 - 18:10:19 - [0,045] ----D C:\Documents and Settings\paule\Application Data\cald2 O43 - CFD: 31/10/2012 - 17:50:41 - [0] ----D C:\Documents and Settings\paule\Application Data\ul_data O43 - CFD: 09/02/2010 - 08:43:44 - [0,001] ----D C:\Documents and Settings\paule\Menu Démarrer\Programmes\Touches de fonction ~ Program Folder: 181 Legitimates Filtered in 00mn 01s ---\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.79F84AC1612AB3C662057304381CFD95] - 27/08/2013 - 20:48:17 ---A- . (...) -- C:\UsbFix [Clean 1] CLAUDE.txt [8333] O44 - LFC:[MD5.C157B416E61141A5461EC4C45B479A45] - 27/08/2013 - 19:33:31 ---A- . (...) -- C:\WINDOWS\IE9_main.log [1389] O44 - LFC:[MD5.2FF2FB3977D09A562E6FD0F3BD9F9FBC] - 27/08/2013 - 18:46:11 ---A- . (...) -- C:\WINDOWS\wiadebug.log [159] O44 - LFC:[MD5.1041BB635B16241D0796EC3189811618] - 27/08/2013 - 18:46:08 ---A- . (...) -- C:\WINDOWS\wiaservc.log [50] O44 - LFC:[MD5.99C38F0038BD8E2E0679E3364E5181FA] - 27/08/2013 - 14:43:27 ----- . (...) -- C:\log.txt [1062381] O44 - LFC:[MD5.C9DD76D0EF94637C77FF8CA5E0FB0684] - 26/08/2013 - 08:22:54 ---A- . (...) -- C:\WINDOWS\system.ini [227] O44 - LFC:[MD5.4D1E56E34C0D19EC9CBD2A471E3548C4] - 26/08/2013 - 08:22:54 ---A- . (...) -- C:\WINDOWS\win.ini [573] O44 - LFC:[MD5.42EE400EAB8844B324EA04A26F91226C] - 25/08/2013 - 18:36:34 ---A- . (...) -- C:\WINDOWS\system32\ASOROSet.bin [2404] O44 - LFC:[MD5.B769F31F15544A455FA5A9DE4CB82829] - 25/08/2013 - 09:18:38 ---A- . (...) -- C:\WINDOWS\system32\mfc45.dat [74703] O44 - LFC:[MD5.2015783A18E1BE8D938298FACDB08D99] - 25/08/2013 - 09:04:01 ----- . (...) -- C:\NTUser.dat [262144] O44 - LFC:[MD5.B0D063401D5128A2F4FC1AE12F62B0FF] - 25/08/2013 - 09:04:01 ----- . (...) -- C:\NTUser.dat.LOG [1024] O44 - LFC:[MD5.22BA49C48A12D0EA923D042CD63BF3BF] - 24/08/2013 - 20:48:21 ---A- . (.Protection Technology - Application Driver (01).) -- C:\WINDOWS\system32\Drivers\appdrv01.sys [2256768] O44 - LFC:[MD5.C14D443940AAA5CC189F423FAC24ED41] - 24/08/2013 - 20:48:21 ---A- . (.Protection Technology - Application Driver Auto Removal Service (01.) -- C:\WINDOWS\system32\appdrvrem01.exe [318632] O44 - LFC:[MD5.65C50D03574D72C7E1860850C8933BEB] - 15/08/2013 - 02:11:27 ---A- . (...) -- C:\WINDOWS\system32\TZLog.log [59646] ~ Files: 34 Legitimates Filtered in 01mn 37s ---\ Opérations et fonctions au démarrage de Windows Explorer (O46) O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll O46 - SEH:ShellExecuteHooks - Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll ~ ShellExecuteHooks: Scanned in 00mn 00s ---\ Image File Execution Options (IFEO) (O50) O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d ~ IFEO: Scanned in 00mn 00s ---\ Liste des pilotes du système (SDL) (O58) O58 - SDL:[MD5.F6AF59D6EEE5E1C304F7F73706AD11D8] - 17/11/2009 - 17:40:42 ---A- . (.Creative - Creative WDM 3D Audio Driver.) -- C:\WINDOWS\system32\Drivers\Ambfilt.sys [1684736] O58 - SDL:[MD5.6D3ADA4CE95CECA7BCE527A08C4C474E] - 14/04/2008 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ansi.sys [9037] ~ Drivers: 5 Legitimates Filtered in 00mn 00s ---\ Liste des outils de désinfection (LATC) (O63) O63 - Logiciel: UsbFix By El Desaparecido - (.El Desaparecido - SosVirus.net.) [HKLM] -- Usbfix O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 ~ ADS: Scanned in 00mn 00s ---\ Liste les services legacy du registre (LALS) (O64) O64 - Services: CurCS - 20/11/2011 - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe LM Service) .(.Adobe Systems - System Level Service Utility.) - LEGACY_ADOBE_LM_SERVICE O64 - Services: CurCS - 09/06/2009 - C:\Program Files\Dell\DellDock\DockLogin.exe (DockLoginService) .(.Stardock Corporation - Dock Login Service.) - LEGACY_DOCKLOGINSERVICE ~ Legacy: 186 Legitimates Filtered in 00mn 02s ---\ Menu de démarrage Internet (SMI) (O68) O68 - StartMenuInternet: <>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\ Recherche d'infection sur les navigateurs internet (SBI) (O69) O69 - SBI: SearchScopes [HKCU] ${searchCLSID} - (@ieframe.dll,-12512) - https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8 O69 - SBI: SearchScopes [HKCU] 419CACB854694A8AA9405A250F77380E - (uTorrentBar_FR Customized Web Search) - http://search.conduit.com =>P2P.µTorrent O69 - SBI: SearchScopes [HKCU] {79B2CD94-5655-8129-42C5-4F150E4A6A48} - (Google) - https://www.google.com/?gws_rd=ssl O69 - SBI: SearchScopes [HKCU] {7CB4DA7B-F6CF-452B-855D-88F37C12FB74} - (Google) - https://www.google.com/?gws_rd=ssl O69 - SBI: SearchScopes [HKCU] {B3B3A6AC-74EC-BD56-BCDB-EFA4799FB9DF} [DefaultScope] - (Amazon) - http://www.amazon.frhTerms} ~ Keys: Scanned in 00mn 00s ---\ Recherche particulière à la racine du système (SPRF) (O84) [MD5.D81AC8D32D3609176D96D669D1777035] [SPRF][30/04/2008] (...) -- C:\Documents and Settings\paule\Local Settings\Application Data\fusioncache.dat [135] [MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][28/05/2010] (...) -- C:\Documents and Settings\paule\Application Data\wklnhst.dat [0] ~ Files: 2 Legitimates Filtered in 00mn 00s ---\ Enumère les codes produits des logiciels (PUC) (O90) O90 - PUC: "13F4A3450959A6146A1224EC4B6C6A49" . (.Battery Meter.) -- C:\WINDOWS\Installer\{543A4F31-9590-416A-A621-42CEB4C6A694}\ARPPRODUCTICON.exe O90 - PUC: "25946514D2147365007A7A857BC02020" . (.Avira SearchFree Toolbar plus Web Protection.) -- C:\WINDOWS\Installer\{41564952-412D-5637-00A7-A758B70C0202}\ToolbarIcon.exe =>Toolbar.Avira O90 - PUC: "3D15E350D588C5245968AE15384C6C88" . (.Function Keys.) -- C:\WINDOWS\Installer\{053E51D3-885D-425C-9586-EA5183C4C688}\ARPPRODUCTICON.exe O90 - PUC: "6216BC6E021D5BF4D9B12E1E09306EC6" . (.WSED.) -- C:\WINDOWS\Installer\{E6CB6126-D120-4FB5-9D1B-E2E19003E66C}\ARPPRODUCTICON.exe ~ Update Products: 58 Legitimates Filtered in 00mn 00s ---\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS) [MD5.993F9C3B4FF62AD7DDFA2DCF3C9E52D7] [WIS][25/08/2013] (.Ask Partner Network - Avira SearchFree Toolbar plus Web Protection.) -- C:\Windows\Installer\10c27c.msi [755200] =>Toolbar.Avira [MD5.3BFF707630742282B54AC0509CE3063B] [WIS][23/03/2011] (.Olivetti Enginering - Dell Photo AIO 928.) -- C:\Windows\Installer\7d9bb8.msi [2080768] [MD5.9E0AD3E31DAB3438A2C02E638574C546] [WIS][23/03/2011] (.Olivetti Engineering - .) -- C:\Windows\Installer\7d9bbf.msi [4174336] [MD5.F93A65FBEF40515319C1F648E37AB6B2] [WIS][09/02/2010] (.COMPAL - EMSC-Common-Driver.) -- C:\Windows\Installer\81a4a.msi [884224] [MD5.7EDFA03387F061E5805A0ABF1CD74F9D] [WIS][18/09/2012] (.roddy2000@hotbox.ru - DVD Decoder Pak for Windows XP.) -- C:\Windows\Installer\b4bb6a3.msi [220160] ~ WIS: 61 Legitimates Filtered in 00mn 18s ---\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Demand 20/11/2011 72704 | (Adobe LM Service) . (.Adobe Systems.) - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe SS - | Demand 20/08/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe SR - | Auto 25/08/2013 84024 | (AntiVirSchedulerService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\sched.exe SR - | Auto 25/08/2013 108088 | (AntiVirService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\avguard.exe SR - | Auto 25/08/2013 589368 | (AntiVirWebService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.exe SS - | Auto 24/08/2013 318632 | (appdrvrem01) . (.Protection Technology.) - C:\WINDOWS\system32\appdrvrem01.exe SR - | Auto 21/12/2012 57008 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe SS - | Auto 28/06/2007 131072 | (deMntrService) . (.Dell.) - C:\Program Files\Dell\MFP_DELL\deMntrService.exe SS - | Demand 14/04/2008 225280 | (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\system32\dmadmin.exe SS - | Auto 09/06/2009 155648 | (DockLoginService) . (.Stardock Corporation.) - C:\Program Files\Dell\DellDock\DockLogin.exe SS - | Auto 27/11/2011 136176 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 27/11/2011 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 03/04/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe SS - | Demand 16/08/2013 553288 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe SS - | Demand 17/08/2013 117656 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe SS - | Auto 21/06/2013 162408 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe SS - | Auto 03/06/2009 201968 | (sprtsvc_DellSupportCenter) . (.SupportSoft, Inc..) - C:\Program Files\Dell Support Center\bin\sprtsvc.exe SS - | Auto 07/01/2009 24576 | (wltrysvc) . (...) - C:\WINDOWS\system32\WLTRYSVC.exe ~ Services: Scanned in 00mn 19s ---\ Scan Additionnel (O88) Database Version : v2.12866 - (26/08/2013) Clés trouvées (Keys found) : 0 Valeurs trouvées (Values found) : 1 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 3 [HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{41564952-412D-5637-00A7-7A786E7484D7} =>Toolbar.Avira^ C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll =>Toolbar.Avira^ C:\WINDOWS\Installer\{41564952-412D-5637-00A7-A758B70C0202}\ToolbarIcon.exe =>Toolbar.Avira^ C:\Windows\Installer\10c27c.msi =>Toolbar.Avira^ ~ Additionnel Scan: 253664 Items scanned in 00mn 34s ---\ Récapitulatif des détections trouvées sur votre station ~ http://nicolascoolman.webs.com28419247-toolbar-avira =>Toolbar.Avira ~ MSI: 1 link(s) detected in 00mn 34s ~ 1011 Legitimates filtered by white list End of the scan (462 lines in 03mn 56s)(0)

hub70 · Answer

~ Rapport de ZHPDiag v2013.8.26.36 - Nicolas Coolman (26/08/2013) ~ Lancé par paule (27/08/2013 22:08:50) ~ Adresse du Site Web https://nicolascoolman.webs.com/ ~ Traduit par Nicolas Coolman ~ Etat de la version : Version à jour. ~ Liste blanche : Activée par le programme ~ Elévation des Privilèges : OK ~ User Account Control (UAC): Not Found ---\ Navigateurs Internet MSIE: Internet Explorer v8.0.6001.18702 MFIE: Mozilla Firefox 23.0.1 (Defaut) GCIE: Google Chrome v29.0.1547.57 ---\ Informations sur les produits Windows ~ Langage: Français Windows XP Home Edition Service Pack 3 (Build 2600) Windows Automatic Updates : OK Windows Genuine Advantage : KO ---\ Logiciels de protection du système Avira Free Antivirus v13.0.0.3885 Malwarebytes Anti-Malware version 1.75.0.1300 ---\ Logiciels d'optimisation du système CCleaner v4.04 =>Piriform Ltd ---\ Logiciels de partage PeerToPeer µTorrent v3.2.0 =>P2P.µTorrent ---\ Surveillance de Logiciels Adobe Flash Player 11 Plugin Adobe Reader 9.5.5 - Français Java 7 Update 7 ---\ Informations sur le système ~ Processor: x86 Family 6 Model 28 Stepping 10, GenuineIntel ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 1013 MB (52% free) System Restore: Activé (Enable) System drive C: has 99 GB (71%) free of 139 GB ---\ Mode de connexion au système ~ Computer Name: CLAUDE ~ User Name: paule ~ All Users Names: SUPPORT_388945a0, paule, HelpAssistant, Administrateur, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\ Variables d'environnement ~ System Unit : C:\ ~ %AppData% : C:\Documents and Settings\paule\Application Data\ ~ %Desktop% : C:\Documents and Settings\paule\Bureau\ ~ %Favorites% : C:\Documents and Settings\paule\Favoris\ ~ %LocalAppData% : C:\Documents and Settings\paule\Local Settings\Application Data\ ~ %StartMenu% : C:\Documents and Settings\paule\Menu Démarrer\ ~ %Windir% : C:\WINDOWS\ ~ %System% : C:\WINDOWS\system32\ ---\ Enumération des unités disques C:\ Hard drive, Flash drive, Thumb drive (Free 99 Go of 139 Go) ---\ Etat du Centre de Sécurité Windows ~ Security Center: 33 Legitimates Filtered in 00mn 00s ---\ Recherche particulière de fichiers génériques [MD5.F2317622D29F9FF0F88AEECD5F60F0DD] - (.Microsoft Corporation - Explorateur Windows.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\Explorer.exe [1037824] [MD5.E1948293F7CBC38987270432935D8D05] - (.Microsoft Corporation - Internet Extensions for Win32.) (.26/07/2013 - 03:47:15.) -- C:\WINDOWS\system32\wininet.dll [920064] [MD5.DD73D6B9F6B4CB630CF35B438B540174] - (.Microsoft Corporation - Application d'ouverture de session Windows NT.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Winlogon.exe [512000] [MD5.1E44BC1E83D8FD2305F8D452DB109CF9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.17/08/2011 - 14:49:54.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496] [MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.14/04/2008 - 00:40:32.) -- C:\WINDOWS\system32\Drivers\atapi.sys [96512] [MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744] [MD5.1F4260CC5B42272D71F79E570A27A4FE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [62976] [MD5.31F923EB2170FC172C81ABDA0045D18C] - (.Microsoft Corporation - Pilote de cryptographie FIPS.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Fips.sys [44672] [MD5.573C7D0A32852B48F3058CFD8026F511] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [144384] [MD5.A09BDC4ED10E3B2E0EC27BB94AF32516] - (.Microsoft Corporation - Pilote de port i8042.) (.14/04/2008 - 08:00:54.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [54144] [MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [42112] [MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [152832] [MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [75264] [MD5.7D304A5EB4344EBEEAB53A2FE3FFB9F0] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.15/07/2011 - 14:29:31.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [456320] [MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers etBT.sys [162816] [MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers tfs.sys [574976] [MD5.8FD0BDBEA875D06CCF6C945CA9ABAF75] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80384] [MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328] [MD5.15CABD0F7C00C47C70124907916AF3F1] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.14/04/2008 - 00:32:52.) -- C:\WINDOWS\system32\Drivers dpdr.sys [196224] [MD5.D8EB2A7904DB6C916EB5361878DDCBAE] - (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) (.13/04/2008 - 19:57:36.) -- C:\WINDOWS\system32\Drivers edbook.sys [58752] [MD5.46DE1126684369BACE4849E4FC8C43CA] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.14/04/2008 - 13:00:00.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [53376] ~ Generic Processes: Scanned in 00mn 01s ---\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 2/1108 ~ Mes musiques (My Musics) : 1/30 ~ Mes Videos (My Videos) : 0/20 ~ Mes Favoris (My Favorites) : 1/18 ~ Mes Documents (My Documents) : 2/2481 ~ Mon Bureau (My Desktop) : 1/698 ~ Menu demarrer (Programs) : 1/25 ~ Hidden Files: Scanned in 00mn 03s ---\ Processus lancés au démarrage du système [MD5.99387251353598C939592FAF40DF8AA9] - (.Avira Operations GmbH & Co. KG - Avira Scheduler.) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024] [PID.1812] [MD5.8491FDA93507F2F27FFBA11372764086] - (.Avira Operations GmbH & Co. KG - Avira On-Access Service.) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088] [PID.180] [MD5.4631FF0EE2964CCDC646AF807CB778F5] - (.Avira Operations GmbH & Co. KG - Avira System Tray Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144] [PID.2340] [MD5.68C105908A54D734D2B154DB546F562E] - (.Avira Operations GmbH & Co. KG - Avira Shadow Copy Service.) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe [76856] [PID.3768] [MD5.696EB1F22EC71262BB8188639DBEED3E] - (.Avira Operations GmbH & Co. KG - Avira WebGuard Service.) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.exe [589368] [PID.3792] [MD5.4FE5C6D40664AE07BE5105874357D2ED] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe [57008] [PID.1224] [MD5.2E0B0A051FFAA86E358465BB0880D453] - (.Microsoft Corporation - Windows Update.) -- C:\WINDOWS\system32\wuauclt.exe [53784] [PID.2324] [MD5.B4CF3FB7E9B8EA69757541DCE6CA20ED] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe [276376] [PID.1628] [MD5.80A5A61530384C6A3614C745217919DE] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7837184] [PID.576] [MD5.49501C6BE752D5043ADA8667AC774F7A] - (.Microsoft Corporation - Windows User Mode Driver Manager.) -- C:\WINDOWS\system32\wdfmgr.exe [38912] [PID.1336] ~ Processes Running: Scanned in 00mn 01s ---\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2) C:\Documents and Settings\paule\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences ~ Google Browser: 11 Legitimates Filtered in 00mn 32s ---\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) C:\Documents and Settings\paule\Application Data\Mozilla\Firefox\Profiles\ztnxs5ap.default-1354458410000\prefs.js ~ Firefox Browser: 28 Legitimates Filtered in 00mn 02s ---\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\WINDOWS\system32\Userinit.exe, F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl" ~ Keys: Scanned in 00mn 00s ---\ Hosts file redirection (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 00s ~ Nombre de lignes (Lines number): 20 ---\ Internet Explorer Toolbars (O3) O3 - Toolbar: Avira SearchFree Toolbar plus Web Protection - [HKLM]{41564952-412D-5637-00A7-7A786E7484D7} . (...) -- C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll =>Toolbar.Avira O3 - Toolbar\WebBrowser: (no name) - [HKCU]{01E04581-4EEE-11D0-BFE9-00AA005B4383} Clé orpheline O3 - Toolbar\WebBrowser: (no name) - [HKCU]{0E5CBF21-D15F-11D0-8301-00AA005B4383} Clé orpheline ~ Toolbar: Scanned in 00mn 00s ---\ Applications démarrées par registre & par dossier (O4) O4 - HKLM\..\Run: [avgnt] . (.Avira Operations GmbH & Co. KG - Avira System Tray Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe O4 - HKLM\..\Run: [WSED] . (.Dell - WSED.) -- C:\Program Files\WSED\WSED.exe O4 - HKLM\..\Run: [SynTPEnh] . (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [DeStatusMon] . (.Dell - Dell Device Status.) -- C:\Program Files\Dell\MFP_DELL\deDvcStatus.exe O4 - HKLM\..\Run: [dellsupportcenter] . (.SupportSoft, Inc. - Dell Support Center Updates.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe O4 - HKLM\..\Run: [CapsLKNotify] C:\Program Files\CapsLKNotify\CapsLKNotify.exe (.not file.) O4 - HKLM\..\Run: [BTMeter] . (.Dell - Pas de description.) -- C:\Program Files\Battery Meter\BTMeter.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] . (.Dell Inc. - Dell Wireless WLAN Card Wireless Network Tr.) -- C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe O4 - HKCU\..\Run: [uTorrent] C:\Documents and Settings\paule\Mes documents\photo , julie + chou\uTorrent.exe (.not file.) =>P2P.µTorrent O4 - HKCU\..\Run: [Spotify] C:\Documents and Settings\paule\Application Data\Spotify\Spotify.exe (.not file.) O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe O4 - HKCU\..\Run: [msnmsgr] C:\Program Files\Windows Live\Messenger\msnmsgr.exe (.not file.) O4 - HKCU\..\Run: [MSMSGS] . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Documents and Settings\paule\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [uTorrent] C:\Documents and Settings\paule\Mes documents\photo , julie + chou\uTorrent.exe (.not file.) =>P2P.µTorrent O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [Spotify] C:\Documents and Settings\paule\Application Data\Spotify\Spotify.exe (.not file.) O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [msnmsgr] C:\Program Files\Windows Live\Messenger\msnmsgr.exe (.not file.) O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [MSMSGS] . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Documents and Settings\paule\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe O4 - HKUS\S-1-5-21-2661660657-132674061-1654209337-1006\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe ~ Application: Scanned in 00mn 03s ---\ Autres liens utilisateurs (O4) O4 - GS\Programs: Adobe Download Assistant.lnk . (...) -- C:\Program Files\Adobe Download Assistant\Adobe Download Assistant.exe O4 - GS\Programs: Adobe Reader 9.lnk . (...) -- C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-A95000000001}\SC_Reader.ico O4 - GS\Programs: Audacity.lnk . (...) -- C:\Program Files\audacity\audacity.exe O4 - GS\Programs: Lanceur de tâches Microsoft Works.lnk . (.Microsoft® Corporation - Microsoft® Works.) -- C:\Program Files\Microsoft Works\MSWorks.exe O4 - GS\Programs: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O4 - GS\Programs: Paint.NET.lnk . (.dotPDN LLC - Paint.NET.) -- C:\Program Files\Paint.NET\PaintDotNet.exe O4 - GS\Programs: Visionneuse Microsoft Office PowerPoint 2007.lnk . (...) -- C:\WINDOWS\Installer\{95120000-00AF-040C-0000-0000000FF1CE}\ppvwicon.exe O4 - GS\Programs: Windows Search.lnk . (.Microsoft Corporation - Windows Search System Tray.) -- C:\Program Files\Windows Desktop Search\WindowsSearch.exe O4 - GS\Programs: Assistance à distance.LNK . (.Microsoft Corporation - Assistance à distance Microsoft.) -- C:\WINDOWS\system32 cimlby.exe O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Programs: Lecteur Windows Media.lnk . (.Microsoft Corporation - Lecteur Windows Media.) -- C:\Program Files\Windows Media Player\wmplayer.exe O4 - GS\Programs: Outlook Express.LNK . (.Microsoft Corporation - Outlook Express.) -- C:\Program Files\Outlook Express\msimn.exe ~ Global Startup: Scanned in 00mn 01s ---\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\OFFICE11\REFBARH.ICO O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -- Clé orpheline O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe ~ IE Extra Buttons: Scanned in 00mn 00s ---\ Objets ActiveX (Downloaded Program Files)(O16) O16 - DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} ((no name)) - http://support.euro.dell.com/systemprofiler/DellSystemLite.CAB ~ Objets ActiveX: Scanned in 00mn 00s ---\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{47A75EC0-95D4-4BF9-97D7-015513A6E793}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{47A75EC0-95D4-4BF9-97D7-015513A6E793}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CS3\Services\Tcpip\..\{47A75EC0-95D4-4BF9-97D7-015513A6E793}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1 ~ Domain: Scanned in 00mn 00s ---\ Titr_HJT34=Protocole additionnel (O18) O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} . (.Microsoft Corporation - WIA Scripting Layer.) -- C:\WINDOWS\system32\wiascr.dll O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.dll ~ Protocole Additionnel: Scanned in 00mn 00s ---\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dll O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dll O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agent réseau hors connexion.) -- C:\WINDOWS\system32\cscdll.dll O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\system32\dimsntfy.dll O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\WINDOWS\system32\igfxdev.dll O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL secondaire de notification de service d.) -- C:\WINDOWS\system32\sclgntfy.dll O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\WlNotify.dll O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll ~ Winlogon: Scanned in 00mn 00s ---\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: Service Google Update (gupdate) (gupdate) . (.Google Inc. - Programme d'installation de Google.) - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: SupportSoft Sprocket Service (DellSuppor (sprtsvc_DellSupportCenter) . (.SupportSoft, Inc. - SupportSoft Agent Service.) - C:\Program Files\Dell Support Center\bin\sprtsvc.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) . (...) - C:\WINDOWS\system32\WLTRYSVC.exe ~ Services: 11 Legitimates Filtered in 00mn 08s ---\ Enumération Active Desktop & MHTML Editor (O24) O24 - Desktop General: BackupWallPaper - .(...) - C:\Documents and Settings\paule\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop General: WallPaper - .(...) - C:\Documents and Settings\paule\Local Settings\Application Data\Microsoft\Wallpaper1.bmp ~ Desktop Component: 4 Legitimates Filtered in 00mn 00s ---\ Pilotes lancés au démarrage du système (O41) O41 - Driver: (appdrv01) . (.Protection Technology - Application Driver (01).) - C:\WINDOWS\system32\Drivers\appdrv01.sys ~ Drivers: 75 Legitimates Filtered in 00mn 01s ---\ Logiciels installés (O42) O42 - Logiciel: Jauge de batterie - (...) [HKLM] -- InstallShield_{543A4F31-9590-416A-A621-42CEB4C6A694} ~ Logic: 101 Legitimates Filtered in 00mn 01s ---\ HKCU & HKLM Software Keys [HKCU\Software\IncrediMail] [HKCU\Software\KeepVid] [HKLM\Software\54c] [HKLM\Software\Chaumet] [HKLM\Software\Function Keys] [HKLM\Software\IncrediMail] [HKLM\Software\SEJER] [HKLM\Software\WSED] ~ Key Software: 207 Legitimates Filtered in 00mn 01s ---\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 09/02/2010 - 08:43:02 - [0,603] ----D C:\Program Files\Battery Meter O43 - CFD: 09/02/2010 - 08:43:43 - [0,384] ----D C:\Program Files\Function Keys O43 - CFD: 09/02/2010 - 08:44:02 - [0,236] ----D C:\Program Files\WSED O43 - CFD: 09/02/2010 - 08:43:17 - [0,887] ----D C:\Documents and Settings\All Users\Application Data\Win732 O43 - CFD: 09/02/2010 - 08:43:17 - [1,427] ----D C:\Documents and Settings\All Users\Application Data\Win764 O43 - CFD: 09/02/2010 - 08:44:43 - [1,468] ----D C:\Documents and Settings\All Users\Application Data\XP32 O43 - CFD: 30/05/2010 - 18:10:19 - [0,045] ----D C:\Documents and Settings\paule\Application Data\cald2 O43 - CFD: 31/10/2012 - 17:50:41 - [0] ----D C:\Documents and Settings\paule\Application Data\ul_data O43 - CFD: 09/02/2010 - 08:43:44 - [0,001] ----D C:\Documents and Settings\paule\Menu Démarrer\Programmes\Touches de fonction ~ Program Folder: 181 Legitimates Filtered in 00mn 01s ---\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.79F84AC1612AB3C662057304381CFD95] - 27/08/2013 - 20:48:17 ---A- . (...) -- C:\UsbFix [Clean 1] CLAUDE.txt [8333] O44 - LFC:[MD5.C157B416E61141A5461EC4C45B479A45] - 27/08/2013 - 19:33:31 ---A- . (...) -- C:\WINDOWS\IE9_main.log [1389] O44 - LFC:[MD5.2FF2FB3977D09A562E6FD0F3BD9F9FBC] - 27/08/2013 - 18:46:11 ---A- . (...) -- C:\WINDOWS\wiadebug.log [159] O44 - LFC:[MD5.1041BB635B16241D0796EC3189811618] - 27/08/2013 - 18:46:08 ---A- . (...) -- C:\WINDOWS\wiaservc.log [50] O44 - LFC:[MD5.99C38F0038BD8E2E0679E3364E5181FA] - 27/08/2013 - 14:43:27 ----- . (...) -- C:\log.txt [1062381] O44 - LFC:[MD5.C9DD76D0EF94637C77FF8CA5E0FB0684] - 26/08/2013 - 08:22:54 ---A- . (...) -- C:\WINDOWS\system.ini [227] O44 - LFC:[MD5.4D1E56E34C0D19EC9CBD2A471E3548C4] - 26/08/2013 - 08:22:54 ---A- . (...) -- C:\WINDOWS\win.ini [573] O44 - LFC:[MD5.42EE400EAB8844B324EA04A26F91226C] - 25/08/2013 - 18:36:34 ---A- . (...) -- C:\WINDOWS\system32\ASOROSet.bin [2404] O44 - LFC:[MD5.B769F31F15544A455FA5A9DE4CB82829] - 25/08/2013 - 09:18:38 ---A- . (...) -- C:\WINDOWS\system32\mfc45.dat [74703] O44 - LFC:[MD5.2015783A18E1BE8D938298FACDB08D99] - 25/08/2013 - 09:04:01 ----- . (...) -- C:\NTUser.dat [262144] O44 - LFC:[MD5.B0D063401D5128A2F4FC1AE12F62B0FF] - 25/08/2013 - 09:04:01 ----- . (...) -- C:\NTUser.dat.LOG [1024] O44 - LFC:[MD5.22BA49C48A12D0EA923D042CD63BF3BF] - 24/08/2013 - 20:48:21 ---A- . (.Protection Technology - Application Driver (01).) -- C:\WINDOWS\system32\Drivers\appdrv01.sys [2256768] O44 - LFC:[MD5.C14D443940AAA5CC189F423FAC24ED41] - 24/08/2013 - 20:48:21 ---A- . (.Protection Technology - Application Driver Auto Removal Service (01.) -- C:\WINDOWS\system32\appdrvrem01.exe [318632] O44 - LFC:[MD5.65C50D03574D72C7E1860850C8933BEB] - 15/08/2013 - 02:11:27 ---A- . (...) -- C:\WINDOWS\system32\TZLog.log [59646] ~ Files: 34 Legitimates Filtered in 01mn 37s ---\ Opérations et fonctions au démarrage de Windows Explorer (O46) O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll O46 - SEH:ShellExecuteHooks - Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll ~ ShellExecuteHooks: Scanned in 00mn 00s ---\ Image File Execution Options (IFEO) (O50) O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d ~ IFEO: Scanned in 00mn 00s ---\ Liste des pilotes du système (SDL) (O58) O58 - SDL:[MD5.F6AF59D6EEE5E1C304F7F73706AD11D8] - 17/11/2009 - 17:40:42 ---A- . (.Creative - Creative WDM 3D Audio Driver.) -- C:\WINDOWS\system32\Drivers\Ambfilt.sys [1684736] O58 - SDL:[MD5.6D3ADA4CE95CECA7BCE527A08C4C474E] - 14/04/2008 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ansi.sys [9037] ~ Drivers: 5 Legitimates Filtered in 00mn 00s ---\ Liste des outils de désinfection (LATC) (O63) O63 - Logiciel: UsbFix By El Desaparecido - (.El Desaparecido - SosVirus.net.) [HKLM] -- Usbfix O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 ~ ADS: Scanned in 00mn 00s ---\ Liste les services legacy du registre (LALS) (O64) O64 - Services: CurCS - 20/11/2011 - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe LM Service) .(.Adobe Systems - System Level Service Utility.) - LEGACY_ADOBE_LM_SERVICE O64 - Services: CurCS - 09/06/2009 - C:\Program Files\Dell\DellDock\DockLogin.exe (DockLoginService) .(.Stardock Corporation - Dock Login Service.) - LEGACY_DOCKLOGINSERVICE ~ Legacy: 186 Legitimates Filtered in 00mn 02s ---\ Menu de démarrage Internet (SMI) (O68) O68 - StartMenuInternet: <>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\ Recherche d'infection sur les navigateurs internet (SBI) (O69) O69 - SBI: SearchScopes [HKCU] ${searchCLSID} - (@ieframe.dll,-12512) - https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8 O69 - SBI: SearchScopes [HKCU] 419CACB854694A8AA9405A250F77380E - (uTorrentBar_FR Customized Web Search) - http://search.conduit.com =>P2P.µTorrent O69 - SBI: SearchScopes [HKCU] {79B2CD94-5655-8129-42C5-4F150E4A6A48} - (Google) - https://www.google.com/?gws_rd=ssl O69 - SBI: SearchScopes [HKCU] {7CB4DA7B-F6CF-452B-855D-88F37C12FB74} - (Google) - https://www.google.com/?gws_rd=ssl O69 - SBI: SearchScopes [HKCU] {B3B3A6AC-74EC-BD56-BCDB-EFA4799FB9DF} [DefaultScope] - (Amazon) - http://www.amazon.frhTerms} ~ Keys: Scanned in 00mn 00s ---\ Recherche particulière à la racine du système (SPRF) (O84) [MD5.D81AC8D32D3609176D96D669D1777035] [SPRF][30/04/2008] (...) -- C:\Documents and Settings\paule\Local Settings\Application Data\fusioncache.dat [135] [MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][28/05/2010] (...) -- C:\Documents and Settings\paule\Application Data\wklnhst.dat [0] ~ Files: 2 Legitimates Filtered in 00mn 00s ---\ Enumère les codes produits des logiciels (PUC) (O90) O90 - PUC: "13F4A3450959A6146A1224EC4B6C6A49" . (.Battery Meter.) -- C:\WINDOWS\Installer\{543A4F31-9590-416A-A621-42CEB4C6A694}\ARPPRODUCTICON.exe O90 - PUC: "25946514D2147365007A7A857BC02020" . (.Avira SearchFree Toolbar plus Web Protection.) -- C:\WINDOWS\Installer\{41564952-412D-5637-00A7-A758B70C0202}\ToolbarIcon.exe =>Toolbar.Avira O90 - PUC: "3D15E350D588C5245968AE15384C6C88" . (.Function Keys.) -- C:\WINDOWS\Installer\{053E51D3-885D-425C-9586-EA5183C4C688}\ARPPRODUCTICON.exe O90 - PUC: "6216BC6E021D5BF4D9B12E1E09306EC6" . (.WSED.) -- C:\WINDOWS\Installer\{E6CB6126-D120-4FB5-9D1B-E2E19003E66C}\ARPPRODUCTICON.exe ~ Update Products: 58 Legitimates Filtered in 00mn 00s ---\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS) [MD5.993F9C3B4FF62AD7DDFA2DCF3C9E52D7] [WIS][25/08/2013] (.Ask Partner Network - Avira SearchFree Toolbar plus Web Protection.) -- C:\Windows\Installer\10c27c.msi [755200] =>Toolbar.Avira [MD5.3BFF707630742282B54AC0509CE3063B] [WIS][23/03/2011] (.Olivetti Enginering - Dell Photo AIO 928.) -- C:\Windows\Installer\7d9bb8.msi [2080768] [MD5.9E0AD3E31DAB3438A2C02E638574C546] [WIS][23/03/2011] (.Olivetti Engineering - .) -- C:\Windows\Installer\7d9bbf.msi [4174336] [MD5.F93A65FBEF40515319C1F648E37AB6B2] [WIS][09/02/2010] (.COMPAL - EMSC-Common-Driver.) -- C:\Windows\Installer\81a4a.msi [884224] [MD5.7EDFA03387F061E5805A0ABF1CD74F9D] [WIS][18/09/2012] (.roddy2000@hotbox.ru - DVD Decoder Pak for Windows XP.) -- C:\Windows\Installer\b4bb6a3.msi [220160] ~ WIS: 61 Legitimates Filtered in 00mn 18s ---\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Demand 20/11/2011 72704 | (Adobe LM Service) . (.Adobe Systems.) - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe SS - | Demand 20/08/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe SR - | Auto 25/08/2013 84024 | (AntiVirSchedulerService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\sched.exe SR - | Auto 25/08/2013 108088 | (AntiVirService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\avguard.exe SR - | Auto 25/08/2013 589368 | (AntiVirWebService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.exe SS - | Auto 24/08/2013 318632 | (appdrvrem01) . (.Protection Technology.) - C:\WINDOWS\system32\appdrvrem01.exe SR - | Auto 21/12/2012 57008 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe SS - | Auto 28/06/2007 131072 | (deMntrService) . (.Dell.) - C:\Program Files\Dell\MFP_DELL\deMntrService.exe SS - | Demand 14/04/2008 225280 | (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\system32\dmadmin.exe SS - | Auto 09/06/2009 155648 | (DockLoginService) . (.Stardock Corporation.) - C:\Program Files\Dell\DellDock\DockLogin.exe SS - | Auto 27/11/2011 136176 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 27/11/2011 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 03/04/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe SS - | Demand 16/08/2013 553288 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe SS - | Demand 17/08/2013 117656 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe SS - | Auto 21/06/2013 162408 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe SS - | Auto 03/06/2009 201968 | (sprtsvc_DellSupportCenter) . (.SupportSoft, Inc..) - C:\Program Files\Dell Support Center\bin\sprtsvc.exe SS - | Auto 07/01/2009 24576 | (wltrysvc) . (...) - C:\WINDOWS\system32\WLTRYSVC.exe ~ Services: Scanned in 00mn 19s ---\ Scan Additionnel (O88) Database Version : v2.12866 - (26/08/2013) Clés trouvées (Keys found) : 0 Valeurs trouvées (Values found) : 1 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 3 [HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{41564952-412D-5637-00A7-7A786E7484D7} =>Toolbar.Avira^ C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll =>Toolbar.Avira^ C:\WINDOWS\Installer\{41564952-412D-5637-00A7-A758B70C0202}\ToolbarIcon.exe =>Toolbar.Avira^ C:\Windows\Installer\10c27c.msi =>Toolbar.Avira^ ~ Additionnel Scan: 253664 Items scanned in 00mn 34s ---\ Récapitulatif des détections trouvées sur votre station ~ http://nicolascoolman.webs.com28419247-toolbar-avira =>Toolbar.Avira ~ MSI: 1 link(s) detected in 00mn 34s ~ 1011 Legitimates filtered by white list End of the scan (462 lines in 03mn 56s)(0)

hub70 · Answer

jai bien poster le rapport précédent sur 
Malekal's forum
 comme il ne m'ont pas fourni de lien j' ai fait un copier coller
quand tu dis tout ce qui est java je n'ai que java 7 
dans programme
est ce que je risque de trouver du java ailleurs?

hub70 · Answer

apres avoir dèinstaler java quand je vais sur le lien java la page bloc dans la recherche de la dernière version j'ai essayer avec firefox et IE
est ce qque je redemar mon ordi ou est ce que je telécharge directement java

hub70 · Answer

j'ai tout fait je testerai demain

hub70 · Answer

bonjour,
ça a l'air d'aller 
petite question
quand je fais msconfig et que je vais voir ce qui il y a au démarrage je trouve Mcafee security scan plus   il me semblais que je l'avais supprimé celui la ,
d'ailleur quand je regarde dans ajouter et supprimer des programmes il n'y est pas 
comment faire pour que msm , facebook, et skipe  ne soit pas cocher dans le menu démarer
avant de contacter CCM j'avais commencé par faire le ménage. en ce qui concerne le pack office je l'avais décocher et actualiser  et il reviens pas dans le menu démare même si j'utilise word certes il est un peux plus long à démarrer  mais ça va

hub70 · Answer

bonsoir 
tout va bien 
je vous remercie beaucoup grâce à des passionnés comme vous, vous m'avez enlevé une belle épine du pied 
merci

Néttoyage demande d'aide

25 réponses

Discussions similaires