TV wizard malgrè utlisation d'Adwcleaner
Fermé
otto74
Messages postés
5
Date d'inscription
mardi 25 novembre 2014
Statut
Membre
Dernière intervention
30 novembre 2014
-
25 nov. 2014 à 01:07
Utilisateur anonyme - 30 nov. 2014 à 17:38
Utilisateur anonyme - 30 nov. 2014 à 17:38
A voir également:
- TV wizard malgrè utlisation d'Adwcleaner
- Telecharger adwcleaner - Télécharger - Antivirus & Antimalwares
- Installer chromecast sur tv - Guide
- Pc wizard - Télécharger - Informations & Diagnostic
- Pas de signal tv - Guide
- Easeus data recovery wizard free - Télécharger - Récupération de données
9 réponses
Utilisateur anonyme
25 nov. 2014 à 01:09
25 nov. 2014 à 01:09
Bonsoir
Pour de plus amples informations, fait ceci stp
Ouvre ce lien et télécharge ZHPDiag de Nicolas Coolman :
https://nicolascoolman.eu
Ou
https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/
Une fois le téléchargement achevé,
Double-clique sur l'icône pour lancer le programme. Sous Vista ; Seven ou Windows 8 clic droit « exécuter en tant que administrateur »
Dans la fenêtre ZHPDiag qui vient de s'ouvrir, clique sur "Complet"
Laisse l'outil travailler, il peut être assez long.
Un rapport s'ouvre. Ce rapport se trouve également sur ton bureau
Pour transmettre le rapport clique sur ce lien:
http://pjjoint.malekal.com/
Si problème utilise un des suivants
https://forums-fec.be/upload
https://www.cjoint.com/
Regarde sur le bureau
Sélectionne le fichier ZHPDiag.txt.
Clique sur "Cliquez ici pour déposer le fichier".
Un lien de cette forme :
http://www.cijoint.com/cjlink.php?file=cj200905/cijSKAP5fU.txt
est ajouté dans la page.
Copie ce lien dans ta réponse.
Merci
@+
Pour de plus amples informations, fait ceci stp
Ouvre ce lien et télécharge ZHPDiag de Nicolas Coolman :
https://nicolascoolman.eu
Ou
https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/
Une fois le téléchargement achevé,
Double-clique sur l'icône pour lancer le programme. Sous Vista ; Seven ou Windows 8 clic droit « exécuter en tant que administrateur »
Dans la fenêtre ZHPDiag qui vient de s'ouvrir, clique sur "Complet"
Laisse l'outil travailler, il peut être assez long.
Un rapport s'ouvre. Ce rapport se trouve également sur ton bureau
Pour transmettre le rapport clique sur ce lien:
http://pjjoint.malekal.com/
Si problème utilise un des suivants
https://forums-fec.be/upload
https://www.cjoint.com/
Regarde sur le bureau
Sélectionne le fichier ZHPDiag.txt.
Clique sur "Cliquez ici pour déposer le fichier".
Un lien de cette forme :
http://www.cijoint.com/cjlink.php?file=cj200905/cijSKAP5fU.txt
est ajouté dans la page.
Copie ce lien dans ta réponse.
Merci
@+
otto74
Messages postés
5
Date d'inscription
mardi 25 novembre 2014
Statut
Membre
Dernière intervention
30 novembre 2014
25 nov. 2014 à 01:15
25 nov. 2014 à 01:15
le lien vers le fichier :
https://pjjoint.malekal.com/files.php?id=20141125_d7q13v8c11k7
merci de l'aide que quiconque pourra m'apporter
D
https://pjjoint.malekal.com/files.php?id=20141125_d7q13v8c11k7
merci de l'aide que quiconque pourra m'apporter
D
merci Monsieur guillaume, mais effectivement le temps de comprendre comment on dépose une PJ vous avez eu la gentillesse de me répondre
ci-joint le lien vers le fichier :
http://pjjoint.malekal.com/files.php?id=ZHPDiag_20141125_s11j11d5f11b11
bien reçu ?
merci de votre aide
je dois vous quitter j'ouvre ma boite à 6h
merci encore de votre coup de main
ci-joint le lien vers le fichier :
http://pjjoint.malekal.com/files.php?id=ZHPDiag_20141125_s11j11d5f11b11
bien reçu ?
merci de votre aide
je dois vous quitter j'ouvre ma boite à 6h
merci encore de votre coup de main
Utilisateur anonyme
25 nov. 2014 à 01:37
25 nov. 2014 à 01:37
Bonjour
Et bien tu posteras ce lien en inscrit sur CCM
merci
Et bien tu posteras ce lien en inscrit sur CCM
merci
otto74
Messages postés
5
Date d'inscription
mardi 25 novembre 2014
Statut
Membre
Dernière intervention
30 novembre 2014
29 nov. 2014 à 21:40
29 nov. 2014 à 21:40
bonjour guillaume,
avez vous pû accéder au lien ?
je vous le remet au cas ou ...
https://pjjoint.malekal.com/files.php?id=ZHPDiag_20141125_s11j11d5f11b11
merci encore de votre aide
avez vous pû accéder au lien ?
je vous le remet au cas ou ...
https://pjjoint.malekal.com/files.php?id=ZHPDiag_20141125_s11j11d5f11b11
merci encore de votre aide
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Utilisateur anonyme
29 nov. 2014 à 21:54
29 nov. 2014 à 21:54
Bonsoir
Télécharge Malwaresbytes anti malware .
--->> Installe le (choisis bien français ); ne modifie pas les paramètres d'installe
--->> Décoche la case Activer l'essai gratuit de Malwarebytes Anti-Malware Premium à la fin de l'installation
--->> /!\ Utilisateurs de Vista/7/8/8.1 : faire un clic droit sur le raccourci de MalwareBytes' Anti-Malware et choisir Exécuter en tant qu'administrateur
--->> pour le mettre en français:cliquer sur settings >>>language >>> français
-->> Clique sur Mettre à jour dans le Tableau de bord afin de mettre à jour la base de données.
--->> Dans l'onglet Examen, sélectionnez Examen Menaces puis clique sur Examiner maintenant.
--->> Une fois le scan terminé, clique sur Tout mettre en quarantaine puis sur Appliquez les actions
--->> (Si un message demande de redémarrer le PC pour terminer la suppression, accepte)
--->> Le rapport est disponible dans Historique > Journaux de l'application >Journal d'examen. (Choisis bien le dernier en date)
Tu sélectionnes le fichier et tu demandes l'affichage
En bas à gauche un bouton exporter ; tu cliques dessus et tu choisis fichier texte et tu choisis ensuite ou l'enregistrer pour ensuite pouvoir le poster dans ta prochaine réponse
Merci
@+
Télécharge Malwaresbytes anti malware .
--->> Installe le (choisis bien français ); ne modifie pas les paramètres d'installe
--->> Décoche la case Activer l'essai gratuit de Malwarebytes Anti-Malware Premium à la fin de l'installation
--->> /!\ Utilisateurs de Vista/7/8/8.1 : faire un clic droit sur le raccourci de MalwareBytes' Anti-Malware et choisir Exécuter en tant qu'administrateur
--->> pour le mettre en français:cliquer sur settings >>>language >>> français
-->> Clique sur Mettre à jour dans le Tableau de bord afin de mettre à jour la base de données.
--->> Dans l'onglet Examen, sélectionnez Examen Menaces puis clique sur Examiner maintenant.
--->> Une fois le scan terminé, clique sur Tout mettre en quarantaine puis sur Appliquez les actions
--->> (Si un message demande de redémarrer le PC pour terminer la suppression, accepte)
--->> Le rapport est disponible dans Historique > Journaux de l'application >Journal d'examen. (Choisis bien le dernier en date)
Tu sélectionnes le fichier et tu demandes l'affichage
En bas à gauche un bouton exporter ; tu cliques dessus et tu choisis fichier texte et tu choisis ensuite ou l'enregistrer pour ensuite pouvoir le poster dans ta prochaine réponse
Merci
@+
otto74
Messages postés
5
Date d'inscription
mardi 25 novembre 2014
Statut
Membre
Dernière intervention
30 novembre 2014
30 nov. 2014 à 01:25
30 nov. 2014 à 01:25
salut Guillaume
j'ai tout fait comme tu as dit, ci après le détail:
Malwarebytes Anti-Malware
www.malwarebytes.org
Date de l'examen: 30/11/2014
Heure de l'examen: 00:35:26
Fichier journal: fichier examen malware.txt
Administrateur: Oui
Version: 2.00.3.1025
Base de données Malveillants: v2014.11.29.09
Base de données Rootkits: v2014.11.29.01
Licence: Gratuit
Protection contre les malveillants: Désactivé(e)
Protection contre les sites Web malveillants: Désactivé(e)
Auto-protection: Désactivé(e)
Système d'exploitation: Windows 7 Service Pack 1
Processeur: x64
Système de fichiers: NTFS
Utilisateur: Domi
Type d'examen: Examen "Menaces"
Résultat: Terminé
Objets analysés: 324252
Temps écoulé: 18 min, 53 sec
Mémoire: Activé(e)
Démarrage: Activé(e)
Système de fichiers: Activé(e)
Archives: Activé(e)
Rootkits: Désactivé(e)
Heuristique: Activé(e)
PUP: Activé(e)
PUM: Activé(e)
Processus: 1
PUP.Optional.TVWizard.A, C:\ProgramData\ZThrcx\iravoHRkQCL.exe, 3004, Supprimé-au-redémarrage, [f598ce73f78588ae468b594a08f925db]
Modules: 0
(Aucun élément malicieux detecté)
Clés du Registre: 6
PUP.Optional.TVWizard.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\iravoHRkQCL, Mis en quarantaine, [f598ce73f78588ae468b594a08f925db],
PUP.Optional.WebSteroids.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{051E9166-B275-4683-907B-372FAE22BC7C}, Mis en quarantaine, [7f0e0041b7c51125d1a316b203ff9b65],
PUP.Optional.ShopSave.A, HKU\S-1-5-21-396673638-2151698002-1417142946-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{033BE5FC-ED4C-48A0-8F07-E0128384D828}, Mis en quarantaine, [e6a782bf7a022610499bedd4738fa45c],
PUP.Optional.Feven.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Freeven pro 1.2, Mis en quarantaine, [8a03c67bd2aa300687cd80e1b053669a],
PUP.Optional.MediaPlayerplus.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\MediaPlayerplus, Mis en quarantaine, [7914cc753e3e4de986a585ee06fdd42c],
PUP.Optional.PlusHD.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Plus-HD-8.1, Mis en quarantaine, [9bf246fb4d2f2115cbf1650e9e65d927],
Valeurs du Registre: 2
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY|AppPath, C:\Program Files (x86)\Mysearchdial\1.8.29.0\, Mis en quarantaine, [e7a6a69b3f3d54e25b58565fa95bdf21]
PUP.Optional.FirstSeenToday.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|fst_fr_166, Mis en quarantaine, [dbb288b986f660d60a25b6b700037789],
Données du Registre: 0
(Aucun élément malicieux detecté)
Dossiers: 0
(Aucun élément malicieux detecté)
Fichiers: 6
PUP.Optional.TVWizard.A, C:\ProgramData\ZThrcx\iravoHRkQCL.exe, Supprimé-au-redémarrage, [f598ce73f78588ae468b594a08f925db],
PUP.Optional.TVWizard.A, C:\ProgramData\ZThrcx\dat\fVziFjMG.exe, Supprimé-au-redémarrage, [8eff320f0c70d462438eefb4f20ff50b],
PUP.Optional.TVWizard.A, C:\ProgramData\ZThrcx\dat\jghzSKRQQpI.exe, Supprimé-au-redémarrage, [1479a0a189f3e353fbd6bae909f8f907],
PUP.Optional.TVWizard.A, C:\ProgramData\ZThrcx\dat\qxGSHDoBD.dll, Supprimé-au-redémarrage, [ddb053eed0ace84ee01e2d1d0203f808],
Trojan.Swisyn, C:\Program Files (x86)\DAEMON Tools Pro\loader_[TBZ].exe, Mis en quarantaine, [90fdfd447408b482d4d1a7a492702dd3],
PUP.Optional.Spigot.A, C:\Windows\Installer\57c5e.msi, Mis en quarantaine, [5f2e9aa7f8841422b6648b3cc041c739],
Secteurs physiques: 0
(Aucun élément malicieux detecté)
(end)
a priori ça devrai marcher maintenant ?
merci du temps que tu me consacre
otto74
j'ai tout fait comme tu as dit, ci après le détail:
Malwarebytes Anti-Malware
www.malwarebytes.org
Date de l'examen: 30/11/2014
Heure de l'examen: 00:35:26
Fichier journal: fichier examen malware.txt
Administrateur: Oui
Version: 2.00.3.1025
Base de données Malveillants: v2014.11.29.09
Base de données Rootkits: v2014.11.29.01
Licence: Gratuit
Protection contre les malveillants: Désactivé(e)
Protection contre les sites Web malveillants: Désactivé(e)
Auto-protection: Désactivé(e)
Système d'exploitation: Windows 7 Service Pack 1
Processeur: x64
Système de fichiers: NTFS
Utilisateur: Domi
Type d'examen: Examen "Menaces"
Résultat: Terminé
Objets analysés: 324252
Temps écoulé: 18 min, 53 sec
Mémoire: Activé(e)
Démarrage: Activé(e)
Système de fichiers: Activé(e)
Archives: Activé(e)
Rootkits: Désactivé(e)
Heuristique: Activé(e)
PUP: Activé(e)
PUM: Activé(e)
Processus: 1
PUP.Optional.TVWizard.A, C:\ProgramData\ZThrcx\iravoHRkQCL.exe, 3004, Supprimé-au-redémarrage, [f598ce73f78588ae468b594a08f925db]
Modules: 0
(Aucun élément malicieux detecté)
Clés du Registre: 6
PUP.Optional.TVWizard.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\iravoHRkQCL, Mis en quarantaine, [f598ce73f78588ae468b594a08f925db],
PUP.Optional.WebSteroids.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{051E9166-B275-4683-907B-372FAE22BC7C}, Mis en quarantaine, [7f0e0041b7c51125d1a316b203ff9b65],
PUP.Optional.ShopSave.A, HKU\S-1-5-21-396673638-2151698002-1417142946-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{033BE5FC-ED4C-48A0-8F07-E0128384D828}, Mis en quarantaine, [e6a782bf7a022610499bedd4738fa45c],
PUP.Optional.Feven.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Freeven pro 1.2, Mis en quarantaine, [8a03c67bd2aa300687cd80e1b053669a],
PUP.Optional.MediaPlayerplus.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\MediaPlayerplus, Mis en quarantaine, [7914cc753e3e4de986a585ee06fdd42c],
PUP.Optional.PlusHD.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Plus-HD-8.1, Mis en quarantaine, [9bf246fb4d2f2115cbf1650e9e65d927],
Valeurs du Registre: 2
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY|AppPath, C:\Program Files (x86)\Mysearchdial\1.8.29.0\, Mis en quarantaine, [e7a6a69b3f3d54e25b58565fa95bdf21]
PUP.Optional.FirstSeenToday.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|fst_fr_166, Mis en quarantaine, [dbb288b986f660d60a25b6b700037789],
Données du Registre: 0
(Aucun élément malicieux detecté)
Dossiers: 0
(Aucun élément malicieux detecté)
Fichiers: 6
PUP.Optional.TVWizard.A, C:\ProgramData\ZThrcx\iravoHRkQCL.exe, Supprimé-au-redémarrage, [f598ce73f78588ae468b594a08f925db],
PUP.Optional.TVWizard.A, C:\ProgramData\ZThrcx\dat\fVziFjMG.exe, Supprimé-au-redémarrage, [8eff320f0c70d462438eefb4f20ff50b],
PUP.Optional.TVWizard.A, C:\ProgramData\ZThrcx\dat\jghzSKRQQpI.exe, Supprimé-au-redémarrage, [1479a0a189f3e353fbd6bae909f8f907],
PUP.Optional.TVWizard.A, C:\ProgramData\ZThrcx\dat\qxGSHDoBD.dll, Supprimé-au-redémarrage, [ddb053eed0ace84ee01e2d1d0203f808],
Trojan.Swisyn, C:\Program Files (x86)\DAEMON Tools Pro\loader_[TBZ].exe, Mis en quarantaine, [90fdfd447408b482d4d1a7a492702dd3],
PUP.Optional.Spigot.A, C:\Windows\Installer\57c5e.msi, Mis en quarantaine, [5f2e9aa7f8841422b6648b3cc041c739],
Secteurs physiques: 0
(Aucun élément malicieux detecté)
(end)
a priori ça devrai marcher maintenant ?
merci du temps que tu me consacre
otto74
Utilisateur anonyme
30 nov. 2014 à 10:13
30 nov. 2014 à 10:13
Bonjour
Après redémarrage ,poste moi un nouveau rapport ZHPDiag,merci
@+
Après redémarrage ,poste moi un nouveau rapport ZHPDiag,merci
@+
otto74
Messages postés
5
Date d'inscription
mardi 25 novembre 2014
Statut
Membre
Dernière intervention
30 novembre 2014
30 nov. 2014 à 17:01
30 nov. 2014 à 17:01
bonjour,
ci après le rapport tout frais...
~ Rapport de ZHPDiag v2014.11.22.166 - Nicolas Coolman (22/11/2014)
~ Lancé par Domi (30/11/2014 16:39:47)
~ Facebook : https://www.facebook.com/nicolascoolman1
~ Adresse du Forum https://nicolascoolman.eu
~ Traduit par Nicolas Coolman
~ Etat de la version : Nouvelle version disponible
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by user
---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.17420
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows Operating System - Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 7QJB7
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ Logiciels de protection du système
avast! Free Antivirus v7.0.1474.0
Malwarebytes Anti-Malware version 2.0.3.1025
Windows Defender W7 (Activate)
---\\ Logiciels d'optimisation du système
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 14 ActiveX
Adobe Reader XI
---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 37 Stepping 5, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3958 MB (66% free)
System Restore: Activé (Enable)
System drive C: has 195 GB (42%) free of 453 GB
---\\ Mode de connexion au système
~ Computer Name: DOMI-PC
~ User Name: Domi
~ All Users Names: HomeGroupUser$, Domi, Administrateur,
~ Unselected Option: None
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Domi\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Domi\AppData\Roaming\
~ %Desktop% : C:\Users\Domi\Desktop\
~ %Favorites% : C:\Users\Domi\Favorites\
~ %LocalAppData% : C:\Users\Domi\AppData\Local\
~ %StartMenu% : C:\Users\Domi\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 195 Go of 453 Go)
D: CD-ROM drive (Not Inserted)
E: CD-ROM drive (Not Inserted)
F: CD-ROM drive (Not Inserted)
G: CD-ROM drive (Not Inserted)
H: CD-ROM drive (Not Inserted)
---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: 46 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.6FC2819A4F80AAB2DADEDFC1EFEE3C3F] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.06/11/2014 - 03:17:24.) -- C:\Windows\System32\wininet.dll [2365440]
[MD5.8CEBD9D0A0A879CDE9F36F4383B7CAEA] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.17/07/2014 - 03:07:24.) -- C:\Windows\System32\Winlogon.exe [455168]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.FA886682CFC5D36718D3E436AACF10B9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.30/05/2014 - 07:45:52.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.24/01/2014 - 03:37:55.) -- C:\Windows\system32\Drivers\ntfs.sys [1684928]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/3
~ Mes musiques (My Musics) : 1/18
~ Mes Videos (My Videos) : 1/2
~ Mes Favoris (My Favorites) : 1/24
~ Mes Documents (My Documents) : 1/216
~ Mon Bureau (My Desktop) : 1/5062
~ Menu demarrer (Programs) : 1/64
~ Hidden Files: Scanned in 00mn 00s
---\\ Processus lancés
[MD5.0D6972A795995F07B6D78CA7724744FB] - (.Egis Technology Inc. - MyWinLocker.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552] [PID.1324]
[MD5.EADCEB89DD46DA2A5560CA2AF016A6A6] - (.Pas de propriétaire - DefaultSettingEXE MFC Application.) -- C:\Windows\PLFSetI.exe [206208] [PID.3232]
[MD5.9ECF375A6E4E74D056F4B54E76D58721] - (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696] [PID.3420]
[MD5.0ADF079D36B2C25E6E9BECE1BD937ACE] - (.Egis Technology Inc. - PMM Update Application.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [407920] [PID.3664]
[MD5.94F80155B91B8DF7A0EAD527C853D377] - (.NewTech Infosystems, Inc. - Acer Backup Manager.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984] [PID.3724]
[MD5.38218E47372B77DDB3C9DDD4390CB960] - (.Dritek System Inc. - Launch Manager.) -- C:\Program Files (x86)\Launch Manager\LManager.exe [975952] [PID.3812]
[MD5.083649EF692A066880C9326020915AFE] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe [4297136] [PID.3924]
[MD5.1DB860CA1C72B0B953B9555BB390E554] - (.Dritek System Inc. - Launch Manager Worker.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe [305744] [PID.3112]
[MD5.460701195EB909738C37910EBD30666C] - (.Pas de propriétaire - ScanToPc MFC Application.) -- C:\Windows\twain_32\Samsung\CLX3180\Scan2Pc.exe [1998848] [PID.2988]
[MD5.D9FAA5EFEB27DDBE99C720B9069A451E] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392] [PID.2544]
[MD5.F255E48EA981E943A14CF16269F3F3AF] - (.Egis Technology Inc. - EgisUpdate Release Application.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201584] [PID.3264]
[MD5.1F6EFF2536C8F773AEB53309FE52F5B8] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8130560] [PID.4624]
[MD5.8FA553E9AE69808D99C164733A0F9590] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [44808] [PID.1504]
[MD5.B362181ED3771DC03B4141927C80F801] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65432] [PID.1920]
[MD5.221564CC7BE37611FE15EACF443E1BF6] - (.Apple Inc. - YSLoader.exe.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [43336] [PID.1952]
[MD5.9CF46FDF163E06B83D03FF929EF2296C] - (.Dritek System Inc. - Dritek WMI Service.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe [321104] [PID.424]
[MD5.0191DEE9B9EB7902AF2CF4F67301095D] - (.Acer Incorporated - Global Registration Service.) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [23584] [PID.1368]
[MD5.DBC1136A62BD4DECC3632DF650284C2E] - (.Intel Corporation - Local Manageability Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [268824] [PID.1328]
[MD5.3E5E20817259F7328C8F3BE5421F35B9] - (.Egis Technology Inc. - MyWinLocker Service.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520] [PID.1276]
[MD5.9A308FCDCCA98A15B6F62D36A272160E] - (.NewTech Infosystems, Inc. - Backup Manager Module.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [255744] [PID.1608]
[MD5.20372BE109FEE1C37E2D5216680DB9EB] - (.pdfforge GmbH - PDF Architect Helper Service.) -- C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496] [PID.2088]
[MD5.B90A279073A815A4AA2C45A09EE004FA] - (.pdfforge GmbH - PDF Architect Conversion Service.) -- C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280] [PID.2124]
[MD5.8A9828975A857E477EFEF5A61BA45AC0] - (.TeamViewer GmbH - TeamViewer Remote Control Application.) -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2337144] [PID.2276]
[MD5.F9EC9ACD504D823D9B9CA98A4F8D3CA2] - (.Acer Group - Updater Service.) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe [243232] [PID.2636]
[MD5.6B24D1C3096DE796D15571079EA5E98C] - (.Intel Corporation - IAStorDataSvc.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [13336] [PID.1420]
[MD5.7466809E6DA561D60C2F1CE8EDE3C73F] - (.Intel Corporation - User Notification Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2320920] [PID.4612]
~ Processes Running: Scanned in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (23)
~ Hosts File: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Domi\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\QuickLaunch [Domi]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Domi\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
~ Global Startup: 2 Legitimates Filtered in 00mn 02s
---\\ Applications lancées au démarrage du système (O4)
O4 - HKLM\..\Run: [mwlDaemon] . (.Egis Technology Inc. - MyWinLocker.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =>.Realtek Semiconductor Corp
O4 - HKLM\..\Run: [ETDWare] C:\Program Files (x86)\Elantech\ETDCtrl.exe (.not file.)
O4 - HKLM\..\Run: [PLFSetI] . (.Pas de propriétaire - DefaultSettingEXE MFC Application.) -- C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [Acer ePower Management] . (.Acer Incorporated - ePowerTray.) -- C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
O4 - HKLM\..\Run: [EvtMgr6] . (.Logitech, Inc. - Logitech SetPoint Event Manager (UNICODE).) -- C:\Program Files\Logitech\SetPointP\SetPoint.exe
O4 - HKLM\..\Wow6432Node\Run: [IAStorIcon] . (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Wow6432Node\Run: [SuiteTray] . (.Egis Technology Inc. - SuiteTray.) -- C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe
O4 - HKLM\..\Wow6432Node\Run: [EgisUpdate] . (.Egis Technology Inc. - EgisUpdate Release Application.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [EgisTecPMMUpdate] . (.Egis Technology Inc. - PMM Update Application.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [BackupManagerTray] . (.NewTech Infosystems, Inc. - Acer Backup Manager.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
O4 - HKLM\..\Wow6432Node\Run: [LManager] . (.Dritek System Inc. - Launch Manager.) -- C:\Program Files (x86)\Launch Manager\LManager.exe
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe =>.Advanced Micro Devices, Inc
O4 - HKLM\..\Wow6432Node\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe
O4 - HKLM\..\Wow6432Node\Run: [CLX3180_Scan2Pc] . (.Pas de propriétaire - ScanToPc MFC Application.) -- C:\Windows\Twain_32\Samsung\CLX3180\Scan2pc.exe
O4 - HKLM\..\Wow6432Node\Run: [3180 Scan2PC] . (.Pas de propriétaire - ScanToPc MFC Application.) -- C:\Windows\twain_32\Samsung\CLX3180\Scan2Pc.exe
O4 - HKLM\..\Wow6432Node\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- C:\Program Files (x86)\QuickTime\QTTask.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [stv_fr_4] Clé orpheline =>PUP.Eorezo
O4 - HKLM\..\Wow6432Node\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
~ Application: Scanned in 00mn 00s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: &Envoyer à OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} -- C:\Program Files (x86)\MICROS~2\Office14\ONBttnIE.dll (.not file.)
O9 - Extra button: Notes &liées OneNote [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} -- C:\Program Files (x86)\MICROS~2\Office14\ONBTTN~1.dll (.not file.)
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{3DB2A8A9-CF56-486D-9920-DF9E62F9E8E1}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{3DE1FAC4-B916-448F-A747-E5A362D2FC66}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{3DB2A8A9-CF56-486D-9920-DF9E62F9E8E1}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{3DE1FAC4-B916-448F-A747-E5A362D2FC66}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{3DB2A8A9-CF56-486D-9920-DF9E62F9E8E1}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{3DE1FAC4-B916-448F-A747-E5A362D2FC66}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: wlmailhtml [64Bits] - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} . (...) --
O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: LBTWlgn . (.Logitech, Inc. - Logitech Bluetooth Service.) -- c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
~ Winlogon: Scanned in 00mn 00s
---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [{B3B79FEF-060C-4876-9A2F-21EC92DA6895}] (...) -- C:\ProgramData\TVWizard\uninstall.exe (.not file.) [0] =>PUP.TVWizard
[MD5.DC192FBC410F2BF9FF59FCF54CD0840D] [APT] [{B66A8A37-3B0C-4965-A236-BE2B21F8C697}] (...) -- C:\Program Files (x86)\Ad-Remover\main.exe [545071]
[MD5.00000000000000000000000000000000] [APT] [{F8C31F97-ADCD-4E8D-BA85-A6C9642A7F15}] (...) -- C:\Users\Domi\Downloads\adwcleaner.exe (.not file.) [0]
~ Scheduled Task: 9 Legitimates Filtered in 00mn 04s
---\\ Logiciels installés (O42)
O42 - Logiciel: 4D v12.1 Hotfix 5 - (.4D S.A.S..) [HKLM][64Bits] -- {C83879DC-B8B1-4170-81B9-132F260E2E48}
O42 - Logiciel: 4D v13.5 - (.4D.) [HKLM][64Bits] -- {89B068E9-48CB-441D-A5CF-515795F56506}
~ Logic: 23 Legitimates Filtered in 00mn 00s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\Blade]
[HKCU\Software\teras games]
[HKLM\Software\Wow6432Node\MaxPower]
~ Key Software: 338 Legitimates Filtered in 00mn 00s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 11/01/2014 - 20:32:14 - [] ----D C:\Program Files (x86)\MultiBit-0.5.16
O43 - CFD: 25/11/2014 - 21:38:13 - [] ----D C:\ProgramData\Browser
O43 - CFD: 30/11/2014 - 00:55:37 - [] ----D C:\ProgramData\ZThrcx
O43 - CFD: 11/01/2014 - 20:32:13 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MultiBit
O43 - CFD: 14/07/2009 - 08:44:38 - [0] R-H-D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC
O43 - CFD: 13/11/2014 - 22:55:38 - [] ----D C:\Users\Domi\AppData\Roaming\AdvancedSystemProtector =>PUP.AdvancedSystemProtector
O43 - CFD: 27/05/2014 - 16:39:37 - [] ----D C:\Users\Domi\AppData\Roaming\MultiBit
O43 - CFD: 27/02/2014 - 19:42:56 - [] ----D C:\Users\Domi\AppData\Local\com
O43 - CFD: 13/11/2014 - 22:41:08 - [] -SH-D C:\Users\Domi\AppData\Local\EmieBrowserModeList
O43 - CFD: 15/12/2012 - 20:04:15 - [] ----D C:\Users\Domi\AppData\Local\storage
O43 - CFD: 25/11/2014 - 00:02:51 - [0] ----D C:\Users\Domi\AppData\Local\TVWizard =>PUP.TVWizard
~ Program Folder: 262 Legitimates Filtered in 00mn 00s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.B83D966A8B7EB8B81BB7B17B6DDD8C02] - 30/11/2014 - 16:37:42 ---A- . (...) -- C:\Windows\win.ini [604]
~ Files: 12 Legitimates Filtered in 00mn 30s
---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.A296FD336B8FA86671294B3D771276C4] - 24/11/2014 - 23:22:42 ---A- - C:\Windows\Prefetch\UTORRENT.EXE-D1D291BD.pf =>P2P.µTorrent
~ Prefetcher: 1 Legitimates Filtered in 00mn 00s
---\\ Clé de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{139158be-2b4e-11e2-98ce-1c750841f37a}\AutoRun\command. (...) -- F:\Launch.exe (.not file.)
~ Keys: Scanned in 00mn 00s
---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 4 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:19/12/2013 - 17:45:50 ---A- . (...) -- C:\Windows\System32\Drivers\AtihdW76.sys [94720]
O58 - SDL:10/11/2012 - 19:42:04 ---A- . (.DT Soft Ltd - DAEMON Tools Virtual Bus Driver.) -- C:\Windows\System32\Drivers\dtsoftbus01.sys [283200]
O58 - SDL:14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:13/04/2010 - 11:15:04 ---A- . (.ELAN Microelectronic Corp. - ETD Control Center.) -- C:\Windows\System32\Drivers\ETD.sys [135560]
O58 - SDL:10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
O58 - SDL:02/11/2009 - 12:48:02 ---A- . (...) -- C:\Windows\System32\Drivers\TurboB.sys [13784]
O58 - SDL:18/03/2013 - 15:51:08 ---A- . (.Apple, Inc. - Apple Mobile Device USB Driver.) -- C:\Windows\System32\Drivers\usbaapl64.sys [54784]
~ Drivers: 81 Legitimates Filtered in 00mn 02s
---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 24/11/2014 - 16:40:49 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\AdwCleaner 3.311.exe [1375089]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\branding.dll [39192]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1025.dll [39936]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1026.dll [46592]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1027.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1028.dll [23552]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1029.dll [43520]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1030.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1031.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1032.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1034.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1035.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1036.dll [61440]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1037.dll [36864]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1038.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1040.dll [47104]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1041.dll [28160]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1042.dll [26624]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1043.dll [50688]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1044.dll [43008]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1045.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1046.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1048.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1049.dll [42496]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1050.dll [47104]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1051.dll [42496]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1052.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1053.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1054.dll [43520]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1055.dll [43520]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1057.dll [46592]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1058.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1059.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1060.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1061.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1062.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1063.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1065.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1066.dll [49152]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1067.dll [49152]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1068.dll [43008]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1071.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1079.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1081.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1087.dll [49152]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1092.dll [49152]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1102.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1104.dll [43008]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1109.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1110.dll [43008]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-2052.dll [22016]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-2070.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:51 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-2074.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:51 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-3098.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:51 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-5146.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:51 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-9999.dll [57344]
~ 31 Fichiers temporaires (Temporary files)
~ 20 Fichiers cookies (Cookies files)
~ Files: 63 Legitimates Filtered in 00mn 08s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: Ad-Remover par C_XX - (.C_XX.) [HKLM] -- Ad-Remover
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 02/11/2009 - C:\Windows\System32\DRIVERS\TurboB.sys (TurboB) .(...) - LEGACY_TURBOB
~ Legacy: 87 Legitimates Filtered in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] ${searchCLSID} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {0135B824-DB5F-43BF-8C6B-877EEEA1B00A} - (Yahoo! Search) - https://fr.search.yahoo.com/
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
~ Keys: Scanned in 00mn 00s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.0D3B680986310AE5540578C0E481C6A0] [SPRF][02/03/2010] (...) -- C:\ProgramData\FullRemove.exe [131984]
~ Files: 1 Legitimates Filtered in 00mn 00s
---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{C527E36A-EF58-4663-99E5-FBC80A858F22}" | In - None - P6 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\Domi\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O87 - FAEL: "{4518FFAF-B45C-49AC-A972-88BFF8BD65BB}" | In - None - P17 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\Domi\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O87 - FAEL: "{F042D2F6-DC3B-4D16-A2CE-35AB9C8569DB}" | In - None - P6 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\Domi\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O87 - FAEL: "{7E58CB49-D945-4EF8-BC69-ECF8A222E2C7}" | In - None - P17 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\Domi\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
~ Firewall: 4 Legitimates Filtered in 00mn 02s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 28/11/2010 655624 | (FLEXnet Licensing Service) . (.Acresso Software Inc..) - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
SS - | Demand 13/06/2013 357144 | (LBTServ) . (.Logitech, Inc..) - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
SS - | Auto 23/10/2013 172192 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Demand 02/11/2009 126352 | (TurboBoost) . (.Intel(R) Corporation.) - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
SR - | Auto 21/12/2013 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 18/04/2014 239616 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 12/02/2014 43336 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 30/10/2012 44808 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SR - | Auto 30/08/2011 462184 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Auto 10/08/2010 321104 | (DsiWMIService) . (.Dritek System Inc..) - C:\Program Files (x86)\Launch Manager\dsiwmis.exe
SR - | Auto 11/06/2010 868896 | (ePowerSvc) . (.Acer Incorporated.) - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
SR - | Auto 08/01/2010 23584 | (GREGService) . (.Acer Incorporated.) - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
SR - | Auto 13/04/2010 13336 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
SR - | Demand 15/05/2014 641352 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SR - | Auto 18/03/2010 268824 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
SR - | Auto 27/05/2010 305520 | (MWLService) . (.Egis Technology Inc..) - C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
SR - | Auto 28/06/2010 255744 | (NTI IScheduleSvc) . (.NewTech Infosystems, Inc..) - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
SR - | Auto 08/04/2013 1320496 | (PDF Architect Helper Service) . (.pdfforge GmbH.) - C:\Program Files (x86)\PDF Architect\HelperService.exe
SR - | Auto 08/04/2013 799280 | (PDF Architect Service) . (.pdfforge GmbH.) - C:\Program Files (x86)\PDF Architect\ConversionService.exe
SR - | Auto 01/06/2011 2337144 | (TeamViewer6) . (.TeamViewer GmbH.) - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
SR - | Auto 18/03/2010 2320920 | (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
SR - | Auto 29/01/2010 243232 | (Updater Service) . (.Acer Group.) - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 08s
---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Run by Domi at 30/11/2014 16:41:34
~ OS 64 not supported by MBR tool
~ MBR: 0 Legitimates Filtered in 00mn 00s
---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Domi at 30/11/2014 16:41:36
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 02s
---\\ Scan Additionnel (O88)
Database Version : 13026 - (22/11/2014)
Clés trouvées (Keys found) : 5
Valeurs trouvées (Values found) : 3
Dossiers trouvés (Folders found) : 3
Fichiers trouvés (Files found) : 0
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E6098043-1183-4580-89EF-423CBF807188}] =>PUP.Dealio
[HKLM\Software\Classes\Installer\Features\3408906E3811085498FE24C3FB081788] =>PUP.Dealio
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\3408906E3811085498FE24C3FB081788] =>PUP.Dealio
[HKLM\Software\Wow6432Node\Classes\Installer\Features\3408906E3811085498FE24C3FB081788] =>PUP.Dealio
[HKCU\Software\Classes\MF] =>PUP.MediaFinder
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:stv_fr_4 =>PUP.Eorezo^
C:\Users\Domi\AppData\Roaming\AdvancedSystemProtector =>PUP.AdvancedSystemProtector^
C:\Users\Domi\AppData\Local\TVWizard =>PUP.TVWizard^
C:\Program Files (x86)\Ad-Remover\Quarantine\C\Users\Domi\AppData\Roaming\OpenCandy =>Adware.OpenCandy
~ Additionnel Scan: 303739 Items scanned in 00mn 21s
---\\ Informations complémentaires sur les modules
~ https://nicolascoolman.eu =>.Internet Explorer, Proxy Management (R5)
~ https://nicolascoolman.eu =>.Applications lancées au démarrage du système (O4)
~ https://nicolascoolman.eu =>.Clé de registre Shell MountPoints2 (MPKS) (O51)
~ AMI: 3 Legitimates Filtered in 00mn 00s
---\\ Récapitulatif des détections trouvées sur votre station
https://nicolascoolman.eu =>PUP.Eorezo
https://nicolascoolman.eu =>PUP.TVWizard
https://nicolascoolman.eu =>PUP.AdvancedSystemProtector
https://nicolascoolman.eu =>PUP.Dealio
https://nicolascoolman.eu =>PUP.MediaFinder
https://nicolascoolman.eu =>Adware.OpenCandy
~ MSI: 6 link(s) detected in 00mn 00s
~ 953 Legitimates filtered by white list
End of the scan (526 lines in 02mn 11s)(0)
j'espère que cela t'aide ??
merci D
ci après le rapport tout frais...
~ Rapport de ZHPDiag v2014.11.22.166 - Nicolas Coolman (22/11/2014)
~ Lancé par Domi (30/11/2014 16:39:47)
~ Facebook : https://www.facebook.com/nicolascoolman1
~ Adresse du Forum https://nicolascoolman.eu
~ Traduit par Nicolas Coolman
~ Etat de la version : Nouvelle version disponible
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by user
---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.17420
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows Operating System - Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 7QJB7
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ Logiciels de protection du système
avast! Free Antivirus v7.0.1474.0
Malwarebytes Anti-Malware version 2.0.3.1025
Windows Defender W7 (Activate)
---\\ Logiciels d'optimisation du système
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 14 ActiveX
Adobe Reader XI
---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 37 Stepping 5, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3958 MB (66% free)
System Restore: Activé (Enable)
System drive C: has 195 GB (42%) free of 453 GB
---\\ Mode de connexion au système
~ Computer Name: DOMI-PC
~ User Name: Domi
~ All Users Names: HomeGroupUser$, Domi, Administrateur,
~ Unselected Option: None
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Domi\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Domi\AppData\Roaming\
~ %Desktop% : C:\Users\Domi\Desktop\
~ %Favorites% : C:\Users\Domi\Favorites\
~ %LocalAppData% : C:\Users\Domi\AppData\Local\
~ %StartMenu% : C:\Users\Domi\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 195 Go of 453 Go)
D: CD-ROM drive (Not Inserted)
E: CD-ROM drive (Not Inserted)
F: CD-ROM drive (Not Inserted)
G: CD-ROM drive (Not Inserted)
H: CD-ROM drive (Not Inserted)
---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: 46 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.6FC2819A4F80AAB2DADEDFC1EFEE3C3F] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.06/11/2014 - 03:17:24.) -- C:\Windows\System32\wininet.dll [2365440]
[MD5.8CEBD9D0A0A879CDE9F36F4383B7CAEA] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.17/07/2014 - 03:07:24.) -- C:\Windows\System32\Winlogon.exe [455168]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.FA886682CFC5D36718D3E436AACF10B9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.30/05/2014 - 07:45:52.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.24/01/2014 - 03:37:55.) -- C:\Windows\system32\Drivers\ntfs.sys [1684928]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/3
~ Mes musiques (My Musics) : 1/18
~ Mes Videos (My Videos) : 1/2
~ Mes Favoris (My Favorites) : 1/24
~ Mes Documents (My Documents) : 1/216
~ Mon Bureau (My Desktop) : 1/5062
~ Menu demarrer (Programs) : 1/64
~ Hidden Files: Scanned in 00mn 00s
---\\ Processus lancés
[MD5.0D6972A795995F07B6D78CA7724744FB] - (.Egis Technology Inc. - MyWinLocker.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552] [PID.1324]
[MD5.EADCEB89DD46DA2A5560CA2AF016A6A6] - (.Pas de propriétaire - DefaultSettingEXE MFC Application.) -- C:\Windows\PLFSetI.exe [206208] [PID.3232]
[MD5.9ECF375A6E4E74D056F4B54E76D58721] - (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696] [PID.3420]
[MD5.0ADF079D36B2C25E6E9BECE1BD937ACE] - (.Egis Technology Inc. - PMM Update Application.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [407920] [PID.3664]
[MD5.94F80155B91B8DF7A0EAD527C853D377] - (.NewTech Infosystems, Inc. - Acer Backup Manager.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984] [PID.3724]
[MD5.38218E47372B77DDB3C9DDD4390CB960] - (.Dritek System Inc. - Launch Manager.) -- C:\Program Files (x86)\Launch Manager\LManager.exe [975952] [PID.3812]
[MD5.083649EF692A066880C9326020915AFE] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe [4297136] [PID.3924]
[MD5.1DB860CA1C72B0B953B9555BB390E554] - (.Dritek System Inc. - Launch Manager Worker.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe [305744] [PID.3112]
[MD5.460701195EB909738C37910EBD30666C] - (.Pas de propriétaire - ScanToPc MFC Application.) -- C:\Windows\twain_32\Samsung\CLX3180\Scan2Pc.exe [1998848] [PID.2988]
[MD5.D9FAA5EFEB27DDBE99C720B9069A451E] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392] [PID.2544]
[MD5.F255E48EA981E943A14CF16269F3F3AF] - (.Egis Technology Inc. - EgisUpdate Release Application.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201584] [PID.3264]
[MD5.1F6EFF2536C8F773AEB53309FE52F5B8] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8130560] [PID.4624]
[MD5.8FA553E9AE69808D99C164733A0F9590] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [44808] [PID.1504]
[MD5.B362181ED3771DC03B4141927C80F801] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65432] [PID.1920]
[MD5.221564CC7BE37611FE15EACF443E1BF6] - (.Apple Inc. - YSLoader.exe.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [43336] [PID.1952]
[MD5.9CF46FDF163E06B83D03FF929EF2296C] - (.Dritek System Inc. - Dritek WMI Service.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe [321104] [PID.424]
[MD5.0191DEE9B9EB7902AF2CF4F67301095D] - (.Acer Incorporated - Global Registration Service.) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [23584] [PID.1368]
[MD5.DBC1136A62BD4DECC3632DF650284C2E] - (.Intel Corporation - Local Manageability Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [268824] [PID.1328]
[MD5.3E5E20817259F7328C8F3BE5421F35B9] - (.Egis Technology Inc. - MyWinLocker Service.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520] [PID.1276]
[MD5.9A308FCDCCA98A15B6F62D36A272160E] - (.NewTech Infosystems, Inc. - Backup Manager Module.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [255744] [PID.1608]
[MD5.20372BE109FEE1C37E2D5216680DB9EB] - (.pdfforge GmbH - PDF Architect Helper Service.) -- C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496] [PID.2088]
[MD5.B90A279073A815A4AA2C45A09EE004FA] - (.pdfforge GmbH - PDF Architect Conversion Service.) -- C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280] [PID.2124]
[MD5.8A9828975A857E477EFEF5A61BA45AC0] - (.TeamViewer GmbH - TeamViewer Remote Control Application.) -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2337144] [PID.2276]
[MD5.F9EC9ACD504D823D9B9CA98A4F8D3CA2] - (.Acer Group - Updater Service.) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe [243232] [PID.2636]
[MD5.6B24D1C3096DE796D15571079EA5E98C] - (.Intel Corporation - IAStorDataSvc.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [13336] [PID.1420]
[MD5.7466809E6DA561D60C2F1CE8EDE3C73F] - (.Intel Corporation - User Notification Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2320920] [PID.4612]
~ Processes Running: Scanned in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (23)
~ Hosts File: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Domi\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\QuickLaunch [Domi]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Domi\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
~ Global Startup: 2 Legitimates Filtered in 00mn 02s
---\\ Applications lancées au démarrage du système (O4)
O4 - HKLM\..\Run: [mwlDaemon] . (.Egis Technology Inc. - MyWinLocker.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =>.Realtek Semiconductor Corp
O4 - HKLM\..\Run: [ETDWare] C:\Program Files (x86)\Elantech\ETDCtrl.exe (.not file.)
O4 - HKLM\..\Run: [PLFSetI] . (.Pas de propriétaire - DefaultSettingEXE MFC Application.) -- C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [Acer ePower Management] . (.Acer Incorporated - ePowerTray.) -- C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
O4 - HKLM\..\Run: [EvtMgr6] . (.Logitech, Inc. - Logitech SetPoint Event Manager (UNICODE).) -- C:\Program Files\Logitech\SetPointP\SetPoint.exe
O4 - HKLM\..\Wow6432Node\Run: [IAStorIcon] . (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Wow6432Node\Run: [SuiteTray] . (.Egis Technology Inc. - SuiteTray.) -- C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe
O4 - HKLM\..\Wow6432Node\Run: [EgisUpdate] . (.Egis Technology Inc. - EgisUpdate Release Application.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [EgisTecPMMUpdate] . (.Egis Technology Inc. - PMM Update Application.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [BackupManagerTray] . (.NewTech Infosystems, Inc. - Acer Backup Manager.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
O4 - HKLM\..\Wow6432Node\Run: [LManager] . (.Dritek System Inc. - Launch Manager.) -- C:\Program Files (x86)\Launch Manager\LManager.exe
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe =>.Advanced Micro Devices, Inc
O4 - HKLM\..\Wow6432Node\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe
O4 - HKLM\..\Wow6432Node\Run: [CLX3180_Scan2Pc] . (.Pas de propriétaire - ScanToPc MFC Application.) -- C:\Windows\Twain_32\Samsung\CLX3180\Scan2pc.exe
O4 - HKLM\..\Wow6432Node\Run: [3180 Scan2PC] . (.Pas de propriétaire - ScanToPc MFC Application.) -- C:\Windows\twain_32\Samsung\CLX3180\Scan2Pc.exe
O4 - HKLM\..\Wow6432Node\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- C:\Program Files (x86)\QuickTime\QTTask.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [stv_fr_4] Clé orpheline =>PUP.Eorezo
O4 - HKLM\..\Wow6432Node\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
~ Application: Scanned in 00mn 00s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: &Envoyer à OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} -- C:\Program Files (x86)\MICROS~2\Office14\ONBttnIE.dll (.not file.)
O9 - Extra button: Notes &liées OneNote [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} -- C:\Program Files (x86)\MICROS~2\Office14\ONBTTN~1.dll (.not file.)
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{3DB2A8A9-CF56-486D-9920-DF9E62F9E8E1}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{3DE1FAC4-B916-448F-A747-E5A362D2FC66}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{3DB2A8A9-CF56-486D-9920-DF9E62F9E8E1}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{3DE1FAC4-B916-448F-A747-E5A362D2FC66}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{3DB2A8A9-CF56-486D-9920-DF9E62F9E8E1}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{3DE1FAC4-B916-448F-A747-E5A362D2FC66}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: wlmailhtml [64Bits] - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} . (...) --
O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: LBTWlgn . (.Logitech, Inc. - Logitech Bluetooth Service.) -- c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
~ Winlogon: Scanned in 00mn 00s
---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [{B3B79FEF-060C-4876-9A2F-21EC92DA6895}] (...) -- C:\ProgramData\TVWizard\uninstall.exe (.not file.) [0] =>PUP.TVWizard
[MD5.DC192FBC410F2BF9FF59FCF54CD0840D] [APT] [{B66A8A37-3B0C-4965-A236-BE2B21F8C697}] (...) -- C:\Program Files (x86)\Ad-Remover\main.exe [545071]
[MD5.00000000000000000000000000000000] [APT] [{F8C31F97-ADCD-4E8D-BA85-A6C9642A7F15}] (...) -- C:\Users\Domi\Downloads\adwcleaner.exe (.not file.) [0]
~ Scheduled Task: 9 Legitimates Filtered in 00mn 04s
---\\ Logiciels installés (O42)
O42 - Logiciel: 4D v12.1 Hotfix 5 - (.4D S.A.S..) [HKLM][64Bits] -- {C83879DC-B8B1-4170-81B9-132F260E2E48}
O42 - Logiciel: 4D v13.5 - (.4D.) [HKLM][64Bits] -- {89B068E9-48CB-441D-A5CF-515795F56506}
~ Logic: 23 Legitimates Filtered in 00mn 00s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\Blade]
[HKCU\Software\teras games]
[HKLM\Software\Wow6432Node\MaxPower]
~ Key Software: 338 Legitimates Filtered in 00mn 00s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 11/01/2014 - 20:32:14 - [] ----D C:\Program Files (x86)\MultiBit-0.5.16
O43 - CFD: 25/11/2014 - 21:38:13 - [] ----D C:\ProgramData\Browser
O43 - CFD: 30/11/2014 - 00:55:37 - [] ----D C:\ProgramData\ZThrcx
O43 - CFD: 11/01/2014 - 20:32:13 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MultiBit
O43 - CFD: 14/07/2009 - 08:44:38 - [0] R-H-D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC
O43 - CFD: 13/11/2014 - 22:55:38 - [] ----D C:\Users\Domi\AppData\Roaming\AdvancedSystemProtector =>PUP.AdvancedSystemProtector
O43 - CFD: 27/05/2014 - 16:39:37 - [] ----D C:\Users\Domi\AppData\Roaming\MultiBit
O43 - CFD: 27/02/2014 - 19:42:56 - [] ----D C:\Users\Domi\AppData\Local\com
O43 - CFD: 13/11/2014 - 22:41:08 - [] -SH-D C:\Users\Domi\AppData\Local\EmieBrowserModeList
O43 - CFD: 15/12/2012 - 20:04:15 - [] ----D C:\Users\Domi\AppData\Local\storage
O43 - CFD: 25/11/2014 - 00:02:51 - [0] ----D C:\Users\Domi\AppData\Local\TVWizard =>PUP.TVWizard
~ Program Folder: 262 Legitimates Filtered in 00mn 00s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.B83D966A8B7EB8B81BB7B17B6DDD8C02] - 30/11/2014 - 16:37:42 ---A- . (...) -- C:\Windows\win.ini [604]
~ Files: 12 Legitimates Filtered in 00mn 30s
---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.A296FD336B8FA86671294B3D771276C4] - 24/11/2014 - 23:22:42 ---A- - C:\Windows\Prefetch\UTORRENT.EXE-D1D291BD.pf =>P2P.µTorrent
~ Prefetcher: 1 Legitimates Filtered in 00mn 00s
---\\ Clé de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{139158be-2b4e-11e2-98ce-1c750841f37a}\AutoRun\command. (...) -- F:\Launch.exe (.not file.)
~ Keys: Scanned in 00mn 00s
---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 4 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:19/12/2013 - 17:45:50 ---A- . (...) -- C:\Windows\System32\Drivers\AtihdW76.sys [94720]
O58 - SDL:10/11/2012 - 19:42:04 ---A- . (.DT Soft Ltd - DAEMON Tools Virtual Bus Driver.) -- C:\Windows\System32\Drivers\dtsoftbus01.sys [283200]
O58 - SDL:14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:13/04/2010 - 11:15:04 ---A- . (.ELAN Microelectronic Corp. - ETD Control Center.) -- C:\Windows\System32\Drivers\ETD.sys [135560]
O58 - SDL:10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
O58 - SDL:02/11/2009 - 12:48:02 ---A- . (...) -- C:\Windows\System32\Drivers\TurboB.sys [13784]
O58 - SDL:18/03/2013 - 15:51:08 ---A- . (.Apple, Inc. - Apple Mobile Device USB Driver.) -- C:\Windows\System32\Drivers\usbaapl64.sys [54784]
~ Drivers: 81 Legitimates Filtered in 00mn 02s
---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 24/11/2014 - 16:40:49 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\AdwCleaner 3.311.exe [1375089]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\branding.dll [39192]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1025.dll [39936]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1026.dll [46592]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1027.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1028.dll [23552]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1029.dll [43520]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1030.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1031.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1032.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1034.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1035.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1036.dll [61440]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1037.dll [36864]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1038.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1040.dll [47104]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1041.dll [28160]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1042.dll [26624]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1043.dll [50688]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1044.dll [43008]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1045.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1046.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1048.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1049.dll [42496]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1050.dll [47104]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1051.dll [42496]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1052.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1053.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1054.dll [43520]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1055.dll [43520]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1057.dll [46592]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1058.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1059.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1060.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1061.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1062.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1063.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1065.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1066.dll [49152]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1067.dll [49152]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1068.dll [43008]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1071.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1079.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1081.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1087.dll [49152]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1092.dll [49152]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1102.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1104.dll [43008]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1109.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-1110.dll [43008]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-2052.dll [22016]
O61 - LFC: 24/11/2014 - 16:40:50 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-2070.dll [57344]
O61 - LFC: 24/11/2014 - 16:40:51 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-2074.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:51 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-3098.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:51 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-5146.dll [53248]
O61 - LFC: 24/11/2014 - 16:40:51 ---A- . (...) -- C:\Users\Domi\FINIS\X APPLICATIONS\CCleaner 5.00.5035 Portable Tech. Enhanced Edition\CCleaner Portable 5\lang\lang-9999.dll [57344]
~ 31 Fichiers temporaires (Temporary files)
~ 20 Fichiers cookies (Cookies files)
~ Files: 63 Legitimates Filtered in 00mn 08s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: Ad-Remover par C_XX - (.C_XX.) [HKLM] -- Ad-Remover
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 02/11/2009 - C:\Windows\System32\DRIVERS\TurboB.sys (TurboB) .(...) - LEGACY_TURBOB
~ Legacy: 87 Legitimates Filtered in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] ${searchCLSID} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {0135B824-DB5F-43BF-8C6B-877EEEA1B00A} - (Yahoo! Search) - https://fr.search.yahoo.com/
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
~ Keys: Scanned in 00mn 00s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.0D3B680986310AE5540578C0E481C6A0] [SPRF][02/03/2010] (...) -- C:\ProgramData\FullRemove.exe [131984]
~ Files: 1 Legitimates Filtered in 00mn 00s
---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{C527E36A-EF58-4663-99E5-FBC80A858F22}" | In - None - P6 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\Domi\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O87 - FAEL: "{4518FFAF-B45C-49AC-A972-88BFF8BD65BB}" | In - None - P17 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\Domi\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O87 - FAEL: "{F042D2F6-DC3B-4D16-A2CE-35AB9C8569DB}" | In - None - P6 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\Domi\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O87 - FAEL: "{7E58CB49-D945-4EF8-BC69-ECF8A222E2C7}" | In - None - P17 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\Domi\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
~ Firewall: 4 Legitimates Filtered in 00mn 02s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 28/11/2010 655624 | (FLEXnet Licensing Service) . (.Acresso Software Inc..) - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
SS - | Demand 13/06/2013 357144 | (LBTServ) . (.Logitech, Inc..) - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
SS - | Auto 23/10/2013 172192 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Demand 02/11/2009 126352 | (TurboBoost) . (.Intel(R) Corporation.) - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
SR - | Auto 21/12/2013 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 18/04/2014 239616 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 12/02/2014 43336 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 30/10/2012 44808 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SR - | Auto 30/08/2011 462184 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Auto 10/08/2010 321104 | (DsiWMIService) . (.Dritek System Inc..) - C:\Program Files (x86)\Launch Manager\dsiwmis.exe
SR - | Auto 11/06/2010 868896 | (ePowerSvc) . (.Acer Incorporated.) - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
SR - | Auto 08/01/2010 23584 | (GREGService) . (.Acer Incorporated.) - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
SR - | Auto 13/04/2010 13336 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
SR - | Demand 15/05/2014 641352 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SR - | Auto 18/03/2010 268824 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
SR - | Auto 27/05/2010 305520 | (MWLService) . (.Egis Technology Inc..) - C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
SR - | Auto 28/06/2010 255744 | (NTI IScheduleSvc) . (.NewTech Infosystems, Inc..) - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
SR - | Auto 08/04/2013 1320496 | (PDF Architect Helper Service) . (.pdfforge GmbH.) - C:\Program Files (x86)\PDF Architect\HelperService.exe
SR - | Auto 08/04/2013 799280 | (PDF Architect Service) . (.pdfforge GmbH.) - C:\Program Files (x86)\PDF Architect\ConversionService.exe
SR - | Auto 01/06/2011 2337144 | (TeamViewer6) . (.TeamViewer GmbH.) - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
SR - | Auto 18/03/2010 2320920 | (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
SR - | Auto 29/01/2010 243232 | (Updater Service) . (.Acer Group.) - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 08s
---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Run by Domi at 30/11/2014 16:41:34
~ OS 64 not supported by MBR tool
~ MBR: 0 Legitimates Filtered in 00mn 00s
---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Domi at 30/11/2014 16:41:36
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 02s
---\\ Scan Additionnel (O88)
Database Version : 13026 - (22/11/2014)
Clés trouvées (Keys found) : 5
Valeurs trouvées (Values found) : 3
Dossiers trouvés (Folders found) : 3
Fichiers trouvés (Files found) : 0
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E6098043-1183-4580-89EF-423CBF807188}] =>PUP.Dealio
[HKLM\Software\Classes\Installer\Features\3408906E3811085498FE24C3FB081788] =>PUP.Dealio
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\3408906E3811085498FE24C3FB081788] =>PUP.Dealio
[HKLM\Software\Wow6432Node\Classes\Installer\Features\3408906E3811085498FE24C3FB081788] =>PUP.Dealio
[HKCU\Software\Classes\MF] =>PUP.MediaFinder
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:stv_fr_4 =>PUP.Eorezo^
C:\Users\Domi\AppData\Roaming\AdvancedSystemProtector =>PUP.AdvancedSystemProtector^
C:\Users\Domi\AppData\Local\TVWizard =>PUP.TVWizard^
C:\Program Files (x86)\Ad-Remover\Quarantine\C\Users\Domi\AppData\Roaming\OpenCandy =>Adware.OpenCandy
~ Additionnel Scan: 303739 Items scanned in 00mn 21s
---\\ Informations complémentaires sur les modules
~ https://nicolascoolman.eu =>.Internet Explorer, Proxy Management (R5)
~ https://nicolascoolman.eu =>.Applications lancées au démarrage du système (O4)
~ https://nicolascoolman.eu =>.Clé de registre Shell MountPoints2 (MPKS) (O51)
~ AMI: 3 Legitimates Filtered in 00mn 00s
---\\ Récapitulatif des détections trouvées sur votre station
https://nicolascoolman.eu =>PUP.Eorezo
https://nicolascoolman.eu =>PUP.TVWizard
https://nicolascoolman.eu =>PUP.AdvancedSystemProtector
https://nicolascoolman.eu =>PUP.Dealio
https://nicolascoolman.eu =>PUP.MediaFinder
https://nicolascoolman.eu =>Adware.OpenCandy
~ MSI: 6 link(s) detected in 00mn 00s
~ 953 Legitimates filtered by white list
End of the scan (526 lines in 02mn 11s)(0)
j'espère que cela t'aide ??
merci D
Utilisateur anonyme
30 nov. 2014 à 17:38
30 nov. 2014 à 17:38
bonsoir
Utilisation de l'outil ZHPFix :
* Copie tout le texte présent dans l'encadré ci-dessous (tu le sélectionnes avec ta souris / Clique droit dessus et choisis "copier" ou fait Ctrl+C )
Script ZHPFix
O4 - HKLM\..\Wow6432Node\Run: [stv_fr_4] Clé orpheline
[MD5.00000000000000000000000000000000] [APT] [{B3B79FEF-060C-4876-9A2F-21EC92DA6895}] (...) -- C:\ProgramData\TVWizard\uninstall.exe (.not file.) [0]
O43 - CFD: 13/11/2014 - 22:55:38 - [] ----D C:\Users\Domi\AppData\Roaming\AdvancedSystemProtector
O43 - CFD: 27/02/2014 - 19:42:56 - [] ----D C:\Users\Domi\AppData\Local\com
O43 - CFD: 25/11/2014 - 00:02:51 - [0] ----D C:\Users\Domi\AppData\Local\TVWizard
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E6098043-1183-4580-89EF-423CBF807188}]
[HKLM\Software\Classes\Installer\Features\3408906E3811085498FE24C3FB081788]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\3408906E3811085498FE24C3FB081788]
[HKLM\Software\Wow6432Node\Classes\Installer\Features\3408906E3811085498FE24C3FB081788]
[HKCU\Software\Classes\MF]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:stv_fr_4
C:\Users\Domi\AppData\Roaming\AdvancedSystemProtector
C:\Users\Domi\AppData\Local\TVWizard
C:\Program Files (x86)\Ad-Remover\Quarantine\C\Users\Domi\AppData\Roaming\OpenCandy
ShortcutFix
EmptyPrefetch
FirewallRAZ
Emptytemp
EmptyCLSID
--------------------------------------------------------------------------------------------
Lance ZHPFix à partir du raccourci sur ton Bureau (si tu es sous Windows Vista ou Windows 7 ou 8, fais le par un clic-droit --> Exécuter en tant qu'administrateur)
Cliquer sur le bouton Importer. Le contenu du Presse-papier vient se coller dans la zone de saisie de ZHPFix
NB (W8) : Dans certains cas le script se colle automatiquement dans la zone de script et ne nécessite pas de cliquer sur le bouton "IMPORTER".
* Clique sur le bouton GO pour lancer le nettoyage.
-> laisse travailler l'outil et ne touche à rien ...
-> S'il t'est demandé de redémarrer le PC pour finir le nettoyage, fais le !
Une fois terminé, un nouveau rapport s'affiche : poste le contenu de ce dernier dans ta prochaine réponse ...
Ce rapport est copié sur le bureau
( ce rapport est en outre sauvegardé dans ce dossier :
- Pour XP : C:\Documents and Settings\username\Local Settings\Application Data\ZHP
- Depuis Vista : C:\Users\username\AppData\Roaming\ZHP\ZHPFix [R1].txt)
Redémarre ton PC
@+
Utilisation de l'outil ZHPFix :
* Copie tout le texte présent dans l'encadré ci-dessous (tu le sélectionnes avec ta souris / Clique droit dessus et choisis "copier" ou fait Ctrl+C )
Script ZHPFix
O4 - HKLM\..\Wow6432Node\Run: [stv_fr_4] Clé orpheline
[MD5.00000000000000000000000000000000] [APT] [{B3B79FEF-060C-4876-9A2F-21EC92DA6895}] (...) -- C:\ProgramData\TVWizard\uninstall.exe (.not file.) [0]
O43 - CFD: 13/11/2014 - 22:55:38 - [] ----D C:\Users\Domi\AppData\Roaming\AdvancedSystemProtector
O43 - CFD: 27/02/2014 - 19:42:56 - [] ----D C:\Users\Domi\AppData\Local\com
O43 - CFD: 25/11/2014 - 00:02:51 - [0] ----D C:\Users\Domi\AppData\Local\TVWizard
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E6098043-1183-4580-89EF-423CBF807188}]
[HKLM\Software\Classes\Installer\Features\3408906E3811085498FE24C3FB081788]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\3408906E3811085498FE24C3FB081788]
[HKLM\Software\Wow6432Node\Classes\Installer\Features\3408906E3811085498FE24C3FB081788]
[HKCU\Software\Classes\MF]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:stv_fr_4
C:\Users\Domi\AppData\Roaming\AdvancedSystemProtector
C:\Users\Domi\AppData\Local\TVWizard
C:\Program Files (x86)\Ad-Remover\Quarantine\C\Users\Domi\AppData\Roaming\OpenCandy
ShortcutFix
EmptyPrefetch
FirewallRAZ
Emptytemp
EmptyCLSID
--------------------------------------------------------------------------------------------
Lance ZHPFix à partir du raccourci sur ton Bureau (si tu es sous Windows Vista ou Windows 7 ou 8, fais le par un clic-droit --> Exécuter en tant qu'administrateur)
Cliquer sur le bouton Importer. Le contenu du Presse-papier vient se coller dans la zone de saisie de ZHPFix
NB (W8) : Dans certains cas le script se colle automatiquement dans la zone de script et ne nécessite pas de cliquer sur le bouton "IMPORTER".
* Clique sur le bouton GO pour lancer le nettoyage.
-> laisse travailler l'outil et ne touche à rien ...
-> S'il t'est demandé de redémarrer le PC pour finir le nettoyage, fais le !
Une fois terminé, un nouveau rapport s'affiche : poste le contenu de ce dernier dans ta prochaine réponse ...
Ce rapport est copié sur le bureau
( ce rapport est en outre sauvegardé dans ce dossier :
- Pour XP : C:\Documents and Settings\username\Local Settings\Application Data\ZHP
- Depuis Vista : C:\Users\username\AppData\Roaming\ZHP\ZHPFix [R1].txt)
Redémarre ton PC
@+