Nettoyage pc: ZHPDiag

Bonsoir

poste moi ce rapport

merci

~ Rapport de ZHPDiag v2014.8.28.125 - Nicolas Coolman (28/08/2014)
~ Lancé par Bigo (24/11/2014 21:23:52)
~ Adresse du Site Web https://nicolascoolman.eu
~ Adresse du Forum https://nicolascoolman.eu
~ Traduit par Nicolas Coolman
~ Etat de la version : Nouvelle version disponible
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by program

---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.17420
GCIE: Google Chrome v39.0.2171.65 (Defaut)

---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows Operating System - Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 32W74
Windows License : OK
~ Windows Remaining Initializations Number : 2
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ Logiciels de protection du système
Malwarebytes Anti-Malware version 2.0.3.1025
Windows Defender W7 (Activate)

---\\ Logiciels d'optimisation du système

---\\ Logiciels de partage PeerToPeer

---\\ Surveillance de Logiciels
Adobe Flash Player 11 ActiveX
Adobe Reader X MUI

---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 58 Stepping 9, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 8059 MB (65% free)
System Restore: Activé (Enable)
System drive C: has 618 GB (90%) free of 685 GB

---\\ Mode de connexion au système
~ Computer Name: BIGO-PC
~ User Name: Bigo
~ All Users Names: Bigo, Administrateur,
~ Unselected Option: None
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Bigo\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Bigo\AppData\Roaming\
~ %Desktop% : C:\Users\Bigo\Desktop\
~ %Favorites% : C:\Users\Bigo\Favorites\
~ %LocalAppData% : C:\Users\Bigo\AppData\Local\
~ %StartMenu% : C:\Users\Bigo\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\WINDOWS\
~ %System% : C:\WINDOWS\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 618 Go of 685 Go)
D: CD-ROM drive (Not Inserted)

---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: Modified =>Hijacker.Application
~ Security Center: 41 Legitimates Filtered in 00mn 00s

---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.12/09/2012 - 19:00:17.) -- C:\WINDOWS\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\WINDOWS\System32\Wininit.exe [129024]
[MD5.6FC2819A4F80AAB2DADEDFC1EFEE3C3F] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.6/11/2014 - 03:17:24.) -- C:\WINDOWS\System32\wininet.dll [2365440]
[MD5.8CEBD9D0A0A879CDE9F36F4383B7CAEA] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.17/07/2014 - 03:07:24.) -- C:\WINDOWS\System32\Winlogon.exe [455168]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.21/11/2010 - 04:24:16.) -- C:\WINDOWS\System32\sppcomapi.dll [232448]
[MD5.FA886682CFC5D36718D3E436AACF10B9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.30/05/2014 - 07:45:52.) -- C:\WINDOWS\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\WINDOWS\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 04:23:47.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 04:24:32.) -- C:\WINDOWS\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 04:23:47.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.12/09/2012 - 19:00:09.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 04:23:51.) -- C:\WINDOWS\system32\Drivers\netBT.sys [261632]
[MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.24/01/2014 - 03:37:55.) -- C:\WINDOWS\system32\Drivers\ntfs.sys [1684928]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\WINDOWS\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 04:24:33.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\WINDOWS\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 04:24:32.) -- C:\WINDOWS\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/11/2010 - 04:23:47.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s

---\\ Etat des fichiers cachés (Caché/Total)
~ Mes musiques (My Musics) : 1/73
~ Mes Favoris (My Favorites) : 1/6
~ Mes Documents (My Documents) : 1/5
~ Mon Bureau (My Desktop) : 1/8
~ Menu demarrer (Programs) : 1/32
~ Hidden Files: Scanned in 00mn 00s

---\\ Processus lancés
[MD5.381474F8A4477CF4951553EF530B0ED5] - (.NVIDIA Corporation - NVIDIA GeForce Experience Backend.) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2465088] [PID.3656]
[MD5.2E8A5736739C6D23F5CBAE22973A1E3A] - (.Spotify Ltd - Spotify.) -- C:\Users\Bigo\AppData\Roaming\Spotify\spotify.exe [6553144] [PID.3704]
[MD5.B66E0842FCF485F3E2D41BF0BA10966F] - (.Spotify Ltd - SpotifyWebHelper.) -- C:\Users\Bigo\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040] [PID.3824]
[MD5.23E04D96AD8012D0585AEDCACB866C63] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe [30520936] [PID.3852]
[MD5.974BE08C2D1C647574527BE8B9FA00EA] - (.Creative Technology Ltd - Sound Blaster Control Panel.) -- C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe [880640] [PID.3996]
[MD5.7AC459ED0B6F8F3FAE43A1417AFC1A13] - (.Pas de propriétaire - Alienware On-Screen Display.) -- C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe [1546096] [PID.4092]
[MD5.766AE515B1749F2141E418CC6C08515B] - (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440] [PID.3212]
[MD5.2A510D5500FD4C50A9E38DF85478F862] - (.Intel Corporation - Intel(R) USB 3.0 Monitor.) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608] [PID.3196]
[MD5.13F44960416C1D24DAAC3CBBBAE49D35] - (.Creative Technology Ltd - Webcam Central.) -- C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe [577024] [PID.3944]
[MD5.DE467BFDC4B78ACD86BB81C2166EC3C0] - (.SoftThinks - Dell - AlienRespawn.) -- C:\Program Files (x86)\AlienRespawn\TOASTER.exe [4005184] [PID.4156]
[MD5.0EF0822810009D58118CCDFD098FA9F4] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480] [PID.4276]
[MD5.F205CD085B25CFC491908EFE4E8AB8F5] - (.Pas de propriétaire - ST Service Scheduling.) -- C:\Program Files (x86)\AlienRespawn\COMPONENTS\SCHEDULER\STSERVICE.exe [2751808] [PID.4288]
[MD5.6CF6D53E832FD38B8C7A9BB34F364852] - (.SoftThinks - Dell - AlienRespawn Update Launcher.) -- C:\Program Files (x86)\AlienRespawn\Components\DSUpdate\DSUpd.exe [320832] [PID.4344]
[MD5.E3080B08BD35BD05797758A811833660] - (.Creative Technology Ltd - Creative Jack Configuration.) -- C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTJckCfg.exe [2014208] [PID.4412]
[MD5.45CB9401FCC23DE9C9306B0F275D56AE] - (...) -- C:\Users\Bigo\AppData\Roaming\Spotify\Data\SpotifyHelper.exe [613944] [PID.5280]
[MD5.30A59C41AF23A324C67CB27800FB4186] - (.Alienware - Alienware AlienFX Controller.) -- C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe [71024] [PID.6464]
[MD5.EFD70B9225A404D436966A7F08EDABC2] - (.Alienware - Hook32 Manager.) -- C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe [14192] [PID.7256]
[MD5.E887931CE3D3E4112139B91670746C00] - (.Alienware - AlienFusionController.) -- C:\Program Files\Alienware\Command Center\AlienFusionController.exe [16240] [PID.7868]
[MD5.15ABBA57923260D4B09A5D5E5754D8B0] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [856904] [PID.7512]
[MD5.33BF80A2291C54DC7D7601CDEF63138E] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8099328] [PID.6908]
[MD5.A9425CB7D5A698EA49BE0DF55A448E68] - (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [409800] [PID.972]
[MD5.EDBA1382E5D7D1E71442B43E170CF8D4] - (.Creative Technology Ltd - Creative Audio Service.) -- c:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [423424] [PID.1172]
[MD5.650D03E40F93FAE323CB841F80368E5C] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [60744] [PID.1792]
[MD5.D494394738C8F44EB4E5765B797CC75B] - (.Creative Technology Ltd - Creative High Definition Audio Service.) -- C:\Windows\sysWow64\CtHdaSvc.exe [122880] [PID.1896]
[MD5.D22982C269775BCBDDA8A0F82A9ADE9E] - (.Intel Corporation - Intel(R) Dynamic Application Loader Host In.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560] [PID.696]
[MD5.D6A687B5E24257B5D3991C0D9BC45BBC] - (.NVIDIA Corporation - NVIDIA Network Service.) -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928] [PID.1296]
[MD5.4215C271D6E6898C3F4DABAB4F387DC9] - (.SoftThinks SAS - SoftThinks Agent Service.) -- C:\Program Files (x86)\AlienRespawn\sftservice.exe [1695040] [PID.2168]
[MD5.F5DF96342ACC1CFB5C55DEA9BF812DFD] - (.Disc Soft Ltd - Disc soft bus service.) -- C:\Program Files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe [887056] [PID.4336]
[MD5.7D4B9A48430ED57ACA6373B71D5904CA] - (.Intel Corporation - IAStorDataSvc.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [13592] [PID.2068]
[MD5.5C08357C65F658E29B5DDC2EF18D575C] - (.Intel Corporation - Local Manageability Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [277784] [PID.5624]
[MD5.0DFC9713D117B349E41A2A477448107A] - (.Intel Corporation - User Notification Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [363800] [PID.7564]
~ Processes Running: Scanned in 00mn 01s

---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Bigo\AppData\Local\Google\Chrome\User Data\Default\Preferences

---\\ Liste des dossiers d'extension Google Chrome
~ Google Lines Browser: 0 Legitimates Filtered in 00mn 12s

---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://fr.alienwarearena.com/
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.alienwarearena.com/
~ IE Browser: 18 Legitimates Filtered in 00mn 00s

---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s

---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe
F2 - REG:system.ini: VMApplet=C:\WINDOWS\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s

---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (21)
~ Hosts File: Scanned in 00mn 00s

---\\ Autres liens utilisateurs (O4)
O4 - GS\QuickLaunch [Bigo]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Bigo\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\Desktop [Bigo]: AppsHat.lnk . (...) -- C:\Users\Bigo\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe (.not file.) =>PUP.CrossRider
O4 - GS\Desktop [Bigo]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Bigo\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
~ Global Startup: 3 Legitimates Filtered in 00mn 00s

---\\ Applications lancées au démarrage du système (O4)
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe (.not file.)
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [AtherosBtStack] . (.Atheros Communications - Serveur Stack Bluetooth.) -- C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
O4 - HKLM\..\Run: [AthBtTray] . (.Atheros Commnucations - Bluetooth Tray.) -- C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
O4 - HKLM\..\Run: [Command Center Controllers] . (.Alienware - RequiredApplicationsLauncher.) -- C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe
O4 - HKLM\..\Run: [NvBackend] . (.NVIDIA Corporation - NVIDIA GeForce Experience Backend.) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
O4 - HKLM\..\Run: [ShadowPlay] . (.NVIDIA Corporation - NVIDIA Capture Server Proxy.) -- C:\Windows\system32\nvspcap64.dll
O4 - HKCU\..\Run: [Spotify] . (.Spotify Ltd - Spotify.) -- C:\Users\Bigo\AppData\Roaming\Spotify\Spotify.exe
O4 - HKCU\..\Run: [DAEMON Tools Ultra Agent] . (.Disc Soft Ltd - DAEMON Tools Ultra Agent.) -- C:\Program Files (x86)\DAEMON Tools Ultra\DTAgent.exe
O4 - HKCU\..\Run: [Spotify Web Helper] . (.Spotify Ltd - SpotifyWebHelper.) -- C:\Users\Bigo\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe =>.Skype Technologies S.A.
O4 - HKLM\..\Wow6432Node\Run: [UpdReg] . (.Creative Technology Ltd. - Creative UpdReg.) -- C:\Windows\UpdReg.exe
O4 - HKLM\..\Wow6432Node\Run: [Sound Blaster Recon3Di Control Panel] . (.Creative Technology Ltd - Sound Blaster Control Panel.) -- c:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe
O4 - HKLM\..\Wow6432Node\Run: [AlienwareOn-ScreenDisplay] . (.Pas de propriétaire - Alienware On-Screen Display.) -- C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
O4 - HKLM\..\Wow6432Node\Run: [IAStorIcon] . (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Wow6432Node\Run: [USB3MON] . (.Intel Corporation - Intel(R) USB 3.0 Monitor.) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
O4 - HKLM\..\Wow6432Node\Run: [Integrated Webcam Live! Central] . (.Creative Technology Ltd - Webcam Central.) -- C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2236308331-1553065417-2988625523-1001\..\Run: [Spotify] . (.Spotify Ltd - Spotify.) -- C:\Users\Bigo\AppData\Roaming\Spotify\Spotify.exe
O4 - HKUS\S-1-5-21-2236308331-1553065417-2988625523-1001\..\Run: [DAEMON Tools Ultra Agent] . (.Disc Soft Ltd - DAEMON Tools Ultra Agent.) -- C:\Program Files (x86)\DAEMON Tools Ultra\DTAgent.exe
O4 - HKUS\S-1-5-21-2236308331-1553065417-2988625523-1001\..\Run: [Spotify Web Helper] . (.Spotify Ltd - SpotifyWebHelper.) -- C:\Users\Bigo\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
O4 - HKUS\S-1-5-21-2236308331-1553065417-2988625523-1001\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe =>.Skype Technologies S.A.
~ Application: Scanned in 00mn 00s

---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{7604E8BB-9DE5-4DA8-8157-D6771415DCC6}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{7604E8BB-9DE5-4DA8-8157-D6771415DCC6}: DhcpDomain = lan
O17 - HKLM\System\CS1\Services\Tcpip\..\{7604E8BB-9DE5-4DA8-8157-D6771415DCC6}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{7604E8BB-9DE5-4DA8-8157-D6771415DCC6}: DhcpDomain = lan
O17 - HKLM\System\CS2\Services\Tcpip\..\{7604E8BB-9DE5-4DA8-8157-D6771415DCC6}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{7604E8BB-9DE5-4DA8-8157-D6771415DCC6}: DhcpDomain = lan
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s

---\\ Protocole additionnel (O18)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\WINDOWS\System32\mscoree.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s

---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\WINDOWS\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s

---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - AppInit_DLLs: . (.NVIDIA Corporation - NVIDIA shim initialization dll, Version 344.) - C:\Windows\system32\nvinitx.dll
~ AppInit DLL: Scanned in 00mn 00s

---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Qualcomm Atheros Killer Service (Qualcomm Atheros Killer Service) . (...) - C:\Program Files\Bigfoot Networks\Killer Network Manager\BFNService.exe
~ Services: 20 Legitimates Filtered in 00mn 07s

---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [SQ] (...) -- C:\Users\Bigo\AppData\Roaming\SQ.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [XEBPSWBZ] (...) -- C:\Users\Bigo\AppData\Roaming\XEBPSWBZ.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [YTAUpdate] (...) -- C:\Program Files (x86)\YOUTUB~1\Updater.exe (.not file.) [0]
O39 - APT: - (..) -- C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater [1002]
O39 - APT: - (..) -- C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore [1066]
O39 - APT: - (..) -- C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA [1070]
O39 - APT: - (..) -- C:\WINDOWS\Tasks\PCDoctorBackgroundMonitorTask.job [536]
O39 - APT: - (..) -- C:\WINDOWS\System32\Tasks\PCDoctorBackgroundMonitorTask [536]
O39 - APT: SQ - (...) -- C:\WINDOWS\Tasks\SQ.job [1326]
O39 - APT: SQ - (...) -- C:\WINDOWS\System32\Tasks\SQ [1326]
O39 - APT: - (..) -- C:\WINDOWS\Tasks\SystemToolsDailyTest.job [394]
O39 - APT: - (..) -- C:\WINDOWS\System32\Tasks\SystemToolsDailyTest [394]
O39 - APT: XEBPSWBZ - (...) -- C:\WINDOWS\Tasks\XEBPSWBZ.job [1682]
O39 - APT: XEBPSWBZ - (...) -- C:\WINDOWS\System32\Tasks\XEBPSWBZ [1682]
~ Scheduled Task: 19 Legitimates Filtered in 00mn 02s

---\\ HKCU & HKLM Software Keys
[HKCU\Software\SQ]
[HKLM\Software\Wow6432Node\149a85b5-3301-4a21-8919-dc405f21925f]
[HKLM\Software\Wow6432Node\26e43645-3cba-43cd-a480-c5816e1e1175]
[HKLM\Software\Wow6432Node\88a3b778-ecc1-4c1c-a4c5-3ddbbe2dd1a4]
[HKLM\Software\Wow6432Node\a677afc9-3200-424c-996f-7eb44c1d60d7]
[HKLM\Software\Wow6432Node\b3641f05-5f13-4d08-8ac6-fc0773137652]
[HKLM\Software\Wow6432Node\c72936ab-9a7a-429a-b977-75799555220e]
~ Key Software: 199 Legitimates Filtered in 00mn 00s

---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 21/11/2014 - 14:55:06 - [] ----D C:\Program Files (x86)\4686227e-93f5-4755-992c-b202abf82710
O43 - CFD: 24/11/2014 - 21:03:02 - [] ----D C:\Program Files (x86)\9b87e385-fcc6-4701-b836-524b5a9bef10
O43 - CFD: 24/11/2014 - 21:03:02 - [] ----D C:\Program Files (x86)\c4e1451d-f356-42e2-a01b-3e9fd52e6727
O43 - CFD: 30/10/2014 - 00:46:12 - [] ----D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
O43 - CFD: 12/09/2012 - 17:35:00 - [] ----D C:\ProgramData\Win732
O43 - CFD: 12/09/2012 - 17:35:00 - [] ----D C:\ProgramData\Win764
O43 - CFD: 12/09/2012 - 17:27:54 - [] ----D C:\ProgramData\XP32
O43 - CFD: 20/11/2014 - 18:14:07 - [] ----D C:\Users\Bigo\AppData\Local\Disc_Soft_Ltd
O43 - CFD: 14/11/2014 - 20:07:30 - [] -SH-D C:\Users\Bigo\AppData\Local\EmieBrowserModeList
O43 - CFD: 19/11/2014 - 20:44:02 - [] ----D C:\Users\Bigo\AppData\Local\Installer
~ Program Folder: 135 Legitimates Filtered in 00mn 00s

---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.CBFE64616C10CF4C52E16C659ED7A921] - 11/11/2014 - 11:29:54 ---A- . (...) -- C:\WINDOWS\System32\nvcoproc.bin [4100776]
O44 - LFC:[MD5.B22CB0DD7DC051EFDF0AAA17FC74699B] - 13/11/2014 - 01:20:36 ---A- . (...) -- C:\WINDOWS\System32\nvinfo.pb [27094]
O44 - LFC:[MD5.C2B64FBC6CA6743668FC28B58F993040] - 24/11/2014 - 16:22:11 ---A- . (...) -- C:\WINDOWS\DirectX.log [9971]
~ Files: 203 Legitimates Filtered in 00mn 10s

---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.9FC501EFC2CBD55203C9F4F1A1432F1D] - 24/11/2014 - 17:32:41 ---A- - C:\WINDOWS\Prefetch\IWEBAR-CODEDOWNLOADER.EXE-3D6AB4E5.pf =>PUP.iWebar
O45 - LFCP:[MD5.04C826BBB23F76ED4280BF498C715EC5] - 23/11/2014 - 19:22:42 ---A- - C:\WINDOWS\Prefetch\UTORRENT.EXE-F0E84FD5.pf =>P2P.µTorrent
~ Prefetcher: 2 Legitimates Filtered in 00mn 00s

---\\ Clé de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{1021b07b-700a-11e4-8875-844bf5341c84}\AutoRun\command. (...) -- E:\setup.exe (.not file.)
~ Keys: Scanned in 00mn 00s

---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s

---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s

---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\WINDOWS\System32\Drivers\elxstor.sys [530496]
O58 - SDL:26/06/2009 - 21:43:42 ---A- . (.Windows (R) Win 7 DDK provider - Embedded System Control.) -- C:\WINDOWS\System32\Drivers\EMSC.sys [16752]
O58 - SDL:10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\WINDOWS\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:16/07/2011 - 03:31:22 ---A- . (.ST Microelectronics - Disk Class Filter Driver for Accelerometer.) -- C:\WINDOWS\System32\Drivers\stdcfltn.sys [22128]
O58 - SDL:14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\WINDOWS\System32\Drivers\stexstor.sys [24656]
O58 - SDL:3/01/2012 - 22:04:52 ---A- . (.STMicroelectronics - STM Accelerometer Device Driver.) -- C:\WINDOWS\System32\Drivers\ST_ACCEL.sys [67184]
O58 - SDL:15/08/2014 - 23:35:00 ---A- . (.Apple, Inc. - Apple Mobile Device USB Driver.) -- C:\WINDOWS\System32\Drivers\usbaapl64.sys [54784]
O58 - SDL:26/06/2009 - 21:43:42 ---A- . (.Windows (R) Win 7 DDK provider - Embedded System Control.) -- C:\WINDOWS\SysWOW64\drivers\EMSC.sys [13680]
~ Drivers: 81 Legitimates Filtered in 00mn 00s

---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 19/11/2014 - 21:24:42 ---A- . (...) -- C:\Users\Bigo\AppData\Local\Google\Chrome\User Data\EVWhitelist\4\_platform_specific\all\ev_hashes_whitelist.bin [713907]
O61 - LFC: 19/11/2014 - 21:24:42 ---A- . (...) -- C:\Users\Bigo\AppData\Local\Installer\Installiwebar_31960\postInst.exe [1151376] =>PUP.iWebar
O61 - LFC: 19/11/2014 - 21:24:42 ---A- . (...) -- C:\Users\Bigo\AppData\Local\Installer\Installsense_31960\postInst.exe [1151376]
O61 - LFC: 24/11/2014 - 21:24:42 ---A- . (...) -- C:\Users\Bigo\AppData\Local\Google\Chrome\User Data\nacl_validation_cache.bin [236]
O61 - LFC: 24/11/2014 - 21:24:43 ---A- . (...) -- C:\Users\Bigo\Downloads\adwcleaner_4.102.exe [2148864]
~ 146 Fichiers temporaires (Temporary files)
~ 87 Fichiers cookies (Cookies files)
~ Files: 80 Legitimates Filtered in 00mn 01s

---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s

---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 10/06/2009 - C:\WINDOWS\System32\Drivers\secdrv.sys (secdrv) .(.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) - LEGACY_SECDRV
~ Legacy: 70 Legitimates Filtered in 00mn 00s

---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s

---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s

---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
~ Keys: Scanned in 00mn 00s

---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{B853D639-69FF-428E-87EB-1F09BEC38FA1}" | In - None - P6 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\Bigo\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O87 - FAEL: "{A67403DC-48E8-4E4D-BDAC-37766A27290C}" | In - None - P17 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\Bigo\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
~ Firewall: 2 Legitimates Filtered in 00mn 01s

---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 12/09/2012 250056 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 18/02/2012 276248 | (cphs) . (.Intel Corporation.) - C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe
SS - | Demand 12/09/2012 79360 | (Creative ALchemy AL6 Licensing Service) . (.Creative Labs.) - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
SS - | Demand 12/09/2012 79360 | (Creative Audio Engine Licensing Service) . (.Creative Labs.) - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
SS - | Auto 11/08/2012 107912 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 11/08/2012 107912 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 22/10/2004 73728 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
SS - | Auto 3/04/2014 315008 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SR - | Auto 15/06/2012 14704 | (AlienFusionService) . (.Alienware.) - C:\Program Files\Alienware\Command Center\AlienFusionService.exe
SR - | Auto 7/10/2014 60744 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 13/02/2012 106144 | (AtherosSvc) . (.Atheros Commnucations.) - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
SR - | Auto 30/08/2011 462184 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Auto 20/10/2011 423424 | (CTAudSvcService) . (.Creative Technology Ltd.) - c:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
SR - | Auto 28/03/2012 122880 | (CtHdaSvc) . (.Creative Technology Ltd.) - C:\WINDOWS\sysWow64\CtHdaSvc.exe
SR - | Demand 10/07/2014 887056 | (Disc Soft Bus Service) . (.Disc Soft Ltd.) - C:\Program Files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe
SR - | Auto 17/11/2014 1149760 | (GfExperienceService) . (.NVIDIA Corporation.) - C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
SR - | Auto 30/11/2011 13592 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
SR - | Auto 11/01/2012 627936 | (Intel(R) Capability Licensing Service Interface) . (.Intel(R) Corporation.) - c:\Program Files\Intel\iCLS Client\HeciServer.exe
SR - | Demand 15/10/2014 643880 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SR - | Auto 1/02/2012 161560 | (jhi_service) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
SR - | Auto 1/02/2012 277784 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
SR - | Auto 17/11/2014 1796928 | (NvNetworkService) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
SR - | Auto 17/11/2014 19821376 | (NvStreamSvc) . (.NVIDIA Corporation.) - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
SR - | Auto 12/11/2014 934032 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe
SR - | Auto 24/02/2012 492032 | (Qualcomm Atheros Killer Service) . (...) - C:\Program Files\Bigfoot Networks\Killer Network Manager\BFNService.exe
SR - | Auto 16/02/2012 1695040 | (SftService) . (.SoftThinks SAS.) - C:\Program Files (x86)\AlienRespawn\sftservice.exe
SR - | Auto 12/11/2014 409800 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
SR - | Auto 1/02/2012 363800 | (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\WINDOWS\System32\svchost.exe
SR - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\WINDOWS\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\WINDOWS\System32\svchost.exe
~ Services: Scanned in 00mn 11s

---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Run by Bigo at 24/11/2014 21:25:27
~ OS 64 not supported by MBR tool
~ MBR: 0 Legitimates Filtered in 00mn 00s

---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Bigo at 24/11/2014 21:25:29
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 02s

---\\ Scan Additionnel (O88)
Database Version : 13026 - (28/08/2014)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 3
Dossiers trouvés (Folders found) : 1
Fichiers trouvés (Files found) : 1

C:\Users\Bigo\AppData\Local\Installer =>Adware.InstallPedia
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: Modified =>Hijacker.Application^
~ Additionnel Scan: 231138 Items scanned in 00mn 22s

---\\ Informations complémentaires sur les modules
~ https://nicolascoolman.eu =>.Internet Explorer, Proxy Management (R5)
~ https://nicolascoolman.eu =>.Applications lancées au démarrage du système (O4)
~ https://nicolascoolman.eu =>.Clé de registre Shell MountPoints2 (MPKS) (O51)
~ AMI: 3 Legitimates Filtered in 00mn 00s

---\\ Récapitulatif des détections trouvées sur votre station
https://nicolascoolman.eu =>PUP.CrossRider
https://nicolascoolman.eu =>PUP.iWebar
https://nicolascoolman.eu =>Adware.InstallPedia
~ MSI: 3 link(s) detected in 00mn 00s

~ 924 Legitimates filtered by white list
End of the scan (497 lines in 02mn 01s)(0)

Re

je t'explique.

--Tu ne disposes pas de la dernière version de ZHPDiag

---Tu héberges ton rapport.
Pour transmettre le rapport clique sur ce lien :

http://pjjoint.malekal.com/

Si problème utilise un des suivants

https://forums-fec.be/upload
https://www.cjoint.com/

Clique sur Parcourir et cherche le fichier : Nom_complet_du_fichier (Fichier demandé )
Clique sur Ouvrir.

Clique sur "Envoyer le fichier".

Un lien de cette forme :

http://pjjoint.malekal.com/cjlink.php?file=cj200905/cijSKAP5fU.txt

est ajouté dans la page.

Copie ce lien dans ta réponse.

Merci de faire le nécessaire

@+

https://pjjoint.malekal.com/files.php?id=ZHPDiag_20141124_z5q6c14w6e6
Voila,
Merci.

Re

1) mettre à jour Adobe flash player et Adobe reader


2)Utilisation de l'outil ZHPFix :

* Copie tout le texte présent dans l'encadré ci-dessous (tu le sélectionnes avec ta souris / Clique droit dessus et choisis "copier" ou fait Ctrl+C )

Script ZHPFix
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: Modified
O4 - GS\Desktop [Bigo]: AppsHat.lnk . (...) -- C:\Users\Bigo\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [SQ] (...) -- C:\Users\Bigo\AppData\Roaming\SQ.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [XEBPSWBZ] (...) -- C:\Users\Bigo\AppData\Roaming\XEBPSWBZ.exe (.not file.) [0]
O45 - LFCP:[MD5.9FC501EFC2CBD55203C9F4F1A1432F1D] - 24/11/2014 - 17:32:41 ---A- - C:\WINDOWS\Prefetch\IWEBAR-CODEDOWNLOADER.EXE-3D6AB4E5.pf
O61 - LFC: 19/11/2014 - 21:24:42 ---A- . (...) -- C:\Users\Bigo\AppData\Local\Installer\Installiwebar_31960\postInst.exe [1151376]
C:\Users\Bigo\AppData\Local\Installer
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: Modified
[MD5.00000000000000000000000000000000] [APT] [YTAUpdate] (...) -- C:\Program Files (x86)\YOUTUB~1\Updater.exe (.not file.) [0]
O39 - APT: SQ - (...) -- C:\WINDOWS\Tasks\SQ.job [1326]
O39 - APT: SQ - (...) -- C:\WINDOWS\System32\Tasks\SQ [1326]
O39 - APT: XEBPSWBZ - (...) -- C:\WINDOWS\Tasks\XEBPSWBZ.job [1682]
O39 - APT: XEBPSWBZ - (...) -- C:\WINDOWS\System32\Tasks\XEBPSWBZ [1682]
[HKLM\Software\Wow6432Node\149a85b5-3301-4a21-8919-dc405f21925f]
[HKLM\Software\Wow6432Node\26e43645-3cba-43cd-a480-c5816e1e1175]
[HKLM\Software\Wow6432Node\88a3b778-ecc1-4c1c-a4c5-3ddbbe2dd1a4]
[HKLM\Software\Wow6432Node\a677afc9-3200-424c-996f-7eb44c1d60d7]
[HKLM\Software\Wow6432Node\b3641f05-5f13-4d08-8ac6-fc0773137652]
[HKLM\Software\Wow6432Node\c72936ab-9a7a-429a-b977-75799555220e]
O43 - CFD: 21/11/2014 - 14:55:06 - [] ----D C:\Program Files (x86)\4686227e-93f5-4755-992c-b202abf82710
O43 - CFD: 24/11/2014 - 21:03:02 - [] ----D C:\Program Files (x86)\9b87e385-fcc6-4701-b836-524b5a9bef10
O43 - CFD: 24/11/2014 - 21:03:02 - [] ----D C:\Program Files (x86)\c4e1451d-f356-42e2-a01b-3e9fd52e6727
O61 - LFC: 19/11/2014 - 21:24:42 ---A- . (...) -- C:\Users\Bigo\AppData\Local\Installer\Installsense_31960\postInst.exe [1151376]
Stop:SR - | Auto 30/08/2011 462184 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
ShortcutFix
EmptyPrefetch
FirewallRAZ
Emptytemp
EmptyCLSID

--------------------------------------------------------------------------------------------
Lance ZHPFix à partir du raccourci sur ton Bureau (si tu es sous Windows Vista ou Windows 7 ou 8, fais le par un clic-droit --> Exécuter en tant qu'administrateur)

Cliquer sur le bouton Importer. Le contenu du Presse-papier vient se coller dans la zone de saisie de ZHPFix

NB (W8) : Dans certains cas le script se colle automatiquement dans la zone de script et ne nécessite pas de cliquer sur le bouton "IMPORTER".

* Clique sur le bouton GO pour lancer le nettoyage.

-> laisse travailler l'outil et ne touche à rien ...
-> S'il t'est demandé de redémarrer le PC pour finir le nettoyage, fais le !

Une fois terminé, un nouveau rapport s'affiche : poste le contenu de ce dernier dans ta prochaine réponse ...
Ce rapport est copié sur le bureau

( ce rapport est en outre sauvegardé dans ce dossier :
- Pour XP : C:\Documents and Settings\username\Local Settings\Application Data\ZHP
- Depuis Vista : C:\Users\username\AppData\Roaming\ZHP\ZHPFix [R1].txt)

Redémarre ton PC

@+

Rapport de ZHPFix 2014.8.3.6 par Nicolas Coolman, Update du 03/08/2014
Fichier d'export Registre :
Run by Bigo at 24/11/2014 22:21:46
High Elevated Privileges : OK
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)

Corbeille vidée (Annulé par l'utilisateur)
Dossier Prefetcher vidé
Réparation des raccourcis navigateur

========== Etat des services ==========
(Bonjour Service) . (Bonjour Service) de Apple Inc. Arrêté

========== Clés du Registre ==========
SUPPRIMÉ: HKLM\Software\Wow6432Node\149a85b5-3301-4a21-8919-dc405f21925f
SUPPRIMÉ: HKLM\Software\Wow6432Node\26e43645-3cba-43cd-a480-c5816e1e1175
SUPPRIMÉ: HKLM\Software\Wow6432Node\88a3b778-ecc1-4c1c-a4c5-3ddbbe2dd1a4
SUPPRIMÉ: HKLM\Software\Wow6432Node\a677afc9-3200-424c-996f-7eb44c1d60d7
SUPPRIMÉ: HKLM\Software\Wow6432Node\b3641f05-5f13-4d08-8ac6-fc0773137652
SUPPRIMÉ: HKLM\Software\Wow6432Node\c72936ab-9a7a-429a-b977-75799555220e

========== Valeurs du Registre ==========
Aucune Valeur Standard Profile: FirewallRaz :
Aucune Valeur Domain Profile: FirewallRaz :
SUPPRIMÉ: FirewallRaz (Domain) : NetPres-In-TCP-NoScope
SUPPRIMÉ: FirewallRaz (Domain) : NetPres-Out-TCP-NoScope
SUPPRIMÉ: FirewallRaz (None) : NetPres-WSD-In-UDP
SUPPRIMÉ: FirewallRaz (None) : NetPres-WSD-Out-UDP
SUPPRIMÉ: FirewallRaz (Public) : NetPres-In-TCP
SUPPRIMÉ: FirewallRaz (Public) : NetPres-Out-TCP
SUPPRIMÉ: FirewallRaz (Public) : {DD3C44F4-0C59-44F1-8A8C-2BE973025B35}
SUPPRIMÉ: FirewallRaz (Public) : {1C326379-5383-4BB4-B47C-984B96947744}

========== Eléments de donnée du Registre ==========
SUPPRIMÉ Explorer Association Data Application: http://www.fileextensionpro.com/redir.aspx?s=smtycl1_0_0_0_0,94534408-7857-464f-89ff-ae8dda9f71ea,&LangID=%04x&Ext=%s

========== Dossiers ==========
Aucun dossiers CLSID Local utilisateur vide

========== Fichiers ==========
SUPPRIMÉ: c:\users\bigo\desktop\appshat.lnk
SUPPRIMÉ: c:\windows\prefetch\iwebar-codedownloader.exe-3d6ab4e5.pf
SUPPRIMÉ: c:\users\bigo\appdata\local\installer\installiwebar_31960\postinst.exe
SUPPRIMÉS Temporaires Windows (143) (94.064.775 octets)

========== Tache planifiée ==========
SUPPRIMÉ: SQ
SUPPRIMÉ: SQ
SUPPRIMÉ: SQ
SUPPRIMÉ: SQ
SUPPRIMÉ: SQ
SUPPRIMÉ: SQ
SUPPRIMÉ: SQ
SUPPRIMÉ: SQ
SUPPRIMÉ: SQ
SUPPRIMÉ: SQ
SUPPRIMÉ: XEBPSWBZ
SUPPRIMÉ: XEBPSWBZ
SUPPRIMÉ: YTAUpdate

========== Récapitulatif ==========
6 : Clés du Registre
10 : Valeurs du Registre
1 : Eléments de donnée du Registre
1 : Dossiers
4 : Fichiers
1 : Etat des services
13 : Tache planifiée

End of clean in 00mn 13s

========== Chemin de fichier rapport ==========
C:\Users\Bigo\AppData\Roaming\ZHP\ZHPFix[R1].txt - 24/11/2014 22:21:53 [2647]

Re

On nettoie et finalise

Télécharge DelFix de Xplode

Lance le.
Tu as 5 choix :

Réactiver l'UAC
Supprimer les outils de désinfection (cocher par défaut)
Effectuer une sauvegarde du registre
Purger la restauration de système
Réinitialisation des paramètres usine

Tu coches ceux qui sont en gras ci-dessus
et tu exécutes
Le rapport se trouve ici généralement
C:\DelFix.txt

Le reste de la sécurité : http://forum.malekal.com/comment-securiser-son-ordinateur.html

@+

# DelFix v10.8 - Rapport créé le 24/11/2014 à 22:30:37
# Mis à jour le 29/07/2014 par Xplode
# Nom d'utilisateur : Bigo - BIGO-PC
# Système d'exploitation : Windows 7 Home Premium Service Pack 1 (64 bits)

~ Suppression des outils de désinfection ...

Supprimé : C:\AdwCleaner
Supprimé : C:\Users\Bigo\AppData\Roaming\ZHP
Supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP
Supprimé : C:\Program Files (x86)\ZHPDiag
Supprimé : C:\PhysicalDisk0_MBR.bin
Supprimé : C:\Users\Bigo\Desktop\ZHPDiag.lnk
Supprimé : C:\Users\Bigo\Desktop\ZHPDiag.txt
Supprimé : C:\Users\Bigo\Desktop\ZHPFix.lnk
Supprimé : C:\Users\Bigo\Desktop\ZHPFixReport.txt
Supprimé : C:\Users\Bigo\Downloads\adwcleaner_4.102.exe
Supprimé : C:\Users\Bigo\Downloads\ZHPDiag2.exe
Supprimée : HKLM\SOFTWARE\AdwCleaner
Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1

########## - EOF - ##########

Re

je te propose donc de mettre ce sujet en résolu

@+

un tout grnad merci, bonne soiree!