Virus qui transforme les dossier en Raccourci

j'ai fais un scan avec USBfix mais je comprend pas ,

############################## | UsbFix V 7.120 | [Recherche]

Utilisateur: DR (Administrateur) # PC-DE-DR
Mis à jour le 30/03/2013 par El Desaparecido
Lancé à 11:32:48 | 06/04/2013

Site Web: https://www.sosvirus.net/
Upload Malware: http://upload.sosvirus.org/
Contact: contact@sosvirus.org

PC: Hewlett-Packard (Compaq Presario C700 Notebook PC) (X86-based PC)
CPU: Intel(R) Pentium(R) Dual CPU T2410 @ 2.00GHz (2000)
RAM -> [Total : 2037 | Free : 679]
BIOS: Default System BIOS
BOOT: Normal boot

OS: Microsoft® Windows Vista(TM) Édition Familiale Basique (6.0.6001 32-Bit) # Service Pack 1
WB: Windows Internet Explorer 7.0.6001.18000

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AS: Windows Defender [Enabled | (!) Outdated]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disque fixe # 222 Go (28 Go libre(s) - 12%) [] # NTFS
D:\ -> Disque fixe # 11 Go (402 Mo libre(s) - 4%) [PRESARIO_RP] # NTFS
E:\ -> CD-ROM
F:\ -> Disque amovible # 2 Go (919 Mo libre(s) - 48%) [KHALED] # FAT

################## | Processus Actif |

C:\Windows\system32\csrss.exe (524)
C:\Windows\system32\wininit.exe (568)
C:\Windows\system32\services.exe (612)
C:\Windows\system32\lsass.exe (624)
C:\Windows\system32\lsm.exe (632)
C:\Windows\system32\svchost.exe (832)
C:\Windows\system32\svchost.exe (892)
C:\Windows\System32\svchost.exe (932)
C:\Windows\System32\svchost.exe (1028)
C:\Windows\System32\svchost.exe (1096)
C:\Windows\system32\svchost.exe (1108)
C:\Windows\system32\SLsvc.exe (1216)
C:\Windows\system32\svchost.exe (1276)
C:\Windows\system32\svchost.exe (1436)
C:\Windows\System32\spoolsv.exe (1616)
C:\Windows\system32\svchost.exe (1640)
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (1816)
C:\Program Files\Bonjour\mDNSResponder.exe (1920)
C:\PVSW\Bin\WGE_SRV.exe (1952)
C:\PVSW\BIN\W3dbsmgr.EXE (204)
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe (264)
c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (396)
C:\Windows\system32\svchost.exe (876)
C:\Program Files\CyberLink\Shared Files\RichVideo.exe (1172)
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe (1304)
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe (1524)
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (512)
C:\Windows\system32\svchost.exe (728)
C:\Windows\System32\svchost.exe (2092)
C:\Windows\system32\SearchIndexer.exe (2164)
C:\Windows\system32\DRIVERS\xaudio.exe (2232)
C:\Windows\system32\WUDFHost.exe (2272)
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe (2440)
C:\Windows\system32\taskeng.exe (2572)
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe (1388)
C:\Windows\system32\wbem\wmiprvse.exe (2996)
C:\Windows\system32\csrss.exe (1796)
C:\Windows\system32\winlogon.exe (3272)
C:\Windows\system32\Dwm.exe (3176)
C:\Windows\system32\taskeng.exe (564)
C:\Windows\Explorer.EXE (3384)
C:\WINDOWS\System32\igfxtray.exe (2752)
C:\WINDOWS\System32\hkcmd.exe (3680)
C:\WINDOWS\System32\igfxpers.exe (3064)
C:\Program Files\Apoint2K\Apoint.exe (1004)
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (3688)
C:\Program Files\Hp\QuickPlay\QPService.exe (3664)
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe (3672)
C:\Program Files\Windows Defender\MSASCui.exe (3520)
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe (3580)
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (3872)
C:\Program Files\Common Files\Java\Java Update\jusched.exe (3900)
C:\Program Files\iTunes\iTunesHelper.exe (988)
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe (2136)
C:\Program Files\uTorrent\uTorrent.exe (3796)
C:\Program Files\Windows Live\Messenger\msnmsgr.exe (3820)
C:\Program Files\Windows Media Player\wmpnscfg.exe (3892)
C:\Program Files\Windows Sidebar\sidebar.exe (2316)
C:\Program Files\Skype\Phone\Skype.exe (3960)
C:\Program Files\Google\Drive\googledrivesync.exe (3712)
C:\Users\DR\AppData\Roaming\Dropbox\bin\Dropbox.exe (156)
C:\Windows\system32\wbem\unsecapp.exe (488)
C:\Windows\system32\wuauclt.exe (2820)
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE (4292)
C:\Windows\system32\igfxsrvc.exe (4308)
C:\Program Files\Apoint2K\ApMsgFwd.exe (4508)
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe (4764)
C:\Program Files\Apoint2K\Apntex.exe (4824)
C:\Program Files\iPod\bin\iPodService.exe (5164)
C:\Program Files\Google\Drive\googledrivesync.exe (2488)
C:\Program Files\Windows Live\Contacts\wlcomm.exe (4628)
C:\Program Files\Mozilla Firefox\firefox.exe (3268)
C:\Program Files\Mozilla Firefox\plugin-container.exe (6004)
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe (3956)
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe (6108)
C:\Program Files\Common Files\Java\Java Update\jucheck.exe (5396)
C:\UsbFix\Go.exe (440)
C:\Windows\system32\wbem\wmiprvse.exe (5428)
C:\Windows\system32\SearchProtocolHost.exe (5620)

################## | El Desaparecido Section |

HKLM\SOFTWARE | Run : [IgfxTray] - C:\Windows\system32\igfxtray.exe
HKLM\SOFTWARE | Run : [HotKeysCmds] - C:\Windows\system32\hkcmd.exe
HKLM\SOFTWARE | Run : [Persistence] - C:\Windows\system32\igfxpers.exe
HKLM\SOFTWARE | Run : [Apoint] - C:\Program Files\Apoint2K\Apoint.exe
HKLM\SOFTWARE | Run : [IAAnotif] - "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
HKLM\SOFTWARE | Run : [QPService] - "C:\Program Files\HP\QuickPlay\QPService.exe"
HKLM\SOFTWARE | Run : [QlbCtrl] - %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
HKLM\SOFTWARE | Run : [UCam_Menu] - "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
HKLM\SOFTWARE | Run : [Windows Defender] - %ProgramFiles%\Windows Defender\MSASCui.exe -hide
HKLM\SOFTWARE | Run : [Adobe Reader Speed Launcher] - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
HKLM\SOFTWARE | Run : [HP Health Check Scheduler] - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
HKLM\SOFTWARE | Run : [HP Software Update] - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
HKLM\SOFTWARE | Run : [hpWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE | Run : [AdobeCS4ServiceManager] - "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM\SOFTWARE | Run : [iTunesHelper] - "C:\Program Files\iTunes\iTunesHelper.exe"
HKLM\SOFTWARE | RunOnce : [] -
HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem
HKU\S-1-5-19\SOFTWARE | Run : [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem
HKU\S-1-5-20\SOFTWARE | Run : [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [HPAdvisor] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [uTorrent] - "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [msnmsgr] - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [EPSON Stylus CX4300 Series] - C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAR.EXE /FU "C:\Windows\TEMP\E_S23B3.tmp" /EF "HKCU"
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [AdobeBridge] -
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [Windows Defender] - C:\Users\DR\AppData\Local\Temp\lJxSJ.exe
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [GoogleDriveSync] - "C:\Program Files\Google\Drive\googledrivesync.exe" /autostart
HKU\S-1-5-21-921124458-1029800000-1231253793-1000\SOFTWARE | Run : [Fbjqjv] - C:\Users\DR\AppData\Roaming\Fbjqjv.exe

################## | Éléments infectieux |

################## | Registre |

Présent! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr

################## | Mountpoints2 |

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccin créé par UsbFix (El Desaparecido)

################## | E.O.F | https://www.sosvirus.net/ |

voila le rapport ZHPDiag:

Rapport de ZHPDiag v2013.4.2.8 par Nicolas Coolman, Update du 03/04/2013
Run by DR at 06/04/2013 12:26:46
State : Nouvelle version disponible
High Elevated Privileges : OK
UAC : Deactivate by user

---\\ Web Browser
MSIE: Internet Explorer v7.0.6001.18000
MFIE: Mozilla Firefox 19.0.2 v19.0.2 (Defaut)

---\\ Windows Product Information
~ Langage: Français
Windows Vista Home Basic Edition, 32-bit Service Pack 1 (Build 6001)
Windows Server License Manager Script : OK
~ Vista, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 44MV3
Windows License : OK
Windows Automatic Updates : OK

---\\ System Information
~ Processor: x86 Family 6 Model 15 Stepping 13, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 2037.3 MB (39% free)
System Restore: Activé (Enable)
System drive C: has 28 GB (12%) free of 222 GB

---\\ Logged in mode
~ Computer Name: PC-DE-DR
~ User Name: DR
~ All Users Names: DR, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Users\DR\AppData\Roaming\
~ %Desktop% : C:\Users\DR\Desktop\
~ %Favorites% : C:\Users\DR\Favorites\
~ %LocalAppData% : C:\Users\DR\AppData\Local\
~ %StartMenu% : C:\Users\DR\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\WINDOWS\
~ %System% : C:\WINDOWS\System32\

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 28 Go of 222 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 0 Go of 11 Go)
E:\ CD-ROM drive (Not Inserted)

---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] UacDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK
[HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] Load: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: Scanned in 00mn 00s

---\\ Recherche particulière de fichiers génériques
[MD5.4F554999D7D5F05DAAEBBA7B5BA1089D] - (.Microsoft Corporation - Explorateur Windows.) (.29/10/2008 - 07:29:41.) -- C:\WINDOWS\Explorer.exe [2927104]
[MD5.101BA3EA053480BB5D957EF37C06B5ED] - (.Microsoft Corporation - Application de démarrage de Windows.) (.21/01/2008 - 03:33:13.) -- C:\WINDOWS\System32\Wininit.exe [96768]
[MD5.DA5A72211661C7F162B332FEA4F09A69] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.21/04/2011 - 16:00:34.) -- C:\WINDOWS\System32\wininet.dll [833024]
[MD5.C2610B6BDBEFC053BBDAB4F1B965CB24] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.21/01/2008 - 03:34:38.) -- C:\WINDOWS\System32\Winlogon.exe [314880]
[MD5.48EB99503533C27AC6135648E5474457] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.21/04/2011 - 14:16:42.) -- C:\WINDOWS\system32\Drivers\AFD.sys [273408]
[MD5.2D9C903DC76A66813D350A562DE40ED9] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.21/01/2008 - 03:32:21.) -- C:\WINDOWS\system32\Drivers\atapi.sys [21560]
[MD5.7ADD03E75BEB9E6DD102C3081D29840A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.21/01/2008 - 03:33:23.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [70144]
[MD5.1EC25CEA0DE6AC4718BF89F9E1778B57] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/01/2008 - 03:32:23.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [67072]
[MD5.A3E9FA213F443AC77C7746119D13FEEC] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.14/04/2011 - 15:24:14.) -- C:\WINDOWS\system32\Drivers\DfsC.sys [75264]
[MD5.C87B1EE051C0464491C1A7B03FA0BC99] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/01/2008 - 03:32:47.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [53760]
[MD5.22D56C8184586B7A1F6FA60BE5F5A2BD] - (.Microsoft Corporation - Pilote de port i8042.) (.21/01/2008 - 03:32:45.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [54784]
[MD5.8793643A67B42CEC66490B2A0CF92D68] - (.Microsoft Corporation - IP Network Address Translator.) (.21/01/2008 - 03:34:06.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [100864]
[MD5.5734A0F2BE7E495F7D3ED6EFD4B9F5A1] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.29/04/2011 - 13:49:35.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [105984]
[MD5.7C5FEE5B1C5728507CD96FB4A13E7A02] - (.Microsoft Corporation - MBT Transport driver.) (.21/01/2008 - 03:34:49.) -- C:\WINDOWS\system32\Drivers\netBT.sys [184320]
[MD5.B4EFFE29EB4F15538FD8A9681108492D] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.21/01/2008 - 03:33:23.) -- C:\WINDOWS\system32\Drivers\ntfs.sys [1081912]
[MD5.0FA9B5055484649D63C303FE404E5F4D] - (.Microsoft Corporation - Pilote de port parallèle.) (.02/11/2006 - 09:51:30.) -- C:\WINDOWS\system32\Drivers\Parport.sys [79360]
[MD5.A214ADBAF4CB47DD2728859EF31F26B0] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/01/2008 - 03:34:44.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [76288]
[MD5.FBC0BACD9C3D7F6956853F64A66E252D] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.21/01/2008 - 03:32:22.) -- C:\WINDOWS\system32\Drivers\rdpdr.sys [248832]
[MD5.031E6BCD53C9B2B9ACE111EAFEC347B6] - (.Microsoft Corporation - SMB Transport driver.) (.21/01/2008 - 03:34:49.) -- C:\WINDOWS\system32\Drivers\smb.sys [66560]
[MD5.D09276B1FAB033CE1D40DCBDF303D10F] - (.Microsoft Corporation - TDI Translation Driver.) (.21/01/2008 - 03:34:42.) -- C:\WINDOWS\system32\Drivers\tdx.sys [71680]
[MD5.D8B4A53DD2769F226B3EB374374987C9] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/01/2008 - 03:32:47.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [227896]
~ Generic Processes: Scanned in 00mn 01s

---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/32
~ Mes musiques (My Musics) : 1/8
~ Mes Videos (My Videos) : 1/2
~ Mes Favoris (My Favorites) : 1/21
~ Mes Documents (My Documents) : 1/720
~ Mon Bureau (My Desktop) : 1/127653
~ Menu demarrer (Programs) : 1/47
~ Hidden Files: Scanned in 03mn 46s

---\\ Processus lancés
[MD5.F96EBC5A624349D81DCC7600A3C5DC43] - (.Microsoft Corporation - Console IME.) -- C:\Windows\system32\conime.exe [69120] [PID.6320]
[MD5.C9BE08664611DDAF98E2331E9288B00B] - (.Microsoft Corporation - PresentationFontCache.exe.) -- C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [46104] [PID.7168]
[MD5.A5299D04ED225D64CF07A568A3E1BF8C] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [55184] [PID.3816]
[MD5.0D26C438E2938A3E6BDD91173BC96FF0] - (.Hewlett-Packard - HP Health Check Service.) -- c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [65536] [PID.5848]
[MD5.0BA91E1358AD25236863039BB2609A2E] - (.Microsoft Corporation - Service de gestion des licences Microsoft.) -- C:\Windows\system32\SLsvc.exe [2623488] [PID.460]
[MD5.8E93CDF0EA8EDBA63F07E2898A9B2147] - (.Microsoft Corporation - Windows Update Automatic Updates.) -- C:\Windows\system32\wuauclt.exe [43008] [PID.6540]
[MD5.BF2F2717C13A4BD4FD73F2788534E86B] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe [917400] [PID.1348]
[MD5.AA6844A5127ED4B20DF6D313467B929D] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files\Mozilla Firefox\plugin-container.exe [17304] [PID.2828]
[MD5.680AD8F376970696B45269F074A8A28E] - (.Adobe Systems, Inc. - Adobe Flash Player 11.6 r602.) -- C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe [1822424] [PID.412]
[MD5.95FB55B85D0AFC0962443808383C5588] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [6396416] [PID.4620]
~ Processes Running: Scanned in 00mn 01s

---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\DR\AppData\Roaming\Mozilla\Firefox\Profiles\b8i9g5kg.default\prefs.js
C:\Users\DR\AppData\Roaming\Mozilla\Firefox\Profiles\b8i9g5kg.default\user.js
M3 - MFPP: Plugins - [DR] -- C:\Program Files\Mozilla FireFox\searchplugins\amazon-france.xml
M3 - MFPP: Plugins - [DR] -- C:\Program Files\Mozilla FireFox\searchplugins\bing.xml
M3 - MFPP: Plugins - [DR] -- C:\Program Files\Mozilla FireFox\searchplugins\cnrtl-tlfi-fr.xml
M3 - MFPP: Plugins - [DR] -- C:\Program Files\Mozilla FireFox\searchplugins\eBay-france.xml
M3 - MFPP: Plugins - [DR] -- C:\Program Files\Mozilla FireFox\searchplugins\google.xml
M3 - MFPP: Plugins - [DR] -- C:\Program Files\Mozilla FireFox\searchplugins\wikipedia-fr.xml
M3 - MFPP: Plugins - [DR] -- C:\Program Files\Mozilla FireFox\searchplugins\yahoo-france.xml
M0 - MFSP: prefs.js [DR - b8i9g5kg.default] https://www.google.com/?gws_rd=ssl
M2 - MFEP: prefs.js [DR - b8i9g5kg.default\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}] [dwhelper] DownloadHelper v4.9.14 (.Michel Gutierrez.)
P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (...) -- C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll
P2 - FPN: [HKLM] [@Apple.com/iTunes,version=1.0] - (...) -- C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
P2 - FPN: [HKLM] [@Google.com/GoogleEarthPlugin] - (.Google - GEPlugin.) -- C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
P2 - FPN: [HKLM] [@java.com/DTPlugin,version=1.6.0_33] - (.Sun Microsystems, Inc. - NPRuntime Script Plug-in Library for Java(TM) Deploy.) -- C:\Windows\system32\npdeployJava1.dll
P2 - FPN: [HKLM] [@java.com/JavaPlugin] - (.Sun Microsystems, Inc. - Next Generation Java Plug-in 1.6.0_33 for Mozilla browsers.) -- C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
P2 - FPN: [HKLM] [@Microsoft.com/NpCtrl,version=1.0] - (. Microsoft Corporation - 4.1.10329.0.) -- c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
P2 - FPN: [HKLM] [@microsoft.com/WLPG,version=14.0.8117.0416] - (.Microsoft Corporation - NPWLPG.) -- C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
P2 - FPN: [HKLM] [@microsoft.com/WPF,version=3.5] - (.Microsoft Corporation - Windows Presentation Foundation (WPF) plug-in for Mozilla browsers.) -- c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=3] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll
P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=9] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll
P2 - FPN: [HKLM] [@videolan.org/vlc,version=2.0.1] - (.VideoLAN - VLC media player Web Plugin 2.0.0.) -- C:\Program Files\VideoLAN\VLC\npvlc.dll
~ Firefox Browser: Scanned in 00mn 00s

---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = https://www.microsoft.com/fr-fr/
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.microsoft.com/fr-fr/
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.microsoft.com/fr-fr/
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.microsoft.com/fr-fr/
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs = res://ieframe.dll/tabswelcome.htm
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.VideoLAN - VLC media player Web Plugin 2.0.0.) (No version) -- (.not file.)
R4 - HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,Enabled = 2
~ IE Browser: Scanned in 00mn 00s

---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s

---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\Userinit.exe,
F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Keys: Scanned in 00mn 00s

---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 22

---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: Yontoo Layers - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} . (.Yontoo LLC - Yontoo Runtime.) -- C:\Program Files\Yontoo\YontooIEClient.dll =>PUP.Yontoo
~ BHO: 7 Legitimates Scanned in 00mn 00s

---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: (no name) - [HKLM]{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} Clé orpheline
~ Toolbar: Scanned in 00mn 00s

---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Apoint] . (.Alps Electric Co., Ltd. - Alps Pointing-device Driver.) -- C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [IAAnotif] . (.Intel Corporation - Event Monitor User Notification Tool.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [QPService] . (.CyberLink Corp. - HP QuickPlay Resident Program.) -- C:\Program Files\HP\QuickPlay\QPService.exe
O4 - HKLM\..\Run: [QlbCtrl] . (. Hewlett-Packard Development Company, L.P. - Quick Launch Buttons.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
O4 - HKLM\..\Run: [UCam_Menu] . (.CyberLink Corp. - StartMen Application.) -- C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Run: [Windows Defender] . (.Microsoft Corporation - Windows Defender User Interface.) -- C:\Program Files\Windows Defender\MSASCui.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] . (.Hewlett-Packard Development Company, L.P. - HPWAMain Module.) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] . (.Adobe Systems Incorporated - Adobe CS4 Service Manager.) -- C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
O4 - HKLM\..\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe
O4 - HKLM\..\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKCU\..\Run: [WindowsWelcomeCenter] oobefldr.dll
O4 - HKCU\..\Run: [HPAdvisor] . (.Hewlett-Packard - HP Advisor.) -- C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
O4 - HKCU\..\Run: [uTorrent] . (.BitTorrent, Inc. - µTorrent.) -- C:\Program Files\uTorrent\uTorrent.exe
O4 - HKCU\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe
O4 - HKCU\..\Run: [EPSON Stylus CX4300 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAR.exe
O4 - HKCU\..\Run: [AdobeBridge] Clé orpheline
O4 - HKCU\..\Run: [WMPNSCFG] . (.Microsoft Corporation - Application de configuration du service Par.) -- C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Windows Defender] C:\Users\DR\AppData\Local\Temp\lJxSJ.exe (.not file.)
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe
O4 - HKCU\..\Run: [GoogleDriveSync] . (.Google - Google Drive.) -- C:\Program Files\Google\Drive\googledrivesync.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] oobefldr.dll
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] oobefldr.dll
O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [WindowsWelcomeCenter] oobefldr.dll
O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [HPAdvisor] . (.Hewlett-Packard - HP Advisor.) -- C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [uTorrent] . (.BitTorrent, Inc. - µTorrent.) -- C:\Program Files\uTorrent\uTorrent.exe
O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe
O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [EPSON Stylus CX4300 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAR.exe
O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [AdobeBridge] Clé orpheline
O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [WMPNSCFG] . (.Microsoft Corporation - Application de configuration du service Par.) -- C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [Windows Defender] C:\Users\DR\AppData\Local\Temp\lJxSJ.exe (.not file.)
O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe
O4 - HKUS\S-1-5-21-921124458-1029800000-1231253793-1000\..\Run: [GoogleDriveSync] . (.Google - Google Drive.) -- C:\Program Files\Google\Drive\googledrivesync.exe
~ Application: Scanned in 00mn 00s

---\\ Autres liens utilisateurs (O4)
O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Programs: Windows Mail.lnk . (.Microsoft Corporation - Windows Mail.) -- C:\Program Files\Windows Mail\WinMail.exe
O4 - GS\Programs: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe
O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O4 - GS\QuickLaunch: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe
O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SendTo: Dropbox.lnk . (...) -- C:\Users\DR\Dropbox
O4 - GS\SendTo: Skype.lnk . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe
O4 - GS\Desktop: Audacity.lnk . (.The Audacity Team - Audacity®, the Free, Cross-Platform Sound E.) -- C:\Program Files\Audacity\audacity.exe
O4 - GS\Desktop: Digital Image Recovery.lnk . (...) -- C:\Program Files\Digital Image Recovery\DIR.exe
O4 - GS\Desktop: Dropbox.lnk . (.Dropbox, Inc. - Dropbox.) -- C:\Users\DR\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - GS\Desktop: Google Drive.lnk . (...) -- C:\Users\DR\Google Drive
O4 - GS\Desktop: Images - Raccourci.lnk . (...) -- C:\Users\DR\Pictures
O4 - GS\Desktop: MagicISO.lnk . (.MagicISO, Inc. - MagicISO Maker.) -- C:\Program Files\MagicISO\MagicISO.exe
O4 - GS\Desktop: Téléchargement - Raccourci.lnk . (...) -- C:\Users\DR\Downloads
~ Global Startup: Scanned in 00mn 00s

---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO
~ IE Extra Buttons: Scanned in 00mn 00s

---\\ Winsock hijacker (Layered Service Provider) (O10)
~ Winsock: 7 Legitimates Scanned in 00mn 00s

---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{15381E7B-4353-4480-BD49-8E4CC4253C14}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{AB6CD3B3-BC34-4414-9F12-87CDB96AC58B}: DhcpNameServer = 100.100.3.40
O17 - HKLM\System\CCS\Services\Tcpip\..\{B7A7B727-1515-4E77-99D3-3A25F8C621F5}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{B7A7B727-1515-4E77-99D3-3A25F8C621F5}: DhcpDomain = Belkin
O17 - HKLM\System\CS1\Services\Tcpip\..\{15381E7B-4353-4480-BD49-8E4CC4253C14}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{AB6CD3B3-BC34-4414-9F12-87CDB96AC58B}: DhcpNameServer = 100.100.3.40
O17 - HKLM\System\CS1\Services\Tcpip\..\{B7A7B727-1515-4E77-99D3-3A25F8C621F5}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{B7A7B727-1515-4E77-99D3-3A25F8C621F5}: DhcpDomain = Belkin
O17 - HKLM\System\CS3\Services\Tcpip\..\{15381E7B-4353-4480-BD49-8E4CC4253C14}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{AB6CD3B3-BC34-4414-9F12-87CDB96AC58B}: DhcpNameServer = 100.100.3.40
O17 - HKLM\System\CS3\Services\Tcpip\..\{B7A7B727-1515-4E77-99D3-3A25F8C621F5}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{B7A7B727-1515-4E77-99D3-3A25F8C621F5}: DhcpDomain = Belkin
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
~ Domain: Scanned in 00mn 00s

---\\ Protocole additionnel (O18)
O18 - Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} . (.Microsoft Corporation - Windows Live Mail.) -- C:\Program Files\Windows Live\Mail\mailcomm.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.dll
~ Protocole Additionnel: Scanned in 00mn 00s

---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\WINDOWS\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s

---\\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)
~ SSODL: 1 Legitimates Scanned in 00mn 00s

---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\WINDOWS\System32\browseui.dll
~ STS/SSO: Scanned in 00mn 00s

---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: EBP Pervasive.SQL (EBP Pervasive.SQL) . (...) - C:\PVSW\Bin\WGE_SRV.exe
O23 - Service: Sentinel Keys Server (SentinelKeysServer) . (.SafeNet, Inc. - Pas de description.) - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
O23 - Service: Sentinel Protection Server (SentinelProtectionServer) . (.SafeNet, Inc - Sentinel Protection Server for SuperPro and.) - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
O23 - Service: XAudioService (XAudioService) . (.Conexant Systems, Inc. - Modem Audio Service.) - C:\WINDOWS\System32\DRIVERS\xaudio.exe
~ Services: 12 Legitimates Scanned in 00mn 13s

---\\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Desktop General: BackupWallPaper - .(...) - C:\WINDOWS\web\Wallpaper\img8.jpg
O24 - Desktop General: WallPaper - .(...) - C:\WINDOWS\web\Wallpaper\img8.jpg
~ Desktop Component: 1 Legitimates Scanned in 00mn 00s

---\\ BootExecute (O34)
~ BEX: 1 Legitimates Scanned in 00mn 00s

---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [YourFile Update] (...) -- C:\Program Files\YourFileDownloader\YourFileUpdater.exe (.not file.) [0]
[MD5.B463F51E53CC636C6C40560B6204B50A] [APT] [{DE5F74E3-7B32-45A8-BD7C-14899FDC4826}] (...) -- C:\Users\DR\Downloads\modasng.exe [7783528]
~ Scheduled Task: 11 Legitimates Scanned in 00mn 04s

---\\ Composants installés (ActiveSetup Installed Components) (O40)
~ Active Setup: 13 Legitimates Scanned in 00mn 00s

---\\ Pilotes lancés au démarrage (O41)
~ Drivers: 60 Legitimates Scanned in 00mn 00s

---\\ Logiciels installés (O42)
O42 - Logiciel: ALTools Update - (.ESTsoft Corp..) [HKLM] -- ALUpdate_is1
O42 - Logiciel: ALZip - (.ESTsoft Corp..) [HKLM] -- ALZip_is1
O42 - Logiciel: Adobe CSI CS4 - (.Adobe Systems Incorporated.) [HKLM] -- {0F723FC1-7606-4867-866C-CE80AD292DAF}
O42 - Logiciel: Adobe Dynamiclink Support - (.Adobe Systems Incorporated.) [HKLM] -- {60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}
O42 - Logiciel: Adobe Flash CS4 - (.Adobe Systems Incorporated.) [HKLM] -- {F6E99614-F042-4459-82B7-8B38B2601356}
O42 - Logiciel: Adobe Flash CS4 Extension - Flash Lite STI en - (.Adobe Systems Incorporated.) [HKLM] -- {793D1D88-6141-43DE-BE58-59BCE31B4090}
O42 - Logiciel: Adobe Flash CS4 STI-en - (.Adobe Systems Incorporated.) [HKLM] -- {2168245A-B5AD-40D8-A641-48E3E070B5B6}
O42 - Logiciel: Adobe Flash Player 11 ActiveX - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player ActiveX
O42 - Logiciel: Adobe Flash Player 11 Plugin - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player Plugin
O42 - Logiciel: Adobe Media Encoder CS4 - (.Adobe Systems Incorporated.) [HKLM] -- {DEB90B8E-0DCB-48CE-B90E-8842A2BD643E}
O42 - Logiciel: Adobe Media Encoder CS4 Exporter - (.Adobe Systems Incorporated.) [HKLM] -- {561968FD-56A1-49FD-9ED0-F55482C7C5BC}
O42 - Logiciel: Adobe Media Encoder CS4 Importer - (.Adobe Systems Incorporated.) [HKLM] -- {8186FF34-D389-4B7E-9A2F-C197585BCFBD}
O42 - Logiciel: Adobe Output Module - (.Adobe Systems Incorporated.) [HKLM] -- {BB4E33EC-8181-4685-96F7-8554293DEC6A}
O42 - Logiciel: Adobe Reader 8.1.0 - Français - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-7AD7-1036-7B44-A81000000003}
O42 - Logiciel: Adobe Search for Help - (.Adobe Systems Incorporated.) [HKLM] -- {F0E64E2E-3A60-40D8-A55D-92F6831875DA}
O42 - Logiciel: Adobe Service Manager Extension - (.Adobe Systems Incorporated.) [HKLM] -- {4943EFF5-229F-435D-BEA9-BE3CAEA783A7}
O42 - Logiciel: AdobeColorCommonSetCMYK - (.Adobe Systems Incorporated.) [HKLM] -- {68243FF8-83CA-466B-B2B8-9F99DA5479C4}
O42 - Logiciel: AdobeColorCommonSetRGB - (.Adobe Systems Incorporated.) [HKLM] -- {16E6D2C1-7C90-4309-8EC4-D2212690AAA4}
O42 - Logiciel: Ciel Compta 18.0 - (.Ciel.) [HKLM] -- {A094E2AD-FD66-497A-AC31-59CC71A2DA11}
O42 - Logiciel: Connect - (.Adobe Systems Incorporated.) [HKLM] -- {B29AD377-CC12-490A-A480-1452337C618D}
O42 - Logiciel: EBP Compta 14.1 - (.EBP.) [HKLM] -- EBP Compta 14.1
O42 - Logiciel: EBP Compta 14.1 - (.EBP.) [HKLM] -- {10A4CAB8-D1B8-4C8C-9F54-76BF6063E71B}
O42 - Logiciel: EBP Utilitaire d'échanges 1.1 - (.EBP.) [HKLM] -- EBP Utilitaire d'échanges 1.1
O42 - Logiciel: EBP Utilitaire d'échanges 1.1 - (.EBP.) [HKLM] -- {5E39F2FB-0D5B-413E-903C-3F495017109C}
O42 - Logiciel: Java(TM) 6 Update 2 - (.Sun Microsystems, Inc..) [HKLM] -- {3248F0A8-6813-11D6-A77B-00B0D0160020}
O42 - Logiciel: Java(TM) 6 Update 33 - (.Oracle.) [HKLM] -- {26A24AE4-039D-4CA4-87B4-2F83216033FF}
O42 - Logiciel: Java(TM) SE Development Kit 6 Update 17 - (.Sun Microsystems, Inc..) [HKLM] -- {32A3A4F4-B792-11D6-A78A-00B0D0160170}
O42 - Logiciel: Magic ISO Maker v5.5 (build 0281) - (...) [HKLM] -- Magic ISO Maker v5.5 (build 0281)
O42 - Logiciel: MyPhpFactory 1.0 - (.Webcom, Inc..) [HKLM] -- MyPhpFactory_is1
O42 - Logiciel: Omics8-DirectLab - (.OMICS Software Inc..) [HKLM] -- {E5F138C5-0973-4988-8E93-0769FEAA8A1C}
O42 - Logiciel: Pixel Bender Toolkit - (.Adobe Systems Incorporated.) [HKLM] -- {43509E18-076E-40FE-AF38-CA5ED400A5A9}
O42 - Logiciel: RTF to HTML Converter 1.0 - (.WonderWebWare.com.) [HKLM] -- WonderWebWare RTF to HTML Converter_is1
O42 - Logiciel: Suite Shared Configuration CS4 - (.Adobe Systems Incorporated.) [HKLM] -- {842B4B72-9E8F-4962-B3C1-1C422A5C4434}
O42 - Logiciel: SurfOffline Professional 2 - (.Bimesoft.) [HKLM] -- SurfOffline Professional 2
O42 - Logiciel: Touch Pad Driver - (...) [HKLM] -- {9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}
O42 - Logiciel: Webplayer setup version 1.0 - (...) [HKLM] -- {68D2ED23-69EB-46B7-812C-FDC04C5CA032}_is1 =>Adware.SocialSkinz
O42 - Logiciel: WinOptics - (.WinOptics sarl.) [HKLM] -- WinOptics
O42 - Logiciel: Yontoo 1.10.03 - (.Yontoo LLC.) [HKLM] -- {889DF117-14D1-44EE-9F31-C5FB5D47F68B} =>PUP.Yontoo
O42 - Logiciel: kuler - (.Adobe Systems Incorporated.) [HKLM] -- {098727E1-775A-4450-B573-3F441F1CA243}
O42 - Logiciel: µTorrent - (...) [HKLM] -- uTorrent
~ Logic: 236 Legitimates Scanned in 00mn 01s

---\\ HKCU & HKLM Software Keys
[HKCU\Software\2K75]
[HKCU\Software\Acucorp]
[HKCU\Software\Ah]
[HKCU\Software\AppDataLow\Software\Smartbar] =>Hijacker.SmartBar
[HKCU\Software\Bimesoft]
[HKCU\Software\BitTorrent]
[HKCU\Software\DSNR Labs]
[HKCU\Software\DxOLabs]
[HKCU\Software\LMSOFT]
[HKCU\Software\MagicISO]
[HKCU\Software\Softonic]
[HKCU\Software\SweetIM] =>PUP.SweetIM
[HKCU\Software\WOWSlider.com]
[HKCU\Software\YourFileDownloader]
[HKLM\Software\Bimesoft]
[HKLM\Software\Iminent] =>Adware.IMBooster
[HKLM\Software\LMSOFT]
[HKLM\Software\SweetIM] =>PUP.SweetIM
[HKLM\Software\Tarma Installer]
[HKLM\Software\YourFileDownloader]
~ Key Software: 233 Legitimates Scanned in 00mn 01s

---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 06/01/2013 - 20:04:24 - [0.382] ----D C:\Program Files\Babylon =>Toolbar.Babylon
O43 - CFD: 30/12/2012 - 19:40:11 - [251.743] ----D C:\Program Files\LMSOFT
O43 - CFD: 26/02/2013 - 18:31:47 - [2.960] ----D C:\Program Files\MagicISO
O43 - CFD: 02/04/2013 - 16:30:05 - [2.278] ----D C:\Program Files\MyPhpFactory
O43 - CFD: 01/01/2013 - 11:59:54 - [1.943] ----D C:\Program Files\SurfOffline Professional 2
O43 - CFD: 21/05/2012 - 22:59:03 - [1.056] ----D C:\Program Files\uTorrent
O43 - CFD: 11/11/2012 - 12:21:01 - [12.538] ----D C:\Program Files\Webplayer setup =>Adware.SocialSkinz
O43 - CFD: 18/01/2013 - 15:01:55 - [46.231] ----D C:\Program Files\WinOptics
O43 - CFD: 27/09/2012 - 01:49:38 - [1.176] ----D C:\Program Files\WonderWebWare RTF to HTML Converter
O43 - CFD: 10/11/2012 - 17:59:19 - [0.186] ----D C:\Program Files\Yontoo =>PUP.Yontoo
O43 - CFD: 01/01/2013 - 12:00:39 - [1.618] ----D C:\ProgramData\Bimesoft
O43 - CFD: 05/04/2013 - 10:23:49 - [0.001] ----D C:\ProgramData\open-config
O43 - CFD: 10/11/2012 - 17:59:19 - [1.661] ----D C:\ProgramData\Tarma Installer
O43 - CFD: 20/01/2013 - 00:21:05 - [7.890] --H-D C:\ProgramData\{457901F5-5804-47CE-B6ED-F1EB9C24658D}
O43 - CFD: 20/01/2013 - 00:24:34 - [158.049] --H-D C:\ProgramData\{6F64497B-6549-4D0D-BD03-D772876B75EB}
O43 - CFD: 19/01/2013 - 19:46:29 - [1.229] ----D C:\Users\DR\AppData\Roaming\DxO Labs
O43 - CFD: 07/10/2012 - 11:54:43 - [0.287] ----D C:\Users\DR\AppData\Roaming\eType
O43 - CFD: 30/12/2012 - 19:53:25 - [0.010] ----D C:\Users\DR\AppData\Roaming\LMSOFT
O43 - CFD: 06/04/2013 - 12:19:09 - [6.228] ----D C:\Users\DR\AppData\Roaming\uTorrent
O43 - CFD: 23/09/2012 - 13:09:42 - [0] ----D C:\Users\DR\AppData\Roaming\YourFileDownloader
O43 - CFD: 19/01/2013 - 19:43:31 - [1.968] ----D C:\Users\DR\AppData\Local\DxO_Labs
O43 - CFD: 19/01/2013 - 19:46:17 - [0.002] --H-D C:\Users\DR\AppData\Local\TM9D2uhpZhJNR0l
O43 - CFD: 30/12/2012 - 19:45:12 - [0.009] ----D C:\Users\DR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LMSOFT
O43 - CFD: 26/02/2013 - 18:31:36 - [0] ----D C:\Users\DR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MagicISO
O43 - CFD: 06/01/2013 - 18:42:08 - [0.002] ----D C:\Users\DR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinOptics
~ Program Folder: 219 Legitimates Scanned in 01mn 57s

---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.AF0356B3CEEFEAFB969F11FAB1BE5787] - 06/04/2013 - 11:22:00 ---A- . (...) -- C:\UsbFix [Clean 4] PC-DE-DR.txt [16183]
O44 - LFC:[MD5.3866725134FA41E89B5440D8D65C1C4C] - 06/04/2013 - 11:15:48 ----- . (...) -- C:\UsbFix [Scan 2] PC-DE-DR.txt [9487]
O44 - LFC:[MD5.BEEF84F4163284C8A883D839B093F738] - 06/04/2013 - 10:22:32 ----- . (...) -- C:\UsbFix.txt [765]
O44 - LFC:[MD5.4712CE57B739C41054F1608469A8600B] - 06/04/2013 - 10:21:56 ---A- . (...) -- C:\WINDOWS\pvsw.log [56827]
O44 - LFC:[MD5.50AF7E0CEA671738F79E82B88FC3ED5A] - 05/04/2013 - 14:36:53 ----- . (...) -- C:\UsbFix [Clean 3] PC-DE-DR.txt [8628]
O44 - LFC:[MD5.9E7DA4ABD50A273D51454B22A1EB45F5] - 05/04/2013 - 09:56:37 ----- . (...) -- C:\UsbFix [Scan 1] PC-DE-DR.txt [9556]
O44 - LFC:[MD5.873A21E3D17CC1F542A2746DD4EB33DA] - 05/04/2013 - 09:26:30 ---A- . (...) -- C:\WINDOWS\system.ini [253]
O44 - LFC:[MD5.BED6A061A8364D67774A0D31E97D578F] - 04/04/2013 - 11:27:06 ----- . (...) -- C:\UsbFix [Clean 2] PC-DE-DR.txt [14381]
~ Files: 19 Legitimates Scanned in 00mn 03s

---\\ Déni du service (Local Security Authority) (O48)
~ LSA: 7 Legitimates Scanned in 00mn 00s

---\\ Contrôle du Safe Boot (CSB) (O49)
~ CBS: 15 Legitimates Scanned in 00mn 00s

---\\ Trojan Driver Search Data (HKLM) (O52)
~ TDSD: 4 Legitimates Scanned in 00mn 00s

---\\ Microsoft Control Security Providers (O54)
~ MSCP: 2 Legitimates Scanned in 00mn 00s

---\\ Microsoft Windows Policies System (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLinkedConnections"=1
~ MWPS: 17 Legitimates Scanned in 00mn 00s

---\\ Microsoft Windows Policies Explorer (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDriveAutoRun"=3
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDriveTypeAutoRun"=0
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoDriveAutoRun"=3
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoDriveTypeAutoRun"=0
~ Keys: Scanned in 00mn 00s

---\\ Liste des Drivers Système (O58)
O58 - SDL:[MD5.04F0FCAC69C7C71A3AC4EB97FAFC8303] - 21/01/2008 - 03:32:46 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\WINDOWS\System32\Drivers\adp94xx.sys [422968]
O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 02/11/2006 - 08:09:42 ---A- . (...) -- C:\WINDOWS\System32\ANSI.SYS [9029]
~ Drivers: Scanned in 00mn 00s

---\\ Liste des outils de nettoyage (O63)
O63 - Logiciel: UsbFix By El Desaparecido - (.El Desaparecido - SosVirus.org.) [HKLM] -- Usbfix
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
~ ADS: Scanned in 00mn 00s

---\\ Liste des services Legacy (O64)
~ Legacy: 63 Legitimates Scanned in 00mn 00s

---\\ File Associations Shell Spawning (O67)
O67 - Shell Spawning: <.bat> <batfile>[HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.cpl> <cplfile>[HKLM\..\cplopen\Command] (.Microsoft Corporation - Windows Control Panel.) -- C:\WINDOWS\System32\control.exe
O67 - Shell Spawning: <.cmd> <cmdfile>[HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.com> <comfile>[HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.evt> <evtfile>[HKLM\..\open\Command] (.Microsoft Corporation - Lanceur du composant logiciel enfichable Observateur d'événements.) -- C:\WINDOWS\System32\eventvwr.exe
O67 - Shell Spawning: <.exe> <exefile>[HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.html> <htmlfile>[HKLM\..\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O67 - Shell Spawning: <.js> <jsfile>[HKLM\..\open\Command] (.Microsoft Corporation - Microsoft (R) Windows Based Script Host.) -- C:\WINDOWS\System32\WScript.exe
O67 - Shell Spawning: <.reg> <regfile>[HKLM\..\open\Command] (.Microsoft Corporation - Éditeur du Registre.) -- C:\WINDOWS\regedit.exe
O67 - Shell Spawning: <.html> <FirefoxHTML>[HKCU\..\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O67 - Shell Spawning: <.bat> <batfile>[HKCR\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.cpl> <cplfile>[HKCR\..\cplopen\Command] (.Microsoft Corporation - Windows Control Panel.) -- C:\WINDOWS\System32\control.exe
O67 - Shell Spawning: <.cmd> <cmdfile>[HKCR\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.com> <comfile>[HKCR\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.evt> <evtfile>[HKCR\..\open\Command] (.Microsoft Corporation - Lanceur du composant logiciel enfichable Observateur d'événements.) -- C:\WINDOWS\System32\eventvwr.exe
O67 - Shell Spawning: <.exe> <exefile>[HKCR\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.html> <FirefoxHTML>[HKCR\..\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O67 - Shell Spawning: <.js> <jsfile>[HKCR\..\open\Command] (.Adobe Systems, Inc. - Adobe Dreamweaver CS4.) -- C:\Program Files\Adobe\Adobe Dreamweaver CS4\Dreamweaver.exe
O67 - Shell Spawning: <.reg> <regfile>[HKCR\..\open\Command] (.Microsoft Corporation - Éditeur du Registre.) -- C:\WINDOWS\regedit.exe
~ Keys: Scanned in 00mn 00s

---\\ Start Menu Internet (O68)
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s

---\\ Search Browser Infection (O69)
O69 - SBI: SearchScopes [HKCU] ${searchCLSID} - (@ieframe.dll,-12512) - https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8
O69 - SBI: SearchScopes [HKCU] {51B0C529-4961-4997-B5F3-4D93C5C38223} - (Kelkoo) - http://fr.kelkoopartners.net
O69 - SBI: SearchScopes [HKCU] {F06C9E33-E332-48E7-91DC-AF028AA60E37} - (AOL Recherche) - http://slirsredirect.search.aol.com
~ Keys: Scanned in 00mn 00s

---\\ Recherche des services démarrés par Svchost (O83)
~ Services: 31 Legitimates Scanned in 00mn 00s

---\\ Recherche particuliere à la racine de certains dossiers (O84)
[MD5.816565442BB64A0F4F2B618596F75098] [SPRF][26/06/2012] (...) -- C:\Users\DR\AppData\Local\wbeqvfge.exe [442368]
[MD5.86A81698D73E34F6462F7607EA83F8A9] [SPRF][18/02/2013] (...) -- C:\Users\DR\AppData\Roaming\wklnhst.dat [182]
[MD5.A830AEFF4C87333BBE0222D976F47E6D] [SPRF][16/10/2011] (.ESTsoft Corp. - ALZip Setup.) -- C:\Users\DR\Desktop\ALZip.exe [6852616]
[MD5.006C83751B9F17934B58085D0B7BDA2C] [SPRF][24/01/2007] (.America Online, Inc. - AOL Media Playback Control.) -- C:\WINDOWS\Downloaded Program Files\ampAx3.0.84.2.dll [841304]
[MD5.3FEA9D2EDF23B0283C7A66C8DEA380BD] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player Module.) -- C:\WINDOWS\Downloaded Program Files\dwusplay.dll [24576]
[MD5.CDBE35EA59BC9223E4F800BD1DB82D27] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player.) -- C:\WINDOWS\Downloaded Program Files\dwusplay.exe [196608]
[MD5.0C78701C6F42345DFF2B2B6C3C3D01EF] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Web Agent.) -- C:\WINDOWS\Downloaded Program Files\isusweb.dll [172032]
[MD5.6F678556A6FCE04FC94F3435F6313705] [SPRF][06/03/2008] (...) -- C:\WINDOWS\Downloaded Program Files\unagiuninst.exe [38428]
~ Files: Scanned in 00mn 00s

---\\ Firewall Active Exception List (FirewallRules) (O87)
O87 - FAEL: "{F0F4D101-604B-40F9-96B8-1360C2214806}" | In - Public - P6 - TRUE | .(.AOL LLC - AOL Loader.) -- C:\Program Files\Common Files\AOL\Loader\aolload.exe
O87 - FAEL: "{A1B23C7E-6F91-494B-A99D-EF52F22EDBB1}" | In - Public - P17 - TRUE | .(.AOL LLC - AOL Loader.) -- C:\Program Files\Common Files\AOL\Loader\aolload.exe
O87 - FAEL: "{53AF2BC5-B7A6-4F1F-80AE-F2E78DF302A5}" | In - None - P6 - TRUE | .(.BitTorrent, Inc. - µTorrent.) -- C:\Program Files\uTorrent\uTorrent.exe
O87 - FAEL: "{AFA39A82-5EE6-46CC-8420-9BFC7F19DF14}" | In - None - P17 - TRUE | .(.BitTorrent, Inc. - µTorrent.) -- C:\Program Files\uTorrent\uTorrent.exe
O87 - FAEL: "{57119231-A585-4C3F-848C-D05E0557E8C5}" |In - Public - P6 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\Downloader.exe (.not file.)
O87 - FAEL: "{A57EDCDB-2C94-4411-AA21-19F6C53E1D00}" |In - Public - P17 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\Downloader.exe (.not file.)
O87 - FAEL: "{22033A6E-AB6C-42B0-AEBA-3965582E9621}" |In - Public - P6 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\YourFile.exe (.not file.)
O87 - FAEL: "{93248E24-ED02-4160-927C-BF7ED1318480}" |In - Public - P17 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\YourFile.exe (.not file.)
O87 - FAEL: "{6C07B7F2-C202-4442-B905-98056FE4B957}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\Downloader.exe (.not file.)
O87 - FAEL: "{D2C1CFD0-5158-46BD-986D-C5AA6F201AE3}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\Downloader.exe (.not file.)
O87 - FAEL: "{C2FECF98-3937-4167-9F24-9E92D8D2C2B0}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\YourFile.exe (.not file.)
O87 - FAEL: "{39365B7D-7107-43F4-B097-B9FB94C2EF0F}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\YourFile.exe (.not file.)
O87 - FAEL: "{BDDCB897-E97B-4598-9151-BA74F0E69EEF}" | In - Private - P6 - FALSE | .(.SafeNet, Inc.) -- C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
O87 - FAEL: "{DF1C9C6E-C645-49F0-BDAF-8DBC161F0CAC}" | In - Private - P17 - FALSE | .(.SafeNet, Inc.) -- C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
O87 - FAEL: "{71D92A63-8014-40F5-BA7F-9E7A9E8EC856}" | In - Private - P6 - FALSE | .(.SafeNet, Inc. - Pas de description.) -- C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
O87 - FAEL: "{455CA368-CD81-446B-814D-0F5E104D505C}" | In - Private - P17 - FALSE | .(.SafeNet, Inc. - Pas de description.) -- C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
O87 - FAEL: "{ADE16596-C03C-43AD-8392-A9DDD29140E7}" | In - Private - P6 - TRUE | .(.Bimesoft - SurfOffline.) -- C:\Program Files\SurfOffline Professional 2\SO_PRO.exe
O87 - FAEL: "{89E25BCA-E0C4-4B8B-9B39-5B98690E4AC2}" | In - Private - P17 - TRUE | .(.Bimesoft - SurfOffline.) -- C:\Program Files\SurfOffline Professional 2\SO_PRO.exe
O87 - FAEL: "{625958F8-CE3B-44E7-BD48-D2D0609AA9E6}" | In - Domain - P6 - TRUE | .(...) -- C:\PVSW\Bin\w3dbsmgr.exe
O87 - FAEL: "{F18FD081-23E9-42FE-9ECC-FB5AC2CDA0C8}" | In - Domain - P17 - TRUE | .(...) -- C:\PVSW\Bin\w3dbsmgr.exe
O87 - FAEL: "{9DD05E07-FDEC-4710-AAE5-79E32F634335}" | In - Private - P6 - TRUE | .(...) -- C:\PVSW\Bin\w3dbsmgr.exe
O87 - FAEL: "{735340B3-D0BE-43B7-BF02-0FEAD1DEAE48}" | In - Private - P17 - TRUE | .(...) -- C:\PVSW\Bin\w3dbsmgr.exe
O87 - FAEL: "TCP Query User{2CFE2E54-ADB2-4AB1-A6E9-66B312568EAF}C:\users\dr\desktop\iphone 4 5.1.1\tinyumbrella-6.10.02a.exe" | In - Private - P6 - TRUE | .(...) -- C:\users\dr\desktop\iphone 4 5.1.1\tinyumbrella-6.10.02a.exe
O87 - FAEL: "UDP Query User{BBF681B4-8F9C-47E5-931C-19DD582E3865}C:\users\dr\desktop\iphone 4 5.1.1\tinyumbrella-6.10.02a.exe" | In - Private - P17 - TRUE | .(...) -- C:\users\dr\desktop\iphone 4 5.1.1\tinyumbrella-6.10.02a.exe
O87 - FAEL: "TCP Query User{A6081377-9F05-4628-A348-6DB3FF3F6AD3}C:\users\dr\dropbox\cours et exos\+\logiciels et outils\optical\optical.exe" | In - Private - P6 - TRUE | .(...) -- C:\users\dr\dropbox\cours et exos\+\logiciels et outils\optical\optical.exe
O87 - FAEL: "UDP Query User{3E70E7CA-F9C5-45B2-8E33-0E7A8C28BA7E}C:\users\dr\dropbox\cours et exos\+\logiciels et outils\optical\optical.exe" | In - Private - P17 - TRUE | .(...) -- C:\users\dr\dropbox\cours et exos\+\logiciels et outils\optical\optical.exe
O87 - FAEL: "TCP Query User{04A90919-7455-45A6-BA8B-FB861AA65A46}F:\recycler\e5188982.exe" |In - Private - P6 - TRUE | .(...) -- F:\recycler\e5188982.exe (.not file.)
O87 - FAEL: "UDP Query User{1605CFB4-7864-42CE-978D-AC5B777D6423}F:\recycler\e5188982.exe" |In - Private - P17 - TRUE | .(...) -- F:\recycler\e5188982.exe (.not file.)
~ Firewall: 210 Legitimates Scanned in 00mn 01s

---\\ Scan Additionnel (O88)
Database Version : v2.11367 - (03/04/2013)
Clés trouvées (Keys found) : 34
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 5
Fichiers trouvés (Files found) : 0

[HKLM\Software\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}] =>PUP.Funmoods
[HKLM\Software\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}] =>Adware.Yontoo
[HKLM\Software\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}] =>Adware.Yontoo
[HKLM\Software\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}] =>Adware.Yontoo
[HKLM\Software\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}] =>Adware.Agent
[HKLM\Software\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}] =>Adware.Yontoo
[HKLM\Software\Classes\CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}] =>Adware.Yontoo
[HKLM\Software\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}] =>Adware.Yontoo
[HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}] =>Adware.Yontoo
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}] =>Adware.Yontoo
[HKLM\Software\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}] =>Adware.CDNHelper
[HKLM\Software\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}] =>Adware.Yontoo
[HKLM\Software\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}] =>Adware.Yontoo
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}] =>Adware.Yontoo
[HKLM\Software\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}] =>Adware.Yontoo
[HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}] =>Adware.Yontoo
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}] =>Adware.Yontoo
[HKLM\Software\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}] =>Adware.Yontoo
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}] =>Adware.Yontoo
[HKLM\Software\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}] =>Adware.Yontoo
[HKCU\Software\1ClickDownload] =>PUP.1ClickDownloader
[HKCU\Software\DSNR Labs] =>Toolbar.Agent
[HKLM\Software\Iminent] =>Adware.IMBooster
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKCU\Software\SweetIM] =>PUP.SweetIM
[HKLM\Software\SweetIM] =>PUP.SweetIM
[HKLM\Software\Tarma Installer] =>Toolbar.Agent
[HKLM\Software\Classes\Prod.cap] =>Toolbar.Babylon
[HKLM\Software\Classes\YontooIEClient.Api] =>Adware.Yontoo
[HKLM\Software\Classes\YontooIEClient.Api.1] =>Adware.Yontoo
[HKLM\Software\Classes\YontooIEClient.Layers] =>Adware.Yontoo
[HKLM\Software\Classes\YontooIEClient.Layers.1] =>Adware.Yontoo
[HKLM\Software\Classes\AppID\YontooIEClient.DLL] =>Adware.Yontoo
C:\Program Files\yontoo =>Adware.Yontoo
C:\Program Files\Babylon =>Toolbar.Babylon
C:\Program Files\Webplayer setup =>Adware.SocialSkinz
C:\Users\DR\AppData\Roaming\yourfiledownloader =>PUP.YourFileDownloader
C:\Users\DR\AppData\Roaming\eType =>Adware.Zugo
~ Additionnel: Scanned in 00mn 51s

---\\ Product Upgrade Codes (O90)
O90 - PUC: "409D4822831C85B439CEC563A25B31A0" . (.Les Sims(TM) Histoires de vie.) -- C:\Windows\Installer\{2284D904-C138-4B58-93EC-5C362AB5130A}\ARPPRODUCTICON.exe
O90 - PUC: "5C831F5E37908894E8397096EFAAA8C1" . (.Omics8-DirectLab.) -- C:\Windows\Installer\{E5F138C5-0973-4988-8E93-0769FEAA8A1C}\ARPPRODUCTICON.exe
~ Update Products: 175 Legitimates Scanned in 00mn 00s

---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 14/03/2013 253656 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 11/08/2012 55184 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SS - | Auto 30/08/2011 390504 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SS - | Demand 05/03/2007 110592 | (Com4Qlb) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
SS - | Auto 32768 | (EBP Pervasive.SQL) . (...) - C:\PVSW\Bin\WGE_SRV.exe
SS - | Demand 21/05/2012 655624 | (FLEXnet Licensing Service) . (.Acresso Software Inc..) - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
SS - | Demand 24/07/2007 181800 | (GameConsoleService) . (.WildTangent, Inc..) - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
SS - | Auto 11/06/2012 116648 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 11/06/2012 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SR - | Auto 19/09/2007 65536 | (HP Health Check Service) . (.Hewlett-Packard.) - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
SS - | Auto 05/12/2007 144688 | (hpqwmiex) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
SS - | Auto 03/10/2007 358936 | (IAANTMON) . (.Intel Corporation.) - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
SS - | Demand 03/04/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
SS - | Demand 09/09/2012 821648 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SS - | Demand 31/03/2013 115608 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Auto 272024 | (RichVideo) . (...) - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
SS - | Auto 11/07/2008 328992 | (SentinelKeysServer) . (.SafeNet, Inc..) - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
SS - | Auto 11/07/2008 226592 | (SentinelProtectionServer) . (.SafeNet, Inc.) - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
SS - | Auto 08/01/2013 161536 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe
SS - | Demand 13/05/2012 18432 | (wampapache) . (.Apache Software Foundation.) - c:\wamp\bin\apache\apache2.2.22\bin\httpd.exe
SS - | Demand 8177664 | (wampmysqld) . (...) - c:\wamp\bin\mysql\mysql5.5.24\bin\mysqld.exe
SR - | Auto 21/01/2008 21504 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\WINDOWS\System32\svchost.exe
SR - | Auto 21/01/2008 21504 | C:\WINDOWS\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\WINDOWS\System32\svchost.exe
SS - | Auto 10/07/2007 386560 | (XAudioService) . (.Conexant Systems, Inc..) - C:\WINDOWS\System32\DRIVERS\xaudio.exe
~ Services: Scanned in 00mn 01s

End of the scan (715 lines in 07mn 36s)(0)

salut branche tous tes perifs , carte infectée compris

Attention !!! : Seuls ces liens sont officiels ne pas telecharger l'outil sur d'autres liens !!
Attention !!! : cet outil peut etre détecté à tort comme virus
Attention !!! : cet outil est puissant suivre scrupuleusement les instructions ci-dessous

tous les processus "non vitaux de windows" vont être coupés , enregistre ton travail. Il y aura une extinction du bureau pendant le scan --> pas de panique.

Désactive toutes tes protections si possible , antivirus , sandbox , pare-feux , etc....: https://forum.pcastuces.com/default.asp

telecharge et enregistre Pre_Scan sur ton bureau :

http://services.service-webmaster.fr/cpt-clics/clics-30453-6820.html (renommé winlogon)

ou , si le lien n'est pas fonctionnel :

http://www.archive-host.com (renommé winlogon)
http://www.security-helpzone.com/Tools/g3n/winlogon.exe (renommé winlogon)

si l'outil est relancé plusieurs fois , il te proposera un menu et qu'aucune option n'est demandée, lance l'option "Scan|Kill"

si l'outil est bloqué par l'infection utilise cette version avec ces autres extensions :

http://www.security-helpzone.com/Tools/g3n/Pre_Scan.scr
http://www.security-helpzone.com/Tools/g3n/Pre_Scan.pif
http://www.security-helpzone.com/Tools/g3n/Pre_Scan.com

si l'outil detecte un proxy et que tu n'en as pas installé clique sur "supprimer le proxy"

Il se peut que des fenêtres noires clignotent , laisse-le travailler.

l'outil va envoyer sur un serveur les virus qu'il a mis en quarantaine afin que je puisse l'ameliorer et etudier ces infections plus en profondeur.

Laisse l'outil redemarrer ton pc.

Poste Pre_Scan_la_date_et_l'heure.txt qui apparaitra à la racine de ton disque système ( généralement C:\ )

NE LE POSTE PAS SUR LE FORUM !!! (il est trop long)

Heberge le rapport sur https://www.cjoint.com/ puis donne le lien obtenu en echange sur le forum où tu te fais aider

¤¤¤¤¤¤¤¤¤¤_Pre_Scan_Concept_¤¤¤¤¤¤¤¤¤¤

pourquoi le service pack 2 n'est-il pas installé sur cette machine ?

======

ok relance l'outil , clique sur diag , heberge le rapport pre_diag et donne le lien

?

quand tu as fait usbfix tous tes peripheriques usb etaient branchés ????

hello

fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

▶ Télécharge ici :

Malwarebytes

▶ Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

relance malwarebytes en suivant scrupuleusement ces consignes :

! Déconnecte toi et ferme toutes applications en cours !

▶ Lance Malwarebyte's .

Fais un examen dit "Complet" .

▶ Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
▶ à la fin tu cliques sur "résultat" .
▶ Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

▶ Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !

▶ Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

re

laisse tout branché et suis ce tuto :

http://www.forum-entraide-informatique.com/support/drweb-cureit-tutoriel-t22.html

Hello ,

C'est dossier ont été créé par toi ?

H:\zohir
H:\zohireee
H:\savage
H:\savages
G:\applications
G:\applicationss

Envoi le ou les fichier . pif comme (mokrjf.pif) sur mon serveur stp pour analyse :

http://sosvirus.org/viewtopic.php?f=6&t=489

re

fais exactement ce qu'El Desaparecido demande pour le moment , je suis le sujet.ne supprime aucun fichier et ne tente rien de ton propre chef.evite de brancher d'autres peripheriques usb (mp3 , mp4 , disques externes , sdCard , etc .... , tout objet branché sera infecté )

merci

T'es infecté par Sality :
https://www.virustotal.com/gui/file/2b9f5b93d04dcbd2de6c61516996507af49bfbc9661220530580bd1f1e8725e0

Il va falloir formater l'ordinateur et réinstaller ton système .

Ne pas conserver de fichier .exe .scr .html

salitykiller peut desinfecter

je suis étonné que drweb n'ai pas desinfecté aussi....

il etaient connectés ?

possible de voir le rapport comme demandé ?

nan je trouve pas , voila la screen foto du deusieme resultat
parceque j'ai fait le scan 2 fois
http://cjoint.com/data/0Dlxdp2GrC2.htm

la premiere été plein d'infection
mais la deusieme elle est vide mais toujours il n'a pas scanner mes disque
je crois qu'il scan les disques interne seulement

et le rapport de drweb ?

tu as lu ceci ?

https://forums.commentcamarche.net/forum/affich-27522776-virus-qui-transforme-les-dossier-en-raccourci#27

j'ai scanner le disque amovible avec avira dans un pc clean

une partition été infecter avec sality j'ai suprrimer les fichier infecter dans un premier scan

dans le deusieme scan voila le raport
http://cjoint.com/data/0DnoJWY1Srb.htm

[RESULTAT]  Contient le modèle de détection du virus de script HTML HTML/NetCarto.6913 

Félicitations, si les sites web sont en ligne, ils infestent tous les visiteurs

Tout ça grâce aux cr@cks ....