Aller au contenu

  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

[Résolu] Do-Search (2)

letetra

Par letetra
dans Analyses et éradication malwares

 Partager

Messages recommandés

Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

Pas besoin de Secunia, je donne les liens dans mon sujet sur l'autre forum; l'important est qu'il soit installé.

 

Fais ce que j'ai demandé dans mon post précédent svp.

 

@++

Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

flechedroitets2.pngESET ONLINE SCANNER

Télécharge systemsr4.pngESET Online Scanner sur ton Bureau en cliquant sur ce logo:
hh3lp9.jpg http://download.eset.com/special/eos/esetsmartinstaller_enu.exe

  • Double-clique sur le fichier esetsmartinstaller_enu.exe présent sur ton Bureau pour installer le scanner. Attention: si tu disposes de Windows VISTA, clique droit sur esetsmartinstaller_enu.exe puis sélectionne "exécuter en tant qu'administrateur"
  • Accepte la licence en cochant la case "YES, i accept the terms of use", puis clique sur le bouton "Start"
  • Une fois le scanner installé, configure-le en cochant la case "Remove found threats" et en cochant la case "Scan archives" de même que la case "scan for the potentially unsafe applications."
  • Lance la recherche antivirale en cliquant sur le bouton "Start": l'outil se met à jour puis lance le scan: une barre de progression indique où en est la recherche
  • Quand le scan est terminé, si des virus ont été détectés, clique sur la ligne "List of found threats":
  • Une nouvelle fenêtre apparaît: clique sur "Export to text file" et enregistre le rapport sur ton Bureau en le nommant logESET.txt
  • Clique sur le bouton "Back" pour retourner à l'interface précédente, puis coche la case "Uninstall application on close"
  • Clique enfin sur le bouton "Finish" puis ferme la fenêtre du scanner
  • Ouvre le fichier logESET sur ton Bureau et copie-colle son contenu dans ta prochaine réponse

Nota : ce scan peut être très long et prendre plusieurs heures.

Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

Bonjour,

 

il faut le temps qu'il faut...

Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

Tu as toujours le détournement do-machin chouette?

 

Refais un scan ZHPDiag et héberge le rapport STP.

letetra Member

letetra

Posté(e)
  • Auteur
Posté(e)

~ Rapport de ZHPDiag v2013.12.1.4 - Nicolas Coolman (01/12/2013)
~ Lancé par utilisateur (02/12/2013 17:00:34)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by program


---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.16428
GCIE: Google Chrome v31.0.1650.57 (Defaut)

---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Business Edition, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows® 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 24367
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ Logiciels de protection du système
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft Security Client v4.4.0304.0
Secunia PSI
Ad-Aware Antivirus v10.4.49.4168
ESET Online Scanner v3
Windows Defender W7

---\\ Logiciels d'optimisation du système
CCleaner v3.15 =>Piriform Ltd

---\\ Logiciels de partage PeerToPeer

---\\ Surveillance de Logiciels
Adobe Flash Player 11 Plugin
Adobe Reader XI
Java 7 Update 45

---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 23 Stepping 10, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1900 MB (24% free)
System Restore: Activé (Enable)
System drive C: has 21 GB (15%) free of 138 GB

---\\ Mode de connexion au système
~ Computer Name: UC
~ User Name: utilisateur
~ All Users Names: utilisateur, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\utilisateur\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\utilisateur\AppData\Roaming\
~ %Desktop% : C:\Users\utilisateur\Desktop\
~ %Favorites% : C:\Users\utilisateur\Favorites\
~ %LocalAppData% : C:\Users\utilisateur\AppData\Local\
~ %StartMenu% : C:\Users\utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 21 Go of 138 Go)
D: Hard drive, Flash drive, Thumb drive (Free 0 Go of 1 Go)
E: CD-ROM drive (Not Inserted)
Q: Hard drive, Flash drive, Thumb drive (Free 2 Go of 10 Go)



---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowMyGames: Modified
~ Security Center: 49 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.E6CB36B85BE59095337427E853A5B65A] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.17/11/2013 - 19:20:29.) -- C:\Windows\System32\wininet.dll [2332160]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/09/2013 - 02:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.1B6163C503398B23FF8B939C67747683] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.20/11/2010 - 12:06:41.) -- C:\Windows\system32\Drivers\rdpdr.sys [165888]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 07s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 2/6318
~ Mes musiques (My Musics) : 1/24
~ Mes Videos (My Videos) : 1/3
~ Mes Favoris (My Favorites) : 1/90
~ Mes Documents (My Documents) : 7/4397
~ Mon Bureau (My Desktop) : 1/313
~ Menu demarrer (Programs) : 1/31
~ Hidden Files: Scanned in 00mn 20s



---\\ Processus lancés
[MD5.BB4CEE22CFE1C259F5C4279349EB879C] - (.Orange - Assistance Livebox.) -- C:\Program Files (x86)\Orange\Assistance Livebox\AssistanceLivebox.exe [149824] [PID.2040]
[MD5.299010E02918CE78E6A9839850928E69] - (...) -- C:\Program Files (x86)\Orange\Orange Installer\OrangeInstaller.exe [525248] [PID.1032]
[MD5.B80293D462EC959097A940D70C857BC3] - (.Orange - Executable Orange Inside.) -- C:\Users\utilisateur\AppData\Roaming\Orange\OrangeInside\one\OrangeInside.exe [1530008] [PID.1492]
[MD5.7E6ACA6B6C89B7CD098944A9159DAED3] - (.TomTom - System Tray application for TomTom HOME.) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208] [PID.1560]
[MD5.F3F743635E8158E0D06614FBE2A7E6CD] - (.Logitech Inc. - Logitech Vid HD.) -- C:\Program Files (x86)\Logitech\Vid HD\Vid.exe [5915480] [PID.1368]
[MD5.51138BEEA3E2C21EC44D0932C71762A8] - (...) -- ysWOW64\rundll32.exe [0] [PID.2068]
[MD5.D2C618BC5394D6D91D148556F22016A5] - (.Secunia - Secunia PSI Tray.) -- C:\Program Files (x86)\Secunia\PSI\psi_tray.exe [565464] [PID.2096]
[MD5.BAF535F843A3E790E04A7613811B55BC] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392] [PID.2620]
[MD5.9EDFB86FAA07BFED3C3D00211FAB6D82] - (.Orange - Assistance Livebox.) -- C:\Program Files (x86)\Orange\Assistance Livebox\dist\ST2.exe [13446464] [PID.1948]
[MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.2252]
[MD5.BB4F6465EEB9ACAA5C60C36983740219] - (.Google Inc. - Google Toolbar Broker.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe [310352] [PID.4908] =>Toolbar.Google
[MD5.D645B082E49F8655F14C61DB4EEBBA1D] - (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe [367016] [PID.4440]
[MD5.59A409BAB55E72D33409A8A99F50DB17] - (.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe [264616] [PID.4112]
[MD5.BDB7D97012F9B3102DB72AA76A24942A] - (.ESET - ESET Online Scanner container.) -- C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe [546944] [PID.7088]
[MD5.CC02FE4520CA886508069245D9A6962F] - (.Microsoft Corporation - Internet Low-Mic Utility Tool.) -- C:\Program Files (x86)\Internet Explorer\IELowutil.exe [222720] [PID.5292]
[MD5.2A1BE3D0B2F439ABB52EF1570D8EB4F7] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280] [PID.3112]
[MD5.C8A8321292A459B0A17FB39A782A5C74] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\IEXPLORE.exe [806096] [PID.3132]
[MD5.3E02FD57FDAF184A15CCAD9D9BD9C626] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8263680] [PID.5356]
[MD5.67A95B9D129ED5399E7965CD09CF30E7] - (.Logitech Inc. - Logitech User mode UMVPF service.) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848] [PID.384]
[MD5.A09A61CFDE15E5A67701EA812CE3F43F] - (.Lavasoft Limited - Ad-Aware Antivirus Service.) -- C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe [1236968] [PID.1688]
[MD5.ADDA5E1951B90D3D23C56D3CF0622ADC] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65640] [PID.1544]
[MD5.30E3850F303EAE5C364782EA78579CC9] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [55624] [PID.2052]
[MD5.9D519AAA21E622DF7DF27041E0917499] - (.Pas de propriétaire - DedicarzService.) -- C:\Program Files (x86)\Orange\Assistance Livebox\dedicarz\DedicarzService.exe [1966960] [PID.2596]
[MD5.CF7B0E597C1F34E528285495721DEEE9] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files (x86)\Google\Update\1.3.21.165\GoogleCrashHandler.exe [237960] [PID.2760]
[MD5.2763A02188FFB04287F5034EC5B6B451] - (.Intel Corporation - Local Manageability Service.) -- C:\Program Files (x86)\Intel\AMT\LMS.exe [174616] [PID.2276]
[MD5.65085456FD9A74D7F1A999520C299ECB] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376] [PID.1420]
[MD5.E0D7732F2D2E24B2DB3F67B6750295B8] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512] [PID.860]
[MD5.1014E1D146350347ED6D7ECE1C274DEF] - (.Lenovo - Power Manager Dynamic Brightness Control Se.) -- C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe [72256] [PID.3256]
[MD5.DA6C0E0B15CD0B135FD385AEABAE3A4C] - (.Secunia - Secunia PSI Agent.) -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1228504] [PID.3316]
[MD5.388AE59FE75F1B959DFA0900923C61BB] - (.Skype Technologies S.A. - Skype C2C Service.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000] [PID.3412]
[MD5.E4FAD21646088D79F8889B6531396ACF] - (.TomTom - Windows Service for TomTom HOME.) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [93072] [PID.3516]
[MD5.D47E82866A6FF02DAE9CEDF127C4BEE0] - (.Intel Corporation - User Notification Service.) -- C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2066968] [PID.3544]
[MD5.99FC1599F89A80216E41175B8CA44D89] - (.GFI Software - GFI Software Anti Malware Service.) -- C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe [3677000] [PID.4268]
[MD5.39AC444E07FDBD8C2E8E291A65D515D3] - (.Lenovo Group Limited - About ThinkVantage Technologies.) -- C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe [1019904] [PID.4216]
[MD5.71761EDC432A0E39CF621105884E738E] - (.Secunia - Secunia Update Agent.) -- C:\Program Files (x86)\Secunia\PSI\sua.exe [660184] [PID.6520]
~ Processes Running: Scanned in 00mn 04s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\utilisateur\AppData\Local\Google\Chrome\User Data\Default\Preferences
~ Google Browser: 0 Legitimates Filtered in 00mn 00s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\utilisateur\AppData\Roaming\Mozilla\Firefox\Profiles\g7v8doxf.default\prefs.js
C:\Users\utilisateur\AppData\Roaming\Mozilla\Firefox\Profiles\p1zoskc1.default\prefs.js
C:\Users\utilisateur\AppData\Roaming\Mozilla\Firefox\Profiles\pwi8o4yy.default\prefs.js
C:\Users\utilisateur\AppData\Roaming\Mozilla\Firefox\Profiles\qohjijo9.default\prefs.js
P2 - FPN: [HKLM] [@videolan.org/vlc,version=2.0.5] - (...) -- C:\Program Files\VideoLAN\VLC\npvlc.dll (.not file.)
~ Firefox Browser: 6 Legitimates Filtered in 00mn 01s



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = preserve
~ IE Browser: 17 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Google Toolbar [64Bits] - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll =>Toolbar.Google
O3 - Toolbar\WebBrowser: (no name) [64Bits] - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) [64Bits] - [HKCU]{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} Clé orpheline
~ Toolbar: Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Ad-Aware Antivirus.lnk . (.Lavasoft Limited - Ad-Aware Antivirus Launcher.) -- C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher.exe
O4 - GS\Desktop [Public]: Brother Creative Center.lnk . (.Adobe Systems Incorporated - Adobe Reader.) -- C:\Program Files (x86)\Brother\CreativeCenter\Brother Creative Center.url
O4 - GS\Desktop [Public]: FaceOnBody.lnk . (...) -- C:\Program Files (x86)\FaceOnBody\FaceOnBody.exe
O4 - GS\Desktop [Public]: IncrediMail.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O4 - GS\Desktop [Public]: Orange Portail.lnk . (...) -- C:\Program Files\Orange\Orange Portail.exe
O4 - GS\Program [Public]: IncrediMail.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O4 - GS\QuickLaunch [utilisateur]: Badoo.Desktop.lnk . (.Badoo - Badoo Desktop.) -- C:\ProgramData\Badoo\Badoo desktop\1.6.58.1220\Badoo.desktop.exe
O4 - GS\QuickLaunch [utilisateur]: Free Easy Burner.lnk . (.Koyote Soft - Main Application.) -- C:\Program Files (x86)\Free Easy CD DVD Burner\FreeEasyBurner.exe
O4 - GS\QuickLaunch [utilisateur]: IncrediMail 2.0.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O4 - GS\TaskBar [utilisateur]: IncrediMail.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O4 - GS\Program [utilisateur]: Badoo Desktop.lnk . (.Badoo - Badoo Desktop.) -- C:\ProgramData\Badoo\Badoo desktop\1.6.58.1220\Badoo.desktop.exe
O4 - GS\Program [utilisateur]: Create Amazing Presentations.lnk - Clé orpheline
O4 - GS\Desktop [utilisateur]: ALTools Update.lnk . (.ESTsoft Corp. - ALTools Automatic Updater Program.) -- C:\Program Files (x86)\ESTsoft\ALUpdate\ALUpdate.exe
O4 - GS\Desktop [utilisateur]: Assistance Livebox.lnk . (.Orange - Assistance Livebox.) -- C:\Program Files (x86)\Orange\Assistance Livebox\AssistanceLivebox.exe
O4 - GS\Desktop [utilisateur]: ATF-Cleaner (1) - Raccourci.lnk . (.Atribune.org - ATF Cleaner.exe.) -- C:\Users\utilisateur\ATF-Cleaner (1).exe
O4 - GS\Desktop [utilisateur]: Auslogics Disk Defrag.lnk . (.Auslogics - Disk Defrag.) -- C:\Program Files (x86)\Auslogics\Auslogics Disk Defrag\DiskDefrag.exe
O4 - GS\Desktop [utilisateur]: Bullzip PDF Printer.lnk . (...) -- C:\Program Files (x86)\Bullzip\PDF Printer\gui.exe (.not file.)
O4 - GS\Desktop [utilisateur]: ControlCenter3.lnk . (.Brother Industries, Ltd. - ControlCenter Program.) -- C:\Program Files (x86)\Brother\ControlCenter3\BrCtrCen.exe
O4 - GS\Desktop [utilisateur]: diskmgmt - Raccourci.lnk . (...) -- C:\Windows\System32\diskmgmt.msc
O4 - GS\Desktop [utilisateur]: Internet Explorer (64-bit).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe http://do-search.com =>PUP.DoSearches
O4 - GS\Desktop [utilisateur]: les.profs.2013.french.dvdrip.xvidartefac (1) - Raccourci.lnk . (...) -- C:\Users\utilisateur\les.profs.2013.french.dvdrip.xvidartefac (1).avi
~ Global Startup: 97 Legitimates Filtered in 00mn 05s



---\\ Applications lancées au démarrage du sytème (O4)
O4 - GS\Startup [Public]: Secunia PSI Tray.lnk . (.Secunia - Secunia PSI Tray.) -- C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
O4 - GS\Startup [utilisateur]: Logitech . Enregistrement du produit.lnk . (.Leader Technologies/Logitech - Product Registration.) -- C:\Program Files (x86)\Logitech\Ereg\eReg.exe
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKCU\..\Run: [RESTART_STICKY_NOTES] . (.Microsoft Corporation - Pense-bête.) -- C:\Windows\System32\StikyNot.exe =>.Microsoft Corporation
O4 - HKCU\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKCU\..\Run: [TomTomHOME.exe] . (.TomTom - System Tray application for TomTom HOME.) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
O4 - HKCU\..\Run: [Orange Installer] . (...) -- C:\Program Files (x86)\Orange\Orange Installer\OrangeInstaller.exe
O4 - HKCU\..\Run: [OrangeInside] . (.Orange - Executable Orange Inside.) -- C:\Users\utilisateur\AppData\Roaming\Orange\OrangeInside\one\OrangeInside.exe
O4 - HKCU\..\Run: [Logitech Vid] . (.Logitech Inc. - Logitech Vid HD.) -- C:\Program Files (x86)\Logitech\Vid HD\Vid.exe
O4 - HKCU\..\Run: [ConduitFloatingPlugin_lcnnhcneegeeojhgpfijnlnocjdmlaon] . (.Conduit Ltd. - Conduit Toolbar Verifier.) -- C:\Users\utilisateur\AppData\Roaming\ValueApps\CH\TBVerifier.dll =>Toolbar.Conduit
O4 - HKCU\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe =>Toolbar.Google
O4 - HKCU\..\RunOnce: [uninstall C:\Users\utilisateur\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64] . (.Microsoft Corporation - Interpréteur de commandes Windows.) -- C:\Windows\system32\cmd.exe =>.Microsoft Corporation
O4 - HKCU\..\RunOnce: [uninstall C:\Users\utilisateur\AppData\Local\Microsoft\SkyDrive\17.0.2006.0314_1\amd64] . (.Microsoft Corporation - Interpréteur de commandes Windows.) -- C:\Windows\system32\cmd.exe =>.Microsoft Corporation
O4 - HKCU\..\RunOnce: [uninstall C:\Users\utilisateur\AppData\Local\Microsoft\SkyDrive\17.0.2006.0314_1] . (.Microsoft Corporation - Interpréteur de commandes Windows.) -- C:\Windows\system32\cmd.exe =>.Microsoft Corporation
O4 - HKLM\..\Wow6432Node\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe
O4 - HKLM\..\Wow6432Node\Run: [mobilegeni daemon] . (...) -- C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [sunJavaUpdateSched] . (.Oracle Corporation - Java Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKUS\S-1-5-19\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-3913750368-3197513314-2863159900-1000\..\Run: [RESTART_STICKY_NOTES] . (.Microsoft Corporation - Pense-bête.) -- C:\Windows\System32\StikyNot.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-3913750368-3197513314-2863159900-1000\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-3913750368-3197513314-2863159900-1000\..\Run: [TomTomHOME.exe] . (.TomTom - System Tray application for TomTom HOME.) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
O4 - HKUS\S-1-5-21-3913750368-3197513314-2863159900-1000\..\Run: [Orange Installer] . (...) -- C:\Program Files (x86)\Orange\Orange Installer\OrangeInstaller.exe
O4 - HKUS\S-1-5-21-3913750368-3197513314-2863159900-1000\..\Run: [OrangeInside] . (.Orange - Executable Orange Inside.) -- C:\Users\utilisateur\AppData\Roaming\Orange\OrangeInside\one\OrangeInside.exe
O4 - HKUS\S-1-5-21-3913750368-3197513314-2863159900-1000\..\Run: [Logitech Vid] . (.Logitech Inc. - Logitech Vid HD.) -- C:\Program Files (x86)\Logitech\Vid HD\Vid.exe
O4 - HKUS\S-1-5-21-3913750368-3197513314-2863159900-1000\..\Run: [ConduitFloatingPlugin_lcnnhcneegeeojhgpfijnlnocjdmlaon] . (.Conduit Ltd. - Conduit Toolbar Verifier.) -- C:\Users\utilisateur\AppData\Roaming\ValueApps\CH\TBVerifier.dll =>Toolbar.Conduit
O4 - HKUS\S-1-5-21-3913750368-3197513314-2863159900-1000\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe =>Toolbar.Google
O4 - HKUS\S-1-5-21-3913750368-3197513314-2863159900-1000\..\RunOnce: [uninstall C:\Users\utilisateur\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64] . (.Microsoft Corporation - Interpréteur de commandes Windows.) -- C:\Windows\system32\cmd.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-3913750368-3197513314-2863159900-1000\..\RunOnce: [uninstall C:\Users\utilisateur\AppData\Local\Microsoft\SkyDrive\17.0.2006.0314_1\amd64] . (.Microsoft Corporation - Interpréteur de commandes Windows.) -- C:\Windows\system32\cmd.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-3913750368-3197513314-2863159900-1000\..\RunOnce: [uninstall C:\Users\utilisateur\AppData\Local\Microsoft\SkyDrive\17.0.2006.0314_1] . (.Microsoft Corporation - Interpréteur de commandes Windows.) -- C:\Windows\system32\cmd.exe =>.Microsoft Corporation
~ Application: Scanned in 00mn 01s



---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} ((no name)) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
~ Objets ActiveX: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{DC953BB4-E8C2-4D1F-8A2E-77120470E05E}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{DC953BB4-E8C2-4D1F-8A2E-77120470E05E}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{DC953BB4-E8C2-4D1F-8A2E-77120470E05E}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{DC953BB4-E8C2-4D1F-8A2E-77120470E05E}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft ®.) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation
O18 - Filter: text/xml [64Bits] - {807553E5-5146-11D5-A672-00B0D022E945} . (...) --
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - AppInit_DLLs: . (...) - C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll (.not file.) =>Toolbar.Conduit
~ AppInit DLL: Scanned in 00mn 00s



---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Dedicarz Service (Dedicarz Service) . (.Pas de propriétaire - DedicarzService.) - C:\Program Files (x86)\Orange\Assistance Livebox\dedicarz\DedicarzService.exe
O23 - Service: Session Launcher Service (PelService) . (...) - C:\Program Files\Lenovo\Lenovo Mouse Suite\PelService.exe
O23 - Service: Intel® Management and Security Application User Notificat (UNS) . (.Intel Corporation - User Notification Service.) - C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe
~ Services: 21 Legitimates Filtered in 00mn 11s



---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job [528]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\SystemToolsDailyTest.job [466]
[MD5.00000000000000000000000000000000] [APT] [Test TimeTrigger] (...) -- C:\Users\utilisateur\AppData\Local\Temp\Runner.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{0186D450-2065-4CA0-AF5E-F74513A3BD76}] (...) -- G:\Face On Body v2.4\FOB_Install.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{09C398BC-781B-4160-9C13-8F86FA30C8D9}] (...) -- E:\autorun.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{1D74CCD9-FCF0-4A97-B857-C43EC50C0D2C}] (...) -- G:\InstallTomTomHOME.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{28FF1E8E-93A4-4415-A395-2F368854D5F7}] (...) -- C:\Users\utilisateur\Documents\Downloads\Programs\sp45115_2.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{2B2B98A0-B68D-4C81-BE81-D3A0B8B00217}] (...) -- C:\Users\utilisateur\Documents\Downloads\Programs\sp45115.exe (.not file.) [0]
[MD5.63B340D8E0A47B3B86F9F8056AA49840] [APT] [{3AF90D0F-1639-453B-90F3-99E71BF70023}] (...) -- C:\Users\utilisateur\LeechGet_1800 (3).exe [3054220]
[MD5.00000000000000000000000000000000] [APT] [{48051221-F14A-4A5C-82F3-73B79FE4EE05}] (...) -- C:\Users\utilisateur\Documents\Downloads\Programs\sp45115_4.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{57F15F4A-77A8-4D3D-95C7-23C4BABF65E6}] (...) -- E:\Setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{66A3050A-5789-4490-A56B-82DFE34E390F}] (...) -- D:\InstallTomTomHOME.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{A250079E-665E-43B5-AD5A-3A18B6AA93CB}] (...) -- E:\autorun.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{A7247161-7A71-4E72-8924-11DAB557BF23}] (...) -- C:\Users\utilisateur\Downloads\ie6setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{BABE044D-1E90-4AB3-9A6B-76BA3CA2C887}] (...) -- F:\Face On Body v2.4\FOB_Install.exe (.not file.) [0]
[MD5.63B340D8E0A47B3B86F9F8056AA49840] [APT] [{BBA080A9-0A58-45F5-9671-944EF05D5137}] (...) -- C:\Users\utilisateur\LeechGet_1800 (1).exe [3054220]
[MD5.00000000000000000000000000000000] [APT] [{C14C3045-E94C-4E47-B50B-D28424B0F928}] (...) -- F:\driver wifi\CNP-WF518N1_XP_VISTA.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{C3C19DE6-BD67-4235-B0D5-6340EB3C3F49}] (...) -- C:\Users\utilisateur\Documents\Downloads\Programs\sp45115_5.exe (.not file.) [0]
~ Scheduled Task: 41 Legitimates Filtered in 00mn 14s



---\\ Logiciels installés (O42)
O42 - Logiciel: FaceOnBody - (...) [HKLM][64Bits] -- FaceOnBody
O42 - Logiciel: FaceOnBody Pro v 2.4 - (...) [HKLM][64Bits] -- FaceOnBody Pro v 2.4
O42 - Logiciel: IncrediMail - (.IncrediMail.) [HKLM][64Bits] -- {2CF22C94-1369-4C04-9A5F-A4BC6D91B508}
O42 - Logiciel: IncrediMail 2.0 - (.IncrediMail Ltd..) [HKLM][64Bits] -- IncrediMail
O42 - Logiciel: Photo Loader 2.3F - (...) [HKLM][64Bits] -- {70B45586-B51E-4947-A258-A895596C5CED}
~ Logic: 39 Legitimates Filtered in 00mn 01s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\Conduit] =>Toolbar.Conduit
[HKCU\Software\FaceOnBody2]
[HKCU\Software\IncrediMail]
[HKCU\Software\SecuredDownload]
[HKCU\Software\SpeedBit]
[HKLM\Software\mamverifier]
~ Key Software: 405 Legitimates Filtered in 00mn 01s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 29/06/2012 - 10:44:00 - [3,599] ----D C:\Program Files (x86)\FaceOnBody
O43 - CFD: 29/06/2012 - 10:57:47 - [2,693] ----D C:\Program Files (x86)\FaceOnBody Pro
O43 - CFD: 28/06/2012 - 17:39:59 - [3,970] ----D C:\Program Files (x86)\FaceOnBody2
O43 - CFD: 18/12/2012 - 21:22:05 - [26,519] ----D C:\Program Files (x86)\IncrediMail
O43 - CFD: 03/02/2013 - 22:22:41 - [0] ----D C:\Program Files (x86)\Common Files\SpeedBit
O43 - CFD: 30/11/2013 - 12:04:30 - [0,004] ----D C:\ProgramData\1ED2
O43 - CFD: 03/02/2013 - 10:19:43 - [1,245] ----D C:\ProgramData\Ad-Aware Browsing Protection
O43 - CFD: 18/10/2013 - 20:28:26 - [2,494] ----D C:\ProgramData\FaceOnBody
O43 - CFD: 28/06/2012 - 18:06:33 - [2,417] ----D C:\ProgramData\FaceOnBody2
O43 - CFD: 23/04/2012 - 18:14:32 - [0] ----D C:\ProgramData\IM
O43 - CFD: 23/04/2012 - 18:13:35 - [6,571] ----D C:\ProgramData\IncrediMail
O43 - CFD: 03/02/2013 - 22:35:56 - [0] ----D C:\ProgramData\SpeedBit
O43 - CFD: 24/04/2012 - 08:01:41 - [0] ----D C:\Users\utilisateur\AppData\Roaming\Update
O43 - CFD: 01/12/2013 - 15:21:30 - [0,269] ----D C:\Users\utilisateur\AppData\Roaming\ValueApps =>Toolbar.Conduit
O43 - CFD: 25/04/2013 - 20:23:28 - [707,623] ----D C:\Users\utilisateur\AppData\Local\IM
~ Program Folder: 279 Legitimates Filtered in 02mn 29s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 01/12/2013 - 15:21:38 ---A- . (...) -- C:\END [0]
O44 - LFC:[MD5.0267BBF6F583177D580D7063F74F0BF9] - 02/12/2013 - 15:03:06 ---A- . (...) -- C:\Windows\SysNative\lvcoinst.log [93997]
O44 - LFC:[MD5.0267BBF6F583177D580D7063F74F0BF9] - 02/12/2013 - 15:03:06 ---A- . (...) -- C:\Windows\System32\lvcoinst.log [93997]
O44 - LFC:[MD5.F862CD08F1AD4EE39BD506853F3C6103] - 17/11/2013 - 19:20:27 ---A- . (...) -- C:\Windows\SysNative\ieuinit.inf [16284]
O44 - LFC:[MD5.F862CD08F1AD4EE39BD506853F3C6103] - 17/11/2013 - 19:20:27 ---A- . (...) -- C:\Windows\System32\ieuinit.inf [16284]
~ Files: 139 Legitimates Filtered in 00mn 39s



---\\ Enumération des clés de registre StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\Cld2000.exe [Key] . (...) -- C:\Program Files (x86)\Calendrier\Cld2000.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\ISUSPM [Key] . (...) -- C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\PWMTRV [Key] . (...) -- rundll32 C:\Program Files (x86)\ThinkPad\UTILIT~1\PWMTR64V.dll (.not file.)
O53 - SMSR:HKLM\...\startupreg\PWRAGD [Key] . (...) -- C:\Program Files (x86)\ThinkPad\Utilities\DPMHost.exe
~ SMSR Keys: 33 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 5 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:[MD5.14908F4F9005C29DE8F5587E271390EE] - 02/02/2013 - 19:37:38 ---A- . (.GFI Software - GFI Boot Time Operations Driver.) -- C:\Windows\System32\Drivers\gfibto.sys [14456]
O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:[MD5.1E7A1B51F1F15E20C70913FFBB4AA77F] - 20/09/2007 - 13:11:18 ----- . (.Primax Electronics Ltd. - PS/2 Mouse Filter Driver (For Windows 2000 Only).) -- C:\Windows\System32\Drivers\PELBTM.SYS [16384]
O58 - SDL:[MD5.355238115A4E65CD09DA6790BC33DB5E] - 23/04/2009 - 14:58:16 ----- . (.Primax Electronics Ltd. - Mouse Suite Driver (For Windows 2000 and Whistler Only).) -- C:\Windows\System32\Drivers\PELMOUBT.SYS [22016]
O58 - SDL:[MD5.EACDC573AB61DAB9FBA200C6A6E2371E] - 30/06/2009 - 10:09:56 ----- . (.Primax Electronics Ltd. - PS/2 Mouse Filter Driver.) -- C:\Windows\System32\Drivers\PELPS2M.SYS [14336]
O58 - SDL:[MD5.DD3FD48D69F5FBBB21D46D1514C1C2DB] - 04/11/2013 - 13:42:02 ---A- . (.Secunia - Secunia PSI Driver.) -- C:\Windows\System32\Drivers\psi_mf_amd64.sys [18456]
O58 - SDL:[MD5.A48B9F81D3C2BA989AE2D566747B4623] - 10/08/2005 - 13:46:20 ---A- . (.Protection Technology - StarForce Protection Environment Driver.) -- C:\Windows\System32\Drivers\sfdrv01.sys [68608]
O58 - SDL:[MD5.9E0ECDA6C72C5D0D8CF3F0FBA076422B] - 16/05/2005 - 14:21:16 ---A- . (.Protection Technology - StarForce Protection Helper Driver.) -- C:\Windows\System32\Drivers\sfhlp02.sys [7168]
O58 - SDL:[MD5.F65D13175EBF3FA49B1F7F948926A16E] - 03/11/2005 - 15:40:56 ---A- . (.Protection Technology - StarForce Protection VFS Driver.) -- C:\Windows\System32\Drivers\sfvfs02.sys [89600]
O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
O58 - SDL:[MD5.34859D3801F4BD3DACFA131DD928455A] - 21/02/2012 - 14:58:50 ---A- . (.Windows ® 2000 DDK provider - Image Mounter SCSI Port Driver.) -- C:\Windows\System32\Drivers\uimx64.sys [59184]
O58 - SDL:[MD5.C9E9D59C0099A9FF51697E9306A44240] - 13/12/2012 - 12:50:36 ---A- . (.Apple, Inc. - Apple Mobile Device USB Driver.) -- C:\Windows\System32\Drivers\usbaapl64.sys [54784]
~ Drivers: 16 Legitimates Filtered in 01mn 06s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (...) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: <Torch> <>[HKLM\..\Shell\open\Command] (.Not Key.)
~ Keys: Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} [DefaultScope] - (Conduit Search) - http://search.conduit.com
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Google) - http://www.google.com
O69 - SBI: SearchScopes [HKCU] {814C76CB-2623-43F4-AAD0-58A0E5190A20} - (Orange) - http://r.orange.fr
~ Keys: Scanned in 00mn 00s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.16E53BFC96CE14021C0E07EB1C198478] [sPRF][18/12/2012] (...) -- C:\Users\utilisateur\AppData\Roaming\inst.exe [99384]
~ Files: 8 Legitimates Filtered in 00mn 00s



---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{41D983B3-7652-4F04-A018-683991816994}" | In - Public - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{A4AC4A3C-8EF9-436E-B54F-0956195061A3}" | In - Public - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{F09A9820-6A3A-469E-BC4A-2ED24A55175B}" | In - Public - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "{8F4FB771-D955-4DD0-A645-A88582A172B9}" | In - Public - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "{F8F27A5A-82C5-46B0-897B-6003A3CCD9CC}" | In - Public - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{87E5883A-4B38-466A-817E-40777980740E}" | In - Public - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files (x86)\IncrediMail\Bin\ImpCnt.exe
~ Firewall: 216 Legitimates Filtered in 00mn 01s



---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "49C22FC2963140C4A9F54ACBD6195B80" . (.IncrediMail.) -- C:\Windows\Installer\{2CF22C94-1369-4C04-9A5F-A4BC6D91B508}\ARPPRODUCTICON.exe
~ Update Products: 80 Legitimates Filtered in 00mn 00s



---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.AD0D3E2D2761E96364C21C5C0ECD1C85] [WIS][14/05/2013] (.IncrediMail - IncrediMail.) -- C:\Windows\Installer\1a39691.msi [2688512]
~ WIS: 82 Legitimates Filtered in 00mn 26s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 01/12/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Auto 24/04/2012 136176 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 24/04/2012 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 16/08/2012 194032 | (gusvc) . (.Google.) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Demand 22/10/2004 73728 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
SS - | Auto 29/08/2013 1073160 | (Orange update Core Service) . (.Orange SA.) - C:\Program Files (x86)\Orange\OrangeUpdate\Service\OUCore.exe
SS - | Auto 05/09/2013 171680 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Demand 06/07/2010 1475896 | (TVT Backup Service) . (.Lenovo Group Limited.) - C:\Program Files (x86)\Lenovo\Rescue and Recovery\rrservice.exe
SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SS - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation

SR - | Auto 14/12/2012 1236968 | (Ad-Aware Service) . (.Lavasoft Limited.) - C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe
SR - | Auto 05/09/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 07/09/2013 55624 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 30/08/2011 462184 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Auto 10/06/2013 1966960 | (Dedicarz Service) . (...) - C:\Program Files (x86)\Orange\Assistance Livebox\dedicarz\DedicarzService.exe
SR - | Demand 02/11/2013 641352 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SR - | Auto 07/10/2009 174616 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\AMT\LMS.exe
SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
SR - | Auto 23/10/2013 23808 | (MsMpSvc) . (.Microsoft Corporation.) - c:\Program Files\Microsoft Security Client\MsMpEng.exe
SR - | Auto 22/04/2010 177152 | (PelService) . (...) - C:\Program Files\Lenovo\Lenovo Mouse Suite\PelService.exe
SR - | Auto 13/08/2009 72256 | (Power Manager DBC Service) . (.Lenovo.) - C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
SR - | Auto 20/09/2012 3677000 | (SBAMSvc) . (.GFI Software.) - C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe
SR - | Auto 04/11/2013 1228504 | (Secunia PSI Agent) . (.Secunia.) - C:\Program Files (x86)\Secunia\PSI\PSIA.exe
SR - | Auto 04/11/2013 660184 | (Secunia Update Agent) . (.Secunia.) - C:\Program Files (x86)\Secunia\PSI\sua.exe
SR - | Auto 02/10/2012 3064000 | (Skype C2C Service) . (.Skype Technologies S.A..) - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
SR - | Auto 28/08/2009 1019904 | (ThinkVantage Registry Monitor Service) . (.Lenovo Group Limited.) - C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe
SR - | Auto 27/08/2013 93072 | (TomTomHOMEService) . (.TomTom.) - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
SR - | Auto 18/01/2012 450848 | (UMVPFSrv) . (.Logitech Inc..) - C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
SR - | Auto 07/10/2009 2066968 | (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Common Files\Intel\Privacy Icon\UNS\UNS.exe
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

~ Services: Scanned in 00mn 33s



---\\ Scan Additionnel (O88)
Database Version : 13007 - (01/12/2013)
Clés trouvées (Keys found) : 21
Valeurs trouvées (Values found) : 2
Dossiers trouvés (Folders found) : 2
Fichiers trouvés (Files found) : 3

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C9A6357B-25CC-4BCF-96C1-78736985D412}] =>Toolbar.Orange
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888] =>Toolbar.Ask
[HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASAPI32] =>Toolbar.Bing
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95525BD9-6136-4A26-8263-9CEE295D442D}] =>Toolbar.4shared
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95525BD9-6136-4A26-8263-9CEE295D442D}] =>Toolbar.4shared
[HKLM\Software\Classes\CLSID\{95525BD9-6136-4A26-8263-9CEE295D442D}] =>Toolbar.4shared
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95525BD9-6136-4A26-8263-9CEE295D442D}] =>Toolbar.4shared
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95525BD9-6136-4A26-8263-9CEE295D442D}] =>Toolbar.4shared
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95080B13-AA71-4EE8-B951-7E98221E1ED5}] =>Toolbar.4shared
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CD1A63BA-A08C-431B-9A34-F240AADC728D}] =>Adware.MyWebSearch
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CD1A63BA-A08C-431B-9A34-F240AADC728D}] =>Adware.MyWebSearch
[HKLM\Software\Classes\IncrediSpooler.DeltaSync] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\IncrediSpooler.DeltaSync.1] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\IncrediSpooler.DeltaSync] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\IncrediSpooler.DeltaSync.1] =>Toolbar.DeltaSearch
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{2318C2B1-4965-11d4-9B18-009027A5CD4F} =>Toolbar.Google^
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:ConduitFloatingPlugin_lcnnhcneegeeojhgpfijnlnocjdmlaon =>Toolbar.Conduit^
C:\Users\utilisateur\AppData\Roaming\ValueApps =>Toolbar.Conduit^
C:\Users\utilisateur\AppData\Local\SearchProtect =>Toolbar.Conduit
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe =>Toolbar.Google^
[HKCU\Software\Conduit] =>Toolbar.Conduit^
C:\Users\utilisateur\AppData\Local\Temp\GoogleToolbarInstaller1.log =>PUP.Babylon
~ Additionnel Scan: 326234 Items scanned in 01mn 04s



---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com/apps/blog/show/33477786-pup-dosearches =>PUP.DoSearches
~ http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit
~ http://nicolascoolman.webs.com/apps/blog/show/28927746-toolbar-ask =>Toolbar.Ask
~ http://nicolascoolman.webs.com/apps/blog/show/27146838-adware-mywebsearch =>Adware.MyWebSearch
~ http://nicolascoolman.webs.com/apps/blog/show/27875657-toolbar-deltasearch =>Toolbar.DeltaSearch
~ http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon =>PUP.Babylon
~ MSI: 6 link(s) detected in 01mn 04s



~ 1479 Legitimates filtered by white list
End of the scan (592 lines in 07mn 44s)(0)

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

×
 Partager
Aller sur la liste des sujets

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...