Sujet Précédent Sujet Suivant

Retirer virus qone8

tof197959 Messages postés 4 Statut Membre -  
kingk06 Messages postés 10790 Statut Membre -
Bonjour,

J'ai un virus qone8 comment le retirer svp j'ai besoin d'aide je n'ai pas encore sauvegardé mon PC.
A voir également:

24 réponses

Précédent
  • 1
  • 2
Réponse 21 / 24
tof197959
 
~ Rapport de ZHPDiag v2013.11.22.46 - Nicolas Coolman (22/11/2013)
~ Lancé par christophe (23/11/2013 11:44:08)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user

---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16736
GCIE: Google Chrome v31.0.1650.57 (Defaut)

---\\ Informations sur les produits Windows
~ Langage: Français
Windows 8 Home Premium Edition, 64-bit (Build 9200)
Windows Server License Manager Script : OK
~ ion : Windows(R) Operating System, OEM_DM channel
Windows ID Activation : OK
~ Windows Partial Key : FJMQ6
Windows License : OK
~ Windows Remaining Initializations Number : 1000
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ Logiciels de protection du système
Kaspersky Internet Security v14.0.0.4651
Malwarebytes Anti-Malware version 1.75.0.1300
Windows Defender W8

---\\ Logiciels d'optimisation du système

---\\ Logiciels de partage PeerToPeer

---\\ Surveillance de Logiciels
Adobe Flash Player 11 Plugin
Adobe Reader XI

---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 58 Stepping 9, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3965 MB (54% free)
System Restore: Activé (Enable)
System drive C: has 315 GB (69%) free of 451 GB

---\\ Mode de connexion au système
~ Computer Name: TOTO
~ User Name: christophe
~ All Users Names: HomeGroupUser$, christophe, Administrateur,
~ Unselected Option: None
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\christophe\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\christophe\AppData\Roaming\
~ %Desktop% : C:\Users\christophe\Desktop\
~ %Favorites% : C:\Users\christophe\Favorites\
~ %LocalAppData% : C:\Users\christophe\AppData\Local\
~ %StartMenu% : C:\Users\christophe\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 315 Go of 451 Go)
D: CD-ROM drive (Not Inserted)
X: Hard drive, Flash drive, Thumb drive (Free 0 Go of 13 Go)
Y: Hard drive, Flash drive, Thumb drive (Free 0 Go of 0 Go)

---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 41 Legitimates Filtered in 00mn 00s

---\\ Recherche particulière de fichiers génériques
[MD5.0E8E6463F81C80AFBED533E0F1F8895D] - (.Microsoft Corporation - Explorateur Windows.) (.01/06/2013 - 12:34:21.) -- C:\Windows\Explorer.exe [2391280]
[MD5.FE9AB232B56A12224E8A3F3F9878C9A3] - (.Microsoft Corporation - Application de démarrage de Windows.) (.26/07/2012 - 04:08:50.) -- C:\Windows\System32\Wininit.exe [132608]
[MD5.9706C99DAEBE3FEAC811B239617E98C4] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.12/10/2013 - 09:45:20.) -- C:\Windows\System32\wininet.dll [2241536]
[MD5.BCF2036A0DD579E47C008C133550283E] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.01/03/2013 - 16:06:16.) -- C:\Windows\System32\Winlogon.exe [517120]
[MD5.9448F5740A037EC0C18F0E9177232DD0] - (.Microsoft Corporation - Bibliothèque de licences.) (.26/07/2012 - 04:07:20.) -- C:\Windows\System32\sppcomapi.dll [273408]
[MD5.7C0E0EDF18D6CC565D7BFBB451709FA5] - (.Microsoft Corporation - Pilote de fonction connexe pour WinSock.) (.04/09/2013 - 04:11:23.) -- C:\Windows\system32\Drivers\AFD.sys [576512]
[MD5.A721FF570C2387E383BDDEA9632863C9] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.26/07/2012 - 06:00:48.) -- C:\Windows\system32\Drivers\atapi.sys [25840]
[MD5.990B1BABE6E81FB18E65A87EBEFB1772] - (.Microsoft Corporation - CD-ROM File System Driver.) (.26/07/2012 - 03:30:10.) -- C:\Windows\system32\Drivers\Cdfs.sys [108544]
[MD5.339BFF85D788268752DA8C9644B188EE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.26/07/2012 - 03:26:36.) -- C:\Windows\system32\Drivers\Cdrom.sys [174080]
[MD5.09D9EB9E7898F8E6561473A20CC808B9] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.26/07/2012 - 03:26:53.) -- C:\Windows\system32\Drivers\DfsC.sys [118784]
[MD5.7D87B5B6C7188D553E11B59DC7F0B111] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/09/2012 - 07:08:44.) -- C:\Windows\system32\Drivers\HDAudBus.sys [71168]
[MD5.C9E9CBF73AFFBFE3E801EFB516787BA3] - (.Microsoft Corporation - Pilote de port i8042.) (.26/07/2012 - 03:28:51.) -- C:\Windows\system32\Drivers\i8042prt.sys [112640]
[MD5.3969B9C218DD3FAA9F4ED2FFC3651C02] - (.Microsoft Corporation - IP Network Address Translator.) (.26/07/2012 - 03:23:01.) -- C:\Windows\system32\Drivers\IpNat.sys [145920]
[MD5.93179D48066918323628CB016D8C94DC] - (.Microsoft Corporation - Minirdr SMB Windows NT.) (.05/02/2013 - 23:29:09.) -- C:\Windows\system32\Drivers\MRxSmb.sys [370688]
[MD5.7CEC25C682D319D484630B3952C31A11] - (.Microsoft Corporation - MBT Transport driver.) (.26/07/2012 - 03:24:28.) -- C:\Windows\system32\Drivers\netBT.sys [331776]
[MD5.76929F4A69E425911A63B407E26C2589] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.02/02/2013 - 11:54:54.) -- C:\Windows\system32\Drivers\ntfs.sys [1933544]
[MD5.4563DAF8C6A740AD7F501E219BD10766] - (.Microsoft Corporation - Pilote de port parallèle.) (.26/07/2012 - 03:29:53.) -- C:\Windows\system32\Drivers\Parport.sys [105984]
[MD5.A14D625C5AEE5FFE0F47D1A1D419FAAE] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.26/07/2012 - 03:23:17.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [124928]
[MD5.B2A3AD74FF2E2FFA73AF2567108231B3] - (.Microsoft Corporation - Redirecteur de périphérique de Microsoft RDP.) (.26/07/2012 - 03:25:18.) -- C:\Windows\system32\Drivers\rdpdr.sys [179712]
[MD5.73DC722CE5DF26D7638CE2446F2655C7] - (.Microsoft Corporation - TDI Translation Driver.) (.26/07/2012 - 06:26:47.) -- C:\Windows\system32\Drivers\tdx.sys [117248]
[MD5.78A5BBA3819FFFC62FFEC3E2220D102D] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.01/06/2013 - 12:26:33.) -- C:\Windows\system32\Drivers\volsnap.sys [327936]
~ Generic Processes: Scanned in 00mn 00s

---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/44
~ Mes musiques (My Musics) : 1/4759
~ Mes Favoris (My Favorites) : 1/7
~ Mes Documents (My Documents) : 1/371
~ Mon Bureau (My Desktop) : 2/3729
~ Menu demarrer (Programs) : 1/31
~ Hidden Files: Scanned in 00mn 13s

---\\ Processus lancés
[MD5.3C7704D641F4B986A1BB61BE8B8A90EA] - (.Kaspersky Lab ZAO - Kaspersky Anti-Virus.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe [992448] [PID.11400]
[MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.5564]
[MD5.9B9CBDCE74E0AC4969E23575B72629C7] - (.SoftThinks - Dell - Dell Backup And Recovery Toaster.) -- C:\Program Files (x86)\Dell Backup and Recovery\TOASTER.exe [4037480] [PID.8560]
[MD5.375AE420C0320F723E64C792D9FC00DE] - (.SoftThinks - Dell - Dell Backup And Recovery Update Launcher.) -- C:\Program Files (x86)\Dell Backup and Recovery\Components\DBRUpdate\DBRUpd.exe [491880] [PID.13488]
[MD5.224F6B374852153C8C24BED141AE3A20] - (...) -- ysWOW64\rundll32.exe [0] [PID.6252]
[MD5.FF2CE3EC0F87A69B2F61EF9D89514800] - (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504] [PID.18276]
[MD5.06BC146E6C2E881A7235A142BA877B82] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8262144] [PID.9328]
[MD5.636D97B3BAF854511FF3F4093E895FED] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [863184] [PID.10648]
~ Processes Running: Scanned in 00mn 00s

---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\christophe\AppData\Local\Google\Chrome\User Data\Default\Preferences
G1 - GCS: Preference [User Data\Default] http://start.iminent.com =>Adware.IMBooster
G2 - GCE: Preference [User Data\Default] [dchlnpcodkpfdpacogkljefecpegganj] URL Advisor v.14.0.0.4651 (Désactivé)
G2 - GCE: Preference [User Data\Default] [dedmngkbaffkenlfdcbganndoghblmap] BetterSurf v.1.0 (Désactivé) =>PUP.BetterSurf
G2 - GCE: Preference [User Data\Default] [flpcjncodpafbgdpnkljologafpionhb] Managera v.0.1 (Activé)
G2 - GCE: Preference [User Data\Default] [gfdkimpbcpahaombhbimeihdjnejgicl] Feedback v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [hakdifolhalapjijoafobooafbilfakh] Protection bancaire v.14.0.0.4651 (Désactivé)
G2 - GCE: Preference [User Data\Default] [hghkgaeecgjhjkannahfamoehjmkjail] Module de blocage des sites Internet dangereux v.14.0.0.4651 (Désactivé)
G2 - GCE: Preference [User Data\Default] [igdhbblpcellaljokkpfhcjlagemhgjl] Iminent v.7.47.2.1, (Activé) =>Adware.IMBooster
G2 - GCE: Preference [User Data\Default] [jagncdcchgajhfhijbbhecadmaiegcmh] Virtual Keyboard v.14.0.0.4794 (Désactivé)
~ Google Browser: 23 Legitimates Filtered in 00mn 04s

---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s

---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s

---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21

---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: DJUCED 18.lnk . (.Guillemot Corporation - DJUCED18.) -- C:\Program Files (x86)\DJUCED 18\DJUCED18.exe
O4 - GS\Desktop [Public]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [Public]: Kaspersky Internet Security.lnk . (.Kaspersky Lab ZAO - Kaspersky Anti-Virus.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
O4 - GS\Program [Public]: Desktop.lnk - Clé orpheline
O4 - GS\QuickLaunch [christophe]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [christophe]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch [christophe]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\christophe\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\TaskBar [christophe]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Program [christophe]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Program [christophe]: Kaspersky Internet Security.lnk . (.Kaspersky Lab ZAO - Kaspersky Anti-Virus.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
O4 - GS\Desktop [christophe]: Search.lnk . (...) -- C:\ProgramData\DSearchLink\DSearchLink.exe (.not file.) =>Toolbar.DeltaSearch
O4 - GS\Desktop [christophe]: VirtualDJ Home FREE.lnk . (.Atomix Productions - VirtualDJ.) -- C:\Program Files (x86)\VirtualDJ\virtualdj_home.exe
~ Global Startup: 44 Legitimates Filtered in 00mn 01s

---\\ Applications lancées au démarrage du sytème (O4)
O4 - HKLM\..\Run: [DellWPF] Clé orpheline
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] . (.Dell Inc. - DW WLAN Card Wireless Network Tray Applet.) -- C:\Program Files\Dell\DW WLAN Card\WLTRAY.exe
O4 - HKCU\..\Run: [NextLive] . (.NewNextDotMe - NewNext Helper Engine.) -- C:\Users\christophe\AppData\Roaming\newnext.me\nengine.dll
O4 - HKCU\..\RunOnce: [Application Restart #0] . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - HKLM\..\Wow6432Node\Run: [IAStorIcon] . (.Intel Corporation - Delayed launcher.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe
O4 - HKLM\..\Wow6432Node\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (.not file.)
O4 - HKLM\..\Wow6432Node\Run: [tuto4pc_fr_62] Clé orpheline =>PUP.Eorezo
O4 - HKLM\..\Wow6432Node\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [Hercules DJ Series] . (.Hercules® - DJ Series Control Panel.) -- C:\Program Files\Hercules\Audio\DJ Console Series\HDJSeriesCPL.exe
O4 - HKUS\S-1-5-21-2927404278-3525996856-1473883911-1001\..\Run: [NextLive] . (.NewNextDotMe - NewNext Helper Engine.) -- C:\Users\christophe\AppData\Roaming\newnext.me\nengine.dll
O4 - HKUS\S-1-5-21-2927404278-3525996856-1473883911-1001\..\RunOnce: [Application Restart #0] . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
~ Application: Scanned in 00mn 00s

---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Clavier virtuel [64Bits] - {0C4CC089-D306-440D-9772-464E226F6539} . (...) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\kbrd.ico
O9 - Extra button: Analyse des liens [64Bits] - {CCF151D8-D089-449F-A5A4-D9909053F20F} . (...) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\logo.ico
~ IE Extra Buttons: Scanned in 00mn 00s

---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{7D5EED28-10D6-4FF9-88E7-31CAADB9C68E}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{7D5EED28-10D6-4FF9-88E7-31CAADB9C68E}: DhcpDomain = lan
O17 - HKLM\System\CS1\Services\Tcpip\..\{7D5EED28-10D6-4FF9-88E7-31CAADB9C68E}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{7D5EED28-10D6-4FF9-88E7-31CAADB9C68E}: DhcpDomain = lan
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
~ Domain: Scanned in 00mn 00s

---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s

---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s

---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\ViewPassword Update.job [418] =>PUP.ViewPassword
[MD5.00000000000000000000000000000000] [APT] [ViewPassword Update] (...) -- C:\Program Files (x86)\ViewPassword\ViewPassword.exe (.not file.) [0] =>PUP.ViewPassword
~ Scheduled Task: 13 Legitimates Filtered in 00mn 06s

---\\ Logiciels installés (O42)
O42 - Logiciel: DJUCED 18° - (.Guillemot.) [HKLM][64Bits] -- {34F730A3-77BA-4741-A02A-D40762FEF274}
O42 - Logiciel: ViewPassword - (.ViewPassword Software.) [HKLM][64Bits] -- {363a1ea4-c27d-4260-a792-e77f47ca032d} =>PUP.ViewPassword
~ Logic: 63 Legitimates Filtered in 00mn 00s

---\\ HKCU & HKLM Software Keys
[HKCU\Software\Conduit] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\BetterSurf] =>PUP.BetterSurf
~ Key Software: 148 Legitimates Filtered in 00mn 00s

---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 14/11/2013 - 14:34:07 - [0,089] ----D C:\Program Files (x86)\BetterSurf =>PUP.BetterSurf
O43 - CFD: 21/10/2013 - 16:06:57 - [31,022] ----D C:\Program Files (x86)\DJUCED 18
O43 - CFD: 23/11/2013 - 11:42:43 - [1,228] ----D C:\Users\christophe\AppData\Roaming\newnext.me
O43 - CFD: 29/09/2013 - 10:11:44 - [0] ----D C:\Users\christophe\AppData\Roaming\wam
O43 - CFD: 29/09/2013 - 10:11:44 - [0,941] ----D C:\Users\christophe\AppData\Roaming\wam.04351C371E530C3762CBA45FA283ED972DCDEFB6.1
O43 - CFD: 21/11/2013 - 10:29:33 - [1,224] ----D C:\Users\christophe\AppData\Local\genienext
~ Program Folder: 127 Legitimates Filtered in 00mn 14s

---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.4E2BF7554472D703258D8B32226F2608] - 14/11/2013 - 14:34:50 ---A- . (...) -- C:\Windows\wininit.ini [131]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 14/11/2013 - 14:34:50 ---A- . (...) -- C:\extensions.sqlite [0]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 21/11/2013 - 10:23:31 ---A- . (...) -- C:\END [0]
~ Files: 99 Legitimates Filtered in 00mn 06s

---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.FA7A396DC4814D3AB9F32A7BF42F505F] - 04/11/2013 - 22:00:17 ---A- - C:\Windows\Prefetch\AUTHHOST.EXE-7385F8D7.pf
O45 - LFCP:[MD5.1FCCF1AAE24E976DABC5616D9FE816B1] - 10/11/2013 - 20:10:47 ---A- - C:\Windows\Prefetch\MYPC BACKUP.EXE-EFC95E5E.pf =>PUP.MyPCBackup
O45 - LFCP:[MD5.12E6476CC0C212524013F096E07A8928] - 11/11/2013 - 12:50:16 ---A- - C:\Windows\Prefetch\BUBBLE DOCK ADDONSUI.EXE-63E03FBE.pf =>PUP.BubbleDock
O45 - LFCP:[MD5.3CC877E0E08256386FA39650D6713A54] - 12/11/2013 - 16:07:30 ---A- - C:\Windows\Prefetch\INSTUP.EXE-3B0A49C7.pf
O45 - LFCP:[MD5.7F15DC15130B872DF44E9154FB9FDE68] - 12/11/2013 - 16:21:03 ---A- - C:\Windows\Prefetch\INSTUP.EXE-73261D82.pf
O45 - LFCP:[MD5.38494D32F71AD1A8770306612B3912F5] - 12/11/2013 - 16:51:16 ---A- - C:\Windows\Prefetch\INSTUP.EXE-993E6BBE.pf
O45 - LFCP:[MD5.52011FA0CE806527FDE1639A0B14F338] - 12/11/2013 - 16:58:42 ---A- - C:\Windows\Prefetch\TEST_WPF.EXE-D519D5A5.pf
O45 - LFCP:[MD5.7D620A8E762B167336568784711F57F0] - 12/11/2013 - 16:58:50 ---A- - C:\Windows\Prefetch\KIS14.0.0.4651AFR_4875.EXE-DAE019FE.pf
O45 - LFCP:[MD5.EA472C03865C87F8860C2D837226856F] - 12/11/2013 - 17:10:24 ---A- - C:\Windows\Prefetch\TEST_WPF.EXE-F112DA88.pf
O45 - LFCP:[MD5.0C133065C5EF3C0F411185BB09FB6A10] - 12/11/2013 - 17:10:28 ---A- - C:\Windows\Prefetch\KIS14.0.0.4651AFR_4875 (1).EX-C5D01420.pf
O45 - LFCP:[MD5.240381145013BE52303BE8A9E1D5976F] - 14/11/2013 - 15:28:56 ---A- - C:\Windows\Prefetch\RELPOST.EXE-9967872C.pf
O45 - LFCP:[MD5.0CE24204A453B5A139FDA0B647DABDCA] - 15/11/2013 - 12:46:43 ---A- - C:\Windows\Prefetch\SNAPDO.EXE-64779234.pf
O45 - LFCP:[MD5.734A577ADE2FB07A8555D8AE733DB85F] - 15/11/2013 - 13:01:29 ---A- - C:\Windows\Prefetch\VPATCH.EXE-15E0C9E7.pf
O45 - LFCP:[MD5.9AD69D4BEA14807AF5191979D1EC8C97] - 17/11/2013 - 12:32:15 ---A- - C:\Windows\Prefetch\DJUCED18.EXE-7F01E5D0.pf
O45 - LFCP:[MD5.9B601B8366F49351F84A1B1D0CC1620A] - 18/11/2013 - 12:24:14 ---A- - C:\Windows\Prefetch\INS6425.EXE-94208C2F.pf
O45 - LFCP:[MD5.987CD62BF4E0D5C785456146AD9D9B52] - 18/11/2013 - 12:24:28 ---A- - C:\Windows\Prefetch\WAJAM_2207-6C14163C.EXE-A0DD297A.pf =>PUP.Wajam
O45 - LFCP:[MD5.5452C7E945E9DA434E3F7ED3FBFD56E9] - 18/11/2013 - 12:25:07 ---A- - C:\Windows\Prefetch\IMINENTMINIBARIE.EXE-B803F4F8.pf =>Adware.IMBooster
O45 - LFCP:[MD5.7845B075666CCC5933DFD70493BB2B37] - 18/11/2013 - 22:52:18 ---A- - C:\Windows\Prefetch\UMBRELLA.EXE-4353EE80.pf =>Adware.IMBooster
O45 - LFCP:[MD5.1F4A1C5FFBEAF90028ED00D39C40441B] - 18/11/2013 - 22:57:29 ---A- - C:\Windows\Prefetch\VIEWPASSWORD.EXE-AAFE3454.pf =>PUP.ViewPassword
O45 - LFCP:[MD5.443A415F6C427865692829E90E23D1E6] - 19/11/2013 - 00:07:35 ---A- - C:\Windows\Prefetch\dynreservedpri.db
O45 - LFCP:[MD5.16C54D25C39B3342BF5371772704A1F0] - 19/11/2013 - 13:14:31 ---A- - C:\Windows\Prefetch\SYSTEMSETTINGS.EXE-94FD71BB.pf
O45 - LFCP:[MD5.8D62E78705AFE7032B8C354604E9DB42] - 21/11/2013 - 10:22:42 ---A- - C:\Windows\Prefetch\SETUP_BRCH.EXE-A0F56A23.pf
O45 - LFCP:[MD5.4BA1277EF49928AB1FF86F415D1B5A1E] - 21/11/2013 - 10:23:41 ---A- - C:\Windows\Prefetch\SPWRAP.EXE-DB755706.pf
O45 - LFCP:[MD5.20AD0CF54BFAF1113B122B904972822D] - 21/11/2013 - 10:23:44 ---A- - C:\Windows\Prefetch\NSO9221.EXE-755B0CEB.pf
O45 - LFCP:[MD5.CCEAE6C848A38C54BF99240E30568107] - 21/11/2013 - 10:23:47 ---A- - C:\Windows\Prefetch\NSIC2A8.EXE-44604C05.pf
O45 - LFCP:[MD5.72AE0DCE85703593278ED73E52AB3038] - 21/11/2013 - 10:23:49 ---A- - C:\Windows\Prefetch\NSKC78B.EXE-A883F7E5.pf
O45 - LFCP:[MD5.0757F37DCBEE64493581F253F5FB488F] - 21/11/2013 - 10:23:50 ---A- - C:\Windows\Prefetch\NST9D6C.EXE-AE326D6C.pf
O45 - LFCP:[MD5.1A21733D223FA4E4C762FF73AFF4EE92] - 21/11/2013 - 10:24:03 ---A- - C:\Windows\Prefetch\NSSDC.EXE-4D41F694.pf
O45 - LFCP:[MD5.B43452E3357AF69D98FADC182A9BA8C4] - 21/11/2013 - 10:28:51 ---A- - C:\Windows\Prefetch\PCSPEEDMAXIMIZER.EXE-E8D6A7C4.pf
O45 - LFCP:[MD5.86B318D41902062B8CD3FAE3044D6791] - 21/11/2013 - 10:29:41 ---A- - C:\Windows\Prefetch\MOBOGENIE.EXE-B7341A4A.pf
O45 - LFCP:[MD5.57CAFD21612F627D10384407B4527CAF] - 21/11/2013 - 10:30:51 ---A- - C:\Windows\Prefetch\_IU14D2N.TMP-AF7EE2E5.pf
O45 - LFCP:[MD5.1C2777682558DC3A577EECE15D782D18] - 21/11/2013 - 10:31:30 ---A- - C:\Windows\Prefetch\NSGD534.EXE-15981EDD.pf
O45 - LFCP:[MD5.F0A880AA0FC7E594BB15EE8884A440EF] - 21/11/2013 - 10:32:53 ---A- - C:\Windows\Prefetch\SPOTIFY.EXE-CD8BECBD.pf
O45 - LFCP:[MD5.71679F19E61216CD5B6797CCEFF5AAA6] - 22/11/2013 - 11:04:55 ---A- - C:\Windows\Prefetch\AVPUI.EXE-EFE843E4.pf
O45 - LFCP:[MD5.F790BFDCE7BB3362F36741EFAD58D01D] - 23/11/2013 - 11:24:14 ---A- - C:\Windows\Prefetch\AVPUI.EXE-EFE843E5.pf
O45 - LFCP:[MD5.408351B891BAC64CD5090F6F60347E3E] - 23/11/2013 - 11:24:49 ---A- - C:\Windows\Prefetch\HDJSERIESCPL.EXE-21A42AF2.pf
O45 - LFCP:[MD5.6BEBB52D85204DFA306233EFC2AF8F16] - 23/11/2013 - 11:26:46 ---A- - C:\Windows\Prefetch\KLDW.EXE-61DD88AD.pf
O45 - LFCP:[MD5.694317C1B056985064CA2B6AC8A9DD8B] - 23/11/2013 - 11:29:36 ---A- - C:\Windows\Prefetch\SFTVSS64.EXE-771AA55C.pf
O45 - LFCP:[MD5.03893E1688D3FF620C1187CDB43F5A5B] - 23/11/2013 - 11:29:44 ---A- - C:\Windows\Prefetch\SETMUILANGUAGE.EXE-14CFC514.pf
O45 - LFCP:[MD5.EA6107E62E3EF8A3658D237E408911C4] - 23/11/2013 - 11:39:43 ---A- - C:\Windows\Prefetch\VPATCH.EXE-0655A528.pf
O45 - LFCP:[MD5.9180412DBFE0871AC5697030B70F06A4] - 24/10/2013 - 21:53:01 ---A- - C:\Windows\Prefetch\DBRUPDATE.TS3-8516C9F1.pf
O45 - LFCP:[MD5.C4ADAFCE196FBB0FFE729F4DB3272E8F] - 27/10/2013 - 09:50:17 ---A- - C:\Windows\Prefetch\SPWEBINST0.EXE-BED9966A.pf
O45 - LFCP:[MD5.698A5BB388823352C6CA773DBC09333B] - 28/10/2013 - 16:02:08 ---A- - C:\Windows\Prefetch\VIRTUALDJ_HOME.EXE-CC61CDCA.pf
~ Prefetcher: 199 Legitimates Filtered in 00mn 01s

---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 17 Legitimates Filtered in 00mn 00s

---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 4 Legitimates Filtered in 00mn 00s

---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.8DCA93290E92CEE3EF9E72ECEC7AC8F8] - 30/10/2012 - 13:49:34 ---A- . (.© Guillemot R&D, 2012. All rights reserved. - DJ Series ASIO kernel driver.) -- C:\Windows\System32\Drivers\HDJAsioK.sys [306032]
~ Drivers: 17 Legitimates Filtered in 00mn 01s

---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 21/11/2013 - 11:45:23 ---A- . (...) -- C:\Users\christophe\.android\adbkey [1704]
O61 - LFC: 21/11/2013 - 11:45:23 ---A- . (...) -- C:\Users\christophe\.android\adbkey.pub [716]
O61 - LFC: 21/11/2013 - 11:45:31 ---A- . (...) -- C:\Users\christophe\daemonprocess.txt [0]
O61 - LFC: 21/11/2013 - 11:45:32 ---A- . (...) -- C:\Users\christophe\Documents\PC Speed Maximizer\CookiesException.txt [15] =>Rogue.PCSpeedMaximizer
O61 - LFC: 21/11/2013 - 11:45:37 ---A- . (.Conduit.) -- C:\Users\christophe\Downloads\Setup_brch.exe [1119056]
O61 - LFC: 23/11/2013 - 11:45:23 ---A- . (...) -- C:\Users\christophe\AppData\Local\Google\Chrome\User Data\Certificate Revocation Lists [266723]
O61 - LFC: 23/11/2013 - 11:45:23 ---A- . (...) -- C:\Users\christophe\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt [5]
O61 - LFC: 23/11/2013 - 11:45:27 ---A- . (...) -- C:\Users\christophe\AppData\Local\Google\Chrome\User Data\Local State [47074]
O61 - LFC: 23/11/2013 - 11:45:31 ---A- . (...) -- C:\Users\christophe\AppData\Roaming\ZHP\Log.txt [17893] =>.Nicolas Coolman
O61 - LFC: 23/11/2013 - 11:45:31 ---A- . (...) -- C:\Users\christophe\AppData\Roaming\ZHP\TestsZHPDiag.txt [2977] =>.Nicolas Coolman
O61 - LFC: 23/11/2013 - 11:45:31 ---A- . (...) -- C:\Users\christophe\AppData\Roaming\newnext.me\nengine.cookie [3072]
~ 34 Fichiers temporaires (Temporary files)
~ Files: 401 Legitimates Filtered in 00mn 16s

---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s

---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s

---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s

---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} [DefaultScope] - (Conduit Search) - http://search.conduit.com
~ Keys: Scanned in 00mn 00s

---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.2F6F50B74D227A4FC7D2734D04FBEE88] [SPRF][14/11/2013] (.BetterSurf - Making web browsing more enjoyable.) -- C:\Users\christophe\AppData\Local\Temp\BetterSurf.exe [487007] =>PUP.BetterSurf
[MD5.32DCED18FFFEA0035E4FA975CA0AE8BE] [SPRF][22/04/2013] (.The Software Group - Software Update Setup.) -- C:\Users\christophe\AppData\Local\Temp\BoxoreInstaller.exe [620656] =>Adware.Boxore
[MD5.C67BCF6441E378371F0D6EEFB7EF0861] [SPRF][31/10/2013] (.Conduit - SP Usage Sender.) -- C:\Users\christophe\AppData\Local\Temp\nsgD534.exe [167812] =>Toolbar.Conduit
[MD5.C67BCF6441E378371F0D6EEFB7EF0861] [SPRF][31/10/2013] (.Conduit - SP Usage Sender.) -- C:\Users\christophe\AppData\Local\Temp\nsiC2A8.exe [167812] =>Toolbar.Conduit
[MD5.C67BCF6441E378371F0D6EEFB7EF0861] [SPRF][31/10/2013] (.Conduit - SP Usage Sender.) -- C:\Users\christophe\AppData\Local\Temp\nsk581.exe [167812] =>Toolbar.Conduit
[MD5.C67BCF6441E378371F0D6EEFB7EF0861] [SPRF][31/10/2013] (.Conduit - SP Usage Sender.) -- C:\Users\christophe\AppData\Local\Temp\nskC78B.exe [167812] =>Toolbar.Conduit
[MD5.C67BCF6441E378371F0D6EEFB7EF0861] [SPRF][31/10/2013] (.Conduit - SP Usage Sender.) -- C:\Users\christophe\AppData\Local\Temp\nssDC.exe [167812] =>Toolbar.Conduit
[MD5.378189889438568FEF3D98588283B3A5] [SPRF][11/11/2013] (...) -- C:\Users\christophe\AppData\Local\Temp\Quarantine.exe [350377]
[MD5.8E331DBFB86B682696ED16D90EC1F11F] [SPRF][27/10/2013] (.Spotify Ltd - Spotify.) -- C:\Users\christophe\AppData\Local\Temp\SpotifyUninstall.exe [4752384]
[MD5.154D7F4D7122D195A7C558746357E3FA] [SPRF][12/06/2013] (.Conduit - Search Protect by conduit.) -- C:\Users\christophe\AppData\Local\Temp\SPWrap.exe [66344] =>Toolbar.Conduit
~ Files: 11 Legitimates Filtered in 00mn 00s

---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "TCP Query User{0C009C6A-FD85-4FC2-A342-D544BD513389}C:\program files (x86)\torntv.com\torntv downloader.exe" |In - Private - P6 - TRUE | .(...) -- C:\program files (x86)\torntv.com\torntv downloader.exe (.not file.) =>Hijacker.TornTV
O87 - FAEL: "UDP Query User{EF720436-FA9B-49B0-AB9C-952778B7A02B}C:\program files (x86)\torntv.com\torntv downloader.exe" |In - Private - P17 - TRUE | .(...) -- C:\program files (x86)\torntv.com\torntv downloader.exe (.not file.) =>Hijacker.TornTV
O87 - FAEL: "{584967F8-99CB-4DF0-91A4-A5746FD1C11D}" |In - Public - P6 - TRUE | .(...) -- C:\ProgramData\eSafe\eGdpSvc.exe (.not file.) =>PUP.eSafeSecurity
O87 - FAEL: "{F53857C7-F0EF-409C-A392-97BFEC4DBA95}" |In - None - P6 - TRUE | .(...) -- C:\Program Files (x86)\Iminent\Iminent.exe (.not file.) =>Adware.IMBooster
O87 - FAEL: "{1F0A47D4-5DB3-431F-845D-762396C7945B}" |In - None - P6 - TRUE | .(...) -- C:\Program Files (x86)\Iminent\Iminent.Messengers.exe (.not file.) =>Adware.IMBooster
~ Firewall: 221 Legitimates Filtered in 00mn 01s

---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 05/09/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 12/10/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 12/10/2013 214512 | (AVP) . (.Kaspersky Lab ZAO.) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
SR - | Auto 02/10/2012 2227992 | (BcmBtRSupport) . (.Broadcom Corporation..) - C:\Windows\System32\BtwRSupportService.exe
SR - | Auto 30/08/2011 462184 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SS - | Demand 16/10/2012 277024 | (cphs) . (.Intel Corporation.) - C:\Windows\SysWow64\IntelCpHeciSvc.exe
SS - | Auto 14/10/2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 14/10/2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SR - | Auto 06/09/2012 18944 | (HerculesDJControlMP3) . (.Hercules®.) - C:\Program Files\Hercules\Audio\DJ Console Series\drivers\amd64\HerculesDJControlMP3.exe
SR - | Auto 09/07/2012 7168 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
SS - | Demand 01/10/2013 641352 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SR - | Auto 18/07/2012 276864 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
SR - | Auto 12/09/2012 1914728 | (SftService) . (.SoftThinks SAS.) - C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe
SR - | Auto 18/07/2012 364416 | (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
SR - | Demand 10/07/1658 0 | (WinDefend) . (...) - C:\Program Files (x86)\Windows Defender\MsMpEng.exe
SR - | Auto 18/09/2012 48640 | (wltrysvc) . (.Dell Inc..) - C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.exe
SS - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SS - | Demand 20/09/2012 29696 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 08s

---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Run by christophe at 23/11/2013 11:53:02
~ OS 64 not supported by MBR tool
~ MBR: 0 Legitimates Filtered in 00mn 00s

---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by christophe at 23/11/2013 11:53:05

********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 02s

---\\ Scan Additionnel (O88)
Database Version : 12996 - (22/11/2013)
Clés trouvées (Keys found) : 7
Valeurs trouvées (Values found) : 3
Dossiers trouvés (Folders found) : 3
Fichiers trouvés (Files found) : 17

[HKLM\Software\Google\Chrome\Extensions\dedmngkbaffkenlfdcbganndoghblmap] =>PUP.BetterSurf^
[HKLM\Software\Google\Chrome\Extensions\igdhbblpcellaljokkpfhcjlagemhgjl] =>Adware.IMBooster^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{363a1ea4-c27d-4260-a792-e77f47ca032d}] =>PUP.ViewPassword^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375] =>PUP.Tarma
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5] =>PUP.Tarma
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F1057DD419AED0B468AD8888429E139A] =>Adware.IMBooster
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CA0054A5AB3EFFE4CB5660E44A1E7DCC] =>Adware.Boxore^
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:tuto4pc_fr_62 =>PUP.Eorezo^
C:\Users\christophe\AppData\Local\Google\Chrome\User Data\Default\Extensions\dedmngkbaffkenlfdcbganndoghblmap =>PUP.BetterSurf^
C:\Users\christophe\AppData\Local\Google\Chrome\User Data\Default\Extensions\igdhbblpcellaljokkpfhcjlagemhgjl =>Adware.IMBooster^
C:\Program Files (x86)\BetterSurf =>PUP.BetterSurf^
C:\Windows\Tasks\ViewPassword Update.job =>PUP.ViewPassword^
[HKCU\Software\Conduit] =>Toolbar.Conduit^
[HKLM\Software\Wow6432Node\BetterSurf] =>PUP.BetterSurf^
C:\Users\christophe\AppData\Local\Temp\BetterSurf.exe =>PUP.BetterSurf^
C:\Users\christophe\AppData\Local\Temp\BoxoreInstaller.exe =>Adware.Boxore^
C:\Users\christophe\AppData\Local\Temp\nsgD534.exe =>Toolbar.Conduit^
C:\Users\christophe\AppData\Local\Temp\nsiC2A8.exe =>Toolbar.Conduit^
C:\Users\christophe\AppData\Local\Temp\nsk581.exe =>Toolbar.Conduit^
C:\Users\christophe\AppData\Local\Temp\nskC78B.exe =>Toolbar.Conduit^
C:\Users\christophe\AppData\Local\Temp\nssDC.exe =>Toolbar.Conduit^
C:\Users\christophe\AppData\Local\Temp\SPWrap.exe =>Toolbar.Conduit^
~ Additionnel Scan: 207123 Items scanned in 00mn 17s

---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com/apps/blog/show/26684723-adware-imbooster =>Adware.IMBooster
~ http://nicolascoolman.webs.com/apps/blog/show/36340918-pup-bettersurf =>PUP.BetterSurf
~ http://nicolascoolman.webs.com/apps/blog/show/27875657-toolbar-deltasearch =>Toolbar.DeltaSearch
~ http://nicolascoolman.webs.com/apps/blog/show/27469224-pup-eorezo =>PUP.EoRezo
~ http://nicolascoolman.webs.com/apps/blog/show/35740148-pup-viewpassword =>PUP.ViewPassword
~ http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit
~ http://nicolascoolman.webs.com/apps/blog/show/32174815-pup-mypcbackup =>PUP.MyPCBackup
~ http://nicolascoolman.webs.com/apps/blog/show/31746142-toolbar-bubbledock =>Toolbar.BubbleDock
~ http://nicolascoolman.webs.com/apps/blog/show/27379491-toolbar-wajam =>PUP.Wajam
~ http://nicolascoolman.webs.com/apps/blog/show/33449013-rogue-pcspeedmaximizer =>Rogue.PCSpeedMaximizer
~ http://nicolascoolman.webs.com/apps/blog/show/26626977-adware-boxore =>Adware.Boxore
~ http://nicolascoolman.webs.com/apps/blog/show/27660150-hijacker-torntv =>Hijacker.TornTV
~ http://nicolascoolman.webs.com/apps/blog/show/27588628-pup-esafesecurity =>PUP.eSafeSecurity
~ http://nicolascoolman.webs.com/apps/blog/show/29637859-toolbar-tarma =>PUP.Tarma
~ MSI: 14 link(s) detected in 00mn 17s

~ 1492 Legitimates filtered by white list
End of the scan (507 lines in 09mn 14s)(0)
0
Réponse 22 / 24
kingk06 Messages postés 10790 Statut Membre 536
 
Re,

c fait

me il me fautle lien on ne change pour regarder le rapport de zhpdiag ! =>

==>NOTE: Il faut héberger ce rapport qui se trouve sur le bureau, celui-ci étant trop long pour être posté sur le forum Pour héberger le rapport Rendez vous sur le site Cjoint ==> https://www.cjoint.com/

=> Pour t'aider http://www.pc-infopratique.com/forum-informatique/tutoriel-heberger-rapport-vt-67934.html
0
Réponse 23 / 24
tof197959
 
http://cjoint.com/?CKyvbVFcoTr
0
Réponse 24 / 24
kingk06 Messages postés 10790 Statut Membre 536
 
Re,

tu et sur => Windows 8 Home Premium tu a désactiver Windows Defender W8 ?
que tu a déjà un antivirus sur le pc ! (Kaspersky Internet Security)
comme désactiver Windows Defender W8 => http://www.windows8facile.fr/desactiver-antivirus-windows-8/
___________________________________________________________

puis fais ceci =>

>>>Attention script personnalisé à ne pas reproduire sur un autre ordinateur risque de plantage !<<<

=> Copie tout le texte existant dans le fichier hébergé :
<<< ouvre le fiches ICI >>> http://cjoint.com/data3/3KzjLsc3Ao3.htm (Sélectionne-le, clique droit dessus et choisis "tout sélectionner").

=> Puis lance ZHPFix depuis le raccourci situé sur ton Bureau.(icône seringue)
(Sous Vista/Win7/Win8, il faut cliquer droit sur le raccourci de ZHPFix et choisir Exécuter en tant qu'administrateur)

=> Une fois ZHPFix ouvert

=> clique sur "importer" Vérifie bien que toutes les lignes se collent automatiquement dans ZHPFix. image ici

clic sur "GO" en bas de page et confirme par oui pour lancer le nettoyage des données

==> laisse travailler l'outil et ne touche à rien ...

==> Si il t'est demandé de redémarrer le PC pour finir le nettoyage, fais le !

le rapport s'affichera sur ton bureau et dans C:\zhpfix.txt .

==> Copie/colle la totalité du rapport dans ta prochaine réponse.
==> : https://www.cjoint.com/ Copie le lien dans ta prochaine réponse.

( ce rapport est en outre sauvegardé dans ce dossier > C:\Program files\ZHPDiag\ ZHPFixReport.txt )

Redémarre le PC et poste le rapport stp.

tuto ici ==> ZHPFi

ici tu a un tutorial en vidéo => https://www.youtube.com/watch?v=PgsbvafSLuI
0

Discussions similaires

Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses
Comment désactiver le mode sécurisé de la Freebox POP.
Cycy -
bazfile -

18 réponses
Désinstaller Softonic
Diguimette -
lilidurhone -

5 réponses
Message Apple virus !!
Souclik67 -
MPMP10 -

3 réponses
Retirer un colis avec une photocopie de la carte d'identité
Tibby -
Chamarant -

9 réponses