Comment supprimer Delta-Homes?

Bonjour,

--> Désinstalle Ad-Aware et Spybot qui ne sont pas utiles.

--> Télécharge et lance AdwCleaner (d'Xplode), choisis l'option "Scanner".

--> Une fois le scan terminé, choisis l'option "Nettoyer".

--> Redémarre le PC comme demandé puis poste le rapport.

comment je fais pour trouver le rapport ?

Il est dans C:\AdwCleaner.

# AdwCleaner v3.001 - Rapport créé le 27/08/2013 à 13:07:47
# Mis à jour le 24/08/2013 par Xplode
# Système d'exploitation : Microsoft Windows XP Service Pack 3 (32 bits)
# Nom d'utilisateur : ANDROVER - PC-ANDROVER
# Exécuté depuis : C:\Documents and Settings\ANDROVER\Mes documents\Downloads\adwcleaner.exe
# Option : Nettoyer

***** [ Services ] *****

Service Supprimé : winzipersvc
Service Supprimé : WsysSvc

***** [ Fichiers / Dossiers ] *****

Dossier Supprimé : C:\Documents and Settings\All Users\Application Data\Babylon
[!] Dossier Supprimé : C:\Documents and Settings\All Users\Application Data\BrowserDefender
Dossier Supprimé : C:\Documents and Settings\All Users\Application Data\eSafe
Dossier Supprimé : C:\Documents and Settings\All Users\Application Data\Systweak
Dossier Supprimé : C:\Documents and Settings\All Users\Application Data\Tarma Installer
Dossier Supprimé : C:\Documents and Settings\All Users\Menu Démarrer\Programmes\WinZipper
Dossier Supprimé : C:\Program Files\MyPC Backup
Dossier Supprimé : C:\Program Files\Plus-HD-3.5
Dossier Supprimé : C:\Program Files\tuguu sl
Dossier Supprimé : C:\Program Files\WinZipper
Dossier Supprimé : C:\Documents and Settings\ANDROVER\IECompatCache
Dossier Supprimé : C:\Documents and Settings\ANDROVER\Local Settings\Application Data\cre
Dossier Supprimé : C:\DOCUME~1\ANDROVER\LOCALS~1\Temp\eIntaller
Dossier Supprimé : C:\Documents and Settings\ANDROVER\Application Data\Babylon
Dossier Supprimé : C:\Documents and Settings\ANDROVER\Application Data\Systweak
Dossier Supprimé : C:\Documents and Settings\ANDROVER\Application Data\WinZipper
Dossier Supprimé : C:\Documents and Settings\ANDROVER\Application Data\Mozilla\Firefox\Profiles\88e23vg6.default\Extensions\d8222698-19e5-4827-b79e-0a077ea8eb7a@7b662f6d-3899-41e4-8864-6393447568da.com
Fichier Supprimé : C:\Documents and Settings\ANDROVER\Application Data\Mozilla\Firefox\Profiles\88e23vg6.default\Extensions\torntv2@torntv.com.xpi
Fichier Supprimé : C:\WINDOWS\system32\roboot.exe
Fichier Supprimé : C:\Documents and Settings\ANDROVER\Application Data\Mozilla\Firefox\Profiles\88e23vg6.default\searchplugins\Babylon.xml
Fichier Supprimé : C:\Documents and Settings\ANDROVER\Application Data\Mozilla\Firefox\Profiles\88e23vg6.default\bProtector_extensions.rdf
Fichier Supprimé : C:\Documents and Settings\ANDROVER\Application Data\Mozilla\Firefox\Profiles\88e23vg6.default\user.js
Fichier Supprimé : C:\Documents and Settings\ANDROVER\Local Settings\Application Data\Google\Chrome\User Data\Default\bProtector Web Data
Fichier Supprimé : C:\Documents and Settings\ANDROVER\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
Fichier Supprimé : C:\WINDOWS\Tasks\EPUpdater.job
Fichier Supprimé : C:\WINDOWS\Tasks\Plus-HD-3.5-codedownloader.job
Fichier Supprimé : C:\WINDOWS\Tasks\Plus-HD-3.5-enabler.job
Fichier Supprimé : C:\WINDOWS\Tasks\Plus-HD-3.5-firefoxinstaller.job
Fichier Supprimé : C:\WINDOWS\Tasks\Plus-HD-3.5-updater.job

***** [ Raccourcis ] *****

Raccourci Désinfecté : C:\Documents and Settings\ANDROVER\Bureau\Google Chrome.lnk
Raccourci Désinfecté : C:\Documents and Settings\ANDROVER\Menu Démarrer\Programmes\Internet Explorer.lnk
Raccourci Désinfecté : C:\Documents and Settings\ANDROVER\Menu Démarrer\Programmes\Google Chrome\Google Chrome.lnk
Raccourci Désinfecté : C:\Documents and Settings\ANDROVER\Menu Démarrer\Programmes\Accessoires\Outils système\Internet Explorer (sans module complémentaire).lnk

***** [ Registre ] *****

Clé Supprimée : HKCU\Software\Google\Chrome\Extensions\paoponfhfdfnjgddpnpjkambkcgdaaib
Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\paoponfhfdfnjgddpnpjkambkcgdaaib
Valeur Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [facemoi]
Valeur Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [WebCake Desktop]
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Clé Supprimée : HKLM\SOFTWARE\Classes\Prod.cap
Clé Supprimée : HKLM\SOFTWARE\Classes\speedupmypc
Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc
Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Clé Supprimée : HKLM\SOFTWARE\Classes\CrossriderApp0037180.BHO
Clé Supprimée : HKLM\SOFTWARE\Classes\CrossriderApp0037180.BHO.1
Clé Supprimée : HKLM\SOFTWARE\Classes\CrossriderApp0037180.Sandbox
Clé Supprimée : HKLM\SOFTWARE\Classes\CrossriderApp0037180.Sandbox.1
Clé Supprimée : HKLM\SOFTWARE\5955dddcb634ed40
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{8D5CFE57-B0FD-4396-97A2-DFD0B7DA935B}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{DF84E609-C3A4-49CB-A160-61767DAF8899}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110311711180}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0974BA1E-64EC-11DE-B2A5-E43756D89593}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{58124A0B-DC32-4180-9BFF-E0E21AE34026}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311711180}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0974BA1E-64EC-11DE-B2A5-E43756D89593}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{58124A0B-DC32-4180-9BFF-E0E21AE34026}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE}
Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9D5BD211-422C-4164-9298-BB4186A30F31}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Valeur Supprimée : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe]
Valeur Supprimée : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [C:\Documents and Settings\All Users\Application Data\eSafe\eGdpSvc.exe]
Clé Supprimée : HKCU\Software\BabSolution
Clé Supprimée : HKCU\Software\Crossrider
Clé Supprimée : HKCU\Software\DataMngr
[#] Clé Supprimée : HKCU\Software\DataMngr_Toolbar
Clé Supprimée : HKCU\Software\Delta
Clé Supprimée : HKCU\Software\dsiteproducts
Clé Supprimée : HKCU\Software\InstallCore
Clé Supprimée : HKCU\Software\InstalledBrowserExtensions
Clé Supprimée : HKCU\Software\Plus-HD-3.5
Clé Supprimée : HKLM\Software\DataMngr
Clé Supprimée : HKLM\Software\Delta
Clé Supprimée : HKLM\Software\delta-homesSoftware
Clé Supprimée : HKLM\Software\eSafeSecControl
Clé Supprimée : HKLM\Software\omigaplusSvc
Clé Supprimée : HKLM\Software\Plus-HD-3.5
Clé Supprimée : HKLM\Software\systweak
Clé Supprimée : HKLM\Software\Tarma Installer
Clé Supprimée : HKLM\Software\Uniblue\DriverScanner
Clé Supprimée : HKLM\Software\V9
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Plus-HD-3.5
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Plus-HD-3.5

***** [ Navigateurs ] *****

-\\ Internet Explorer v7.0.6000.21348

Paramètre Restauré : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Paramètre Restauré : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
Paramètre Restauré : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Paramètre Restauré : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Paramètre Restauré : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [bProtectTabs]

-\\ Mozilla Firefox v

[ Fichier : C:\Documents and Settings\ANDROVER\Application Data\Mozilla\Firefox\Profiles\88e23vg6.default\prefs.js ]

-\\ Google Chrome v

[ Fichier : C:\Documents and Settings\ANDROVER\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [10222 octets] - [27/08/2013 13:06:21]
AdwCleaner[S0].txt - [8772 octets] - [27/08/2013 13:07:47]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [8832 octets] ##########

Delta Homes est encore présent ?

--> Relance AdwCleaner et choisis "Désinstaller".

--> Je voudrais un nouveau rapport ZHPDiag.

~ Rapport de ZHPDiag v2013.8.26.36 - Nicolas Coolman (26/08/2013)
~ Lancé par ANDROVER (27/08/2013 22:40:22)
~ Adresse du Site Web https://nicolascoolman.webs.com/
~ Traduit par Nicolas Coolman
~ Etat de la version : Version à jour.
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Not Found

---\\ Navigateurs Internet
MSIE: Internet Explorer v7.0.5730.11
GCIE: Google Chrome v23.0.1271.97 (Defaut)

---\\ Informations sur les produits Windows
~ Langage: Français
Windows XP Home Edition Service Pack 3 (Build 2600)
Windows Automatic Updates : OK
Windows Genuine Advantage : KO

---\\ Logiciels de protection du système
avast! Free Antivirus v8.0.1489.0

---\\ Logiciels d'optimisation du système

---\\ Logiciels de partage PeerToPeer
µTorrent v3.3.0.29625 =>P2P.µTorrent

---\\ Surveillance de Logiciels
Adobe Flash Player 10 Plugin
Adobe Reader XI
Java 7 Update 25

---\\ Informations sur le système
~ Processor: x86 Family 6 Model 15 Stepping 11, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3070 MB (64% free)
System Restore: Désactivé (Disabled)
System drive C: has 154 GB (63%) free of 244 GB

---\\ Mode de connexion au système
~ Computer Name: PC-ANDROVER
~ User Name: ANDROVER
~ All Users Names: SUPPORT_388945a0, HelpAssistant, ASPNET, ANDROVER, Administrateur,
~ Unselected Option: None
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppData% : \
~ %Desktop% : \
~ %Favorites% : \
~ %LocalAppData% : \
~ %StartMenu% : \
~ %Windir% : C:\WINDOWS\
~ %System% : C:\WINDOWS\system32\

---\\ Enumération des unités disques
C:\ Hard drive, Flash drive, Thumb drive (Free 154 Go of 244 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 171 Go of 222 Go)
E:\ CD-ROM drive (Not Inserted)
F:\ Floppy drive, Flash card reader, USB Key (Free 7 Go of 7 Go)

---\\ Etat du Centre de Sécurité Windows
~ Security Center: 33 Legitimates Filtered in 00mn 00s

---\\ Recherche particulière de fichiers génériques
[MD5.F2317622D29F9FF0F88AEECD5F60F0DD] - (.Microsoft Corporation - Explorateur Windows.) (.14/04/2008 - 03:34:03.) -- C:\WINDOWS\Explorer.exe [1037824]
[MD5.56A4B6CCE17EF57E9D5A2E56E062BE83] - (.Microsoft Corporation - Internet Extensions for Win32.) (.25/07/2013 - 19:07:52.) -- C:\WINDOWS\system32\wininet.dll [841216]
[MD5.DD73D6B9F6B4CB630CF35B438B540174] - (.Microsoft Corporation - Application d'ouverture de session Windows NT.) (.14/04/2008 - 03:34:28.) -- C:\WINDOWS\system32\Winlogon.exe [512000]
[MD5.1E44BC1E83D8FD2305F8D452DB109CF9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.17/08/2011 - 14:49:54.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496]
[MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.13/04/2008 - 19:40:30.) -- C:\WINDOWS\system32\Drivers\atapi.sys [96512]
[MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/04/2008 - 20:14:21.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744]
[MD5.1F4260CC5B42272D71F79E570A27A4FE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.13/04/2008 - 19:40:46.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [62976]
[MD5.31F923EB2170FC172C81ABDA0045D18C] - (.Microsoft Corporation - Pilote de cryptographie FIPS.) (.14/04/2008 - 02:57:38.) -- C:\WINDOWS\system32\Drivers\Fips.sys [44672]
[MD5.3FCC124B6E08EE0E9351F717DD136939] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.07/01/2005 - 16:07:18.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [138752]
[MD5.A09BDC4ED10E3B2E0EC27BB94AF32516] - (.Microsoft Corporation - Pilote de port i8042.) (.14/04/2008 - 03:00:52.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [54144]
[MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.13/04/2008 - 19:40:58.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [42112]
[MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.13/04/2008 - 19:57:15.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [152832]
[MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.13/04/2008 - 20:19:42.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [75264]
[MD5.7D304A5EB4344EBEEAB53A2FE3FFB9F0] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.15/07/2011 - 14:29:31.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [456320]
[MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.13/04/2008 - 20:21:00.) -- C:\WINDOWS\system32\Drivers\netBT.sys [162816]
[MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.13/04/2008 - 20:15:53.) -- C:\WINDOWS\system32\Drivers\ntfs.sys [574976]
[MD5.8FD0BDBEA875D06CCF6C945CA9ABAF75] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/04/2008 - 03:09:40.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80384]
[MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13/04/2008 - 20:19:43.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328]
[MD5.15CABD0F7C00C47C70124907916AF3F1] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.13/04/2008 - 19:32:51.) -- C:\WINDOWS\system32\Drivers\rdpdr.sys [196224]
[MD5.D8EB2A7904DB6C916EB5361878DDCBAE] - (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) (.14/04/2008 - 02:57:34.) -- C:\WINDOWS\system32\Drivers\redbook.sys [58752]
[MD5.46DE1126684369BACE4849E4FC8C43CA] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.14/04/2008 - 02:56:04.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [53376]
~ Generic Processes: Scanned in 00mn 00s

---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 0/0
~ Mes musiques (My Musics) : 0/0
~ Mes Videos (My Videos) : 0/0
~ Mes Favoris (My Favorites) : 0/0
~ Mes Documents (My Documents) : 0/0
~ Mon Bureau (My Desktop) : 0/0
~ Menu demarrer (Programs) : 0/0
~ Hidden Files: Scanned in 00mn 00s

---\\ Processus lancés au démarrage du système
[MD5.80A5A61530384C6A3614C745217919DE] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7837184] [PID.2584]
~ Processes Running: Scanned in 00mn 00s

---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
P2 - FPN:Firefox Plugin Navigator . (.BitComet - BitCometAgent v1.27 for Firefox.) -- C:\Program Files\Mozilla Firefox\Plugins\npBitCometAgent.dll =>P2P.BitComet
~ Firefox Browser: 22 Legitimates Filtered in 00mn 00s

---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (...) (No version) -- (.not file.)
R4 - HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,Enabled = 1
~ IE Browser: 10 Legitimates Filtered in 00mn 00s

---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s

---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\WINDOWS\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Keys: Scanned in 00mn 00s

---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 01s
~ Nombre de lignes (Lines number): 15010

---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} . (.MusicLab, LLC - IEHelper.) -- C:\Program Files\BearShare Applications\MediaBar\Datamngr\IEBHO.dll =>PUP.BearShare
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} . (.AVAST Software - IE Webrep plugin.) -- C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll =>Toolbar.Avast
~ BHO: 12 Legitimates Filtered in 00mn 00s

---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: avast! WebRep - [HKLM]{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} . (.AVAST Software - IE Webrep plugin.) -- C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll =>Toolbar.Avast
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{01E04581-4EEE-11D0-BFE9-00AA005B4383} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{0E5CBF21-D15F-11D0-8301-00AA005B4383} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{F2CF5485-4E02-4F68-819C-B92DE9277049} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{21FA44EF-376D-4D53-9B0F-8A89D3229068} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
~ Toolbar: Scanned in 00mn 00s

---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [NvCplDaemon] . (.NVIDIA Corporation - NVIDIA Display Properties Extension.) -- C:\WINDOWS\system32\NvCpl.dll
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.exe (.not file.)
O4 - HKLM\..\Run: [VX1000] . (.Microsoft Corporation - Microsoft LifeCam Device Application.) -- C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [LifeCam] . (.Microsoft Corporation - LifeExp.exe.) -- C:\Program Files\Microsoft LifeCam\LifeExp.exe
O4 - HKLM\..\Run: [nwiz] . (...) -- C:\WINDOWS\system32\nwiz.exe
O4 - HKLM\..\Run: [avast5] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
O4 - HKLM\..\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files\Fichiers communs\Apple\Apple Application Support\APSDaemon.exe
O4 - HKLM\..\Run: [TkBellExe] . (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\program files\real\realplayer\update\realsched.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [RTHDCPL] . (.Realtek Semiconductor Corp. - Realtek HD Audio Control Panel.) -- C:\WINDOWS\RTHDCPL.exe
O4 - HKLM\..\Run: [Alcmtr] . (.Realtek Semiconductor Corp. - Realtek Azalia Audio - Event Monitor.) -- C:\WINDOWS\ALCMTR.exe
O4 - HKLM\..\Run: [RelevantKnowledge] c:\program files\relevantknowledge\rlvknlg.exe (.not file.) =>Adware.RelevantKnowledge
O4 - HKLM\..\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- C:\Program Files\QuickTime\QTTask.exe
O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe
O4 - HKLM\..\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] C:\Documents and Settings\ANDROVER\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (.not file.)
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-21-1229272821-484061587-839522115-1004\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-1229272821-484061587-839522115-1004\..\Run: [Google Update] C:\Documents and Settings\ANDROVER\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (.not file.)
~ Application: Scanned in 00mn 00s

---\\ Autres liens utilisateurs (O4)
O4 - GS\Programs: Adobe Reader XI.lnk . (...) -- C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-AB0000000001}\SC_Reader.ico
O4 - GS\Programs: Apple Software Update.lnk . (...) -- C:\WINDOWS\Installer\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}\AppleSoftwareUpdateIco.exe
O4 - GS\Programs: Dell ResourceCD.lnk - Clé orpheline
O4 - GS\Programs: Paint.NET.lnk . (.dotPDN LLC - Paint.NET.) -- C:\Program Files\Paint.NET\PaintDotNet.exe
O4 - GS\Programs: Windows Live ID.lnk . (.Microsoft Corporation - Sign in Options.) -- C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\SIGNINOPTIONS.exe
O4 - GS\Programs: Windows Movie Maker.lnk . (.Microsoft Corporation - Windows Movie Maker.) -- C:\Program Files\Movie Maker\moviemk.exe
~ Global Startup: Scanned in 00mn 00s

---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -- Clé orpheline
O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -- Clé orpheline
O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe
~ IE Extra Buttons: Scanned in 00mn 00s

---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} ((no name)) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} ((no name)) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} ((no name)) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
~ Objets ActiveX: Scanned in 00mn 00s

---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{A2170897-86A2-48AD-8DDC-FA55F3F8FB2F}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{A2170897-86A2-48AD-8DDC-FA55F3F8FB2F}: DhcpDomain = lan
O17 - HKLM\System\CS1\Services\Tcpip\..\{A2170897-86A2-48AD-8DDC-FA55F3F8FB2F}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{A2170897-86A2-48AD-8DDC-FA55F3F8FB2F}: DhcpDomain = lan
O17 - HKLM\System\CS2\Services\Tcpip\..\{A2170897-86A2-48AD-8DDC-FA55F3F8FB2F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{A2170897-86A2-48AD-8DDC-FA55F3F8FB2F}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS3\Services\Tcpip\..\{A2170897-86A2-48AD-8DDC-FA55F3F8FB2F}: DhcpDomain = lan
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
~ Domain: Scanned in 00mn 00s

---\\ Titr_HJT34=Protocole additionnel (O18)
O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} . (.Microsoft Corporation - WIA Scripting Layer.) -- C:\WINDOWS\system32\wiascr.dll
O18 - Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} . (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS\system32\SHELL32.dll
~ Protocole Additionnel: Scanned in 00mn 00s

---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dll
O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dll
O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agent réseau hors connexion.) -- C:\WINDOWS\system32\cscdll.dll
O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\system32\dimsntfy.dll
O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL secondaire de notification de service d.) -- C:\WINDOWS\system32\sclgntfy.dll
O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\WlNotify.dll
O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll
~ Winlogon: Scanned in 00mn 00s

---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) . (.Pas de propriétaire - RichVideo Module.) - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: {95808DC4-FA4A-4c74-92FE-5B863F82066B} ({95808DC4-FA4A-4c74-92FE-5B863F82066B}) . (.Cyberlink Corp. - FCL Driver.) - C:\Program Files\CyberLink\PowerDVD\000.fcl
~ Services: 14 Legitimates Filtered in 00mn 03s

---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At1.job [460]
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At2.job [460]
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At3.job [460]
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At4.job [460]
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\FinishInstall igdhbblpcellaljokkpfhcjlagemhgjl.job [698]
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\GoforFilesUpdate.job [282] =>P2P.GoforFiles
~ Scheduled Task: 17 Legitimates Filtered in 00mn 00s

---\\ Pilotes lancés au démarrage du système (O41)
O41 - Driver: (vsdatant) . (. - .) - C:\WINDOWS\system32\vsdatant.sys (.not file.)
~ Drivers: 77 Legitimates Filtered in 00mn 00s

---\\ Logiciels installés (O42)
O42 - Logiciel: Image Editor Packages - (...) [HKCU] -- Image Editor Packages
O42 - Logiciel: MediaBar - (.Musiclab, LLC.) [HKLM] -- BearShare MediaBar =>PUP.BearShare
O42 - Logiciel: PhoTags Express - (.PhoTags Inc..) [HKLM] -- PhoTagsExpress
O42 - Logiciel: ResultBar 1.0 build 129 - (...) [HKLM] -- ResultBar
~ Logic: 143 Legitimates Filtered in 00mn 00s

---\\ HKCU & HKLM Software Keys
[HKCU\Software\BearShare] =>PUP.BearShare
[HKCU\Software\BitComet] =>P2P.BitComet
[HKCU\Software\IncrediMail]
[HKCU\Software\PhoTags]
[HKCU\Software\bearsharemediabartb] =>PUP.BearShare
[HKLM\Software\BearShareMediabarTb] =>PUP.BearShare
[HKLM\Software\C3 Developments]
[HKLM\Software\FashionLove]
[HKLM\Software\FileConverter_1.5]
~ Key Software: 276 Legitimates Filtered in 00mn 00s

---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 29/10/2010 - 18:37:04 - [4,036] ----D C:\Program Files\aMule
O43 - CFD: 03/06/2012 - 21:07:17 - [4,546] ----D C:\Program Files\BearShare Applications =>PUP.BearShare
O43 - CFD: 11/09/2012 - 18:04:38 - [0] ----D C:\Program Files\FileConverter_1.5
O43 - CFD: 27/01/2013 - 20:13:35 - [0] ----D C:\Program Files\GUM10.tmp
O43 - CFD: 06/02/2013 - 10:47:18 - [0] ----D C:\Program Files\GUM3C.tmp
O43 - CFD: 20/06/2013 - 17:18:27 - [10,210] ----D C:\Program Files\JustCloud
O43 - CFD: 28/10/2010 - 20:17:59 - [0,000] ----D C:\Program Files\LimeWire
O43 - CFD: 05/08/2012 - 16:11:42 - [77,350] ----D C:\Program Files\PhoTags Express
O43 - CFD: 05/05/2009 - 13:07:34 - [0] ----D C:\Program Files\Playrix Games
O43 - CFD: 25/01/2009 - 17:32:08 - [0,001] ----D C:\Program Files\SoldnerSecretWars
O43 - CFD: 26/04/2012 - 14:21:51 - [0,003] ----D C:\Documents and Settings\All Users\Application Data\33399
O43 - CFD: 10/09/2008 - 09:45:34 - [0,000] ----D C:\Documents and Settings\All Users\Application Data\IM
O43 - CFD: 10/09/2008 - 09:44:31 - [0,012] ----D C:\Documents and Settings\All Users\Application Data\IncrediMail
O43 - CFD: 17/05/2009 - 15:22:57 - [0] ----D C:\Documents and Settings\All Users\Application Data\nView_Profiles
~ Program Folder: 158 Legitimates Filtered in 00mn 00s

---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.BFA13CB4DEA8E7E454244A241A811F92] - 27/08/2013 - 12:11:26 ---A- . (...) -- C:\RTHDCPL_Dump.txt [526]
O44 - LFC:[MD5.19A31EB243B65645E41B0D7C5CF07209] - 27/08/2013 - 12:09:57 ---A- . (...) -- C:\WINDOWS\wiadebug.log [159]
O44 - LFC:[MD5.195943F8335E21977DF1DF112617E011] - 27/08/2013 - 12:09:56 ---A- . (...) -- C:\WINDOWS\wiaservc.log [50]
O44 - LFC:[MD5.F980BFA26589646B6657393470DFBF64] - 15/08/2013 - 16:54:46 ---A- . (...) -- C:\WINDOWS\comsetup.log [645403]
O44 - LFC:[MD5.41DE85C2EAE33C423251B31615105DBC] - 15/08/2013 - 16:54:46 ---A- . (...) -- C:\WINDOWS\iis6.log [352132]
O44 - LFC:[MD5.BC91EED87B24A93F55E93A1BD49FDE07] - 15/08/2013 - 16:54:46 ---A- . (...) -- C:\WINDOWS\imsins.log [1374]
O44 - LFC:[MD5.973758944C69CC2C8B74368BC35FCEC3] - 15/08/2013 - 16:54:46 ---A- . (...) -- C:\WINDOWS\ntdtcsetup.log [389500]
O44 - LFC:[MD5.7A8EEB34C3737C3AEE88C72162795058] - 15/08/2013 - 16:54:46 ---A- . (...) -- C:\WINDOWS\ocmsn.log [105116]
O44 - LFC:[MD5.352B5F524F662761C662C79A37586742] - 15/08/2013 - 16:54:46 ---A- . (...) -- C:\WINDOWS\tsoc.log [856375]
O44 - LFC:[MD5.32A77A49767AA8A3ABC1F5E8CAC2686E] - 15/08/2013 - 16:54:45 ---A- . (...) -- C:\WINDOWS\FaxSetup.log [2230628]
O44 - LFC:[MD5.1755CED7D5DB72D8B7D62DA15A29E513] - 15/08/2013 - 16:54:45 ---A- . (...) -- C:\WINDOWS\msgsocm.log [112163]
O44 - LFC:[MD5.9A0DBD9D642C3164E3B457D4CD0AF5B5] - 15/08/2013 - 16:54:45 ---A- . (...) -- C:\WINDOWS\ocgen.log [1089583]
O44 - LFC:[MD5.CE8DC4173853AE986A1E291295AAE9BB] - 15/08/2013 - 16:54:32 ---A- . (...) -- C:\WINDOWS\imsins.BAK [1374]
O44 - LFC:[MD5.FC6E1A177D2B5DE041D3BBB406F45C60] - 15/08/2013 - 16:54:11 ---A- . (...) -- C:\WINDOWS\system32\TZLog.log [52610]
O44 - LFC:[MD5.0414C763F6A97ADEF9CCAB0DF2DE15F0] - 15/08/2013 - 16:53:59 ---A- . (...) -- C:\WINDOWS\updspapi.log [443142]
~ Files: 34 Legitimates Filtered in 00mn 17s

---\\ Opérations et fonctions au démarrage de Windows Explorer (O46)
O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll
~ ShellExecuteHooks: Scanned in 00mn 00s

---\\ Export de clé d'application autorisée (O47)
O47 - AAKE:Key Export SP - "C:\Program Files\BitComet\BitComet.exe" [Enabled] .(...) -- C:\Program Files\BitComet\BitComet.exe (.not file.) =>P2P.BitComet
O47 - AAKE:Key Export SP - "C:\Program Files\BearShare Applications\BearShare\BearShare.exe" [Enabled] .(...) -- C:\Program Files\BearShare Applications\BearShare\BearShare.exe (.not file.) =>PUP.BearShare
O47 - AAKE:Key Export SP - "E:\data\eSKernel.exe" [Enabled] .(...) -- E:\data\eSKernel.exe (.not file.)
O47 - AAKE:Key Export SP - "C:\Documents and Settings\ANDROVER\Local Settings\Temp\toolbar_vit_sweetim.exe" [Enabled] .(...) -- C:\Documents and Settings\ANDROVER\Local Settings\Temp\toolbar_vit_sweetim.exe (.not file.) =>PUP.SweetIM
O47 - AAKE:Key Export SP - "C:\Documents and Settings\ANDROVER\Mes documents\Downloads\AA_v3.exe" [Enabled] .(...) -- C:\Documents and Settings\ANDROVER\Mes documents\Downloads\AA_v3.exe (.not file.)
O47 - AAKE:Key Export SP - "C:\Program Files\GoforFiles\goforfilesdl.exe" [Enabled] .(...) -- C:\Program Files\GoforFiles\goforfilesdl.exe (.not file.) =>P2P.GoforFiles
O47 - AAKE:Key Export SP - "C:\Program Files\GoforFiles\GoforFiles.exe" [Enabled] .(...) -- C:\Program Files\GoforFiles\GoforFiles.exe (.not file.) =>P2P.GoforFiles
O47 - AAKE:Key Export DP - "C:\Program Files\BearShare Applications\BearShare\BearShare.exe" [Enabled] .(...) -- C:\Program Files\BearShare Applications\BearShare\BearShare.exe (.not file.) =>PUP.BearShare
~ Keys Export: 24 Legitimates Filtered in 00mn 00s

---\\ Image File Execution Options (IFEO) (O50)
O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d
~ IFEO: Scanned in 00mn 00s

---\\ Enumération des clés de registre StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\IncrediMail [Key] . (...) -- C:\Program Files\IncrediMail\bin\IncMail.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\TkBellExe [Key] . (...) -- C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe (.not file.)
~ SMSR Keys: 15 Legitimates Filtered in 00mn 00s

---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKCU\...\Policies\System] - "SetVisualStyle"=
~ MWPS: 6 Legitimates Filtered in 00mn 00s

---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.4AF5F360BA1E8794D32B366E45A64A0A] - 09/05/2013 - 09:59:08 ---A- . (.AVAST Software - avast! File System Access Blocking Driver.) -- C:\WINDOWS\system32\Drivers\aswFsBlk.sys [29816]
O58 - SDL:[MD5.6D3ADA4CE95CECA7BCE527A08C4C474E] - 05/08/2004 - 13:00:00 ---A- . (...) -- C:\WINDOWS\system32\ansi.sys [9037]
~ Drivers: 6 Legitimates Filtered in 00mn 00s

---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
~ ADS: Scanned in 00mn 00s

---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 13/07/2001 - Pas de propriétaire (SBKUPNT) .(...) - LEGACY_SBKUPNT
~ Legacy: 155 Legitimates Filtered in 00mn 01s

---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 17 Legitimates Filtered in 00mn 00s

---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <chrome.exe> <>[HKLM\..\Shell\open\Command] (...) -- C:\Documents and Settings\ANDROVER\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" http://www.delta-homes.com =>Toolbar.DeltaSearch
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (...) -- C:\Program Files\Google\Chrome\Application\chrome.exe (.not file.)
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s

---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {0B1A8ACD-E262-4727-8462-4D38612C516F} - (Google) - https://www.google.com/?gws_rd=ssl
O69 - SBI: SearchScopes [HKCU] {4DAF305D-DFF3-47F9-ADCC-71A542D93E20} - (Recherche 01net.com) - https://www.01net.com/
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {8C7F4742-E900-49C4-A34C-E13B54D270B5} - (Rercherche d'articles 01net.com) - https://www.01net.com/
O69 - SBI: SearchScopes [HKCU] {8FF6AA4C-0E6F-4076-9F7C-89A1267DC79D} - (Recherche produits informatique 01net.com) - https://www.01net.com/
O69 - SBI: SearchScopes [HKCU] {97D01804-FCA6-4D65-8E14-F62823791E07} - (Recherche de téléchargements 01net.com) - https://www.01net.com/
O69 - SBI: SearchScopes [HKCU] {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} - (Web Search) - http://search.bearshare.net/ =>PUP.BearShare
O69 - SBI: SearchScopes [HKCU] {C1A3DF32-E1F4-4962-84C0-3CCEEB564C72} - (Google) - https://www.google.com/?gws_rd=ssl
O69 - SBI: SearchScopes [HKCU] {E0E4D942-C1DA-4723-A014-F43A985BB3EB} - (Search the web (Softonic)) - https://en.softonic.com =>Adware.IMBooster
O69 - SBI: SearchScopes [HKUS\.DEFAULT] {100CDAC4-F524-492B-BE51-DA717EC0ACEC} - (Recherche de téléchargements 01net.com) - https://www.01net.com/
O69 - SBI: SearchScopes [HKUS\.DEFAULT] {2750E757-C233-49E0-9358-40A9B90DB408} - (Recherche 01net.com) - https://www.01net.com/
O69 - SBI: SearchScopes [HKUS\.DEFAULT] {3F607418-B5A5-405D-A4A5-A56E78654F2B} - (Recherche produits informatique 01net.com) - https://www.01net.com/
O69 - SBI: SearchScopes [HKUS\.DEFAULT] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Google) - https://www.google.com/?gws_rd=ssl
O69 - SBI: SearchScopes [HKUS\.DEFAULT] {7ECD67B5-016A-4EE2-AC0A-701DD31113F7} - (Rercherche d'articles 01net.com) - https://www.01net.com/
O69 - SBI: SearchScopes [HKUS\S-1-5-18] {100CDAC4-F524-492B-BE51-DA717EC0ACEC} - (Recherche de téléchargements 01net.com) - https://www.01net.com/
O69 - SBI: SearchScopes [HKUS\S-1-5-18] {2750E757-C233-49E0-9358-40A9B90DB408} - (Recherche 01net.com) - https://www.01net.com/
O69 - SBI: SearchScopes [HKUS\S-1-5-18] {3F607418-B5A5-405D-A4A5-A56E78654F2B} - (Recherche produits informatique 01net.com) - https://www.01net.com/
O69 - SBI: SearchScopes [HKUS\S-1-5-18] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Google) - https://www.google.com/?gws_rd=ssl
O69 - SBI: SearchScopes [HKUS\S-1-5-18] {7ECD67B5-016A-4EE2-AC0A-701DD31113F7} - (Rercherche d'articles 01net.com) - https://www.01net.com/
~ Keys: Scanned in 00mn 00s

---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.C37C1B3F6505BD3A7F5AAE8B71973902] [SPRF][05/08/2004] (...) -- \Bootfont.bin [4952]
[MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][30/12/1899] (...) -- \pagefile.sys [4831838208]
[MD5.C37C1B3F6505BD3A7F5AAE8B71973902] [SPRF][05/08/2004] (...) -- \Bootfont.bin [4952]
[MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][30/12/1899] (...) -- \pagefile.sys [4831838208]
[MD5.C37C1B3F6505BD3A7F5AAE8B71973902] [SPRF][05/08/2004] (...) -- \Bootfont.bin [4952]
[MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][30/12/1899] (...) -- \pagefile.sys [4831838208]
~ Files: 9 Legitimates Filtered in 00mn 00s

---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.AD380B886A7681F99CED3311D0639F9A] [WIS][11/06/2013] (.Boxore OU - Boxore Client Installer.) -- C:\Windows\Installer\1054ab2.msi [474112] =>Adware.Boxore
[MD5.85C5DEF2B079CA6E8CA7FCBD45793BEF] [WIS][24/09/2012] (.SweetIM Technologies Ltd. - Sweetpacks Communicator 1.0.) -- C:\Windows\Installer\1191e8d.msi [2243584] =>PUP.SweetIM
[MD5.72DFEF0124AD3FD20310347D67C395E0] [WIS][01/05/2009] (.AGEIA Technologies, Inc. - Install/UnInstall PhysX Driver + Engines: 2.3.1/2/3; 2.4.0/1/4;.) -- C:\Windows\Installer\204f2f1.msi [1535488]
[MD5.3CD19859CD377AD00B30E4BEE49D374E] [WIS][25/09/2012] (.SweetIM Technologies Ltd. - Sweetpacks Communicator 1.1.) -- C:\Windows\Installer\32d34.msi [2997248] =>PUP.SweetIM
[MD5.58D66700C6BE261B4DE68ED3BCE2FA8C] [WIS][15/10/2012] (.Boxore OU. - Software Update Helper.) -- C:\Windows\Installer\8c659a.msi [24576] =>Adware.Boxore
[MD5.A5FA0FEAE35FBD4FA8F73B5498381DA4] [WIS][24/03/2013] (.Tuguu SL - .) -- C:\Windows\Installer\96277a.msi [2314752] =>PUP.VAFPlayer
~ WIS: 68 Legitimates Filtered in 00mn 31s

---\\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Demand 20/08/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 21/12/2012 57008 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 09/05/2013 46808 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
SR - | Auto 30/08/2011 390504 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Demand 14/04/2008 225280 | (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\system32\dmadmin.exe
SR - | Auto 30/06/2012 136176 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SR - | Demand 30/06/2012 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SR - | Demand 16/08/2013 553288 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SR - | Auto 12/06/2013 182184 | (JavaQuickStarterService) . (.Oracle Corporation.) - C:\Program Files\Java\jre7\bin\jqs.exe
SR - | Auto 09/06/2013 1777488 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe
SR - | Auto 05/12/2007 155716 | (NVSvc) . (.NVIDIA Corporation.) - C:\WINDOWS\system32\nvsvc32.exe
SR - | Auto 04/01/2009 66872 | (PnkBstrA) . (...) - C:\WINDOWS\system32\PnkBstrA.exe
SR - | Auto 04/01/2009 103736 | (PnkBstrB) . (...) - C:\WINDOWS\system32\PnkBstrB.exe
SR - | Auto 29/11/2012 38608 | (RealNetworks Downloader Resolver Service) . (...) - C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
SR - | Auto 07/02/2007 173616 | (RichVideo) . (...) - C:\Program Files\CyberLink\Shared files\RichVideo.exe
SR - | Auto 02/10/2012 3064000 | (Skype C2C Service) . (.Skype Technologies S.A..) - C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
SR - | Auto 03/06/2013 162408 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe
SR - | Demand 11/07/2007 69632 | (stllssvr) . (.MicroVision Development, Inc..) - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
SR - | Auto 02/11/2006 13560 | ({95808DC4-FA4A-4c74-92FE-5B863F82066B}) . (.Cyberlink Corp..) - C:\Program Files\CyberLink\PowerDVD\000.fcl
~ Services: Scanned in 00mn 31s

---\\ Recherche dinfection sur le Master Boot Record (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by ANDROVER at 27/08/2013 22:41:53

device: opened successfully
user: error reading MBR

Disk trace:
error: Read Descripteur non valide
kernel: error reading MBR
~ MBR: 9 Legitimates Filtered in 00mn 02s

---\\ Scan Additionnel (O88)
Database Version : v2.12866 - (26/08/2013)
Clés trouvées (Keys found) : 8
Valeurs trouvées (Values found) : 2
Dossiers trouvés (Folders found) : 2
Fichiers trouvés (Files found) : 10

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{74322BF9-DF26-493F-B0DA-6D2FC5E6429E}] =>PUP.BearShare^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48BF-AC2D-D17F00898D06}] =>Toolbar.Avast^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\BearShare MediaBar] =>PUP.BearShare^
[HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220322712280}] =>PUP.CrossRider
[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110111991162}] =>PUP.CrossRider
[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110111991162}] =>PUP.CrossRider
[HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\SRS_IT_E8790477B6765B5130AD92] =>Adware.ShopperReports
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}] =>Adware.Bandoo^
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} =>Toolbar.Avast^
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:RelevantKnowledge =>Adware.RelevantKnowledge^
C:\Program Files\BearShare Applications =>PUP.BearShare^
C:\Documents and Settings\ANDROVER\Local Settings\Application Data\Temp\Iminent =>Adware.IMBooster
C:\Program Files\BearShare Applications\MediaBar\Datamngr\IEBHO.dll =>PUP.BearShare^
C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll =>Toolbar.Avast^
[HKCU\Software\BearShare] =>PUP.BearShare^
[HKCU\Software\bearsharemediabartb] =>PUP.BearShare^
[HKLM\Software\BearShareMediabarTb] =>PUP.BearShare^
C:\Windows\Installer\1054ab2.msi =>Adware.Boxore^
C:\Windows\Installer\1191e8d.msi =>PUP.SweetIM^
C:\Windows\Installer\32d34.msi =>PUP.SweetIM^
C:\Windows\Installer\8c659a.msi =>Adware.Boxore^
C:\Windows\Installer\96277a.msi =>PUP.VAFPlayer^
~ Additionnel Scan: 261154 Items scanned in 00mn 22s

---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com26705717-pup-bearshare =>PUP.BearShare
~ http://nicolascoolman.webs.com30898585-toolbar-avast =>Toolbar.Avast
~ http://nicolascoolman.webs.com27456165-adware-relevantknowledge =>Adware.RelevantKnowledge
~ http://nicolascoolman.webs.com29216159-pup-sweetim =>PUP.SweetIM
~ http://nicolascoolman.webs.com27875657-toolbar-deltasearch =>Toolbar.DeltaSearch
~ http://nicolascoolman.webs.com26684723-adware-imbooster =>Adware.IMBooster
~ http://nicolascoolman.webs.com26626977-adware-boxore =>Adware.Boxore
~ http://nicolascoolman.webs.com30392620-pup-vafplayer =>PUP.VAFPlayer
~ http://nicolascoolman.webs.com27583526-pup-crossrider =>PUP.CrossRider
~ http://nicolascoolman.webs.com26611092-adware-bandoo =>Adware.Bandoo
~ MSI: 10 link(s) detected in 00mn 22s

~ 1076 Legitimates filtered by white list
End of the scan (552 lines in 01mn 56s)(0)

--> Copie tout le texte présent en gras ci-dessous (Sélectionne-le, clique droit dessus et choisis "Copier").

SysRestore
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} . (.MusicLab, LLC - IEHelper.) -- C:\Program Files\BearShare Applications\MediaBar\Datamngr\IEBHO.dll
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
O4 - HKLM\..\Run: [RelevantKnowledge] c:\program files\relevantknowledge\rlvknlg.exe (.not file.)
OPT:O4 - HKLM\..\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- C:\Program Files\QuickTime\QTTask.exe
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\FinishInstall igdhbblpcellaljokkpfhcjlagemhgjl.job [698]
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\GoforFilesUpdate.job [282]
O41 - Driver: (vsdatant) . (. - .) - C:\WINDOWS\system32\vsdatant.sys (.not file.)
O42 - Logiciel: MediaBar - (.Musiclab, LLC.) [HKLM] -- BearShare MediaBar
O42 - Logiciel: ResultBar 1.0 build 129 - (...) [HKLM] -- ResultBar
[HKCU\Software\BearShare]
[HKCU\Software\bearsharemediabartb]
[HKLM\Software\BearShareMediabarTb]
[HKLM\Software\FileConverter_1.5]
O43 - CFD: 03/06/2012 - 21:07:17 - [4,546] ----D C:\Program Files\BearShare Applications
O43 - CFD: 11/09/2012 - 18:04:38 - [0] ----D C:\Program Files\FileConverter_1.5
O43 - CFD: 27/01/2013 - 20:13:35 - [0] ----D C:\Program Files\GUM10.tmp
O43 - CFD: 06/02/2013 - 10:47:18 - [0] ----D C:\Program Files\GUM3C.tmp
O47 - AAKE:Key Export SP - "C:\Program Files\BearShare Applications\BearShare\BearShare.exe" [Enabled] .(...) -- C:\Program Files\BearShare Applications\BearShare\BearShare.exe (.not file.)
O47 - AAKE:Key Export SP - "C:\Documents and Settings\ANDROVER\Local Settings\Temp\toolbar_vit_sweetim.exe" [Enabled] .(...) -- C:\Documents and Settings\ANDROVER\Local Settings\Temp\toolbar_vit_sweetim.exe (.not file.)
O47 - AAKE:Key Export SP - "C:\Program Files\GoforFiles\goforfilesdl.exe" [Enabled] .(...) -- C:\Program Files\GoforFiles\goforfilesdl.exe (.not file.)
O47 - AAKE:Key Export SP - "C:\Program Files\GoforFiles\GoforFiles.exe" [Enabled] .(...) -- C:\Program Files\GoforFiles\GoforFiles.exe (.not file.)
O47 - AAKE:Key Export DP - "C:\Program Files\BearShare Applications\BearShare\BearShare.exe" [Enabled] .(...) -- C:\Program Files\BearShare Applications\BearShare\BearShare.exe (.not file.)
OPT:O68 - StartMenuInternet: <chrome.exe> <>[HKLM\..\Shell\open\Command] (...) -- C:\Documents and Settings\ANDROVER\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" http://www.delta-homes.com
O69 - SBI: SearchScopes [HKCU] {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} - (Web Search) - http://search.bearshare.net/
O69 - SBI: SearchScopes [HKCU] {E0E4D942-C1DA-4723-A014-F43A985BB3EB} - (Search the web (Softonic)) - https://en.softonic.com
[MD5.AD380B886A7681F99CED3311D0639F9A] [WIS][11/06/2013] (.Boxore OU - Boxore Client Installer.) -- C:\Windows\Installer\1054ab2.msi [474112]
[MD5.85C5DEF2B079CA6E8CA7FCBD45793BEF] [WIS][24/09/2012] (.SweetIM Technologies Ltd. - Sweetpacks Communicator 1.0.) -- C:\Windows\Installer\1191e8d.msi [2243584]
[MD5.3CD19859CD377AD00B30E4BEE49D374E] [WIS][25/09/2012] (.SweetIM Technologies Ltd. - Sweetpacks Communicator 1.1.) -- C:\Windows\Installer\32d34.msi [2997248]
[MD5.58D66700C6BE261B4DE68ED3BCE2FA8C] [WIS][15/10/2012] (.Boxore OU. - Software Update Helper.) -- C:\Windows\Installer\8c659a.msi [24576]
[MD5.A5FA0FEAE35FBD4FA8F73B5498381DA4] [WIS][24/03/2013] (.Tuguu SL - .) -- C:\Windows\Installer\96277a.msi [2314752]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{74322BF9-DF26-493F-B0DA-6D2FC5E6429E}]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\BearShare MediaBar]
[HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220322712280}]
[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110111991162}]
[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110111991162}]
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}]
C:\Documents and Settings\ANDROVER\Local Settings\Application Data\Temp\Iminent
[HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\SRS_IT_E8790477B6765B5130AD92]
ProxyFix
EmptyFlash
EmptyTemp

--> Puis lance ZHPFix depuis le raccourci situé sur ton Bureau.

--> Clique sur le bouton "Coller le presse-papier".

--> Clique sur "GO" pour lancer le nettoyage. Laisse l'outil travailler et ne touche à rien.

--> Accepte la désinstallation des programmes si proposé, mais refuse le redémarrage de ton PC si également proposé, car cela stopperait ZHPFix.

--> Une fois terminé, copie-colle le rapport dans ton prochain message.

bjr es ce que je suis obligée de le faire si cela fonctionne sans faire cette manip? ca remarche depuis la manip d'avant merci

Oui, c'est mieux.