Comment activer zhpfix

Résolu
perfido -  
Bonsoir,
Ma page firefox est masquée à l'ouverture par un malveillant.
J'ai fait ZHPDIAG que j'ai reporté sur le bureau.
Je suis passé sur ZHPFIX et suis bloqué, je ne vois pas Quels boutons activer, pouvez vous me renseigner ?
Merci d'avance.

https://www.cjoint.com/?CDzvAZ1tdrg

17 réponses

  1.  juju666 Contributeur sécurité
    Salut je t'ai demandé si personne ne pouvait t'aider à réaliser les manipulations correctement, je pense que ça sera utile !

    Prompt rétablissement à ton épouse.

    1. perfido Auteur
      Bonjour juju666,
      Je suis débordé par l'état de santé de mon épouse qui ne permet plus de participer aux activités que je pratiquais sur mon ordinateur que j'ai décidais de n'utiliser que pour des besoins utilitaires par contre je te communique l'ouverture de firefox qui paraît être occupé d'un indésirable

      Egalement internet explorer

      Peux-tu intervenir pour remettre ouvertures en ordre ?
      Merci pour toutes tes interventions.
      Bonne journée
      https://www.cjoint.com/c/CEogMXjiP7a
      1. juju666 Contributeur sécurité
        Bonjour
        C'est déjà ce que tu fais pour m'envoyer tes fichiers word ...
        3. juju666 Contributeur sécurité
          Bonsoir,
          Dans ton entourage, personne ne pourrait d'aider à réaliser les manipulations ?

          2. juju666 Contributeur sécurité
            Bonjour,

            Je suis entièrement d'accord et très patient mais il y a des limites.
            Encore une fois, tu mets le rapport d'adwcleaner dans un document WORD, pourquoi ? Je ne saisis pas !





            A+
            1. perfido Auteur
              Bonjour juju666,

              Je suis désolé de l'exaspération que je te procure, je suis inexpérimenté en informatique, je ne comprends pas certains termes recommandés.
              Pour exécuter et poster otl, je vais sur démarrer>rechercher les programmes et fichiers j'affiche `'otl'' double droit `'exécuter en tant qu'administrateur'' le panneau s'affiche, je coche `'tous les utilisateurs'' `'recherche lop'' `'recherche purity'' ''analyse'' le résumé s'affiche dont je fais un copier/coller sur personnalisation. A partir de manipulation j'hésite, qu'est-ce que l'exécutable, je retourne sur otl où sont affichés otl
              J'ai bien remarqué en affichant otl extra accolé à txt me faut-il utiliser ces 2 manipulations ?
              Encore merci pour la patience que tu me témoignes.

              Je ne comprends pas, il m'est arrivé d'utiliser nouveaux documents pour un cjoint et pour ce cjoint j'étais dirigé sur nouveau document qui ne contenait pas le document adwcleaner que j'ai trouvé dans la bibliothèque.

              https://www.cjoint.com/c/CEgje1BpBHR
              1. jacques.gache Contributeur sécurité
                bonjour, juste de passage et juste une question perfido pourquoi ne pas télécharger les outils directement sur le bureau c'est beaucoup plus simple pour les retrouver et les rapports aussi ??
            2. juju666 Contributeur sécurité
              Bonjour,

              Franchement je comprends pas ce que tu fais ...
              Après l'analyse, OTL dépose 2 fichiers à côté de l'exécutable (dans ton cas dans le "Nouveau dossier") il suffit de les envoyer. Pourquoi c'est le "Run 8" ? Pourquoi tu m'as fais un mélange des 2 fichiers ?
              Bref.
              AdwCleaner a été mis à jour, il devrait supprimer encore pas mal de chose.
              Donc re-télécharge-le ici : http://general-changelog-team.fr/fr/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner
              Clic suppression et poster le rapport

              A+
              1. perfido Auteur
                Bonsoir juju666
                Voila ce que je suis arrivé à réaliser dans le doute, tel un robot.
                Je te souhaite une bonne soirée.

                http://cjoint.com/?CEfaMrwlfvD
                http://cjoint.com/?CEfaPEAtweO
                3. juju666 Contributeur sécurité
                  Bonjour,

                  Relance AdwCleaner clique sur Désinstaller

                  ~~

                  J'attends mes rapports OTL ;)
                  1. perfido Auteur
                    Bonsoir juju666
                    Il se trouve qu'en téléchargeant OTL j'ai retrouvé tout étonné firefox, comme quoi ces malveillants tiennent à peu de chose.
                    Je ne te remercierais jamais assez.
                    Grand merci

                    # AdwCleaner v2.202 - Rapport créé le 26/04/2013 à 00:38:49
                    # Mis à jour le 23/04/2013 par Xplode
                    # Système d'exploitation : Windows 7 Professional Service Pack 1 (64 bits)
                    # Nom d'utilisateur : User - USER-THINK
                    # Mode de démarrage : Normal
                    # Exécuté depuis : C:\Users\User\Nouveau dossier\adwcleaner.exe
                    # Option [Suppression]

                    ***** [Services] *****

                    ***** [Fichiers / Dossiers] *****

                    ***** [Registre] *****

                    Clé Supprimée : HKCU\Software\BabylonToolbar

                    ***** [Navigateurs] *****

                    -\\ Internet Explorer v9.0.8112.16476

                    [OK] Le registre ne contient aucune entrée illégitime.

                    -\\ Mozilla Firefox v20.0.1 (fr)

                    -\\ Google Chrome v26.0.1410.64

                    *************************

                    AdwCleaner[R1].txt - [1022 octets] - [25/04/2013 16:49:22]
                    AdwCleaner[S10].txt - [769 octets] - [26/04/2013 00:38:49]
                    AdwCleaner[S1].txt - [1122 octets] - [24/04/2013 15:49:11]
                    AdwCleaner[S5].txt - [473 octets] - [25/04/2013 22:57:06]
                    AdwCleaner[S6].txt - [679 octets] - [25/04/2013 22:59:04]
                    AdwCleaner[S7].txt - [467 octets] - [25/04/2013 23:33:38]
                    AdwCleaner[S8].txt - [467 octets] - [25/04/2013 23:36:00]
                    AdwCleaner[S9].txt - [4165 octets] - [25/04/2013 23:53:37]

                    ########## EOF - C:\AdwCleaner[S10].txt - [1185 octets] ##########
                    1. juju666 Contributeur sécurité
                      Une véritable poubelle numérique ton PC

                      ~~

                      Dans l'ordre :

                      1/
                      ▶ Télécharge sur cette page: AdwCleaner (de Xplode)

                      ▶ Lance-le

                      clique sur Suppression et patiente le temps du nettoyage.

                      ▶ Envoie le rapport que tu trouveras dans ton disque dur c:\ADwcleaner[Sx].txt sur cjoint et poste le lien pour consulter le fichier

                      2/
                      ▶ Télécharge sur cette page: RstHosts

                      ▶ Lance-le

                      clique sur Restaurer, ça va très vite.

                      3/
                      Désinstalle ZHPDiag via le panneau de configuration.

                      4/
                      Faire un scan OTL pour diagnostiquer les programmes qui tournent et déceler des infections :

                      ▶ Télécharge ici :OTL

                      ▶ Fais un double clic sur l'icône pour le lancer (clic droit executer en tant qu'administrateur sous Vista, Windows 7 ou Windows 8). Vérifier que toutes les autres fenêtres sont fermées afin qu'il s'exécute sans interruption.

                      ▶ Quand la fenêtre apparaît, Coche la case Tous les utilisateurs
                      ▶ Coche les cases à coté de Recherche Lop et Recherche Purity.
                      ▶ Laisse tous les autres paramètres par défaut

                      ▶ Copie et colle le contenu de ce qui suit en gras dans la partie inférieure d'OTL "Personnalisation"


                      msconfig
                      netsvcs
                      /md5start
                      explorer.exe
                      winlogon.exe
                      userinit.exe
                      svchost.exe
                      services.exe
                      winsock.*
                      /md5stop
                      %temp%\*.exe /s
                      %ALLUSERSPROFILE%\Application Data\*.exe /s
                      %ALLUSERSPROFILE%\Application Data\*.
                      %APPDATA%\*.exe /s
                      %SYSTEMDRIVE%\*.*
                      BASESERVICES
                      CREATERESTOREPOINT
                      SAVEMBR:0

                      ▶ Clic sur Analyse.

                      A la fin du scan, 2 Bloc-Notes vont s'ouvrir avec les rapports (OTL.txt et extras.txt).

                      NE PAS COPIER/COLLER LE RAPPORT ICI - LIRE JUSQU'AU BOUT

                      Ces fichiers se trouvent à côté de l'exécutable OTL.exe

                      héberge OTL.txt et extra.txt sur cjoint.com et donne les liens obtenus en échange

                      NE PAS COPIER/COLLER LE RAPPORT DANS TA REPONSE, L'HEBERGER SUR CJOINT

                      Bonne soirée et bon courage, poste bien tout ce qui est demandé :)
                      1. perfido Auteur
                        Merci pour ton intervention
                        Lorsque j'ouvre firefox je trouve
                        https://www.cjoint.com/?CDzwMfwIGKm
                        Fonctionnalités de Firefo
                        Mozilla
                        mozilla
                        * Ordinateur
                        * Mobile ¬
                        * Modules
                        * Assistance
                        * À propos
                        * Accès presse
                        * FirefoxTéléchargement gratuit
                        Respect de la vie privée - Autres langues et systèmes
                        Fonctionnalités de Firefox
                        Toute une gamme de super fonctionnalités pour améliorer votre navigation.
                        * Navigation facilitée
                        * Performances élevées
                        * Sécurité renforcée
                        * Personnalisation développée
                        * Technologies de pointe
                        * Accès universel
                        Fonctionnalités principales
                        (survolez pour en savoir plus)
                        * Rapidité
                        * Synchronisation
                        * Personnalisation facile
                        * Barre intelligente
                        * Interface intuitive
                        Haut de la page
                        Navigation facilitée

                        Rapport de ZHPDiag v2013.4.24.149 par Nicolas Coolman, Update du 24/04/2013
                        Run by User at 25/04/2013 22:04:49
                        State : Version à jour.
                        WhiteList : Enable
                        High Elevated Privileges : OK
                        UAC : Deactivate by user

                        ---\\ Web Browser
                        MSIE: Internet Explorer v9.0.8112.16421
                        MFIE: Mozilla Firefox 20.0.1 (Defaut)
                        GCIE: Google Chrome v26.0.1410.64

                        ---\\ Windows Product Information
                        ~ Langage: Français
                        Windows 7 Business Edition, 64-bit Service Pack 1 (Build 7601)
                        Windows Server License Manager Script : OK
                        ~ Windows(R) 7, OEM_SLP channel
                        System Locked Preinstallation (OEM_SLP) : OK
                        Windows ID Activation : OK
                        ~ Windows Partial Key : 24367
                        Windows License : OK
                        ~ Windows Remaining Initializations Number : 2
                        Software Protection Service (Protection logicielle) : OK
                        Windows Automatic Updates : OK
                        Windows Activation Technologies : OK

                        ---\\ System Protection
                        AVG 2013 v13.0.3162
                        Windows Defender W7

                        ---\\ System Optimizer

                        ---\\ Software Update
                        Adobe Flash Player 11 Plugin
                        Adobe Reader X
                        Java 7 Update 6
                        Java 7 Update 9

                        ---\\ System Information
                        ~ Processor: Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
                        ~ Operating System: 64 Bits
                        Boot mode: Normal (Normal boot)
                        Total RAM: 3916 MB (60% free)
                        System Restore: Activé (Enable)
                        System drive C: has 401 GB (88%) free of 451 GB

                        ---\\ Logged in mode
                        ~ Computer Name: USER-THINK
                        ~ User Name: User
                        ~ All Users Names: User, LogMeInRemoteUser, HomeGroupUser$, Administrateur,
                        ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
                        Logged in as Administrator

                        ---\\ Environnement Variables
                        ~ System Unit : C:\
                        ~ %AppData% : C:\Users\User\AppData\Roaming\
                        ~ %Desktop% : C:\Users\User\Desktop\
                        ~ %Favorites% : C:\Users\User\Favorites\
                        ~ %LocalAppData% : C:\Users\User\AppData\Local\
                        ~ %StartMenu% : C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\
                        ~ %Windir% : C:\Windows\
                        ~ %System% : C:\Windows\System32\

                        ---\\ DOS/Devices
                        C:\ Hard drive, Flash drive, Thumb drive (Free 401 Go of 451 Go)
                        D:\ CD-ROM drive (Not Inserted)
                        Q:\ Hard drive, Flash drive, Thumb drive (Free 4 Go of 14 Go)

                        ---\\ Security Center & Tools Informations
                        [HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK
                        [HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK
                        [HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK
                        [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
                        [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
                        [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK
                        [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK
                        [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK
                        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK
                        [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : OK
                        ~ Security Center: Scanned in 00mn 00s

                        ---\\ Recherche particulière de fichiers génériques
                        [MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.08/12/2011 - 21:56:11.) -- C:\Windows\Explorer.exe [2871808]
                        [MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
                        [MD5.A4F6142CABA82FB7293ECE5FF864B440] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.22/02/2013 - 07:20:51.) -- C:\Windows\System32\wininet.dll [1392128]
                        [MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.21/11/2010 - 04:24:29.) -- C:\Windows\System32\Winlogon.exe [390656]
                        [MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.21/11/2010 - 04:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
                        [MD5.1C7857B62DE5994A75B054A9FD4C3825] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.23/06/2012 - 07:57:07.) -- C:\Windows\system32\Drivers\AFD.sys [498688]
                        [MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
                        [MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
                        [MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
                        [MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
                        [MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
                        [MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
                        [MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
                        [MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.08/12/2011 - 21:58:09.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
                        [MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 04:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
                        [MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
                        [MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
                        [MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 04:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
                        [MD5.1B6163C503398B23FF8B939C67747683] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.21/11/2010 - 04:25:07.) -- C:\Windows\system32\Drivers\rdpdr.sys [165888]
                        [MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
                        [MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
                        [MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
                        ~ Generic Processes: Scanned in 00mn 00s

                        ---\\ Etat des fichiers cachés (Caché/Total)
                        ~ Mes images (My Pictures) : 1/45
                        ~ Mes Favoris (My Favorites) : 1/23
                        ~ Mes Documents (My Documents) : 5/221
                        ~ Mon Bureau (My Desktop) : 1/612
                        ~ Menu demarrer (Programs) : 1/28
                        ~ Hidden Files: Scanned in 00mn 00s

                        ---\\ Processus lancés
                        [MD5.D9C8DC2D7EC28E3FF25C99EF17C8631A] - (...) -- C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [2787280] [PID.1880] =>Toolbar.Babylon
                        [MD5.BA92C496F08D78F7DB263A20C36AA546] - (.AVG Technologies CZ, s.r.o. - AVG User Interface.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe [4394032] [PID.2952]
                        [MD5.D722AA885336EDBA2AC0EB4D8E15D050] - (.SPAMfighter ApS - FIGHTERtools Update Manager.) -- C:\Program Files (x86)\Fighters\Tray\FightersTray.exe [1405544] [PID.2968]
                        [MD5.AE94B9E946239BF390AA8918CADFCE40] - (.SPAMfighter ApS - SPAMfighter Agent.) -- C:\Program Files (x86)\Fighters\SPAMfighter\sfagent.exe [1460768] [PID.3060]
                        [MD5.7DFA6844BB54E6FE73E0032877AE6793] - (.Symantec Corporation - Symantec VIP Access.) -- C:\Program Files (x86)\Symantec\VIP Access Client\VIPUIManager.exe [1666704] [PID.4480]
                        [MD5.1321DC81E317EE48C4D004775FB29AC9] - (.Nicolas Coolman - ZHPDiag Setup.) -- C:\Program Files (x86)\ZHPDiag\ZHPhep.exe [1916928] [PID.960]
                        [MD5.8ECBD447964D1D003FF0ADAA10AE3376] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [6987264] [PID.3920]
                        [MD5.3927397AC60D943DAF8808AFFED582B7] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65192] [PID.1732]
                        [MD5.0D8244A9DB70BC6C36E2FB56F6039AB6] - (.AVG Technologies CZ, s.r.o. - AVG Identity Protection Service.) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4937264] [PID.1784]
                        [MD5.DC98337F0D2A9F6C0B6FB682297ECE3B] - (.AVG Technologies CZ, s.r.o. - AVG Watchdog Service.) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [282624] [PID.1820]
                        [MD5.63511240AF70D10343A4AE05F8E2CA12] - (.Lenovo - RapidBoot HDD Accelerator Service.) -- C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [169776] [PID.2012]
                        [MD5.BB3FAB073189F3BBC5F0BD30A1FF5377] - (.Pas de propriétaire - Installer.) -- C:\ProgramData\IBUpdaterService\ibsvc.exe [649984] [PID.1404] =>Adware.InstallBrain
                        [MD5.5A9894E80575647DC77A7D1954B05CE7] - (.Intel Corporation - Intel IPT Host Interface Service.) -- C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe [212944] [PID.2392]
                        [MD5.11E09CE1C14E76F9A658D02198365F37] - (.Lenovo Group Limited - Camera Mute Control Service for ThinkPad.) -- C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe [58192] [PID.2420]
                        [MD5.D7D72179E2696F6DB6CD082984A3400E] - (.Lenovo Group Limited - Microphone volume control service.) -- C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe [61264] [PID.2456]
                        [MD5.5FECAD752E908D92EA8BD3E9E3862C98] - (.Lenovo - Power Manager Dynamic Brightness Control Se.) -- C:\Program Files (x86)\Lenovo\PowerMgr\PWMDBSVC.exe [70968] [PID.2640]
                        [MD5.ACEE95093C47CE3EC342578EE5F47E01] - (.SPAMfighter ApS - SPAMfighter Update Service.) -- C:\Program Files (x86)\Fighters\SPAMfighter\sfus.exe [216608] [PID.2728]
                        [MD5.DE43E582B80C4DF7D6425A42BCABB90A] - (.SPAMfighter ApS - Fighter Suite Service.) -- C:\Program Files (x86)\Fighters\FighterSuiteService.exe [1270376] [PID.2776]
                        [MD5.BE788A747457E6916586C410EC0111E7] - (.Ulead Systems, Inc. - ULCDRSvr.) -- C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [61440] [PID.3536]
                        [MD5.545462D0DBE24AF379BA869B7C185CCD] - (.Intel Corporation - IAStorDataSvc.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [13592] [PID.2712]
                        [MD5.BF22ACF4CF3734D61357E67F0521BC03] - (.Intel Corporation - Local Manageability Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [277784] [PID.5796]
                        [MD5.A9C45E3CFD3054EF391827BCF0BF1F61] - (.Symantec Corporation - Symantec VIPAppService.) -- C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe [81552] [PID.5900]
                        [MD5.B097EBA0E3FEB020BB65FE43AF5ECCFF] - (.Intel Corporation - User Notification Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [363800] [PID.3548]
                        ~ Processes Running: Scanned in 00mn 00s

                        ---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
                        C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Preferences
                        ~ Google Browser: Scanned in 00mn 00s

                        ---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
                        C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\prefs.js
                        C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\user.js
                        M3 - MFPP: Plugins - [User] -- C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\searchplugins\amazon.xml
                        M3 - MFPP: Plugins - [User] -- C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\searchplugins\babylon.xml =>Toolbar.Babylon
                        M3 - MFPP: Plugins - [User] -- C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\searchplugins\BrowserProtect.xml =>Toolbar.Babylon
                        M3 - MFPP: Plugins - [User] -- C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\searchplugins\delta.xml
                        M3 - MFPP: Plugins - [User] -- C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\searchplugins\fileconverter-15-customized-web-search.xml
                        M3 - MFPP: Plugins - [User] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\babylon.xml =>Toolbar.Babylon
                        M3 - MFPP: Plugins - [User] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\portaldosites.xml
                        M0 - MFSP: prefs.js [User - vn2atj3w.default] https://www.mozilla.org/en-US/
                        M2 - MFEP: prefs.js [User - vn2atj3w.default\SpecialSavings@SpecialSavings.com] [] SpecialSavings v2.0.0.1 (..)
                        ~ Firefox Browser: 20 Legitimates Filtered in 00mn 00s

                        ---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
                        R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www2.delta-search.com =>Toolbar.DeltaSearch
                        R4 - HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,EnabledV8 = 1
                        R4 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\PhishingFilter,EnabledV8 = 1
                        ~ IE Browser: 14 Legitimates Filtered in 00mn 00s

                        ---\\ Internet Explorer, Proxy Management (R5)
                        R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
                        R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
                        R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
                        R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
                        R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
                        ~ Proxy management: Scanned in 00mn 00s

                        ---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
                        F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
                        F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
                        F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
                        ~ Keys: Scanned in 00mn 00s

                        ---\\ Redirection du fichier Hosts (O1)
                        O1 - Hosts: 0.0.0.0 boxore.com =>Adware.Boxore
                        O1 - Hosts: 0.0.0.0 www.boxore.com =>Adware.Boxore
                        O1 - Hosts: 0.0.0.0 boxore.org =>Adware.Boxore
                        O1 - Hosts: 0.0.0.0 www.boxore.org =>Adware.Boxore
                        O1 - Hosts: 0.0.0.0 boxore.net =>Adware.Boxore
                        O1 - Hosts: 0.0.0.0 www.boxore.net =>Adware.Boxore
                        O1 - Hosts: 0.0.0.0 dlmanager.com
                        O1 - Hosts: 0.0.0.0 www.dlmanager.com
                        O1 - Hosts: 0.0.0.0 dlmanager.org
                        O1 - Hosts: 0.0.0.0 www.dlmanager.org
                        O1 - Hosts: 0.0.0.0 dlmanager.net
                        O1 - Hosts: 0.0.0.0 www.dlmanager.net
                        ~ Hosts File: Scanned in 00mn 00s
                        ~ Nombre de lignes (Lines number): 34

                        ---\\ Browser Helper Objects de navigateur (O2)
                        O2 - BHO: SpecialSavings [64Bits] - {938958E8-355C-49FF-92B0-53C1B87ACEA9} . (.SpecialSavings.com - ScriptHost.) -- C:\Program Files (x86)\SpecialSavings\ScriptHost.dll
                        ~ BHO: 8 Legitimates Filtered in 00mn 00s

                        ---\\ Applications démarrées par registre & par dossier (O4)
                        O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
                        O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
                        O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe
                        O4 - HKLM\..\Wow6432Node\Run: [AVG_UI] . (.AVG Technologies CZ, s.r.o. - AVG User Interface.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe
                        O4 - HKLM\..\Wow6432Node\Run: [CommonToolkitTray] . (.SPAMfighter ApS - FIGHTERtools Update Manager.) -- C:\Program Files (x86)\Fighters\Tray\FightersTray.exe
                        O4 - HKLM\..\Wow6432Node\Run: [sfagent] . (.SPAMfighter ApS - SPAMfighter Agent.) -- C:\Program Files (x86)\Fighters\SPAMfighter\sfagent.exe
                        O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
                        O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
                        O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
                        O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
                        ~ Application: Scanned in 00mn 00s

                        ---\\ Autres liens utilisateurs (O4)
                        O4 - GS\TaskBar: FreeOCR.lnk . (...) -- C:\FreeOCR\FreeOCR.exe
                        O4 - GS\TaskBar: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                        O4 - GS\TaskBar: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe http://www.portaldosites.com
                        O4 - GS\TaskBar: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
                        O4 - GS\TaskBar: Windows Media Player.lnk . (.Microsoft Corporation - Lecteur Windows Media.) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                        O4 - GS\TaskBar: ZHPFix.lnk . (.Nicolas Coolman - ZHPFix.) -- C:\Program Files (x86)\ZHPFix\ZHPFix.exe
                        O4 - GS\Programs: Internet Explorer (64-bit).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
                        O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
                        O4 - GS\QuickLaunch: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                        O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe http://www.portaldosites.com
                        O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
                        O4 - GS\Accessories: Private Character Editor.lnk . (.Microsoft Corporation - Éditeur de caractères privés.) -- C:\Windows\system32\eudcedit.exe
                        O4 - GS\SendTo: Desk 365.lnk . (...) -- C:\Program Files (x86)\Desk 365\desk365.exe (.not file.)
                        O4 - GS\SendTo: Fax Recipient.lnk . (.Microsoft Corporation - Microsoft Windows Fax and Scan.) -- C:\Windows\system32\WFS.exe
                        O4 - GS\SendTo: Transfert de fichiers Bluetooth.LNK . (.Microsoft Corporation - Pas de description.) -- C:\Windows\System32\fsquirt.exe
                        O4 - GS\Desktop: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe http://www.portaldosites.com
                        O4 - GS\Desktop: Microsoft Office - Raccourci.lnk . (...) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
                        O4 - GS\Desktop: Microsoft Office Excel 2007.lnk . (...) -- C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
                        O4 - GS\Desktop: Microsoft Office Word 2007.lnk . (...) -- C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe
                        O4 - GS\Desktop: Paint (2).lnk . (.Microsoft Corporation - Paint.) -- C:\Windows\system32\mspaint.exe
                        O4 - GS\Desktop: Paint.lnk . (.Microsoft Corporation - Paint.) -- C:\Windows\system32\mspaint.exe
                        O4 - GS\Desktop: PhotoFiltre.lnk . (.Antonio Da Cruz - PhotoFiltre.) -- C:\Program Files (x86)\PhotoFiltre\PhotoFiltre.exe
                        O4 - GS\Desktop: Windows Live Mail (2).lnk . (.Microsoft Corporation - Windows Live Mail.) -- C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
                        O4 - GS\Desktop: ZHPFix 2013 - Raccourci (2).lnk . (...) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHPFix 2013
                        O4 - GS\Desktop: ZHPFix 2013 - Raccourci (3).lnk . (...) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHPFix 2013
                        O4 - GS\Desktop: ZHPFix 2013 - Raccourci.lnk . (...) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHPFix 2013
                        ~ Global Startup: Scanned in 00mn 00s

                        ---\\ Modification Domaine/Adresses DNS (O17)
                        O17 - HKLM\System\CCS\Services\Tcpip\..\{5078CA81-73E2-4B3E-B198-F4EAFFB00E65}: DhcpNameServer = 192.168.0.1
                        O17 - HKLM\System\CS1\Services\Tcpip\..\{5078CA81-73E2-4B3E-B198-F4EAFFB00E65}: DhcpNameServer = 192.168.0.1
                        O17 - HKLM\System\CS2\Services\Tcpip\..\{5078CA81-73E2-4B3E-B198-F4EAFFB00E65}: DhcpNameServer = 192.168.0.1
                        O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
                        ~ Domain: Scanned in 00mn 00s

                        ---\\ Protocole additionnel (O18)
                        O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
                        O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll
                        ~ Protocole Additionnel: Scanned in 00mn 00s

                        ---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
                        O20 - Winlogon Notify: GoToAssist . (.Citrix Online, a division of Citrix Systems - Citrix Online GoToAssist Corporate.) -- C:\Program Files (x86)\Citrix\GoToAssist\759\G2AWinLogon_x64.dll
                        O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
                        ~ Winlogon: Scanned in 00mn 00s

                        ---\\ Liste des services NT non Microsoft et non désactivés (O23)
                        O23 - Service: BrowserProtect (BrowserProtect) . (...) - C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe =>Toolbar.Babylon
                        O23 - Service: FastbootService (FastbootService) . (.Lenovo - RapidBoot HDD Accelerator Service.) - C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe
                        O23 - Service: Updater Service (IBUpdaterService) . (.Pas de propriétaire - Installer.) - C:\ProgramData\IBUpdaterService\ibsvc.exe =>Adware.InstallBrain
                        O23 - Service: Lenovo Camera Mute (LENOVO.CAMMUTE) . (.Lenovo Group Limited - Camera Mute Control Service for ThinkPad.) - C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
                        O23 - Service: Lenovo Keyboard Noise Reduction (LENOVO.TPKNRSVC) . (.Lenovo Group Limited - Microphone volume control service.) - C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
                        O23 - Service: Power Manager DBC Service (Power Manager DBC Service) . (.Lenovo - Power Manager Dynamic Brightness Control Se.) - C:\Program Files (x86)\Lenovo\PowerMgr\PWMDBSVC.exe
                        O23 - Service: Skdaemon Service (Sks8821) . (...) - C:\Program Files\Lenovo\Lenovo Slim USB Keyboard\Sks8821.exe
                        O23 - Service: VIPAppService (VIPAppService) . (.Symantec Corporation - Symantec VIPAppService.) - C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe
                        O23 - Service: (vToolbarUpdater14.2.0) . (...) - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe (.not file.) =>Toolbar.AVGSearch
                        ~ Services: 23 Legitimates Filtered in 00mn 08s

                        ---\\ Tâches planifiées en automatique (O39)
                        [MD5.534C82F1D7246EDF654B5257CA82FE70] [APT] [DealPly] (...) -- C:\Users\User\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.exe [93728] =>PUP.DealPly
                        [MD5.00000000000000000000000000000000] [APT] [DealPlyUpdate] (...) -- C:\Program Files (x86)\DealPly\DealPlyUpdate.exe (.not file.) [0] =>PUP.DealPly
                        [MD5.00000000000000000000000000000000] [APT] [Desk 365 RunAsStdUser] (...) -- C:\Program Files (x86)\Desk 365\desk365.exe (.not file.) [0]
                        [MD5.65611587D8245CE8DB9E306D239EE22F] [APT] [EPUpdater] (...) -- C:\Users\User\AppData\Roaming\BabSolution\Shared\BabMaint.exe [9808] =>Hijacker.BabSolution
                        [MD5.00000000000000000000000000000000] [APT] [MCP] (...) -- C:\Program Files (x86)\LENOVO\Message Center Plus\MCPLaunch.exe (.not file.) [0]
                        [MD5.DB175958FDF8DE7F3E1E3AC6E24D81EF] [APT] [PMTask] (.Lenovo Group Limited.) -- C:\Program Files (x86)\Lenovo\PowerMgr\PWMIDTSV.exe [169272]
                        [MD5.7F91A8D7192B1664D4C4B19996ED8281] [APT] [Test TimeTrigger] (...) -- C:\Users\User\AppData\Local\Temp\Runner.exe [40587]
                        [MD5.295E67A34ACF7525C65E3B72F0146005] [APT] [{14926FEE-1575-4A1A-89A8-00FE09161CEE}] (.SPAMfighter ApS.) -- C:\Users\User\Downloads\spamfighter_web.exe [2581368]
                        [MD5.295E67A34ACF7525C65E3B72F0146005] [APT] [{185AAE90-66AC-4744-8ECC-D1A9885580AC}] (.SPAMfighter ApS.) -- C:\Users\User\Downloads\spamfighter_web.exe [2581368]
                        [MD5.295E67A34ACF7525C65E3B72F0146005] [APT] [{3B158F06-B3BE-428D-B24D-3C4B1AED66D2}] (.SPAMfighter ApS.) -- C:\Users\User\Downloads\spamfighter_web.exe [2581368]
                        [MD5.295E67A34ACF7525C65E3B72F0146005] [APT] [{9601BC2B-7D18-4A2F-9275-91B433F4CE72}] (.SPAMfighter ApS.) -- C:\Users\User\Downloads\spamfighter_web.exe [2581368]
                        [MD5.295E67A34ACF7525C65E3B72F0146005] [APT] [{F6BB7E90-674E-4B48-B63F-751BE71D090E}] (.SPAMfighter ApS.) -- C:\Users\User\Downloads\spamfighter_web.exe [2581368]
                        [MD5.2235796E99BDC3FFA45B93556E97FE5B] [APT] [TVSUUpdateTask] (...) -- C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [184680]
                        ~ Scheduled Task: 31 Legitimates Filtered in 00mn 01s

                        ---\\ Logiciels installés (O42)
                        O42 - Logiciel: SpecialSavings - (.SpecialSavings.com.) [HKLM][64Bits] -- SpecialSavings
                        O42 - Logiciel: Updater Service - (...) [HKLM][64Bits] -- Updater Service
                        ~ Logic: 85 Legitimates Filtered in 00mn 00s

                        ---\\ HKCU & HKLM Software Keys
                        [HKCU\Software\AppDataLow\Software\Smartbar] =>Hijacker.SmartBar
                        [HKCU\Software\DataMngr] =>PUP.Datamngr
                        [HKCU\Software\DataMngr_Toolbar] =>PUP.Datamngr
                        [HKCU\Software\Duuqu]
                        [HKCU\Software\LiveKit]
                        [HKCU\Software\e28cd8e269e517]
                        [HKLM\Software\LTON_HIS]
                        [HKLM\Software\Wow6432Node\Babylon] =>Toolbar.Babylon
                        [HKLM\Software\Wow6432Node\DataMngr] =>PUP.Datamngr
                        [HKLM\Software\Wow6432Node\Duuqu]
                        [HKLM\Software\Wow6432Node\ThinkVantage]
                        [HKLM\Software\Wow6432Node\e28cd8e269e517]
                        ~ Key Software: 167 Legitimates Filtered in 00mn 00s

                        ---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
                        O43 - CFD: 22/04/2013 - 05:25:48 - [0,062] ----D C:\Program Files (x86)\mixiedj
                        O43 - CFD: 25/04/2013 - 18:37:30 - [1,467] ----D C:\Program Files (x86)\SpecialSavings
                        O43 - CFD: 25/04/2013 - 18:36:55 - [0] ----D C:\ProgramData\Babylon =>Toolbar.Babylon
                        O43 - CFD: 25/04/2013 - 18:37:25 - [7,800] ----D C:\ProgramData\BrowserProtect =>Toolbar.Babylon
                        O43 - CFD: 16/12/2012 - 11:52:32 - [0,003] ----D C:\ProgramData\clp
                        O43 - CFD: 25/04/2013 - 18:36:54 - [0,622] ----D C:\ProgramData\IBUpdaterService =>Adware.InstallBrain
                        O43 - CFD: 25/04/2013 - 18:37:18 - [1,933] ----D C:\Users\User\AppData\Roaming\BabSolution =>Hijacker.BabSolution
                        O43 - CFD: 17/04/2013 - 22:51:33 - [0,081] ----D C:\Users\User\AppData\Roaming\Babylon =>Toolbar.Babylon
                        O43 - CFD: 23/04/2013 - 05:46:59 - [0,090] ----D C:\Users\User\AppData\Roaming\DealPly =>PUP.DealPly
                        O43 - CFD: 23/04/2013 - 15:16:18 - [11,815] ----D C:\Users\User\AppData\Roaming\Desk 365
                        O43 - CFD: 23/04/2013 - 15:14:13 - [5,560] ----D C:\Users\User\AppData\Roaming\eIntaller
                        O43 - CFD: 17/04/2013 - 22:51:32 - [0,308] ----D C:\Users\User\AppData\Roaming\File Scout
                        O43 - CFD: 01/12/2012 - 15:39:59 - [1,402] ----D C:\Users\User\AppData\Roaming\LiveKit
                        O43 - CFD: 30/08/2012 - 16:58:42 - [0,009] ----D C:\Users\User\AppData\Roaming\LSC
                        O43 - CFD: 20/04/2013 - 05:03:41 - [27,280] ----D C:\Users\User\AppData\Roaming\OpenCandy =>Adware.OpenCandy
                        O43 - CFD: 25/04/2013 - 18:37:32 - [0,066] ----D C:\Users\User\AppData\Roaming\SpecialSavings
                        O43 - CFD: 24/04/2013 - 11:16:40 - [0,138] ----D C:\Users\User\AppData\Roaming\Yontoo =>PUP.Yontoo
                        O43 - CFD: 22/04/2013 - 05:22:45 - [0] ----D C:\Users\User\AppData\Local\Duuqu
                        O43 - CFD: 25/04/2013 - 17:50:39 - [0] ----D C:\Users\User\AppData\Local\Lollipop =>Adware.Lollipop
                        O43 - CFD: 30/08/2012 - 17:15:21 - [0,250] ----D C:\Users\User\AppData\Local\LSC
                        O43 - CFD: 23/04/2013 - 15:34:07 - [0] ----D C:\Users\User\AppData\Local\Tiger Savings
                        O43 - CFD: 25/04/2013 - 18:37:28 - [0,001] ----D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserProtect =>Toolbar.Babylon
                        O43 - CFD: 23/04/2013 - 05:46:58 - [0,001] ----D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly =>PUP.DealPly
                        O43 - CFD: 23/04/2013 - 08:52:07 - [0,002] ----D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\QTRAX
                        ~ 148 Dossiers CLSID vides (CLSID Empty Folders)
                        ~ Program Folder: 354 Legitimates Filtered in 00mn 01s

                        ---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
                        O44 - LFC:[MD5.A69FE04618C8F6A0C6B9565C83DBE841] - 24/04/2013 - 14:47:39 ---A- . (...) -- C:\DelFix.txt [361]
                        O44 - LFC:[MD5.815372073DA85B2098A37DED84083C8A] - 24/04/2013 - 04:55:04 ---A- . (...) -- C:\Windows\_MSRSTRT.EXE [2560]
                        O44 - LFC:[MD5.882D792A41DD9CFE1F87B7AB40F446E1] - 23/04/2013 - 07:34:51 ---A- . (...) -- C:\Windows\BUZZTWLC.INI [101]
                        O44 - LFC:[MD5.73B0CE289F75A103DFA3F5CDC9513970] - 20/04/2013 - 12:36:14 ---A- . (...) -- C:\Windows\AVControl.ini [90]
                        O44 - LFC:[MD5.87E5AAE1AA9431EF1DDEDC46D2145BDB] - 20/04/2013 - 12:36:09 ---A- . (...) -- C:\Windows\DDRLog.ini [32]
                        ~ Files: 19 Legitimates Filtered in 00mn 01s

                        ---\\ MountPoints2 Shell Key (O51)
                        O51 - MPSK:{27b4c52e-bcad-11e1-a26d-806e6f6e6963}\AutoRun\command. (.Lenovo Group Limited - Lenovo Factory Backup Partition Information.) -- Q:\LenovoQDrive.exe
                        ~ Keys: Scanned in 00mn 00s

                        ---\\ ShareTools MSconfig StartupReg (O53)
                        O53 - SMSR:HKLM\...\startupreg\sfagent [Key] . (.SPAMfighter ApS - SPAMfighter Agent.) -- C:\Program Files (x86)\Fighters\SPAMfighter\sfagent.exe
                        ~ SMSR Keys: 15 Legitimates Filtered in 00mn 00s

                        ---\\ Microsoft Windows Policies System (O55)
                        O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
                        O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
                        O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
                        O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
                        ~ MWPS: 16 Legitimates Filtered in 00mn 00s

                        ---\\ Microsoft Windows Policies Explorer (O56)
                        O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
                        ~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s

                        ---\\ Liste des Drivers Système (O58)
                        O58 - SDL:[MD5.2F6B34B83843F0C5118B63AC634F5BF4] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [491088]
                        O58 - SDL:[MD5.A4E07DA3AE2078BD96E84D4BAA07B71D] - 23/12/2004 - 03:47:10 R--A- . (.Ulead Systems, Inc. - ULCDRHlp driver.) -- C:\Windows\SysWOW64\drivers\ULCDRHlp.sys [27392]
                        ~ Drivers: Scanned in 00mn 00s

                        ---\\ Liste des outils de nettoyage (O63)
                        O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
                        O63 - Logiciel: ZHPFix 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPFix_is1
                        ~ ADS: Scanned in 00mn 00s

                        ---\\ Liste des services Legacy (O64)
                        O64 - Services: CurCS - 24/07/2008 - C:\Windows\system32\drivers\LMIRfsDriver.sys (LMIRfsDriver) .(.LogMeIn, Inc. - LogMeIn Rfs Drivemap Driver.) - LEGACY_LMIRFSDRIVER
                        O64 - Services: CurCS - 10/06/2009 - C:\Windows\System32\Drivers\secdrv.sys (secdrv) .(.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) - LEGACY_SECDRV
                        ~ Legacy: 122 Legitimates Filtered in 00mn 00s

                        ---\\ File Associations Shell Spawning (O67)
                        O67 - Shell Spawning: <.reg> <Regedit.Document>[HKLM\..\open\Command] (.Not Key.)
                        O67 - Shell Spawning: <.reg> <Regedit.Document>[HKCR\..\open\Command] (.Not Key.)
                        ~ FASS Keys: 19 Legitimates Filtered in 00mn 00s

                        ---\\ Start Menu Internet (O68)
                        O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
                        O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                        O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
                        ~ Keys: Scanned in 00mn 00s

                        ---\\ Search Browser Infection (O69)
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("browser.search.defaultthis.engineName", "FileConverter 1.5 Customized Web Search");
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("browser.search.defaulturl", "http://search.conduit.com/ResultsExt.aspx?ctid=CT3241952&CUI=UN38232132948890256&UM=1&Sear[...]
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("CT3241952.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"http://search.conduit.com/?ctid=CT3241952&octid=CT3[...]
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("CT3241952.SearchFromAddressBarUrl", "http://search.conduit.com/ResultsExt.aspx?ctid=CT3241952&SearchSource=2&CUI=UN3823[...]
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.admin", false);
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.aflt", "babsst");
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.autoRvrt", "fals
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.bbDpng", "23");
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.cntry", "FR");
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.dfltLng", "en");user
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.ffxUnstlRst", true);
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.instlDay", "15818");
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.instlRef", "sst");
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.lastVrsnTs", "1.8.16.168:49:40");
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.newTab", false);
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.prdct", "delta");
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.prtnrId", "delta");
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.rvrt", "false");
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.sg", "tzb");
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.smplGrp", "none");
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.tlbrId", "base");
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.tlbrSrchUrl", "");
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.vrsn", "1.8.16.16");
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.vrsni", "1.8.16.16");
                        O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.vrsnTs", "1.8.16.168:49:40");
                        O69 - SBI: SearchScopes [HKCU] {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} - (Delta Search) - http://www2.delta-search.com =>Toolbar.DeltaSearch
                        O69 - SBI: SearchScopes [HKCU] {4C4C7AAB-5854-4241-A414-E2F1EF119C4A} [DefaultScope] - (DnsBasic) - http://www.dnsbasic.com
                        O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Google) - https://www.google.com/?gws_rd=ssl
                        O69 - SBI: SearchScopes [HKCU] {B3B3A6AC-74EC-BD56-BCDB-EFA4799FB9DF} - (Amazon) - https://www.amazon.fr/
                        O69 - SBI: SearchScopes [HKUS\.DEFAULT] {4C4C7AAB-5854-4241-A414-E2F1EF119C4A} - (DnsBasic) - http://www.dnsbasic.com
                        O69 - SBI: SearchScopes [HKUS\S-1-5-18] {4C4C7AAB-5854-4241-A414-E2F1EF119C4A} - (DnsBasic) - http://www.dnsbasic.com
                        ~ Keys: Scanned in 00mn 00s

                        ---\\ Recherche particuliere à la racine de certains dossiers (O84)
                        [MD5.B3FDF6E7B0AECD48CA7E4921773FB606] [SPRF][18/04/2013] (...) -- C:\Users\User\AppData\Local\Temp\7z920.exe [1110476]
                        [MD5.7EE382396FFE5B846EF4C276F916DB8B] [SPRF][25/04/2013] (...) -- C:\Users\User\AppData\Local\Temp\803.bat [208]
                        [MD5.1BDF5E5015EFCAA68B05CEC0A79BE484] [SPRF][16/08/2012] (.Somoto Ltd. - Better Installer Host.) -- C:\Users\User\AppData\Local\Temp\BI_RunOnce (1).exe [222208] =>Adware.MegaSearch
                        [MD5.1BDF5E5015EFCAA68B05CEC0A79BE484] [SPRF][16/08/2012] (.Somoto Ltd. - Better Installer Host.) -- C:\Users\User\AppData\Local\Temp\BI_RunOnce.exe [222208] =>Adware.MegaSearch
                        [MD5.55B59C2C685CF6A684881FA2AB1DB55A] [SPRF][18/04/2013] (.SweetIM Technologies Ltd. - SweetIM Installer by SweetPacks.) -- C:\Users\User\AppData\Local\Temp\bundlesweetimsetup.exe [9895184] =>PUP.SweetIM
                        [MD5.81019731EC6A3B72840FFF974C55EFB3] [SPRF][07/04/2013] (...) -- C:\Users\User\AppData\Local\Temp\busunint.exe [12880]
                        [MD5.FC1F33785FB9C61EC8409B47DE71B1BB] [SPRF][23/04/2013] (...) -- C:\Users\User\AppData\Local\Temp\DNS.exe [1027609]
                        [MD5.E15D071AD57CB4FD957609B085BADE57] [SPRF][23/04/2013] (...) -- C:\Users\User\AppData\Local\Temp\ICReinstall_InstSocr.exe [667016]
                        [MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][30/12/1899] (...) -- C:\Users\User\AppData\Local\Temp\LyricsPal.exe [269508]
                        [MD5.1D99754A57A2FDD3E14EFCCB42D7A396] [SPRF][26/12/2012] (...) -- C:\Users\User\AppData\Local\Temp\MixiDJToolbar.exe [885400]
                        [MD5.AC3129819FAA20A776239F48E57D2B35] [SPRF][18/04/2013] (.Babylon Ltd. - Babylon Client Setup.) -- C:\Users\User\AppData\Local\Temp\MyBabylonTB.exe [786584] =>Toolbar.Babylon
                        [MD5.35F783E83866CDFD580A06A59C375A61] [SPRF][18/04/2013] (.QuickShare - QuickShare.) -- C:\Users\User\AppData\Local\Temp\QuickShare1.exe [7704368] =>PUP.QuickShare
                        [MD5.7F91A8D7192B1664D4C4B19996ED8281] [SPRF][02/11/2012] (...) -- C:\Users\User\AppData\Local\Temp\Runner.exe [40587]
                        [MD5.F3A10836603E03A28CAF404B29328F92] [SPRF][07/04/2013] (.Babylon Ltd. - Uninstaller Application.) -- C:\Users\User\AppData\Local\Temp\uninst1.exe [394320] =>Toolbar.Babylon
                        [MD5.BCFAEE85EC74C624D660EF170D1FCEB5] [SPRF][25/04/2013] (...) -- C:\Users\User\AppData\Local\Temp\wajam_install.exe [493544] =>Toolbar.Wajam
                        ~ Files: Scanned in 00mn 00s

                        ---\\ Firewall Active Exception List (FirewallRules) (O87)
                        O87 - FAEL: "{3DE0322A-9F5B-47F4-A163-E5735064A356}" | In - Private - P6 - TRUE | .(.Pas de propriétaire - UNCServer.) -- C:\Program Files (x86)\Lenovo\System Update\UNCServer.exe
                        O87 - FAEL: "{C8B8415F-0AC2-4BF0-87BF-9A333921364F}" | In - Private - P17 - TRUE | .(.Pas de propriétaire - UNCServer.) -- C:\Program Files (x86)\Lenovo\System Update\UNCServer.exe
                        ~ Firewall: 208 Legitimates Filtered in 00mn 00s

                        ---\\ Scan Additionnel (O88)
                        Database Version : v2.11707 - (24/04/2013)
                        Clés trouvées (Keys found) : 79
                        Valeurs trouvées (Values found) : 0
                        Dossiers trouvés (Folders found) : 20
                        Fichiers trouvés (Files found) : 13

                        [HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9}] =>Toolbar.Babylon
                        [HKLM\Software\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}] =>Toolbar.Babylon
                        [HKLM\Software\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}] =>Toolbar.Babylon
                        [HKLM\Software\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}] =>Toolbar.Babylon
                        [HKLM\Software\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}] =>Toolbar.Babylon
                        [HKLM\Software\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}] =>Toolbar.Babylon
                        [HKLM\Software\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}] =>Toolbar.Babylon
                        [HKLM\Software\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}] =>Toolbar.Babylon
                        [HKLM\Software\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}] =>Toolbar.Babylon
                        [HKLM\Software\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}] =>Adware.CDNHelper
                        [HKLM\Software\Wow6432Node\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}] =>Adware.CDNHelper
                        [HKLM\Software\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}] =>Toolbar.Babylon
                        [HKLM\Software\Wow6432Node\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}] =>Toolbar.Babylon
                        [HKLM\Software\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}] =>Toolbar.Babylon
                        [HKLM\Software\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}] =>Toolbar.Babylon
                        [HKLM\Software\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}] =>Toolbar.Babylon
                        [HKLM\Software\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}] =>Toolbar.Babylon
                        [HKLM\Software\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}] =>Toolbar.Babylon
                        [HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASMANCS] =>Toolbar.Bing
                        [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\90C64EA18BA25EE488BF80DCF07F2FFD] =>Toolbar.Agent
                        [HKLM\SYSTEM\CurrentControlSet\Services\IBUpdaterService] =>Adware.IncrediBar
                        [HKCU\Software\DataMngr] =>Adware.Bandoo
                        [HKLM\Software\Wow6432Node\DataMngr] =>Adware.Bandoo
                        [HKLM\Software\Wow6432Node\Microsoft\Tracing\MyBabylontb_RASAPI32] =>Toolbar.Babylon
                        [HKLM\Software\Wow6432Node\Microsoft\Tracing\MyBabylontb_RASMANCS] =>Toolbar.Babylon
                        [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE46C09-2AB8-4EE5-88FB-08CD0FF7F2DF}] =>Toolbar.Agent
                        [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SpecialSavings] =>PUP.SpecialSavings
                        [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Updater Service] =>Adware.IncrediBar
                        [HKLM\Software\Classes\Prod.cap] =>Toolbar.Babylon
                        [HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASAPI32] =>Toolbar.Bing
                        [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings] =>PUP.BProtector
                        [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375] =>Toolbar.Agent
                        [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5] =>Toolbar.Agent
                        [HKLM\Software\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}] =>Toolbar.DeltaSearch
                        [HKLM\Software\Wow6432Node\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}] =>Toolbar.DeltaSearch
                        [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\desksvc] =>Hijacker.22find
                        [HKLM\Software\Classes\ScriptHost.Tool.1] =>Toolbar.Agent
                        [HKLM\Software\Classes\ScriptHost.Tool] =>Toolbar.Agent
                        [HKLM\Software\Classes\AppID\{562B9316-C08A-444A-9482-62080DD851AE}] =>Toolbar.Freecorder
                        [HKLM\Software\Wow6432Node\Classes\AppID\{562B9316-C08A-444A-9482-62080DD851AE}] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\AppID\AddonsFramework.DLL] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\AppID\ButtonSite.DLL] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\AppID\PropertySync.EXE] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\AppID\ScriptHost.DLL] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\AppID\{18B9B16E-716F-43DF-A6AD-512C7D2EB983}] =>Toolbar.Freecorder
                        [HKLM\Software\Wow6432Node\Classes\AppID\{18B9B16E-716F-43DF-A6AD-512C7D2EB983}] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\AppID\{19975B78-1907-4DD6-A437-4C48120F46A4}] =>Toolbar.Freecorder
                        [HKLM\Software\Wow6432Node\Classes\AppID\{19975B78-1907-4DD6-A437-4C48120F46A4}] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\AppID\{562B9317-C08A-444A-9482-62080DD851AE}] =>Toolbar.Freecorder
                        [HKLM\Software\Wow6432Node\Classes\AppID\{562B9317-C08A-444A-9482-62080DD851AE}] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\Interface\{045F91B3-695F-423A-98C7-8DE3C47AA020}] =>Toolbar.Freecorder
                        [HKLM\Software\Wow6432Node\Classes\Interface\{045F91B3-695F-423A-98C7-8DE3C47AA020}] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\Interface\{1348BD1B-C32A-41A7-9BD4-5377AA1AB925}] =>Toolbar.Freecorder
                        [HKLM\Software\Wow6432Node\Classes\Interface\{1348BD1B-C32A-41A7-9BD4-5377AA1AB925}] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\Interface\{395AFE6E-8308-48DB-89BE-ED5F4AA3D3EC}] =>Toolbar.Freecorder
                        [HKLM\Software\Wow6432Node\Classes\Interface\{395AFE6E-8308-48DB-89BE-ED5F4AA3D3EC}] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\Interface\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}] =>Toolbar.Freecorder
                        [HKLM\Software\Wow6432Node\Classes\Interface\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\Interface\{43B390F0-6BA2-45CA-ABF2-5DB0CEE9B49D}] =>Toolbar.Freecorder
                        [HKLM\Software\Wow6432Node\Classes\Interface\{43B390F0-6BA2-45CA-ABF2-5DB0CEE9B49D}] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\Interface\{93CF54F5-CFAA-4440-B588-8ED0DFAD5C21}] =>Toolbar.Freecorder
                        [HKLM\Software\Wow6432Node\Classes\Interface\{93CF54F5-CFAA-4440-B588-8ED0DFAD5C21}] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\Interface\{94CADA2E-1D3F-419F-8A3D-06C58EDF53C8}] =>Toolbar.Freecorder
                        [HKLM\Software\Wow6432Node\Classes\Interface\{94CADA2E-1D3F-419F-8A3D-06C58EDF53C8}] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\Interface\{9E52EB8B-8DD9-4605-AD36-D352BCD482F2}] =>Toolbar.Freecorder
                        [HKLM\Software\Wow6432Node\Classes\Interface\{9E52EB8B-8DD9-4605-AD36-D352BCD482F2}] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\Interface\{A1440EC3-F0FA-407A-B811-DE6668C06D29}] =>Toolbar.Freecorder
                        [HKLM\Software\Wow6432Node\Classes\Interface\{A1440EC3-F0FA-407A-B811-DE6668C06D29}] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\Interface\{B9A84AD0-5777-46FD-8B8F-1EBD06750FBC}] =>Toolbar.Freecorder
                        [HKLM\Software\Wow6432Node\Classes\Interface\{B9A84AD0-5777-46FD-8B8F-1EBD06750FBC}] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\Interface\{C1995F88-1C7F-40D7-B0FA-6F107F6308B8}] =>Toolbar.Freecorder
                        [HKLM\Software\Wow6432Node\Classes\Interface\{C1995F88-1C7F-40D7-B0FA-6F107F6308B8}] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\Interface\{C815E3DA-0823-49B0-9270-D1771D58B317}] =>Toolbar.Freecorder
                        [HKLM\Software\Wow6432Node\Classes\Interface\{C815E3DA-0823-49B0-9270-D1771D58B317}] =>Toolbar.Freecorder
                        [HKLM\Software\Classes\Interface\{D3BC53E7-0437-4C97-90EE-2CD6FF47FB14}] =>Toolbar.Freecorder
                        [HKLM\Software\Wow6432Node\Classes\Interface\{D3BC53E7-0437-4C97-90EE-2CD6FF47FB14}] =>Toolbar.Freecorder
                        [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110111271167}] =>PUP.CrossRider
                        [HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110111271167}] =>PUP.CrossRider
                        [HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110111271167}] =>PUP.CrossRider
                        C:\Program Files (x86)\Software =>Adware.Boxore
                        C:\Program Files (x86)\SpecialSavings =>PUP.SpecialSavings
                        C:\ProgramData\Babylon =>Toolbar.Babylon
                        C:\ProgramData\IBUpdaterService =>Adware.IncrediBar
                        C:\ProgramData\Software =>Adware.Boxore
                        C:\Users\User\AppData\Roaming\yontoo =>Adware.Yontoo
                        C:\Users\User\AppData\Roaming\Babylon =>Toolbar.Babylon
                        C:\Users\User\AppData\Roaming\DealPly =>PUP.DealPly
                        C:\Users\User\AppData\Roaming\OpenCandy =>Adware.OpenCandy
                        C:\Users\User\AppData\Roaming\SpecialSavings =>PUP.SpecialSavings
                        C:\Users\User\AppData\Roaming\BabSolution =>Hijacker.BabSolution
                        C:\Users\User\AppData\Roaming\Desk 365 =>Hijacker.22find
                        C:\Users\User\AppData\Local\AVG Secure Search =>Toolbar.AVGSearch
                        C:\Users\User\AppData\Local\Duuqu =>Toolbar.Agent
                        C:\Users\User\AppData\Local\lollipop =>Adware.Lollipop
                        C:\Users\User\AppData\Local\Software =>Adware.Boxore
                        C:\Users\User\AppData\Local\Tiger Savings =>PUP.RewardsArcade
                        C:\Users\User\AppData\LocalLow\AVG Secure Search =>Toolbar.AVGSearch
                        C:\Users\User\AppData\Local\Temp\Desk365 =>Hijacker.22find
                        C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\Smartbar =>Hijacker.SmartBar
                        C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\bprotector_extensions.sqlite =>PUP.BProtector
                        C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\bprotector_prefs.js =>PUP.BProtector
                        C:\Users\User\AppData\Local\Temp\uninst1.exe =>Toolbar.Babylon
                        C:\Users\User\AppData\Local\Temp\bundlesweetimsetup.exe =>PUP.SweetIM
                        C:\Users\User\AppData\Local\Temp\MyBabylonTB.exe =>PUP.SweetIM
                        C:\Users\User\AppData\Local\Temp\wajam_install.exe =>Toolbar.Wajam
                        C:\Users\User\AppData\Local\Temp\BI_RunOnce (1).exe =>Adware.MegaSearch
                        C:\Users\User\AppData\Local\Temp\BI_RunOnce.exe =>Adware.MegaSearch
                        ~ Additionnel Scan: 209509 Items scanned in 00mn 14s

                        ---\\ Product Upgrade Codes (O90)
                        O90 - PUC: "4154526C49DD5E54780C9BBC093AC498" . (.View Management Utility.) -- C:\Windows\Installer\{C6254514-DD94-45E5-87C0-B9CB90A34C89}\ARPPRODUCTICON.exe
                        O90 - PUC: "430C7076B6DEA6B42BF169B96360BFED" . (.Lenovo Registration.) -- C:\Windows\Installer\{6707C034-ED6B-4B6A-B21F-969B3606FBDE}\ARPPRODUCTICON.exe
                        O90 - PUC: "4C08D494755337D41A3556EFB4E3DC3C" . (.Lenovo Slim USB Keyboard.) -- C:\Windows\Installer\{494D80C4-3557-4D73-A153-65FE4B3ECDC3}\ARPPRODUCTICON.exe
                        O90 - PUC: "6315CD058E12CB84795EA10D556F0B6B" . (.Create Recovery Media.) -- C:\Program Files (x86)\Lenovo\Factory Recovery\recovburncd.exe,0
                        O90 - PUC: "74846C52009BDA841A46B1F4B9776405" . (.Lenovo System Update.) -- C:\Windows\Installer\{25C64847-B900-48AD-A164-1B4F9B774650}\ARPPRODUCTICON.exe
                        O90 - PUC: "C9335768C821DD4438FBA0D5A6DB2879" . (.Lenovo System Update.) -- C:\Program Files (x86)\Lenovo\System Update\Tvsu.exe
                        O90 - PUC: "E1F3EB3A2742112478538E32B94ED9F9" . (.Burn.Now 4.5.) -- C:\Windows\Installer\{A3BE3F1E-2472-4211-8735-E8239BE49D9F}\ARPPRODUCTICON.exe
                        ~ Update Products: 101 Legitimates Filtered in 00mn 00s

                        ---\\ Random Export Key (O91)
                        [HKCU\Software\e28cd8e269e517] =>Toolbar.Babylon^
                        [HKCU\Software\e28cd8e269e517]:GUID="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}"
                        [HKCU\Software\e28cd8e269e517]:version="2.6.1249.132"
                        [HKLM\Software\Wow6432Node\e28cd8e269e517] =>Toolbar.Babylon^
                        [HKLM\Software\Wow6432Node\e28cd8e269e517]:GUID="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}"
                        [HKLM\Software\Wow6432Node\e28cd8e269e517]:version="2.6.1249.132"
                        ~ Export Key Software: Scanned in 00mn 00s

                        ---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
                        SR - | Auto 18/12/2012 65192 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
                        SS - | Demand 13/03/2013 253656 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
                        SR - | Auto 27/02/2013 4937264 | (AVGIDSAgent) . (.AVG Technologies CZ, s.r.o..) - C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
                        SR - | Auto 19/02/2013 282624 | (avgwd) . (.AVG Technologies CZ, s.r.o..) - C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
                        SS - | Auto 11/06/2012 193616 | (BBSvc) . (.Microsoft Corporation..) - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe
                        SR - | Demand 11/06/2012 240208 | (BBUpdate) . (.Microsoft Corporation..) - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe
                        SR - | Auto 2787280 | (BrowserProtect) . (...) - C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe =>Toolbar.Babylon
                        SS - | Demand 14/12/2012 277616 | (cphs) . (.Intel Corporation.) - C:\Windows\SysWow64\IntelCpHeciSvc.exe
                        SR - | Auto 17/01/2012 169776 | (FastbootService) . (.Lenovo.) - C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe
                        SS - | Demand 15/10/2012 13160 | (GoToAssist) . (.Citrix Online, a division of Citrix Systems.) - C:\Program Files (x86)\Citrix\GoToAssist\759\g2aservice.exe
                        SS - | Auto 25/04/2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
                        SS - | Demand 25/04/2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
                        SR - | Auto 01/02/2012 13592 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
                        SR - | Auto 649984 | (IBUpdaterService) . (...) - C:\ProgramData\IBUpdaterService\ibsvc.exe =>Adware.InstallBrain
                        SR - | Auto 08/12/2011 607456 | (Intel(R) Capability Licensing Service Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\iCLS Client\HeciServer.exe
                        SR - | Auto 28/09/2011 212944 | (jhi_service) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
                        SR - | Auto 09/02/2012 58192 | (LENOVO.CAMMUTE) . (.Lenovo Group Limited.) - C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
                        SR - | Auto 09/02/2012 61264 | (LENOVO.TPKNRSVC) . (.Lenovo Group Limited.) - C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
                        SR - | Auto 22/11/2012 375728 | (LMIGuardianSvc) . (.LogMeIn, Inc..) - C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
                        SR - | Auto 22/11/2012 147888 | (LMIMaint) . (.LogMeIn, Inc..) - C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe
                        SR - | Auto 16/12/2011 277784 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
                        SR - | Auto 08/06/2012 407424 | (LogMeIn) . (.LogMeIn, Inc..) - C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
                        SS - | Demand 10/04/2013 115608 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                        SR - | Auto 22/02/2012 70968 | (Power Manager DBC Service) . (.Lenovo.) - C:\Program Files (x86)\Lenovo\PowerMgr\PWMDBSVC.exe
                        SS - | Demand 22/02/2012 165176 | (PwmEWSvc) . (.Lenovo Group Limited.) - C:\Program Files (x86)\Lenovo\PowerMgr\PWMEWSVC.exe
                        SR - | Auto 137216 | (Sks8821) . (...) - C:\Program Files\Lenovo\Lenovo Slim USB Keyboard\Sks8821.exe
                        SR - | Auto 15/01/2013 216608 | (SPAMfighter Update Service) . (.SPAMfighter ApS.) - C:\Program Files (x86)\Fighters\SPAMfighter\sfus.exe
                        SR - | Auto 12/11/2012 1270376 | (Suite Service) . (.SPAMfighter ApS.) - C:\Program Files (x86)\Fighters\FighterSuiteService.exe
                        SS - | Demand 22376 | (SUService) . (...) - C:\Program Files (x86)\Lenovo\System Update\SUService.exe
                        SR - | Auto 10/01/2008 61440 | (UleadBurningHelper) . (.Ulead Systems, Inc..) - C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
                        SR - | Auto 16/12/2011 363800 | (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
                        SR - | Auto 02/12/2012 81552 | (VIPAppService) . (.Symantec Corporation.) - C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe
                        SS - | Auto 0 | (vToolbarUpdater14.2.0) . (...) - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe =>Toolbar.AVGSearch
                        SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
                        SR - | Auto 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe
                        SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
                        ~ Services: Scanned in 00mn 00s

                        ~ 1281 Legitimates filtered by white list
                        End of the scan (698 lines in 00mn 38s)(0)
                        1. juju666 Contributeur sécurité
                          Bonsoir,

                          Ma page firefox est masquée à l'ouverture par un malveillant.

                          Tu peux en dire plus stp ?
                          La capture de ZHPFix ne nous intéresse pas, si on ne connait pas les problèmes initiaux ...
                          A la limite, tu aurais posté le rapport de ZHPDiag mais là, tu parles dans le vide :)

                          Et tout le monde n'utilise pas ZHPDiag/fix, chacun sa méthode.
                          Donc dis nous en plus stp.
                          C'est par ceci que tu es bloqué ? :


                          A+

                          Discussions similaires

                          Activation de la fonction OTG
                          Cnab

                          1 réponse
                          Comment activer le Bluetooth sur une TV Samsung ?
                          zaraki490

                          110 réponses