Zhpdiag rapport. Fermé

Question

Bonjour en ce samedi soir ! Je viens d'effectuer un zhpdiag suite à un scan MBAM. Quelq'un peut y jeter un oeil ? Merci bien ! 


http://www.cjoint.com/c/FIyqreithYT

fabul · Answer

Salut,

Installe ZHPFix

Importe le script qui suit et clic sur GO

Script ZHPFix
SysRestore
G0 - GCSP: Preferences [User Data\Default][HomePage] http://app.corobizar.com
G0 - GCSP: Preferences [User Data\Default][HomePage] http://api.dailymotion.com
G0 - GCSP: Preferences [User Data\Default][HomePage] http://api.twitch.tv
G0 - GCSP: Preferences [User Data\Default][HomePage] http://ws-api.domingo.tv
G2 - GCE: Preference [User Data\Default] [homldgnlpldcmdflhnabedgkgpmeanhd] Tweet Button for Chrome by Shareaholic
McAfee Security Scan Plus v3.0.285.6
O23 - Service: @oem150.inf,%SERVICE_NAME%;Intel Bluetooth Service (ibtsiva) . (...) - C:\WINDOWS\system32\ibtsiva (.not file.)
=>.Superfluous.Empty
O39 - APT: Dell SupportAssistAgent AutoUpdate - (...) -- C:\WINDOWS\System32\Tasks\Dell SupportAssistAgent AutoUpdate  [3272]  (.Orphan.)  =>.Superfluous.Orphan
O39 - APT: DolbySelectorTask - (...) -- C:\WINDOWS\System32\Tasks\DolbySelectorTask  [2118]  (.Orphan.)  =>.Superfluous.Orphan
[MD5.F2AD1B265908797F8A5E21E0312F2F25] - (.Akamai Technologies, Inc. - Akamai NetSession Client.) -- C:\Users\Duncan\AppData\Local\Akamai
etsession_win.exe [4691384] [PID.6480]  =>.Superfluous.AkamaiHD
[MD5.F2AD1B265908797F8A5E21E0312F2F25] - (.Akamai Technologies, Inc. - Akamai NetSession Client.) -- C:\Users\Duncan\AppData\Local\Akamai
etsession_win.exe [4691384] [PID.6536]  =>.Superfluous.AkamaiHD
O4 - HKCU\..\Run: [Akamai NetSession Interface] . (.Akamai Technologies, Inc. - Akamai NetSession Client.) -- C:\Users\Duncan\AppData\Local\Akamai
etsession_win.exe  =>.Superfluous.AkamaiHD
O4 - HKUS\S-1-5-21-1065940000-1840723944-1159598690-1002\..\Run: [Akamai NetSession Interface] . (.Akamai Technologies, Inc. - Akamai NetSession Client.) -- C:\Users\Duncan\AppData\Local\Akamai
etsession_win.exe  =>.Superfluous.AkamaiHD
O42 - Logiciel: Akamai NetSession Interface - (.Akamai Technologies, Inc.) [HKCU][64Bits] -- Akamai  =>.Superfluous.AkamaiHD
HKCU\SOFTWARE\Akamai
HKCU\SOFTWARE\TeleCharger  =>.Superfluous.Downloader
O43 - CFD: 23/12/2014 - [0] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
O43 - CFD: 23/12/2014 - [] D -- C:\ProgramData\McAfee Security Scan
O43 - CFD: 23/09/2015 - [] D -- C:\Users\Duncan\AppData\Local\Akamai
O87 - FAEL: "{60C13671-8EA8-4C2B-B1F2-663D582D5D08}" [In-None-P6-TRUE] .(...) -- C:\Users\Duncan\Downloads\BlackDesert_Downloader.exe (.not file.)
O87 - FAEL: "{9F918D83-28ED-4F1D-ACC3-D929EDC51E25}" [In-None-P6-TRUE] .(...) -- C:\Users\Duncan\Downloads\BlackDesert_Launcher.exe (.not file.)
O87 - FAEL: "{9B33F34B-3EA8-420D-AE52-16A8BDE2955F}" [In-None-P6-TRUE] .(...) -- C:\Users\Duncan\Downloads\bin64\BlackDesert64.exe (.not file.)
O87 - FAEL: "{07245662-411B-48BA-A589-98CA94DC261F}" [In-None-P6-TRUE] .(...) -- C:\Users\Duncan\Downloads\bin\BlackDesert32.exe (.not file.)
HKCU\SOFTWARE\TeleCharger  =>.Superfluous.Downloader
https://nicolascoolman.eu  =>.Superfluous.AkamaiHD
https://nicolascoolman.eu  =>.Superfluous.Downloader
[MD5.00000000000000000000000000000000] [APT] [SoftwareUpdateTaskMachineUA] (...) -- C:\Program Files (x86)\Software\Update\SoftwareUpdate.exe (.not file.)   [0] (.Activate.)  =>PUP.Optional.Boxore
O39 - APT: SoftwareUpdateTaskMachineUA - (...) -- C:\WINDOWS\Tasks\SoftwareUpdateTaskMachineUA.job  [932]  (.Orphan.)  =>PUP.Optional.Boxore
O39 - APT: SoftwareUpdateTaskMachineUA - (...) -- C:\WINDOWS\System32\Tasks\SoftwareUpdateTaskMachineUA  [3300]  (.Orphan.)  =>PUP.Optional.Boxore
G0 - GCSP: Secure Preferences [User Data\Default][HomePage] http://astromenda.com/  =>PUP.Optional.Astromenda
G0 - GCSP: Secure Preferences [User Data\Default][HomePage] http://ww12.gboxapp.com  =>PUP.Optional.GadgetBox
O42 - Logiciel: ApptoU - (.ApptoU.) [HKLM][64Bits] -- {01B91C29-337A-1FFD-7CFC-473451D2F861}  =>PUP.Optional.AppToU
O42 - Logiciel: FastPlayer - (...) [HKLM][64Bits] -- FastPlayer  =>PUP.Optional.FastPlayer
O42 - Logiciel: FleXiblaeShOppper - (.FlexibleShopper.) [HKLM][64Bits] -- {A30F3754-C0DC-8242-F3A9-52B360AE9798}  =>PUP.Optional.FlexibleShoper
O42 - Logiciel: Health Alert - (.Rational Thought Solutions.) [HKLM][64Bits] -- HealthAlert  =>PUP.Optional.HealthAlert
O42 - Logiciel: LuckyShooppeer - (."".) [HKLM][64Bits] -- {AE9B04F2-E9E8-162C-829B-52C116B3EFCC}  =>PUP.Optional.LuckyShopper
O42 - Logiciel: Quick Ref 1.10.0.9 - (.Quick Ref.) [HKLM][64Bits] -- QuickRef_1.10.0.9  =>PUP.Optional.QuickRef
O42 - Logiciel: RoyalCoupoan - (."".) [HKLM][64Bits] -- {40DC4B27-4588-C56F-7737-D03A0ACE4383}  =>PUP.Optional.RoyalCoupon
O42 - Logiciel: RoyalShopperApp - (."".) [HKLM][64Bits] -- {F6423EE4-93D8-FA04-D09D-A8598F6EFDFD}  =>PUP.Optional.RoyalShopperApp
O42 - Logiciel: SaleasChecker - (."".) [HKLM][64Bits] -- {CC17A332-9555-AD95-3985-0BDD9BF0EC71}  =>PUP.Optional.SalesChecker
O42 - Logiciel: SaoleSMagneeta - (."".) [HKLM][64Bits] -- {3119AFD3-545C-0955-573A-494F62E61990}  =>PUP.Optional.SalesMagnet
O42 - Logiciel: SmartCompauree - (.SmartCompare.) [HKLM][64Bits] -- {A9F7A981-09A3-C1F7-2D46-1BA20CFDF02F}  =>PUP.Optional.SmartCompare
O42 - Logiciel: SmarterPower - (.SmarterPower.) [HKLM][64Bits] -- SmarterPower  =>PUP.Optional.SmarterPower
O42 - Logiciel: SpeedCheck - (.SpeedCheck-software.) [HKLM][64Bits] -- 10F9B5AD-D565-69FE-97E0-36763B3A21CC  =>PUP.Optional.SpeedCheck
O42 - Logiciel: SuperManCoupon - (.SuperManCoupon.) [HKLM][64Bits] -- {37476589-E48E-439E-A706-56189E2ED4C4}_is1  =>PUP.Optional.SuperManCoupon
HKLM\SOFTWARE\Wow6432Node\PCTechHotline
HKCU\SOFTWARE\PepperZip  =>PUP.Optional.PepperZip
HKCU\SOFTWARE\AppDataLow\Software\SpeedCheck  =>PUP.Optional.SpeedCheck
O43 - CFD: 26/07/2016 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Clear with PC Tech Hotline  =>PUP.Optional.PCTechHotline
O43 - CFD: 30/01/2015 - [] D -- C:\ProgramData\FleXiblaeShOppper  =>PUP.Optional.FlexibleShoper
O43 - CFD: 30/01/2015 - [] D -- C:\ProgramData\LuckyShooppeer  =>PUP.Optional.LuckyShopper
O43 - CFD: 30/01/2015 - [] D -- C:\ProgramData\RoyalCoupoan  =>PUP.Optional.RoyalCoupon
O43 - CFD: 30/01/2015 - [] D -- C:\ProgramData\SaleasChecker  =>PUP.Optional.SalesChecker
O43 - CFD: 30/01/2015 - [] D -- C:\ProgramData\SaoleSMagneeta  =>PUP.Optional.SalesMagnet
O43 - CFD: 30/01/2015 - [] D -- C:\ProgramData\SmartCompauree  =>PUP.Optional.SmartCompare
O43 - CFD: 23/12/2014 - [] D -- C:\Users\Duncan\AppData\Local\Software  =>PUP.Optional.Boxore
O69 - SBI: prefs.js [Duncan - Sp30XE02.default] user_pref("browser.search.selectedEngine", "omiga-plus");  =>PUP.Optional.OmigaPlus
O69 - SBI: prefs.js [Duncan - Sp30XE02.default] user_pref("extensions.quick_start.enable_search1", false);  =>PUP.Optional.QuickStart
O69 - SBI: prefs.js [Duncan - Sp30XE02.default] user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);  =>PUP.Optional.QuickStart
O90 - PUC: "5C9F59CB830AEE547A93698B6A7DF9D7" . (.Boxore Client.) -- C:\Windows\Installer\{BC95F9C5-A038-45EE-A739-96B8A6D79F7D}\Boxore.ico  =>PUP.Optional.Boxore
O90 - PUC: "D2A425F405350054677A7A857BC0D100" . (.Search App by Ask.) -- C:\Windows\Installer\{4F524A2D-5350-4500-76A7-A758B70C1D00}\ToolbarIcon.exe  =>PUP.Optional.BrowserTabSearch
[MD5.] [WIS][2015/05/26 21:43:38] (.APN, LLC - Ask.com ® - Install Builder.) -- C:\WINDOWS\Installer\1bc5b3a.msi   [528384]  =>PUP.Optional.Bandoo
C:\WINDOWS\Tasks\SoftwareUpdateTaskMachineUA.job  =>PUP.Optional.Boxore
C:\WINDOWS\System32\Tasks\SoftwareUpdateTaskMachineUA  =>PUP.Optional.Boxore
HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SmarterPower  =>PUP.Optional.SmarterPower
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\10F9B5AD-D565-69FE-97E0-36763B3A21CC  =>PUP.Optional.SpeedCheck
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FastPlayer  =>PUP.Optional.FastPlayer
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HealthAlert  =>PUP.Optional.HealthAlert
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickRef_1.10.0.9  =>PUP.Optional.QuickRef
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B91C29-337A-1FFD-7CFC-473451D2F861}  =>PUP.Optional.AppToU
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3119AFD3-545C-0955-573A-494F62E61990}  =>PUP.Optional.SalesMagnet
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37476589-E48E-439E-A706-56189E2ED4C4}_is1  =>PUP.Optional.SuperManCoupon
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{40DC4B27-4588-C56F-7737-D03A0ACE4383}  =>PUP.Optional.RoyalCoupon
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A30F3754-C0DC-8242-F3A9-52B360AE9798}  =>PUP.Optional.FlexibleShoper
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A9F7A981-09A3-C1F7-2D46-1BA20CFDF02F}  =>PUP.Optional.SmartCompare
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AE9B04F2-E9E8-162C-829B-52C116B3EFCC}  =>PUP.Optional.LuckyShopper
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CC17A332-9555-AD95-3985-0BDD9BF0EC71}  =>PUP.Optional.SalesChecker
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F6423EE4-93D8-FA04-D09D-A8598F6EFDFD}  =>PUP.Optional.RoyalShopperApp
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\10F9B5AD-D565-69FE-97E0-36763B3A21CC  =>PUP.Optional.SpeedCheck
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FastPlayer  =>PUP.Optional.FastPlayer
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HealthAlert  =>PUP.Optional.HealthAlert
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\QuickRef_1.10.0.9  =>PUP.Optional.QuickRef
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B91C29-337A-1FFD-7CFC-473451D2F861}  =>PUP.Optional.AppToU
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{3119AFD3-545C-0955-573A-494F62E61990}  =>PUP.Optional.SalesMagnet
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{37476589-E48E-439E-A706-56189E2ED4C4}_is1  =>PUP.Optional.SuperManCoupon
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{40DC4B27-4588-C56F-7737-D03A0ACE4383}  =>PUP.Optional.RoyalCoupon
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A30F3754-C0DC-8242-F3A9-52B360AE9798}  =>PUP.Optional.FlexibleShoper
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A9F7A981-09A3-C1F7-2D46-1BA20CFDF02F}  =>PUP.Optional.SmartCompare
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AE9B04F2-E9E8-162C-829B-52C116B3EFCC}  =>PUP.Optional.LuckyShopper
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CC17A332-9555-AD95-3985-0BDD9BF0EC71}  =>PUP.Optional.SalesChecker
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6423EE4-93D8-FA04-D09D-A8598F6EFDFD}  =>PUP.Optional.RoyalShopperApp
HKCU\SOFTWARE\PepperZip  =>PUP.Optional.PepperZip
HKCU\SOFTWARE\AppDataLow\Software\SpeedCheck  =>PUP.Optional.SpeedCheck
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Clear with PC Tech Hotline  =>PUP.Optional.PCTechHotline
C:\ProgramData\FleXiblaeShOppper  =>PUP.Optional.FlexibleShoper
C:\ProgramData\LuckyShooppeer  =>PUP.Optional.LuckyShopper
C:\ProgramData\RoyalCoupoan  =>PUP.Optional.RoyalCoupon
C:\ProgramData\SaleasChecker  =>PUP.Optional.SalesChecker
C:\ProgramData\SaoleSMagneeta  =>PUP.Optional.SalesMagnet
C:\ProgramData\SmartCompauree  =>PUP.Optional.SmartCompare
C:\Users\Duncan\AppData\Local\Software  =>PUP.Optional.Boxore
C:\Windows\Installer\{BC95F9C5-A038-45EE-A739-96B8A6D79F7D}\Boxore.ico  =>PUP.Optional.Boxore
HKLM\Software\Classes\Installer\Products\5C9F59CB830AEE547A93698B6A7DF9D7  =>PUP.Optional.Boxore
HKLM\Software\Classes\Installer\Features\5C9F59CB830AEE547A93698B6A7DF9D7  =>PUP.Optional.Boxore
C:\Windows\Installer\{4F524A2D-5350-4500-76A7-A758B70C1D00}\ToolbarIcon.exe  =>PUP.Optional.BrowserTabSearch
HKLM\Software\Classes\Installer\Products\D2A425F405350054677A7A857BC0D100  =>PUP.Optional.BrowserTabSearch
HKLM\Software\Classes\Installer\Features\D2A425F405350054677A7A857BC0D100  =>PUP.Optional.BrowserTabSearch
C:\WINDOWS\Installer\1bc5b3a.msi  =>PUP.Optional.Bandoo
https://www.anti-malware.top/2016/05/02/pup-optional-boxore/  =>PUP.Optional.Boxore
https://nicolascoolman.eu  =>PUP.Optional.Astromenda
https://nicolascoolman.eu  =>PUP.Optional.GadgetBox
https://nicolascoolman.eu  =>PUP.Optional.SmarterPower
https://www.anti-malware.top/2016/05/03/pup-optional-speedcheck/  =>PUP.Optional.SpeedCheck
https://nicolascoolman.eu  =>PUP.Optional.FastPlayer
https://nicolascoolman.eu  =>PUP.Optional.HealthAlert
https://nicolascoolman.eu  =>PUP.Optional.QuickRef
https://nicolascoolman.eu  =>PUP.Optional.AppToU
https://nicolascoolman.eu  =>PUP.Optional.SalesMagnet
https://nicolascoolman.eu  =>PUP.Optional.SuperManCoupon
https://nicolascoolman.eu  =>PUP.Optional.RoyalCoupon
https://nicolascoolman.eu  =>PUP.Optional.FlexibleShoper
https://nicolascoolman.eu  =>PUP.Optional.SmartCompare
https://nicolascoolman.eu  =>PUP.Optional.LuckyShopper
https://nicolascoolman.eu  =>PUP.Optional.SalesChecker
https://nicolascoolman.eu  =>PUP.Optional.RoyalShopperApp
https://nicolascoolman.eu  =>PUP.Optional.PepperZip
https://nicolascoolman.eu  =>PUP.Optional.PCTechHotline
https://nicolascoolman.eu  =>PUP.Optional.OmigaPlus
https://nicolascoolman.eu  =>PUP.Optional.QuickStart
https://nicolascoolman.eu  =>PUP.Optional.BrowserTabSearch
https://nicolascoolman.eu  =>PUP.Optional.Bandoo
O43 - CFD: 09/08/2015 - [0] D -- C:\ProgramData\APN
C:\ProgramData\APN
https://www.anti-malware.top/2016/09/22/toolbar-ask/
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
ShortcutFix
ProxyFix
FirewallRAZ 
EmptyPrefetch
EmptyCLSID
EmptyFlash
EmptyTemp

fabul · Answer

Ensuite, tu peux faire ça si tu veux:

Tu peux vérifier ton PC avec RegRun Reanimator (Gratuit)

Fermes tous tes programmes, pour ne pas qu'ils soient détectés pour rien durant l'analyse.

Utilises les 3 options:

Cliquer sur Fix Problems

Option 1. Scan Windows Startup...

Cocher la case "Use Deep Level Scanning Once (For Advanced Users)"...

Cliquer sur Make Scan Now

Cliquer sur Fix Problems

Attention, il détecte aussi des faux positifs (des bons items).

Si tu ne sais pas si c'est bon a vue de nez, tu peux chercher sur Internet pour le nom d'un item / fichier avec clic droit
dans le milieu de la fenêtre et "Copy To Clipboard".

En choisir une partie pour faire la recherche, comme le nom du fichier, ou son code en chiffres et en lettres.

Passe avec la flèche, ou mieux, clic sur le bouton "False Positive" si c'est un item que tu connais comme bon, au prochain scan, il ne sera plus détecté.

Ne supprime que des virus ou inutiles avec le bouton "Get It Out", tu peux endommager ton système ou tes programmes si tu ne fais pas attention.

Clic sur "Reboot Computer" a la fin pour effectuer la suppression et confirme pour redémarrer.


Option 2. Fix Browser Redirect -> Inspect si proposé.

Regarde dans les différents onglets et marques comme faux positifs les bons items au fur et a mesure de tes recherches et supprimes les mauvais si il y en a.


Option 3. On-line Multi-Antivirus Scan...


Ensuite, contrôle ce qui se lance avec Autoruns ou Autoruns64 (64 bit), vois si tu a quelque chose de mauvais ou inutile surtout dans les onglets "Logon", "Scheduled Tasks" et "Services"

Si tu fais attention, tu peux désactiver ou supprimer ce qui n'est pas nécessaire ou mauvais.

Les services bons, mais certains inutiles la plupart du temps, tu peux les mettre en mode Manuel avec services.msc de Windows plutôt que les désactiver complètement avec Autoruns.

On trouve des lignes jaunes (File not found), on peut supprimer la majorité du temps, excepté ce qui proviens de Microsoft et surtout dans la section Drivers, c'est mieux pas.


Tu peux aussi t'aider de Process Explorer pour bien visualiser les processus actifs.


Dans certains cas d'infections de navigateurs, ou de navigateur défaillant, il faut réinitialiser les navigateurs, tu peux t'aider de cet outil: http://christians-steffen.fr/telecharger/telecharger-resetbrowser/


Si tu a des questions...

Zhpdiag rapport.

2 réponses

Discussions similaires

Newsletters