ASUS Eee
Bonjour tous le monde, c'est a propos de mon asus Eee qui est d'une lenteur incroyable il faut minimum attendre 50 secondes pour accéder d'une fenêtre a une autre et comme je me débrouille un peu en informatique donc j'ai presque télécharger tous les logiciels d'optimisation comme par exemple: TUNEUP et GLARY UTILITIES mais aucun résultats secondo j'ai fais la défrag des disques dur mais c'est la même chose, moi ce que je cherche et c'est ma question en quelques sorte un logiciel ou une astuce pour optimiser la la Ram svp aider je deviens fous si ça continue je vais le jeter a la poubelle, mrc d'avance vous me rendez un grand service
Répondre
Répondre
29 réponses
Résumé de la discussion
La lenteur extrême de l'ordinateur Asus Eee, avec des accès Windows qui prennent jusqu'à 50 secondes entre les fenêtres, est le problème central évoqué, malgré des tentatives d'optimisation et de défragmentation. Plusieurs outils d'optimisation n'apportent pas d'amélioration; Malwarebytes a détecté et mis en quarantaine de multiples PUP et traces indésirables. En complément, ZHPDiag, RogueKiller et JRT ont été proposés pour diagnostiquer et nettoyer les entrées sensibles et les programmes potentiellement malveillants. Des retours évoquent des adwares ou des données compromises, justifiant des changements de mots de passe et une vérification des installations.
-
d'accord lili mrc encore
-
Contributeur sécuritéPour demain
Mettre IE à jour
AVG,flashplayer,reader et java
-
-
d'accord lilidurhone
-
Contributeur sécuritéMerci Destrio
Oudamir
Héberges sur cjoint :)
-
~ Rapport de ZHPDiag v2014.2.23.20 - Nicolas Coolman (23/02/2014)
(rapport supprimé par la modération CCM car il provoquait un bogue d'affichage) -
Contributeur sécuritéUn nouveau zhpdiag
-
bonjour mademoiselle c'est concernant la prochaine étape a suivre svp
-
d'accord mais pour info j'ai changer que les mots de passe de mes e-mail et réseaux socio parceque j'en ai pleins et franchement il vous faut du temps pour tous les changés mais ce n'est pas importants
-
Contributeur sécuritéTous sans exception!
Refais un zhpdiag
-
c bon j'ai tout changé enfin les plus importants
-
Contributeur sécuritéC:\Users\Asus\AppData\Roaming\dclogs (Stolen.Data) -> Mis en quarantaine et supprimé avec succès.
Changes tout tes mots de passe internet ils ont été pompé!
-
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Version de la base de données: v2014.02.20.12
Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16798
Asus :: ASUS-PC [administrateur]
21/02/2014 02:25:56
mbam-log-2014-02-21 (02-25-56).txt
Type d'examen: Examen complet (C:\|D:\|)
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 380706
Temps écoulé: 3 heure(s), 28 minute(s), 41 seconde(s)
Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)
Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)
Clé(s) du Registre détectée(s): 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F6AFBF1-E065-4627-A2FD-810366367D01} (PUP.Optional.DefaultTab.A) -> Mis en quarantaine et supprimé avec succès.
HKCU\Software\DC3_FEXEC (Malware.Trace) -> Mis en quarantaine et supprimé avec succès.
Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)
Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)
Dossier(s) détecté(s): 6
C:\Users\Asus\AppData\Roaming\dclogs (Stolen.Data) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Invité\AppData\Roaming\Iminent\Mediator (PUP.Optional.Iminent.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Invité\AppData\Roaming\Iminent\Mediator\Datas (PUP.Optional.Iminent.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Asus\AppData\Roaming\newnext.me (PUP.Optional.NextLive.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Asus\AppData\Roaming\newnext.me\cache (PUP.Optional.NextLive.A) -> Mis en quarantaine et supprimé avec succès.
Fichier(s) détecté(s): 80
C:\Program Files\Mobogenie\nengine.dll (PUP.Optional.NextLive.A) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files\Webplayer decompression\MyBabylonTB.exe (PUP.Optional.Babylon.A) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-saudi-forf.exe (PUP.Optional.Hao123.A) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files\Cain\Abel64.exe (HackTool.Cain) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files\Cain\Cain.exe (PUP.Passwordtool.Cain) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files\Cain\installer_winpcap_4_1_2_French.exe (PUP.Optional.Vittalia) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files\Cain\installer_winpcap_4_1_2_French.exe.opdownload (PUP.Optional.Vittalia) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\Program Files\BrowseFox\updateBrowseFox.exe.vir (PUP.Optional.BrowseFox.A) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\Program Files\BrowseFox\bin\utilBrowseFox.exe.vir (PUP.Optional.BrowseFox.A) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\Program Files\BrowseFox\update\nfj0guoe.5ic.exe.vir (PUP.Optional.BrowseFox.A) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\Program Files\Conduit\Community Alerts\Alert.dll.vir (PUP.Optional.Conduit) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\Program Files\Conduit\Community Alerts\Alert0.dll.vir (PUP.Optional.Conduit) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\Program Files\FTDownloader.com\FLTextsetup.exe.vir (PUP.Optional.Bundler) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\Program Files\HDvid Codec V1\HDvid Codec V1-buttonutil.exe.vir (PUP.Optional.HDvidCodec.A) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\Program Files\HDvid Codec V1\HDvid Codec V1-buttonutil64.exe.vir (PUP.Optional.HDvidCodec.A) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\Program Files\HDvid Codec V1\HDvid Codec V1-codedownloader.exe.vir (PUP.Optional.HDvidCodec.A) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\Program Files\HDvid Codec V1\HDvid Codec V1-helper.exe.vir (PUP.Optional.CrossRider) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\Program Files\PC Optimizer Pro\pc.optimizer.pro.v6.x.x-patch.exe.vir (PUP.Hacktool.Patcher) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\Program Files\Webplayer setup\MyBabylonTB.exe.vir (PUP.Optional.Babylon.A) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\ProgramData\saveNNshhaare,\JzCRFaYnoE.dll.vir (PUP.Optional.MultiPlugin.A) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\ProgramData\savEnshare a\ACNzn.dll.vir (PUP.Optional.MultiPlugin.A) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\Users\Asus\AppData\Local\Bundled software uninstaller\bi_client.exe.vir (PUP.Optional.Somoto.A) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\Users\Asus\AppData\Roaming\BabSolution\Shared\NTRedirect.dll.vir (PUP.Optional.Babylon.A) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\windows\system32\roboot.exe.vir (PUP.Optional.PCPerformer.A) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\windows\system32\ARFC\wrtc.exe.vir (PUP.Optional.InstallBrain.A) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\windows\system32\jmdp\lmrn.dll.vir (PUP.Optional.Sweetpacks) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\windows\system32\jmdp\stij.exe.vir (PUP.Optional.InstallBrain.A) -> Mis en quarantaine et supprimé avec succès.
C:\AdwCleaner\Quarantine\C\windows\system32\WNLT\Installation\SKSetup.exe.vir (PUP.Optional.InstallBrain.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Asus\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie2.1.35.zip (PUP.Optional.NextLive.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Asus\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\nengine.dll (PUP.Optional.NextLive.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Asus\AppData\Local\genienext\nengine.dll (PUP.Optional.NextLive.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Asus\AppData\Roaming\newnext.me\nengine.dll (PUP.Optional.NextLive.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Asus\AppData\Roaming\Opera Software\Opera Stable\File System\003\t\00\00000000 (PUP.Optional.OneClickDownloader.A) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SkywalkerSetup[1].exe (PUP.Optional.InstallBrain.A) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WSSetup[1].exe (PUP.Optional.InstallBrain.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Asus\AppData\Roaming\dclogs\2013-12-27-6.dc (Stolen.Data) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Asus\AppData\Roaming\dclogs\2013-12-28-7.dc (Stolen.Data) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Asus\AppData\Roaming\dclogs\2013-12-29-1.dc (Stolen.Data) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\bubble.xml (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\HotInactiveTabRight.bmp (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\24x7bubble_Left.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\24x7bubble_Right.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\24x7bubble_X00.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\24x7bubble_X01.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\24x7bubble_X02.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\24x7Dark001_SettingsActive.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\24x7Dark001_SettingsBack.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\24x7Dark001_SettingsHover.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\24x7Dark_NoTabs_Back00.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\24x7Dark_NoTabs_PhoneIcon.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\24x7logoNew_dark01.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\24x7man_dark01.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\24x7_UploaderDark01.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\ArrowSmall.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\ArrowSmallHot.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\Hardware_Icon.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\HotInactiveTabLeft.bmp (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\MainImg_SettingsDark01.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\Navigation_HomeIcon00_Dark01.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\Navigation_HomeIcon01_Dark01.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\Navigation_SettingsIcon00_Dark01.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\Navigation_SettingsIcon01_Dark01.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\OK_IconGreen01.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\Phones_Icon.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\PushedInactiveTabLeft.bmp (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\PushedInactiveTabRight.bmp (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\Security_Icon.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\skin.xml (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\Software_Icon.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\SupportCheck01_arrow00.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\SupportCheck01_arrow01.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\Warning_Icon01.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\Warning_IconOrange01.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\Warning_IconRed01.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\WhiteTabLeft.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Windows\System32\config\systemprofile\AppData\Roaming\24x7 Help\skin\WhiteTabRight.png (PUP.Optional.24x7) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Invité\AppData\Roaming\Iminent\Mediator\Datas\globalcache.dat (PUP.Optional.Iminent.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Invité\AppData\Roaming\Iminent\Mediator\Datas\user.dat (PUP.Optional.Iminent.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Asus\AppData\Roaming\newnext.me\nengine.cookie (PUP.Optional.NextLive.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Asus\AppData\Roaming\newnext.me\cache\spark.bin (PUP.Optional.NextLive.A) -> Mis en quarantaine et supprimé avec succès.
(fin) -
Contributeur sécuritéOn va faire un scan généralisé pour voir si d'autres infections ne se cachent pas
Attention le scan peut durer assez longtemps environ 2h voire plus suivant la capacité des disques durs
* Télécharge MalwareBytes' anti-malware sur le bureau
https://www.commentcamarche.net/telecharger/securite/14361-malwarebytes-anti-malware/
* Cliques droit sur l'icône Download_mbam-setup.exe afin de l'exécuter en tant qu'admin pour lancer le processus d'installation
* Si le pare-feu demande l'autorisation de se connecter pour malwareBytes, accepte
* Décoche pour la version d'essai pour malwarebytes pro
* Il va se mettre à jour une fois faite
* Va dans l'onglet recherche
* Sélectionne exécuter un examen complet
* Clique sur rechercher
* Le scan démarre
* A la fin de l'analyse, le message s'affiche: L'examen s'est terminé normalement.
* Clique sur afficher les résultats pour afficher les objets trouvés
* Clique sur OK pour poursuivre
* Si des malwares ont été détectés, cliquer sur afficher les résultats
* Sélectionne tout (ou laisser coché)
* Clique sur tout supprimer
* MalwareBytes va détruire les fichiers et les clés de registre et en mettre une
copie dans la quarantaine
* Malwarebytes va ouvrir le bloc-note et y copier le rapport
* Redémarre le PC
* Une fois redémarré, double-clique sur MalwareBytes
* Va dans l'onglet rapport/log
* Clique dessus pour l'afficher une fois affiché, cliquer sur édition
en haut du bloc-note puis sur sélectionner tout
* Reviens sur édition, puis sur copier et reviens
sur le forum dans ta réponse
* Clic droit dans le cadre de la réponse et coller
Bonne chance
-
~ Rapport de ZHPDiag v2014.2.17.15 - Nicolas Coolman (17/02/2014)
~ Lancé par Asus (20/02/2014 16:54:42)
~ Adresse du Site Web https://nicolascoolman.webs.com/
~ Forums gratuits d'Assistance à la désinfection : https://nicolascoolman.webs.com/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user
---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16798
GCIE: Google Chrome v32.0.1700.107
OPIE: Opera vStable 19.0.1326.63 (Defaut)
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Starter, 32-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : YCJVG
Windows License : OK
~ Windows Remaining Initializations Number : 2
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ Logiciels de protection du système
AVG 2013 v13.0.3705
Windows Defender W7
---\\ Logiciels d'optimisation du système
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 13 Plugin
Adobe Reader XI
Java 7 Update 45
---\\ Informations sur le système
~ Processor: x86 Family 6 Model 28 Stepping 10, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1014 MB (18% free)
System Restore: Activé (Enable)
System drive C: has 20 GB (20%) free of 100 GB
---\\ Mode de connexion au système
~ Computer Name: ASUS-PC
~ User Name: Asus
~ All Users Names: Asus, Administrateur,
~ Unselected Option: None
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Asus\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Asus\AppData\Roaming\
~ %Desktop% : C:\Users\Asus\Desktop\
~ %Favorites% : C:\Users\Asus\Favorites\
~ %LocalAppData% : C:\Users\Asus\AppData\Local\
~ %StartMenu% : C:\Users\Asus\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 20 Go of 100 Go)
D: Hard drive, Flash drive, Thumb drive (Free 39 Go of 118 Go)
E: Floppy drive, Flash card reader, USB Key (Not Inserted)
F: CD-ROM drive (Not Inserted)
---\\ Etat du Centre de Sécurité Windows
~ Security Center: 50 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.8B88EBBB05A0E56B7DCC708498C02B3E] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 06:30:54.) -- C:\Windows\Explorer.exe [2616320]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:14:45.) -- C:\Windows\System32\Wininit.exe [96256]
[MD5.1FF83D2BE92B40DAE234CF4236680B6E] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.01/02/2014 - 08:58:31.) -- C:\Windows\System32\wininet.dll [1767936]
[MD5.6D13E1406F50C66E2A95D97F22C47560] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.20/11/2010 - 13:17:54.) -- C:\Windows\System32\Winlogon.exe [286720]
[MD5.E3AE23569749DE12D45BA3B489A036AE] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 13:21:24.) -- C:\Windows\System32\sppcomapi.dll [193536]
[MD5.F81BB7E487EDCEAB630A7EE66CF23913] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.14/09/2013 - 01:48:58.) -- C:\Windows\system32\Drivers\AFD.sys [338944]
[MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:26:15.) -- C:\Windows\system32\Drivers\atapi.sys [21584]
[MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:11:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656]
[MD5.BE167ED0FDB9C1FA1133953C18D5A6C9] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 09:38:10.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544]
[MD5.F024449C97EC1E464AAFFDA18593DB88] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 09:42:32.) -- C:\Windows\system32\Drivers\DfsC.sys [78336]
[MD5.9036377B8A6C15DC2EEC53E489D159B5] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 10:59:29.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544]
[MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:11:24.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896]
[MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 00:54:29.) -- C:\Windows\system32\Drivers\IpNat.sys [101888]
[MD5.5D16C921E3671636C0EBA3BBAAC5FD25] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:17:22.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123904]
[MD5.280122DDCF04B378EDD1AD54D71C1E54] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 09:39:44.) -- C:\Windows\system32\Drivers\netBT.sys [187904]
[MD5.5E43D2B0EE64123D4880DFA6626DEFDE] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 14:45:29.) -- C:\Windows\system32\Drivers\ntfs.sys [1211752]
[MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 00:45:35.) -- C:\Windows\system32\Drivers\Parport.sys [79360]
[MD5.D9F91EAFEC2815365CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.14/07/2009 - 00:54:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848]
[MD5.3E21C083B8A01CB70BA1F09303010FCE] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 00:53:41.) -- C:\Windows\system32\Drivers\smb.sys [71168]
[MD5.B459575348C20E8121D6039DA063C704] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 09:39:17.) -- C:\Windows\system32\Drivers\tdx.sys [74752]
[MD5.F497F67932C6FA693D7DE2780631CFE7] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 13:30:16.) -- C:\Windows\system32\Drivers\volsnap.sys [245632]
~ Generic Processes: Scanned in 00mn 14s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/80
~ Mes musiques (My Musics) : 1/31
~ Mes Videos (My Videos) : 1/5
~ Mes Favoris (My Favorites) : 1/44
~ Mes Documents (My Documents) : 1/1336
~ Mon Bureau (My Desktop) : 1/814
~ Menu demarrer (Programs) : 1/60
~ Hidden Files: Scanned in 01mn 09s
---\\ Processus lancés
[MD5.F2E0D536DF86C0BF795B95A251F07659] - (.Pas de propriétaire - Eee Docking Application.) -- C:\Program Files\ASUS\Eee Docking\Eee Docking.exe [415920] [PID.3264]
[MD5.D36DA0A5C531353C5FF5E29242649257] - (.Boingo Wireless, Inc. - Boingo Wi-Fi.) -- C:\Program Files\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe [365936] [PID.3284]
[MD5.0830F8648E7D86F0BCEEA133BE9E460B] - (.Synaptics Incorporated - Asus Custom Acpi Monitor Application.) -- C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [85304] [PID.3344]
[MD5.13B671D7253F29DA148569288CECF74B] - (.Intel Corporation - hkcmd Module.) -- C:\Windows\System32\hkcmd.exe [173592] [PID.3376]
[MD5.2B3DB9C9D7E206CFCF3E327709BEF3AD] - (.Intel Corporation - igfxsrvc Module.) -- C:\windows\system32\igfxsrvc.exe [252952] [PID.3392]
[MD5.052F402E557C9EC01B188AD56E336029] - (.Intel Corporation - persistence Module.) -- C:\Windows\System32\igfxpers.exe [150552] [PID.3428]
[MD5.CB99B4F2C1C984389A6A9167C7FD6599] - (.Samsung Electronics Co., Ltd. - Kies TrayAgent Application.) -- C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152] [PID.3520]
[MD5.B4BB5F5F5CDF0B6C51E0ACE23FC8537B] - (...) -- C:\Program Files\Mobogenie\DaemonProcess.exe [746176] [PID.3608] =>PUP.Mobogenie
[MD5.A8D3CF1BCEDB663C257F6C20219B718A] - (.AVG Technologies CZ, s.r.o. - AVG User Interface.) -- C:\Program Files\AVG\AVG2013\avgui.exe [4411952] [PID.3756]
[MD5.844047923CBE99DF185FA887F8B98EC3] - (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2350392] [PID.3772]
[MD5.766AE515B1749F2141E418CC6C08515B] - (.Intel Corporation - IAStorIcon.) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440] [PID.3780]
[MD5.E567B6DA553BDF20FCBEF1A07CF5AA46] - (.Samsung - Kies.) -- C:\Program Files\Samsung\Kies\Kies.exe [1564016] [PID.3956]
[MD5.8367B8696F613B766F393CD85F17EE80] - (.Samsung - KiesPDLR.) -- C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656] [PID.3984]
[MD5.EB68702BC009258910F26C906F956EE6] - (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files\Microsoft Office\Office15\MsoSync.exe [448192] [PID.4368]
[MD5.2C9E5DD5DCB10238ED082A275CB67758] - (.Synaptics Incorporated - Synaptics Pointing Device Helper.) -- C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.exe [109880] [PID.4672]
[MD5.EA0F5701A2A6B832AE8D3525B0F957BE] - (.Ralink Technology, Corp. - Ralink Wireless LAN Card Utility.) -- C:\Program Files\Ralink\Common\RaUI.exe [15661872] [PID.4980]
[MD5.5EFDBEAECD69E250E5BA4A2950203CD4] - (.Microsoft Corporation - Sauvegarde Microsoft® Windows.) -- C:\windows\system32\sdclt.exe [1131008] [PID.5496]
[MD5.56E51C26745FF7413514EA4DDF33BC6C] - (.Microsoft Corporation - Microsoft Feeds Synchronization.) -- C:\windows\system32\msfeedssync.exe [11776] [PID.3616]
[MD5.E31566D2575B0249C65CA491A3FD87FC] - (.Opera Software - Opera Internet Browser.) -- C:\Program Files\Opera\19.0.1326.63\opera.exe [45198176] [PID.6136]
[MD5.3028F38FA148057E9AC675F29074791B] - (...) -- C:\Program Files\Opera\19.0.1326.63\opera_crashreporter.exe [1378144] [PID.4076]
[MD5.62D61231D5EC85AD6BBCEF146ADC673F] - (.Tonec Inc. - Internet Download Manager (IDM).) -- D:\Program Files\Internet Download Manager\IDMan.exe [3821136] [PID.3472]
[MD5.AB44884BC129FC04D75A4649E0710203] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8338432] [PID.5560]
[MD5.5DAF7081A4BB112FA3F1915819330A3E] - (...) -- C:\Program Files\ZHPDiag\pv.exe [61440] [PID.0]
[MD5.D53024C1355615B82DD1526B63623E61] - (...) -- C:\Program Files\Mobogenie\mgusb.exe [88256] [PID.8044] =>PUP.Mobogenie
~ Processes Running: Scanned in 01mn 00s
---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Preferences
~ Google Browser: 0 Legitimates Filtered in 00mn 02s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Asus\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js (.not file.)
C:\Users\Asus\AppData\Roaming\Mozilla\Firefox\Profiles\n6aqrywy.default\prefs.js
C:\Users\Asus\AppData\Roaming\Mozilla\Firefox\Profiles\wpddqarv.default\prefs.js (.not file.)
~ Firefox Browser: 22 Legitimates Filtered in 00mn 08s
---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://bestsearchonweb.com
R0 - HKCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.barremagique.com
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = preserve
~ IE Browser: 12 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 01s
~ Nombre de lignes (Lines number): 21
---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: PXCIEaddin - {42DFA04F-0F16-418e-B80C-AB97A5AFAD39} . (.Tracker Softaware - Pas de description.) -- C:\Program Files\Tracker Software\PDF-XChange 4\PXCIEAddin4.dll
~ BHO: 20 Legitimates Filtered in 00mn 04s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: PDFXChange 4.0 - [HKLM]{42DFA04F-0F16-418e-B80C-AB97A5AFAD39} . (.Tracker Softaware - Pas de description.) -- C:\Program Files\Tracker Software\PDF-XChange 4\PXCIEAddin4.dll
O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll =>Toolbar.Google
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{21FA44EF-376D-4D53-9B0F-8A89D3229068} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{CFCB809C-3A22-4616-A916-6C007BD9D920} Clé orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: AVG.lnk . (.AVG Technologies CZ, s.r.o. - AVG User Interface.) -- C:\Program Files\AVG\AVG2013\avgui.exe
O4 - GS\Desktop [Public]: Boilsoft Video Joiner.lnk . (.Boilsoft - Boilsoft Video Joiner.) -- C:\Program Files\Boilsoft\Boilsoft Video Joiner\EZMerge.exe
O4 - GS\Desktop [Public]: DriverEasy.lnk . (.Easeware - DriverEasy.) -- C:\Program Files\Easeware\DriverEasy\DriverEasy.exe
O4 - GS\Desktop [Public]: Démarrer SPYOME.lnk . (...) -- C:\Program Files\Spyome\exec\maspyome.exe
O4 - GS\Desktop [Public]: Max Recorder.lnk . (...) -- C:\Program Files\Max Recorder\MaxRecorder.exe
O4 - GS\Desktop [Public]: Office2PDF.lnk . (.Tracker Software Products Ltd. - Batch converter for Office documents to PDF.) -- C:\Program Files\Tracker Software\PDF-XChange 4\OFFice2PDF.exe
O4 - GS\Desktop [Public]: PDF-Tools 4.lnk . (.Tracker Software Products Ltd. - PDF-Tools.) -- C:\Program Files\Tracker Software\PDF-Tools 4\PDFTools4.exe
O4 - GS\Desktop [Public]: PDF-Viewer.lnk . (.Tracker Software Products (Canada) Ltd. - PDF-XChange Viewer.) -- C:\Program Files\Tracker Software\PDF Viewer\PDFXCview.exe
O4 - GS\Desktop [Public]: PowerISO.lnk . (.Power Software Ltd - PowerISO.) -- D:\Program Files\PowerISO\PowerISO.exe
O4 - GS\Program [Public]: Opera.lnk . (.Opera Software - Opera Internet Browser.) -- C:\Program Files\Opera\launcher.exe
O4 - GS\QuickLaunch [Asus]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Asus]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch [Asus]: PC Optimizer Pro.lnk . (...) -- C:\Program Files\PC Optimizer Pro\PCOptimizerPro.exe (.not file.) =>PUP.OptimizerPro
O4 - GS\QuickLaunch [Asus]: Update Detector.lnk . (.Filepuma International - Update Detector.) -- C:\Program Files\Update Detector\UpdateDetector.exe
O4 - GS\QuickLaunch [Asus]: Viber.lnk . (...) -- C:\Users\Asus\AppData\Local\Viber\Viber.exe
O4 - GS\QuickLaunch [Asus]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Asus\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\TaskBar [Asus]: Internet Explorer (2).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [Asus]: Internet Explorer (3).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [Asus]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [Asus]: Magnify.lnk . (.Microsoft Corporation - Loupe Microsoft.) -- C:\windows\system32\magnify.exe
O4 - GS\TaskBar [Asus]: On-Screen Keyboard.lnk . (.Microsoft Corporation - Accessibilité au Clavier visuel.) -- C:\windows\system32\osk.exe
O4 - GS\TaskBar [Asus]: Opera.lnk . (.Opera Software - Opera Internet Browser.) -- C:\Program Files\Opera\launcher.exe
O4 - GS\TaskBar [Asus]: Viber.lnk . (...) -- C:\Users\Asus\AppData\Local\Viber\Viber.exe
O4 - GS\TaskBar [Asus]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Asus\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\Program [Asus]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Program [Asus]: Songr.lnk . (.Xamasoft - Songr.) -- C:\Users\Asus\AppData\Local\Songr\Songr.exe
O4 - GS\Program [Asus]: Update Detector.lnk . (.Filepuma International - Update Detector.) -- C:\Program Files\Update Detector\UpdateDetector.exe
O4 - GS\Program [Asus]: Viber.lnk . (...) -- C:\Users\Asus\AppData\Local\Viber\Viber.exe
O4 - GS\SystemTools [Asus]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Asus]: Cain.lnk . (.oxid.it - Cain - Password Recovery Utility.) -- C:\Program Files\Cain\Cain.exe
O4 - GS\Desktop [Asus]: CVitae V4.lnk . (...) -- C:\Program Files\CVitaeV4\CVitae.exe
O4 - GS\Desktop [Asus]: Lanceur d'applications Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [Asus]: Le Petit Robert.lnk . (...) -- C:\Program Files\Le Robert\Le Petit Robert 2014\Le Petit Robert.exe
O4 - GS\Desktop [Asus]: Mobogenie.lnk . (...) -- C:\Program Files\Mobogenie\Mobogenie.exe =>PUP.Mobogenie
O4 - GS\Desktop [Asus]: PDF-Viewer.lnk . (.Tracker Software Products (Canada) Ltd. - PDF-XChange Viewer.) -- C:\Program Files\Tracker Software\PDF Viewer\PDFXCview.exe
O4 - GS\Desktop [Asus]: RM.lnk . (.www.moofdev.net - Ratio Master.) -- D:\Program Files\RatioMaster-1.9.1\RM.exe
O4 - GS\Desktop [Asus]: Songr.lnk . (.Xamasoft - Songr.) -- C:\Users\Asus\AppData\Local\Songr\Songr.exe
O4 - GS\Desktop [Asus]: StreamTorrent 1.0.lnk . (.StreamTorrent - StreamTorrent Media Player.) -- D:\Program Files\StreamTorrent 1.0\StreamTorrent.exe
O4 - GS\Desktop [Asus]: Youtube Downloader HD.lnk . (...) -- C:\Program Files\Youtube Downloader HD\YouTubeDownloaderHD.exe =>PUP.Dealio
O4 - GS\Desktop [Asus]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Asus\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
~ Global Startup: 105 Legitimates Filtered in 00mn 47s
---\\ Applications lancées au démarrage du sytème (O4)
O4 - GS\Startup [Public]: AsusVibeLauncher.lnk . (.ASUSTeK Computer Inc. - AsusVibe Application.) -- C:\Program Files\ASUS\AsusVibe\AsusVibeLauncher.exe
O4 - GS\Startup [Public]: Ralink Wireless Utility.lnk . (.Ralink Technology, Corp. - Ralink Wireless LAN Card Utility.) -- C:\Program Files\Ralink\Common\RaUI.exe
O4 - GS\Startup [Asus]: Dropbox.lnk . (.Dropbox, Inc. - Dropbox.) -- C:\Users\Asus\AppData\Roaming\Dropbox\bin\Dropbox.exe =>.Dropbox
O4 - GS\Startup [Asus]: Envoyer à OneNote.lnk . (.Microsoft Corporation - Send to OneNote Tool.) -- C:\Program Files\Microsoft Office\Office15\ONENOTEM.exe
O4 - HKLM\..\Run: [Eee Docking] . (.Pas de propriétaire - Eee Docking Application.) -- C:\Program Files\ASUS\Eee Docking\Eee Docking.exe
O4 - HKLM\..\Run: [Boingo Wi-Fi] . (...) -- C:\Program Files\Boingo\Boingo Wi-Fi\Boingo.lnk
O4 - HKLM\..\Run: [ASUSPRP] . (.ASUSTek Computer Inc. - ASUS Product Register Program.) -- C:\Program Files\ASUS\APRP\APRP.exe
O4 - HKLM\..\Run: [SynAsusAcpi] . (.Synaptics Incorporated - Asus Custom Acpi Monitor Application.) -- C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] . (.Adobe Systems Incorporated - Adobe Updater Startup Utility.) -- C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Run: [KiesTrayAgent] . (.Samsung Electronics Co., Ltd. - Kies TrayAgent Application.) -- C:\Program Files\Samsung\Kies\KiesTrayAgent.exe =>.Samsung Electronics Co
O4 - HKLM\..\Run: [mobilegeni daemon] . (...) -- C:\Program Files\Mobogenie\DaemonProcess.exe =>PUP.Mobogenie
O4 - HKLM\..\Run: [PWRISOVM.EXE] . (.Power Software Ltd - PowerISO Virtual Drive Manager.) -- D:\Program Files\PowerISO\PWRISOVM.exe
O4 - HKLM\..\Run: [AVG_UI] . (.AVG Technologies CZ, s.r.o. - AVG User Interface.) -- C:\Program Files\AVG\AVG2013\avgui.exe
O4 - HKLM\..\Run: [SynTPEnh] . (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IAStorIcon] . (.Intel Corporation - IAStorIcon.) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [WheelMouse] . (.Pas de propriétaire - Mouse Start Program.) -- C:\Advanced Wheel Mouse\wh_exec.exe
O4 - HKCU\..\Run: [Akamai NetSession Interface] . (...) -- C:\Users\Asus\AppData\Local\Akamai\netsession_win.exe
O4 - HKCU\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe =>Toolbar.Google
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Users\Asus\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKCU\..\Run: [KiesPreload] . (.Samsung - Kies.) -- C:\Program Files\Samsung\Kies\Kies.exe
O4 - HKCU\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- D:\Program Files\Internet Download Manager\IDMan.exe
O4 - HKCU\..\Run: [uTorrent] . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Asus\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - HKUS\.DEFAULT\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-18\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2093371556-3351502057-3444359280-1000\..\Run: [Akamai NetSession Interface] . (...) -- C:\Users\Asus\AppData\Local\Akamai\netsession_win.exe
O4 - HKUS\S-1-5-21-2093371556-3351502057-3444359280-1000\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe =>Toolbar.Google
O4 - HKUS\S-1-5-21-2093371556-3351502057-3444359280-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2093371556-3351502057-3444359280-1000\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Users\Asus\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKUS\S-1-5-21-2093371556-3351502057-3444359280-1000\..\Run: [KiesPreload] . (.Samsung - Kies.) -- C:\Program Files\Samsung\Kies\Kies.exe
O4 - HKUS\S-1-5-21-2093371556-3351502057-3444359280-1000\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- D:\Program Files\Internet Download Manager\IDMan.exe
O4 - HKUS\S-1-5-21-2093371556-3351502057-3444359280-1000\..\Run: [uTorrent] . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Asus\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
~ Application: Scanned in 00mn 03s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office15\ONBttnIE.dll =>.Microsoft Corporation
O9 - Extra button: Cliquer pour appeler Lync - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} . (.Microsoft Corporation - Microsoft Lync.) -- C:\Program Files\Microsoft Office\Office15\lync.exe
O9 - Extra button: Notes &liées OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office15\ONBTTN~1.dll =>.Microsoft Corporation
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} ((no name)) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} ((no name)) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
~ Objets ActiveX: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{4DF4E8BB-8691-4413-B233-037B57B0DB8C}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{FFEB3A24-266C-4D94-8F2B-8644F3FED41E}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{4DF4E8BB-8691-4413-B233-037B57B0DB8C}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{FFEB3A24-266C-4D94-8F2B-8644F3FED41E}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{4DF4E8BB-8691-4413-B233-037B57B0DB8C}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{FFEB3A24-266C-4D94-8F2B-8644F3FED41E}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 03s
---\\ Protocole additionnel (O18)
O18 - Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (.Microsoft Corporation - Windows Live Album Download Protocol Handle.) -- C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Asus Launcher Service (AsusService) . (...) - C:\Windows\System32\AsusService.exe
O23 - Service: Util BrowseFox (Util BrowseFox) . (...) - C:\Program Files\BrowseFox\bin\utilBrowseFox.exe (.not file.) =>Adware.BrowseFox
O23 - Service: (vToolbarUpdater15.4.0) . (...) - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe (.not file.) =>Toolbar.AVGSearch
~ Services: 12 Legitimates Filtered in 00mn 38s
---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\DriverEasy Scheduled Scan.job [404]
[MD5.00000000000000000000000000000000] [APT] [{3E47B51D-EBF1-44C8-90D7-2F23BB2F7AAA}] (...) -- G:\PrinterShare2306.exe (.not file.) [0]
[MD5.33B59A48C1810F7BBFA66D73CF66C611] [APT] [{42BD7D24-A2CD-4A21-9BC6-E5D62918AB79}] (.Opera Software.) -- c:\program files\opera\launcher.exe [1598304]
[MD5.00000000000000000000000000000000] [APT] [{A9D520E8-BE58-40FC-8AD7-DD1352F9F3F2}] (...) -- C:\Users\Asus\Desktop\Logiciels\ZHPDiag2.exe (.not file.) [0]
~ Scheduled Task: 24 Legitimates Filtered in 00mn 58s
---\\ Logiciels installés (O42)
O42 - Logiciel: Advanced Wheel Mouse 6.0.0.010 - (...) [HKLM] -- WheelMouse
O42 - Logiciel: Akamai NetSession Interface Service - (...) [HKLM] -- Akamai
O42 - Logiciel: PrinterShare 2.3.06 - (.Printer Anywhere Inc..) [HKLM] -- {7239791B-F20F-4816-8AC3-89AB8A1AEDA6}
O42 - Logiciel: Spyome 1.15 - (.Morillon Alain.) [HKLM] -- Spyome_is1
O42 - Logiciel: StreamTorrent 1.0 - (...) [HKLM] -- StreamTorrent 1.0
O42 - Logiciel: Youtube to MP3 Converter v. 1.4 - (.YoutubeDownloaderHD.com.) [HKLM] -- Youtube to MP3 Converter_is1 =>PUP.SoftwareEngine
O42 - Logiciel: savEnshare a - (.saVensHarue.) [HKLM] -- {62D82EC1-0D3A-DF54-8E3E-07E1337A5311}
~ Logic: 23 Legitimates Filtered in 00mn 09s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\DC3_FEXEC] =>Trojan.Trojan.Fynloski
[HKCU\Software\IncrediMail]
[HKCU\Software\JC]
[HKCU\Software\MaxRecorder]
[HKCU\Software\PCRemote]
[HKCU\Software\PrinterShare]
[HKCU\Software\SPYOME-AGENT]
[HKLM\Software\IO3O]
[HKLM\Software\IncrediMail]
[HKLM\Software\JC]
[HKLM\Software\MaxRecorder]
[HKLM\Software\Vonteera] =>Trojan.Trojan.Vonteera
[HKLM\Software\Vontera]
~ Key Software: 324 Legitimates Filtered in 00mn 09s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 21/07/2013 - 16:12:47 - [0,075] ----D C:\Program Files\CHRYOPROD
O43 - CFD: 16/02/2014 - 22:23:16 - [0] ----D C:\Program Files\Magic Memory Optimizer
O43 - CFD: 01/01/2014 - 20:44:59 - [0] ----D C:\Program Files\Portable
O43 - CFD: 30/03/2013 - 11:13:01 - [1,283] ----D C:\Program Files\PrinterShare
O43 - CFD: 22/03/2013 - 16:45:27 - [6,376] ----D C:\Program Files\Spyome
O43 - CFD: 25/12/2013 - 09:04:10 - [1,872] ----D C:\Program Files\Update Detector
O43 - CFD: 22/08/2013 - 04:04:11 - [0,002] ----D C:\Program Files\VonteeraAddon =>Trojan.Trojan.Vonteera
O43 - CFD: 13/10/2013 - 23:43:47 - [5,138] ----D C:\Program Files\Youtube to MP3 Converter
O43 - CFD: 22/08/2013 - 03:54:44 - [4,725] ----D C:\ProgramData\InstallMate =>PUP.Tarma
O43 - CFD: 30/03/2013 - 00:08:08 - [0] ----D C:\ProgramData\PrinterShare
O43 - CFD: 22/03/2013 - 16:45:45 - [5,605] ----D C:\ProgramData\spyome
O43 - CFD: 15/08/2013 - 09:26:26 - [0] ----D C:\ProgramData\SuperClearCookies
O43 - CFD: 15/08/2013 - 09:27:35 - [0] ----D C:\ProgramData\SuperClearHistory
O43 - CFD: 06/01/2014 - 22:58:18 - [0] -SH-D C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
O43 - CFD: 29/12/2013 - 11:17:15 - [0] --H-D C:\Users\Asus\AppData\Roaming\DataWork
O43 - CFD: 15/02/2014 - 08:23:19 - [1,228] ----D C:\Users\Asus\AppData\Roaming\newnext.me =>PUP.NextLive
O43 - CFD: 15/08/2013 - 09:26:26 - [0] ----D C:\Users\Asus\AppData\Roaming\SuperClearCookies
O43 - CFD: 15/08/2013 - 09:27:35 - [0] ----D C:\Users\Asus\AppData\Roaming\SuperClearHistory
O43 - CFD: 13/10/2013 - 23:44:03 - [0] ----D C:\Users\Asus\AppData\Roaming\Youtube to MP3 Converter
O43 - CFD: 15/12/2013 - 12:56:54 - [1,224] ----D C:\Users\Asus\AppData\Local\genienext
O43 - CFD: 11/08/2013 - 12:56:45 - [0,002] ----D C:\Users\Asus\AppData\Local\MaxRecorder
O43 - CFD: 31/12/2013 - 00:21:43 - [0,001] ----D C:\Users\Asus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Advanced Wheel Mouse
O43 - CFD: 22/03/2013 - 16:45:29 - [0,002] ----D C:\Users\Asus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SPYOME
O43 - CFD: 14/08/2013 - 00:58:33 - [0,001] ----D C:\Users\Asus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StreamTorrent 1.0
O43 - CFD: 25/12/2013 - 09:04:10 - [0,003] ----D C:\Users\Asus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Detector
~ Program Folder: 260 Legitimates Filtered in 07mn 17s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.2465EBC8CD6E412CDC1AB9FEF40BCAE6] - 11/02/2014 - 03:30:38 ---A- . (...) -- C:\Windows\win.ini [478]
O44 - LFC:[MD5.033A41B09406E93EFD6823CD31CD15FB] - 20/02/2014 - 15:47:41 ---A- . (...) -- C:\Windows\IE11_main.log [41640]
O44 - LFC:[MD5.24F026DEA5FBF0C0DC854712387972DE] - 20/02/2014 - 17:01:04 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [16160]
O44 - LFC:[MD5.24F026DEA5FBF0C0DC854712387972DE] - 20/02/2014 - 17:01:04 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [16160]
~ Files: 60 Legitimates Filtered in 02mn 35s
---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.48C433C22F1ED3E268E3592F3876B355] - 02/02/2014 - 14:14:18 ---A- - C:\Windows\Prefetch\SRSERVICE.EXE-1327EC2A.pf
O45 - LFCP:[MD5.D4EB3EE646EDEB6640916673CCAF6086] - 11/02/2014 - 09:58:46 ---A- - C:\Windows\Prefetch\LIVETUNER.EXE-A259B20D.pf
O45 - LFCP:[MD5.A4E9B9BEB7EB837CE2311FC06591BA40] - 15/02/2014 - 08:16:42 ---A- - C:\Windows\Prefetch\SRFEATURE.EXE-81CB1699.pf
O45 - LFCP:[MD5.0C2597D50AA63645148CAE4F1FB75E06] - 15/02/2014 - 08:16:53 ---A- - C:\Windows\Prefetch\SRSERVER.EXE-175D3310.pf
O45 - LFCP:[MD5.45108F8DBB8B50AA43E08F856C6D0758] - 15/02/2014 - 09:00:04 ---A- - C:\Windows\Prefetch\HDVID CODEC V1-CODEDOWNLOADER-3AF29134.pf =>PUP.HDVidCodec
O45 - LFCP:[MD5.24C90A539028DF5C05B5A2939250821B] - 16/02/2014 - 20:09:01 ---A- - C:\Windows\Prefetch\IDMUPDT.EXE-07D75D51.pf
O45 - LFCP:[MD5.8EA878096F077DBFEC1DB30DE00BDE14] - 16/02/2014 - 20:09:18 ---A- - C:\Windows\Prefetch\IDM1.TMP-DBBAD2B9.pf
O45 - LFCP:[MD5.E90232D13F9BB88F3DF921A0282FA439] - 16/02/2014 - 20:11:18 ---A- - C:\Windows\Prefetch\MEDIUMILSTART.EXE-66C58623.pf
O45 - LFCP:[MD5.BB3367F733BA738FB4666869611D88E3] - 16/02/2014 - 21:48:01 ---A- - C:\Windows\Prefetch\CORELCREATORSV.EXE-D2AC60EB.pf
O45 - LFCP:[MD5.BFB652727AA8A288D021F569E57713AC] - 16/02/2014 - 21:59:43 ---A- - C:\Windows\Prefetch\RTHDVBG.EXE-A764F421.pf
O45 - LFCP:[MD5.B2C1395573856B539D81CA644C5E3A32] - 16/02/2014 - 22:00:31 ---A- - C:\Windows\Prefetch\PWRISOVM.EXE-60147F8E.pf
O45 - LFCP:[MD5.ECE29E286072AB48EB294C09BAF56971] - 16/02/2014 - 22:00:31 ---A- - C:\Windows\Prefetch\WH_EXEC.EXE-10A1A889.pf
O45 - LFCP:[MD5.8FA9AF8F8606213C5E607B342C265D43] - 18/02/2014 - 19:29:02 ---A- - C:\Windows\Prefetch\RAUI.EXE-AA314F44.pf
O45 - LFCP:[MD5.0F000798BE307D1C89BE1721F753701E] - 20/02/2014 - 17:22:03 ---A- - C:\Windows\Prefetch\MGUSB.EXE-03B14200.pf
~ Prefetcher: 118 Legitimates Filtered in 00mn 07s
---\\ Clé de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{6e146077-b185-11e2-b733-20cf3060074a}\AutoRun\command. (...) -- E:\autorun.exe (.not file.)
O51 - MPSK:{6e146093-b185-11e2-b733-20cf3060074a}\AutoRun\command. (...) -- G:\autorun.exe (.not file.)
~ Keys: Scanned in 48mn 46s
---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 19 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.548CCBD8B48FDF7E2435AD6017920A7F] - 08/10/2012 - 19:53:56 ---A- . (.Wondershare - Wondershare Virtual Audio Device.) -- C:\Windows\System32\Drivers\Apowersoft_AudioDevice.sys [26080]
O58 - SDL:[MD5.A9A565C669786C402752F609AFDD0DD5] - 09/02/2011 - 14:03:00 ---A- . (...) -- C:\Windows\System32\Drivers\AsUpIO.sys [11832]
O58 - SDL:[MD5.B6B5566B24329432E0FD1E4ED15A683B] - 06/03/1999 - 12:38:28 ---A- . (...) -- C:\Windows\System32\Drivers\ASUSHWIO.SYS [6144]
O58 - SDL:[MD5.BDDE322DD3E6ABBC589C5DC8A948A661] - 29/08/2008 - 17:54:40 ---A- . (.Mobile Connector - USB/Serial Device Driver.) -- C:\Windows\System32\Drivers\cmusbser.sys [103552]
O58 - SDL:[MD5.30384865C9AF82DB291E5C4F468E1AC6] - 29/08/2012 - 18:46:12 ---A- . (.Windows (R) Win 7 DDK provider - Explore Systems Virtual Audio Device.) -- C:\Windows\System32\Drivers\dfx11_1.sys [24424]
O58 - SDL:[MD5.0ED67910C8C326796FAA00B2BF6D9D3C] - 14/07/2009 - 02:20:28 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [453712]
O58 - SDL:[MD5.C44E3C2BAB6837DB337DDEE7544736DB] - 13/07/2009 - 23:54:14 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [26624]
O58 - SDL:[MD5.203BB2691E7D0088A2C1F9C39C15A9B7] - 28/11/2013 - 01:24:18 ---A- . (.Tonec Inc. - Internet Download Manager WFP Driver.) -- C:\Windows\System32\Drivers\idmwfp.sys [108000]
O58 - SDL:[MD5.3EB803312987FF44265C87CB960DF6AB] - 13/04/2010 - 03:36:12 ---A- . (.Pas de propriétaire - Keyboard Filter Driver.) -- C:\Windows\System32\Drivers\kbfiltr.sys [13880]
O58 - SDL:[MD5.EDF7F8387C2072205ABCF105F14B13B4] - 28/10/2013 - 01:12:12 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG USB Composite Device Driver (MSS Ver.3).) -- C:\Windows\System32\Drivers\ssudbus.sys [87064]
O58 - SDL:[MD5.24F5F92263E3B461A1105FE370D53D1C] - 28/10/2013 - 01:12:12 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG Android Modem Device Driver (MSS Ver.3).) -- C:\Windows\System32\Drivers\ssudmdm.sys [182680]
O58 - SDL:[MD5.DB32D325C192B801DF274BFD12A7E72B] - 14/07/2009 - 02:19:04 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [21072]
O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 13/07/2009 - 22:40:41 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029]
O58 - SDL:[MD5.0FE9F16075C9ACB941C957B7C649176E] - 13/07/2009 - 22:40:44 ---A- . (...) -- C:\Windows\System32\country.sys [27097]
O58 - SDL:[MD5.E6BC0F98FECEF245A0010D350C1A0B9B] - 13/07/2009 - 22:40:40 ---A- . (...) -- C:\Windows\System32\HIMEM.SYS [4768]
O58 - SDL:[MD5.492090267B9608C62B956CD29BE3AFB7] - 13/07/2009 - 22:40:43 ---A- . (...) -- C:\Windows\System32\KEY01.SYS [42809]
O58 - SDL:[MD5.FBBCFEC1379C5C02D88A361993EDF1B8] - 13/07/2009 - 22:40:43 ---A- . (...) -- C:\Windows\System32\KEYBOARD.SYS [42537]
O58 - SDL:[MD5.FFFF296A08DBF2AC0126C62E3778AC0D] - 13/07/2009 - 22:40:23 ---A- . (...) -- C:\Windows\System32\NTDOS.SYS [27866]
O58 - SDL:[MD5.CF9ED169FF86D935E47999E82359E898] - 13/07/2009 - 22:40:31 ---A- . (...) -- C:\Windows\System32\NTDOS404.SYS [29146]
O58 - SDL:[MD5.03B945AC0481CD8BB161C3569D8ED1C3] - 13/07/2009 - 22:40:35 ---A- . (...) -- C:\Windows\System32\NTDOS411.SYS [29370]
O58 - SDL:[MD5.BBC957DC18C17CC027EB80B7C77F2AEA] - 13/07/2009 - 22:40:39 ---A- . (...) -- C:\Windows\System32\NTDOS412.SYS [29274]
O58 - SDL:[MD5.3CFFAEFFF23B0D208214A6D3061A5B1B] - 13/07/2009 - 22:40:27 ---A- . (...) -- C:\Windows\System32\NTDOS804.SYS [29146]
O58 - SDL:[MD5.2E4112FB7D1B76E11ADFD7487B5D0E95] - 13/07/2009 - 22:40:11 ---A- . (...) -- C:\Windows\System32\NTIO.SYS [33952]
O58 - SDL:[MD5.A98EBD4C2DF983665BF2D1AF49949974] - 13/07/2009 - 22:40:15 ---A- . (...) -- C:\Windows\System32\NTIO404.SYS [34672]
O58 - SDL:[MD5.3F7E6406EDEF197C5CAAB2240EEF6F48] - 13/07/2009 - 22:40:17 ---A- . (...) -- C:\Windows\System32\NTIO411.SYS [35776]
O58 - SDL:[MD5.3E64D681B776CC57BDC38A46D881F85B] - 13/07/2009 - 22:40:19 ---A- . (...) -- C:\Windows\System32\NTIO412.SYS [35536]
O58 - SDL:[MD5.D86B6435729231C171432B4E77801BDB] - 13/07/2009 - 22:40:13 ---A- . (...) -- C:\Windows\System32\NTIO804.SYS [34672]
~ Drivers: 19 Legitimates Filtered in 00mn 50s
---\\ Fichiers Alternate Data Stream (ADS) (O62)
O62 - ADS:Alternate Data Stream File - C:\Windows\System32\?;?:lotserviceruntime.log
~ ADS: Scanned in 00mn 21s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <OperaStable>[HKLM\..\open\Command] (.Opera Software - Opera Internet Browser.) -- C:\Program Files\Opera\Launcher.exe
O67 - Shell Spawning: <.html> <OperaStable>[HKCU\..\open\Command] (.Opera Software - Opera Internet Browser.) -- C:\Program Files\Opera\Launcher.exe
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: <OperaStable> <Opera Stable>[HKLM\..\Shell\open\Command] (.Opera Software - Opera Internet Browser.) -- C:\Program Files\Opera\Launcher.exe
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {756D1D40-E491-4E1D-9BC6-5B37CEDE646E} - (VenteeRo) - http://ww12.arabyonline.com
~ Keys: Scanned in 00mn 00s
---\\ Enumère les fichiers Crack & Keygen (CKF) (O82)
C:\Users\Asus\AppData\Local\CrashDumps\keygen.exe.7836.dmp
C:\Users\Asus\AppData\Roaming\uTorrent\Folder Lock Pro 8.3.1 Setup + Keygen.rar.1.torrent =>P2P.µTorrent
C:\Users\Asus\AppData\Roaming\uTorrent\Folder Lock Pro 8.3.1 Setup + Keygen.rar.torrent =>P2P.µTorrent
C:\Users\Asus\AppData\Roaming\uTorrent\Simple Adblock 1.0.2 Keygen Generator.rar.torrent =>P2P.µTorrent
C:\Users\Asus\AppData\Local\CrashDumps\keygen.exe.7836.dmp
C:\Users\Asus\AppData\Roaming\uTorrent\Folder Lock Pro 8.3.1 Setup + Keygen.rar.1.torrent =>P2P.µTorrent
C:\Users\Asus\AppData\Roaming\uTorrent\Folder Lock Pro 8.3.1 Setup + Keygen.rar.torrent =>P2P.µTorrent
C:\Users\Asus\AppData\Roaming\uTorrent\Simple Adblock 1.0.2 Keygen Generator.rar.torrent =>P2P.µTorrent
~ Files: Scanned in 01mn 23s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.0D3B680986310AE5540578C0E481C6A0] [SPRF][02/03/2010] (...) -- C:\ProgramData\FullRemove.exe [131984]
[MD5.86F3AE507BEA5CA9F9C45E6133699C3B] [SPRF][17/08/2013] (...) -- C:\ProgramData\ntuser.dat [262144]
[MD5.128D9E5E68BF9CB4767ECE772267D92D] [SPRF][10/03/2011] (.Serials Founder 2007 - Serials Founder 2007.) -- C:\Users\Asus\Desktop\Serials.Founder.exe [102400]
[MD5.BC1C264165EC26EDA413024AE079341E] [SPRF][14/09/2013] (...) -- C:\Users\Asus\Desktop\Shortcut Virus Remover v3.1.exe [806717]
~ Files: 5 Legitimates Filtered in 00mn 00s
---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{73F05034-BA47-4EF4-8473-1040A5096596}" | In - Private - P6 - TRUE | .(...) -- C:\Users\Asus\AppData\Local\Akamai\netsession_win.exe
O87 - FAEL: "{8DFFEB02-5090-4093-9CDA-1F375B6F9F22}" | In - Private - P17 - TRUE | .(...) -- C:\Users\Asus\AppData\Local\Akamai\netsession_win.exe
O87 - FAEL: "TCP Query User{25E8114C-66F6-4C9B-895E-944620CA5657}C:\users\asus\appdata\local\akamai\netsession_win.exe" | In - Public - P6 - TRUE | .(...) -- C:\users\asus\appdata\local\akamai\netsession_win.exe
O87 - FAEL: "UDP Query User{0049F431-7512-4596-BCFE-A05546BC856E}C:\users\asus\appdata\local\akamai\netsession_win.exe" | In - Public - P17 - TRUE | .(...) -- C:\users\asus\appdata\local\akamai\netsession_win.exe
O87 - FAEL: "{4BF97550-7BF6-493B-A6BA-B853FD8D9591}" |In - Public - P6 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.)
O87 - FAEL: "{CF1B6C71-77C1-4908-9A12-D1752D69A77C}" |In - Public - P17 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.)
O87 - FAEL: "TCP Query User{0D19C50E-4D4B-4C85-970F-8510334054FC}C:\program files\printershare\paconsole.exe" | In - Private - P6 - TRUE | .(.PrinterAnywhere - PrinterAnywhere Console.) -- C:\program files\printershare\paconsole.exe
O87 - FAEL: "UDP Query User{C56175E0-D680-456C-B378-A7785C9FE9B3}C:\program files\printershare\paconsole.exe" | In - Private - P17 - TRUE | .(.PrinterAnywhere - PrinterAnywhere Console.) -- C:\program files\printershare\paconsole.exe
O87 - FAEL: "TCP Query User{DA6B3FA1-0709-41EB-9B89-45FB1057B8F2}C:\program files\printershare\paconsole.exe" | In - Public - P6 - TRUE | .(.PrinterAnywhere - PrinterAnywhere Console.) -- C:\program files\printershare\paconsole.exe
O87 - FAEL: "UDP Query User{46F155A0-F6C5-4D00-B0DD-00E160C0F16A}C:\program files\printershare\paconsole.exe" | In - Public - P17 - TRUE | .(.PrinterAnywhere - PrinterAnywhere Console.) -- C:\program files\printershare\paconsole.exe
O87 - FAEL: "TCP Query User{8279283F-7CE3-4368-B5EF-6AA9D7777172}C:\users\asus\appdata\roaming\cacaoweb\cacaoweb.exe" |In - Private - P6 - TRUE | .(...) -- C:\users\asus\appdata\roaming\cacaoweb\cacaoweb.exe (.not file.) =>PUP.CacaoWeb
O87 - FAEL: "UDP Query User{D6E21D5B-D99A-4D5B-935F-BF12D1A2E608}C:\users\asus\appdata\roaming\cacaoweb\cacaoweb.exe" |In - Private - P17 - TRUE | .(...) -- C:\users\asus\appdata\roaming\cacaoweb\cacaoweb.exe (.not file.) =>PUP.CacaoWeb
O87 - FAEL: "{7B0CD378-D384-4810-AD6E-D1058F6D3A95}" |In - Public - P17 - TRUE | .(...) -- C:\users\asus\appdata\roaming\cacaoweb\cacaoweb.exe (.not file.) =>PUP.CacaoWeb
O87 - FAEL: "{21CB4E45-B1C1-4115-8767-DB0081AED016}" |In - Public - P6 - TRUE | .(...) -- C:\users\asus\appdata\roaming\cacaoweb\cacaoweb.exe (.not file.) =>PUP.CacaoWeb
~ Firewall: 216 Legitimates Filtered in 00mn 06s
---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "44D1C85F9CA48E840994A7C6FDBC14C5" . (.LocaleMe.) -- C:\windows\Installer\{F58C1D44-4AC9-48E8-9049-7A6CDFCB415C}\ARPPRODUCTICON.exe
~ Update Products: 90 Legitimates Filtered in 00mn 02s
---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.729A96719811141F5DEFBEF91DDDE86E] [WIS][08/09/2011] (.Printer Anywhere Inc. - PrinterShare Installation package.) -- C:\Windows\Installer\8ce60.msi [2217984]
~ WIS: 93 Legitimates Filtered in 00mn 57s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 11/02/2014 257928 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 10/07/1658 0 | (CorelCreatorMessages) . (...) - C:\windows\system32\CorelCreatorMessages.exe
SS - | Auto 30/03/2011 135664 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 30/03/2011 135664 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 11/10/2012 194032 | (gusvc) . (.Google.) - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Auto 06/07/2012 1863680 | (RaMediaServer) . (.Ralink.) - C:\Program Files\Ralink\Common\RaMediaServer.exe
SS - | Auto 05/09/2013 171680 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe
SS - | Auto 10/07/1658 0 | (TuneUp.UtilitiesSvc) . (...) - C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe
SS - | Auto 10/07/1658 0 | (Util BrowseFox) . (...) - C:\Program Files\BrowseFox\bin\utilBrowseFox.exe =>Adware.BrowseFox
SS - | Auto 10/07/1658 0 | (vToolbarUpdater15.4.0) . (...) - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe =>Toolbar.AVGSearch
SR - | Auto 05/09/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 14/07/2009 20992 | c:\program files\common files\akamai\netsession_win_8fa3539.dll (Akamai) . (.Akamai Technologies, Inc..) - C:\Windows\System32\svchost.exe
SR - | Auto 22/03/2012 24645 | (Apache2.2) . (.Apache Software Foundation.) - C:\Program Files\Spyome\apache\bin\httpd.exe
SR - | Auto 19/08/2009 219136 | (AsusService) . (...) - C:\Windows\System32\AsusService.exe
SR - | Auto 23/10/2013 1432080 | (avgfws) . (.AVG Technologies CZ, s.r.o..) - C:\Program Files\AVG\AVG2013\avgfws.exe
SR - | Auto 04/07/2013 4939312 | (AVGIDSAgent) . (.AVG Technologies CZ, s.r.o..) - C:\Program Files\AVG\AVG2013\avgidsagent.exe
SR - | Auto 20/11/2013 283136 | (avgwd) . (.AVG Technologies CZ, s.r.o..) - C:\Program Files\AVG\AVG2013\avgwdsvc.exe
SR - | Auto 29/11/2011 13592 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
SR - | Auto 14/07/2009 20992 | C:\windows\system32\HPZinw12.dll (Net Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe
SR - | Auto 14/07/2009 20992 | C:\windows\system32\HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe
SR - | Auto 26/06/2013 391472 | (RalinkRegistryWriter) . (.Ralink Technology, Corp..) - C:\Program Files\Ralink\Common\RaRegistry.exe
SR - | Auto 13/12/2437 250072 | (RtkAudioService) . (.Realtek Semiconductor.) - C:\Program Files\Realtek\Audio\HDA\RtkAudioService.exe
SR - | Auto 14/07/2009 20992 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 14/07/2009 20992 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 01mn 26s
---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
~ MBR: 1 Legitimates Filtered in 00mn 02s
---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Asus at 20/02/2014 18:20:14
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 04s
---\\ Scan Additionnel (O88)
Database Version : 13031 - (17/02/2014)
Clés trouvées (Keys found) : 14
Valeurs trouvées (Values found) : 3
Dossiers trouvés (Folders found) : 5
Fichiers trouvés (Files found) : 3
[HKLM\SYSTEM\CurrentControlSet\Services\Util BrowseFox] =>Adware.BrowseFox^
[HKLM\SYSTEM\CurrentControlSet\Services\vToolbarUpdater15.4.0] =>Toolbar.AVGSearch^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Youtube to MP3 Converter_is1] =>PUP.SoftwareEngine^
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{27100E88-8830-44ED-9D6A-CA24F3523F39}] =>Toolbar.Agent
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{493CCB71-DCAD-4257-9F08-8750F63BD792}] =>Toolbar.Agent
[HKCU\Software\DC3_FEXEC] =>Trojan.Fynloski
[HKLM\Software\Classes\AppID\VONTEERA.DLL] =>Trojan.Vonteera
[HKLM\Software\Microsoft\Tracing\BingBar_RASAPI32] =>Toolbar.Bing
[HKLM\Software\Classes\AppID\{D651E893-3D08-458D-A242-0E6B862E6507}] =>Hijacker.Alnaddy
[HKLM\Software\AVG SafeGuard toolbar] =>Toolbar.AVGSafeGuard
[HKCU\Software\AppDataLow\Software\TelevisionFanaticEI] =>PUP.TelevisionFanatic
[HKLM\Software\TelevisionFanaticEI] =>PUP.TelevisionFanatic
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{62D82EC1-0D3A-DF54-8E3E-07E1337A5311}] =>Adware.SaveShare
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311431162}] =>PUP.CrossRider
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{2318C2B1-4965-11d4-9B18-009027A5CD4F} =>Toolbar.Google^
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:mobilegeni daemon =>PUP.Mobogenie^
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:swg =>Toolbar.Google^
C:\Program Files\VonteeraAddon =>Trojan.Trojan.Vonteera^
C:\ProgramData\InstallMate =>PUP.Tarma^
C:\Users\Asus\AppData\Roaming\newnext.me =>PUP.NextLive^
C:\Users\Asus\AppData\LocalLow\SearchNewTab =>Adware.FastSaveApp
C:\Users\Asus\AppData\LocalLow\searchcoretoolbar =>Adware.Bandoo
C:\Program Files\Mobogenie\DaemonProcess.exe =>PUP.Mobogenie^
C:\Program Files\Mobogenie\mgusb.exe =>PUP.Mobogenie^
[HKLM\Software\Vonteera] =>Trojan.Trojan.Vonteera^
~ Additionnel Scan: 263715 Items scanned in 02mn 58s
---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com/apps/blog/show/41034005-pup-mobogenie =>PUP.Mobogenie
~ http://nicolascoolman.webs.com/apps/blog/show/28204239-pup-optimizerpro =>PUP.OptimizerPro
~ http://nicolascoolman.webs.com/apps/blog/show/27443462-pup-dealio =>PUP.Dealio
~ http://nicolascoolman.webs.com/apps/blog/show/32363262-adware-browsefox =>Adware.BrowseFox
~ http://nicolascoolman.webs.com/apps/blog/show/29758660-pup-softwareengine =>PUP.SoftwareEngine
~ http://nicolascoolman.webs.com/apps/blog/show/32240257-trojan-fynloski =>Trojan.Fynloski
~ http://nicolascoolman.webs.com/apps/blog/show/31951367-trojan-vonteera =>Trojan.Vonteera
~ http://nicolascoolman.webs.com/apps/blog/show/29637859-toolbar-tarma =>PUP.Tarma
~ http://nicolascoolman.webs.com/apps/blog/show/40528410-pup-nextlive =>PUP.NextLive
~ http://nicolascoolman.webs.com/apps/blog/show/30834772-pup-hdvidcodec =>PUP.HDVidCodec
~ http://nicolascoolman.webs.com/apps/blog/show/27566847-pup-cacaoweb =>PUP.CacaoWeb
~ http://nicolascoolman.webs.com/apps/blog/show/32240257-trojan-fynloski =>Trojan.Fynloski
~ http://nicolascoolman.webs.com/apps/blog/show/31951367-trojan-vonteera =>Trojan.Vonteera
~ http://nicolascoolman.webs.com/apps/blog/show/28212192-hijacker-alnaddy =>Hijacker.Alnaddy
~ http://nicolascoolman.webs.com/apps/blog/show/30167532-pup-televisionfanatic =>PUP.TelevisionFanatic
~ http://nicolascoolman.webs.com/apps/blog/show/31929570-adware-saveshare =>Adware.SaveShare
~ http://nicolascoolman.webs.com/apps/blog/show/27583526-pup-crossrider =>PUP.CrossRider
~ http://nicolascoolman.webs.com/apps/blog/show/26801402-adware-fastsaveapp =>Adware.FastSaveApp
~ http://nicolascoolman.webs.com/apps/blog/show/26611092-adware-bandoo =>Adware.Bandoo
~ MSI: 19 link(s) detected in 02mn 59s
~ 1662 Legitimates filtered by white list
End of the scan (691 lines in 28mn 37s)(8) -
d'accord mademoiselle et merci encore une fois pour votre aide si précieuse
-
Contributeur sécuritéPour demain un nouveau rapport zhpdiag
-
voici le rapport JRT:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.1 (02.04.2014:1)
OS: Windows 7 Starter x86
Ran by Asus on 19/02/2014 at 22:19:09,84
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
Successfully stopped: [Service] splashtopremoteservice
Successfully deleted: [Service] splashtopremoteservice
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{38495740-0035-4471-851E-F5BBB86AB085}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{A1E28287-1A31-4B0F-8D05-AA8C465D3C5A}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1E28287-1A31-4B0F-8D05-AA8C465D3C5A}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2093371556-3351502057-3444359280-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21D59046-8568-4E51-BD32-79BD751DCCE6}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{499B15AC-881F-4224-9373-E2AF2D95108B}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C2A9ED0-361D-4678-BBB6-FA668315952D}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82FE22F6-6581-4ED3-B962-D0114CFC8F04}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A178FE10-2662-4286-93AB-0477A425A351}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\backupstack_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\backupstack_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\dmwu_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\dmwu_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1E28287-1A31-4B0F-8D05-AA8C465D3C5A}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220322432262}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110311431162}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskInstaller_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\PricePeep_BetterInstaller_2012-10-02_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\PricePeep_BetterInstaller_2012-10-02_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311431162}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{14BE5A0E-AD3E-7930-7E39-4FE33AECF273}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{2CEC0DAA-3CA7-4904-85C5-399B497FD5FA}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{ADB15C8E-41F4-455F-A820-6DFD40EF5E7B}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{14BE5A0E-AD3E-7930-7E39-4FE33AECF273}
~~~ Files
Successfully deleted: [File] "C:\windows\Tasks\pc optimizer pro scan.job"
Successfully deleted: [File] "C:\Users\Asus\appdata\locallow\microsoft\silverlight\outofbrowser\index\portal.qtrax.com"
Successfully deleted: [File] "C:\Users\Asus\appdata\locallow\SkwConfig.bin"
~~~ Folders
Successfully deleted: [Folder] "C:\Users\Asus\appdata\locallow\datamngr"
Failed to delete: [Folder] "C:\Program Files\saveshare"
Successfully deleted: [Folder] "C:\Program Files\secretsauce"
Successfully deleted: [Empty Folder] C:\Users\Asus\appdata\local\{57945119-A7AA-436B-B148-3F8159AFD931}
Successfully deleted: [Empty Folder] C:\Users\Asus\appdata\local\{A62A0FA8-6DCC-4839-9551-785D377AB8E2}
~~~ Chrome
Successfully deleted: [Folder] C:\Users\Asus\appdata\local\Google\Chrome\User Data\Default\Extensions\ppdjnkblmcjfnlogjjhpigpdgpcgdpll
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\dnllcmllkjofnojidnaknldfehfhehoo
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 19/02/2014 at 22:37:25,99
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -
Contributeur sécurité* Télécharge Junkware Removal Tool à cette adresse (ne clique pas sur télécharger, le téléchargement va débuter automatiquement) : https://www.bleepingcomputer.com/download/junkware-removal-tool/dl/131/
* Enregistre-le sur ton bureau.
* Ferme toutes les applications en cours.
* Ouvre JRT.exe et appuie sur Entrée : si tu es sous Windows Vista, 7 ou 8, ouvre-le en faisant : clic droit => Exécuter en tant qu'administrateur.
* Patiente le temps que l'outil travaille : le bureau va disparaître quelques instants, c'est tout à fait normal.
* À la fin de l'analyse, un rapport nommé JRT.txt va s'ouvrir. Héberge-le comme ceci et poste le lien obtenu dans ta prochaine réponse.
Tutoriel : http://www.forum-entraide-informatique.com/support/junkware-removal-tool-tutoriel-t8260.html
-
voici le rapport du zhpdiag:
~ Rapport de ZHPDiag v2014.2.17.15 - Nicolas Coolman (17/02/2014)
~ Lancé par Asus (19/02/2014 00:30:48)
~ Adresse du Site Web https://nicolascoolman.webs.com/
~ Forums gratuits d'Assistance à la désinfection : https://nicolascoolman.webs.com/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by program
---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16798
GCIE: Google Chrome v32.0.1700.107
OPIE: Opera vStable 19.0.1326.63 (Defaut)
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Starter, 32-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
System - Enable Open file C:\Users\Asus\AppData\Roaming\ZHP\Licence.txt =>.Nicolas Coolman
---\\ Logiciels de protection du système
AVG 2013 v13.0.3705
Windows Defender W7
---\\ Logiciels d'optimisation du système
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 13 Plugin
Adobe Reader XI
Java 7 Update 45
---\\ Informations sur le système
~ Processor: x86 Family 6 Model 28 Stepping 10, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1014 MB (10% free)
System Restore: Activé (Enable)
System drive C: has 22 GB (21%) free of 100 GB
---\\ Mode de connexion au système
~ Computer Name: ASUS-PC
~ User Name: Asus
~ All Users Names: Asus, Administrateur,
~ Unselected Option: None
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Asus\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Asus\AppData\Roaming\
~ %Desktop% : C:\Users\Asus\Desktop\
~ %Favorites% : C:\Users\Asus\Favorites\
~ %LocalAppData% : C:\Users\Asus\AppData\Local\
~ %StartMenu% : C:\Users\Asus\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 22 Go of 100 Go)
D: Hard drive, Flash drive, Thumb drive (Free 76 Go of 118 Go)
E: Floppy drive, Flash card reader, USB Key (Not Inserted)
F: CD-ROM drive (Not Inserted)
---\\ Etat du Centre de Sécurité Windows
~ Security Center: 50 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.8B88EBBB05A0E56B7DCC708498C02B3E] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 06:30:54.) -- C:\Windows\Explorer.exe [2616320]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:14:45.) -- C:\Windows\System32\Wininit.exe [96256]
[MD5.1FF83D2BE92B40DAE234CF4236680B6E] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.01/02/2014 - 08:58:31.) -- C:\Windows\System32\wininet.dll [1767936]
[MD5.6D13E1406F50C66E2A95D97F22C47560] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.20/11/2010 - 13:17:54.) -- C:\Windows\System32\Winlogon.exe [286720]
[MD5.E3AE23569749DE12D45BA3B489A036AE] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 13:21:24.) -- C:\Windows\System32\sppcomapi.dll [193536]
[MD5.F81BB7E487EDCEAB630A7EE66CF23913] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.14/09/2013 - 01:48:58.) -- C:\Windows\system32\Drivers\AFD.sys [338944]
[MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:26:15.) -- C:\Windows\system32\Drivers\atapi.sys [21584]
[MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:11:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656]
[MD5.BE167ED0FDB9C1FA1133953C18D5A6C9] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 09:38:10.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544]
[MD5.F024449C97EC1E464AAFFDA18593DB88] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 09:42:32.) -- C:\Windows\system32\Drivers\DfsC.sys [78336]
[MD5.9036377B8A6C15DC2EEC53E489D159B5] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 10:59:29.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544]
[MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:11:24.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896]
[MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 00:54:29.) -- C:\Windows\system32\Drivers\IpNat.sys [101888]
[MD5.5D16C921E3671636C0EBA3BBAAC5FD25] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:17:22.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123904]
[MD5.280122DDCF04B378EDD1AD54D71C1E54] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 09:39:44.) -- C:\Windows\system32\Drivers\netBT.sys [187904]
[MD5.5E43D2B0EE64123D4880DFA6626DEFDE] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 14:45:29.) -- C:\Windows\system32\Drivers\ntfs.sys [1211752]
[MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 00:45:35.) -- C:\Windows\system32\Drivers\Parport.sys [79360]
[MD5.D9F91EAFEC2815365CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.14/07/2009 - 00:54:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848]
[MD5.3E21C083B8A01CB70BA1F09303010FCE] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 00:53:41.) -- C:\Windows\system32\Drivers\smb.sys [71168]
[MD5.B459575348C20E8121D6039DA063C704] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 09:39:17.) -- C:\Windows\system32\Drivers\tdx.sys [74752]
[MD5.F497F67932C6FA693D7DE2780631CFE7] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 13:30:16.) -- C:\Windows\system32\Drivers\volsnap.sys [245632]
~ Generic Processes: Scanned in 00mn 04s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/80
~ Mes musiques (My Musics) : 1/31
~ Mes Videos (My Videos) : 1/5
~ Mes Favoris (My Favorites) : 1/44
~ Mes Documents (My Documents) : 1/1336
~ Mon Bureau (My Desktop) : 1/794
~ Menu demarrer (Programs) : 1/60
~ Hidden Files: Scanned in 00mn 23s
---\\ Processus lancés
[MD5.F2E0D536DF86C0BF795B95A251F07659] - (.Pas de propriétaire - Eee Docking Application.) -- C:\Program Files\ASUS\Eee Docking\Eee Docking.exe [415920] [PID.3400]
[MD5.D36DA0A5C531353C5FF5E29242649257] - (.Boingo Wireless, Inc. - Boingo Wi-Fi.) -- C:\Program Files\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe [365936] [PID.3420]
[MD5.0830F8648E7D86F0BCEEA133BE9E460B] - (.Synaptics Incorporated - Asus Custom Acpi Monitor Application.) -- C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [85304] [PID.3456]
[MD5.13B671D7253F29DA148569288CECF74B] - (.Intel Corporation - hkcmd Module.) -- C:\Windows\System32\hkcmd.exe [173592] [PID.3492]
[MD5.052F402E557C9EC01B188AD56E336029] - (.Intel Corporation - persistence Module.) -- C:\Windows\System32\igfxpers.exe [150552] [PID.3524]
[MD5.CB99B4F2C1C984389A6A9167C7FD6599] - (.Samsung Electronics Co., Ltd. - Kies TrayAgent Application.) -- C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152] [PID.3564]
[MD5.B4BB5F5F5CDF0B6C51E0ACE23FC8537B] - (...) -- C:\Program Files\Mobogenie\DaemonProcess.exe [746176] [PID.3576] =>PUP.Mobogenie
[MD5.2B3DB9C9D7E206CFCF3E327709BEF3AD] - (.Intel Corporation - igfxsrvc Module.) -- C:\windows\system32\igfxsrvc.exe [252952] [PID.3584]
[MD5.E04599579D15710E22AC4F5F06E13AD2] - (.Global Graphics Software Ltd. - gDocCreator Client application.) -- C:\Program Files\Corel\Corel PDF Fusion\CorelCreatorClient.exe [667648] [PID.3600]
[MD5.A8D3CF1BCEDB663C257F6C20219B718A] - (.AVG Technologies CZ, s.r.o. - AVG User Interface.) -- C:\Program Files\AVG\AVG2013\avgui.exe [4411952] [PID.3716]
[MD5.844047923CBE99DF185FA887F8B98EC3] - (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2350392] [PID.3732]
[MD5.766AE515B1749F2141E418CC6C08515B] - (.Intel Corporation - IAStorIcon.) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440] [PID.3740]
[MD5.E567B6DA553BDF20FCBEF1A07CF5AA46] - (.Samsung - Kies.) -- C:\Program Files\Samsung\Kies\Kies.exe [1564016] [PID.2156]
[MD5.8367B8696F613B766F393CD85F17EE80] - (.Samsung - KiesPDLR.) -- C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656] [PID.3076]
[MD5.2C9E5DD5DCB10238ED082A275CB67758] - (.Synaptics Incorporated - Synaptics Pointing Device Helper.) -- C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.exe [109880] [PID.4800]
[MD5.EA0F5701A2A6B832AE8D3525B0F957BE] - (.Ralink Technology, Corp. - Ralink Wireless LAN Card Utility.) -- C:\Program Files\Ralink\Common\RaUI.exe [15661872] [PID.5236]
[MD5.E31566D2575B0249C65CA491A3FD87FC] - (.Opera Software - Opera Internet Browser.) -- C:\Program Files\Opera\19.0.1326.63\opera.exe [45198176] [PID.1216]
[MD5.158F781810DE0791D1B9C6CB2A0F21BA] - (.Dropbox, Inc. - Dropbox.) -- C:\Users\Asus\AppData\Roaming\Dropbox\bin\Dropbox.exe [32641112] [PID.5364]
[MD5.AB44884BC129FC04D75A4649E0710203] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8338432] [PID.5848]
[MD5.D53024C1355615B82DD1526B63623E61] - (...) -- C:\Program Files\Mobogenie\mgusb.exe [88256] [PID.3544] =>PUP.Mobogenie
~ Processes Running: Scanned in 00mn 12s
---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Asus\AppData\Local\Google\Chrome\User Data\Default\Preferences
~ Google Browser: 0 Legitimates Filtered in 00mn 01s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Asus\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js (.not file.)
C:\Users\Asus\AppData\Roaming\Mozilla\Firefox\Profiles\n6aqrywy.default\prefs.js
C:\Users\Asus\AppData\Roaming\Mozilla\Firefox\Profiles\wpddqarv.default\prefs.js (.not file.)
~ Firefox Browser: 22 Legitimates Filtered in 00mn 01s
---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://bestsearchonweb.com
R0 - HKCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.barremagique.com
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = preserve
~ IE Browser: 12 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21
---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: PXCIEaddin - {42DFA04F-0F16-418e-B80C-AB97A5AFAD39} . (.Tracker Softaware - Pas de description.) -- C:\Program Files\Tracker Software\PDF-XChange 4\PXCIEAddin4.dll
~ BHO: 20 Legitimates Filtered in 00mn 01s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: PDFXChange 4.0 - [HKLM]{42DFA04F-0F16-418e-B80C-AB97A5AFAD39} . (.Tracker Softaware - Pas de description.) -- C:\Program Files\Tracker Software\PDF-XChange 4\PXCIEAddin4.dll
O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll =>Toolbar.Google
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{21FA44EF-376D-4D53-9B0F-8A89D3229068} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{CFCB809C-3A22-4616-A916-6C007BD9D920} Clé orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: AVG.lnk . (.AVG Technologies CZ, s.r.o. - AVG User Interface.) -- C:\Program Files\AVG\AVG2013\avgui.exe
O4 - GS\Desktop [Public]: Boilsoft Video Joiner.lnk . (.Boilsoft - Boilsoft Video Joiner.) -- C:\Program Files\Boilsoft\Boilsoft Video Joiner\EZMerge.exe
O4 - GS\Desktop [Public]: DriverEasy.lnk . (.Easeware - DriverEasy.) -- C:\Program Files\Easeware\DriverEasy\DriverEasy.exe
O4 - GS\Desktop [Public]: Démarrer SPYOME.lnk . (...) -- C:\Program Files\Spyome\exec\maspyome.exe
O4 - GS\Desktop [Public]: Max Recorder.lnk . (...) -- C:\Program Files\Max Recorder\MaxRecorder.exe
O4 - GS\Desktop [Public]: Office2PDF.lnk . (.Tracker Software Products Ltd. - Batch converter for Office documents to PDF.) -- C:\Program Files\Tracker Software\PDF-XChange 4\OFFice2PDF.exe
O4 - GS\Desktop [Public]: PDF-Tools 4.lnk . (.Tracker Software Products Ltd. - PDF-Tools.) -- C:\Program Files\Tracker Software\PDF-Tools 4\PDFTools4.exe
O4 - GS\Desktop [Public]: PDF-Viewer.lnk . (.Tracker Software Products (Canada) Ltd. - PDF-XChange Viewer.) -- C:\Program Files\Tracker Software\PDF Viewer\PDFXCview.exe
O4 - GS\Desktop [Public]: PowerISO.lnk . (.Power Software Ltd - PowerISO.) -- D:\Program Files\PowerISO\PowerISO.exe
O4 - GS\Program [Public]: Opera.lnk . (.Opera Software - Opera Internet Browser.) -- C:\Program Files\Opera\launcher.exe
O4 - GS\QuickLaunch [Asus]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Asus]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch [Asus]: PC Optimizer Pro.lnk . (...) -- C:\Program Files\PC Optimizer Pro\PCOptimizerPro.exe (.not file.) =>PUP.OptimizerPro
O4 - GS\QuickLaunch [Asus]: Update Detector.lnk . (.Filepuma International - Update Detector.) -- C:\Program Files\Update Detector\UpdateDetector.exe
O4 - GS\QuickLaunch [Asus]: Viber.lnk . (...) -- C:\Users\Asus\AppData\Local\Viber\Viber.exe
O4 - GS\QuickLaunch [Asus]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Asus\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\TaskBar [Asus]: Internet Explorer (2).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [Asus]: Internet Explorer (3).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [Asus]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [Asus]: Magnify.lnk . (.Microsoft Corporation - Loupe Microsoft.) -- C:\windows\system32\magnify.exe
O4 - GS\TaskBar [Asus]: Mobogenie.lnk . (...) -- C:\Program Files\Mobogenie\Mobogenie.exe =>PUP.Mobogenie
O4 - GS\TaskBar [Asus]: On-Screen Keyboard.lnk . (.Microsoft Corporation - Accessibilité au Clavier visuel.) -- C:\windows\system32\osk.exe
O4 - GS\TaskBar [Asus]: Opera.lnk . (.Opera Software - Opera Internet Browser.) -- C:\Program Files\Opera\launcher.exe
O4 - GS\TaskBar [Asus]: Viber.lnk . (...) -- C:\Users\Asus\AppData\Local\Viber\Viber.exe
O4 - GS\TaskBar [Asus]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Asus\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\Program [Asus]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Program [Asus]: Songr.lnk . (.Xamasoft - Songr.) -- C:\Users\Asus\AppData\Local\Songr\Songr.exe
O4 - GS\Program [Asus]: Update Detector.lnk . (.Filepuma International - Update Detector.) -- C:\Program Files\Update Detector\UpdateDetector.exe
O4 - GS\Program [Asus]: Viber.lnk . (...) -- C:\Users\Asus\AppData\Local\Viber\Viber.exe
O4 - GS\SystemTools [Asus]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Asus]: Cain.lnk . (.oxid.it - Cain - Password Recovery Utility.) -- C:\Program Files\Cain\Cain.exe
O4 - GS\Desktop [Asus]: CVitae V4.lnk . (...) -- C:\Program Files\CVitaeV4\CVitae.exe
O4 - GS\Desktop [Asus]: Lanceur d'applications Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [Asus]: Le Petit Robert.lnk . (...) -- C:\Program Files\Le Robert\Le Petit Robert 2014\Le Petit Robert.exe
O4 - GS\Desktop [Asus]: Mobogenie.lnk . (...) -- C:\Program Files\Mobogenie\Mobogenie.exe =>PUP.Mobogenie
O4 - GS\Desktop [Asus]: PDF-Viewer.lnk . (.Tracker Software Products (Canada) Ltd. - PDF-XChange Viewer.) -- C:\Program Files\Tracker Software\PDF Viewer\PDFXCview.exe
O4 - GS\Desktop [Asus]: RM.lnk . (.www.moofdev.net - Ratio Master.) -- D:\Program Files\RatioMaster-1.9.1\RM.exe
O4 - GS\Desktop [Asus]: Songr.lnk . (.Xamasoft - Songr.) -- C:\Users\Asus\AppData\Local\Songr\Songr.exe
O4 - GS\Desktop [Asus]: StreamTorrent 1.0.lnk . (.StreamTorrent - StreamTorrent Media Player.) -- D:\Program Files\StreamTorrent 1.0\StreamTorrent.exe
O4 - GS\Desktop [Asus]: Youtube Downloader HD.lnk . (...) -- C:\Program Files\Youtube Downloader HD\YouTubeDownloaderHD.exe =>PUP.Dealio
O4 - GS\Desktop [Asus]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Asus\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
~ Global Startup: 107 Legitimates Filtered in 00mn 10s
---\\ Applications lancées au démarrage du sytème (O4)
O4 - GS\Startup [Public]: AsusVibeLauncher.lnk . (.ASUSTeK Computer Inc. - AsusVibe Application.) -- C:\Program Files\ASUS\AsusVibe\AsusVibeLauncher.exe
O4 - GS\Startup [Public]: Ralink Wireless Utility.lnk . (.Ralink Technology, Corp. - Ralink Wireless LAN Card Utility.) -- C:\Program Files\Ralink\Common\RaUI.exe
O4 - GS\Startup [Asus]: Dropbox.lnk . (.Dropbox, Inc. - Dropbox.) -- C:\Users\Asus\AppData\Roaming\Dropbox\bin\Dropbox.exe =>.Dropbox
O4 - GS\Startup [Asus]: Envoyer à OneNote.lnk . (.Microsoft Corporation - Send to OneNote Tool.) -- C:\Program Files\Microsoft Office\Office15\ONENOTEM.exe
O4 - HKLM\..\Run: [Eee Docking] . (.Pas de propriétaire - Eee Docking Application.) -- C:\Program Files\ASUS\Eee Docking\Eee Docking.exe
O4 - HKLM\..\Run: [Boingo Wi-Fi] . (...) -- C:\Program Files\Boingo\Boingo Wi-Fi\Boingo.lnk
O4 - HKLM\..\Run: [ASUSPRP] . (.ASUSTek Computer Inc. - ASUS Product Register Program.) -- C:\Program Files\ASUS\APRP\APRP.exe
O4 - HKLM\..\Run: [SynAsusAcpi] . (.Synaptics Incorporated - Asus Custom Acpi Monitor Application.) -- C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] . (.Adobe Systems Incorporated - Adobe Updater Startup Utility.) -- C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Run: [KiesTrayAgent] . (.Samsung Electronics Co., Ltd. - Kies TrayAgent Application.) -- C:\Program Files\Samsung\Kies\KiesTrayAgent.exe =>.Samsung Electronics Co
O4 - HKLM\..\Run: [mobilegeni daemon] . (...) -- C:\Program Files\Mobogenie\DaemonProcess.exe =>PUP.Mobogenie
O4 - HKLM\..\Run: [CorelCreatorClient] . (.Global Graphics Software Ltd. - gDocCreator Client application.) -- C:\Program Files\Corel\Corel PDF Fusion\CorelCreatorClient.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] . (.Power Software Ltd - PowerISO Virtual Drive Manager.) -- D:\Program Files\PowerISO\PWRISOVM.exe
O4 - HKLM\..\Run: [AVG_UI] . (.AVG Technologies CZ, s.r.o. - AVG User Interface.) -- C:\Program Files\AVG\AVG2013\avgui.exe
O4 - HKLM\..\Run: [SynTPEnh] . (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IAStorIcon] . (.Intel Corporation - IAStorIcon.) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [WheelMouse] . (.Pas de propriétaire - Mouse Start Program.) -- C:\Advanced Wheel Mouse\wh_exec.exe
O4 - HKCU\..\Run: [Akamai NetSession Interface] . (...) -- C:\Users\Asus\AppData\Local\Akamai\netsession_win.exe
O4 - HKCU\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe =>Toolbar.Google
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Users\Asus\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKCU\..\Run: [KiesPreload] . (.Samsung - Kies.) -- C:\Program Files\Samsung\Kies\Kies.exe
O4 - HKCU\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- D:\Program Files\Internet Download Manager\IDMan.exe
O4 - HKCU\..\Run: [uTorrent] . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Asus\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - HKUS\.DEFAULT\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-18\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2093371556-3351502057-3444359280-1000\..\Run: [Akamai NetSession Interface] . (...) -- C:\Users\Asus\AppData\Local\Akamai\netsession_win.exe
O4 - HKUS\S-1-5-21-2093371556-3351502057-3444359280-1000\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe =>Toolbar.Google
O4 - HKUS\S-1-5-21-2093371556-3351502057-3444359280-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2093371556-3351502057-3444359280-1000\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Users\Asus\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKUS\S-1-5-21-2093371556-3351502057-3444359280-1000\..\Run: [KiesPreload] . (.Samsung - Kies.) -- C:\Program Files\Samsung\Kies\Kies.exe
O4 - HKUS\S-1-5-21-2093371556-3351502057-3444359280-1000\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- D:\Program Files\Internet Download Manager\IDMan.exe
O4 - HKUS\S-1-5-21-2093371556-3351502057-3444359280-1000\..\Run: [uTorrent] . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Asus\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
~ Application: Scanned in 00mn 01s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office15\ONBttnIE.dll =>.Microsoft Corporation
O9 - Extra button: Cliquer pour appeler Lync - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} . (.Microsoft Corporation - Microsoft Lync.) -- C:\Program Files\Microsoft Office\Office15\lync.exe
O9 - Extra button: Notes &liées OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office15\ONBTTN~1.dll =>.Microsoft Corporation
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} ((no name)) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} ((no name)) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
~ Objets ActiveX: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{4DF4E8BB-8691-4413-B233-037B57B0DB8C}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{FFEB3A24-266C-4D94-8F2B-8644F3FED41E}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{4DF4E8BB-8691-4413-B233-037B57B0DB8C}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{FFEB3A24-266C-4D94-8F2B-8644F3FED41E}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{4DF4E8BB-8691-4413-B233-037B57B0DB8C}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{FFEB3A24-266C-4D94-8F2B-8644F3FED41E}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (.Microsoft Corporation - Windows Live Album Download Protocol Handle.) -- C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Asus Launcher Service (AsusService) . (...) - C:\Windows\System32\AsusService.exe
O23 - Service: Splashtop® Remote Service (SplashtopRemoteService) . (...) - C:\Program Files\Splashtop\Splashtop Remote\SERVER\SRService.exe (.not file.)
O23 - Service: Util BrowseFox (Util BrowseFox) . (...) - C:\Program Files\BrowseFox\bin\utilBrowseFox.exe (.not file.) =>Adware.BrowseFox
O23 - Service: (vToolbarUpdater15.4.0) . (...) - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe (.not file.) =>Toolbar.AVGSearch
~ Services: 12 Legitimates Filtered in 00mn 25s
---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\DriverEasy Scheduled Scan.job [404]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\PC Optimizer Pro Scan.job [404] =>PUP.OptimizerPro
[MD5.00000000000000000000000000000000] [APT] [PC Optimizer Pro Scan] (...) -- C:\Program Files\PC Optimizer Pro\StartApps.exe (.not file.) [0] =>PUP.OptimizerPro
[MD5.00000000000000000000000000000000] [APT] [{3E47B51D-EBF1-44C8-90D7-2F23BB2F7AAA}] (...) -- G:\PrinterShare2306.exe (.not file.) [0]
[MD5.33B59A48C1810F7BBFA66D73CF66C611] [APT] [{42BD7D24-A2CD-4A21-9BC6-E5D62918AB79}] (.Opera Software.) -- c:\program files\opera\launcher.exe [1598304]
[MD5.00000000000000000000000000000000] [APT] [{A9D520E8-BE58-40FC-8AD7-DD1352F9F3F2}] (...) -- C:\Users\Asus\Desktop\Logiciels\ZHPDiag2.exe (.not file.) [0]
~ Scheduled Task: 26 Legitimates Filtered in 00mn 21s
---\\ Logiciels installés (O42)
O42 - Logiciel: Advanced Wheel Mouse 6.0.0.010 - (...) [HKLM] -- WheelMouse
O42 - Logiciel: Akamai NetSession Interface Service - (...) [HKLM] -- Akamai
O42 - Logiciel: PrinterShare 2.3.06 - (.Printer Anywhere Inc..) [HKLM] -- {7239791B-F20F-4816-8AC3-89AB8A1AEDA6}
O42 - Logiciel: Spyome 1.15 - (.Morillon Alain.) [HKLM] -- Spyome_is1
O42 - Logiciel: StreamTorrent 1.0 - (...) [HKLM] -- StreamTorrent 1.0
O42 - Logiciel: Youtube to MP3 Converter v. 1.4 - (.YoutubeDownloaderHD.com.) [HKLM] -- Youtube to MP3 Converter_is1 =>PUP.SoftwareEngine
O42 - Logiciel: savEnshare a - (.saVensHarue.) [HKLM] -- {62D82EC1-0D3A-DF54-8E3E-07E1337A5311}
~ Logic: 23 Legitimates Filtered in 00mn 05s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\DC3_FEXEC] =>Trojan.Trojan.Fynloski
[HKCU\Software\IncrediMail]
[HKCU\Software\JC]
[HKCU\Software\MaxRecorder]
[HKCU\Software\PCRemote]
[HKCU\Software\PrinterShare]
[HKCU\Software\SPYOME-AGENT]
[HKLM\Software\IO3O]
[HKLM\Software\IncrediMail]
[HKLM\Software\JC]
[HKLM\Software\MaxRecorder]
[HKLM\Software\Vonteera] =>Trojan.Trojan.Vonteera
[HKLM\Software\Vontera]
~ Key Software: 328 Legitimates Filtered in 00mn 05s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 21/07/2013 - 16:12:47 - [0,075] ----D C:\Program Files\CHRYOPROD
O43 - CFD: 16/02/2014 - 22:23:16 - [0] ----D C:\Program Files\Magic Memory Optimizer
O43 - CFD: 01/01/2014 - 20:44:59 - [0] ----D C:\Program Files\Portable
O43 - CFD: 30/03/2013 - 11:13:01 - [1,283] ----D C:\Program Files\PrinterShare
O43 - CFD: 31/12/2013 - 09:48:25 - [0,471] ----D C:\Program Files\SaveShare =>Adware.SaveShare
O43 - CFD: 10/12/2013 - 23:41:18 - [0] ----D C:\Program Files\SecretSauce =>Adware.SecretSauce
O43 - CFD: 22/03/2013 - 16:45:27 - [6,376] ----D C:\Program Files\Spyome
O43 - CFD: 25/12/2013 - 09:04:10 - [1,872] ----D C:\Program Files\Update Detector
O43 - CFD: 22/08/2013 - 04:04:11 - [0,002] ----D C:\Program Files\VonteeraAddon =>Trojan.Trojan.Vonteera
O43 - CFD: 13/10/2013 - 23:43:47 - [5,138] ----D C:\Program Files\Youtube to MP3 Converter
O43 - CFD: 22/08/2013 - 03:54:44 - [4,725] ----D C:\ProgramData\InstallMate =>PUP.Tarma
O43 - CFD: 30/03/2013 - 00:08:08 - [0] ----D C:\ProgramData\PrinterShare
O43 - CFD: 22/03/2013 - 16:45:45 - [5,603] ----D C:\ProgramData\spyome
O43 - CFD: 15/08/2013 - 09:26:26 - [0] ----D C:\ProgramData\SuperClearCookies
O43 - CFD: 15/08/2013 - 09:27:35 - [0] ----D C:\ProgramData\SuperClearHistory
O43 - CFD: 06/01/2014 - 22:58:18 - [0] -SH-D C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
O43 - CFD: 29/12/2013 - 11:17:15 - [0] --H-D C:\Users\Asus\AppData\Roaming\DataWork
O43 - CFD: 15/02/2014 - 08:23:19 - [1,228] ----D C:\Users\Asus\AppData\Roaming\newnext.me =>PUP.NextLive
O43 - CFD: 15/08/2013 - 09:26:26 - [0] ----D C:\Users\Asus\AppData\Roaming\SuperClearCookies
O43 - CFD: 15/08/2013 - 09:27:35 - [0] ----D C:\Users\Asus\AppData\Roaming\SuperClearHistory
O43 - CFD: 13/10/2013 - 23:44:03 - [0] ----D C:\Users\Asus\AppData\Roaming\Youtube to MP3 Converter
O43 - CFD: 15/12/2013 - 12:56:54 - [1,224] ----D C:\Users\Asus\AppData\Local\genienext
O43 - CFD: 11/08/2013 - 12:56:45 - [0,002] ----D C:\Users\Asus\AppData\Local\MaxRecorder
O43 - CFD: 31/12/2013 - 00:21:43 - [0,001] ----D C:\Users\Asus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Advanced Wheel Mouse
O43 - CFD: 22/03/2013 - 16:45:29 - [0,002] ----D C:\Users\Asus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SPYOME
O43 - CFD: 14/08/2013 - 00:58:33 - [0,001] ----D C:\Users\Asus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StreamTorrent 1.0
O43 - CFD: 25/12/2013 - 09:04:10 - [0,003] ----D C:\Users\Asus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Detector
~ 2 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 264 Legitimates Filtered in 01mn 26s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.2465EBC8CD6E412CDC1AB9FEF40BCAE6] - 11/02/2014 - 03:30:38 ---A- . (...) -- C:\Windows\win.ini [478]
O44 - LFC:[MD5.99154B5C3591370552DF8D2BE07611C6] - 18/02/2014 - 13:21:25 ---A- . (...) -- C:\Windows\IE11_main.log [33224]
O44 - LFC:[MD5.54F30ACDDFE4B1CFD146D6B0B1C93A61] - 19/02/2014 - 00:36:19 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [16160]
O44 - LFC:[MD5.54F30ACDDFE4B1CFD146D6B0B1C93A61] - 19/02/2014 - 00:36:19 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [16160]
~ Files: 61 Legitimates Filtered in 00mn 29s
---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.48C433C22F1ED3E268E3592F3876B355] - 02/02/2014 - 14:14:18 ---A- - C:\Windows\Prefetch\SRSERVICE.EXE-1327EC2A.pf
O45 - LFCP:[MD5.D4EB3EE646EDEB6640916673CCAF6086] - 11/02/2014 - 09:58:46 ---A- - C:\Windows\Prefetch\LIVETUNER.EXE-A259B20D.pf
O45 - LFCP:[MD5.A4E9B9BEB7EB837CE2311FC06591BA40] - 15/02/2014 - 08:16:42 ---A- - C:\Windows\Prefetch\SRFEATURE.EXE-81CB1699.pf
O45 - LFCP:[MD5.0C2597D50AA63645148CAE4F1FB75E06] - 15/02/2014 - 08:16:53 ---A- - C:\Windows\Prefetch\SRSERVER.EXE-175D3310.pf
O45 - LFCP:[MD5.45108F8DBB8B50AA43E08F856C6D0758] - 15/02/2014 - 09:00:04 ---A- - C:\Windows\Prefetch\HDVID CODEC V1-CODEDOWNLOADER-3AF29134.pf =>PUP.HDVidCodec
O45 - LFCP:[MD5.24C90A539028DF5C05B5A2939250821B] - 16/02/2014 - 20:09:01 ---A- - C:\Windows\Prefetch\IDMUPDT.EXE-07D75D51.pf
O45 - LFCP:[MD5.8EA878096F077DBFEC1DB30DE00BDE14] - 16/02/2014 - 20:09:18 ---A- - C:\Windows\Prefetch\IDM1.TMP-DBBAD2B9.pf
O45 - LFCP:[MD5.E90232D13F9BB88F3DF921A0282FA439] - 16/02/2014 - 20:11:18 ---A- - C:\Windows\Prefetch\MEDIUMILSTART.EXE-66C58623.pf
O45 - LFCP:[MD5.BB3367F733BA738FB4666869611D88E3] - 16/02/2014 - 21:48:01 ---A- - C:\Windows\Prefetch\CORELCREATORSV.EXE-D2AC60EB.pf
O45 - LFCP:[MD5.BFB652727AA8A288D021F569E57713AC] - 16/02/2014 - 21:59:43 ---A- - C:\Windows\Prefetch\RTHDVBG.EXE-A764F421.pf
O45 - LFCP:[MD5.B2C1395573856B539D81CA644C5E3A32] - 16/02/2014 - 22:00:31 ---A- - C:\Windows\Prefetch\PWRISOVM.EXE-60147F8E.pf
O45 - LFCP:[MD5.ECE29E286072AB48EB294C09BAF56971] - 16/02/2014 - 22:00:31 ---A- - C:\Windows\Prefetch\WH_EXEC.EXE-10A1A889.pf
O45 - LFCP:[MD5.8FA9AF8F8606213C5E607B342C265D43] - 18/02/2014 - 19:29:02 ---A- - C:\Windows\Prefetch\RAUI.EXE-AA314F44.pf
O45 - LFCP:[MD5.3A9BA7523F2CA62DA9963E4025FF29AD] - 19/02/2014 - 00:36:54 ---A- - C:\Windows\Prefetch\MGUSB.EXE-03B14200.pf
~ Prefetcher: 118 Legitimates Filtered in 00mn 01s
---\\ Clé de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{6e146077-b185-11e2-b733-20cf3060074a}\AutoRun\command. (...) -- E:\autorun.exe (.not file.)
O51 - MPSK:{6e146093-b185-11e2-b733-20cf3060074a}\AutoRun\command. (...) -- G:\autorun.exe (.not file.)
~ Keys: Scanned in 00mn 13s
---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 17 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.548CCBD8B48FDF7E2435AD6017920A7F] - 08/10/2012 - 19:53:56 ---A- . (.Wondershare - Wondershare Virtual Audio Device.) -- C:\Windows\System32\Drivers\Apowersoft_AudioDevice.sys [26080]
O58 - SDL:[MD5.A9A565C669786C402752F609AFDD0DD5] - 09/02/2011 - 14:03:00 ---A- . (...) -- C:\Windows\System32\Drivers\AsUpIO.sys [11832]
O58 - SDL:[MD5.B6B5566B24329432E0FD1E4ED15A683B] - 06/03/1999 - 12:38:28 ---A- . (...) -- C:\Windows\System32\Drivers\ASUSHWIO.SYS [6144]
O58 - SDL:[MD5.BDDE322DD3E6ABBC589C5DC8A948A661] - 29/08/2008 - 17:54:40 ---A- . (.Mobile Connector - USB/Serial Device Driver.) -- C:\Windows\System32\Drivers\cmusbser.sys [103552]
O58 - SDL:[MD5.30384865C9AF82DB291E5C4F468E1AC6] - 29/08/2012 - 18:46:12 ---A- . (.Windows (R) Win 7 DDK provider - Explore Systems Virtual Audio Device.) -- C:\Windows\System32\Drivers\dfx11_1.sys [24424]
O58 - SDL:[MD5.0ED67910C8C326796FAA00B2BF6D9D3C] - 14/07/2009 - 02:20:28 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [453712]
O58 - SDL:[MD5.C44E3C2BAB6837DB337DDEE7544736DB] - 13/07/2009 - 23:54:14 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [26624]
O58 - SDL:[MD5.203BB2691E7D0088A2C1F9C39C15A9B7] - 28/11/2013 - 01:24:18 ---A- . (.Tonec Inc. - Internet Download Manager WFP Driver.) -- C:\Windows\System32\Drivers\idmwfp.sys [108000]
O58 - SDL:[MD5.3EB803312987FF44265C87CB960DF6AB] - 13/04/2010 - 03:36:12 ---A- . (.Pas de propriétaire - Keyboard Filter Driver.) -- C:\Windows\System32\Drivers\kbfiltr.sys [13880]
O58 - SDL:[MD5.EDF7F8387C2072205ABCF105F14B13B4] - 28/10/2013 - 01:12:12 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG USB Composite Device Driver (MSS Ver.3).) -- C:\Windows\System32\Drivers\ssudbus.sys [87064]
O58 - SDL:[MD5.24F5F92263E3B461A1105FE370D53D1C] - 28/10/2013 - 01:12:12 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG Android Modem Device Driver (MSS Ver.3).) -- C:\Windows\System32\Drivers\ssudmdm.sys [182680]
O58 - SDL:[MD5.DB32D325C192B801DF274BFD12A7E72B] - 14/07/2009 - 02:19:04 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [21072]
O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 13/07/2009 - 22:40:41 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029]
O58 - SDL:[MD5.0FE9F16075C9ACB941C957B7C649176E] - 13/07/2009 - 22:40:44 ---A- . (...) -- C:\Windows\System32\country.sys [27097]
O58 - SDL:[MD5.E6BC0F98FECEF245A0010D350C1A0B9B] - 13/07/2009 - 22:40:40 ---A- . (...) -- C:\Windows\System32\HIMEM.SYS [4768]
O58 - SDL:[MD5.492090267B9608C62B956CD29BE3AFB7] - 13/07/2009 - 22:40:43 ---A- . (...) -- C:\Windows\System32\KEY01.SYS [42809]
O58 - SDL:[MD5.FBBCFEC1379C5C02D88A361993EDF1B8] - 13/07/2009 - 22:40:43 ---A- . (...) -- C:\Windows\System32\KEYBOARD.SYS [42537]
O58 - SDL:[MD5.FFFF296A08DBF2AC0126C62E3778AC0D] - 13/07/2009 - 22:40:23 ---A- . (...) -- C:\Windows\System32\NTDOS.SYS [27866]
O58 - SDL:[MD5.CF9ED169FF86D935E47999E82359E898] - 13/07/2009 - 22:40:31 ---A- . (...) -- C:\Windows\System32\NTDOS404.SYS [29146]
O58 - SDL:[MD5.03B945AC0481CD8BB161C3569D8ED1C3] - 13/07/2009 - 22:40:35 ---A- . (...) -- C:\Windows\System32\NTDOS411.SYS [29370]
O58 - SDL:[MD5.BBC957DC18C17CC027EB80B7C77F2AEA] - 13/07/2009 - 22:40:39 ---A- . (...) -- C:\Windows\System32\NTDOS412.SYS [29274]
O58 - SDL:[MD5.3CFFAEFFF23B0D208214A6D3061A5B1B] - 13/07/2009 - 22:40:27 ---A- . (...) -- C:\Windows\System32\NTDOS804.SYS [29146]
O58 - SDL:[MD5.2E4112FB7D1B76E11ADFD7487B5D0E95] - 13/07/2009 - 22:40:11 ---A- . (...) -- C:\Windows\System32\NTIO.SYS [33952]
O58 - SDL:[MD5.A98EBD4C2DF983665BF2D1AF49949974] - 13/07/2009 - 22:40:15 ---A- . (...) -- C:\Windows\System32\NTIO404.SYS [34672]
O58 - SDL:[MD5.3F7E6406EDEF197C5CAAB2240EEF6F48] - 13/07/2009 - 22:40:17 ---A- . (...) -- C:\Windows\System32\NTIO411.SYS [35776]
O58 - SDL:[MD5.3E64D681B776CC57BDC38A46D881F85B] - 13/07/2009 - 22:40:19 ---A- . (...) -- C:\Windows\System32\NTIO412.SYS [35536]
O58 - SDL:[MD5.D86B6435729231C171432B4E77801BDB] - 13/07/2009 - 22:40:13 ---A- . (...) -- C:\Windows\System32\NTIO804.SYS [34672]
~ Drivers: 17 Legitimates Filtered in 00mn 15s
---\\ Fichiers Alternate Data Stream (ADS) (O62)
O62 - ADS:Alternate Data Stream File - C:\Windows\System32\?;?:lotserviceruntime.log
~ ADS: Scanned in 00mn 12s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: UsbFix By El Desaparecido - (.El Desaparecido - SosVirus.net.) [HKLM] -- Usbfix
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <OperaStable>[HKLM\..\open\Command] (.Opera Software - Opera Internet Browser.) -- C:\Program Files\Opera\Launcher.exe
O67 - Shell Spawning: <.html> <OperaStable>[HKCU\..\open\Command] (.Opera Software - Opera Internet Browser.) -- C:\Program Files\Opera\Launcher.exe
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: <OperaStable> <Opera Stable>[HKLM\..\Shell\open\Command] (.Opera Software - Opera Internet Browser.) -- C:\Program Files\Opera\Launcher.exe
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {14BE5A0E-AD3E-7930-7E39-4FE33AECF273} - (MyStart Search) - https://mystart.incredibar.com/ =>Adware.IncrediBar
O69 - SBI: SearchScopes [HKCU] {2CEC0DAA-3CA7-4904-85C5-399B497FD5FA} - (FileConverter 1.5 Customized Web Search) - http://search.conduit.com
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {756D1D40-E491-4E1D-9BC6-5B37CEDE646E} - (VenteeRo) - http://ww12.arabyonline.com
O69 - SBI: SearchScopes [HKCU] {ADB15C8E-41F4-455F-A820-6DFD40EF5E7B} - (WiseConvert 1.5 Customized Web Search) - http://search.conduit.com =>Toolbar.Conduit
~ Keys: Scanned in 00mn 00s
---\\ Enumère les fichiers Crack & Keygen (CKF) (O82)
C:\Users\Asus\AppData\Local\CrashDumps\keygen.exe.4868.dmp
C:\Users\Asus\AppData\Local\CrashDumps\keygen.exe.7836.dmp
C:\Users\Asus\AppData\Roaming\uTorrent\Folder Lock Pro 8.3.1 Setup + Keygen.rar.1.torrent =>P2P.µTorrent
C:\Users\Asus\AppData\Roaming\uTorrent\Folder Lock Pro 8.3.1 Setup + Keygen.rar.torrent =>P2P.µTorrent
C:\Users\Asus\AppData\Roaming\uTorrent\Simple Adblock 1.0.2 Keygen Generator.rar.torrent =>P2P.µTorrent
C:\Users\Asus\AppData\Local\CrashDumps\keygen.exe.4868.dmp
C:\Users\Asus\AppData\Local\CrashDumps\keygen.exe.7836.dmp
C:\Users\Asus\AppData\Roaming\uTorrent\Folder Lock Pro 8.3.1 Setup + Keygen.rar.1.torrent =>P2P.µTorrent
C:\Users\Asus\AppData\Roaming\uTorrent\Folder Lock Pro 8.3.1 Setup + Keygen.rar.torrent =>P2P.µTorrent
C:\Users\Asus\AppData\Roaming\uTorrent\Simple Adblock 1.0.2 Keygen Generator.rar.torrent =>P2P.µTorrent
~ Files: Scanned in 01mn 07s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.0D3B680986310AE5540578C0E481C6A0] [SPRF][02/03/2010] (...) -- C:\ProgramData\FullRemove.exe [131984]
[MD5.86F3AE507BEA5CA9F9C45E6133699C3B] [SPRF][17/08/2013] (...) -- C:\ProgramData\ntuser.dat [262144]
[MD5.BC1C264165EC26EDA413024AE079341E] [SPRF][14/09/2013] (...) -- C:\Users\Asus\Desktop\Shortcut Virus Remover v3.1.exe [806717]
~ Files: 4 Legitimates Filtered in 00mn 01s
---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{73F05034-BA47-4EF4-8473-1040A5096596}" | In - Private - P6 - TRUE | .(...) -- C:\Users\Asus\AppData\Local\Akamai\netsession_win.exe
O87 - FAEL: "{8DFFEB02-5090-4093-9CDA-1F375B6F9F22}" | In - Private - P17 - TRUE | .(...) -- C:\Users\Asus\AppData\Local\Akamai\netsession_win.exe
O87 - FAEL: "TCP Query User{25E8114C-66F6-4C9B-895E-944620CA5657}C:\users\asus\appdata\local\akamai\netsession_win.exe" | In - Public - P6 - TRUE | .(...) -- C:\users\asus\appdata\local\akamai\netsession_win.exe
O87 - FAEL: "UDP Query User{0049F431-7512-4596-BCFE-A05546BC856E}C:\users\asus\appdata\local\akamai\netsession_win.exe" | In - Public - P17 - TRUE | .(...) -- C:\users\asus\appdata\local\akamai\netsession_win.exe
O87 - FAEL: "{4BF97550-7BF6-493B-A6BA-B853FD8D9591}" |In - Public - P6 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.)
O87 - FAEL: "{CF1B6C71-77C1-4908-9A12-D1752D69A77C}" |In - Public - P17 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.)
O87 - FAEL: "TCP Query User{0D19C50E-4D4B-4C85-970F-8510334054FC}C:\program files\printershare\paconsole.exe" | In - Private - P6 - TRUE | .(.PrinterAnywhere - PrinterAnywhere Console.) -- C:\program files\printershare\paconsole.exe
O87 - FAEL: "UDP Query User{C56175E0-D680-456C-B378-A7785C9FE9B3}C:\program files\printershare\paconsole.exe" | In - Private - P17 - TRUE | .(.PrinterAnywhere - PrinterAnywhere Console.) -- C:\program files\printershare\paconsole.exe
O87 - FAEL: "TCP Query User{DA6B3FA1-0709-41EB-9B89-45FB1057B8F2}C:\program files\printershare\paconsole.exe" | In - Public - P6 - TRUE | .(.PrinterAnywhere - PrinterAnywhere Console.) -- C:\program files\printershare\paconsole.exe
O87 - FAEL: "UDP Query User{46F155A0-F6C5-4D00-B0DD-00E160C0F16A}C:\program files\printershare\paconsole.exe" | In - Public - P17 - TRUE | .(.PrinterAnywhere - PrinterAnywhere Console.) -- C:\program files\printershare\paconsole.exe
O87 - FAEL: "TCP Query User{8279283F-7CE3-4368-B5EF-6AA9D7777172}C:\users\asus\appdata\roaming\cacaoweb\cacaoweb.exe" |In - Private - P6 - TRUE | .(...) -- C:\users\asus\appdata\roaming\cacaoweb\cacaoweb.exe (.not file.) =>PUP.CacaoWeb
O87 - FAEL: "UDP Query User{D6E21D5B-D99A-4D5B-935F-BF12D1A2E608}C:\users\asus\appdata\roaming\cacaoweb\cacaoweb.exe" |In - Private - P17 - TRUE | .(...) -- C:\users\asus\appdata\roaming\cacaoweb\cacaoweb.exe (.not file.) =>PUP.CacaoWeb
O87 - FAEL: "{7B0CD378-D384-4810-AD6E-D1058F6D3A95}" |In - Public - P17 - TRUE | .(...) -- C:\users\asus\appdata\roaming\cacaoweb\cacaoweb.exe (.not file.) =>PUP.CacaoWeb
O87 - FAEL: "{21CB4E45-B1C1-4115-8767-DB0081AED016}" |In - Public - P6 - TRUE | .(...) -- C:\users\asus\appdata\roaming\cacaoweb\cacaoweb.exe (.not file.) =>PUP.CacaoWeb
~ Firewall: 216 Legitimates Filtered in 00mn 06s
---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "44D1C85F9CA48E840994A7C6FDBC14C5" . (.LocaleMe.) -- C:\windows\Installer\{F58C1D44-4AC9-48E8-9049-7A6CDFCB415C}\ARPPRODUCTICON.exe
~ Update Products: 91 Legitimates Filtered in 00mn 01s
---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.729A96719811141F5DEFBEF91DDDE86E] [WIS][08/09/2011] (.Printer Anywhere Inc. - PrinterShare Installation package.) -- C:\Windows\Installer\8ce60.msi [2217984]
~ WIS: 94 Legitimates Filtered in 00mn 56s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 11/02/2014 257928 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Auto 30/03/2011 135664 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 30/03/2011 135664 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 11/10/2012 194032 | (gusvc) . (.Google.) - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Auto 06/07/2012 1863680 | (RaMediaServer) . (.Ralink.) - C:\Program Files\Ralink\Common\RaMediaServer.exe
SS - | Auto 05/09/2013 171680 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe
SS - | Auto 10/07/1658 0 | (SplashtopRemoteService) . (...) - C:\Program Files\Splashtop\Splashtop Remote\SERVER\SRService.exe
SS - | Auto 10/07/1658 0 | (TuneUp.UtilitiesSvc) . (...) - C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe
SS - | Auto 10/07/1658 0 | (Util BrowseFox) . (...) - C:\Program Files\BrowseFox\bin\utilBrowseFox.exe =>Adware.BrowseFox
SS - | Auto 10/07/1658 0 | (vToolbarUpdater15.4.0) . (...) - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe =>Toolbar.AVGSearch
SR - | Auto 05/09/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 14/07/2009 20992 | c:\program files\common files\akamai\netsession_win_8fa3539.dll (Akamai) . (.Akamai Technologies, Inc..) - C:\Windows\System32\svchost.exe
SR - | Auto 22/03/2012 24645 | (Apache2.2) . (.Apache Software Foundation.) - C:\Program Files\Spyome\apache\bin\httpd.exe
SR - | Auto 19/08/2009 219136 | (AsusService) . (...) - C:\Windows\System32\AsusService.exe
SR - | Auto 23/10/2013 1432080 | (avgfws) . (.AVG Technologies CZ, s.r.o..) - C:\Program Files\AVG\AVG2013\avgfws.exe
SR - | Auto 04/07/2013 4939312 | (AVGIDSAgent) . (.AVG Technologies CZ, s.r.o..) - C:\Program Files\AVG\AVG2013\avgidsagent.exe
SR - | Auto 20/11/2013 283136 | (avgwd) . (.AVG Technologies CZ, s.r.o..) - C:\Program Files\AVG\AVG2013\avgwdsvc.exe
SR - | Demand 25/04/2012 73728 | (CorelCreatorMessages) . (.Global Graphics Software Ltd.) - C:\windows\system32\CorelCreatorMessages.exe
SR - | Auto 29/11/2011 13592 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
SR - | Auto 14/07/2009 20992 | C:\windows\system32\HPZinw12.dll (Net Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe
SR - | Auto 14/07/2009 20992 | C:\windows\system32\HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe
SR - | Auto 26/06/2013 391472 | (RalinkRegistryWriter) . (.Ralink Technology, Corp..) - C:\Program Files\Ralink\Common\RaRegistry.exe
SR - | Auto 13/12/2437 250072 | (RtkAudioService) . (.Realtek Semiconductor.) - C:\Program Files\Realtek\Audio\HDA\RtkAudioService.exe
SR - | Auto 14/07/2009 20992 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 14/07/2009 20992 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 01mn 03s
---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Asus at 19/02/2014 00:42:34
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 04s
---\\ Scan Additionnel (O88)
Database Version : 13031 - (17/02/2014)
Clés trouvées (Keys found) : 16
Valeurs trouvées (Values found) : 3
Dossiers trouvés (Folders found) : 7
Fichiers trouvés (Files found) : 4
[HKLM\SYSTEM\CurrentControlSet\Services\Util BrowseFox] =>Adware.BrowseFox^
[HKLM\SYSTEM\CurrentControlSet\Services\vToolbarUpdater15.4.0] =>Toolbar.AVGSearch^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Youtube to MP3 Converter_is1] =>PUP.SoftwareEngine^
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{27100E88-8830-44ED-9D6A-CA24F3523F39}] =>Toolbar.Agent
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{493CCB71-DCAD-4257-9F08-8750F63BD792}] =>Toolbar.Agent
[HKCU\Software\DC3_FEXEC] =>Trojan.Fynloski
[HKLM\Software\Classes\AppID\VONTEERA.DLL] =>Trojan.Vonteera
[HKLM\Software\Microsoft\Tracing\BingBar_RASAPI32] =>Toolbar.Bing
[HKLM\Software\Classes\AppID\{D651E893-3D08-458D-A242-0E6B862E6507}] =>Hijacker.Alnaddy
[HKLM\Software\AVG SafeGuard toolbar] =>Toolbar.AVGSafeGuard
[HKCU\Software\AppDataLow\Software\TelevisionFanaticEI] =>PUP.TelevisionFanatic
[HKLM\Software\TelevisionFanaticEI] =>PUP.TelevisionFanatic
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{62D82EC1-0D3A-DF54-8E3E-07E1337A5311}] =>Adware.SaveShare
[HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311431162}] =>PUP.CrossRider
[HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220322432262}] =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311431162}] =>PUP.CrossRider
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{2318C2B1-4965-11d4-9B18-009027A5CD4F} =>Toolbar.Google^
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:mobilegeni daemon =>PUP.Mobogenie^
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:swg =>Toolbar.Google^
C:\Program Files\SaveShare =>Adware.SaveShare^
C:\Program Files\SecretSauce =>Adware.SecretSauce^
C:\Program Files\VonteeraAddon =>Trojan.Trojan.Vonteera^
C:\ProgramData\InstallMate =>PUP.Tarma^
C:\Users\Asus\AppData\Roaming\newnext.me =>PUP.NextLive^
C:\Users\Asus\AppData\LocalLow\SearchNewTab =>Adware.FastSaveApp
C:\Users\Asus\AppData\LocalLow\searchcoretoolbar =>Adware.Bandoo
C:\Program Files\Mobogenie\DaemonProcess.exe =>PUP.Mobogenie^
C:\Program Files\Mobogenie\mgusb.exe =>PUP.Mobogenie^
C:\Windows\Tasks\PC Optimizer Pro Scan.job =>PUP.OptimizerPro^
[HKLM\Software\Vonteera] =>Trojan.Trojan.Vonteera^
~ Additionnel Scan: 264958 Items scanned in 02mn 49s
---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com/apps/blog/show/41034005-pup-mobogenie =>PUP.Mobogenie
~ http://nicolascoolman.webs.com/apps/blog/show/28204239-pup-optimizerpro =>PUP.OptimizerPro
~ http://nicolascoolman.webs.com/apps/blog/show/27443462-pup-dealio =>PUP.Dealio
~ http://nicolascoolman.webs.com/apps/blog/show/32363262-adware-browsefox =>Adware.BrowseFox
~ http://nicolascoolman.webs.com/apps/blog/show/29758660-pup-softwareengine =>PUP.SoftwareEngine
~ http://nicolascoolman.webs.com/apps/blog/show/32240257-trojan-fynloski =>Trojan.Fynloski
~ http://nicolascoolman.webs.com/apps/blog/show/31951367-trojan-vonteera =>Trojan.Vonteera
~ http://nicolascoolman.webs.com/apps/blog/show/31929570-adware-saveshare =>Adware.SaveShare
~ http://nicolascoolman.webs.com/apps/blog/show/37825424-adware-secretsauce =>Adware.SecretSauce
~ http://nicolascoolman.webs.com/apps/blog/show/29637859-toolbar-tarma =>PUP.Tarma
~ http://nicolascoolman.webs.com/apps/blog/show/40528410-pup-nextlive =>PUP.NextLive
~ http://nicolascoolman.webs.com/apps/blog/show/30834772-pup-hdvidcodec =>PUP.HDVidCodec
~ http://nicolascoolman.webs.com/apps/blog/show/26898222-adware-incredibar =>Adware.Incredibar
~ http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit
~ http://nicolascoolman.webs.com/apps/blog/show/27566847-pup-cacaoweb =>PUP.CacaoWeb
~ http://nicolascoolman.webs.com/apps/blog/show/32240257-trojan-fynloski =>Trojan.Fynloski
~ http://nicolascoolman.webs.com/apps/blog/show/31951367-trojan-vonteera =>Trojan.Vonteera
~ http://nicolascoolman.webs.com/apps/blog/show/28212192-hijacker-alnaddy =>Hijacker.Alnaddy
~ http://nicolascoolman.webs.com/apps/blog/show/30167532-pup-televisionfanatic =>PUP.TelevisionFanatic
~ http://nicolascoolman.webs.com/apps/blog/show/27583526-pup-crossrider =>PUP.CrossRider
~ http://nicolascoolman.webs.com/apps/blog/show/26801402-adware-fastsaveapp =>Adware.FastSaveApp
~ http://nicolascoolman.webs.com/apps/blog/show/26611092-adware-bandoo =>Adware.Bandoo
~ MSI: 22 link(s) detected in 02mn 50s
~ 1668 Legitimates filtered by white list
End of the scan (694 lines in 14mn 40s)(10)
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : YCJVG
Windows License : OK
~ Windows Remaining Initializations Number : 2
Software Protection Service (Protection logicielle) : KO
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ Logiciels de protection du système
AVG 2013 v13.0.3705
Windows Defender W7
---\\ Logiciels d'optimisation du système
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 13 Plugin
Adobe Reader XI
Java 7 Update 45
---\\ Informations sur le système
~ Processor: x86 Family 6 Model 28 Stepping 10, GenuineIntel
~ Operating System: 32 Bits
Boot mo
- 1
- 2
Suivant
