Quarantaine sur malwarebytes

Merci beaucoup pour tout.

Re

Je te propose donc de mettre ce sujet en résolu

@+

# DelFix v10.6 - Rapport créé le 07/01/2014 à 21:42:05
# Mis à jour le 11/11/2013 par Xplode
# Nom d'utilisateur : PC 1 - PC1-PC
# Système d'exploitation : Windows 7 Professional Service Pack 1 (32 bits)

~ Suppression des outils de désinfection ...

########## - EOF - ##########

Re

Une fois cela fait.

je te propose de nettoyer et finaliser

Télécharge DelFix de Xplode

Lance le.
Tu as 5 choix :

Réactiver l'UAC
Supprimer les outils de désinfection (cocher par défaut)
Effectuer une sauvegarde du registre
Purger la restauration de système
Réinitialisation des paramètres usine

Tu coches ceux qui sont en gras
et tu exécutes
Le rapport se trouve ici généralement
C:\DelFix.txt

Le reste de la sécurité : http://forum.malekal.com/comment-securiser-son-ordinateur.html

@+

Merci beaucoup je ne suis pas forte en informatique comme vous

Re

Tu installes ceux ci.
Java
Adobe flash player

@+

Excusez moi pour le dérangement

Désolé j'arrive pas

Re

je ne veux pas savoir.
A toi de faire de faire ces différentes MaJ

@+

Resource Hacker(TM) - Version 3.5.2

19 November 2009.
Copyright 1999-2009 Angus Johnson

http://www.angusj.com/resourcehacker/

FREEWARE utility to view, modify, add, rename
and delete resources in Windows executables and
resource files. Incorporates an internal
resource compiler and decompiler. Works on
Win9x, WinNT, Win2000 and WinXP, Vista & Win7.

----------------------------------------------
Summary:
----------------------------------------------

Resource Hacker(TM) has been designed to:

1. View resources in Win32 executable files
(*.exe, *.dll, *.cpl, *.ocx) and in Win32
resource files (*.res) in both their compiled
and decompiled formats.

2. Extract (save) resources to file in:
*.res format; as a binary; or as decompiled
resource scripts or images.
Icons, bitmaps, cursors, menus, dialogs,
string tables, message tables, accelerators,
Borland forms and version info resources can
be fully decompiled into their respective
formats, whether as image files or *.rc text
files.

3. Modify (rename or replace) resources in
executables. Image resources (icons, cursors
and bitmaps) can be replaced with an image from
a corresponding image file (*.ico, *.cur, *.bmp),
a *.res file or even another *.exe file.
Dialogs, menus, stringtables, accelerators and
messagetable resource scripts (and also Borland
forms) can be edited and recompiled using the
internal resource script editor.
Resources can also be replaced with resources
from a *.res file as long as the replacement
resource is of the same type and has the same
name.

4. Add new resources to executables.
Enable a program to support multiple languages,
or add a custom icon or bitmap (company logo
etc) to a program's dialog.

5. Delete resources.
Most compilers add resources into applications
which are never used by the application.
Removing these unused resources can reduce an
application's size.

----------------------------------------------
Note regarding WinXP - Win7 and Visual Styles:
----------------------------------------------

* Adding a manifest resource to Resource Hacker(TM)
will cause intermittent problems when viewing
or editing dialogs - so I don't recommend it :)

----------------------------------------------
Known limitations:
----------------------------------------------

1. Resource Hacker(TM) will not read 16bit executables.

2. Resource Hacker(TM) is currently compiled with
Delphi 3.02. When decompiling and recompiling
Borland's Delphi forms in applications compiled
with later version of Delphi, there may be errors
in the recompiled forms if frames have been used
to create the form. This error is due to the DFM
keyword 'inline' not being recognized. While
decompiling, the 'inline' keyword will be replaced
by 'object' and, if manually corrected before
recompiling, 'inline' will be rejected by the
Resource Hacker(TM) compiler.

3. To reduce the size of application files, some
applications are "packed" or "compressed" using
an EXE compressor after they have been compiled.
This has a side-effect of making it more difficult
to view and modify resources. When a "compressed"
executable is viewed with Resource Hacker(TM), only
resource types and names will be visible but not
the actual resources.

----------------------------------------------
Licence Agreement:
----------------------------------------------

This Resource Hacker(TM) software is released as
freeware provided that you agree to the
following terms and conditions:

1. This software is not to be distributed via
any website domain or any other media without
the prior written approval of the copyright owner.

2. This software is not to be used in any way to
illegally modify software.

DISCLAIMER: A user of this Resource Hacker(TM)
software acknowledges that he or she is
receiving this software on an "as is" basis
and the user is not relying on the accuracy
or functionality of the software for any purpose.
The user further acknowledges that any use of
this software will be at the user's own risk
and the copyright owner accepts no responsibility
whatsoever arising from the use or application of
the software.

Re

La première ligne comme mentionné sur ce screen (les mises à jour sont à faire)
https://www.flexera.com/products/operations/software-vulnerability-research/secunia-research.html

@+

--------Contributeur Sécurité---------
On a tous été un jour débutant dans quelque chose.
Mais le savoir est la récompense de l'assiduité.

Re
oui j'ai installé secunia pour les mises à jours j'ai 7 programmes qui nécessitent une mise à jour mais je ne sais comment ça marche

Re

Pour vérifier les mises à jour logiciels à appliquer sur ton PC
https://www.flexera.com/products/operations/software-vulnerability-management.html
Onglet Personal Software Inspector (PSI)
Laisse toi guider

@+

t de ZHPFix 2013.12.14.5 par Nicolas Coolman, Update du 06/12/2013
Fichier d'export Registre :
Run by PC 1 at 07/01/2014 18:40:10
High Elevated Privileges : OK
Windows Vista Business Edition, 32-bit (Build 6000)

Corbeille vidée (00mn 03s)
Réparation des raccourcis navigateur

========== Logiciels ==========
ABSENT Uninstall Process: c:\program files\yahoo!\common\unyt_wrap.exe

========== Processus mémoire ==========
SUPPRIMÉ: Memory Process: C:\Users\PC 1\AppData\Local\Updater4479\Updater4479.exe
SUPPRIMÉ: Memory Process: C:\Users\PC 1\AppData\Local\Temp\Quarantine.exe
SUPPRIMÉ Redémarrage: Memory Process: C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
SUPPRIMÉ: Memory Process: C:\Users\PC 1\AppData\Local\Temp\nsk3D91.exe
SUPPRIMÉ: Memory Process: C:\Users\PC 1\AppData\Local\Temp\nsk5EC9.exe
SUPPRIMÉ: Memory Process: C:\Users\PC 1\AppData\Local\Temp\nsk6224.exe
SUPPRIMÉ: Memory Process: C:\Users\PC 1\AppData\Local\Temp\nsp391D.exe
SUPPRIMÉ: Memory Process: C:\Users\PC 1\AppData\Local\Temp\nsv4179.exe
SUPPRIMÉ: Memory Process: C:\Users\PC 1\AppData\Local\Temp\nsv66A8.exe
SUPPRIMÉ: Memory Process: C:\Users\PC 1\AppData\Local\Temp\nsy8A1A.exe

========== Clés du Registre ==========
SUPPRIMÉ Logiciel Key: [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion]
SUPPRIMÉ: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011441179}
SUPPRIMÉ: [HKLM\SOFTWARE\Classes\CLSID\{41564952-412D-5637-00A7-7A786E7484D7}]
SUPPRIMÉ: Service: APNMCP
SUPPRIMÉ: HKCU\Software\AskPartnerNetwork
SUPPRIMÉ: HKLM\Software\AskPartnerNetwork
SUPPRIMÉ: SearchScopes :{1D172C84-435A-4CAB-96E7-62E44F4E50A6}
SUPPRIMÉ: SearchScopes :{DA1CA122-4536-48F5-B9F2-690F08726FAA}
SUPPRIMÉ: [HKLM\Software\Classes\Installer\Products\\25946514D2147365007A7A857BC0A000]
SUPPRIMÉ: [HKLM\Software\Classes\Installer\Features\25946514D2147365007A7A857BC0A000]
SUPPRIMÉ: HKLM\Software\Google\Chrome\Extensions\aaaaacalgebmfelllfiaoknifldpngjh
SUPPRIMÉ: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

========== Valeurs du Registre ==========
SUPPRIMÉ [HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks]:{00000000-6E41-4FD3-8538-502F5495E5FC}
SUPPRIMÉ: Toolbar: {41564952-412D-5637-00A7-7A786E7484D7}
SUPPRIMÉ RunValue: ApnTBMon
Aucune Valeur Standard Profile: FirewallRaz :
Aucune Valeur Domain Profile: FirewallRaz :

========== Eléments de donnée du Registre ==========
REMPLACÉ Value Start_ShowSetProgramAccessAndDefaults : Good (1) - Bad (0)

========== Préférences navigateur ==========
SUPPRIMÉ Folder Chrome: C:\Users\PC 1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaacalgebmfelllfiaoknifldpngjh

========== Dossiers ==========
Aucun dossiers CLSID Local utilisateur vide

========== Fichiers ==========
SUPPRIMÉ: c:\users\pc 1\appdata\roaming\microsoft\windows\start menu\programs\google.lnk (http://www.google.fr)
SUPPRIMÉ: c:\users\pc 1\appdata\local\google\chrome\user data\default\preferences
SUPPRIMÉ: c:\program files\askpartnernetwork\toolbar\updater\tbnotifier.exe
SUPPRIMÉ Redémarrage: c:\program files\askpartnernetwork\toolbar\apnmcp.exe
SUPPRIMÉ: C:\Windows\Installer\3fcc98d.msi
SUPPRIMÉS Temporaires Windows (48) (4 127 715 octets)

========== Tache planifiée ==========
SUPPRIMÉ: Updater4479.exe
SUPPRIMÉ: {0292304B-65B0-41FA-929B-159A79618E4F}

========== Récapitulatif ==========
10 : Processus mémoire
12 : Clés du Registre
5 : Valeurs du Registre
1 : Eléments de donnée du Registre
1 : Dossiers
6 : Fichiers
1 : Logiciels
1 : Préférences navigateur
2 : Tache planifiée

End of clean in 00mn 42s

========== Chemin de fichier rapport ==========
C:\Users\PC 1\AppData\Roaming\ZHP\ZHPFix[R1].txt - 07/01/2014 18:40:14 [3822]

Re

1) Désinstalle McAfee Security Scan Plus

2)Utilisation de l'outil ZHPFix :

* Copie tout le texte présent dans l'encadré ci-dessous (tu le sélectionnes avec ta souris / Clique droit dessus et choisis "copier" ou fait Ctrl+C )

Script ZHPFix
ShortcutFix
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSetProgramAccessAndDefaults: Modified
O4 - GS\Program [PC 1]: Google.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe https://www.google.fr/?gws_rd=ssl
[MD5.96261D590C12F5D47DA973AE882C58F0] [APT] [Updater4479.exe] (.FileProperties_CompanyName.) -- C:\Users\PC 1\AppData\Local\Updater4479\Updater4479.exe [206336]
[MD5.00000000000000000000000000000000] [APT] [{0292304B-65B0-41FA-929B-159A79618E4F}] (...) -- C:\Program Files\Free YouTube Downloader Converter\UNWISE.exe (.not file.) [0]
O43 - CFD: 20/01/2013 - 17:06:16 - [0,197] ----D C:\Users\PC 1\AppData\Local\Updater4479
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011441179}]
[HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks]:{00000000-6E41-4FD3-8538-502F5495E5FC}
C:\Users\PC 1\AppData\Local\Updater4479
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSetProgramAccessAndDefaults: Modified
C:\Users\PC 1\AppData\Local\Updater4479\Updater4479.exe
[MD5.F0A5B44B9B8A23E2F2950B346B5C7718] [SPRF][23/12/2013] (...) -- C:\Users\PC 1\AppData\Local\Temp\Quarantine.exe [360051]
[MD5.33BE35574E1081A91EACD2B98E0A472A] - (.APN - Ask Toolbar Notifier.) -- C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1778640] [PID.2636]
G2 - GCE: Preference [User Data\Default] [aaaaacalgebmfelllfiaoknifldpngjh] Avira SearchFree Toolbar plus Web Protection v.30.2, (Désactivé)
O3 - Toolbar: Avira SearchFree Toolbar - [HKLM]{41564952-412D-5637-00A7-7A786E7484D7} . (.APN LLC. - Passport.) -- C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll
O4 - HKLM\..\Run: [ApnTBMon] . (.APN - Ask Toolbar Notifier.) -- C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
O23 - Service: Service de mise à jour Ask (APNMCP) . (.APN LLC. - APN Updater.) - C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
O42 - Logiciel: Yahoo! Toolbar - (...) [HKLM] -- Yahoo! Companion
[HKCU\Software\AskPartnerNetwork]
[HKLM\Software\AskPartnerNetwork]
O43 - CFD: 30/08/2013 - 09:09:28 - [13,482] ----D C:\Program Files\AskPartnerNetwork
O43 - CFD: 30/08/2013 - 09:09:11 - [0] ----D C:\ProgramData\APN
O43 - CFD: 30/08/2013 - 09:09:28 - [2,503] ----D C:\ProgramData\AskPartnerNetwork
O43 - CFD: 20/12/2012 - 19:25:16 - [23,535] -SH-D C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
O43 - CFD: 18/03/2013 - 14:30:03 - [0,184] ----D C:\Users\PC 1\AppData\Local\APN
O69 - SBI: SearchScopes [HKCU] {1D172C84-435A-4CAB-96E7-62E44F4E50A6} - (Ask Search) - http://www.search.ask.com/?o=10148&l=dis
O69 - SBI: SearchScopes [HKCU] {DA1CA122-4536-48F5-B9F2-690F08726FAA} - (DVDVideoSoftTB Customized Web Search) - http://search.conduit.com
[MD5.C67BCF6441E378371F0D6EEFB7EF0861] [SPRF][07/01/2014] (.Conduit - SP Usage Sender.) -- C:\Users\PC 1\AppData\Local\Temp\nsk3D91.exe [167812]
[MD5.C67BCF6441E378371F0D6EEFB7EF0861] [SPRF][07/01/2014] (.Conduit - SP Usage Sender.) -- C:\Users\PC 1\AppData\Local\Temp\nsk5EC9.exe [167812]
[MD5.C67BCF6441E378371F0D6EEFB7EF0861] [SPRF][07/01/2014] (.Conduit - SP Usage Sender.) -- C:\Users\PC 1\AppData\Local\Temp\nsk6224.exe [167812]
[MD5.C67BCF6441E378371F0D6EEFB7EF0861] [SPRF][07/01/2014] (.Conduit - SP Usage Sender.) -- C:\Users\PC 1\AppData\Local\Temp\nsp391D.exe [167812]
[MD5.C67BCF6441E378371F0D6EEFB7EF0861] [SPRF][07/01/2014] (.Conduit - SP Usage Sender.) -- C:\Users\PC 1\AppData\Local\Temp\nsv4179.exe [167812]
[MD5.C67BCF6441E378371F0D6EEFB7EF0861] [SPRF][07/01/2014] (.Conduit - SP Usage Sender.) -- C:\Users\PC 1\AppData\Local\Temp\nsv66A8.exe [167812]
[MD5.C67BCF6441E378371F0D6EEFB7EF0861] [SPRF][07/01/2014] (.Conduit - SP Usage Sender.) -- C:\Users\PC 1\AppData\Local\Temp\nsy8A1A.exe [167812]
O90 - PUC: "25946514D2147365007A7A857BC0A000" . (.Avira SearchFree Toolbar.) -- C:\Windows\Installer\{41564952-412D-5637-00A7-A758B70C0A00}\ToolbarIcon.exe
[MD5.CB226C5E01130B811167885B3D4FE577] [WIS][20/12/2013] (.APN, LLC - Avira SearchFree Toolbar.) -- C:\Windows\Installer\3fcc98d.msi [813568]
SR - | Auto 20/12/2013 166352 | (APNMCP) . (.APN LLC..) - C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
[HKLM\Software\Google\Chrome\Extensions\aaaaacalgebmfelllfiaoknifldpngjh]
[HKLM\SYSTEM\CurrentControlSet\Services\APNMCP]
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion]
[HKCU\Software\AskPartnerNetwork]
[HKLM\Software\AskPartnerNetwork]
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{41564952-412D-5637-00A7-7A786E7484D7}
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:ApnTBMon
C:\Users\PC 1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaacalgebmfelllfiaoknifldpngjh
C:\Program Files\AskPartnerNetwork
C:\ProgramData\AskPartnerNetwork
C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
C:\Users\PC 1\AppData\Local\Temp\nsk3D91.exe
C:\Users\PC 1\AppData\Local\Temp\nsk5EC9.exe
C:\Users\PC 1\AppData\Local\Temp\nsk6224.exe
C:\Users\PC 1\AppData\Local\Temp\nsp391D.exe
C:\Users\PC 1\AppData\Local\Temp\nsv4179.exe
C:\Users\PC 1\AppData\Local\Temp\nsv66A8.exe
C:\Users\PC 1\AppData\Local\Temp\nsy8A1A.exe
C:\Windows\Installer\3fcc98d.msi

FirewallRAZ
Emptytemp
EmptyCLSID

--------------------------------------------------------------------------------------------
Lance ZHPFix à partir du raccourci sur ton Bureau (si tu es sous Windows Vista ou Windows 7 ou 8, fais le par un clic-droit --> Exécuter en tant qu'administrateur)

Cliquer sur le bouton Importer. Le contenu du Presse-papier vient se coller dans la zone de saisie de ZHPFix

NB (W8) : Dans certains cas le script se colle automatiquement dans la zone de script et ne nécessite pas de cliquer sur le bouton "IMPORTER".

* Clique sur le bouton GO pour lancer le nettoyage.

-> laisse travailler l'outil et ne touche à rien ...
-> S'il t'est demandé de redémarrer le PC pour finir le nettoyage, fais le !

Une fois terminé, un nouveau rapport s'affiche : poste le contenu de ce dernier dans ta prochaine réponse ...
Ce rapport est copié sur le bureau

( ce rapport est en outre sauvegardé dans ce dossier :
- Pour XP : C:\Documents and Settings\username\Local Settings\Application Data\ZHP
- Depuis Vista : C:\Users\username\AppData\Roaming\ZHP\ZHPFix [R1].txt)

@+

https://pjjoint.malekal.com/files.php?id=ZHPDiag_20140107_e14x15c15l7f6

---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.16476
GCIE: Google Chrome v31.0.1650.63 (Defaut)

---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Professional, 32-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK

---\\ Logiciels de protection du système
Avira Free Antivirus v14.0.2.286
Malwarebytes Anti-Malware version 1.75.0.1300
McAfee Security Scan Plus v3.8.130.10
Windows Defender W7

---\\ Logiciels d'optimisation du système
CCleaner v4.00 =>Piriform Ltd

---\\ Logiciels de partage PeerToPeer
µTorrent v3.3.0.29625 =>P2P.µTorrent

---\\ Surveillance de Logiciels
Adobe Flash Player 10.0.42.34
Adobe Reader XI

---\\ Informations sur le système
~ Processor: x86 Family 6 Model 37 Stepping 2, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 2997 MB (52% free)
System Restore: Activé (Enable)
System drive C: has 200 GB (67%) free of 298 GB

---\\ Mode de connexion au système
~ Computer Name: PC1-PC
~ User Name: PC 1
~ All Users Names: PC 1, Administrateur,
~ Unselected Option: None
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\PC 1\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\PC 1\AppData\Roaming\
~ %Desktop% : C:\Users\PC 1\Desktop\
~ %Favorites% : C:\Users\PC 1\Favorites\
~ %LocalAppData% : C:\Users\PC 1\AppData\Local\
~ %StartMenu% : C:\Users\PC 1\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 200 Go of 298 Go)
D: CD-ROM drive (Not Inserted)

---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Security Center] UacDisableNotify: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowMyGames: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowPrinters: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSetProgramAccessAndDefaults: Modified =>PUA.StartShow
~ Security Center: 46 Legitimates Filtered in 00mn 00s

---\\ Recherche particulière de fichiers génériques
[MD5.8B88EBBB05A0E56B7DCC708498C02B3E] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 06:30:54.) -- C:\Windows\Explorer.exe [2616320]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:14:45.) -- C:\Windows\System32\Wininit.exe [96256]
[MD5.927FA6456AD6D7630F6854828D2FD16B] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.26/11/2013 - 07:33:33.) -- C:\Windows\System32\wininet.dll [1820160]
[MD5.6D13E1406F50C66E2A95D97F22C47560] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.20/11/2010 - 13:17:54.) -- C:\Windows\System32\Winlogon.exe [286720]
[MD5.E3AE23569749DE12D45BA3B489A036AE] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 13:21:24.) -- C:\Windows\System32\sppcomapi.dll [193536]
[MD5.F81BB7E487EDCEAB630A7EE66CF23913] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.14/09/2013 - 01:48:58.) -- C:\Windows\system32\Drivers\AFD.sys [338944]
[MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:26:15.) -- C:\Windows\system32\Drivers\atapi.sys [21584]
[MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:11:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656]
[MD5.BE167ED0FDB9C1FA1133953C18D5A6C9] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 09:38:10.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544]
[MD5.F024449C97EC1E464AAFFDA18593DB88] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 09:42:32.) -- C:\Windows\system32\Drivers\DfsC.sys [78336]
[MD5.9036377B8A6C15DC2EEC53E489D159B5] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 10:59:29.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544]
[MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:11:24.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896]
[MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 00:54:29.) -- C:\Windows\system32\Drivers\IpNat.sys [101888]
[MD5.5D16C921E3671636C0EBA3BBAAC5FD25] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:17:22.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123904]
[MD5.280122DDCF04B378EDD1AD54D71C1E54] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 09:39:44.) -- C:\Windows\system32\Drivers\netBT.sys [187904]
[MD5.5E43D2B0EE64123D4880DFA6626DEFDE] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 14:45:29.) -- C:\Windows\system32\Drivers\ntfs.sys [1211752]
[MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 00:45:35.) -- C:\Windows\system32\Drivers\Parport.sys [79360]
[MD5.D9F91EAFEC2815365CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.14/07/2009 - 00:54:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848]
[MD5.B973FCFC50DC1434E1970A146F7E3885] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.20/11/2010 - 11:24:46.) -- C:\Windows\system32\Drivers\rdpdr.sys [133632]
[MD5.3E21C083B8A01CB70BA1F09303010FCE] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 00:53:41.) -- C:\Windows\system32\Drivers\smb.sys [71168]
[MD5.B459575348C20E8121D6039DA063C704] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 09:39:17.) -- C:\Windows\system32\Drivers\tdx.sys [74752]
[MD5.F497F67932C6FA693D7DE2780631CFE7] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 13:30:16.) -- C:\Windows\system32\Drivers\volsnap.sys [245632]
~ Generic Processes: Scanned in 00mn 00s

---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/4902
~ Mes musiques (My Musics) : 3/899
~ Mes Videos (My Videos) : 1/2
~ Mes Favoris (My Favorites) : 1/11
~ Mes Documents (My Documents) : 2/16
~ Mon Bureau (My Desktop) : 1/16046
~ Menu demarrer (Programs) : 1/29
~ Hidden Files: Scanned in 00mn 21s

---\\ Processus lancés
[MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.2168]
[MD5.2858B3385DC8891F6A5C33E0A94371C6] - (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2274600] [PID.2572]
[MD5.DD231039B13EC2ABDE315D76E658EF0E] - (.Avira Operations GmbH & Co. KG - Antivirus System Tray Tool (Desktop).) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600] [PID.2624]
[MD5.33BE35574E1081A91EACD2B98E0A472A] - (.APN - Ask Toolbar Notifier.) -- C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1778640] [PID.2636] =>Toolbar.Ask
[MD5.BAF535F843A3E790E04A7613811B55BC] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe [152392] [PID.2672]
[MD5.D3D4BD94434A9CB4B35E82283EAE8EFB] - (.McAfee, Inc. - McAfee Security Scanner Scheduler.) -- C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe [273296] [PID.2892]
[MD5.376A9B411BF8B77D5BF84B24D0C7DACD] - (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe [863184] [PID.2944]
[MD5.DAA0C27658CED9D9D1C55C3D0156E940] - (.Synaptics Incorporated - Synaptics Pointing Device Helper.) -- C:\Program Files\Synaptics\SynTP\SynTPHelper.exe [107816] [PID.3916]
[MD5.1305B94364F8F8F80DCD0E22E64E267A] - (.Avira Operations GmbH & Co. KG - In Product Messaging Application.) -- C:\program files\avira\antivir desktop\ipmGui.exe [467000] [PID.3256]
[MD5.534A3CB0847BA114F0D8A5F2BB2EF6D0] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [887432] [PID.3904]
[MD5.486BDC196F8914845302745A15310D62] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8321024] [PID.4860]
~ Processes Running: Scanned in 00mn 00s

---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\PC 1\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [aaaaacalgebmfelllfiaoknifldpngjh] Avira SearchFree Toolbar plus Web Protection v.30.2, (Désactivé) =>Toolbar.Avira
~ Google Browser: 11 Legitimates Filtered in 00mn 00s

---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\PC 1\AppData\Roaming\Mozilla\Firefox\Profiles\ivetk5ye.default\prefs.js
M3 - MFPP: Plugins - [PC 1] -- C:\Users\PC 1\AppData\Roaming\Mozilla\Firefox\Profiles\ivetk5ye.default\searchplugins\explorary.xml
M3 - MFPP: Plugins - [PC 1] -- C:\Program Files\Mozilla FireFox\searchplugins\answers.xml
M3 - MFPP: Plugins - [PC 1] -- C:\Program Files\Mozilla FireFox\searchplugins\creativecommons.xml
M0 - MFSP: prefs.js [PC 1 - ivetk5ye.default] https://www.google.com/
M2 - MFEP: prefs.js [PC 1 - ivetk5ye.default\toolbar@explorary.com] [] Toolbar Explorary v1.04.5 (..)
~ Firefox Browser: 27 Legitimates Filtered in 00mn 00s

---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s

---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s

---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21

---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Avira SearchFree Toolbar - [HKLM]{41564952-412D-5637-00A7-7A786E7484D7} . (.APN LLC. - Passport.) -- C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll =>Toolbar.Ask
~ Toolbar: Scanned in 00mn 00s

---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Free YouTube to MP3 Converter.lnk . (.DVDVideoSoft Ltd. - FreeYouTubeToMP3Converter.) -- C:\Program Files\DVDVideoSoft\Free YouTube to MP3 Converter\FreeYouTubeToMP3Converter.exe
O4 - GS\Desktop [Public]: McAfee Security Scan Plus.lnk . (.McAfee, Inc. - McAfee.) -- C:\Program Files\McAfee Security Scan\3.8.130\McUICnt.exe
O4 - GS\Desktop [Public]: Tout pour réussir son année de CE2.lnk . (...) -- C:\Program Files\Micro Application\Tout pour réussir son année de CE2\TpReussir_09.exe
O4 - GS\Program [Public]: 450 Grammaire Débutant.lnk . (.Macromedia, Inc. - Macromedia Projector.) -- C:\Program Files\CLE International\450 Grammaire Débutant\450Debutant.exe
O4 - GS\QuickLaunch [PC 1]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch [PC 1]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\PC 1\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\Program [PC 1]: Google.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe https://www.google.fr/?gws_rd=ssl =>Hijacker.Browsers
O4 - GS\Program [PC 1]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [PC 1]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop [PC 1]: Downloads.lnk . (...) -- C:\Users\PC 1\Downloads
O4 - GS\Desktop [PC 1]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [PC 1]: Mozilla Firefox.lnk - Clé orpheline
O4 - GS\Desktop [PC 1]: RANIA.CE2.lnk . (...) -- C:\Program Files\Lambda\LesMouzz2001\SYSTEM\SMILEV.exe
~ Global Startup: 48 Legitimates Filtered in 00mn 02s

---\\ Applications lancées au démarrage du sytème (O4)
O4 - GS\Startup [Public]: McAfee Security Scan Plus.lnk . (.McAfee, Inc. - McAfee Security Scanner Scheduler.) -- C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
O4 - HKLM\..\Run: [SynTPEnh] . (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe
O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe =>.Hewlett-Packard Co
O4 - HKLM\..\Run: [avgnt] . (.Avira Operations GmbH & Co. KG - Antivirus System Tray Tool (Desktop).) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
O4 - HKLM\..\Run: [ApnTBMon] . (.APN - Ask Toolbar Notifier.) -- C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe =>Toolbar.Ask
O4 - HKLM\..\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_61DAF3D80BC0EF9EC2791510918E2BB7] . (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Users\PC 1\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-1775606490-3226318973-1659062129-1000\..\Run: [GoogleChromeAutoLaunch_61DAF3D80BC0EF9EC2791510918E2BB7] . (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O4 - HKUS\S-1-5-21-1775606490-3226318973-1659062129-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-1775606490-3226318973-1659062129-1000\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Users\PC 1\AppData\Local\Facebook\Update\FacebookUpdate.exe
~ Application: Scanned in 00mn 00s

---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO
~ IE Extra Buttons: Scanned in 00mn 00s

---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{6FD14EB1-F804-4C85-932C-876E4AC63457}: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{9068AE8E-B76D-4EEA-9AF9-2347E26C6F76}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{6FD14EB1-F804-4C85-932C-876E4AC63457}: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{9068AE8E-B76D-4EEA-9AF9-2347E26C6F76}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{6FD14EB1-F804-4C85-932C-876E4AC63457}: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{9068AE8E-B76D-4EEA-9AF9-2347E26C6F76}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.254
~ Domain: Scanned in 00mn 00s

---\\ Protocole additionnel (O18)
O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s

---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Service de mise à jour Ask (APNMCP) . (.APN LLC. - APN Updater.) - C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe =>Toolbar.Ask
O23 - Service: Validity WBF Policy Service (valWBFPolicyService) . (...) - C:\Windows\System32\valWBFPolicyService.exe
~ Services: 14 Legitimates Filtered in 00mn 07s

---\\ Tâches planifiées en automatique (O39)
[MD5.96261D590C12F5D47DA973AE882C58F0] [APT] [Updater4479.exe] (.FileProperties_CompanyName.) -- C:\Users\PC 1\AppData\Local\Updater4479\Updater4479.exe [206336] =>PUP.CrossRider
[MD5.00000000000000000000000000000000] [APT] [{0292304B-65B0-41FA-929B-159A79618E4F}] (...) -- C:\Program Files\Free YouTube Downloader Converter\UNWISE.exe (.not file.) [0] =>PUP.Dealio
[MD5.B4FAAAD7FB17366A801D5658690D1925] [APT] [{CDF17FF6-B441-4737-847C-8C6DC1067CCE}] (...) -- C:\Program Files\Atout Clic 6e\UNWISE.exe [128000]
~ Scheduled Task: 18 Legitimates Filtered in 00mn 05s

---\\ Logiciels installés (O42)
O42 - Logiciel: Assistant GT v1 - (...) [HKLM] -- Assistant GT_is1
O42 - Logiciel: GT 7 OrbChanger v1 - (...) [HKLM] -- GT 7 OrbChanger_is1
O42 - Logiciel: Les MOUZZ 2001 - (...) [HKLM] -- LesMouzz2001
O42 - Logiciel: Yahoo! Toolbar - (...) [HKLM] -- Yahoo! Companion
~ Logic: 16 Legitimates Filtered in 00mn 00s

---\\ HKCU & HKLM Software Keys
[HKCU\Software\AskPartnerNetwork]
[HKLM\Software\AskPartnerNetwork]
[HKLM\Software\Lab Production]
~ Key Software: 189 Legitimates Filtered in 00mn 00s

---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 30/08/2013 - 09:09:28 - [13,482] ----D C:\Program Files\AskPartnerNetwork
O43 - CFD: 01/04/2013 - 16:19:09 - [7,253] ----D C:\Program Files\Atout Clic 6e
O43 - CFD: 01/04/2013 - 15:47:37 - [5,832] ----D C:\Program Files\Lambda
O43 - CFD: 17/11/2012 - 18:05:38 - [16,389] ----D C:\Program Files\Windows GT
O43 - CFD: 30/08/2013 - 09:09:11 - [0] ----D C:\ProgramData\APN
O43 - CFD: 30/08/2013 - 09:09:28 - [2,503] ----D C:\ProgramData\AskPartnerNetwork
O43 - CFD: 20/12/2012 - 19:25:16 - [23,535] -SH-D C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
O43 - CFD: 18/03/2013 - 14:30:03 - [0,184] ----D C:\Users\PC 1\AppData\Local\APN
O43 - CFD: 20/01/2013 - 17:06:16 - [0,197] ----D C:\Users\PC 1\AppData\Local\Updater4479 =>PUP.CrossRider
O43 - CFD: 01/04/2013 - 15:47:41 - [0,006] ----D C:\Users\PC 1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Les MOUZZ 2001
~ Program Folder: 147 Legitimates Filtered in 00mn 15s

---\\ Clé de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{edbc5211-30d7-11e2-a296-806e6f6e6963}\AutoRun\command. (...) -- D:\DriverPackSolution.exe (.not file.)
~ Keys: Scanned in 00mn 00s

---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 19 Legitimates Filtered in 00mn 00s

---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoRecentDocsHistory"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s

---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.0ED67910C8C326796FAA00B2BF6D9D3C] - 14/07/2009 - 02:20:28 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [453712]
O58 - SDL:[MD5.C44E3C2BAB6837DB337DDEE7544736DB] - 13/07/2009 - 23:54:14 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [26624]
O58 - SDL:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 30/03/1747 - 19:43:41 ---A- . (...) -- C:\Windows\System32\Drivers\sptd.sys [691696]
O58 - SDL:[MD5.A36EE93698802CD899F98BFD553D8185] - 30/08/2013 - 09:07:44 ---A- . (.Avira GmbH - AVIRA SnapShot Driver.) -- C:\Windows\System32\Drivers\ssmdrv.sys [28520]
O58 - SDL:[MD5.DB32D325C192B801DF274BFD12A7E72B] - 14/07/2009 - 02:19:04 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [21072]
O58 - SDL:[MD5.6E421CCC57059B0186C6259CA3B6DFC9] - 13/12/2012 - 13:50:38 ---A- . (.Apple, Inc. - Apple Mobile Device USB Driver.) -- C:\Windows\System32\Drivers\usbaapl.sys [45056]
O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 13/07/2009 - 22:40:41 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029]
O58 - SDL:[MD5.0FE9F16075C9ACB941C957B7C649176E] - 13/07/2009 - 22:40:44 ---A- . (...) -- C:\Windows\System32\country.sys [27097]
O58 - SDL:[MD5.E6BC0F98FECEF245A0010D350C1A0B9B] - 13/07/2009 - 22:40:40 ---A- . (...) -- C:\Windows\System32\HIMEM.SYS [4768]
O58 - SDL:[MD5.492090267B9608C62B956CD29BE3AFB7] - 13/07/2009 - 22:40:43 ---A- . (...) -- C:\Windows\System32\KEY01.SYS [42809]
O58 - SDL:[MD5.FBBCFEC1379C5C02D88A361993EDF1B8] - 13/07/2009 - 22:40:43 ---A- . (...) -- C:\Windows\System32\KEYBOARD.SYS [42537]
O58 - SDL:[MD5.FFFF296A08DBF2AC0126C62E3778AC0D] - 13/07/2009 - 22:40:23 ---A- . (...) -- C:\Windows\System32\NTDOS.SYS [27866]
O58 - SDL:[MD5.CF9ED169FF86D935E47999E82359E898] - 13/07/2009 - 22:40:31 ---A- . (...) -- C:\Windows\System32\NTDOS404.SYS [29146]
O58 - SDL:[MD5.03B945AC0481CD8BB161C3569D8ED1C3] - 13/07/2009 - 22:40:35 ---A- . (...) -- C:\Windows\System32\NTDOS411.SYS [29370]
O58 - SDL:[MD5.BBC957DC18C17CC027EB80B7C77F2AEA] - 13/07/2009 - 22:40:39 ---A- . (...) -- C:\Windows\System32\NTDOS412.SYS [29274]
O58 - SDL:[MD5.3CFFAEFFF23B0D208214A6D3061A5B1B] - 13/07/2009 - 22:40:27 ---A- . (...) -- C:\Windows\System32\NTDOS804.SYS [29146]
O58 - SDL:[MD5.2E4112FB7D1B76E11ADFD7487B5D0E95] - 13/07/2009 - 22:40:11 ---A- . (...) -- C:\Windows\System32\NTIO.SYS [33952]
O58 - SDL:[MD5.A98EBD4C2DF983665BF2D1AF49949974] - 13/07/2009 - 22:40:15 ---A- . (...) -- C:\Windows\System32\NTIO404.SYS [34672]
O58 - SDL:[MD5.3F7E6406EDEF197C5CAAB2240EEF6F48] - 13/07/2009 - 22:40:17 ---A- . (...) -- C:\Windows\System32\NTIO411.SYS [35776]
O58 - SDL:[MD5.3E64D681B776CC57BDC38A46D881F85B] - 13/07/2009 - 22:40:19 ---A- . (...) -- C:\Windows\System32\NTIO412.SYS [35536]
O58 - SDL:[MD5.D86B6435729231C171432B4E77801BDB] - 13/07/2009 - 22:40:13 ---A- . (...) -- C:\Windows\System32\NTIO804.SYS [34672]
~ Drivers: 19 Legitimates Filtered in 00mn 01s

---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 05/01/2014 - 17:35:37 ---A- . (...) -- C:\Users\PC 1\Downloads\adwcleaner.exe [1233962]
O61 - LFC: 07/01/2014 - 17:32:59 ---A- . (...) -- C:\Users\PC 1\AppData\Local\Google\Chrome\User Data\Certificate Revocation Lists [265316]
O61 - LFC: 07/01/2014 - 17:33:06 ---A- . (...) -- C:\Users\PC 1\AppData\Local\Google\Chrome\User Data\Local State [50642]
O61 - LFC: 07/01/2014 - 17:35:35 ---A- . (...) -- C:\Users\PC 1\AppData\Roaming\ZHP\Log.txt [17444] =>.Nicolas Coolman
O61 - LFC: 07/01/2014 - 17:35:35 ---A- . (...) -- C:\Users\PC 1\AppData\Roaming\ZHP\TestsZHPDiag.txt [2782] =>.Nicolas Coolman
O61 - LFC: 07/01/2014 - 17:35:37 ---A- . (...) -- C:\Users\PC 1\Documents\Notes\mbam-log-2014-01-07 (16-33-29).txt [5342]
~ 18 Fichiers temporaires (Temporary files)
~ 1 Fichiers cookies (Cookies files)
~ Files: 3504 Legitimates Filtered in 04mn 41s

---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s

---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s

---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s

---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {1D172C84-435A-4CAB-96E7-62E44F4E50A6} - (Ask Search) - http://www.search.ask.com/?o=10148&l=dis =>Toolbar.Ask
O69 - SBI: SearchScopes [HKCU] {5ca81b0d-4875-47f8-b9cb-1d97d8a775e7} - (explorary) - http://www.explorary.com
O69 - SBI: SearchScopes [HKCU] {DA1CA122-4536-48F5-B9F2-690F08726FAA} - (DVDVideoSoftTB Customized Web Search) - http://search.conduit.com
~ Keys: Scanned in 00mn 00s

---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.C67BCF6441E378371F0D6EEFB7EF0861] [SPRF][07/01/2014] (.Conduit - SP Usage Sender.) -- C:\Users\PC 1\AppData\Local\Temp\nsk3D91.exe [167812] =>Toolbar.Conduit
[MD5.C67BCF6441E378371F0D6EEFB7EF0861] [SPRF][07/01/2014] (.Conduit - SP Usage Sender.) -- C:\Users\PC 1\AppData\Local\Temp\nsk5EC9.exe [167812] =>Toolbar.Conduit
[MD5.C67BCF6441E378371F0D6EEFB7EF0861] [SPRF][07/01/2014] (.Conduit - SP Usage Sender.) -- C:\Users\PC 1\AppData\Local\Temp\nsk6224.exe [167812] =>Toolbar.Conduit
[MD5.C67BCF6441E378371F0D6EEFB7EF0861] [SPRF][07/01/2014] (.Conduit - SP Usage Sender.) -- C:\Users\PC 1\AppData\Local\Temp\nsp391D.exe [167812] =>Toolbar.Conduit
[MD5.C67BCF6441E378371F0D6EEFB7EF0861] [SPRF][07/01/2014] (.Conduit - SP Usage Sender.) -- C:\Users\PC 1\AppData\Local\Temp\nsv4179.exe [167812] =>Toolbar.Conduit
[MD5.C67BCF6441E378371F0D6EEFB7EF0861] [SPRF][07/01/2014] (.Conduit - SP Usage Sender.) -- C:\Users\PC 1\AppData\Local\Temp\nsv66A8.exe [167812] =>Toolbar.Conduit
[MD5.C67BCF6441E378371F0D6EEFB7EF0861] [SPRF][07/01/2014] (.Conduit - SP Usage Sender.) -- C:\Users\PC 1\AppData\Local\Temp\nsy8A1A.exe [167812] =>Toolbar.Conduit
[MD5.F0A5B44B9B8A23E2F2950B346B5C7718] [SPRF][23/12/2013] (...) -- C:\Users\PC 1\AppData\Local\Temp\Quarantine.exe [360051]
[MD5.F735D204FE50BCC554DCB683A0A9EFEE] [SPRF][02/02/2013] (...) -- C:\Users\PC 1\Desktop\avira_free_antivirus.exe [2086240]
~ Files: 9 Legitimates Filtered in 00mn 00s

---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "25946514D2147365007A7A857BC0A000" . (.Avira SearchFree Toolbar.) -- C:\Windows\Installer\{41564952-412D-5637-00A7-A758B70C0A00}\ToolbarIcon.exe =>Toolbar.Avira
~ Update Products: 40 Legitimates Filtered in 00mn 00s

---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.22C6CA1017B542648C7900FBE4929B7C] [WIS][13/03/2010] (.FrontMotion - 3.6.0.0 (created Sat Feb 13 2010 at 6:26:23pm).) -- C:\Windows\Installer\27f6f.msi [12263424]
[MD5.CB226C5E01130B811167885B3D4FE577] [WIS][20/12/2013] (.APN, LLC - Avira SearchFree Toolbar.) -- C:\Windows\Installer\3fcc98d.msi [813568] =>Toolbar.Avira
~ WIS: 41 Legitimates Filtered in 00mn 08s

---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 10/12/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Auto 17/11/2012 116648 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 17/11/2012 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 06/09/2013 235216 | (McComponentHostService) . (.McAfee, Inc..) - C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe

SR - | Auto 11/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 12/10/2011 176128 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 19/12/2013 440376 | (AntiVirSchedulerService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\sched.exe
SR - | Auto 27/11/2013 440376 | (AntiVirService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
SR - | Auto 19/12/2013 1011768 | (AntiVirWebService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.exe
SR - | Auto 20/12/2013 166352 | (APNMCP) . (.APN LLC..) - C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe =>Toolbar.Ask
SR - | Auto 07/09/2013 55624 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 30/08/2011 390504 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Auto 13/05/2011 26168 | (hpsrv) . (.Hewlett-Packard Company.) - C:\Windows\System32\Hpservice.exe
SR - | Demand 02/11/2013 553288 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SR - | Auto 22/04/2013 754000 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe
SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
SR - | Auto 17/10/2013 24064 | (valWBFPolicyService) . (...) - C:\Windows\System32\valWBFPolicyService.exe
SR - | Auto 14/07/2009 20992 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 14/07/2009 20992 | C:\Windows\system32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

~ Services: Scanned in 00mn 11s

---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

~ MBR: 1 Legitimates Filtered in 00mn 02s

---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by PC 1 at 07/01/2014 17:38:05

********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin

~ MBR: Scanned in 00mn 04s

---\\ Liste des émulateurs de CD/DVD (MBR Hook)
O58 - SDL:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 30/03/1747 - 19:43:41 ---A- . (...) -- C:\Windows\System32\Drivers\sptd.sys [691696]
~ Emulateurs: Scanned in 00mn 04s

---\\ Scan Additionnel (O88)
Database Version : 13018 - (02/01/2014)
Clés trouvées (Keys found) : 7
Valeurs trouvées (Values found) : 3
Dossiers trouvés (Folders found) : 4
Fichiers trouvés (Files found) : 18

[HKLM\Software\Google\Chrome\Extensions\aaaaacalgebmfelllfiaoknifldpngjh] =>Toolbar.Avira^
[HKLM\SYSTEM\CurrentControlSet\Services\APNMCP] =>Toolbar.Ask^
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion] =>Toolbar.Yahoo
[HKCU\Software\AskPartnerNetwork] =>Toolbar.Ask
[HKLM\Software\AskPartnerNetwork] =>Toolbar.Ask
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011441179}] =>PUP.CrossRider
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{41564952-412D-5637-00A7-7A786E7484D7} =>Toolbar.Ask^
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:ApnTBMon =>Toolbar.Ask^
[HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks]:{00000000-6E41-4FD3-8538-502F5495E5FC} =>Adware.ShopperReports
C:\Users\PC 1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaacalgebmfelllfiaoknifldpngjh =>Toolbar.Avira^
C:\Users\PC 1\AppData\Local\Updater4479 =>PUP.CrossRider^
C:\Program Files\AskPartnerNetwork =>Toolbar.Ask
C:\ProgramData\AskPartnerNetwork =>Toolbar.Ask
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSetProgramAccessAndDefaults: Modified =>PUA.StartShow ^
C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe =>Toolbar.Ask^
C:\Users\PC 1\AppData\Local\Updater4479\Updater4479.exe =>PUP.CrossRider^
C:\Users\PC 1\AppData\Local\Temp\nsk3D91.exe =>Toolbar.Conduit^
C:\Users\PC 1\AppData\Local\Temp\nsk5EC9.exe =>Toolbar.Conduit^
C:\Users\PC 1\AppData\Local\Temp\nsk6224.exe =>Toolbar.Conduit^
C:\Users\PC 1\AppData\Local\Temp\nsp391D.exe =>Toolbar.Conduit^
C:\Users\PC 1\AppData\Local\Temp\nsv4179.exe =>Toolbar.Conduit^
C:\Users\PC 1\AppData\Local\Temp\nsv66A8.exe =>Toolbar.Conduit^
C:\Users\PC 1\AppData\Local\Temp\nsy8A1A.exe =>Toolbar.Conduit^
C:\Windows\Installer\3fcc98d.msi =>Toolbar.Avira^
~ Additionnel Scan: 228796 Items scanned in 00mn 17s

---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com/apps/blog/show/34077727-pua-startshow =>PUA.StartShow
~ http://nicolascoolman.webs.com/apps/blog/show/28927746-toolbar-ask =>Toolbar.Ask
~ http://nicolascoolman.webs.com/apps/blog/show/33263878-hijacker-browser =>Hijacker.Browsers
~ http://nicolascoolman.webs.com/apps/blog/show/27583526-pup-crossrider =>PUP.CrossRider
~ http://nicolascoolman.webs.com/apps/blog/show/27443462-pup-dealio =>PUP.Dealio
~ http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit
~ MSI: 6 link(s) detected in 00mn 17s

~ 4426 Legitimates filtered by white list
End of the scan (508 lines in 07mn 32s)(0)

Re

Pour de plus amples informations, fait ceci stp

Ouvre ce lien et télécharge ZHPDiag de Nicolas Coolman :

https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

Ou

https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/

en bas de la page ZHP avec un numéro de version.

Une fois le téléchargement achevé,

Double-clique sur l'icône pour lancer le programme. Sous Vista ; Seven ou Windows 8 clic droit « exécuter en tant que administrateur »

Dans la fenêtre ZHPDiag qui vient de s'ouvrir, clique sur "Configurer"

Clique sur la loupe en bas à gauche avec le signe plus pour lancer l'analyse.

Laisse l'outil travailler, il peut être assez long.

Un rapport s'ouvre. Ce rapport se trouve également sur ton bureau

Pour transmettre le rapport clique sur ce lien:
http://pjjoint.malekal.com/

Si problème utilise un des suivants

https://forums-fec.be/upload
https://www.cjoint.com/

Regarde sur le bureau

Sélectionne le fichier ZHPDiag.txt.

Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.com/cjlink.php?file=cj200905/cijSKAP5fU.txt

est ajouté dans la page.

Copie ce lien dans ta réponse.

Merci

@+

wCleaner v3.016 - Rapport créé le 07/01/2014 à 17:09:57
# Mis à jour le 23/12/2013 par Xplode
# Système d'exploitation : Windows 7 Professional Service Pack 1 (32 bits)
# Nom d'utilisateur : PC 1 - PC1-PC
# Exécuté depuis : C:\Users\PC 1\Downloads\adwcleaner.exe
# Option : Nettoyer

***** [ Services ] *****

***** [ Fichiers / Dossiers ] *****

***** [ Raccourcis ] *****

***** [ Registre ] *****

***** [ Navigateurs ] *****

-\\ Internet Explorer v11.0.9600.16428

-\\ Mozilla Firefox v3.6.0.0 (en-US)

[ Fichier : C:\Users\PC 1\AppData\Roaming\Mozilla\Firefox\Profiles\ivetk5ye.default\prefs.js ]

-\\ Google Chrome v31.0.1650.63

[ Fichier : C:\Users\PC 1\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [29826 octets] - [05/01/2014 15:23:30]
AdwCleaner[R1].txt - [1057 octets] - [05/01/2014 15:29:17]
AdwCleaner[R2].txt - [1118 octets] - [05/01/2014 15:38:37]
AdwCleaner[R3].txt - [1178 octets] - [05/01/2014 16:02:25]
AdwCleaner[R4].txt - [1299 octets] - [07/01/2014 13:48:02]
AdwCleaner[R5].txt - [2735 octets] - [07/01/2014 15:45:41]
AdwCleaner[R6].txt - [1479 octets] - [07/01/2014 16:04:59]
AdwCleaner[R7].txt - [1539 octets] - [07/01/2014 17:09:11]
AdwCleaner[S0].txt - [28718 octets] - [05/01/2014 15:25:38]
AdwCleaner[S1].txt - [1240 octets] - [05/01/2014 16:04:38]
AdwCleaner[S2].txt - [2675 octets] - [07/01/2014 15:46:47]
AdwCleaner[S3].txt - [1460 octets] - [07/01/2014 17:09:57]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1520 octets] ##########

Re

Télécharge AdwCleaner ( d'Xplode ) sur ton bureau.
Lance le, clique sur [Scanner] puis patiente le temps du scan.
Une fois le scan terminé clique sur le bouton [Nettoyer]
Patiente durant le nettoyage. Lis le message qui apparaît, puis clique sur Ok . Le PC va être redémarré automatiquement et le rapport s'ouvrira à la fin du redémarrage.
Poste le rapport

Note : Le rapport est également sauvegardé sous C:\AdwCleaner[S1].txt

A lire :
Les toolbars, c'est pas obligatoire ( par Malekal ) :https://forum.malekal.com/viewtopic.php?t=6173&start=
Les programmes potentiellement indésirables :
https://forum.malekal.com/viewtopic.php?t=33776&start=
https://www.malekal.com/adwares-pup-protection/

@+