Fenêtres Intempestives...
Résolu
Bonjour à la communauté,
Depuis un certain temps, j'ai des fenêtres qui s'ouvrent, lorsque je suis Mozilla....
J'ai lancé une analyse ..résultat au lien ajouté https://pjjoint.malekal.com/files.php?id=ZHPDiag_20130428_d6n1214l12o13
Merci pour celui qui sait décoder de me dire si je dois aller chez le docteur ou pas.
Marc
Depuis un certain temps, j'ai des fenêtres qui s'ouvrent, lorsque je suis Mozilla....
J'ai lancé une analyse ..résultat au lien ajouté https://pjjoint.malekal.com/files.php?id=ZHPDiag_20130428_d6n1214l12o13
Merci pour celui qui sait décoder de me dire si je dois aller chez le docteur ou pas.
Marc
36 réponses
Résumé de la discussion
Des fenêtres publicitaires apparaissent lors de l’usage de Firefox sous Windows Vista, signalant potentiellement une infection ou des barres d’outils indésirables nécessitant un diagnostic technique. Des réponses privilégient la désinstallation de composants problématiques, notamment Bing Bar et Yontoo, et la suppression d’extensions associées via le panneau de configuration, et d'autres logiciels potentiellement indésirables. L’usage d’outils de nettoyage comme AdwCleaner est évoqué, avec un rapport détaillant l’arrêt puis la suppression de services, fichiers et clés de registre affectés par plusieurs suites publicitaires. Ces actions démontrent une purge en profondeur des composants malveillants, mais suggèrent aussi d’effectuer un nouveau scan et de maintenir les navigateurs et extensions à jour pour prévenir de futures redondances.
-
re
pas de soucis
@+
-
OK...vu...ma mémoire, comme celle du PC avait besoin d'un rafraichissement!
Merci pour ton aide et comme d'hab...super efficace cette collaboration en ligne
Merci pour ton support....
@+ -
ben ça a l'air OK..et si tu n'as plus rien à donner en médicament, je te propose de le mettre en résolu...juste en me rappelant comment faire..
-
re
si tu n'as plus de soucis, oui
@+
le taux de radiation est plus élevé au pôle emploi qu'à Tchernobyl -
mais j'avoue plus savoir comment mettre le sujet en résolu ;)
-
Ok fait pour IE et firefox....
je suppose que je peux mettre le sujet en clos? -
re
et si tu as toujours des pubs, tu peux ajouter adblock (pour IE) et adblock plus
pour firefox et chrome dans tes extentions
pour IE
pour firefox
pour chrome
@+
-
Ok 2 MAJ faite, versions beta non réalisées
nettoyage CCleaner OK, avec registre -
re
télécharge update checker (pou mettre tes logiciels a jour)
le lien https://www.commentcamarche.net/telecharger/utilitaires/9771-filehippo-app-manager/
mets ccleaner a jour puis exécute le (nettoyage+registre)
enregistre ce que ccleaner va supprimer (dans registre)et si tu n'as pas de soucis, dans 3-4 jours
tu pourras supprimer la sauvegarde
ps: je ne télécharge pas les versions beta
dis moi quand c'est fait
@+
le taux de radiation est plus élevé au pôle emploi qu'à Tchernobyl -
pas si mal...j'ai encore eu une fenêtre de pub ce matin qui s'est ouverte
de plus a priori..j'ai beaucoup mois de fichier NTUSER.dat que j'avais un peu partout....
niveau lenteur, ça à l'air d'aller...ça a ramé un peu qd je désinstalle (avec pg et fonctionnalité) mais là je pense lié à ts les pgs qu'il peut y avoir -
re
ok, comment va le pc?
@+
-
voici le rapport
# DelFix v10.2 - Rapport créé le 02/05/2013 à 09:49:56
# Mis à jour le 02/04/2013 par Xplode
# Nom d'utilisateur : Marc - FAMILIAL
~ Activation de l'UAC ... OK
~ Suppression des outils de désinfection ...
Supprimé : C:\ZHP
Supprimé : C:\Program Files\ZHPDiag
Supprimé : C:\PhysicalDisk0_MBR.bin
Supprimé : C:\Users\Marc\Desktop\ZHPDiag.txt
Supprimé : C:\Users\Marc\Desktop\ZHPFixReport.txt
Supprimé : C:\Users\Public\Desktop\MBRCheck.lnk
Supprimé : C:\Users\Public\Desktop\ZHPDiag.lnk
Supprimé : C:\Users\Public\Desktop\ZHPFix.lnk
Supprimé : C:\Users\Marc\Downloads\ZHPDiag2(1).exe
Supprimé : C:\Users\Marc\Downloads\ZHPDiag2.exe
Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1
~ Purge de la restauration système ...
Supprimé : RP #1926 [Windows Update | 04/29/2013 15:10:33]
Supprimé : RP #1927 [Point de contrôle planifié | 04/30/2013 05:56:43]
Supprimé : RP #1928 [Point de contrôle planifié | 05/01/2013 07:49:02]
Supprimé : RP #1929 [Removed Bing Bar | 05/02/2013 06:38:18]
Supprimé : RP #1930 [Removed QuickShare | 05/02/2013 06:43:39]
Supprimé : RP #1931 [Removed QuickShare | 05/02/2013 06:44:47]
Supprimé : RP #1932 [Removed QuickShare | 05/02/2013 06:56:01]
Supprimé : RP #1934 [Revo Uninstaller's restore point - QuickShare | 05/02/2013 07:19:40]
Supprimé : RP #1935 [Removed QuickShare | 05/02/2013 07:19:50]
Supprimé : RP #1937 [P | 05/02/2013 07:35:37]
Nouveau point de restauration créé !
########## - EOF - ########## -
re
fais ceci maintenant
télécharge delfix sur ton bureau
le lien http://general-changelog-team.fr/fr/downloads/viewdownload/20-outils-de-xplode/9-delfix
exécute le en tant qu'administrateur (clic droit)
vérifie que ces cases soient cochées:
supprimer les outils de désinfection (case cochée par défault)
réactiver l'UAC
purger la restauration système
clique sur exécuter
le rapport s'affichera sur ton bureau et dans C:\delfix.txt
poste le rapport via 1 copier/coller
@+
-
ci après le rapport http://cjoint.com/?CEcjO2ppBye
-
re
pour ceci Logiciel: QuickShare, essaye avec revouninstaller
le lien https://www.commentcamarche.net/telecharger/utilitaires/19405-revo-uninstaller/
le tuto http://www.6ma.fr/tuto/revo-uninstaller-pour-desinstaller-des-programmes/
ensuite fait le zhpfix
@+
-
Bjr Billmaxime
Toolbar: Bing Bar --> OK désinstallé via programme et fonctionnalité du panneau de configuration
Logiciel: QuickShare --> KO impossible à désinstaller via programme et fonctionnalité du panneau de configuration, je le vois, je lance la désinstallation, il pédale mais ne se passe rien!
C:\program files\emule\emule.exe --> n'existe pas via programme et fonctionnalité du panneau de configuration et n'existe pas non plus sous C:\program files\emule\ , la directory emule pas présente (j'avais déjà du le desinstaller!!)
C:\Program Files\LimeWire\LimeWire.exe --> idem emule
Dois-je continuer comme tu le demande, où y a t'il un loup?? -
salut marco
désinstalle ceci via programme et fonctionnalité du panneau de configuration
Toolbar: Bing Bar
Logiciel: QuickShare
C:\program files\emule\emule.exe
C:\Program Files\LimeWire\LimeWire.exe
ensuite fais ceci
lance zhpfix en tant qu'administrateur (clic droit)
copie tout le texte en gras ci-dessous
clique sur le 2ème bouton en haut a gauche (coller le presse papier)
clic sur GO en bas de page et confirme par oui pour lancer le nettoyage des données
le rapport s'affichera sur ton bureau et dans C:\zhpfix.txt
poste le rapport via ce lien https://www.cjoint.com/
le texte a copier
SysRestore
O4 - GS\Desktop: Corbeille.lnk - Clé orpheline
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} -- Clé orpheline
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\One-Click Tweak.job [498]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Registry Reviver-Marc-Startup.job [376]
[MD5.00000000000000000000000000000000] [APT] [Go for FilesUpdate] (...) -- C:\Program Files\GoforFiles\GFFUpdater.exe (.not file.) [0] =>P2P.GoforFiles
[MD5.00000000000000000000000000000000] [APT] [GoforFilesUpdate] (...) -- C:\Program Files\GoforFiles\GFFUpdater.exe (.not file.) [0] =>P2P.GoforFiles
[MD5.00000000000000000000000000000000] [APT] [NeroLiveEpgUpdate-Familial_Marc] (...) -- C:\Program Files\Nero\Nero 9\Nero Live\NeroLive.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [One-Click Tweak] (...) -- C:\Program Files\Advanced PC Tweaker\OneClick.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [Scheduled Update for Ask Toolbar] (...) -- C:\Program Files\Ask.com\UpdateTask.exe (.not file.) [0] =>Toolbar.Ask
[MD5.00000000000000000000000000000000] [APT] [{33A990E6-882A-41F8-964A-822FF03CDEE5}] (...) -- C:\Users\Marc\Jeux PC\CoD2 lu\instmsiw.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{3AC3AB46-F2F0-4552-927E-45C11999D4C0}] (...) -- C:\Users\Marc\Jeux PC\Call of duty 1\setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{65E859AD-6463-4C65-997F-0C6FF09C2E81}] (...) -- C:\Python24\Removecgkit.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{777A7CF7-F978-4678-A5E5-E91C5EB4650C}] (...) -- C:\Users\Marc\Jeux PC\Call of duty lu\CD1lu\Launch.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{D051BC8C-3A92-43AD-BCBC-F919118686FA}] (...) -- C:\Users\Marc\Jeux PC\Call of duty lu\CD1lu\setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{D5EF717B-4714-4944-A0AA-39355527630A}] (...) -- C:\Users\Marc\Downloads\WCPR_PCDRV_US_1_03_01_0523.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{DEE16D20-A8BC-4356-A9BD-6CB81662B289}] (...) -- C:\Users\Marc\Jeux PC\CoD2 lu\Launch.exe (.not file.) [0]
[HKCU\Software\GoforFiles] =>P2P.GoforFiles
[HKCU\Software\IncrediMail]
[HKCU\Software\SweetIM] =>PUP.SweetIM
[HKLM\Software\GoforFiles] =>P2P.GoforFiles
[HKLM\Software\IncrediMail]
[HKLM\Software\SweetIM] =>PUP.SweetIM
O43 - CFD: 02/09/2012 - 20:19:34 - [1,929] ----D C:\Program Files\~Web Assistant =>Adware.IncrediBar
O43 - CFD: 01/12/2012 - 10:18:14 - [0,025] ----D C:\Users\Marc\AppData\Roaming\GoforFiles =>P2P.GoforFiles
O69 - SBI: SearchScopes [HKCU] ${searchCLSID} - (@ieframe.dll,-12512) - https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {918C22D6-1D53-4071-B81B-8A39889F7F96} - (Ask Search) - http://www.search.ask.com/?o=10148&l=dis
O69 - SBI: SearchScopes [HKCU] {BEFAD34B-ADEB-44F4-9CC5-65910502CC2C} - (Orange) - http://www.orange.fril
O69 - SBI: SearchScopes [HKCU] {DECA3892-BA8F-44b8-A993-A466AD694AE4} - (Yahoo!) - https://fr.search.yahoo.com/
O69 - SBI: SearchScopes [HKCU] {FA54DC4B-9ADB-4D38-A964-283A44032D16} - (Google) - https://www.google.fr/?gws_rd=ssl
O69 - SBI: SearchScopes [HKUS\.DEFAULT] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - () - https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8
O69 - SBI: SearchScopes [HKUS\.DEFAULT] {338E70B8-68F0-4BFD-9733-D344170F8F9B} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKUS\S-1-5-18] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - () - https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8
O69 - SBI: SearchScopes [HKUS\S-1-5-18] {338E70B8-68F0-4BFD-9733-D344170F8F9B} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
[MD5.CE755676AE6D27A1EFEEFB0F3C70A929] [SPRF][17/04/2013] (.Ask.com - AskStub Application.) -- C:\Users\Marc\AppData\Local\Temp\APNStub.exe [358600]
[MD5.B3A840E05F27DC6AE773A5D622BFA994] [SPRF][11/09/2012] (.Ask.com - Offercast - APN Install Manager.) -- C:\Users\Marc\AppData\Local\Temp\AskPIP_FF_.exe [783560]
[MD5.F88C296A9109CF540EEDEF41E8A46E09] [SPRF][12/01/2013] (.Oracle Corporation - Java(TM) Platform SE binary.) -- C:\Users\Marc\AppData\Local\Temp\jre-7u11-windows-i586-iftw.exe [896424]
[MD5.5CC163324A11091C975B686EF4C52C73] [SPRF][16/02/2013] (.Oracle Corporation - Java(TM) Platform SE binary.) -- C:\Users\Marc\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe [897448]
[MD5.A620A735458E04AE0CF471319B6D6E7D] [SPRF][01/03/2013] (.Oracle Corporation - Java(TM) Platform SE binary.) -- C:\Users\Marc\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe [897448]
[MD5.EC3A1A84A0A407FE3985ED6F9A0CC436] [SPRF][27/09/2012] (.Oracle Corporation - Java(TM) Platform SE binary.) -- C:\Users\Marc\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe [895464]
[MD5.689902C468F8645D7F13C81BD9D62B82] [SPRF][03/02/2013] (.Somoto Ltd. - Pas de description.) -- C:\Users\Marc\AppData\Local\Temp\sdpupdater.exe [146784] =>Adware.MegaSearch
[MD5.44632F415D4A299D839945F59FEA2C22] [SPRF][04/04/2013] (.Pas de propriétaire - Linkury.Installer.MsiWrapper.) -- C:\Users\Marc\AppData\Local\Temp\SmartbarExeInstaller.exe [8364312] =>Hijacker.SmartBar
[MD5.067BECAFD5F884CEB2E86F766F965B5D] [SPRF][13/04/2013] (.Web Deals Interactive LLC - Installer.) -- C:\Users\Marc\AppData\Local\Temp\toolbar311346.exe [1418136]
[MD5.35F783E83866CDFD580A06A59C375A61] [SPRF][13/04/2013] (.QuickShare - QuickShare.) -- C:\Users\Marc\AppData\Local\Temp\toolbar324497.exe [7704368] =>PUP.QuickShare
[MD5.2610CFF0E034C4A6B1F8BCCC09565178] [SPRF][13/04/2013] (.http://www.goforfiles.com/ - GoforFiles.) -- C:\Users\Marc\AppData\Local\Temp\uninstall3099209.exe [6438536] =>P2P.GoforFiles
[MD5.20362D635A0DE200A963BD634153312D] [SPRF][13/04/2013] (.http://goforfiles.com/ - GoforFiles Application.) -- C:\Users\Marc\AppData\Local\Temp\uninstall3107477.exe [901712] =>P2P.GoforFiles
[MD5.F3774B861F7C0A9D1DC6DC80092FA851] [SPRF][05/01/2013] (.http://www.goforfiles.com/ - GoforFiles.) -- C:\Users\Marc\AppData\Local\Temp\update196639.exe [11480712] =>P2P.GoforFiles
[MD5.2610CFF0E034C4A6B1F8BCCC09565178] [SPRF][13/04/2013] (.http://www.goforfiles.com/ - GoforFiles.) -- C:\Users\Marc\AppData\Local\Temp\update221583.exe [6438536] =>P2P.GoforFiles
[MD5.E2ECA03C1CB714A2BCE3383313DC8329] [SPRF][09/10/2008] (...) -- C:\Users\Marc\Desktop\MCPR.exe [608344]
O87 - FAEL: "{97605590-C14A-466C-910A-C458B699F488}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe (.not file.) =>PUP.SweetIM
O87 - FAEL: "{40F2DE22-ED91-4811-AE51-001FF451C23C}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe (.not file.) =>PUP.SweetIM
O87 - FAEL: "{FA9C6D09-85C1-4012-B8CE-D8700C0F9AB8}" |In - Private - P6 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.)
O87 - FAEL: "{D9ED07D7-966D-402F-BFD1-4074C7A3BE96}" |In - Private - P17 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.)
O87 - FAEL: "{D7D8AE3C-A898-403C-A812-854E3AEA56BF}" |In - Public - P6 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.)
O87 - FAEL: "{18DC9959-22A4-4636-B478-5E7EC3284ADF}" |In - Public - P17 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.)
O87 - FAEL: "{D8C284B2-6530-4B3D-8586-8EB063FF94A7}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files\GoforFiles\goforfilesdl.exe (.not file.) =>P2P.GoforFiles
O87 - FAEL: "{949E639A-F4B0-4FF0-AD12-BF7F9AEFC114}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files\GoforFiles\goforfilesdl.exe (.not file.) =>P2P.GoforFiles
O87 - FAEL: "{6D2BA48A-E872-460F-9A66-EEAE730F5131}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files\GoforFiles\GoforFiles.exe (.not file.) =>P2P.GoforFiles
O87 - FAEL: "{F795405D-D403-4FF9-AEDA-CF1FED3E5723}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files\GoforFiles\GoforFiles.exe (.not file.) =>P2P.GoforFiles
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}] =>Adware.Bandoo
[HKLM\Software\Classes\Installer\Features\4340C4778499EED41AE496DC3D613EC6] =>PUP.SweetIM
[HKLM\Software\Classes\Installer\Products\4340C4778499EED41AE496DC3D613EC6] =>PUP.SweetIM
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4340C4778499EED41AE496DC3D613EC6] =>PUP.SweetIM
[HKCU\Software\SweetIM] =>PUP.SweetIM
[HKLM\Software\SweetIM] =>PUP.SweetIM
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632] =>PUP.SweetIM
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0] =>PUP.SweetIM
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F754C503375A13344B22388E18DFE87E] =>PUP.SweetIM
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094] =>PUP.SweetIM^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536] =>PUP.SweetIM^
C:\Users\Marc\AppData\Local\Temp\instloffer.exe =>PUP.OfferBox
C:\Users\Marc\AppData\Local\Temp\sdpupdater.exe =>Adware.MegaSearch
SS - | Demand 17/04/2011 69120 | (Boonty Games) . (.BOONTY.) - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
FirewallRAZ
EmptyCLSID
EmptyTemp
EmptyFlash
@+
-
et enfin le 2nd rapport
Rapport de ZHPDiag v2013.4.30.182 par Nicolas Coolman, Update du 30/04/2013
Run by Marc at 01/05/2013 20:31:05
State : Version à jour.
WhiteList : Enable
High Elevated Privileges : OK
UAC : Deactivate by program
---\\ Web Browser
MSIE: Internet Explorer v9.0.8112.16421
MFIE: Mozilla Firefox 20.0.1 (Defaut)
---\\ Windows Product Information
~ Langage: Français
Windows Vista Home Premium Edition, 32-bit Service Pack 2 (Build 6002)
Windows Server License Manager Script : OK
~ Vista, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 6CJ97
Windows License : OK
Windows Automatic Updates : OK
---\\ System Protection
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft Security Client FR-FR Language Pack v2.0.0657.0
---\\ System Optimizer
CCleaner v3.18
---\\ Peer To Peer (P2P)
---\\ Software Update
Adobe Flash Player 11 Plugin
Adobe Reader X
Java 7 Update 21
---\\ System Information
~ Processor: x86 Family 16 Model 2 Stepping 3, AuthenticAMD
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 2813 MB (43% free)
System Restore: Activé (Enable)
System drive C: has 43 GB (30%) free of 143 GB
---\\ Logged in mode
~ Computer Name: FAMILIAL
~ User Name: Marc
~ All Users Names: UpdatusUser, Marc, ASPNET, Administrateur,
~ Unselected Option: None
Logged in as Administrator
---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Users\Marc\AppData\Roaming\
~ %Desktop% : C:\Users\Marc\Desktop\
~ %Favorites% : C:\Users\Marc\Favorites\
~ %LocalAppData% : C:\Users\Marc\AppData\Local\
~ %StartMenu% : C:\Users\Marc\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 43 Go of 143 Go)
D:\ CD-ROM drive (Not Inserted)
E:\ Hard drive, Flash drive, Thumb drive (Free 138 Go of 145 Go)
G:\ CD-ROM drive (Not Inserted)
---\\ Security Center & Tools Informations
~ Security Center: 36 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.D07D4C3038F3578FFCE1C0237F2A1253] - (.Microsoft Corporation - Explorateur Windows.) (.11/04/2009 - 07:27:36.) -- C:\Windows\Explorer.exe [2926592]
[MD5.101BA3EA053480BB5D957EF37C06B5ED] - (.Microsoft Corporation - Application de démarrage de Windows.) (.21/01/2008 - 03:23:42.) -- C:\Windows\System32\Wininit.exe [96768]
[MD5.C5B6468422DB1C8AA36C32CBB0197E5E] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.22/02/2013 - 04:38:00.) -- C:\Windows\System32\wininet.dll [1129472]
[MD5.898E7C06A350D4A1A64A9EA264D55452] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.11/04/2009 - 07:28:13.) -- C:\Windows\System32\Winlogon.exe [314368]
[MD5.3911B972B55FEA0478476B2E777B29FA] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.21/04/2011 - 14:58:27.) -- C:\Windows\system32\Drivers\AFD.sys [273408]
[MD5.1F05B78AB91C9075565A9D8A4B880BC4] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.11/04/2009 - 07:32:26.) -- C:\Windows\system32\Drivers\atapi.sys [19944]
[MD5.7ADD03E75BEB9E6DD102C3081D29840A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.21/01/2008 - 03:23:51.) -- C:\Windows\system32\Drivers\Cdfs.sys [70144]
[MD5.6B4BFFB9BECD728097024276430DB314] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.11/04/2009 - 05:39:17.) -- C:\Windows\system32\Drivers\Cdrom.sys [67072]
[MD5.622C41A07CA7E6DD91770F50D532CB6C] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.14/04/2011 - 15:59:03.) -- C:\Windows\system32\Drivers\DfsC.sys [75264]
[MD5.062452B7FFD68C8C042A6261FE8DFF4A] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.11/04/2009 - 05:42:42.) -- C:\Windows\system32\Drivers\HDAudBus.sys [561152]
[MD5.22D56C8184586B7A1F6FA60BE5F5A2BD] - (.Microsoft Corporation - Pilote de port i8042.) (.21/01/2008 - 03:23:20.) -- C:\Windows\system32\Drivers\i8042prt.sys [54784]
[MD5.8793643A67B42CEC66490B2A0CF92D68] - (.Microsoft Corporation - IP Network Address Translator.) (.21/01/2008 - 03:24:25.) -- C:\Windows\system32\Drivers\IpNat.sys [100864]
[MD5.1E94971C4B446AB2290DEB71D01CF0C2] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.29/04/2011 - 14:24:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [106496]
[MD5.ECD64230A59CBD93C85F1CD1CAB9F3F6] - (.Microsoft Corporation - MBT Transport driver.) (.11/04/2009 - 05:45:37.) -- C:\Windows\system32\Drivers\netBT.sys [185856]
[MD5.2C1121F2B87E9A6B12485DF53CD848C7] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.03/03/2013 - 20:07:52.) -- C:\Windows\system32\Drivers\ntfs.sys [1082232]
[MD5.0FA9B5055484649D63C303FE404E5F4D] - (.Microsoft Corporation - Pilote de port parallèle.) (.02/11/2006 - 09:51:30.) -- C:\Windows\system32\Drivers\Parport.sys [79360]
[MD5.A214ADBAF4CB47DD2728859EF31F26B0] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/01/2008 - 03:24:55.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [76288]
[MD5.FBC0BACD9C3D7F6956853F64A66E252D] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.21/01/2008 - 03:23:01.) -- C:\Windows\system32\Drivers\rdpdr.sys [248832]
[MD5.7B75299A4D201D6A6533603D6914AB04] - (.Microsoft Corporation - SMB Transport driver.) (.11/04/2009 - 05:45:22.) -- C:\Windows\system32\Drivers\smb.sys [66560]
[MD5.76B06EB8A01FC8624D699E7045303E54] - (.Microsoft Corporation - TDI Translation Driver.) (.11/04/2009 - 05:45:56.) -- C:\Windows\system32\Drivers\tdx.sys [72192]
[MD5.786DB5771F05EF300390399F626BF30A] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/08/2012 - 12:47:42.) -- C:\Windows\system32\Drivers\volsnap.sys [224640]
~ Generic Processes: Scanned in 00mn 00s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 2/27
~ Mes musiques (My Musics) : 1/102
~ Mes Videos (My Videos) : 1/12
~ Mes Favoris (My Favorites) : 1/180
~ Mes Documents (My Documents) : 1/236
~ Mon Bureau (My Desktop) : 0/40
~ Menu demarrer (Programs) : 0/92
~ Hidden Files: Scanned in 00mn 00s
---\\ Processus lancés
[MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.3624]
[MD5.8E2A7F1F62467A7DCB8AB2C0642F47CA] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe [152392] [PID.3776]
[MD5.D63797E8E7781EE1500A810CB6194FA6] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816] [PID.3784]
[MD5.0E08C168533B2D2A0ED292B025256E00] - (.TomTom - MyTomTom.) -- C:\Program Files\MyTomTom 3\MyTomTomSA.exe [434168] [PID.3792]
[MD5.88B6D9FD6B47B00BC76ECBD13AD24566] - (.TomTom - System Tray application for TomTom HOME.) -- C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [247728] [PID.3816]
[MD5.BF08674925F151BD4537B89A493E3E0C] - (.Microsoft Corporation - Media Center Tray Applet.) -- C:\Windows\ehome\ehtray.exe [125952] [PID.3856]
[MD5.47C9EF1600EDD9EBD8155EB6B5206B6B] - (.NVIDIA Corporation - NVIDIA Settings.) -- C:\Program Files\NVIDIA Corporation\Display\nvtray.exe [1821984] [PID.4044]
[MD5.0F4195B9B348DE5CF9B822F81704B20E] - (.Microsoft Corporation - Media Center Media Status Aggregator Servic.) -- C:\Windows\ehome\ehmsas.exe [37376] [PID.4072]
[MD5.6F5386A655598F71BAAB2D6B63A69D6A] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe [920472] [PID.1940]
[MD5.2E0B0A051FFAA86E358465BB0880D453] - (.Microsoft Corporation - Windows Update.) -- C:\Windows\system32\wuauclt.exe [53784] [PID.5764]
[MD5.9313678EC46F3A2E89D3F6377350EEB3] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7100928] [PID.1432]
[MD5.6080A176D09435FC8E6E800996656E18] - (.Microsoft Corporation - Console IME.) -- C:\Windows\system32\conime.exe [69120] [PID.5500]
[MD5.E4284FCF99FEA13A7E1836F87AE356F6] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 311.0.) -- C:\Windows\system32\nvvsvc.exe [639776] [PID.1668]
[MD5.5A19667A580B1CE886EAF968B9743F45] - (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [383264] [PID.1148]
[MD5.C1F19D2BACBEE9AB64D9AE69E9859AC0] - (.Microsoft Corporation - Antimalware Service Executable.) -- C:\Program Files\Microsoft Security Client\MsMpEng.exe [20456] [PID.528]
[MD5.862BB4CBC05D80C5B45BE430E5EF872F] - (.Microsoft Corporation - Service de gestion des licences Microsoft.) -- C:\Windows\system32\SLsvc.exe [3408896] [PID.368]
[MD5.8619BE54EC51A74A2C3F82B313AB445E] - (.NVIDIA Corporation - NVIDIA User Experience Driver Component.) -- C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe [873248] [PID.832]
[MD5.ADC420616C501B45D26C0FD3EF1E54E4] - (.ArcSoft Inc. - ArcSoft Connect Service.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152] [PID.2144]
[MD5.517D30057C726C797764BFD70A55D82A] - (.CyberLink - CLMSServer.) -- C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [269448] [PID.2164]
[MD5.3927397AC60D943DAF8808AFFED582B7] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [65192] [PID.2180]
[MD5.4FE5C6D40664AE07BE5105874357D2ED] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [57008] [PID.2220]
[MD5.DB5BEA73EDAF19AC68B2C0FAD0F92B1A] - (.Apple Inc. - Bonjour Service.) -- C:\Program Files\Bonjour\mDNSResponder.exe [390504] [PID.2252]
[MD5.09E6AFFAE6C0E9158BF05C7D08D0107A] - (.NewTech Infosystems, Inc. - NTI Backup Now 5 Agent service..) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [16384] [PID.2296]
[MD5.B7DC2580425225C320CEDA78DE55A3D0] - (.Egis Incorporated - Acer eDataSecurity Management Service.) -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe [500784] [PID.2320]
[MD5.20D3741680AB88269BADCDB161B36705] - (.Pas de propriétaire - Acer Empowering Technology Framework Servic.) -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [24576] [PID.2432]
[MD5.793FF718477345CD5D232C50BED1E452] - (.Hewlett-Packard Company - Pas de description.) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440] [PID.2500]
[MD5.CB76F68BA0D57C5D25B538981B1C611C] - (.NewTech InfoSystems, Inc. - NTI Backup Now 5 BackupSvc Application.) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [50424] [PID.2552]
[MD5.DF1C10A75DF7E50195FC417F88A33227] - (...) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [131072] [PID.2612]
[MD5.C183B7E8C4DD96AF66D7ACE48D2D9B05] - (...) -- C:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe [63040] [PID.2644]
[MD5.C1C132455200AD4704142442C89D0FA4] - (.Pas de propriétaire - RichVideo Module.) -- C:\Program Files\CyberLink\Shared Files\RichVideo.exe [262247] [PID.2680]
[MD5.388AE59FE75F1B959DFA0900923C61BB] - (.Skype Technologies S.A. - Skype C2C Service.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000] [PID.2760]
[MD5.83682F469A3D65E8B6F06C28212318BD] - (.TomTom - Windows Service for TomTom HOME.) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe [92592] [PID.2872]
[MD5.E570ECA850F30EB740C2E9699DF3D2BD] - (.Microsoft Corporation - Microsoft Network Realtime Inspection Servi.) -- C:\Program Files\Microsoft Security Client\NisSrv.exe [295232] [PID.3280]
[MD5.65085456FD9A74D7F1A999520C299ECB] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376] [PID.3596]
[MD5.E0D7732F2D2E24B2DB3F67B6750295B8] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512] [PID.3608]
[MD5.E46B17060D3962A384AE484094614788] - (.Apple Inc. - iPodService Module (32-bit).) -- C:\Program Files\iPod\bin\iPodService.exe [553288] [PID.1832]
[MD5.03E60E0BFA53ED15DC984FA34B44BB0F] - (.NVIDIA Corporation - NVIDIA Settings Update Manager.) -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [1260320] [PID.5992]
~ Processes Running: Scanned in 00mn 00s
---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Marc\AppData\Local\Google\Chrome\User Data\Default\Preferences
~ Google Browser: Scanned in 00mn 00s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\Profiles\3ft93ug0.default\prefs.js
P2 - FPN: [HKLM] [@real.com/nppl3260;version=6.0.12.69] - (...) -- C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (.not file.)
P2 - FPN: [HKLM] [@real.com/nprpjplug;version=6.0.12.69] - (...) -- C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (.not file.)
~ Firefox Browser: 47 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R4 - HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,Enabled = 1
~ IE Browser: 11 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local;*.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\Userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Keys: Scanned in 00mn 00s
---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 20
---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} . (.ArcSoft, Inc. - ArcURLRecord Module.) -- C:\Program Files\ArcSoft\Media Converter for Philips\Internet Video Downloader\ArcURLRecord.dll
~ BHO: 16 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Acer eDataSecurity Management - [HKLM]{5CBE3B7C-1E47-477e-A7DD-396DB0476E29} . (.Egis Incorporated. - Acer eDataSecurity Management Explorer Tool.) -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: Bing Bar - [HKLM]{8dcb7100-df86-4384-8842-8fa844297b3f} . (.Microsoft Corporation. - Extensions du client Bing.) -- C:\Program Files\Microsoft\BingBar\BingExt.dll
~ Toolbar: Scanned in 00mn 00s
---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- C:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKLM\..\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe
O4 - HKLM\..\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- C:\Program Files\QuickTime\QTTask.exe
O4 - HKLM\..\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe
O4 - HKCU\..\Run: [MyTomTomSA.exe] . (.TomTom - MyTomTom.) -- C:\Program Files\MyTomTom 3\MyTomTomSA.exe
O4 - HKCU\..\Run: [TomTomHOME.exe] . (.TomTom - System Tray application for TomTom HOME.) -- C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
O4 - HKCU\..\Run: [MobileDocuments] C:\Program Files\Common Files\Apple\Internet Services\ubd.exe (.not file.)
O4 - HKCU\..\Run: [ehTray.exe] . (.Microsoft Corporation - Media Center Tray Applet.) -- C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] . (.Microsoft Corporation - Application de configuration du service Par.) -- C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] oobefldr.dll
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] oobefldr.dll
O4 - HKUS\S-1-5-21-1598174871-2250478180-2568443352-1003\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-21-1598174871-2250478180-2568443352-1003\..\Run: [WindowsWelcomeCenter] oobefldr.dll
O4 - HKUS\S-1-5-21-1598174871-2250478180-2568443352-1003\..\RunOnce: [RUN] . (.Pas de propriétaire - EmptyForm.) -- C:\Windows\Acer_Normal\run_DT.exe
~ Application: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop: The Rise of Atlantis.lnk . (...) -- C:\Program Files\BoontyGames\The Rise of Atlantis\The Rise of Atlantis.exe
O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Programs: Windows Mail.lnk . (.Microsoft Corporation - Windows Mail.) -- C:\Program Files\Windows Mail\WinMail.exe
O4 - GS\Programs: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe
O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O4 - GS\QuickLaunch: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe
O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SendTo: Format Factory.lnk . (.Free Time - FormatFactory.) -- C:\Program Files\FreeTime\FormatFactory\FormatFactory.exe
O4 - GS\SendTo: Skype.lnk . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe
O4 - GS\Desktop: Audacity.lnk . (...) -- C:\Program Files\Audacity\audacity.exe
O4 - GS\Desktop: AVS Audio Editor.lnk . (.Online Media Technologies Ltd. - AVS Audio Editor.) -- C:\Program Files\AVS4YOU\AVSAudioEditor\AVSAudioEditor.exe
O4 - GS\Desktop: AVS4YOU Software Navigator.lnk . (.Online Media Technologies Ltd. - Pas de description.) -- C:\Program Files\AVS4YOU\AVSSoftwareNavigator\AVS4YOUSoftwareNavigator.exe
O4 - GS\Desktop: CDex.lnk . (.Albert L Faber - CDex CD-Ripper.) -- C:\Program Files\CDex_150\CDex.exe
O4 - GS\Desktop: Corbeille.lnk - Clé orpheline
O4 - GS\Desktop: DVD Shrink 3.2.lnk . (.DVD Shrink - DVD Shrink 3.2.) -- C:\Program Files\DVD Shrink\DVD Shrink 3.2.exe
O4 - GS\Desktop: DVDFab HD Decrypter 4.lnk . (.Fengtao Software Inc. - DVDFab - The ultimate DVD copying/convertin.) -- C:\Program Files\DVDFab HD Decrypter 4\DVDFabHDDecrypter.exe
O4 - GS\Desktop: Format Factory.lnk . (.Free Time - FormatFactory.) -- C:\Program Files\FreeTime\FormatFactory\FormatFactory.exe
O4 - GS\Desktop: Free PDF to Word Doc Converter.lnk . (...) -- C:\Program Files\Free PDF to Word Doc Converter\pdf2word.exe
O4 - GS\Desktop: Microsoft Office Excel 2007.lnk . (...) -- C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
O4 - GS\Desktop: Microsoft Office PowerPoint 2007.lnk . (...) -- C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe
O4 - GS\Desktop: Microsoft Office Word 2007.lnk . (...) -- C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe
O4 - GS\Desktop: Mobipocket Reader.lnk . (...) -- C:\Users\Marc\AppData\Roaming\Microsoft\Installer\{342126E1-173C-4585-BFBE-3EBDD20E3E9E}\_6FEFF9B68218417F98F549.exe
~ Global Startup: Scanned in 00mn 00s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} . (.Microsoft Corporation - Windows Live Messenger Companion core resources.) -- C:\Program Files\Windows Live\Companion\companionres.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} . (.Microsoft Corporation - Windows Live Writer Blog This Extension.) -- C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft Office OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} . (.Microsoft Corporation - Synchronisation des favoris ActiveSync.) -- C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} -- Clé orpheline
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} ((no name)) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} ((no name)) - http://messenger.zone.msn.com/MessengerGamesContent/GameContent/fr/uno1/GAME_UNO1.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} ((no name)) - http://download.eset.com/special/eos-beta/OnlineScanner.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} ((no name)) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} ((no name)) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.4.21.0.cab
~ Objets ActiveX: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D9E239F-8E1F-490E-8A2E-36C9885FFF89}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{0D9E239F-8E1F-490E-8A2E-36C9885FFF89}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{0D9E239F-8E1F-490E-8A2E-36C9885FFF89}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (.Microsoft Corporation - Windows Live Album Download Protocol Handle.) -- C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.dll
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\Windows\System32\browseui.dll
~ STS/SSO: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Acer HomeMedia Connect Service (Acer HomeMedia Connect Service) . (.CyberLink - CLMSServer.) - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: TomTomHOMEService (TomTomHOMEService) . (.TomTom - Windows Service for TomTom HOME.) - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
~ Services: 22 Legitimates Filtered in 00mn 05s
---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\One-Click Tweak.job [498]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Registry Reviver-Marc-Startup.job [376]
[MD5.00000000000000000000000000000000] [APT] [Go for FilesUpdate] (...) -- C:\Program Files\GoforFiles\GFFUpdater.exe (.not file.) [0] =>P2P.GoforFiles
[MD5.00000000000000000000000000000000] [APT] [GoforFilesUpdate] (...) -- C:\Program Files\GoforFiles\GFFUpdater.exe (.not file.) [0] =>P2P.GoforFiles
[MD5.00000000000000000000000000000000] [APT] [NeroLiveEpgUpdate-Familial_Marc] (...) -- C:\Program Files\Nero\Nero 9\Nero Live\NeroLive.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [One-Click Tweak] (...) -- C:\Program Files\Advanced PC Tweaker\OneClick.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [Scheduled Update for Ask Toolbar] (...) -- C:\Program Files\Ask.com\UpdateTask.exe (.not file.) [0] =>Toolbar.Ask
[MD5.00000000000000000000000000000000] [APT] [{33A990E6-882A-41F8-964A-822FF03CDEE5}] (...) -- C:\Users\Marc\Jeux PC\CoD2 lu\instmsiw.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{3AC3AB46-F2F0-4552-927E-45C11999D4C0}] (...) -- C:\Users\Marc\Jeux PC\Call of duty 1\setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{65E859AD-6463-4C65-997F-0C6FF09C2E81}] (...) -- C:\Python24\Removecgkit.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{777A7CF7-F978-4678-A5E5-E91C5EB4650C}] (...) -- C:\Users\Marc\Jeux PC\Call of duty lu\CD1lu\Launch.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{D051BC8C-3A92-43AD-BCBC-F919118686FA}] (...) -- C:\Users\Marc\Jeux PC\Call of duty lu\CD1lu\setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{D1C0854B-FD81-499A-8072-D0671E16E073}] (...) -- C:\Users\Marc\AppData\Local\Temp\Temp1_mc2490MF_win32_v2028102_WHQL_fr.zip\French\SetupAIO.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{D5EF717B-4714-4944-A0AA-39355527630A}] (...) -- C:\Users\Marc\Downloads\WCPR_PCDRV_US_1_03_01_0523.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{DEE16D20-A8BC-4356-A9BD-6CB81662B289}] (...) -- C:\Users\Marc\Jeux PC\CoD2 lu\Launch.exe (.not file.) [0]
~ Scheduled Task: 58 Legitimates Filtered in 00mn 39s
---\\ Logiciels installés (O42)
O42 - Logiciel: QuickShare - (.Linkury Inc..) [HKLM] -- {A35C3D8E-5E46-442E-A7DA-A2D7487D40BC} =>PUP.QuickShare
O42 - Logiciel: eType - (.eType.) [HKCU] -- eType
O42 - Logiciel: magicolor 2490MF - (.KONICA MINOLTA.) [HKLM] -- InstallShield_{FDA65F37-CB0F-488D-9B77-212885C308C6}
O42 - Logiciel: magicolor 2490MF - (.KONICA MINOLTA.) [HKLM] -- {FDA65F37-CB0F-488D-9B77-212885C308C6}
~ Logic: 147 Legitimates Filtered in 00mn 00s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\COOPP]
[HKCU\Software\GoforFiles] =>P2P.GoforFiles
[HKCU\Software\IncrediMail]
[HKCU\Software\Speed-Downloading]
[HKCU\Software\SweetIM] =>PUP.SweetIM
[HKLM\Software\Boonty]
[HKLM\Software\GoforFiles] =>P2P.GoforFiles
[HKLM\Software\IncrediMail]
[HKLM\Software\Speed-Downloading]
[HKLM\Software\SweetIM] =>PUP.SweetIM
~ Key Software: 268 Legitimates Filtered in 00mn 00s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 17/04/2011 - 18:15:39 - [26,037] ----D C:\Program Files\BoontyGames
O43 - CFD: 15/11/2009 - 10:13:51 - [0,025] ----D C:\Program Files\profile
O43 - CFD: 02/09/2012 - 20:19:34 - [1,929] ----D C:\Program Files\~Web Assistant =>Adware.IncrediBar
O43 - CFD: 17/04/2011 - 18:16:22 - [0,066] ----D C:\Program Files\Common Files\BOONTY Shared
O43 - CFD: 18/06/2009 - 19:55:24 - [0,035] ----D C:\Users\Marc\AppData\Roaming\.k3d
O43 - CFD: 01/12/2012 - 10:18:14 - [0,025] ----D C:\Users\Marc\AppData\Roaming\GoforFiles =>P2P.GoforFiles
O43 - CFD: 11/10/2008 - 10:01:55 - [0] --H-D C:\Users\Marc\AppData\Roaming\Planit International
O43 - CFD: 11/10/2008 - 10:01:55 - [0] --H-D C:\Users\Marc\AppData\Local\Planit International
~ 1506 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 1968 Legitimates Filtered in 00mn 21s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.CEAF98D916D2B75B8704BEE7680EE0B5] - 01/05/2013 - 06:28:14 ---A- . (...) -- C:\Windows\System32\agent.log [147]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 01/05/2013 - 06:28:11 ---A- . (...) -- C:\Windows\System32\LogConfigTemp.xml [0]
O44 - LFC:[MD5.CD18E303B47E126EAACDEFAD26B006B2] - 01/05/2013 - 06:26:23 ---A- . (.Pas de propriétaire - Setup/Uninstall.) -- C:\Windows\isRS-000.tmp [712264]
O44 - LFC:[MD5.CA9D5826A58411E0095BA6D41E31FF9B] - 17/04/2013 - 10:29:40 ---A- . (...) -- C:\Windows\System32\jupdate-1.7.0_21-b11.log [4003]
~ Files: 18 Legitimates Filtered in 00mn 01s
---\\ ShareTools MSconfig StartupReg (O53)
O53 - SMSR:HKLM\...\startupreg\PhilipsSongbirdLauncher [Key] . (...) -- C:\Program Files\Philips\Philips Songbird\extensions\philips-autoplay@philips.com\application\PhilipsSongbirdLauncher.exe
~ SMSR Keys: 19 Legitimates Filtered in 00mn 00s
---\\ Microsoft Windows Policies System (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s
---\\ Microsoft Windows Policies Explorer (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "HonorAutoRunSetting"=
O56 - MWPE:[HKLM\...\policies\Explorer] - "HonorAutoRunSetting"=0
~ MWPE Keys: 22 Legitimates Filtered in 00mn 00s
---\\ Liste des Drivers Système (O58)
O58 - SDL:[MD5.04F0FCAC69C7C71A3AC4EB97FAFC8303] - 21/01/2008 - 03:23:21 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [422968]
O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 02/11/2006 - 08:09:42 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029]
~ Drivers: Scanned in 00mn 00s
---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 01/05/2013 - 06:25:00 ---A- C:\Users\Marc\Downloads\mbam-setup-1.75.0.1300.exe [10285040]
O61 - LFC: 28/04/2013 - 10:43:37 ---A- C:\Users\Marc\Downloads\Firefox Setup 20.0.1.exe [21192480]
O61 - LFC: 28/04/2013 - 11:16:38 ---A- C:\Users\Marc\Downloads\ZHPDiag2(1).exe [5611886]
O61 - LFC: 29/04/2013 - 17:24:28 ---A- C:\Users\Marc\Annie\notes hugo.xlsx [16561]
O61 - LFC: 30/04/2013 - 10:16:33 ---A- C:\Users\Marc\Annie\ASS MAT\Bulletin salaire Nourrice -Lilou.xls [93184]
O61 - LFC: 30/04/2013 - 10:22:41 ---A- C:\Users\Marc\Annie\ASS MAT\Bulletin salaire Nourrice -Maxime LE DU.xls [175616]
O61 - LFC: 30/04/2013 - 10:23:59 ---A- C:\Users\Marc\Annie\ASS MAT\Heures mensuelles avec heures reellements effectuées.xlsx [15567]
O61 - LFC: 30/04/2013 - 10:30:01 ---A- C:\Users\Marc\Annie\ASS MAT\Bulletin salaire Nourrice -Lilou - Copie.xls [55808]
O61 - LFC: 30/04/2013 - 11:01:36 ---A- C:\Users\Marc\Annie\Prénom pour Menu.doc [38400]
O61 - LFC: 30/04/2013 - 12:13:05 ---A- C:\Users\Marc\Annie\Liste des invités profession de foi d'hugo.docx [12474]
O61 - LFC: 30/04/2013 - 16:40:56 ---A- C:\Users\Marc\Annie\notes sophie.xlsx [16571]
~ 426 Fichiers temporaires (Temporary files)
~ 26 Fichiers cookies (Cookies files)
~ Files: 260 Legitimates Filtered in 00mn 08s
---\\ Liste des outils de nettoyage (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
~ ADS: Scanned in 00mn 00s
---\\ Liste des services Legacy (O64)
O64 - Services: CurCS - ??\??\???? - Pas de propriétaire (Profos) .(...) - LEGACY_PROFOS
~ Legacy: 223 Legitimates Filtered in 00mn 03s
---\\ Start Menu Internet (O68)
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s
---\\ Search Browser Infection (O69)
O69 - SBI: SearchScopes [HKCU] ${searchCLSID} - (@ieframe.dll,-12512) - https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {918C22D6-1D53-4071-B81B-8A39889F7F96} - (Ask Search) - http://www.search.ask.com/?o=10148&l=dis
O69 - SBI: SearchScopes [HKCU] {BEFAD34B-ADEB-44F4-9CC5-65910502CC2C} - (Orange) - http://www.orange.fril
O69 - SBI: SearchScopes [HKCU] {DECA3892-BA8F-44b8-A993-A466AD694AE4} - (Yahoo!) - https://fr.search.yahoo.com/
O69 - SBI: SearchScopes [HKCU] {FA54DC4B-9ADB-4D38-A964-283A44032D16} - (Google) - https://www.google.fr/?gws_rd=ssl
O69 - SBI: SearchScopes [HKUS\.DEFAULT] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - () - https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8
O69 - SBI: SearchScopes [HKUS\.DEFAULT] {338E70B8-68F0-4BFD-9733-D344170F8F9B} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKUS\S-1-5-18] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - () - https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8
O69 - SBI: SearchScopes [HKUS\S-1-5-18] {338E70B8-68F0-4BFD-9733-D344170F8F9B} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
~ Keys: Scanned in 00mn 00s
---\\ Recherche particuliere à la racine de certains dossiers (O84)
[MD5.1E8DB4E97C0726090CC5878903214B3A] [SPRF][23/10/2012] (...) -- C:\Users\Marc\AppData\Local\d3d9caps.dat [2032]
[MD5.C35F4F191B5A4A8DA65E67AFF00E6C90] [SPRF][03/04/2010] (...) -- C:\Users\Marc\AppData\Local\fusioncache.dat [92]
[MD5.CE755676AE6D27A1EFEEFB0F3C70A929] [SPRF][17/04/2013] (.Ask.com - AskStub Application.) -- C:\Users\Marc\AppData\Local\Temp\APNStub.exe [358600]
[MD5.B3A840E05F27DC6AE773A5D622BFA994] [SPRF][11/09/2012] (.Ask.com - Offercast - APN Install Manager.) -- C:\Users\Marc\AppData\Local\Temp\AskPIP_FF_.exe [783560]
[MD5.A3E6ECC05F3AAC5187DF609CE4CF78BC] [SPRF][05/04/2007] (.Electronic Arts Inc. - Uninstall.) -- C:\Users\Marc\AppData\Local\Temp\eauninstall.exe [356352]
[MD5.F6278B5A16F830885B184D5F72E1B935] [SPRF][28/04/2013] (.Terra Informatica Software, Inc., British C - HTMLayout - embeddable HTML rendering and layout component.) -- C:\Users\Marc\AppData\Local\Temp\htmlayout.dll [947200]
[MD5.C653BB49C6DD00AF2BC6F7ED1E549025] [SPRF][15/03/2013] (...) -- C:\Users\Marc\AppData\Local\Temp\instloffer.exe [195984]
[MD5.630C6E774DBE70850836C0356FC51877] [SPRF][17/03/2013] (...) -- C:\Users\Marc\AppData\Local\Temp\itinstallerp.exe [2869872]
[MD5.F88C296A9109CF540EEDEF41E8A46E09] [SPRF][12/01/2013] (.Oracle Corporation - Java(TM) Platform SE binary.) -- C:\Users\Marc\AppData\Local\Temp\jre-7u11-windows-i586-iftw.exe [896424]
[MD5.5CC163324A11091C975B686EF4C52C73] [SPRF][16/02/2013] (.Oracle Corporation - Java(TM) Platform SE binary.) -- C:\Users\Marc\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe [897448]
[MD5.A620A735458E04AE0CF471319B6D6E7D] [SPRF][01/03/2013] (.Oracle Corporation - Java(TM) Platform SE binary.) -- C:\Users\Marc\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe [897448]
[MD5.6C137D2BEF3CDD43F3AE2FD6705B9FED] [SPRF][05/04/2013] (.Oracle Corporation - Java(TM) Platform SE binary.) -- C:\Users\Marc\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe [904104]
[MD5.EC3A1A84A0A407FE3985ED6F9A0CC436] [SPRF][27/09/2012] (.Oracle Corporation - Java(TM) Platform SE binary.) -- C:\Users\Marc\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe [895464]
[MD5.689902C468F8645D7F13C81BD9D62B82] [SPRF][03/02/2013] (.Somoto Ltd. - Pas de description.) -- C:\Users\Marc\AppData\Local\Temp\sdpupdater.exe [146784] =>Adware.MegaSearch
[MD5.44632F415D4A299D839945F59FEA2C22] [SPRF][04/04/2013] (.Pas de propriétaire - Linkury.Installer.MsiWrapper.) -- C:\Users\Marc\AppData\Local\Temp\SmartbarExeInstaller.exe [8364312] =>Hijacker.SmartBar
[MD5.CF0F79CAF70138DEE8C46D583CE64073] [SPRF][04/04/2007] (.Electronic Arts Inc. - Uninstalls the CD key.) -- C:\Users\Marc\AppData\Local\Temp\The Sims 2 Deluxe_uninst.exe [73728]
[MD5.067BECAFD5F884CEB2E86F766F965B5D] [SPRF][13/04/2013] (.Web Deals Interactive LLC - Installer.) -- C:\Users\Marc\AppData\Local\Temp\toolbar311346.exe [1418136]
[MD5.35F783E83866CDFD580A06A59C375A61] [SPRF][13/04/2013] (.QuickShare - QuickShare.) -- C:\Users\Marc\AppData\Local\Temp\toolbar324497.exe [7704368] =>PUP.QuickShare
[MD5.2610CFF0E034C4A6B1F8BCCC09565178] [SPRF][13/04/2013] (.http://www.goforfiles.com/ - GoforFiles.) -- C:\Users\Marc\AppData\Local\Temp\uninstall3099209.exe [6438536] =>P2P.GoforFiles
[MD5.20362D635A0DE200A963BD634153312D] [SPRF][13/04/2013] (.http://goforfiles.com/ - GoforFiles Application.) -- C:\Users\Marc\AppData\Local\Temp\uninstall3107477.exe [901712] =>P2P.GoforFiles
[MD5.F6278B5A16F830885B184D5F72E1B935] [SPRF][13/04/2013] (.Terra Informatica Software, Inc., British C - HTMLayout - embeddable HTML rendering and layout component.) -- C:\Users\Marc\AppData\Local\Temp\uninstall3107493.exe [947200]
[MD5.F3774B861F7C0A9D1DC6DC80092FA851] [SPRF][05/01/2013] (.http://www.goforfiles.com/ - GoforFiles.) -- C:\Users\Marc\AppData\Local\Temp\update196639.exe [11480712] =>P2P.GoforFiles
[MD5.2610CFF0E034C4A6B1F8BCCC09565178] [SPRF][13/04/2013] (.http://www.goforfiles.com/ - GoforFiles.) -- C:\Users\Marc\AppData\Local\Temp\update221583.exe [6438536] =>P2P.GoforFiles
[MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][09/10/2008] (...) -- C:\Users\Marc\AppData\Roaming\wklnhst.dat [0]
[MD5.250B9F87DDAF7AFC624BB5E61C4BD6E3] [SPRF][26/04/2012] (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Users\Marc\Desktop\mbam-setup-1.61.0.1400.exe [10063000]
[MD5.E2ECA03C1CB714A2BCE3383313DC8329] [SPRF][09/10/2008] (...) -- C:\Users\Marc\Desktop\MCPR.exe [608344]
[MD5.BAE7AEE62DFB727D618BE1ED8935EB79] [SPRF][10/06/2012] (.Pas de propriétaire - The Rise of Atlantis Setup.) -- C:\Users\Marc\Desktop\riseofatlantis.exe [18987308]
[MD5.3FEA9D2EDF23B0283C7A66C8DEA380BD] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player Module.) -- C:\Windows\Downloaded Program Files\dwusplay.dll [24576]
[MD5.CDBE35EA59BC9223E4F800BD1DB82D27] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player.) -- C:\Windows\Downloaded Program Files\dwusplay.exe [196608]
[MD5.80F4A456633F78A26A3C6B16E64EFEC5] [SPRF][28/09/2007] (.Microsoft - Uno Messenger.) -- C:\Windows\Downloaded Program Files\GAME_UNO1.dll [381960]
[MD5.3217F1F7D2F34FFAAE55F53AC3C4920F] [SPRF][16/10/2003] (.InstallShield Software Corporation - InstallShield Update Service Web Agent.) -- C:\Windows\Downloaded Program Files\isusweb.dll [299008]
[MD5.8945CCA5FC4F25168E8B6F401EFAF51F] [SPRF][22/02/2007] (.Microsoft Corporation - Zone.com Stats Client for MSN Messenger.) -- C:\Windows\Downloaded Program Files\MessengerStatsPAClient.dll [304544]
[MD5.1E5CFDF9AEBDD84305A4C8154277A269] [SPRF][28/02/2007] (.Microsoft Corporation - Zone.com Checkers for MSN Messenger.) -- C:\Windows\Downloaded Program Files\msgrchkr.dll [131472]
[MD5.2FD994827193B68DD301F80BDF744231] [SPRF][03/04/2009] (.Husdawg, LLC - System Requirements Lab.) -- C:\Windows\Downloaded Program Files\sysreqlab_nvd.dll [354608]
~ Files: Scanned in 00mn 00s
---\\ Firewall Active Exception List (FirewallRules) (O87)
O87 - FAEL: "TCP Query User{E80F7CE2-6297-4C88-BDF3-631E66E88C8A}C:\program files\emule\emule.exe" |In - Private - P6 - TRUE | .(...) -- C:\program files\emule\emule.exe (.not file.)
O87 - FAEL: "UDP Query User{62330BDE-9274-477A-AC17-0477F9BCFF17}C:\program files\emule\emule.exe" |In - Private - P17 - TRUE | .(...) -- C:\program files\emule\emule.exe (.not file.)
O87 - FAEL: "{DD65C6E8-73DF-4651-89CD-952B228DE2F4}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files\LimeWire\LimeWire.exe (.not file.)
O87 - FAEL: "{C3B1D87C-EF6C-40A9-895B-CABA5E2D0845}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files\LimeWire\LimeWire.exe (.not file.)
O87 - FAEL: "{97605590-C14A-466C-910A-C458B699F488}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe (.not file.) =>PUP.SweetIM
O87 - FAEL: "{40F2DE22-ED91-4811-AE51-001FF451C23C}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe (.not file.) =>PUP.SweetIM
O87 - FAEL: "{FA9C6D09-85C1-4012-B8CE-D8700C0F9AB8}" |In - Private - P6 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.)
O87 - FAEL: "{D9ED07D7-966D-402F-BFD1-4074C7A3BE96}" |In - Private - P17 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.)
O87 - FAEL: "{D7D8AE3C-A898-403C-A812-854E3AEA56BF}" |In - Public - P6 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.)
O87 - FAEL: "{18DC9959-22A4-4636-B478-5E7EC3284ADF}" |In - Public - P17 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.)
O87 - FAEL: "{D8C284B2-6530-4B3D-8586-8EB063FF94A7}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files\GoforFiles\goforfilesdl.exe (.not file.) =>P2P.GoforFiles
O87 - FAEL: "{949E639A-F4B0-4FF0-AD12-BF7F9AEFC114}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files\GoforFiles\goforfilesdl.exe (.not file.) =>P2P.GoforFiles
O87 - FAEL: "{6D2BA48A-E872-460F-9A66-EEAE730F5131}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files\GoforFiles\GoforFiles.exe (.not file.) =>P2P.GoforFiles
O87 - FAEL: "{F795405D-D403-4FF9-AEDA-CF1FED3E5723}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files\GoforFiles\GoforFiles.exe (.not file.) =>P2P.GoforFiles
~ Firewall: 241 Legitimates Filtered in 00mn 00s
---\\ Scan Additionnel (O88)
Database Version : v2.11782 - (30/04/2013)
Clés trouvées (Keys found) : 11
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 3
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}] =>Adware.Bandoo
[HKLM\Software\Classes\Installer\Features\4340C4778499EED41AE496DC3D613EC6] =>PUP.SweetIM
[HKLM\Software\Classes\Installer\Products\4340C4778499EED41AE496DC3D613EC6] =>PUP.SweetIM
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4340C4778499EED41AE496DC3D613EC6] =>PUP.SweetIM
[HKCU\Software\SweetIM] =>PUP.SweetIM
[HKLM\Software\SweetIM] =>PUP.SweetIM
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632] =>PUP.SweetIM
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0] =>PUP.SweetIM
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F754C503375A13344B22388E18DFE87E] =>PUP.SweetIM
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094] =>PUP.SweetIM^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536] =>PUP.SweetIM^
C:\Users\Marc\AppData\Local\Temp\instloffer.exe =>PUP.OfferBox
C:\Users\Marc\AppData\Local\Temp\sdpupdater.exe =>Adware.MegaSearch
~ Additionnel Scan: 366600 Items scanned in 00mn 26s
---\\ Product Upgrade Codes (O90)
O90 - PUC: "4340C4778499EED41AE496DC3D613EC6" . (.Internet Explorer Toolbar 4.6 by SweetPacks.) -- C:\Windows\Installer\{774C0434-9948-4DEE-A14E-69CDD316E36C}\ARPPRODUCTICON.exe =>PUP.SweetIM
O90 - PUC: "E17A8F77515323848B2BF2E1BD2D0E1F" . (.Bing Bar.) -- C:\Windows\Installer\{77F8A71E-3515-4832-B8B2-2F1EDBD2E0F1}\icon_installer_ico
~ Update Products: 113 Legitimates Filtered in 00mn 00s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 18/03/2010 113152 | (ACDaemon) . (.ArcSoft Inc..) - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
SR - | Auto 25/01/2008 269448 | (Acer HomeMedia Connect Service) . (.CyberLink.) - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
SR - | Auto 18/12/2012 65192 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 28/04/2013 256904 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 21/12/2012 57008 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SS - | Demand 28/02/2011 183560 | (BBSvc) . (.Microsoft Corporation..) - C:\Program Files\Microsoft\BingBar\BBSvc.exe
SR - | Auto 30/08/2011 390504 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SS - | Demand 17/04/2011 69120 | (Boonty Games) . (.BOONTY.) - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
SR - | Auto 03/03/2008 16384 | (BUNAgentSvc) . (.NewTech Infosystems, Inc..) - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
SR - | Auto 04/03/2008 500784 | (eDataSecurity Service) . (.Egis Incorporated.) - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
SR - | Auto 24576 | (ETService) . (...) - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
SS - | Auto 16/04/2010 136176 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 16/04/2010 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 14/11/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
SR - | Demand 20/02/2013 553288 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SR - | Auto 17/01/2007 61440 | (LightScribeService) . (.Hewlett-Packard Company.) - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
SS - | Demand 11/04/2013 115608 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
SR - | Auto 06/04/2008 50424 | (NTIBackupSvc) . (.NewTech InfoSystems, Inc..) - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
SR - | Auto 131072 | (NTISchedulerSvc) . (...) - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
SR - | Auto 18/01/2013 639776 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe
SR - | Auto 25/02/2013 1260320 | (nvUpdatusService) . (.NVIDIA Corporation.) - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
SR - | Auto 63040 | (PnkBstrA) . (...) - C:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe
SR - | Auto 262247 | (RichVideo) . (...) - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
SR - | Auto 25/02/2011 249648 | (SeaPort) . (.Microsoft Corporation.) - C:\Program Files\Microsoft\BingBar\SeaPort.exe
SR - | Auto 02/10/2012 3064000 | (Skype C2C Service) . (.Skype Technologies S.A..) - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
SS - | Auto 01/03/2013 161384 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe
SR - | Auto 18/01/2013 383264 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
SR - | Auto 20/04/2012 92592 | (TomTomHOMEService) . (.TomTom.) - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
SS - | Auto 21/01/2008 21504 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 21/01/2008 21504 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 00s
---\\ Recherche Master Boot Record Infection (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by Marc at 01/05/2013 20:34:25
device: opened successfully
user: MBR read successfully
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x85BE01F8]<<
1 ntkrnlpa!IofCallDriver[0x82890926] >> \Device\Harddisk0\DR0[0x86909620]
\Driver\nvstor32[0x85C94188] >> IRP_MJ_CREATE >> 0x85BE01F8
kernel: MBR read successfully
detected disk devices:
detected hooks:
\Driver\atapi >> 0x85bdf1f8
user & kernel MBR OK
Warning: possible MBR rootkit infection !
~ MBR: 36 Legitimates Filtered in 00mn 02s
---\\ Recherche Master Boot Record Infection (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Marc at 01/05/2013 20:34:27
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 04s
~ 3602 Legitimates filtered by white list
End of the scan (622 lines in 03mn 21s)(0) -
re...
voila le premier rapport :
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Version de la base de données: v2013.05.01.01
Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Marc :: FAMILIAL [administrateur]
01/05/2013 07:55:28
mbam-log-2013-05-01 (07-55-28).txt
Type d'examen: Examen complet (C:\|D:\|E:\|)
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 389007
Temps écoulé: 1 heure(s), 19 minute(s), 7 seconde(s)
Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)
Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)
Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)
Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)
Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)
Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)
Fichier(s) détecté(s): 0
(Aucun élément nuisible détecté)
(fin) -
salut
fais ceci s'il te plaît
télécharge MBAM sur ton bureau
le lien https://www.malwarebytes.com/ (prend le free)
le tuto https://www.donnemoilinfo.com/tuto/Malwarebytes-Anti-Malware/
exécute le en tant qu'administrateur (clic droit)
met le a jour (3ème bouton)
fais 1 scan complet (tous les disques)
le scan peut durer +-2H (laisse le bosser)
si MBAM trouve quelque chose supprime la sélection (voir tuto 2ème page)
poste le rapport via 1 copier/coller
le rapport s'affichera sur ton bureau et dans rapport/log de MBAM
---------------------------------------------------------------------------------------
ensuite, refais 1 zhpdiag et poste le rapport
lance zhpdiag et mets le a jour (clique sur la flèche verte, 2ème bouton en haut a
droite-update) puis tu lance le scan (1er bouton en haut a gauche)
@+
- 1
- 2
Suivant
