Awesomehp
Fermé
Luvsba
Messages postés
51
Date d'inscription
lundi 26 mars 2012
Statut
Membre
Dernière intervention
12 avril 2020
-
5 avril 2014 à 09:29
Luvsba Messages postés 51 Date d'inscription lundi 26 mars 2012 Statut Membre Dernière intervention 12 avril 2020 - 6 avril 2014 à 10:11
Luvsba Messages postés 51 Date d'inscription lundi 26 mars 2012 Statut Membre Dernière intervention 12 avril 2020 - 6 avril 2014 à 10:11
10 réponses
lilidurhone
Messages postés
43343
Date d'inscription
lundi 25 avril 2011
Statut
Contributeur sécurité
Dernière intervention
19 juillet 2024
3 807
5 avril 2014 à 09:36
5 avril 2014 à 09:36
Hello
Toujours Awesomehp?
Toujours Awesomehp?
Luvsba
Messages postés
51
Date d'inscription
lundi 26 mars 2012
Statut
Membre
Dernière intervention
12 avril 2020
2
5 avril 2014 à 09:52
5 avril 2014 à 09:52
Bonjour Lilidurhone,
En fait, après redémarrage (demandé par ADWCleaner auquel j'ai bien sûr obtempéré !) mon laptop s'est réouvert sans cette...... - non, non, je ne le dirai pas -et sur le moteur de recherche Google.
Donc apparemment, je ne trimbale plus l'autre...!
J'aurais désiré avoir le top pour réinitialiser les navigateurs, après lecture du rapport que j'avais joint, par plus qualifié que moi.
Puis-je donc continuer sans problème ?
Merci beaucoup de votre réponse
ECh
En fait, après redémarrage (demandé par ADWCleaner auquel j'ai bien sûr obtempéré !) mon laptop s'est réouvert sans cette...... - non, non, je ne le dirai pas -et sur le moteur de recherche Google.
Donc apparemment, je ne trimbale plus l'autre...!
J'aurais désiré avoir le top pour réinitialiser les navigateurs, après lecture du rapport que j'avais joint, par plus qualifié que moi.
Puis-je donc continuer sans problème ?
Merci beaucoup de votre réponse
ECh
lilidurhone
Messages postés
43343
Date d'inscription
lundi 25 avril 2011
Statut
Contributeur sécurité
Dernière intervention
19 juillet 2024
3 807
5 avril 2014 à 09:54
5 avril 2014 à 09:54
On va vérifier
* Télécharge ZHPDiag (de Nicolas Coolman)
https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html ou https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/
* Au cas où le premier lien ne marcherai pas, clique sur celui de dessous
ftp://zebulon.fr/ZHPDiag2.exe
* Laisse toi guider lors de l'installation, il se lancera automatiquement à la fin.
* Surtout, n'oublie pas d'installer son icône sur le bureau l'icône est en forme de parchemin
https://www.cjoint.com/13sp/CIvuQfap3YY_zhpdiag.png
* A l'ouverture du logiciel il te sera proposé deux options "rechercher" et "configurer"
* Cliques sur configurer
* Tournevis puis tous
* Clique sur l'icône représentant une loupe + (« Lancer le diagnostic »)
* Enregistre le rapport sur ton Bureau à l'aide de l'icône représentant une disquette
* Pour héberger le rapport, rends toi sur cjoint.com
* Clique sur choisissez un fichier va chercher le rapport dans ton PC.
* Le rapport est hébergé:
- Pour XP : C:\Documents and Settings\username\Local Settings\Application Data\ZHP
- Depuis Vista : C:\Users\username\AppData\Roaming\ZHP
* Une fois le rapport trouvé, sélectionne le, et clique sur Ouvrir
* Choisis le type de diffusion (illimitée ou 21 jours)
* Puis cliques sur créer le lien cjoint
* Une fois que tu auras obtenu le lien copies colle dans ta prochaine réponse
* Pour t'aider https://www.commentcamarche.net/faq/29493-utiliser-cjoint-pour-heberger-des-fichiers
* Télécharge ZHPDiag (de Nicolas Coolman)
https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html ou https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/
* Au cas où le premier lien ne marcherai pas, clique sur celui de dessous
ftp://zebulon.fr/ZHPDiag2.exe
* Laisse toi guider lors de l'installation, il se lancera automatiquement à la fin.
* Surtout, n'oublie pas d'installer son icône sur le bureau l'icône est en forme de parchemin
https://www.cjoint.com/13sp/CIvuQfap3YY_zhpdiag.png
* A l'ouverture du logiciel il te sera proposé deux options "rechercher" et "configurer"
* Cliques sur configurer
* Tournevis puis tous
* Clique sur l'icône représentant une loupe + (« Lancer le diagnostic »)
* Enregistre le rapport sur ton Bureau à l'aide de l'icône représentant une disquette
* Pour héberger le rapport, rends toi sur cjoint.com
* Clique sur choisissez un fichier va chercher le rapport dans ton PC.
* Le rapport est hébergé:
- Pour XP : C:\Documents and Settings\username\Local Settings\Application Data\ZHP
- Depuis Vista : C:\Users\username\AppData\Roaming\ZHP
* Une fois le rapport trouvé, sélectionne le, et clique sur Ouvrir
* Choisis le type de diffusion (illimitée ou 21 jours)
* Puis cliques sur créer le lien cjoint
* Une fois que tu auras obtenu le lien copies colle dans ta prochaine réponse
* Pour t'aider https://www.commentcamarche.net/faq/29493-utiliser-cjoint-pour-heberger-des-fichiers
Luvsba
Messages postés
51
Date d'inscription
lundi 26 mars 2012
Statut
Membre
Dernière intervention
12 avril 2020
2
5 avril 2014 à 10:18
5 avril 2014 à 10:18
Merci beaucoup Lilidurhone pour votre aide.
Cela étant, il y avait - dans une réponse du Forum - un lien donné par Malekal et qui permet de réinitialiser automatiquement les navigateurs... Est-ce que ça ne pourrait pas convenir donc, après le "nettoyage" que j'ai effectué ??
Merci encore
ECh
Cela étant, il y avait - dans une réponse du Forum - un lien donné par Malekal et qui permet de réinitialiser automatiquement les navigateurs... Est-ce que ça ne pourrait pas convenir donc, après le "nettoyage" que j'ai effectué ??
Merci encore
ECh
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
lilidurhone
Messages postés
43343
Date d'inscription
lundi 25 avril 2011
Statut
Contributeur sécurité
Dernière intervention
19 juillet 2024
3 807
5 avril 2014 à 10:25
5 avril 2014 à 10:25
Justement fais zhpdiag
Luvsba
Messages postés
51
Date d'inscription
lundi 26 mars 2012
Statut
Membre
Dernière intervention
12 avril 2020
2
5 avril 2014 à 11:41
5 avril 2014 à 11:41
Re....,
En fait, sur W7, je n'arrive pas à trouver le "stockage" dudit diagnostic...
Le voici toutefois :
~ Rapport de ZHPDiag v2014.4.3.2 - Nicolas Coolman (03/04/2014)
~ Lancé par Elisabeth (05/04/2014 10:38:10)
~ Adresse du Site Web https://nicolascoolman.webs.com/
~ Forums gratuits d'Assistance à la désinfection : https://nicolascoolman.webs.com/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user
---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16844 (Defaut)
GCIE: Google Chrome v33.0.1750.154
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 3Q6C9
Windows License : OK
~ Windows Remaining Initializations Number : 2
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ Logiciels de protection du système
avast! Free Antivirus v9.0.2016
Malwarebytes Anti-Malware version 1.75.0.1300
McAfee Security Scan Plus v3.8.141.11
Windows Defender W7
---\\ Logiciels d'optimisation du système
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 12 Plugin
Adobe Reader X
Java 7 Update 51
---\\ Informations sur le système
~ Processor: AMD64 Family 15 Model 107 Stepping 2, AuthenticAMD
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3836 MB (50% free)
System Restore: Activé (Enable)
System drive C: has 153 GB (53%) free of 285 GB
---\\ Mode de connexion au système
~ Computer Name: LISBETH-PC
~ User Name: Elisabeth
~ All Users Names: Elisabeth, Administrateur,
~ Unselected Option: None
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Elisabeth\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Elisabeth\AppData\Roaming\
~ %Desktop% : C:\Users\Elisabeth\Desktop\
~ %Favorites% : C:\Users\Elisabeth\Favorites\
~ %LocalAppData% : C:\Users\Elisabeth\AppData\Local\
~ %StartMenu% : C:\Users\Elisabeth\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 153 Go of 285 Go)
D: Hard drive, Flash drive, Thumb drive (Free 2 Go of 13 Go)
---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 44 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.79EDF01FA13D886F8E1B655D542011FB] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.23/02/2014 - 09:13:41.) -- C:\Windows\System32\wininet.dll [2241536]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/09/2013 - 02:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/18604
~ Mes musiques (My Musics) : 2/29
~ Mes Videos (My Videos) : 2/66
~ Mes Favoris (My Favorites) : 1/151
~ Mes Documents (My Documents) : 91/2857
~ Mon Bureau (My Desktop) : 1/20
~ Menu demarrer (Programs) : 1/29
~ Hidden Files: Scanned in 00mn 20s
---\\ Processus lancés
[MD5.B508A4EE516D905730458BB50B79979B] - (.CyberLink - CyberLink MediaLibray Service.) -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe [206120] [PID.3320]
[MD5.8F89E6CB82E6DB45BC993D423CD0FDBD] - (. Hewlett-Packard Development Company, L.P. - Quick Launch Buttons.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe [323640] [PID.3464]
[MD5.5516C26A6AF8EB4E2CAB48EC98A74398] - (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe [54576] [PID.3548]
[MD5.48BE298F7FD1BEF4D8FBACB04D8D95C4] - (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576] [PID.3568]
[MD5.F6158734F1E24C6C510155CF0D363911] - (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512] [PID.3624]
[MD5.BDEFC081D02C162DCB90738BE432D66B] - (.Easybits - Software update notification.) -- C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1258504] [PID.3784]
[MD5.4BFA1849DC7AA3CB99C160D9EB96C67B] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640] [PID.3868]
[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336] [PID.3104]
[MD5.0DE3C7622EC33126579B1742260F08C2] - (.Pas de propriétaire - HpqToaster Module.) -- C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe [632888] [PID.4356]
[MD5.F71D97B6B631D565AF7C6E0BDF9D49F4] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\IEXPLORE.exe [770736] [PID.4428]
[MD5.49A3B0500DCBB24C15E7B5C4EA9D1CC8] - (.AOL Inc. - AOL France Toolbar Server.) -- c:\program files (x86)\aol france toolbar\aolfrtbServer.exe [278344] [PID.5752]
[MD5.4A59A9F53628FD76EAA3EDFE9903BBFD] - (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe [366536] [PID.6092]
[MD5.F4762082DDCFD241BE8BA5DD35133F4A] - (.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe [264136] [PID.6044]
[MD5.E75DA1FAAFC9B69CCD0940F95C9D1CF7] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8182272] [PID.1692]
[MD5.BEA8D0FA8805CC2E6BB49728166699C7] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344] [PID.1436]
[MD5.ADDA5E1951B90D3D23C56D3CF0622ADC] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65640] [PID.1876]
[MD5.96EFEC24346A8EB1157E80523079ADDC] - (...) -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056] [PID.348]
[MD5.498EB62A160674E793FA40FD65390625] - (.Pas de propriétaire - RichVideo Module.) -- C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152] [PID.424]
[MD5.9B7EDD3FE7C211C36E921D34D18A3A0A] - (.Hewlett-Packard Company - HP Software Framework WMI Service.) -- C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe [1001376] [PID.3188]
[MD5.C7A0E61D5714AC20DE52D4F66EC773B8] - (.Hewlett-Packard Development Company, L.P. - Com for QLB application.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [227896] [PID.5092]
~ Processes Running: Scanned in 00mn 01s
---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Elisabeth\AppData\Local\Google\Chrome\User Data\Default\Preferences
G1 - GCS: Preference [User Data\Default] https://www.google.com/?gws_rd=ssl
G2 - GCE: Preference [User Data\Default] [bopakagnckmlgajfccecajhnimjiiedh] McAfee Security Scan+ v.3.8.141.12 (Désactivé)
G2 - GCE: Preference [User Data\Default] [cnmdgidklhhnmppphpohildcefnaaflp] Services x86 v.1.22.22 (Activé) =>PUP.CrossRider
G2 - GCE: Preference [User Data\Default] [lcnnhcneegeeojhgpfijnlnocjdmlaon] Value apps v.1.7.0.2, (Activé) =>Toolbar.Conduit
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Wallet v.0.0.6.1 (Activé)
G2 - GCE: Preference [User Data\Default] [pelmeidfhdlhlbjimpabfcbnnojbboma] Quick Start v.3.2.0, (Désactivé) =>PUP.QuickStart
---\\ Liste des dossiers d'extension Google Chrome
~ Google Lines Browser: 17 Legitimates Filtered in 00mn 03s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21
---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: AOL Toolbar BHO [64Bits] - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} . (.AOL LLC - AOL IE Toolbar Dynamic Link Library.) -- C:\Program Files (x86)\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Adblock Plus for IE Browser Helper Object [64Bits] - {FFCB3198-32F3-4E8B-9539-4324694ED664} . (.Adblock Plus - Adblock Plus Module.) -- C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll
~ BHO: 17 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: (no name) - [HKLM]{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} Clé orpheline
O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll =>Toolbar.Google
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{DE9C389F-3316-41A7-809B-AA305ED9D922} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{DB89E9A0-FA7F-48D6-89BB-2B8B53A26E87} Clé orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Animations d'email.lnk . (.Adobe Systems Incorporated - Adobe Reader.) -- C:\Program Files (x86)\IncrediMail\Bin\EmailAnimationUrl.url (.not file.)
O4 - GS\Desktop [Public]: Augmentez la vitesse de votre ordinateur !.lnk . (.Adobe Systems Incorporated - Adobe Reader.) -- C:\Program Files (x86)\IncrediMail\Bin\Iobit.url (.not file.)
O4 - GS\Desktop [Public]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [Public]: HP Support Assistant.lnk . (.Hewlett-Packard Company - HP Support Assistant.) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe =>.Hewlett-Packard Co
O4 - GS\Desktop [Public]: Jouer à HP Games.lnk . (...) -- C:\Program Files (x86)\HP Games\onplay\onplay.exe
O4 - GS\Desktop [Public]: McAfee Security Scan Plus.lnk . (.McAfee, Inc. - McAfee.) -- C:\Program Files\McAfee Security Scan\3.8.141\McUICnt.exe
O4 - GS\Desktop [Public]: Photo Animation Creator.lnk . (...) -- C:\Program Files (x86)\Photo Notifier and Animation Creator\Application\Bin\pnac.exe
O4 - GS\Desktop [Public]: Photo Notifier Creator.lnk . (...) -- C:\Program Files (x86)\Photo Notifier and Animation Creator\Application\Bin\pnac.exe
O4 - GS\Desktop [Public]: Wallpapers by IncrediMail.lnk . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\IncrediMail\Bin\FreeWallpapersDesktop.url =>.Skype Technologies S.A.
O4 - GS\Program [Public]: IncrediMail.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O4 - GS\Program [Public]: Magic Desktop.lnk . (.EasyBits Software AS - EasyBits Security Shield.) -- C:\Program Files (x86)\EasyBits For Kids\ezSecShield.exe =>.EasyBits Software AS
O4 - GS\QuickLaunch [Elisabeth]: Babylon.lnk . (...) -- C:\Program Files (x86)\Babylon\Babylon-Pro\Babylon.exe (.not file.) =>PUP.Babylon
O4 - GS\QuickLaunch [Elisabeth]: Check PC For Errors.lnk . (.Support.com - ARO 2011.) -- C:\Program Files (x86)\ARO 2011\ARO.exe
O4 - GS\QuickLaunch [Elisabeth]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Elisabeth]: IncrediMail 2.0.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O4 - GS\QuickLaunch [Elisabeth]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [Elisabeth]: HP MediaSmart Webcam.lnk . (.CyberLink Corp. - HPMediaSmartWebcam.) -- C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\HPMediaSmartWebcam.exe
O4 - GS\TaskBar [Elisabeth]: HP MediaSmart.lnk . (...) -- C:\Program Files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (.not file.)
O4 - GS\TaskBar [Elisabeth]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Program [Elisabeth]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [Elisabeth]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Elisabeth]: Check PC For Errors.lnk . (.Support.com - ARO 2011.) -- C:\Program Files (x86)\ARO 2011\ARO.exe
O4 - GS\Desktop [Elisabeth]: Images - Raccourci.lnk . (...) -- C:\Users\Elisabeth\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms
O4 - GS\Desktop [Elisabeth]: IncrediMail.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O4 - GS\Desktop [Elisabeth]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Elisabeth]: Live PC Help.lnk - Clé orpheline
O4 - GS\Desktop [Elisabeth]: Mes images - Raccourci.lnk . (...) -- C:\Users\Elisabeth\Pictures\Mes images
O4 - GS\Desktop [Elisabeth]: Solitaire.lnk - Clé orpheline
O4 - GS\Desktop [Elisabeth]: USA - Raccourci.lnk . (...) -- C:\Users\Elisabeth\Pictures\Mes images\USA
O4 - GS\Desktop [Elisabeth]: Ventes à venir - Raccourci.lnk - Clé orpheline
~ Global Startup: 91 Legitimates Filtered in 00mn 05s
---\\ Applications lancées au démarrage du système (O4)
O4 - GS\Startup [Public]: McAfee Security Scan Plus.lnk . (.McAfee, Inc. - McAfee Security Scanner Scheduler.) -- C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
O4 - HKLM\..\Run: [SysTrayApp] . (.IDT, Inc. - IDT PC Audio.) -- C:\Program Files\IDT\WDM\sttray64.exe
O4 - HKLM\..\Run: [AmIcoSinglun64] . (.AlcorMicro Co., Ltd. - Single LUN Icon Utility for VID 058F PID 63.) -- C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
O4 - HKLM\..\Run: [Apoint] . (.Alps Electric Co., Ltd. - Alps Pointing-device Driver.) -- C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [SmartMenu] . (.Pas de propriétaire - SmartMenu.) -- C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\bin\jusched.exe =>.Oracle Corporation
O4 - HKLM\..\RunOnce: [NCPluginUpdater] . (.Hewlett-Packard - NCPluginUpdater.) -- C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe
O4 - HKCU\..\Run: [AROReminder] . (.Support.com - ARO 2011.) -- C:\Program Files (x86)\ARO 2011\ARO.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe =>.Advanced Micro Devices, Inc
O4 - HKLM\..\Wow6432Node\Run: [HPCam_Menu] . (.CyberLink Corp. - MUI StartMenu Application.) -- c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Wow6432Node\Run: [QlbCtrl.exe] . (. Hewlett-Packard Development Company, L.P. - Quick Launch Buttons.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
O4 - HKLM\..\Wow6432Node\Run: [UpdatePRCShortCut] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Wow6432Node\Run: [Easybits Recovery] . (.EasyBits Software AS - Pas de description.) -- C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe =>.EasyBits Software AS
O4 - HKLM\..\Wow6432Node\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe =>.Hewlett-Packard Co
O4 - HKLM\..\Wow6432Node\Run: [WirelessAssistant] . (.Hewlett-Packard Company - HP Wireless Assistant Main Program.) -- C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [TkBellExe] . (.RealNetworks, Inc. - RealNetworks Scheduler.) -- c:\program files (x86)\real\realplayer\Update\realsched.exe =>.RealNetworks, Inc
O4 - HKLM\..\Wow6432Node\Run: [Magic Desktop for HP notification] . (.Easybits - Software update notification.) -- C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe
O4 - HKLM\..\Wow6432Node\Run: [AvastUI.exe] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-3283381568-904949491-440556053-1001\..\Run: [AROReminder] . (.Support.com - ARO 2011.) -- C:\Program Files (x86)\ARO 2011\ARO.exe
O4 - HKUS\S-1-5-21-3283381568-904949491-440556053-1001\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
~ Application: Scanned in 00mn 00s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll,-102 [64Bits] - {25510184-5A38-4A99-B273-DCA8EEF6CD08} . (...) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\Resources\Icons\HP.ico
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{86C12D1D-F119-42C0-A788-50DA0A72BC76}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{9522C11D-FB3D-4F1D-BC23-5E5F5E47EE1B}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{86C12D1D-F119-42C0-A788-50DA0A72BC76}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{9522C11D-FB3D-4F1D-BC23-5E5F5E47EE1B}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{86C12D1D-F119-42C0-A788-50DA0A72BC76}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{9522C11D-FB3D-4F1D-BC23-5E5F5E47EE1B}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\ARO 2011.job [248]
[MD5.659CB37944BFCCA3FE6EBDFEB3BB99F4] [APT] [ARO 2011] (.Support.com.) -- C:\Program Files (x86)\ARO 2011\ARO.exe [2312048]
[MD5.00000000000000000000000000000000] [APT] [Updater27096.exe] (...) -- C:\Users\Elisabeth\AppData\Local\Updater27096\Updater27096.exe (.not file.) [0] =>PUP.CrossRider
[MD5.00000000000000000000000000000000] [APT] [{433E2897-7D42-498B-AF9C-A8BFBC5E6AA0}] (...) -- C:\Program Files (x86)\INCRED~2\UNWISE.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{A72AEAF4-5B19-4913-B6B4-6C7A6279D139}] (...) -- C:\Users\Elisabeth\AppData\Roaming\awesomehp\UninstallManager.exe (.not file.) [0] =>PUP.Awesomehp
~ Scheduled Task: 23 Legitimates Filtered in 00mn 08s
---\\ Logiciels installés (O42)
O42 - Logiciel: ARO 2011 - (.Support.com.) [HKLM][64Bits] -- ARO 2011_is1
O42 - Logiciel: IncrediMail - (.IncrediMail.) [HKLM][64Bits] -- {5E97F3BD-CDDC-4188-9D98-532E14FABB5D}
O42 - Logiciel: IncrediMail 2.0 - (.IncrediMail Ltd..) [HKLM][64Bits] -- IncrediMail
~ Logic: 56 Legitimates Filtered in 00mn 01s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\ELIGCHK]
[HKCU\Software\IM]
[HKCU\Software\IncrediMail]
[HKLM\Software\Wow6432Node\mamverifier]
~ Key Software: 296 Legitimates Filtered in 00mn 01s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 03/04/2010 - 17:44:39 - [28,898] ----D C:\Program Files (x86)\ACCESS.FR-FR
O43 - CFD: 03/04/2010 - 17:44:49 - [26,388] ----D C:\Program Files (x86)\ADMIN
O43 - CFD: 17/04/2011 - 14:52:35 - [14,181] ----D C:\Program Files (x86)\ARO 2011
O43 - CFD: 03/04/2010 - 17:44:51 - [1,262] ----D C:\Program Files (x86)\CATALOG
O43 - CFD: 03/04/2010 - 17:44:53 - [16,448] ----D C:\Program Files (x86)\EXCEL.FR-FR
O43 - CFD: 04/04/2014 - 17:08:41 - [6,517] ----D C:\Program Files (x86)\GUM84C4.tmp
O43 - CFD: 15/08/2011 - 20:23:14 - [26,519] ----D C:\Program Files (x86)\IncrediMail
O43 - CFD: 03/04/2010 - 17:44:56 - [28,297] ----D C:\Program Files (x86)\INFOPATH.FR-FR
O43 - CFD: 03/04/2010 - 17:44:59 - [32,849] ----D C:\Program Files (x86)\OFFICE.FR-FR
O43 - CFD: 03/04/2010 - 17:45:00 - [0,493] ----D C:\Program Files (x86)\OFFICE64.FR-FR
O43 - CFD: 03/04/2010 - 17:44:09 - [81,725] ----D C:\Program Files (x86)\PROOFING.FR-FR
O43 - CFD: 03/04/2010 - 17:44:33 - [251,833] ----D C:\Program Files (x86)\PROPLUS.WW
O43 - CFD: 03/04/2010 - 17:44:35 - [1,558] ----D C:\Program Files (x86)\ROSEBUD.FR-FR
O43 - CFD: 03/04/2010 - 17:44:35 - [0] ----D C:\Program Files (x86)\UPDATES
O43 - CFD: 03/04/2010 - 17:44:36 - [17,681] ----D C:\Program Files (x86)\WORD.FR-FR
O43 - CFD: 06/02/2010 - 18:23:45 - [0] ----D C:\ProgramData\IM
O43 - CFD: 06/02/2010 - 18:21:47 - [6,747] ----D C:\ProgramData\IncrediMail
O43 - CFD: 07/02/2010 - 10:58:53 - [0,915] ----D C:\Users\Elisabeth\AppData\Roaming\igraal
O43 - CFD: 19/05/2013 - 19:53:46 - [1387,161] ----D C:\Users\Elisabeth\AppData\Local\IM
~ 11 Dossier CLSID vide (CLSID Empty Folder)
~ Program Folder: 191 Legitimates Filtered in 07mn 50s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.82F3F674AF68553498F5E6D9554EA20B] - 05/04/2014 - 06:54:36 ---A- . (...) -- C:\Windows\IE11_main.log [288555]
O44 - LFC:[MD5.DA132AE285739B5902EC8AA3D1CC5290] - 05/04/2014 - 09:43:28 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [26192]
O44 - LFC:[MD5.DA132AE285739B5902EC8AA3D1CC5290] - 05/04/2014 - 09:43:28 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [26192]
O44 - LFC:[MD5.CB8572E790FCE09714143741C20E9934] - 21/03/2014 - 11:08:41 ---A- . (...) -- C:\Windows\System32\sasnative64.exe [16896]
~ Files: 23 Legitimates Filtered in 00mn 25s
---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.B98D0CB02AA863EB54EE06EC634581AC] - 05/04/2014 - 08:24:22 ---A- - C:\Windows\Prefetch\AOLFRTBSERVER.EXE-3B15653C.pf
O45 - LFCP:[MD5.E597D73318B9CCB0698DEC0D67631184] - 05/04/2014 - 08:32:44 ---A- - C:\Windows\Prefetch\INCMAIL.EXE-F91AEC10.pf
O45 - LFCP:[MD5.85AC4C5B103ED83CD90C4B304206B64A] - 05/04/2014 - 08:32:46 ---A- - C:\Windows\Prefetch\IMAPP.EXE-3E2B42CA.pf
O45 - LFCP:[MD5.E4C9847AF4EB086B6AA9FFB85DE2E3A1] - 05/04/2014 - 09:33:42 ---A- - C:\Windows\Prefetch\IMLPP.EXE-C9266A11.pf
O45 - LFCP:[MD5.27C9B576F761BCB6B21989912C776058] - 17/03/2014 - 07:52:14 ---A- - C:\Windows\Prefetch\RESOURCE.EXE-E971D367.pf
O45 - LFCP:[MD5.72A25F210BF4C3EAF2DDB4EA662A5610] - 31/03/2014 - 16:59:12 ---A- - C:\Windows\Prefetch\ARO.EXE-907CCEF1.pf
~ Prefetcher: 6 Legitimates Filtered in 00mn 00s
---\\ Clé de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{058fcb9c-8055-11e0-8039-0021cc3edd34}\AutoRun\command. (...) -- E:\ReadMe.exe (.not file.)
~ Keys: Scanned in 00mn 00s
---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKCU\...\Policies\System] - "WallpaperStyle"=
~ MWPS: 21 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.8D4B8BF93C65BDBC133B20706A3B5208] - 04/04/2014 - 16:14:54 ---A- . (...) -- C:\Windows\System32\Drivers\aswRvrt.sys [65776]
O58 - SDL:[MD5.0606875650850B0697D662934529F6FC] - 04/04/2014 - 16:14:54 ---A- . (...) -- C:\Windows\System32\Drivers\aswVmm.sys [208928]
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:[MD5.356BB3DD25987179080F3B669AD4080A] - 07/09/2010 - 02:04:00 ---A- . (.Novatek - Camera mini Driver.) -- C:\Windows\System32\Drivers\nvtcam.sys [2755072]
O58 - SDL:[MD5.A82C5B6269184DF2A62A164B65917372] - 07/09/2010 - 02:03:44 ---A- . (.Novatek - Camera mini Driver.) -- C:\Windows\System32\Drivers\nvtcamd2.sys [36224]
O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
O58 - SDL:[MD5.8D1CE4322A35F840711B87927CB57C05] - 13/08/2009 - 21:09:38 ---A- . (.IDT, Inc. - IDT PC Audio.) -- C:\Windows\System32\Drivers\stwrt64.sys [487936]
~ Drivers: 21 Legitimates Filtered in 00mn 15s
---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 02/04/2014 - 10:48:09 ---A- . (...) -- C:\Users\Elisabeth\AppData\Local\AOL France Toolbar\ieToolbar\fr-FR\pagealerts.xml [2924]
O61 - LFC: 04/04/2014 - 11:05:24 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\Sammsoft\ARO\Version 2011\Logs\ARO2011_custom_3044.txt [34]
O61 - LFC: 05/04/2014 - 10:48:09 ---A- . (...) -- C:\Users\Elisabeth\AppData\Local\AOL France Toolbar\ieToolbar\fr-FR\publish.xml [77]
O61 - LFC: 05/04/2014 - 10:48:16 ---A- . (...) -- C:\Users\Elisabeth\AppData\Local\IM\content.xml [44539]
O61 - LFC: 05/04/2014 - 11:05:24 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\Sammsoft\ARO\Version 2011\Logs\ARO2011_custom_3232.txt [34]
O61 - LFC: 05/04/2014 - 11:05:24 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\ZHP\Log.txt [21521] =>.Nicolas Coolman
O61 - LFC: 05/04/2014 - 11:05:24 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\ZHP\TestsZHPDiag.txt [2954] =>.Nicolas Coolman
~ 171 Fichiers temporaires (Temporary files)
~ Files: 286 Legitimates Filtered in 18mn 11s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (...) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {5A9A4B33-AFBA-4B6E-BF37-B992E6C14788} - (Google) - https://www.google.com/?gws_rd=ssl
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Google) - https://www.google.com/?gws_rd=ssl
O69 - SBI: SearchScopes [HKCU] {7D7AE29F-C990-4602-A381-7B85EAA69B32} - (AOL search) - http://slirsredirect.search.aol.com
O69 - SBI: SearchScopes [HKCU] {E27FFF02-2968-4F54-BD1C-2EDC76821299} - (Yahoo!) - https://fr.search.yahoo.com/
O69 - SBI: SearchScopes [HKCU] {EFF8551B-142B-48DC-98EE-A112AACFA12E} - (AOL Recherche) - http://slirsredirect.search.aol.com
~ Keys: Scanned in 00mn 00s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.CE929D8A3F04F180CCD94A22257E3A7F] [SPRF][29/01/2014] (...) -- C:\Users\Elisabeth\AppData\Roaming\wklnhst.dat [508]
~ Files: 2 Legitimates Filtered in 00mn 00s
---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{68722F66-D758-4447-BCA7-777588A0A242}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files (x86)\LimeWire\LimeWire.exe (.not file.)
O87 - FAEL: "{85CD2F6E-302F-412E-88B5-AD9E9D6DF89C}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files (x86)\LimeWire\LimeWire.exe (.not file.)
O87 - FAEL: "{90E82949-8579-43A4-9B3B-C004DEC87BB2}" | In - Public - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{96C30E2E-F4BA-4F28-90DC-63F9910D72E3}" | In - Public - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{EF02A774-6235-4A31-8331-5A0A1EBB63E2}" | In - Public - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{79191566-E488-437F-AC36-7BE6E5744EDF}" | In - Public - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{5E2C9B15-2FB6-4216-B3D6-5F3EC083FF08}" | In - Public - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "{9B8D3C96-FA6E-4F7F-B851-D27BFEBF2122}" | In - Public - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "TCP Query User{F2FB198A-F5D2-48B8-87A4-D7B0CB88842B}C:\program files (x86)\freetvradio\freetvradio.exe" |In - Private - P6 - TRUE | .(...) -- C:\program files (x86)\freetvradio\freetvradio.exe (.not file.) =>Adware.SPointer
O87 - FAEL: "UDP Query User{A28C2BF5-98C7-4041-9A50-039AC9FE15E8}C:\program files (x86)\freetvradio\freetvradio.exe" |In - Private - P17 - TRUE | .(...) -- C:\program files (x86)\freetvradio\freetvradio.exe (.not file.) =>Adware.SPointer
O87 - FAEL: "{35FE58CE-2459-4F36-B50F-EF54750431C7}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{D3ADF49E-B435-4993-A100-06986FC6A864}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{C8E08AD5-63DA-4FB3-B7D2-FA56BC5E61D3}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "{2FAE321D-F2E6-47D0-88E3-61543B7EFA55}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "{C7742555-F6F5-4A39-8210-0301596419B5}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{37250D27-4231-47A8-AD6B-246A21C9D783}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{64070E53-C9FF-4915-A30F-26EA9E34D9C2}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{E60B3BD4-C917-49CC-A41E-D763F02429BB}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{361A6133-CD11-4564-8488-B276B0D5CF47}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
~ Firewall: 223 Legitimates Filtered in 00mn 03s
---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "DB3F79E5CDDC8814D98935E241AFBBD5" . (.IncrediMail.) -- C:\Windows\Installer\{5E97F3BD-CDDC-4188-9D98-532E14FABB5D}\ARPPRODUCTICON.exe
~ Update Products: 160 Legitimates Filtered in 00mn 00s
---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.8FFB0EE18F9233D86A4400A12259897A] [WIS][08/10/2013] (.Eyeo GmbH - Adblock Plus for IE.) -- C:\Windows\Installer\84e5418.msi [2588672]
[MD5.9D193210E3209AB2EDD8BB8A63D62C2C] [WIS][17/06/2012] (.IncrediMail - IncrediMail.) -- C:\Windows\Installer\dae82.msi [2892800]
~ WIS: 171 Legitimates Filtered in 00mn 20s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 12/03/2014 257928 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 22/05/2009 250616 | (GameConsoleService) . (.WildTangent, Inc..) - C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe
SS - | Auto 19/04/2010 135664 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 19/04/2010 135664 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 18/08/2013 194032 | (gusvc) . (.Google.) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Demand 16/01/2014 289256 | (McComponentHostService) . (.McAfee, Inc..) - C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe
SR - | Auto 10/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 02/03/2009 89600 | (AESTFilters) . (.Andrea Electronics Corporation.) - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b87ff64c8b56b7db\AESTSr64.exe
SR - | Auto 22/09/2009 203264 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 04/04/2014 50344 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SR - | Demand 25/02/2010 227896 | (Com4QLBEx) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\ezsvc7.dll (ezSharedSvc) . (.EasyBits Sofware AS.) - C:\Windows\System32\svchost.exe
SR - | Auto 27/09/2012 86528 | (HP Support Assistant Service) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe =>.Hewlett-Packard Co
SR - | Demand 10/08/2012 1001376 | (hpqwmiex) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
SR - | Auto 08/07/2009 30520 | (hpsrv) . (.Hewlett-Packard.) - C:\Windows\System32\Hpservice.exe
SR - | Auto 14/08/2013 39056 | (RealNetworks Downloader Resolver Service) . (...) - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
SR - | Auto 21/01/2009 247152 | (RichVideo) . (...) - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
SR - | Auto 13/08/2009 240640 | (STacSV) . (.IDT, Inc..) - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b87ff64c8b56b7db\STacSV64.exe
SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 25s
---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Run by Elisabeth at 05/04/2014 11:11:51
~ OS 64 not supported by MBR tool
~ MBR: 0 Legitimates Filtered in 00mn 00s
---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Elisabeth at 05/04/2014 11:11:53
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 02s
---\\ Scan Additionnel (O88)
Database Version : 13036 - (03/04/2014)
Clés trouvées (Keys found) : 11
Valeurs trouvées (Values found) : 1
Dossiers trouvés (Folders found) : 3
Fichiers trouvés (Files found) : 14
[HKLM\Software\Google\Chrome\Extensions\cnmdgidklhhnmppphpohildcefnaaflp] =>PUP.CrossRider^
[HKLM\Software\Google\Chrome\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon] =>Toolbar.Conduit^
[HKLM\Software\Google\Chrome\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma] =>PUP.QuickStart^
[HKCR\VirtualStore\MACHINE\Software\CToolbar] =>Toolbar.Crawler
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375] =>PUP.Tarma
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5] =>PUP.Tarma
[HKLM\Software\Classes\aolfrTb.AOLToolBand.1] =>Toolbar.Agent
[HKLM\Software\Classes\AOLTB.AOLToolBand.1] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Classes\aolfrTb.AOLToolBand.1] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Classes\AOLTB.AOLToolBand.1] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110211701196}] =>PUP.CrossRider
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{2318C2B1-4965-11d4-9B18-009027A5CD4F} =>Toolbar.Google^
C:\Users\Elisabeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp =>PUP.CrossRider^
C:\Users\Elisabeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon =>Toolbar.Conduit^
C:\Users\Elisabeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma =>PUP.QuickStart^
C:\Users\Elisabeth\AppData\Local\Temp\uninst1.exe =>PUP.Babylon
C:\Users\Elisabeth\AppData\Local\Temp\GoogleToolbarInstaller1.log =>PUP.Babylon
C:\Users\Elisabeth\AppData\Local\Temp\GoogleToolbarInstaller2.log =>PUP.Babylon
C:\Users\Elisabeth\AppData\Local\Temp\GLF184F.tmp.tbChez.dll =>Toolbar.Conduit
C:\Users\Elisabeth\AppData\Local\Temp\GLF93B5.tmp.tbRadi.dll =>Toolbar.Conduit
C:\Users\Elisabeth\AppData\Local\Temp\GLFACD1.tmp.tbRadi.dll =>Toolbar.Conduit
C:\Users\Elisabeth\AppData\Local\Temp\nsi7870.tmp.tbIncr.dll =>Toolbar.Conduit
C:\Users\Elisabeth\AppData\Local\Temp\tbIncr.dll =>Toolbar.Conduit
~ Additionnel Scan: 368825 Items scanned in 01mn 25s
---\\ Récapitulatif des détections trouvées sur votre station
http://nicolascoolman.webs.com/apps/blog/show/27583526-pup-crossrider =>PUP.CrossRider
http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit
http://nicolascoolman.webs.com/apps/blog/show/41962558-pup-quickstart =>PUP.QuickStart
http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon =>PUP.Babylon
http://nicolascoolman.webs.com/apps/blog/show/41011964-pup-awesomehp =>PUP.Awesomehp
http://nicolascoolman.webs.com/apps/blog/show/27556476-adware-spointer =>Adware.SPointer
http://nicolascoolman.webs.com/apps/blog/show/29637859-toolbar-tarma =>PUP.Tarma
~ MSI: 7 link(s) detected in 00mn 00s
~ 1543 Legitimates filtered by white list
End of the scan (576 lines in 35mn 11s)(0)
So what à présent si je ne puis coller le lien sur CJoint.com ??
Merci encore !
ECh
En fait, sur W7, je n'arrive pas à trouver le "stockage" dudit diagnostic...
Le voici toutefois :
~ Rapport de ZHPDiag v2014.4.3.2 - Nicolas Coolman (03/04/2014)
~ Lancé par Elisabeth (05/04/2014 10:38:10)
~ Adresse du Site Web https://nicolascoolman.webs.com/
~ Forums gratuits d'Assistance à la désinfection : https://nicolascoolman.webs.com/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user
---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16844 (Defaut)
GCIE: Google Chrome v33.0.1750.154
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 3Q6C9
Windows License : OK
~ Windows Remaining Initializations Number : 2
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ Logiciels de protection du système
avast! Free Antivirus v9.0.2016
Malwarebytes Anti-Malware version 1.75.0.1300
McAfee Security Scan Plus v3.8.141.11
Windows Defender W7
---\\ Logiciels d'optimisation du système
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 12 Plugin
Adobe Reader X
Java 7 Update 51
---\\ Informations sur le système
~ Processor: AMD64 Family 15 Model 107 Stepping 2, AuthenticAMD
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3836 MB (50% free)
System Restore: Activé (Enable)
System drive C: has 153 GB (53%) free of 285 GB
---\\ Mode de connexion au système
~ Computer Name: LISBETH-PC
~ User Name: Elisabeth
~ All Users Names: Elisabeth, Administrateur,
~ Unselected Option: None
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Elisabeth\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Elisabeth\AppData\Roaming\
~ %Desktop% : C:\Users\Elisabeth\Desktop\
~ %Favorites% : C:\Users\Elisabeth\Favorites\
~ %LocalAppData% : C:\Users\Elisabeth\AppData\Local\
~ %StartMenu% : C:\Users\Elisabeth\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 153 Go of 285 Go)
D: Hard drive, Flash drive, Thumb drive (Free 2 Go of 13 Go)
---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 44 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.79EDF01FA13D886F8E1B655D542011FB] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.23/02/2014 - 09:13:41.) -- C:\Windows\System32\wininet.dll [2241536]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/09/2013 - 02:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/18604
~ Mes musiques (My Musics) : 2/29
~ Mes Videos (My Videos) : 2/66
~ Mes Favoris (My Favorites) : 1/151
~ Mes Documents (My Documents) : 91/2857
~ Mon Bureau (My Desktop) : 1/20
~ Menu demarrer (Programs) : 1/29
~ Hidden Files: Scanned in 00mn 20s
---\\ Processus lancés
[MD5.B508A4EE516D905730458BB50B79979B] - (.CyberLink - CyberLink MediaLibray Service.) -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe [206120] [PID.3320]
[MD5.8F89E6CB82E6DB45BC993D423CD0FDBD] - (. Hewlett-Packard Development Company, L.P. - Quick Launch Buttons.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe [323640] [PID.3464]
[MD5.5516C26A6AF8EB4E2CAB48EC98A74398] - (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe [54576] [PID.3548]
[MD5.48BE298F7FD1BEF4D8FBACB04D8D95C4] - (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576] [PID.3568]
[MD5.F6158734F1E24C6C510155CF0D363911] - (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512] [PID.3624]
[MD5.BDEFC081D02C162DCB90738BE432D66B] - (.Easybits - Software update notification.) -- C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1258504] [PID.3784]
[MD5.4BFA1849DC7AA3CB99C160D9EB96C67B] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640] [PID.3868]
[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336] [PID.3104]
[MD5.0DE3C7622EC33126579B1742260F08C2] - (.Pas de propriétaire - HpqToaster Module.) -- C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe [632888] [PID.4356]
[MD5.F71D97B6B631D565AF7C6E0BDF9D49F4] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\IEXPLORE.exe [770736] [PID.4428]
[MD5.49A3B0500DCBB24C15E7B5C4EA9D1CC8] - (.AOL Inc. - AOL France Toolbar Server.) -- c:\program files (x86)\aol france toolbar\aolfrtbServer.exe [278344] [PID.5752]
[MD5.4A59A9F53628FD76EAA3EDFE9903BBFD] - (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe [366536] [PID.6092]
[MD5.F4762082DDCFD241BE8BA5DD35133F4A] - (.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe [264136] [PID.6044]
[MD5.E75DA1FAAFC9B69CCD0940F95C9D1CF7] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8182272] [PID.1692]
[MD5.BEA8D0FA8805CC2E6BB49728166699C7] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344] [PID.1436]
[MD5.ADDA5E1951B90D3D23C56D3CF0622ADC] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65640] [PID.1876]
[MD5.96EFEC24346A8EB1157E80523079ADDC] - (...) -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056] [PID.348]
[MD5.498EB62A160674E793FA40FD65390625] - (.Pas de propriétaire - RichVideo Module.) -- C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152] [PID.424]
[MD5.9B7EDD3FE7C211C36E921D34D18A3A0A] - (.Hewlett-Packard Company - HP Software Framework WMI Service.) -- C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe [1001376] [PID.3188]
[MD5.C7A0E61D5714AC20DE52D4F66EC773B8] - (.Hewlett-Packard Development Company, L.P. - Com for QLB application.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [227896] [PID.5092]
~ Processes Running: Scanned in 00mn 01s
---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Elisabeth\AppData\Local\Google\Chrome\User Data\Default\Preferences
G1 - GCS: Preference [User Data\Default] https://www.google.com/?gws_rd=ssl
G2 - GCE: Preference [User Data\Default] [bopakagnckmlgajfccecajhnimjiiedh] McAfee Security Scan+ v.3.8.141.12 (Désactivé)
G2 - GCE: Preference [User Data\Default] [cnmdgidklhhnmppphpohildcefnaaflp] Services x86 v.1.22.22 (Activé) =>PUP.CrossRider
G2 - GCE: Preference [User Data\Default] [lcnnhcneegeeojhgpfijnlnocjdmlaon] Value apps v.1.7.0.2, (Activé) =>Toolbar.Conduit
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Wallet v.0.0.6.1 (Activé)
G2 - GCE: Preference [User Data\Default] [pelmeidfhdlhlbjimpabfcbnnojbboma] Quick Start v.3.2.0, (Désactivé) =>PUP.QuickStart
---\\ Liste des dossiers d'extension Google Chrome
~ Google Lines Browser: 17 Legitimates Filtered in 00mn 03s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21
---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: AOL Toolbar BHO [64Bits] - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} . (.AOL LLC - AOL IE Toolbar Dynamic Link Library.) -- C:\Program Files (x86)\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Adblock Plus for IE Browser Helper Object [64Bits] - {FFCB3198-32F3-4E8B-9539-4324694ED664} . (.Adblock Plus - Adblock Plus Module.) -- C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll
~ BHO: 17 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: (no name) - [HKLM]{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} Clé orpheline
O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll =>Toolbar.Google
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{DE9C389F-3316-41A7-809B-AA305ED9D922} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{DB89E9A0-FA7F-48D6-89BB-2B8B53A26E87} Clé orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Animations d'email.lnk . (.Adobe Systems Incorporated - Adobe Reader.) -- C:\Program Files (x86)\IncrediMail\Bin\EmailAnimationUrl.url (.not file.)
O4 - GS\Desktop [Public]: Augmentez la vitesse de votre ordinateur !.lnk . (.Adobe Systems Incorporated - Adobe Reader.) -- C:\Program Files (x86)\IncrediMail\Bin\Iobit.url (.not file.)
O4 - GS\Desktop [Public]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [Public]: HP Support Assistant.lnk . (.Hewlett-Packard Company - HP Support Assistant.) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe =>.Hewlett-Packard Co
O4 - GS\Desktop [Public]: Jouer à HP Games.lnk . (...) -- C:\Program Files (x86)\HP Games\onplay\onplay.exe
O4 - GS\Desktop [Public]: McAfee Security Scan Plus.lnk . (.McAfee, Inc. - McAfee.) -- C:\Program Files\McAfee Security Scan\3.8.141\McUICnt.exe
O4 - GS\Desktop [Public]: Photo Animation Creator.lnk . (...) -- C:\Program Files (x86)\Photo Notifier and Animation Creator\Application\Bin\pnac.exe
O4 - GS\Desktop [Public]: Photo Notifier Creator.lnk . (...) -- C:\Program Files (x86)\Photo Notifier and Animation Creator\Application\Bin\pnac.exe
O4 - GS\Desktop [Public]: Wallpapers by IncrediMail.lnk . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\IncrediMail\Bin\FreeWallpapersDesktop.url =>.Skype Technologies S.A.
O4 - GS\Program [Public]: IncrediMail.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O4 - GS\Program [Public]: Magic Desktop.lnk . (.EasyBits Software AS - EasyBits Security Shield.) -- C:\Program Files (x86)\EasyBits For Kids\ezSecShield.exe =>.EasyBits Software AS
O4 - GS\QuickLaunch [Elisabeth]: Babylon.lnk . (...) -- C:\Program Files (x86)\Babylon\Babylon-Pro\Babylon.exe (.not file.) =>PUP.Babylon
O4 - GS\QuickLaunch [Elisabeth]: Check PC For Errors.lnk . (.Support.com - ARO 2011.) -- C:\Program Files (x86)\ARO 2011\ARO.exe
O4 - GS\QuickLaunch [Elisabeth]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Elisabeth]: IncrediMail 2.0.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O4 - GS\QuickLaunch [Elisabeth]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [Elisabeth]: HP MediaSmart Webcam.lnk . (.CyberLink Corp. - HPMediaSmartWebcam.) -- C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\HPMediaSmartWebcam.exe
O4 - GS\TaskBar [Elisabeth]: HP MediaSmart.lnk . (...) -- C:\Program Files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (.not file.)
O4 - GS\TaskBar [Elisabeth]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Program [Elisabeth]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [Elisabeth]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Elisabeth]: Check PC For Errors.lnk . (.Support.com - ARO 2011.) -- C:\Program Files (x86)\ARO 2011\ARO.exe
O4 - GS\Desktop [Elisabeth]: Images - Raccourci.lnk . (...) -- C:\Users\Elisabeth\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms
O4 - GS\Desktop [Elisabeth]: IncrediMail.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O4 - GS\Desktop [Elisabeth]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Elisabeth]: Live PC Help.lnk - Clé orpheline
O4 - GS\Desktop [Elisabeth]: Mes images - Raccourci.lnk . (...) -- C:\Users\Elisabeth\Pictures\Mes images
O4 - GS\Desktop [Elisabeth]: Solitaire.lnk - Clé orpheline
O4 - GS\Desktop [Elisabeth]: USA - Raccourci.lnk . (...) -- C:\Users\Elisabeth\Pictures\Mes images\USA
O4 - GS\Desktop [Elisabeth]: Ventes à venir - Raccourci.lnk - Clé orpheline
~ Global Startup: 91 Legitimates Filtered in 00mn 05s
---\\ Applications lancées au démarrage du système (O4)
O4 - GS\Startup [Public]: McAfee Security Scan Plus.lnk . (.McAfee, Inc. - McAfee Security Scanner Scheduler.) -- C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
O4 - HKLM\..\Run: [SysTrayApp] . (.IDT, Inc. - IDT PC Audio.) -- C:\Program Files\IDT\WDM\sttray64.exe
O4 - HKLM\..\Run: [AmIcoSinglun64] . (.AlcorMicro Co., Ltd. - Single LUN Icon Utility for VID 058F PID 63.) -- C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
O4 - HKLM\..\Run: [Apoint] . (.Alps Electric Co., Ltd. - Alps Pointing-device Driver.) -- C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [SmartMenu] . (.Pas de propriétaire - SmartMenu.) -- C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\bin\jusched.exe =>.Oracle Corporation
O4 - HKLM\..\RunOnce: [NCPluginUpdater] . (.Hewlett-Packard - NCPluginUpdater.) -- C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe
O4 - HKCU\..\Run: [AROReminder] . (.Support.com - ARO 2011.) -- C:\Program Files (x86)\ARO 2011\ARO.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe =>.Advanced Micro Devices, Inc
O4 - HKLM\..\Wow6432Node\Run: [HPCam_Menu] . (.CyberLink Corp. - MUI StartMenu Application.) -- c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Wow6432Node\Run: [QlbCtrl.exe] . (. Hewlett-Packard Development Company, L.P. - Quick Launch Buttons.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
O4 - HKLM\..\Wow6432Node\Run: [UpdatePRCShortCut] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Wow6432Node\Run: [Easybits Recovery] . (.EasyBits Software AS - Pas de description.) -- C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe =>.EasyBits Software AS
O4 - HKLM\..\Wow6432Node\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe =>.Hewlett-Packard Co
O4 - HKLM\..\Wow6432Node\Run: [WirelessAssistant] . (.Hewlett-Packard Company - HP Wireless Assistant Main Program.) -- C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [TkBellExe] . (.RealNetworks, Inc. - RealNetworks Scheduler.) -- c:\program files (x86)\real\realplayer\Update\realsched.exe =>.RealNetworks, Inc
O4 - HKLM\..\Wow6432Node\Run: [Magic Desktop for HP notification] . (.Easybits - Software update notification.) -- C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe
O4 - HKLM\..\Wow6432Node\Run: [AvastUI.exe] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-3283381568-904949491-440556053-1001\..\Run: [AROReminder] . (.Support.com - ARO 2011.) -- C:\Program Files (x86)\ARO 2011\ARO.exe
O4 - HKUS\S-1-5-21-3283381568-904949491-440556053-1001\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
~ Application: Scanned in 00mn 00s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll,-102 [64Bits] - {25510184-5A38-4A99-B273-DCA8EEF6CD08} . (...) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\Resources\Icons\HP.ico
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{86C12D1D-F119-42C0-A788-50DA0A72BC76}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{9522C11D-FB3D-4F1D-BC23-5E5F5E47EE1B}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{86C12D1D-F119-42C0-A788-50DA0A72BC76}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{9522C11D-FB3D-4F1D-BC23-5E5F5E47EE1B}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{86C12D1D-F119-42C0-A788-50DA0A72BC76}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{9522C11D-FB3D-4F1D-BC23-5E5F5E47EE1B}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\ARO 2011.job [248]
[MD5.659CB37944BFCCA3FE6EBDFEB3BB99F4] [APT] [ARO 2011] (.Support.com.) -- C:\Program Files (x86)\ARO 2011\ARO.exe [2312048]
[MD5.00000000000000000000000000000000] [APT] [Updater27096.exe] (...) -- C:\Users\Elisabeth\AppData\Local\Updater27096\Updater27096.exe (.not file.) [0] =>PUP.CrossRider
[MD5.00000000000000000000000000000000] [APT] [{433E2897-7D42-498B-AF9C-A8BFBC5E6AA0}] (...) -- C:\Program Files (x86)\INCRED~2\UNWISE.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{A72AEAF4-5B19-4913-B6B4-6C7A6279D139}] (...) -- C:\Users\Elisabeth\AppData\Roaming\awesomehp\UninstallManager.exe (.not file.) [0] =>PUP.Awesomehp
~ Scheduled Task: 23 Legitimates Filtered in 00mn 08s
---\\ Logiciels installés (O42)
O42 - Logiciel: ARO 2011 - (.Support.com.) [HKLM][64Bits] -- ARO 2011_is1
O42 - Logiciel: IncrediMail - (.IncrediMail.) [HKLM][64Bits] -- {5E97F3BD-CDDC-4188-9D98-532E14FABB5D}
O42 - Logiciel: IncrediMail 2.0 - (.IncrediMail Ltd..) [HKLM][64Bits] -- IncrediMail
~ Logic: 56 Legitimates Filtered in 00mn 01s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\ELIGCHK]
[HKCU\Software\IM]
[HKCU\Software\IncrediMail]
[HKLM\Software\Wow6432Node\mamverifier]
~ Key Software: 296 Legitimates Filtered in 00mn 01s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 03/04/2010 - 17:44:39 - [28,898] ----D C:\Program Files (x86)\ACCESS.FR-FR
O43 - CFD: 03/04/2010 - 17:44:49 - [26,388] ----D C:\Program Files (x86)\ADMIN
O43 - CFD: 17/04/2011 - 14:52:35 - [14,181] ----D C:\Program Files (x86)\ARO 2011
O43 - CFD: 03/04/2010 - 17:44:51 - [1,262] ----D C:\Program Files (x86)\CATALOG
O43 - CFD: 03/04/2010 - 17:44:53 - [16,448] ----D C:\Program Files (x86)\EXCEL.FR-FR
O43 - CFD: 04/04/2014 - 17:08:41 - [6,517] ----D C:\Program Files (x86)\GUM84C4.tmp
O43 - CFD: 15/08/2011 - 20:23:14 - [26,519] ----D C:\Program Files (x86)\IncrediMail
O43 - CFD: 03/04/2010 - 17:44:56 - [28,297] ----D C:\Program Files (x86)\INFOPATH.FR-FR
O43 - CFD: 03/04/2010 - 17:44:59 - [32,849] ----D C:\Program Files (x86)\OFFICE.FR-FR
O43 - CFD: 03/04/2010 - 17:45:00 - [0,493] ----D C:\Program Files (x86)\OFFICE64.FR-FR
O43 - CFD: 03/04/2010 - 17:44:09 - [81,725] ----D C:\Program Files (x86)\PROOFING.FR-FR
O43 - CFD: 03/04/2010 - 17:44:33 - [251,833] ----D C:\Program Files (x86)\PROPLUS.WW
O43 - CFD: 03/04/2010 - 17:44:35 - [1,558] ----D C:\Program Files (x86)\ROSEBUD.FR-FR
O43 - CFD: 03/04/2010 - 17:44:35 - [0] ----D C:\Program Files (x86)\UPDATES
O43 - CFD: 03/04/2010 - 17:44:36 - [17,681] ----D C:\Program Files (x86)\WORD.FR-FR
O43 - CFD: 06/02/2010 - 18:23:45 - [0] ----D C:\ProgramData\IM
O43 - CFD: 06/02/2010 - 18:21:47 - [6,747] ----D C:\ProgramData\IncrediMail
O43 - CFD: 07/02/2010 - 10:58:53 - [0,915] ----D C:\Users\Elisabeth\AppData\Roaming\igraal
O43 - CFD: 19/05/2013 - 19:53:46 - [1387,161] ----D C:\Users\Elisabeth\AppData\Local\IM
~ 11 Dossier CLSID vide (CLSID Empty Folder)
~ Program Folder: 191 Legitimates Filtered in 07mn 50s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.82F3F674AF68553498F5E6D9554EA20B] - 05/04/2014 - 06:54:36 ---A- . (...) -- C:\Windows\IE11_main.log [288555]
O44 - LFC:[MD5.DA132AE285739B5902EC8AA3D1CC5290] - 05/04/2014 - 09:43:28 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [26192]
O44 - LFC:[MD5.DA132AE285739B5902EC8AA3D1CC5290] - 05/04/2014 - 09:43:28 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [26192]
O44 - LFC:[MD5.CB8572E790FCE09714143741C20E9934] - 21/03/2014 - 11:08:41 ---A- . (...) -- C:\Windows\System32\sasnative64.exe [16896]
~ Files: 23 Legitimates Filtered in 00mn 25s
---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.B98D0CB02AA863EB54EE06EC634581AC] - 05/04/2014 - 08:24:22 ---A- - C:\Windows\Prefetch\AOLFRTBSERVER.EXE-3B15653C.pf
O45 - LFCP:[MD5.E597D73318B9CCB0698DEC0D67631184] - 05/04/2014 - 08:32:44 ---A- - C:\Windows\Prefetch\INCMAIL.EXE-F91AEC10.pf
O45 - LFCP:[MD5.85AC4C5B103ED83CD90C4B304206B64A] - 05/04/2014 - 08:32:46 ---A- - C:\Windows\Prefetch\IMAPP.EXE-3E2B42CA.pf
O45 - LFCP:[MD5.E4C9847AF4EB086B6AA9FFB85DE2E3A1] - 05/04/2014 - 09:33:42 ---A- - C:\Windows\Prefetch\IMLPP.EXE-C9266A11.pf
O45 - LFCP:[MD5.27C9B576F761BCB6B21989912C776058] - 17/03/2014 - 07:52:14 ---A- - C:\Windows\Prefetch\RESOURCE.EXE-E971D367.pf
O45 - LFCP:[MD5.72A25F210BF4C3EAF2DDB4EA662A5610] - 31/03/2014 - 16:59:12 ---A- - C:\Windows\Prefetch\ARO.EXE-907CCEF1.pf
~ Prefetcher: 6 Legitimates Filtered in 00mn 00s
---\\ Clé de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{058fcb9c-8055-11e0-8039-0021cc3edd34}\AutoRun\command. (...) -- E:\ReadMe.exe (.not file.)
~ Keys: Scanned in 00mn 00s
---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKCU\...\Policies\System] - "WallpaperStyle"=
~ MWPS: 21 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.8D4B8BF93C65BDBC133B20706A3B5208] - 04/04/2014 - 16:14:54 ---A- . (...) -- C:\Windows\System32\Drivers\aswRvrt.sys [65776]
O58 - SDL:[MD5.0606875650850B0697D662934529F6FC] - 04/04/2014 - 16:14:54 ---A- . (...) -- C:\Windows\System32\Drivers\aswVmm.sys [208928]
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:[MD5.356BB3DD25987179080F3B669AD4080A] - 07/09/2010 - 02:04:00 ---A- . (.Novatek - Camera mini Driver.) -- C:\Windows\System32\Drivers\nvtcam.sys [2755072]
O58 - SDL:[MD5.A82C5B6269184DF2A62A164B65917372] - 07/09/2010 - 02:03:44 ---A- . (.Novatek - Camera mini Driver.) -- C:\Windows\System32\Drivers\nvtcamd2.sys [36224]
O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
O58 - SDL:[MD5.8D1CE4322A35F840711B87927CB57C05] - 13/08/2009 - 21:09:38 ---A- . (.IDT, Inc. - IDT PC Audio.) -- C:\Windows\System32\Drivers\stwrt64.sys [487936]
~ Drivers: 21 Legitimates Filtered in 00mn 15s
---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 02/04/2014 - 10:48:09 ---A- . (...) -- C:\Users\Elisabeth\AppData\Local\AOL France Toolbar\ieToolbar\fr-FR\pagealerts.xml [2924]
O61 - LFC: 04/04/2014 - 11:05:24 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\Sammsoft\ARO\Version 2011\Logs\ARO2011_custom_3044.txt [34]
O61 - LFC: 05/04/2014 - 10:48:09 ---A- . (...) -- C:\Users\Elisabeth\AppData\Local\AOL France Toolbar\ieToolbar\fr-FR\publish.xml [77]
O61 - LFC: 05/04/2014 - 10:48:16 ---A- . (...) -- C:\Users\Elisabeth\AppData\Local\IM\content.xml [44539]
O61 - LFC: 05/04/2014 - 11:05:24 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\Sammsoft\ARO\Version 2011\Logs\ARO2011_custom_3232.txt [34]
O61 - LFC: 05/04/2014 - 11:05:24 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\ZHP\Log.txt [21521] =>.Nicolas Coolman
O61 - LFC: 05/04/2014 - 11:05:24 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\ZHP\TestsZHPDiag.txt [2954] =>.Nicolas Coolman
~ 171 Fichiers temporaires (Temporary files)
~ Files: 286 Legitimates Filtered in 18mn 11s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (...) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {5A9A4B33-AFBA-4B6E-BF37-B992E6C14788} - (Google) - https://www.google.com/?gws_rd=ssl
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Google) - https://www.google.com/?gws_rd=ssl
O69 - SBI: SearchScopes [HKCU] {7D7AE29F-C990-4602-A381-7B85EAA69B32} - (AOL search) - http://slirsredirect.search.aol.com
O69 - SBI: SearchScopes [HKCU] {E27FFF02-2968-4F54-BD1C-2EDC76821299} - (Yahoo!) - https://fr.search.yahoo.com/
O69 - SBI: SearchScopes [HKCU] {EFF8551B-142B-48DC-98EE-A112AACFA12E} - (AOL Recherche) - http://slirsredirect.search.aol.com
~ Keys: Scanned in 00mn 00s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.CE929D8A3F04F180CCD94A22257E3A7F] [SPRF][29/01/2014] (...) -- C:\Users\Elisabeth\AppData\Roaming\wklnhst.dat [508]
~ Files: 2 Legitimates Filtered in 00mn 00s
---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{68722F66-D758-4447-BCA7-777588A0A242}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files (x86)\LimeWire\LimeWire.exe (.not file.)
O87 - FAEL: "{85CD2F6E-302F-412E-88B5-AD9E9D6DF89C}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files (x86)\LimeWire\LimeWire.exe (.not file.)
O87 - FAEL: "{90E82949-8579-43A4-9B3B-C004DEC87BB2}" | In - Public - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{96C30E2E-F4BA-4F28-90DC-63F9910D72E3}" | In - Public - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{EF02A774-6235-4A31-8331-5A0A1EBB63E2}" | In - Public - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{79191566-E488-437F-AC36-7BE6E5744EDF}" | In - Public - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{5E2C9B15-2FB6-4216-B3D6-5F3EC083FF08}" | In - Public - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "{9B8D3C96-FA6E-4F7F-B851-D27BFEBF2122}" | In - Public - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "TCP Query User{F2FB198A-F5D2-48B8-87A4-D7B0CB88842B}C:\program files (x86)\freetvradio\freetvradio.exe" |In - Private - P6 - TRUE | .(...) -- C:\program files (x86)\freetvradio\freetvradio.exe (.not file.) =>Adware.SPointer
O87 - FAEL: "UDP Query User{A28C2BF5-98C7-4041-9A50-039AC9FE15E8}C:\program files (x86)\freetvradio\freetvradio.exe" |In - Private - P17 - TRUE | .(...) -- C:\program files (x86)\freetvradio\freetvradio.exe (.not file.) =>Adware.SPointer
O87 - FAEL: "{35FE58CE-2459-4F36-B50F-EF54750431C7}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{D3ADF49E-B435-4993-A100-06986FC6A864}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{C8E08AD5-63DA-4FB3-B7D2-FA56BC5E61D3}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "{2FAE321D-F2E6-47D0-88E3-61543B7EFA55}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "{C7742555-F6F5-4A39-8210-0301596419B5}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{37250D27-4231-47A8-AD6B-246A21C9D783}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{64070E53-C9FF-4915-A30F-26EA9E34D9C2}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{E60B3BD4-C917-49CC-A41E-D763F02429BB}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{361A6133-CD11-4564-8488-B276B0D5CF47}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
~ Firewall: 223 Legitimates Filtered in 00mn 03s
---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "DB3F79E5CDDC8814D98935E241AFBBD5" . (.IncrediMail.) -- C:\Windows\Installer\{5E97F3BD-CDDC-4188-9D98-532E14FABB5D}\ARPPRODUCTICON.exe
~ Update Products: 160 Legitimates Filtered in 00mn 00s
---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.8FFB0EE18F9233D86A4400A12259897A] [WIS][08/10/2013] (.Eyeo GmbH - Adblock Plus for IE.) -- C:\Windows\Installer\84e5418.msi [2588672]
[MD5.9D193210E3209AB2EDD8BB8A63D62C2C] [WIS][17/06/2012] (.IncrediMail - IncrediMail.) -- C:\Windows\Installer\dae82.msi [2892800]
~ WIS: 171 Legitimates Filtered in 00mn 20s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 12/03/2014 257928 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 22/05/2009 250616 | (GameConsoleService) . (.WildTangent, Inc..) - C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe
SS - | Auto 19/04/2010 135664 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 19/04/2010 135664 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 18/08/2013 194032 | (gusvc) . (.Google.) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Demand 16/01/2014 289256 | (McComponentHostService) . (.McAfee, Inc..) - C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe
SR - | Auto 10/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 02/03/2009 89600 | (AESTFilters) . (.Andrea Electronics Corporation.) - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b87ff64c8b56b7db\AESTSr64.exe
SR - | Auto 22/09/2009 203264 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 04/04/2014 50344 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SR - | Demand 25/02/2010 227896 | (Com4QLBEx) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\ezsvc7.dll (ezSharedSvc) . (.EasyBits Sofware AS.) - C:\Windows\System32\svchost.exe
SR - | Auto 27/09/2012 86528 | (HP Support Assistant Service) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe =>.Hewlett-Packard Co
SR - | Demand 10/08/2012 1001376 | (hpqwmiex) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
SR - | Auto 08/07/2009 30520 | (hpsrv) . (.Hewlett-Packard.) - C:\Windows\System32\Hpservice.exe
SR - | Auto 14/08/2013 39056 | (RealNetworks Downloader Resolver Service) . (...) - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
SR - | Auto 21/01/2009 247152 | (RichVideo) . (...) - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
SR - | Auto 13/08/2009 240640 | (STacSV) . (.IDT, Inc..) - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b87ff64c8b56b7db\STacSV64.exe
SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 25s
---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Run by Elisabeth at 05/04/2014 11:11:51
~ OS 64 not supported by MBR tool
~ MBR: 0 Legitimates Filtered in 00mn 00s
---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Elisabeth at 05/04/2014 11:11:53
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 02s
---\\ Scan Additionnel (O88)
Database Version : 13036 - (03/04/2014)
Clés trouvées (Keys found) : 11
Valeurs trouvées (Values found) : 1
Dossiers trouvés (Folders found) : 3
Fichiers trouvés (Files found) : 14
[HKLM\Software\Google\Chrome\Extensions\cnmdgidklhhnmppphpohildcefnaaflp] =>PUP.CrossRider^
[HKLM\Software\Google\Chrome\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon] =>Toolbar.Conduit^
[HKLM\Software\Google\Chrome\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma] =>PUP.QuickStart^
[HKCR\VirtualStore\MACHINE\Software\CToolbar] =>Toolbar.Crawler
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375] =>PUP.Tarma
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5] =>PUP.Tarma
[HKLM\Software\Classes\aolfrTb.AOLToolBand.1] =>Toolbar.Agent
[HKLM\Software\Classes\AOLTB.AOLToolBand.1] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Classes\aolfrTb.AOLToolBand.1] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Classes\AOLTB.AOLToolBand.1] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110211701196}] =>PUP.CrossRider
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{2318C2B1-4965-11d4-9B18-009027A5CD4F} =>Toolbar.Google^
C:\Users\Elisabeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp =>PUP.CrossRider^
C:\Users\Elisabeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon =>Toolbar.Conduit^
C:\Users\Elisabeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma =>PUP.QuickStart^
C:\Users\Elisabeth\AppData\Local\Temp\uninst1.exe =>PUP.Babylon
C:\Users\Elisabeth\AppData\Local\Temp\GoogleToolbarInstaller1.log =>PUP.Babylon
C:\Users\Elisabeth\AppData\Local\Temp\GoogleToolbarInstaller2.log =>PUP.Babylon
C:\Users\Elisabeth\AppData\Local\Temp\GLF184F.tmp.tbChez.dll =>Toolbar.Conduit
C:\Users\Elisabeth\AppData\Local\Temp\GLF93B5.tmp.tbRadi.dll =>Toolbar.Conduit
C:\Users\Elisabeth\AppData\Local\Temp\GLFACD1.tmp.tbRadi.dll =>Toolbar.Conduit
C:\Users\Elisabeth\AppData\Local\Temp\nsi7870.tmp.tbIncr.dll =>Toolbar.Conduit
C:\Users\Elisabeth\AppData\Local\Temp\tbIncr.dll =>Toolbar.Conduit
~ Additionnel Scan: 368825 Items scanned in 01mn 25s
---\\ Récapitulatif des détections trouvées sur votre station
http://nicolascoolman.webs.com/apps/blog/show/27583526-pup-crossrider =>PUP.CrossRider
http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit
http://nicolascoolman.webs.com/apps/blog/show/41962558-pup-quickstart =>PUP.QuickStart
http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon =>PUP.Babylon
http://nicolascoolman.webs.com/apps/blog/show/41011964-pup-awesomehp =>PUP.Awesomehp
http://nicolascoolman.webs.com/apps/blog/show/27556476-adware-spointer =>Adware.SPointer
http://nicolascoolman.webs.com/apps/blog/show/29637859-toolbar-tarma =>PUP.Tarma
~ MSI: 7 link(s) detected in 00mn 00s
~ 1543 Legitimates filtered by white list
End of the scan (576 lines in 35mn 11s)(0)
So what à présent si je ne puis coller le lien sur CJoint.com ??
Merci encore !
ECh
lilidurhone
Messages postés
43343
Date d'inscription
lundi 25 avril 2011
Statut
Contributeur sécurité
Dernière intervention
19 juillet 2024
3 807
5 avril 2014 à 11:51
5 avril 2014 à 11:51
Coucou
Tu peux suivre ceci
Réinitialise tes navigateurs et ou manuellement reparamètre tes navigateurs WEB (page de démarrage, moteur de recherche etc) mais aussi supprimer/désactiver les extensions inutiles/parasites :
* Internet Explorer et modules complémentaires / moteurs de recherche : https://forum.malekal.com/viewtopic.php?t=41399&start=
* Firefox : https://www.malekal.com/reparer-firefox/?t=36057&start=
* Google Chrome : https://www.malekal.com/reparer-google-chrome/?t=35837&start=
NOTE : Pour Firefox et Google Chrome - si rien ne va, il y a la possibilité de les désinstaller/réinstaller, voir liens explicatifs ci-dessus.
Surtout pour les extensions ;)
Tu peux suivre ceci
Réinitialise tes navigateurs et ou manuellement reparamètre tes navigateurs WEB (page de démarrage, moteur de recherche etc) mais aussi supprimer/désactiver les extensions inutiles/parasites :
* Internet Explorer et modules complémentaires / moteurs de recherche : https://forum.malekal.com/viewtopic.php?t=41399&start=
* Firefox : https://www.malekal.com/reparer-firefox/?t=36057&start=
* Google Chrome : https://www.malekal.com/reparer-google-chrome/?t=35837&start=
NOTE : Pour Firefox et Google Chrome - si rien ne va, il y a la possibilité de les désinstaller/réinstaller, voir liens explicatifs ci-dessus.
Surtout pour les extensions ;)
Luvsba
Messages postés
51
Date d'inscription
lundi 26 mars 2012
Statut
Membre
Dernière intervention
12 avril 2020
2
5 avril 2014 à 18:47
5 avril 2014 à 18:47
Bonsoir,
Et mes excuses, Lilidurhone, pour ce silence.... mais j'ai eu quelques "ennuis" (entre autres, c'est la journée...) sur le PC familial, une question de serveur Proxy, car soudain, les fenêtres de démarrage n'étaient "plus connectées à ce serveur" (!!) et, n'étant pas spécialiste - mais aimant chercher... - j'ai pu constater que la case de détection automatique était décochée et celle où se trouve l'adresse du serveur, elle, cochée, alors que sur mon laptop - après vérif. - c'était le contraire !
Bref, apparemment, j'ai dû faire le bon choix, mais est-ce que ça ne va pas à nouveau se décocher ?? Qui vivra verra....
Tout ça pour dire que, suivant vos conseils, je pense que cette m... de Awesomehp a disparu, étant donné que j'ai redémarré le laptop et.... plus rien !!
Ouf ! Rassurez-moi, ça ne va pas revenir ??
Comme il est apparu avec Java, que faut-il que je fasse, dès l'instant où certains logiciels ne peuvent "travailler" qu'avec Java ??
Merci encore et, soyons optimiste(s),
A la prochaine, car il y a des gens vraiment au top chez vous !!
Bon Dimanche à vous et aux autres !
Elisabeth
Et mes excuses, Lilidurhone, pour ce silence.... mais j'ai eu quelques "ennuis" (entre autres, c'est la journée...) sur le PC familial, une question de serveur Proxy, car soudain, les fenêtres de démarrage n'étaient "plus connectées à ce serveur" (!!) et, n'étant pas spécialiste - mais aimant chercher... - j'ai pu constater que la case de détection automatique était décochée et celle où se trouve l'adresse du serveur, elle, cochée, alors que sur mon laptop - après vérif. - c'était le contraire !
Bref, apparemment, j'ai dû faire le bon choix, mais est-ce que ça ne va pas à nouveau se décocher ?? Qui vivra verra....
Tout ça pour dire que, suivant vos conseils, je pense que cette m... de Awesomehp a disparu, étant donné que j'ai redémarré le laptop et.... plus rien !!
Ouf ! Rassurez-moi, ça ne va pas revenir ??
Comme il est apparu avec Java, que faut-il que je fasse, dès l'instant où certains logiciels ne peuvent "travailler" qu'avec Java ??
Merci encore et, soyons optimiste(s),
A la prochaine, car il y a des gens vraiment au top chez vous !!
Bon Dimanche à vous et aux autres !
Elisabeth
lilidurhone
Messages postés
43343
Date d'inscription
lundi 25 avril 2011
Statut
Contributeur sécurité
Dernière intervention
19 juillet 2024
3 807
5 avril 2014 à 20:28
5 avril 2014 à 20:28
Refais zhpdiag
Luvsba
Messages postés
51
Date d'inscription
lundi 26 mars 2012
Statut
Membre
Dernière intervention
12 avril 2020
2
6 avril 2014 à 10:11
6 avril 2014 à 10:11
Bonjour Lilidurhone,
Ci-après, le copier-coller du nouveau diagnostic de ZHP.
Est-ce que vous me l'avez préconisé par rapport à mon problème de Proxy sur le PC (comparaison éventuelle avec ce laptop) ou autre ??
J'extrapole peut-être......!
Voici :
~ Rapport de ZHPDiag v2014.4.3.2 - Nicolas Coolman (03/04/2014)
~ Lancé par Elisabeth (06/04/2014 09:23:33)
~ Adresse du Site Web https://nicolascoolman.webs.com/
~ Forums gratuits d'Assistance à la désinfection : https://nicolascoolman.webs.com/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by program
---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16844 (Defaut)
GCIE: Google Chrome v33.0.1750.154
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 3Q6C9
Windows License : OK
~ Windows Remaining Initializations Number : 2
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ Logiciels de protection du système
avast! Free Antivirus v9.0.2016
Malwarebytes Anti-Malware version 1.75.0.1300
McAfee Security Scan Plus v3.8.141.11
Windows Defender W7
---\\ Logiciels d'optimisation du système
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 12 Plugin
Adobe Reader X
Java 7 Update 51
---\\ Informations sur le système
~ Processor: AMD64 Family 15 Model 107 Stepping 2, AuthenticAMD
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3836 MB (36% free)
System Restore: Activé (Enable)
System drive C: has 152 GB (53%) free of 285 GB
---\\ Mode de connexion au système
~ Computer Name: LISBETH-PC
~ User Name: Elisabeth
~ All Users Names: Elisabeth, Administrateur,
~ Unselected Option: None
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Elisabeth\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Elisabeth\AppData\Roaming\
~ %Desktop% : C:\Users\Elisabeth\Desktop\
~ %Favorites% : C:\Users\Elisabeth\Favorites\
~ %LocalAppData% : C:\Users\Elisabeth\AppData\Local\
~ %StartMenu% : C:\Users\Elisabeth\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 152 Go of 285 Go)
D: Hard drive, Flash drive, Thumb drive (Free 2 Go of 13 Go)
---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 44 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.79EDF01FA13D886F8E1B655D542011FB] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.23/02/2014 - 09:13:41.) -- C:\Windows\System32\wininet.dll [2241536]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/09/2013 - 02:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/18604
~ Mes musiques (My Musics) : 2/29
~ Mes Videos (My Videos) : 2/66
~ Mes Favoris (My Favorites) : 1/151
~ Mes Documents (My Documents) : 92/2859
~ Mon Bureau (My Desktop) : 1/20
~ Menu demarrer (Programs) : 1/29
~ Hidden Files: Scanned in 00mn 26s
---\\ Processus lancés
[MD5.8F89E6CB82E6DB45BC993D423CD0FDBD] - (. Hewlett-Packard Development Company, L.P. - Quick Launch Buttons.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe [323640] [PID.2060]
[MD5.5516C26A6AF8EB4E2CAB48EC98A74398] - (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe [54576] [PID.3976]
[MD5.48BE298F7FD1BEF4D8FBACB04D8D95C4] - (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576] [PID.6108]
[MD5.F6158734F1E24C6C510155CF0D363911] - (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512] [PID.1900]
[MD5.BDEFC081D02C162DCB90738BE432D66B] - (.Easybits - Software update notification.) -- C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1258504] [PID.8180]
[MD5.4BFA1849DC7AA3CB99C160D9EB96C67B] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640] [PID.6428]
[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336] [PID.5944]
[MD5.0DE3C7622EC33126579B1742260F08C2] - (.Pas de propriétaire - HpqToaster Module.) -- C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe [632888] [PID.5536]
[MD5.F71D97B6B631D565AF7C6E0BDF9D49F4] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\IEXPLORE.exe [770736] [PID.6240]
[MD5.B508A4EE516D905730458BB50B79979B] - (.CyberLink - CyberLink MediaLibray Service.) -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe [206120] [PID.4924]
[MD5.49A3B0500DCBB24C15E7B5C4EA9D1CC8] - (.AOL Inc. - AOL France Toolbar Server.) -- c:\program files (x86)\aol france toolbar\aolfrtbServer.exe [278344] [PID.7680]
[MD5.4A59A9F53628FD76EAA3EDFE9903BBFD] - (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe [366536] [PID.3104]
[MD5.F4762082DDCFD241BE8BA5DD35133F4A] - (.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe [264136] [PID.6728]
[MD5.5397E32E882C0148CEC13D9EACFB7157] - (.Microsoft Corporation - Internet Low-Mic Utility Tool.) -- C:\Program Files (x86)\Internet Explorer\IELowutil.exe [222208] [PID.8956]
[MD5.E75DA1FAAFC9B69CCD0940F95C9D1CF7] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8182272] [PID.9068]
[MD5.BEA8D0FA8805CC2E6BB49728166699C7] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344] [PID.1436]
[MD5.ADDA5E1951B90D3D23C56D3CF0622ADC] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65640] [PID.1876]
[MD5.96EFEC24346A8EB1157E80523079ADDC] - (...) -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056] [PID.348]
[MD5.498EB62A160674E793FA40FD65390625] - (.Pas de propriétaire - RichVideo Module.) -- C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152] [PID.424]
[MD5.9B7EDD3FE7C211C36E921D34D18A3A0A] - (.Hewlett-Packard Company - HP Software Framework WMI Service.) -- C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe [1001376] [PID.3188]
[MD5.C7A0E61D5714AC20DE52D4F66EC773B8] - (.Hewlett-Packard Development Company, L.P. - Com for QLB application.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [227896] [PID.5092]
~ Processes Running: Scanned in 00mn 02s
---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Elisabeth\AppData\Local\Google\Chrome\User Data\Default\Preferences
G1 - GCS: Preference [User Data\Default] https://www.google.com/?gws_rd=ssl
G2 - GCE: Preference [User Data\Default] [bopakagnckmlgajfccecajhnimjiiedh] McAfee Security Scan+ v.3.8.141.12 (Désactivé)
G2 - GCE: Preference [User Data\Default] [cnmdgidklhhnmppphpohildcefnaaflp] Services x86 v.1.22.22 (Activé) =>PUP.CrossRider
G2 - GCE: Preference [User Data\Default] [lcnnhcneegeeojhgpfijnlnocjdmlaon] Value apps v.1.7.0.2, (Activé) =>Toolbar.Conduit
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Wallet v.0.0.6.1 (Activé)
G2 - GCE: Preference [User Data\Default] [pelmeidfhdlhlbjimpabfcbnnojbboma] Quick Start v.3.2.0, (Désactivé) =>PUP.QuickStart
---\\ Liste des dossiers d'extension Google Chrome
~ Google Lines Browser: 17 Legitimates Filtered in 00mn 03s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21
---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: AOL Toolbar BHO [64Bits] - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} . (.AOL LLC - AOL IE Toolbar Dynamic Link Library.) -- C:\Program Files (x86)\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Adblock Plus for IE Browser Helper Object [64Bits] - {FFCB3198-32F3-4E8B-9539-4324694ED664} . (.Adblock Plus - Adblock Plus Module.) -- C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll
~ BHO: 17 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: (no name) - [HKLM]{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} Clé orpheline
O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll =>Toolbar.Google
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{DE9C389F-3316-41A7-809B-AA305ED9D922} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{DB89E9A0-FA7F-48D6-89BB-2B8B53A26E87} Clé orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Animations d'email.lnk . (.Adobe Systems Incorporated - Adobe Reader.) -- C:\Program Files (x86)\IncrediMail\Bin\EmailAnimationUrl.url (.not file.)
O4 - GS\Desktop [Public]: Augmentez la vitesse de votre ordinateur !.lnk . (.Adobe Systems Incorporated - Adobe Reader.) -- C:\Program Files (x86)\IncrediMail\Bin\Iobit.url (.not file.)
O4 - GS\Desktop [Public]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [Public]: HP Support Assistant.lnk . (.Hewlett-Packard Company - HP Support Assistant.) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe =>.Hewlett-Packard Co
O4 - GS\Desktop [Public]: Jouer à HP Games.lnk . (...) -- C:\Program Files (x86)\HP Games\onplay\onplay.exe
O4 - GS\Desktop [Public]: McAfee Security Scan Plus.lnk . (.McAfee, Inc. - McAfee.) -- C:\Program Files\McAfee Security Scan\3.8.141\McUICnt.exe
O4 - GS\Desktop [Public]: Photo Animation Creator.lnk . (...) -- C:\Program Files (x86)\Photo Notifier and Animation Creator\Application\Bin\pnac.exe
O4 - GS\Desktop [Public]: Photo Notifier Creator.lnk . (...) -- C:\Program Files (x86)\Photo Notifier and Animation Creator\Application\Bin\pnac.exe
O4 - GS\Desktop [Public]: Wallpapers by IncrediMail.lnk . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\IncrediMail\Bin\FreeWallpapersDesktop.url =>.Skype Technologies S.A.
O4 - GS\Program [Public]: IncrediMail.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O4 - GS\Program [Public]: Magic Desktop.lnk . (.EasyBits Software AS - EasyBits Security Shield.) -- C:\Program Files (x86)\EasyBits For Kids\ezSecShield.exe =>.EasyBits Software AS
O4 - GS\QuickLaunch [Elisabeth]: Babylon.lnk . (...) -- C:\Program Files (x86)\Babylon\Babylon-Pro\Babylon.exe (.not file.) =>PUP.Babylon
O4 - GS\QuickLaunch [Elisabeth]: Check PC For Errors.lnk . (.Support.com - ARO 2011.) -- C:\Program Files (x86)\ARO 2011\ARO.exe
O4 - GS\QuickLaunch [Elisabeth]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Elisabeth]: IncrediMail 2.0.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O4 - GS\QuickLaunch [Elisabeth]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [Elisabeth]: HP MediaSmart Webcam.lnk . (.CyberLink Corp. - HPMediaSmartWebcam.) -- C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\HPMediaSmartWebcam.exe
O4 - GS\TaskBar [Elisabeth]: HP MediaSmart.lnk . (...) -- C:\Program Files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (.not file.)
O4 - GS\TaskBar [Elisabeth]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Program [Elisabeth]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [Elisabeth]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Elisabeth]: Check PC For Errors.lnk . (.Support.com - ARO 2011.) -- C:\Program Files (x86)\ARO 2011\ARO.exe
O4 - GS\Desktop [Elisabeth]: Images - Raccourci.lnk . (...) -- C:\Users\Elisabeth\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms
O4 - GS\Desktop [Elisabeth]: IncrediMail.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O4 - GS\Desktop [Elisabeth]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Elisabeth]: Live PC Help.lnk - Clé orpheline
O4 - GS\Desktop [Elisabeth]: Mes images - Raccourci.lnk . (...) -- C:\Users\Elisabeth\Pictures\Mes images
O4 - GS\Desktop [Elisabeth]: Solitaire.lnk - Clé orpheline
O4 - GS\Desktop [Elisabeth]: USA - Raccourci.lnk . (...) -- C:\Users\Elisabeth\Pictures\Mes images\USA
O4 - GS\Desktop [Elisabeth]: Ventes à venir - Raccourci.lnk - Clé orpheline
~ Global Startup: 91 Legitimates Filtered in 00mn 06s
---\\ Applications lancées au démarrage du système (O4)
O4 - GS\Startup [Public]: McAfee Security Scan Plus.lnk . (.McAfee, Inc. - McAfee Security Scanner Scheduler.) -- C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
O4 - HKLM\..\Run: [SysTrayApp] . (.IDT, Inc. - IDT PC Audio.) -- C:\Program Files\IDT\WDM\sttray64.exe
O4 - HKLM\..\Run: [AmIcoSinglun64] . (.AlcorMicro Co., Ltd. - Single LUN Icon Utility for VID 058F PID 63.) -- C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
O4 - HKLM\..\Run: [Apoint] . (.Alps Electric Co., Ltd. - Alps Pointing-device Driver.) -- C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [SmartMenu] . (.Pas de propriétaire - SmartMenu.) -- C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\bin\jusched.exe =>.Oracle Corporation
O4 - HKLM\..\RunOnce: [NCPluginUpdater] . (.Hewlett-Packard - NCPluginUpdater.) -- C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe
O4 - HKCU\..\Run: [AROReminder] . (.Support.com - ARO 2011.) -- C:\Program Files (x86)\ARO 2011\ARO.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe =>.Advanced Micro Devices, Inc
O4 - HKLM\..\Wow6432Node\Run: [HPCam_Menu] . (.CyberLink Corp. - MUI StartMenu Application.) -- c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Wow6432Node\Run: [QlbCtrl.exe] . (. Hewlett-Packard Development Company, L.P. - Quick Launch Buttons.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
O4 - HKLM\..\Wow6432Node\Run: [UpdatePRCShortCut] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Wow6432Node\Run: [Easybits Recovery] . (.EasyBits Software AS - Pas de description.) -- C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe =>.EasyBits Software AS
O4 - HKLM\..\Wow6432Node\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe =>.Hewlett-Packard Co
O4 - HKLM\..\Wow6432Node\Run: [WirelessAssistant] . (.Hewlett-Packard Company - HP Wireless Assistant Main Program.) -- C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [TkBellExe] . (.RealNetworks, Inc. - RealNetworks Scheduler.) -- c:\program files (x86)\real\realplayer\Update\realsched.exe =>.RealNetworks, Inc
O4 - HKLM\..\Wow6432Node\Run: [Magic Desktop for HP notification] . (.Easybits - Software update notification.) -- C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe
O4 - HKLM\..\Wow6432Node\Run: [AvastUI.exe] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-3283381568-904949491-440556053-1001\..\Run: [AROReminder] . (.Support.com - ARO 2011.) -- C:\Program Files (x86)\ARO 2011\ARO.exe
O4 - HKUS\S-1-5-21-3283381568-904949491-440556053-1001\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
~ Application: Scanned in 00mn 00s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll,-102 [64Bits] - {25510184-5A38-4A99-B273-DCA8EEF6CD08} . (...) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\Resources\Icons\HP.ico
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{86C12D1D-F119-42C0-A788-50DA0A72BC76}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{9522C11D-FB3D-4F1D-BC23-5E5F5E47EE1B}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{86C12D1D-F119-42C0-A788-50DA0A72BC76}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{9522C11D-FB3D-4F1D-BC23-5E5F5E47EE1B}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{86C12D1D-F119-42C0-A788-50DA0A72BC76}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{9522C11D-FB3D-4F1D-BC23-5E5F5E47EE1B}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\ARO 2011.job [248]
[MD5.659CB37944BFCCA3FE6EBDFEB3BB99F4] [APT] [ARO 2011] (.Support.com.) -- C:\Program Files (x86)\ARO 2011\ARO.exe [2312048]
[MD5.00000000000000000000000000000000] [APT] [Updater27096.exe] (...) -- C:\Users\Elisabeth\AppData\Local\Updater27096\Updater27096.exe (.not file.) [0] =>PUP.CrossRider
[MD5.00000000000000000000000000000000] [APT] [{433E2897-7D42-498B-AF9C-A8BFBC5E6AA0}] (...) -- C:\Program Files (x86)\INCRED~2\UNWISE.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{A72AEAF4-5B19-4913-B6B4-6C7A6279D139}] (...) -- C:\Users\Elisabeth\AppData\Roaming\awesomehp\UninstallManager.exe (.not file.) [0] =>PUP.Awesomehp
~ Scheduled Task: 24 Legitimates Filtered in 00mn 09s
---\\ Logiciels installés (O42)
O42 - Logiciel: ARO 2011 - (.Support.com.) [HKLM][64Bits] -- ARO 2011_is1
O42 - Logiciel: IncrediMail - (.IncrediMail.) [HKLM][64Bits] -- {5E97F3BD-CDDC-4188-9D98-532E14FABB5D}
O42 - Logiciel: IncrediMail 2.0 - (.IncrediMail Ltd..) [HKLM][64Bits] -- IncrediMail
~ Logic: 56 Legitimates Filtered in 00mn 02s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\ELIGCHK]
[HKCU\Software\IM]
[HKCU\Software\IncrediMail]
[HKLM\Software\Wow6432Node\mamverifier]
~ Key Software: 296 Legitimates Filtered in 00mn 02s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 03/04/2010 - 17:44:39 - [28,898] ----D C:\Program Files (x86)\ACCESS.FR-FR
O43 - CFD: 03/04/2010 - 17:44:49 - [26,388] ----D C:\Program Files (x86)\ADMIN
O43 - CFD: 17/04/2011 - 14:52:35 - [14,181] ----D C:\Program Files (x86)\ARO 2011
O43 - CFD: 03/04/2010 - 17:44:51 - [1,262] ----D C:\Program Files (x86)\CATALOG
O43 - CFD: 03/04/2010 - 17:44:53 - [16,448] ----D C:\Program Files (x86)\EXCEL.FR-FR
O43 - CFD: 04/04/2014 - 17:08:41 - [6,517] ----D C:\Program Files (x86)\GUM84C4.tmp
O43 - CFD: 15/08/2011 - 20:23:14 - [26,519] ----D C:\Program Files (x86)\IncrediMail
O43 - CFD: 03/04/2010 - 17:44:56 - [28,297] ----D C:\Program Files (x86)\INFOPATH.FR-FR
O43 - CFD: 03/04/2010 - 17:44:59 - [32,849] ----D C:\Program Files (x86)\OFFICE.FR-FR
O43 - CFD: 03/04/2010 - 17:45:00 - [0,493] ----D C:\Program Files (x86)\OFFICE64.FR-FR
O43 - CFD: 03/04/2010 - 17:44:09 - [81,725] ----D C:\Program Files (x86)\PROOFING.FR-FR
O43 - CFD: 03/04/2010 - 17:44:33 - [251,833] ----D C:\Program Files (x86)\PROPLUS.WW
O43 - CFD: 03/04/2010 - 17:44:35 - [1,558] ----D C:\Program Files (x86)\ROSEBUD.FR-FR
O43 - CFD: 03/04/2010 - 17:44:35 - [0] ----D C:\Program Files (x86)\UPDATES
O43 - CFD: 03/04/2010 - 17:44:36 - [17,681] ----D C:\Program Files (x86)\WORD.FR-FR
O43 - CFD: 06/02/2010 - 18:23:45 - [0] ----D C:\ProgramData\IM
O43 - CFD: 06/02/2010 - 18:21:47 - [6,747] ----D C:\ProgramData\IncrediMail
O43 - CFD: 07/02/2010 - 10:58:53 - [0,915] ----D C:\Users\Elisabeth\AppData\Roaming\igraal
O43 - CFD: 19/05/2013 - 19:53:46 - [1389,116] ----D C:\Users\Elisabeth\AppData\Local\IM
~ 11 Dossier CLSID vide (CLSID Empty Folder)
~ Program Folder: 191 Legitimates Filtered in 06mn 48s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.EE0314A1492F2231E436795558F56954] - 06/04/2014 - 07:51:14 ---A- . (...) -- C:\Windows\IE11_main.log [292961]
O44 - LFC:[MD5.7C6CE24D479AA5EF83F830C619A2220E] - 06/04/2014 - 08:28:44 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [26192]
O44 - LFC:[MD5.7C6CE24D479AA5EF83F830C619A2220E] - 06/04/2014 - 08:28:44 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [26192]
~ Files: 23 Legitimates Filtered in 00mn 25s
---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.F8344024003A56FDF985DB29D8391E72] - 05/04/2014 - 17:18:44 ---A- - C:\Windows\Prefetch\AOLFRTBSERVER.EXE-3B15653C.pf
O45 - LFCP:[MD5.FF3523D16A92637E2062D7B72ABA023D] - 05/04/2014 - 17:47:52 ---A- - C:\Windows\Prefetch\INCMAIL.EXE-F91AEC10.pf
O45 - LFCP:[MD5.86C01B704F3809E53D36BD46CC56588A] - 05/04/2014 - 17:47:55 ---A- - C:\Windows\Prefetch\IMAPP.EXE-3E2B42CA.pf
O45 - LFCP:[MD5.F0626ABA440BC66CFBF96A27B718E6D9] - 06/04/2014 - 08:14:23 ---A- - C:\Windows\Prefetch\IMLPP.EXE-C9266A11.pf
O45 - LFCP:[MD5.27C9B576F761BCB6B21989912C776058] - 17/03/2014 - 07:52:14 ---A- - C:\Windows\Prefetch\RESOURCE.EXE-E971D367.pf
O45 - LFCP:[MD5.72A25F210BF4C3EAF2DDB4EA662A5610] - 31/03/2014 - 16:59:12 ---A- - C:\Windows\Prefetch\ARO.EXE-907CCEF1.pf
~ Prefetcher: 6 Legitimates Filtered in 00mn 00s
---\\ Clé de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{058fcb9c-8055-11e0-8039-0021cc3edd34}\AutoRun\command. (...) -- E:\ReadMe.exe (.not file.)
~ Keys: Scanned in 00mn 00s
---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKCU\...\Policies\System] - "WallpaperStyle"=
~ MWPS: 21 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.8D4B8BF93C65BDBC133B20706A3B5208] - 04/04/2014 - 16:14:54 ---A- . (...) -- C:\Windows\System32\Drivers\aswRvrt.sys [65776]
O58 - SDL:[MD5.0606875650850B0697D662934529F6FC] - 04/04/2014 - 16:14:54 ---A- . (...) -- C:\Windows\System32\Drivers\aswVmm.sys [208928]
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:[MD5.356BB3DD25987179080F3B669AD4080A] - 07/09/2010 - 02:04:00 ---A- . (.Novatek - Camera mini Driver.) -- C:\Windows\System32\Drivers\nvtcam.sys [2755072]
O58 - SDL:[MD5.A82C5B6269184DF2A62A164B65917372] - 07/09/2010 - 02:03:44 ---A- . (.Novatek - Camera mini Driver.) -- C:\Windows\System32\Drivers\nvtcamd2.sys [36224]
O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
O58 - SDL:[MD5.8D1CE4322A35F840711B87927CB57C05] - 13/08/2009 - 21:09:38 ---A- . (.IDT, Inc. - IDT PC Audio.) -- C:\Windows\System32\Drivers\stwrt64.sys [487936]
~ Drivers: 21 Legitimates Filtered in 00mn 06s
---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 04/04/2014 - 09:49:13 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\Sammsoft\ARO\Version 2011\Logs\ARO2011_custom_3044.txt [34]
O61 - LFC: 05/04/2014 - 09:32:28 ---A- . (...) -- C:\Users\Elisabeth\AppData\Local\AOL France Toolbar\ieToolbar\fr-FR\publish.xml [77]
O61 - LFC: 05/04/2014 - 09:32:35 ---A- . (...) -- C:\Users\Elisabeth\AppData\Local\IM\content.xml [44539]
O61 - LFC: 05/04/2014 - 09:49:13 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\Sammsoft\ARO\Version 2011\Logs\ARO2011_custom_3232.txt [34]
O61 - LFC: 05/04/2014 - 09:49:13 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\Sammsoft\ARO\Version 2011\Logs\ARO2011_custom_9208.txt [34]
O61 - LFC: 05/04/2014 - 09:49:13 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\ZHP\ZHPADSReport.txt [351] =>.Nicolas Coolman
O61 - LFC: 05/04/2014 - 09:49:13 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\ZHP\ZHPDiag.txt [45764] =>.Nicolas Coolman
O61 - LFC: 05/04/2014 - 09:49:28 ---A- . (.Elisabeth.) -- C:\Users\Elisabeth\Documents\Rapport de ZHPDiag v2014 - 05-04-2014.doc [81920] =>.Nicolas Coolman
O61 - LFC: 05/04/2014 - 09:49:40 --HA- . (...) -- C:\Users\Elisabeth\Documents\~$pport de ZHPDiag v2014 - 05-04-2014.doc [162] =>.Nicolas Coolman
O61 - LFC: 06/04/2014 - 09:49:13 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\ZHP\Log.txt [46627] =>.Nicolas Coolman
O61 - LFC: 06/04/2014 - 09:49:13 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\ZHP\TestsZHPDiag.txt [2954] =>.Nicolas Coolman
~ 144 Fichiers temporaires (Temporary files)
~ Files: 271 Legitimates Filtered in 17mn 38s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (...) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {5A9A4B33-AFBA-4B6E-BF37-B992E6C14788} [DefaultScope] - (Google) - https://www.google.com/?gws_rd=ssl
O69 - SBI: SearchScopes [HKCU] {7D7AE29F-C990-4602-A381-7B85EAA69B32} - (AOL search) - http://slirsredirect.search.aol.com
O69 - SBI: SearchScopes [HKCU] {E27FFF02-2968-4F54-BD1C-2EDC76821299} - (Yahoo!) - https://fr.search.yahoo.com/
O69 - SBI: SearchScopes [HKCU] {EFF8551B-142B-48DC-98EE-A112AACFA12E} - (AOL Recherche) - http://slirsredirect.search.aol.com
~ Keys: Scanned in 00mn 00s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.CE929D8A3F04F180CCD94A22257E3A7F] [SPRF][29/01/2014] (...) -- C:\Users\Elisabeth\AppData\Roaming\wklnhst.dat [508]
~ Files: 2 Legitimates Filtered in 00mn 00s
---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{68722F66-D758-4447-BCA7-777588A0A242}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files (x86)\LimeWire\LimeWire.exe (.not file.)
O87 - FAEL: "{85CD2F6E-302F-412E-88B5-AD9E9D6DF89C}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files (x86)\LimeWire\LimeWire.exe (.not file.)
O87 - FAEL: "{90E82949-8579-43A4-9B3B-C004DEC87BB2}" | In - Public - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{96C30E2E-F4BA-4F28-90DC-63F9910D72E3}" | In - Public - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{EF02A774-6235-4A31-8331-5A0A1EBB63E2}" | In - Public - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{79191566-E488-437F-AC36-7BE6E5744EDF}" | In - Public - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{5E2C9B15-2FB6-4216-B3D6-5F3EC083FF08}" | In - Public - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "{9B8D3C96-FA6E-4F7F-B851-D27BFEBF2122}" | In - Public - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "TCP Query User{F2FB198A-F5D2-48B8-87A4-D7B0CB88842B}C:\program files (x86)\freetvradio\freetvradio.exe" |In - Private - P6 - TRUE | .(...) -- C:\program files (x86)\freetvradio\freetvradio.exe (.not file.) =>Adware.SPointer
O87 - FAEL: "UDP Query User{A28C2BF5-98C7-4041-9A50-039AC9FE15E8}C:\program files (x86)\freetvradio\freetvradio.exe" |In - Private - P17 - TRUE | .(...) -- C:\program files (x86)\freetvradio\freetvradio.exe (.not file.) =>Adware.SPointer
O87 - FAEL: "{35FE58CE-2459-4F36-B50F-EF54750431C7}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{D3ADF49E-B435-4993-A100-06986FC6A864}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{C8E08AD5-63DA-4FB3-B7D2-FA56BC5E61D3}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "{2FAE321D-F2E6-47D0-88E3-61543B7EFA55}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "{C7742555-F6F5-4A39-8210-0301596419B5}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{37250D27-4231-47A8-AD6B-246A21C9D783}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{64070E53-C9FF-4915-A30F-26EA9E34D9C2}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{E60B3BD4-C917-49CC-A41E-D763F02429BB}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{361A6133-CD11-4564-8488-B276B0D5CF47}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
~ Firewall: 223 Legitimates Filtered in 00mn 03s
---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "DB3F79E5CDDC8814D98935E241AFBBD5" . (.IncrediMail.) -- C:\Windows\Installer\{5E97F3BD-CDDC-4188-9D98-532E14FABB5D}\ARPPRODUCTICON.exe
~ Update Products: 160 Legitimates Filtered in 00mn 00s
---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.8FFB0EE18F9233D86A4400A12259897A] [WIS][08/10/2013] (.Eyeo GmbH - Adblock Plus for IE.) -- C:\Windows\Installer\84e5418.msi [2588672]
[MD5.9D193210E3209AB2EDD8BB8A63D62C2C] [WIS][17/06/2012] (.IncrediMail - IncrediMail.) -- C:\Windows\Installer\dae82.msi [2892800]
~ WIS: 171 Legitimates Filtered in 00mn 21s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 12/03/2014 257928 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 22/05/2009 250616 | (GameConsoleService) . (.WildTangent, Inc..) - C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe
SS - | Auto 19/04/2010 135664 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 19/04/2010 135664 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 18/08/2013 194032 | (gusvc) . (.Google.) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Demand 16/01/2014 289256 | (McComponentHostService) . (.McAfee, Inc..) - C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe
SR - | Auto 10/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 02/03/2009 89600 | (AESTFilters) . (.Andrea Electronics Corporation.) - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b87ff64c8b56b7db\AESTSr64.exe
SR - | Auto 22/09/2009 203264 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 04/04/2014 50344 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SR - | Demand 25/02/2010 227896 | (Com4QLBEx) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\ezsvc7.dll (ezSharedSvc) . (.EasyBits Sofware AS.) - C:\Windows\System32\svchost.exe
SR - | Auto 27/09/2012 86528 | (HP Support Assistant Service) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe =>.Hewlett-Packard Co
SR - | Demand 10/08/2012 1001376 | (hpqwmiex) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
SR - | Auto 08/07/2009 30520 | (hpsrv) . (.Hewlett-Packard.) - C:\Windows\System32\Hpservice.exe
SR - | Auto 14/08/2013 39056 | (RealNetworks Downloader Resolver Service) . (...) - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
SR - | Auto 21/01/2009 247152 | (RichVideo) . (...) - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
SR - | Auto 13/08/2009 240640 | (STacSV) . (.IDT, Inc..) - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b87ff64c8b56b7db\STacSV64.exe
SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 25s
---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Run by Elisabeth at 06/04/2014 09:56:12
~ OS 64 not supported by MBR tool
~ MBR: 0 Legitimates Filtered in 00mn 00s
---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Elisabeth at 06/04/2014 09:56:14
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 02s
---\\ Scan Additionnel (O88)
Database Version : 13036 - (03/04/2014)
Clés trouvées (Keys found) : 11
Valeurs trouvées (Values found) : 1
Dossiers trouvés (Folders found) : 3
Fichiers trouvés (Files found) : 14
[HKLM\Software\Google\Chrome\Extensions\cnmdgidklhhnmppphpohildcefnaaflp] =>PUP.CrossRider^
[HKLM\Software\Google\Chrome\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon] =>Toolbar.Conduit^
[HKLM\Software\Google\Chrome\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma] =>PUP.QuickStart^
[HKCR\VirtualStore\MACHINE\Software\CToolbar] =>Toolbar.Crawler
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375] =>PUP.Tarma
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5] =>PUP.Tarma
[HKLM\Software\Classes\aolfrTb.AOLToolBand.1] =>Toolbar.Agent
[HKLM\Software\Classes\AOLTB.AOLToolBand.1] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Classes\aolfrTb.AOLToolBand.1] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Classes\AOLTB.AOLToolBand.1] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110211701196}] =>PUP.CrossRider
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{2318C2B1-4965-11d4-9B18-009027A5CD4F} =>Toolbar.Google^
C:\Users\Elisabeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp =>PUP.CrossRider^
C:\Users\Elisabeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon =>Toolbar.Conduit^
C:\Users\Elisabeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma =>PUP.QuickStart^
C:\Users\Elisabeth\AppData\Local\Temp\uninst1.exe =>PUP.Babylon
C:\Users\Elisabeth\AppData\Local\Temp\GoogleToolbarInstaller1.log =>PUP.Babylon
C:\Users\Elisabeth\AppData\Local\Temp\GoogleToolbarInstaller2.log =>PUP.Babylon
C:\Users\Elisabeth\AppData\Local\Temp\GLF184F.tmp.tbChez.dll =>Toolbar.Conduit
C:\Users\Elisabeth\AppData\Local\Temp\GLF93B5.tmp.tbRadi.dll =>Toolbar.Conduit
C:\Users\Elisabeth\AppData\Local\Temp\GLFACD1.tmp.tbRadi.dll =>Toolbar.Conduit
C:\Users\Elisabeth\AppData\Local\Temp\nsi7870.tmp.tbIncr.dll =>Toolbar.Conduit
C:\Users\Elisabeth\AppData\Local\Temp\tbIncr.dll =>Toolbar.Conduit
~ Additionnel Scan: 369105 Items scanned in 01mn 23s
---\\ Récapitulatif des détections trouvées sur votre station
http://nicolascoolman.webs.com/apps/blog/show/27583526-pup-crossrider =>PUP.CrossRider
http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit
http://nicolascoolman.webs.com/apps/blog/show/41962558-pup-quickstart =>PUP.QuickStart
http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon =>PUP.Babylon
http://nicolascoolman.webs.com/apps/blog/show/41011964-pup-awesomehp =>PUP.Awesomehp
http://nicolascoolman.webs.com/apps/blog/show/27556476-adware-spointer =>Adware.SPointer
http://nicolascoolman.webs.com/apps/blog/show/29637859-toolbar-tarma =>PUP.Tarma
~ MSI: 7 link(s) detected in 00mn 00s
~ 1529 Legitimates filtered by white list
End of the scan (579 lines in 34mn 07s)(0)
Merci
ECh
Ci-après, le copier-coller du nouveau diagnostic de ZHP.
Est-ce que vous me l'avez préconisé par rapport à mon problème de Proxy sur le PC (comparaison éventuelle avec ce laptop) ou autre ??
J'extrapole peut-être......!
Voici :
~ Rapport de ZHPDiag v2014.4.3.2 - Nicolas Coolman (03/04/2014)
~ Lancé par Elisabeth (06/04/2014 09:23:33)
~ Adresse du Site Web https://nicolascoolman.webs.com/
~ Forums gratuits d'Assistance à la désinfection : https://nicolascoolman.webs.com/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by program
---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16844 (Defaut)
GCIE: Google Chrome v33.0.1750.154
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 3Q6C9
Windows License : OK
~ Windows Remaining Initializations Number : 2
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ Logiciels de protection du système
avast! Free Antivirus v9.0.2016
Malwarebytes Anti-Malware version 1.75.0.1300
McAfee Security Scan Plus v3.8.141.11
Windows Defender W7
---\\ Logiciels d'optimisation du système
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 12 Plugin
Adobe Reader X
Java 7 Update 51
---\\ Informations sur le système
~ Processor: AMD64 Family 15 Model 107 Stepping 2, AuthenticAMD
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3836 MB (36% free)
System Restore: Activé (Enable)
System drive C: has 152 GB (53%) free of 285 GB
---\\ Mode de connexion au système
~ Computer Name: LISBETH-PC
~ User Name: Elisabeth
~ All Users Names: Elisabeth, Administrateur,
~ Unselected Option: None
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Elisabeth\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Elisabeth\AppData\Roaming\
~ %Desktop% : C:\Users\Elisabeth\Desktop\
~ %Favorites% : C:\Users\Elisabeth\Favorites\
~ %LocalAppData% : C:\Users\Elisabeth\AppData\Local\
~ %StartMenu% : C:\Users\Elisabeth\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 152 Go of 285 Go)
D: Hard drive, Flash drive, Thumb drive (Free 2 Go of 13 Go)
---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 44 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.79EDF01FA13D886F8E1B655D542011FB] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.23/02/2014 - 09:13:41.) -- C:\Windows\System32\wininet.dll [2241536]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/09/2013 - 02:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/18604
~ Mes musiques (My Musics) : 2/29
~ Mes Videos (My Videos) : 2/66
~ Mes Favoris (My Favorites) : 1/151
~ Mes Documents (My Documents) : 92/2859
~ Mon Bureau (My Desktop) : 1/20
~ Menu demarrer (Programs) : 1/29
~ Hidden Files: Scanned in 00mn 26s
---\\ Processus lancés
[MD5.8F89E6CB82E6DB45BC993D423CD0FDBD] - (. Hewlett-Packard Development Company, L.P. - Quick Launch Buttons.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe [323640] [PID.2060]
[MD5.5516C26A6AF8EB4E2CAB48EC98A74398] - (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe [54576] [PID.3976]
[MD5.48BE298F7FD1BEF4D8FBACB04D8D95C4] - (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576] [PID.6108]
[MD5.F6158734F1E24C6C510155CF0D363911] - (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512] [PID.1900]
[MD5.BDEFC081D02C162DCB90738BE432D66B] - (.Easybits - Software update notification.) -- C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1258504] [PID.8180]
[MD5.4BFA1849DC7AA3CB99C160D9EB96C67B] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640] [PID.6428]
[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336] [PID.5944]
[MD5.0DE3C7622EC33126579B1742260F08C2] - (.Pas de propriétaire - HpqToaster Module.) -- C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe [632888] [PID.5536]
[MD5.F71D97B6B631D565AF7C6E0BDF9D49F4] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\IEXPLORE.exe [770736] [PID.6240]
[MD5.B508A4EE516D905730458BB50B79979B] - (.CyberLink - CyberLink MediaLibray Service.) -- c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe [206120] [PID.4924]
[MD5.49A3B0500DCBB24C15E7B5C4EA9D1CC8] - (.AOL Inc. - AOL France Toolbar Server.) -- c:\program files (x86)\aol france toolbar\aolfrtbServer.exe [278344] [PID.7680]
[MD5.4A59A9F53628FD76EAA3EDFE9903BBFD] - (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe [366536] [PID.3104]
[MD5.F4762082DDCFD241BE8BA5DD35133F4A] - (.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe [264136] [PID.6728]
[MD5.5397E32E882C0148CEC13D9EACFB7157] - (.Microsoft Corporation - Internet Low-Mic Utility Tool.) -- C:\Program Files (x86)\Internet Explorer\IELowutil.exe [222208] [PID.8956]
[MD5.E75DA1FAAFC9B69CCD0940F95C9D1CF7] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8182272] [PID.9068]
[MD5.BEA8D0FA8805CC2E6BB49728166699C7] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344] [PID.1436]
[MD5.ADDA5E1951B90D3D23C56D3CF0622ADC] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65640] [PID.1876]
[MD5.96EFEC24346A8EB1157E80523079ADDC] - (...) -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056] [PID.348]
[MD5.498EB62A160674E793FA40FD65390625] - (.Pas de propriétaire - RichVideo Module.) -- C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152] [PID.424]
[MD5.9B7EDD3FE7C211C36E921D34D18A3A0A] - (.Hewlett-Packard Company - HP Software Framework WMI Service.) -- C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe [1001376] [PID.3188]
[MD5.C7A0E61D5714AC20DE52D4F66EC773B8] - (.Hewlett-Packard Development Company, L.P. - Com for QLB application.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [227896] [PID.5092]
~ Processes Running: Scanned in 00mn 02s
---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Elisabeth\AppData\Local\Google\Chrome\User Data\Default\Preferences
G1 - GCS: Preference [User Data\Default] https://www.google.com/?gws_rd=ssl
G2 - GCE: Preference [User Data\Default] [bopakagnckmlgajfccecajhnimjiiedh] McAfee Security Scan+ v.3.8.141.12 (Désactivé)
G2 - GCE: Preference [User Data\Default] [cnmdgidklhhnmppphpohildcefnaaflp] Services x86 v.1.22.22 (Activé) =>PUP.CrossRider
G2 - GCE: Preference [User Data\Default] [lcnnhcneegeeojhgpfijnlnocjdmlaon] Value apps v.1.7.0.2, (Activé) =>Toolbar.Conduit
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Wallet v.0.0.6.1 (Activé)
G2 - GCE: Preference [User Data\Default] [pelmeidfhdlhlbjimpabfcbnnojbboma] Quick Start v.3.2.0, (Désactivé) =>PUP.QuickStart
---\\ Liste des dossiers d'extension Google Chrome
~ Google Lines Browser: 17 Legitimates Filtered in 00mn 03s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21
---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: AOL Toolbar BHO [64Bits] - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} . (.AOL LLC - AOL IE Toolbar Dynamic Link Library.) -- C:\Program Files (x86)\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Adblock Plus for IE Browser Helper Object [64Bits] - {FFCB3198-32F3-4E8B-9539-4324694ED664} . (.Adblock Plus - Adblock Plus Module.) -- C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll
~ BHO: 17 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: (no name) - [HKLM]{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} Clé orpheline
O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll =>Toolbar.Google
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{DE9C389F-3316-41A7-809B-AA305ED9D922} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{DB89E9A0-FA7F-48D6-89BB-2B8B53A26E87} Clé orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Animations d'email.lnk . (.Adobe Systems Incorporated - Adobe Reader.) -- C:\Program Files (x86)\IncrediMail\Bin\EmailAnimationUrl.url (.not file.)
O4 - GS\Desktop [Public]: Augmentez la vitesse de votre ordinateur !.lnk . (.Adobe Systems Incorporated - Adobe Reader.) -- C:\Program Files (x86)\IncrediMail\Bin\Iobit.url (.not file.)
O4 - GS\Desktop [Public]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [Public]: HP Support Assistant.lnk . (.Hewlett-Packard Company - HP Support Assistant.) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe =>.Hewlett-Packard Co
O4 - GS\Desktop [Public]: Jouer à HP Games.lnk . (...) -- C:\Program Files (x86)\HP Games\onplay\onplay.exe
O4 - GS\Desktop [Public]: McAfee Security Scan Plus.lnk . (.McAfee, Inc. - McAfee.) -- C:\Program Files\McAfee Security Scan\3.8.141\McUICnt.exe
O4 - GS\Desktop [Public]: Photo Animation Creator.lnk . (...) -- C:\Program Files (x86)\Photo Notifier and Animation Creator\Application\Bin\pnac.exe
O4 - GS\Desktop [Public]: Photo Notifier Creator.lnk . (...) -- C:\Program Files (x86)\Photo Notifier and Animation Creator\Application\Bin\pnac.exe
O4 - GS\Desktop [Public]: Wallpapers by IncrediMail.lnk . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\IncrediMail\Bin\FreeWallpapersDesktop.url =>.Skype Technologies S.A.
O4 - GS\Program [Public]: IncrediMail.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O4 - GS\Program [Public]: Magic Desktop.lnk . (.EasyBits Software AS - EasyBits Security Shield.) -- C:\Program Files (x86)\EasyBits For Kids\ezSecShield.exe =>.EasyBits Software AS
O4 - GS\QuickLaunch [Elisabeth]: Babylon.lnk . (...) -- C:\Program Files (x86)\Babylon\Babylon-Pro\Babylon.exe (.not file.) =>PUP.Babylon
O4 - GS\QuickLaunch [Elisabeth]: Check PC For Errors.lnk . (.Support.com - ARO 2011.) -- C:\Program Files (x86)\ARO 2011\ARO.exe
O4 - GS\QuickLaunch [Elisabeth]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Elisabeth]: IncrediMail 2.0.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O4 - GS\QuickLaunch [Elisabeth]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [Elisabeth]: HP MediaSmart Webcam.lnk . (.CyberLink Corp. - HPMediaSmartWebcam.) -- C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\HPMediaSmartWebcam.exe
O4 - GS\TaskBar [Elisabeth]: HP MediaSmart.lnk . (...) -- C:\Program Files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (.not file.)
O4 - GS\TaskBar [Elisabeth]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Program [Elisabeth]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [Elisabeth]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Elisabeth]: Check PC For Errors.lnk . (.Support.com - ARO 2011.) -- C:\Program Files (x86)\ARO 2011\ARO.exe
O4 - GS\Desktop [Elisabeth]: Images - Raccourci.lnk . (...) -- C:\Users\Elisabeth\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms
O4 - GS\Desktop [Elisabeth]: IncrediMail.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O4 - GS\Desktop [Elisabeth]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Elisabeth]: Live PC Help.lnk - Clé orpheline
O4 - GS\Desktop [Elisabeth]: Mes images - Raccourci.lnk . (...) -- C:\Users\Elisabeth\Pictures\Mes images
O4 - GS\Desktop [Elisabeth]: Solitaire.lnk - Clé orpheline
O4 - GS\Desktop [Elisabeth]: USA - Raccourci.lnk . (...) -- C:\Users\Elisabeth\Pictures\Mes images\USA
O4 - GS\Desktop [Elisabeth]: Ventes à venir - Raccourci.lnk - Clé orpheline
~ Global Startup: 91 Legitimates Filtered in 00mn 06s
---\\ Applications lancées au démarrage du système (O4)
O4 - GS\Startup [Public]: McAfee Security Scan Plus.lnk . (.McAfee, Inc. - McAfee Security Scanner Scheduler.) -- C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
O4 - HKLM\..\Run: [SysTrayApp] . (.IDT, Inc. - IDT PC Audio.) -- C:\Program Files\IDT\WDM\sttray64.exe
O4 - HKLM\..\Run: [AmIcoSinglun64] . (.AlcorMicro Co., Ltd. - Single LUN Icon Utility for VID 058F PID 63.) -- C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
O4 - HKLM\..\Run: [Apoint] . (.Alps Electric Co., Ltd. - Alps Pointing-device Driver.) -- C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [SmartMenu] . (.Pas de propriétaire - SmartMenu.) -- C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre6\bin\jusched.exe =>.Oracle Corporation
O4 - HKLM\..\RunOnce: [NCPluginUpdater] . (.Hewlett-Packard - NCPluginUpdater.) -- C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe
O4 - HKCU\..\Run: [AROReminder] . (.Support.com - ARO 2011.) -- C:\Program Files (x86)\ARO 2011\ARO.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe =>.Advanced Micro Devices, Inc
O4 - HKLM\..\Wow6432Node\Run: [HPCam_Menu] . (.CyberLink Corp. - MUI StartMenu Application.) -- c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Wow6432Node\Run: [QlbCtrl.exe] . (. Hewlett-Packard Development Company, L.P. - Quick Launch Buttons.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
O4 - HKLM\..\Wow6432Node\Run: [UpdatePRCShortCut] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Wow6432Node\Run: [Easybits Recovery] . (.EasyBits Software AS - Pas de description.) -- C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe =>.EasyBits Software AS
O4 - HKLM\..\Wow6432Node\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe =>.Hewlett-Packard Co
O4 - HKLM\..\Wow6432Node\Run: [WirelessAssistant] . (.Hewlett-Packard Company - HP Wireless Assistant Main Program.) -- C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [TkBellExe] . (.RealNetworks, Inc. - RealNetworks Scheduler.) -- c:\program files (x86)\real\realplayer\Update\realsched.exe =>.RealNetworks, Inc
O4 - HKLM\..\Wow6432Node\Run: [Magic Desktop for HP notification] . (.Easybits - Software update notification.) -- C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe
O4 - HKLM\..\Wow6432Node\Run: [AvastUI.exe] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-3283381568-904949491-440556053-1001\..\Run: [AROReminder] . (.Support.com - ARO 2011.) -- C:\Program Files (x86)\ARO 2011\ARO.exe
O4 - HKUS\S-1-5-21-3283381568-904949491-440556053-1001\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
~ Application: Scanned in 00mn 00s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll,-102 [64Bits] - {25510184-5A38-4A99-B273-DCA8EEF6CD08} . (...) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\Resources\Icons\HP.ico
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{86C12D1D-F119-42C0-A788-50DA0A72BC76}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{9522C11D-FB3D-4F1D-BC23-5E5F5E47EE1B}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{86C12D1D-F119-42C0-A788-50DA0A72BC76}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{9522C11D-FB3D-4F1D-BC23-5E5F5E47EE1B}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{86C12D1D-F119-42C0-A788-50DA0A72BC76}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{9522C11D-FB3D-4F1D-BC23-5E5F5E47EE1B}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\ARO 2011.job [248]
[MD5.659CB37944BFCCA3FE6EBDFEB3BB99F4] [APT] [ARO 2011] (.Support.com.) -- C:\Program Files (x86)\ARO 2011\ARO.exe [2312048]
[MD5.00000000000000000000000000000000] [APT] [Updater27096.exe] (...) -- C:\Users\Elisabeth\AppData\Local\Updater27096\Updater27096.exe (.not file.) [0] =>PUP.CrossRider
[MD5.00000000000000000000000000000000] [APT] [{433E2897-7D42-498B-AF9C-A8BFBC5E6AA0}] (...) -- C:\Program Files (x86)\INCRED~2\UNWISE.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{A72AEAF4-5B19-4913-B6B4-6C7A6279D139}] (...) -- C:\Users\Elisabeth\AppData\Roaming\awesomehp\UninstallManager.exe (.not file.) [0] =>PUP.Awesomehp
~ Scheduled Task: 24 Legitimates Filtered in 00mn 09s
---\\ Logiciels installés (O42)
O42 - Logiciel: ARO 2011 - (.Support.com.) [HKLM][64Bits] -- ARO 2011_is1
O42 - Logiciel: IncrediMail - (.IncrediMail.) [HKLM][64Bits] -- {5E97F3BD-CDDC-4188-9D98-532E14FABB5D}
O42 - Logiciel: IncrediMail 2.0 - (.IncrediMail Ltd..) [HKLM][64Bits] -- IncrediMail
~ Logic: 56 Legitimates Filtered in 00mn 02s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\ELIGCHK]
[HKCU\Software\IM]
[HKCU\Software\IncrediMail]
[HKLM\Software\Wow6432Node\mamverifier]
~ Key Software: 296 Legitimates Filtered in 00mn 02s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 03/04/2010 - 17:44:39 - [28,898] ----D C:\Program Files (x86)\ACCESS.FR-FR
O43 - CFD: 03/04/2010 - 17:44:49 - [26,388] ----D C:\Program Files (x86)\ADMIN
O43 - CFD: 17/04/2011 - 14:52:35 - [14,181] ----D C:\Program Files (x86)\ARO 2011
O43 - CFD: 03/04/2010 - 17:44:51 - [1,262] ----D C:\Program Files (x86)\CATALOG
O43 - CFD: 03/04/2010 - 17:44:53 - [16,448] ----D C:\Program Files (x86)\EXCEL.FR-FR
O43 - CFD: 04/04/2014 - 17:08:41 - [6,517] ----D C:\Program Files (x86)\GUM84C4.tmp
O43 - CFD: 15/08/2011 - 20:23:14 - [26,519] ----D C:\Program Files (x86)\IncrediMail
O43 - CFD: 03/04/2010 - 17:44:56 - [28,297] ----D C:\Program Files (x86)\INFOPATH.FR-FR
O43 - CFD: 03/04/2010 - 17:44:59 - [32,849] ----D C:\Program Files (x86)\OFFICE.FR-FR
O43 - CFD: 03/04/2010 - 17:45:00 - [0,493] ----D C:\Program Files (x86)\OFFICE64.FR-FR
O43 - CFD: 03/04/2010 - 17:44:09 - [81,725] ----D C:\Program Files (x86)\PROOFING.FR-FR
O43 - CFD: 03/04/2010 - 17:44:33 - [251,833] ----D C:\Program Files (x86)\PROPLUS.WW
O43 - CFD: 03/04/2010 - 17:44:35 - [1,558] ----D C:\Program Files (x86)\ROSEBUD.FR-FR
O43 - CFD: 03/04/2010 - 17:44:35 - [0] ----D C:\Program Files (x86)\UPDATES
O43 - CFD: 03/04/2010 - 17:44:36 - [17,681] ----D C:\Program Files (x86)\WORD.FR-FR
O43 - CFD: 06/02/2010 - 18:23:45 - [0] ----D C:\ProgramData\IM
O43 - CFD: 06/02/2010 - 18:21:47 - [6,747] ----D C:\ProgramData\IncrediMail
O43 - CFD: 07/02/2010 - 10:58:53 - [0,915] ----D C:\Users\Elisabeth\AppData\Roaming\igraal
O43 - CFD: 19/05/2013 - 19:53:46 - [1389,116] ----D C:\Users\Elisabeth\AppData\Local\IM
~ 11 Dossier CLSID vide (CLSID Empty Folder)
~ Program Folder: 191 Legitimates Filtered in 06mn 48s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.EE0314A1492F2231E436795558F56954] - 06/04/2014 - 07:51:14 ---A- . (...) -- C:\Windows\IE11_main.log [292961]
O44 - LFC:[MD5.7C6CE24D479AA5EF83F830C619A2220E] - 06/04/2014 - 08:28:44 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [26192]
O44 - LFC:[MD5.7C6CE24D479AA5EF83F830C619A2220E] - 06/04/2014 - 08:28:44 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [26192]
~ Files: 23 Legitimates Filtered in 00mn 25s
---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.F8344024003A56FDF985DB29D8391E72] - 05/04/2014 - 17:18:44 ---A- - C:\Windows\Prefetch\AOLFRTBSERVER.EXE-3B15653C.pf
O45 - LFCP:[MD5.FF3523D16A92637E2062D7B72ABA023D] - 05/04/2014 - 17:47:52 ---A- - C:\Windows\Prefetch\INCMAIL.EXE-F91AEC10.pf
O45 - LFCP:[MD5.86C01B704F3809E53D36BD46CC56588A] - 05/04/2014 - 17:47:55 ---A- - C:\Windows\Prefetch\IMAPP.EXE-3E2B42CA.pf
O45 - LFCP:[MD5.F0626ABA440BC66CFBF96A27B718E6D9] - 06/04/2014 - 08:14:23 ---A- - C:\Windows\Prefetch\IMLPP.EXE-C9266A11.pf
O45 - LFCP:[MD5.27C9B576F761BCB6B21989912C776058] - 17/03/2014 - 07:52:14 ---A- - C:\Windows\Prefetch\RESOURCE.EXE-E971D367.pf
O45 - LFCP:[MD5.72A25F210BF4C3EAF2DDB4EA662A5610] - 31/03/2014 - 16:59:12 ---A- - C:\Windows\Prefetch\ARO.EXE-907CCEF1.pf
~ Prefetcher: 6 Legitimates Filtered in 00mn 00s
---\\ Clé de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{058fcb9c-8055-11e0-8039-0021cc3edd34}\AutoRun\command. (...) -- E:\ReadMe.exe (.not file.)
~ Keys: Scanned in 00mn 00s
---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKCU\...\Policies\System] - "WallpaperStyle"=
~ MWPS: 21 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.8D4B8BF93C65BDBC133B20706A3B5208] - 04/04/2014 - 16:14:54 ---A- . (...) -- C:\Windows\System32\Drivers\aswRvrt.sys [65776]
O58 - SDL:[MD5.0606875650850B0697D662934529F6FC] - 04/04/2014 - 16:14:54 ---A- . (...) -- C:\Windows\System32\Drivers\aswVmm.sys [208928]
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:[MD5.356BB3DD25987179080F3B669AD4080A] - 07/09/2010 - 02:04:00 ---A- . (.Novatek - Camera mini Driver.) -- C:\Windows\System32\Drivers\nvtcam.sys [2755072]
O58 - SDL:[MD5.A82C5B6269184DF2A62A164B65917372] - 07/09/2010 - 02:03:44 ---A- . (.Novatek - Camera mini Driver.) -- C:\Windows\System32\Drivers\nvtcamd2.sys [36224]
O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
O58 - SDL:[MD5.8D1CE4322A35F840711B87927CB57C05] - 13/08/2009 - 21:09:38 ---A- . (.IDT, Inc. - IDT PC Audio.) -- C:\Windows\System32\Drivers\stwrt64.sys [487936]
~ Drivers: 21 Legitimates Filtered in 00mn 06s
---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 04/04/2014 - 09:49:13 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\Sammsoft\ARO\Version 2011\Logs\ARO2011_custom_3044.txt [34]
O61 - LFC: 05/04/2014 - 09:32:28 ---A- . (...) -- C:\Users\Elisabeth\AppData\Local\AOL France Toolbar\ieToolbar\fr-FR\publish.xml [77]
O61 - LFC: 05/04/2014 - 09:32:35 ---A- . (...) -- C:\Users\Elisabeth\AppData\Local\IM\content.xml [44539]
O61 - LFC: 05/04/2014 - 09:49:13 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\Sammsoft\ARO\Version 2011\Logs\ARO2011_custom_3232.txt [34]
O61 - LFC: 05/04/2014 - 09:49:13 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\Sammsoft\ARO\Version 2011\Logs\ARO2011_custom_9208.txt [34]
O61 - LFC: 05/04/2014 - 09:49:13 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\ZHP\ZHPADSReport.txt [351] =>.Nicolas Coolman
O61 - LFC: 05/04/2014 - 09:49:13 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\ZHP\ZHPDiag.txt [45764] =>.Nicolas Coolman
O61 - LFC: 05/04/2014 - 09:49:28 ---A- . (.Elisabeth.) -- C:\Users\Elisabeth\Documents\Rapport de ZHPDiag v2014 - 05-04-2014.doc [81920] =>.Nicolas Coolman
O61 - LFC: 05/04/2014 - 09:49:40 --HA- . (...) -- C:\Users\Elisabeth\Documents\~$pport de ZHPDiag v2014 - 05-04-2014.doc [162] =>.Nicolas Coolman
O61 - LFC: 06/04/2014 - 09:49:13 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\ZHP\Log.txt [46627] =>.Nicolas Coolman
O61 - LFC: 06/04/2014 - 09:49:13 ---A- . (...) -- C:\Users\Elisabeth\AppData\Roaming\ZHP\TestsZHPDiag.txt [2954] =>.Nicolas Coolman
~ 144 Fichiers temporaires (Temporary files)
~ Files: 271 Legitimates Filtered in 17mn 38s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (...) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {5A9A4B33-AFBA-4B6E-BF37-B992E6C14788} [DefaultScope] - (Google) - https://www.google.com/?gws_rd=ssl
O69 - SBI: SearchScopes [HKCU] {7D7AE29F-C990-4602-A381-7B85EAA69B32} - (AOL search) - http://slirsredirect.search.aol.com
O69 - SBI: SearchScopes [HKCU] {E27FFF02-2968-4F54-BD1C-2EDC76821299} - (Yahoo!) - https://fr.search.yahoo.com/
O69 - SBI: SearchScopes [HKCU] {EFF8551B-142B-48DC-98EE-A112AACFA12E} - (AOL Recherche) - http://slirsredirect.search.aol.com
~ Keys: Scanned in 00mn 00s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.CE929D8A3F04F180CCD94A22257E3A7F] [SPRF][29/01/2014] (...) -- C:\Users\Elisabeth\AppData\Roaming\wklnhst.dat [508]
~ Files: 2 Legitimates Filtered in 00mn 00s
---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{68722F66-D758-4447-BCA7-777588A0A242}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files (x86)\LimeWire\LimeWire.exe (.not file.)
O87 - FAEL: "{85CD2F6E-302F-412E-88B5-AD9E9D6DF89C}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files (x86)\LimeWire\LimeWire.exe (.not file.)
O87 - FAEL: "{90E82949-8579-43A4-9B3B-C004DEC87BB2}" | In - Public - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{96C30E2E-F4BA-4F28-90DC-63F9910D72E3}" | In - Public - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{EF02A774-6235-4A31-8331-5A0A1EBB63E2}" | In - Public - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{79191566-E488-437F-AC36-7BE6E5744EDF}" | In - Public - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{5E2C9B15-2FB6-4216-B3D6-5F3EC083FF08}" | In - Public - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "{9B8D3C96-FA6E-4F7F-B851-D27BFEBF2122}" | In - Public - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "TCP Query User{F2FB198A-F5D2-48B8-87A4-D7B0CB88842B}C:\program files (x86)\freetvradio\freetvradio.exe" |In - Private - P6 - TRUE | .(...) -- C:\program files (x86)\freetvradio\freetvradio.exe (.not file.) =>Adware.SPointer
O87 - FAEL: "UDP Query User{A28C2BF5-98C7-4041-9A50-039AC9FE15E8}C:\program files (x86)\freetvradio\freetvradio.exe" |In - Private - P17 - TRUE | .(...) -- C:\program files (x86)\freetvradio\freetvradio.exe (.not file.) =>Adware.SPointer
O87 - FAEL: "{35FE58CE-2459-4F36-B50F-EF54750431C7}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{D3ADF49E-B435-4993-A100-06986FC6A864}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{C8E08AD5-63DA-4FB3-B7D2-FA56BC5E61D3}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "{2FAE321D-F2E6-47D0-88E3-61543B7EFA55}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "{C7742555-F6F5-4A39-8210-0301596419B5}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{37250D27-4231-47A8-AD6B-246A21C9D783}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{64070E53-C9FF-4915-A30F-26EA9E34D9C2}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{E60B3BD4-C917-49CC-A41E-D763F02429BB}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{361A6133-CD11-4564-8488-B276B0D5CF47}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
~ Firewall: 223 Legitimates Filtered in 00mn 03s
---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "DB3F79E5CDDC8814D98935E241AFBBD5" . (.IncrediMail.) -- C:\Windows\Installer\{5E97F3BD-CDDC-4188-9D98-532E14FABB5D}\ARPPRODUCTICON.exe
~ Update Products: 160 Legitimates Filtered in 00mn 00s
---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.8FFB0EE18F9233D86A4400A12259897A] [WIS][08/10/2013] (.Eyeo GmbH - Adblock Plus for IE.) -- C:\Windows\Installer\84e5418.msi [2588672]
[MD5.9D193210E3209AB2EDD8BB8A63D62C2C] [WIS][17/06/2012] (.IncrediMail - IncrediMail.) -- C:\Windows\Installer\dae82.msi [2892800]
~ WIS: 171 Legitimates Filtered in 00mn 21s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 12/03/2014 257928 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 22/05/2009 250616 | (GameConsoleService) . (.WildTangent, Inc..) - C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe
SS - | Auto 19/04/2010 135664 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 19/04/2010 135664 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 18/08/2013 194032 | (gusvc) . (.Google.) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Demand 16/01/2014 289256 | (McComponentHostService) . (.McAfee, Inc..) - C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe
SR - | Auto 10/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 02/03/2009 89600 | (AESTFilters) . (.Andrea Electronics Corporation.) - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b87ff64c8b56b7db\AESTSr64.exe
SR - | Auto 22/09/2009 203264 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 04/04/2014 50344 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SR - | Demand 25/02/2010 227896 | (Com4QLBEx) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\ezsvc7.dll (ezSharedSvc) . (.EasyBits Sofware AS.) - C:\Windows\System32\svchost.exe
SR - | Auto 27/09/2012 86528 | (HP Support Assistant Service) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe =>.Hewlett-Packard Co
SR - | Demand 10/08/2012 1001376 | (hpqwmiex) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
SR - | Auto 08/07/2009 30520 | (hpsrv) . (.Hewlett-Packard.) - C:\Windows\System32\Hpservice.exe
SR - | Auto 14/08/2013 39056 | (RealNetworks Downloader Resolver Service) . (...) - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
SR - | Auto 21/01/2009 247152 | (RichVideo) . (...) - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
SR - | Auto 13/08/2009 240640 | (STacSV) . (.IDT, Inc..) - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b87ff64c8b56b7db\STacSV64.exe
SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 25s
---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Run by Elisabeth at 06/04/2014 09:56:12
~ OS 64 not supported by MBR tool
~ MBR: 0 Legitimates Filtered in 00mn 00s
---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Elisabeth at 06/04/2014 09:56:14
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 02s
---\\ Scan Additionnel (O88)
Database Version : 13036 - (03/04/2014)
Clés trouvées (Keys found) : 11
Valeurs trouvées (Values found) : 1
Dossiers trouvés (Folders found) : 3
Fichiers trouvés (Files found) : 14
[HKLM\Software\Google\Chrome\Extensions\cnmdgidklhhnmppphpohildcefnaaflp] =>PUP.CrossRider^
[HKLM\Software\Google\Chrome\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon] =>Toolbar.Conduit^
[HKLM\Software\Google\Chrome\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma] =>PUP.QuickStart^
[HKCR\VirtualStore\MACHINE\Software\CToolbar] =>Toolbar.Crawler
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375] =>PUP.Tarma
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5] =>PUP.Tarma
[HKLM\Software\Classes\aolfrTb.AOLToolBand.1] =>Toolbar.Agent
[HKLM\Software\Classes\AOLTB.AOLToolBand.1] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Classes\aolfrTb.AOLToolBand.1] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Classes\AOLTB.AOLToolBand.1] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110211701196}] =>PUP.CrossRider
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{2318C2B1-4965-11d4-9B18-009027A5CD4F} =>Toolbar.Google^
C:\Users\Elisabeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp =>PUP.CrossRider^
C:\Users\Elisabeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcnnhcneegeeojhgpfijnlnocjdmlaon =>Toolbar.Conduit^
C:\Users\Elisabeth\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma =>PUP.QuickStart^
C:\Users\Elisabeth\AppData\Local\Temp\uninst1.exe =>PUP.Babylon
C:\Users\Elisabeth\AppData\Local\Temp\GoogleToolbarInstaller1.log =>PUP.Babylon
C:\Users\Elisabeth\AppData\Local\Temp\GoogleToolbarInstaller2.log =>PUP.Babylon
C:\Users\Elisabeth\AppData\Local\Temp\GLF184F.tmp.tbChez.dll =>Toolbar.Conduit
C:\Users\Elisabeth\AppData\Local\Temp\GLF93B5.tmp.tbRadi.dll =>Toolbar.Conduit
C:\Users\Elisabeth\AppData\Local\Temp\GLFACD1.tmp.tbRadi.dll =>Toolbar.Conduit
C:\Users\Elisabeth\AppData\Local\Temp\nsi7870.tmp.tbIncr.dll =>Toolbar.Conduit
C:\Users\Elisabeth\AppData\Local\Temp\tbIncr.dll =>Toolbar.Conduit
~ Additionnel Scan: 369105 Items scanned in 01mn 23s
---\\ Récapitulatif des détections trouvées sur votre station
http://nicolascoolman.webs.com/apps/blog/show/27583526-pup-crossrider =>PUP.CrossRider
http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit
http://nicolascoolman.webs.com/apps/blog/show/41962558-pup-quickstart =>PUP.QuickStart
http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon =>PUP.Babylon
http://nicolascoolman.webs.com/apps/blog/show/41011964-pup-awesomehp =>PUP.Awesomehp
http://nicolascoolman.webs.com/apps/blog/show/27556476-adware-spointer =>Adware.SPointer
http://nicolascoolman.webs.com/apps/blog/show/29637859-toolbar-tarma =>PUP.Tarma
~ MSI: 7 link(s) detected in 00mn 00s
~ 1529 Legitimates filtered by white list
End of the scan (579 lines in 34mn 07s)(0)
Merci
ECh
