Aller au contenu

  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

[Résolu] Enlever un virus sur mon PC -> HD-4.9

philfou

Par philfou
dans Analyses et éradication malwares

 Partager

Messages recommandés

philfou Junior Member

philfou

Posté(e)
Posté(e)

bonjour,

j'ai des fenêtres de pub qui s'ouvrent tout le temps, visiblement j'ai un nouveau truc qui s'affiche HD 4.9, je ne sais pas ce que c'est.

Quelqu'un peut-il m'aider ?

Merci

Philippe

Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

Bonsoir,

 

 

 

ZHPDiag :

  • Télécharge ZHPDiag de Nicolas Coolman. et enregistre-le sur le BUREAU.
    Lien de secours: ftp://zebulon.fr/ZHPDiag2.exe
  • Double-clique sur ZHPDiag.exe pour lancer l'installation
    • Important:
      Sous Vista et Windows 7/8 : il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur


N'oublie pas de cocher la case qui permet de mettre un raccourci sur le Bureau.

[*]L'outil a créé 2 icônes ZHPDiag et ZHPFix sur le Bureau.

[*]Double-clique sur ZHPDiag pour lancer l'exécution

  • Important:
    Sous Vista et Windows 7 : il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur

Clique sur Configurer.

[*]Clique sur le petit tournevis tournevis.jpg et clique sur TOUS.

zhpdiagc2_zps5d3f82ed.jpg

Décocher 045 et 061 . Clic sur OK.

[*]Clique sur Rechercher pour lancer l'analyse. Tu patientes jusqu'à ce que le scan affiche 100%
Tu refermes ZHPDiag

[*]Le rapport ZHPDiag.txt se trouve sur le Bureau. (et sous c:\ZHP\ZHPDiag.txt)
Ce rapport étant trop long pour le forum, héberge le :

ou http://dl.free.fr/

http://www.rue-du-montceau.fr/tuto_cjoint.html >> tuto de Nardino pour héberger.

16-01-201400-29-39_zpsaee22218.jpg

@++

 

Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

A)

 

ZHPFix :

  • Ferme toutes les applications ouvertes
  • Double-clique sur ZHPFix, raccourci installé par ZHPDiag sur le Bureau
    Important:
    Sous Vista et Windows 7/8 : il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur.
  • Copie les lignes ci-dessous dans la fenêtre

sauf citation.

 

 

Script ZHPFix

G2 - GCE: Preference [user Data\Default] [emcodopgkennkkhddeagljloebpncidk] SaveAs v.2 (Désactivé) => Infection PUP (PUP.Offerware)
G2 - GCE: Preference [user Data\Default] [pbojlkfjeklgcdnfflbnlpbgmlaoffbi] SaveAs v.2 (Désactivé) => Infection PUP (PUP.Offerware)
M0 - MFSP: prefs.js [Concomitance - 0] http://websearch.mocaflix.com => PUP.Mocaflix
R0 - HKCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page = http://allssearch.com =>Adware.SocialSkinz
O4 - GS\Program [Concomitance]: WebPlayerV2.lnk . (...) -- C:\Users\Concomitance\AppData\Roaming\Microsoft\Installer\{77236F9C-987C-40EC-832B-5BD6181E4846}\_383C4C6B4D3B599ADF1116.exe => Infection PUP (Adware.SocialSkinz)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Plus-HD-4.9-chromeinstaller.job [1988] =>Adware.PlusHD
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Plus-HD-4.9-codedownloader.job [1244] =>Adware.PlusHD
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Plus-HD-4.9-enabler.job [1144] =>Adware.PlusHD
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Plus-HD-4.9-firefoxinstaller.job [2118] =>Adware.PlusHD
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Plus-HD-4.9-updater.job [1342] =>Adware.PlusHD
[MD5.90A64787EF51413479E44E0669116CE1] [APT] [Plus-HD-4.9-chromeinstaller] (.Plus HD.) -- C:\Program Files (x86)\Plus-HD-4.9\Plus-HD-4.9-chromeinstaller.exe [832872] =>Adware.PlusHD
[MD5.5C6D3F84769CA34156392D4065700920] [APT] [Plus-HD-4.9-codedownloader] (.Plus HD.) -- C:\Program Files (x86)\Plus-HD-4.9\Plus-HD-4.9-codedownloader.exe [528232] =>Adware.PlusHD
[MD5.D2B48154D86135C93C744F4531AF7C95] [APT] [Plus-HD-4.9-enabler] (.Plus HD.) -- C:\Program Files (x86)\Plus-HD-4.9\Plus-HD-4.9-enabler.exe [348520] =>Adware.PlusHD
[MD5.61F935C026F0D50E7786616DB3598441] [APT] [Plus-HD-4.9-firefoxinstaller] (.Plus HD.) -- C:\Program Files (x86)\Plus-HD-4.9\Plus-HD-4.9-firefoxinstaller.exe [890728] =>Adware.PlusHD
[MD5.25081264BE938982FFB12BD438CAE340] [APT] [Plus-HD-4.9-updater] (.Plus HD.) -- C:\Program Files (x86)\Plus-HD-4.9\Plus-HD-4.9-updater.exe [358248] =>Adware.PlusHD
O42 - Logiciel: Plus-HD-4.9 - (.Plus HD.) [HKLM][64Bits] -- Plus-HD-4.9 =>Adware.PlusHD
O42 - Logiciel: Search Assistant MocaFlix 1.66 - (...) [HKLM][64Bits] -- SP_8e4eb48d => Infection PUP (PUP.Mocaflix)
O42 - Logiciel: WebPlayerV2 - (.Kreapixel.) [HKLM][64Bits] -- {77236F9C-987C-40EC-832B-5BD6181E4846} =>Adware.SocialSkinz
[HKCU\Software\1ClickDownload] =>PUP.1ClickDownloader
[HKCU\Software\InstalledBrowserExtensions] =>Adware.VidSaver
[HKLM\Software\IB Updater] =>Adware.InstallBrain
[HKLM\Software\Iminent] =>Adware.IMBooster
[HKLM\Software\Wow6432Node\Iminent] =>Adware.IMBooster
[HKLM\Software\Wow6432Node\SP Global] =>PUP.AdvancedSystemProtector
O43 - CFD: 05/01/2014 - 20:53:46 - [0] ----D C:\Program Files (x86)\IminentToolbar =>Adware.IMBooster
O43 - CFD: 28/01/2013 - 10:33:40 - [0,376] ----D C:\Program Files (x86)\MocaFlix => Infection PUP (PUP.Mocaflix)
O43 - CFD: 17/01/2014 - 20:20:37 - [8,022] ----D C:\Program Files (x86)\Plus-HD-4.9 =>Adware.PlusHD
O43 - CFD: 18/12/2012 - 10:05:12 - [0,084] ----D C:\ProgramData\SaveAs => Infection PUP (PUP.Offerware)
O43 - CFD: 04/01/2014 - 17:13:02 - [0,259] ----D C:\Users\Concomitance\AppData\Roaming\IminentToolbar =>Adware.IMBooster
O69 - SBI: SearchScopes [HKCU] {2DD7C196-7FAE-49D6-9150-5B25BAE5477E} - (Search the web (Softonic)) - http://search.softonic.com =>Adware.IMBooster
[MD5.4027E144748FD3463DCA96B83690D409] [sPRF][04/01/2014] (.Iminent - Iminent Setup.) -- C:\Users\Concomitance\AppData\Local\Temp\IminentSetup.exe [2092328] =>Adware.IMBooster
[MD5.991B768251C4B28DE937464C7D83C44D] [sPRF][04/01/2014] (.Vubfcwzq - Ufwrlxuvoab.) -- C:\Users\Concomitance\AppData\Local\Temp\plus-hd-4-91.exe [5389048] =>Adware.PlusHD
[MD5.2B4435B8A24C72CB360B64EB4397D43A] [WIS][23/03/2012] (.Boxore OU. - Software Update Helper.) -- C:\Windows\Installer\6e5b2c.msi [45056] =>Adware.Boxore
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Plus-HD-4.9] =>Adware.PlusHD^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{77236F9C-987C-40EC-832B-5BD6181E4846}] =>Adware.SocialSkinz^
[HKLM\Software\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}] =>Adware.IMBooster
[HKLM\Software\Wow6432Node\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}] =>Adware.IMBooster
[HKLM\Software\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}] =>Adware.IMBooster
[HKLM\Software\Wow6432Node\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}] =>Adware.IMBooster
[HKLM\Software\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}] =>Adware.IMBooster
[HKLM\Software\Wow6432Node\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}] =>Adware.IMBooster
[HKLM\Software\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}] =>Adware.IMBooster
[HKLM\Software\Wow6432Node\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}] =>Adware.IMBooster
[HKLM\Software\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}] =>PUP.RewardsArcade
[HKLM\Software\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}] =>Adware.IMBooster
[HKLM\Software\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}] =>PUP.ToparcadeHits
[HKLM\Software\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}] =>PUP.ToparcadeHits
[HKLM\Software\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}] =>PUP.RewardsArcade
[HKLM\Software\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08}] =>Adware.IMBooster
[HKLM\Software\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}] =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}] =>PUP.RewardsArcade
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9] =>Adware.MyWebSearch
[HKCU\Software\1ClickDownload] =>PUP.1ClickDownloader
[HKLM\Software\Iminent] =>Adware.IMBooster
[HKLM\Software\Wow6432Node\Iminent] =>Adware.IMBooster
[HKLM\Software\Wow6432Node\SP Global] =>PUP.AdvancedSystemProtector
[HKCU\Software\AppDataLow\SProtector] =>PUP.AdvancedSystemProtector
[HKLM\Software\Wow6432Node\Microsoft\Tracing\Iminent_RASAPI32] =>Adware.Bandoo
[HKLM\Software\Wow6432Node\Microsoft\Tracing\Iminent_RASMANCS] =>Adware.Bandoo
[HKLM\Software\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP] =>Adware.IMBooster
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B24D9234-CFC5-46D2-95C5-0DE695A7895E}] =>Adware.Downware
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\64A6E60055D801F4BB8AC269354B72B8] =>Adware.Boxore
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload] =>PUP.1ClickDownloader
[HKLM\Software\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}] =>Adware.Agent
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375] =>PUP.Tarma
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5] =>PUP.Tarma
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{77236F9C-987C-40EC-832B-5BD6181E4846}] =>Adware.SocialSkinz
[HKLM\Software\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}] =>Adware.MagniPic
[HKLM\Software\Wow6432Node\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}] =>Adware.MagniPic
[HKCU\Software\AppDataLow\Software\Crossrider] =>PUP.CrossRider
[HKCU\Software\InstalledBrowserExtensions\] =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Microsoft\Tracing\boxore_RASAPI32] =>Adware.Boxore
[HKLM\Software\Wow6432Node\Microsoft\Tracing\boxore_RASMANCS] =>Adware.Boxore
[HKCU\Software\InstalledBrowserExtensions] =>PUP.CrossRider
[HKLM\Software\Classes\protector_dll.protectorbho] =>PUP.BProtector
[HKLM\Software\Classes\protector_dll.protectorbho.1] =>PUP.BProtector
[HKLM\Software\Classes\CLSID\{11111111-1111-1111-1111-110411591118}] =>PUP.CrossRider
[HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220422592218}] =>PUP.CrossRider
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110411591118}] =>PUP.CrossRider
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CA0054A5AB3EFFE4CB5660E44A1E7DCC] =>Adware.Boxore^
C:\Program Files (x86)\IminentToolbar =>Adware.IMBooster^
C:\Program Files (x86)\Plus-HD-4.9 =>Adware.PlusHD^
C:\Users\Concomitance\AppData\Roaming\IminentToolbar =>Adware.IMBooster^
C:\Program Files (x86)\MocaFlix =>PUP.Mocaflix
C:\ProgramData\SaveAs =>PUP.Offerware
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SaveAs =>PUP.Offerware
C:\Users\Concomitance\AppData\Roaming\WebPlayerBdd =>Adware.SocialSkinz
C:\Users\Concomitance\AppData\LocalLow\SaveAs =>PUP.Offerware
C:\Windows\Tasks\Plus-HD-4.9-chromeinstaller.job =>Adware.PlusHD^
C:\Windows\Tasks\Plus-HD-4.9-codedownloader.job =>Adware.PlusHD^
C:\Windows\Tasks\Plus-HD-4.9-enabler.job =>Adware.PlusHD^
C:\Windows\Tasks\Plus-HD-4.9-firefoxinstaller.job =>Adware.PlusHD^
C:\Windows\Tasks\Plus-HD-4.9-updater.job =>Adware.PlusHD^
C:\Program Files (x86)\Plus-HD-4.9\Plus-HD-4.9-chromeinstaller.exe =>Adware.PlusHD^
C:\Program Files (x86)\Plus-HD-4.9\Plus-HD-4.9-codedownloader.exe =>Adware.PlusHD^
C:\Program Files (x86)\Plus-HD-4.9\Plus-HD-4.9-enabler.exe =>Adware.PlusHD^
C:\Program Files (x86)\Plus-HD-4.9\Plus-HD-4.9-firefoxinstaller.exe =>Adware.PlusHD^
C:\Program Files (x86)\Plus-HD-4.9\Plus-HD-4.9-updater.exe =>Adware.PlusHD^
[HKLM\Software\IB Updater] =>Adware.InstallBrain^
C:\Users\Concomitance\AppData\Local\Temp\IminentSetup.exe =>Adware.IMBooster^
C:\Users\Concomitance\AppData\Local\Temp\plus-hd-4-91.exe =>Adware.PlusHD^
C:\Windows\Installer\6e5b2c.msi =>Adware.Boxore^
firewallraz
shortcutfix
proxyfix
emptytemp
emptyflash

Cliquer sur IMPORTER., cela devrait coller le contenu du presse papier dans la fenêtre ZHPFix.

  • Le script doit automatiquement apparaitre dans ZHPFix.
    Clique sur le bouton GO pour lancer le nettoyage

  • Valide par Oui la désinstallation des programmes si demandé.
  • Laisse l'outil travailler. Si un redémarrage est demandé, accepte et redémarre le PC
  • Le rapport ZHPFixReport.txt s'affiche. Copie-colle le contenu de ce rapport dans ta réponse.
    Le rapport ZHPFixReport.txt est enregistré sous C:\ZHP\ZHPFix.txt

Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr , Onglet Fichier , Nouvelle tâche , tape explorer.exe et valide.

 

----------------------------------

B))

1) Télécharge Junkware Removal Tool sur le bureau: http://www.bleepingcomputer.com/download/junkware-removal-tool/

18-01-2014-17-20-00-4362ccf.jpg

Site éditeur: http://thisisudax.org/

Sous XP, double-clique sur l'icône et presse une touche lorsque cela sera demandé.

Sous Vista/7/8, clic droit/exécuter en temps qu'administrateur.

L'outil peut demander si on souhaite vérifier la présence d'une nouvelle version Y/N >> taper Y.
S'il découvre une version obsolète, il le dira et devrez presser une touche. L'outil se fermera.

JRT_New sera créé sur le bureau;

Jette l'ancien JRT et renomme JRT_New en JRT .

Si c'est déjà la bonne version , il commencera sa recherche de malwares normalement. Patience svp.

Afin de ne pas fausser le rapport, ne passer l'outil qu'une seule fois svp!

Si l'antivirus fait des siennes: désactive-le provisoirement. Si tu ne sais pas comment faire, reporte-toi à cet article.

Poste le rapport généré à la fin de l'analyse.

NB: Le bureau disparaitra un instant, c'est normal.

>>>Si le rapport est long, l'héberger ici: http://cjoint.com ou http://dl.free.fr/

capture1-3bf0deb_zpsf4ca5241.jpg

capture2-3bf0dfa_zps7abd8f5a.jpg

------------------------------
*** Si tu as une ancienne version d'AdwCleaner, lance-le et clique sur désinstaller.***

2) Télécharge AdwCleaner par Xplode: http://general-changelog-team.fr/telechargements/logiciels/viewdownload/75-outils-de-xplode/28-adwcleaner

Enregistre-le sur le bureau (et pas ailleurs).

Afin de ne pas fausser le rapport, ne passer l'outil qu'une seule fois svp!

Si tu es sous XP double clique sur AdwCleaner pour lancer l'outil.
Si tu es sous Vista/Seven, clique droit sur AdwCleaner et choisis exécuter en temps qu'administrateur.

Clique sur Scanner et laisse travailler l'outil.

Cliquer sur Nettoyer, le bouton sera accessible.

Le rapport va s'ouvrir en fichier texte; copie la totalité de son contenu et colle-le dans ta réponse.

Le rapport est en outre sauvegardé sous C:\AdwCleaner[s0]

NB: Si l'outil "cale" en mode normal, le lancer en mode sans échec: http://www.vista-xp.fr/forum/topic93.html

A lire absolument: http://www.vista-xp.fr/forum/topic5482.html
http://www.vista-xp.fr/forum/topic10389.html

-------------------------

@++

 

philfou Junior Member

philfou

Posté(e)
  • Auteur
Posté(e)

ADW

 

# AdwCleaner v3.017 - Rapport créé le 18/01/2014 à 20:01:10
# Mis à jour le 12/01/2014 par Xplode
# Système d'exploitation : Windows 7 Professional Service Pack 1 (64 bits)
# Nom d'utilisateur : Concomitance - CONCOMITANCE-PG
# Exécuté depuis : C:\Users\Concomitance\Desktop\AdwCleaner.exe
# Option : Nettoyer
***** [ Services ] *****
Service Supprimé : vToolbarUpdater17.3.0
***** [ Fichiers / Dossiers ] *****
Dossier Supprimé : C:\Kreapixel
Dossier Supprimé : C:\ProgramData\AVG Secure Search
Dossier Supprimé : C:\Program Files (x86)\AVG Secure Search
Dossier Supprimé : C:\Program Files (x86)\Common Files\AVG Secure Search
Dossier Supprimé : C:\Users\Concomitance\AppData\Local\AVG Secure Search
Dossier Supprimé : C:\Users\Concomitance\AppData\LocalLow\AVG Secure Search
Dossier Supprimé : C:\Users\Concomitance\AppData\LocalLow\IminentToolbar
Dossier Supprimé : C:\Users\Concomitance\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Fichier Supprimé : C:\Program Files (x86)\Mozilla Firefox\user.js
Fichier Supprimé : C:\Users\Concomitance\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
***** [ Raccourcis ] *****
***** [ Registre ] *****
Valeur Supprimée : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{336D0C35-8A85-403A-B9D2-65C292C39087}]
Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Valeur Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
Clé Supprimée : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_0e313256
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{B24D9234-CFC5-46D2-95C5-0DE695A7895E}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C9A6357B-25CC-4BCF-96C1-78736985D412}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Valeur Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}
Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Clé Supprimée : HKCU\Software\AVG Secure Search
Clé Supprimée : HKLM\Software\AVG Secure Search
Clé Supprimée : HKLM\Software\AVG Security Toolbar
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
***** [ Navigateurs ] *****
-\\ Internet Explorer v11.0.9600.16428
-\\ Mozilla Firefox v
[ Fichier : C:\Users\Concomitance\AppData\Roaming\Mozilla\Firefox\Profiles\0\prefs.js ]
Ligne Supprimée : user_pref("browser.search.order.1", "WebSearch");
Ligne Supprimée : user_pref("browser.search.defaultenginename", "WebSearch");
Ligne Supprimée : user_pref("browser.search.selectedEngine", "WebSearch");
Ligne Supprimée : user_pref("browser.search.order.1,S", "WebSearch");
Ligne Supprimée : user_pref("browser.search.defaultenginename,S", "WebSearch");
Ligne Supprimée : user_pref("browser.search.selectedEngine,S", "WebSearch");
-\\ Google Chrome v32.0.1700.76
[ Fichier : C:\Users\Concomitance\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [4709 octets] - [18/01/2014 20:00:36]
AdwCleaner[s0].txt - [4615 octets] - [18/01/2014 20:01:10]
########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [4675 octets] ##########
JRT :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Professional x64
Ran by Concomitance on 18/01/2014 at 19:51:54,41
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\viprotocol.dll
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\conduit
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\softonic
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2626869156-1805537898-74337979-1000\Software\ib updater
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\protocols\handler\viprotocol
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\scripthelper.scripthelperapi
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\scripthelper.scripthelperapi.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\viprotocol.viprotocolole
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\viprotocol.viprotocolole.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\au__rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\au__rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{55555555-5555-5555-5555-550455595518}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{66666666-6666-6666-6666-660466596618}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{44444444-4444-4444-4444-440444594418}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{55555555-5555-5555-5555-550455595518}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{66666666-6666-6666-6666-660466596618}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{44444444-4444-4444-4444-440444594418}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{55555555-5555-5555-5555-550455595518}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{66666666-6666-6666-6666-660466596618}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{44444444-4444-4444-4444-440444594418}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskSLib_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskSLib_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\TaskScheduler_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\TaskScheduler_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_pour_3d-chess_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_pour_3d-chess_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{55555555-5555-5555-5555-550455595518}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{66666666-6666-6666-6666-660466596618}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\TypeLib\{44444444-4444-4444-4444-440444594418}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskSLib_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskSLib_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\TaskScheduler_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\TaskScheduler_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_pour_3d-chess_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_pour_3d-chess_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{F7137187-28C6-4039-B7B6-69F33CCB762A}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
~~~ Files
Successfully deleted: [File] "C:\end"
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\premium"
Successfully deleted: [Folder] "C:\Users\Concomitance\appdata\locallow\softonic"
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{1978A618-2F03-4C40-9F72-DD5C20FE5849}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{1A9D1067-EDAB-487A-9CF3-47B892C9624F}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{1C4FEC58-6906-449C-ADAB-6E245CD6E1BC}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{2DC32B68-4622-4A27-AF46-8CE4B488FECD}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{339E09A2-8469-4021-AE5C-F7419BF20D02}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{38F14F8A-AA1D-4E2F-B86D-3C919A214420}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{3F5769F4-17E5-4B07-992A-80A95B08E50B}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{44E36043-73B2-4DD6-B004-C4E64834518A}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{57705582-D037-4683-B347-A594846D5DCE}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{5B4DF1B8-22AB-4486-ADE2-BE18B0B1D628}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{6F598530-7FC9-4CA5-B435-6AB5136719BE}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{6F83A2D4-29BC-4D85-A18D-931BC895226E}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{70A8B317-122E-42F8-9CCF-4BDAC3E5D1DC}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{74611703-DC47-4082-90EB-09709A2270E3}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{889BA281-6B8F-4621-81A7-EF94130F70AF}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{983DEE67-8D80-47FA-8249-137AB507D8A1}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{A0ABD737-F5F5-41D7-9D47-D9E0C43E9D2D}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{BB83C575-4100-466C-8F13-348BDDB51F51}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{C1E6F1C2-8803-475B-AA6F-D74C930E2FA8}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{CFB21C3F-8549-4E41-AEB5-31B5FAA28C64}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{E253461B-2232-4E1F-AFE5-B2BD968CD2D7}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{E50D2CB9-9860-4C31-8DEE-215BF75499E4}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{EE30ED4A-1389-44EC-A02C-3ADC5D9838DD}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{EE411608-0439-4AC5-9533-3DE84B7C9B6D}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{F3961B41-33E7-4B94-B72A-8C4F65D97117}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{F3FB47DB-0B2F-44CD-97FC-8F4EE76B9C25}
Successfully deleted: [Empty Folder] C:\Users\Concomitance\appdata\local\{F8365349-40A3-4A4C-9230-A01DD9D9BF95}
~~~ Chrome
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Policies\Google [blacklisted Policy]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 18/01/2014 at 19:59:07,94
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ZHPfix : le lien

http://dl.free.fr/mEcwF34xQ

 

Merci encore

Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

1) Télécharger SFTGC.exe sur le Bureau >>>> il ne peut pas être ailleurs! L'y déplacer si nécessaire.

Fermer les applications et navigateurs.

Sous XP, double cliquer sur le fichier.
Sous les autres versions de Windows, clic droit sur le fichier et choisir Exécuter en tant qu'administrateur.

Après l'initialisation, cliquer sur Go pour lancer le nettoyage.

Si l'antivirus chicane, désactive-le provisoirement. . Si tu ne sais pas comment faire, reporte-toi à cet article.

Un rapport va s'ouvrir à la fin.
Ce rapport est sur le bureau (SFTGC.txt)

Héberger sur http://cjoint.com pour ne pas planter le sujet. ou http://dl.free.fr/

--------------------------
2) Télécharge Malwarebytes' Anti-Malware (MBAM).

Enregistre l'exécutable sur le bureau. http://fr.malwarebytes.org/

http://www.pcastuces.com/logitheque/malwarebytes_anti-malware.htm

Attention, ne rien installer d'autre que MBAM car il est parfois proposé des trucs inutiles comme Registry Booster ou autres bêtises. A éviter donc.
A la fin de l'installation, décocher la case proposant l'essai de la version Pro.

MBAMPRO_zps5337812f.jpg

MBAMparam_zps4e3ce4d1.jpg

Si MBAM est déjà installé, aller directement à la mise à jour puis à l'analyse.

Ce logiciel est à conserver.

Uniquement en cas de problème de mise à jour:

Télécharger mises à jour MBAM

Exécute le fichier après l'installation de MBAM

Connecter les supports amovibles (clés usb etc.) avant de lancer l'analyse.

  • Double clique sur le fichier téléchargé pour lancer le processus d'installation.
  • Dans l'onglet "Mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter, accepte.
  • Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
  • Sélectionne "Exécuter un examen complet"
  • Clique sur "Rechercher"
  • L'analyse démarre, le scan est relativement long, c'est normal.
  • A la fin de l'analyse, un message s'affiche :

     
    L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.

    Clique sur "Ok" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
  • Ferme tes navigateurs.
  • Si des malwares ont été détectés, clique sur Afficher les résultats.
    Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
  • MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport et poste-le dans ta prochaine réponse.


Si MBAM demande à redémarrer le pc, fais-le.

Si au redémarrage Windows te dit qu'il a bloqué certains programmes de démarrage, clique sur la bulle puis sur Exécuter les programmes bloqués/Malwarebytes Anti-Malware.

@++

philfou Junior Member

philfou

Posté(e)
  • Auteur
Posté(e)

Voici le lien pour SFTCG : http://dl.free.fr/rVD0QN7X2

et le rapport MBAM est ci dessous

 

alwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Version de la base de données: v2014.01.19.02
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Concomitance :: CONCOMITANCE-PG [administrateur]
19/01/2014 08:50:26
mbam-log-2014-01-19 (08-50-26).txt
Type d'examen: Examen complet (C:\|D:\|G:\|)
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 445013
Temps écoulé: 1 heure(s), 58 minute(s), 12 seconde(s)
Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)
Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)
Clé(s) du Registre détectée(s): 1
HKLM\SOFTWARE\Plus-HD-4.9 (PUP.Optional.PlusHD.A) -> Mis en quarantaine et supprimé avec succès.
Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)
Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)
Dossier(s) détecté(s): 1
C:\Program Files (x86)\OnlineHD.TV (PUP.Optional.OnlineVid.A) -> Mis en quarantaine et supprimé avec succès.
Fichier(s) détecté(s): 16
C:\Program Files\Vuze\.install4j\user\mism.exe (PUP.Optional.Conduit.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Concomitance\AppData\Roaming\ZHP\Quarantine\iminentsetup.exe.VIR (PUP.Optional.Iminent.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Concomitance\AppData\Roaming\ZHP\Quarantine\plus-hd-4.9-chromeinstaller.exe.VIR (PUP.Optional.PlusHD.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Concomitance\AppData\Roaming\ZHP\Quarantine\plus-hd-4.9-codedownloader.exe.VIR (PUP.Optional.PlusHD.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Concomitance\AppData\Roaming\ZHP\Quarantine\plus-hd-4.9-enabler.exe.VIR (PUP.Optional.PlusHD.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Concomitance\AppData\Roaming\ZHP\Quarantine\plus-hd-4.9-firefoxinstaller.exe.VIR (PUP.Optional.PlusHD.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Concomitance\AppData\Roaming\ZHP\Quarantine\plus-hd-4.9-updater.exe.VIR (PUP.Optional.PlusHD.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Concomitance\AppData\Roaming\ZHP\Quarantine\Plus-HD-4.9.DIR\Plus-HD-4.9-bg.exe (PUP.Optional.PlusHD.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Concomitance\AppData\Roaming\ZHP\Quarantine\Plus-HD-4.9.DIR\Plus-HD-4.9-bho.dll (PUP.Optional.PlusHD.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Concomitance\AppData\Roaming\ZHP\Quarantine\Plus-HD-4.9.DIR\Plus-HD-4.9-bho64.dll (PUP.Optional.PlusHD.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Concomitance\AppData\Roaming\ZHP\Quarantine\Plus-HD-4.9.DIR\Plus-HD-4.9-buttonutil.exe (PUP.Optional.PlusHD.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Concomitance\AppData\Roaming\ZHP\Quarantine\Plus-HD-4.9.DIR\Plus-HD-4.9-buttonutil64.exe (PUP.Optional.PlusHD.A) -> Mis en quarantaine et supprimé avec succès.
C:\Users\Concomitance\Downloads\SoftonicDownloader_pour_vuze.exe (PUP.Optional.Softonic.A) -> Mis en quarantaine et supprimé avec succès.
G:\Recycled\INFO.EXE (Worm.AutoRun) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files (x86)\OnlineHD.TV\onhdtemp.xpi (PUP.Optional.OnlineVid.A) -> Mis en quarantaine et supprimé avec succès.
C:\Program Files (x86)\OnlineHD.TV\uninst.exe (PUP.Optional.OnlineVid.A) -> Mis en quarantaine et supprimé avec succès.
(fin)
Merci
Philippe
Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

Bonjour,

 

1)

Fais ces vérifications de sécurité stp:

fleche_droite_003.gifhttp://theknitter-apollo.xooit.com/p17644.htm

Ou ici: http://www.vista-xp.fr/forum/topic13109.html#p108827

Pour Java, utiliser l'outil de Pierre13.

 

-----------------------------

2) Refais un scan ZHPDiag après ça.

 

Héberge le rapport stp.

 

@++

philfou Junior Member

philfou

Posté(e)
  • Auteur
Posté(e)

Merci

 

le rapport ZHPDiag

 

~ Rapport de ZHPDiag v2014.1.17.19 - Nicolas Coolman (17/01/2014)
~ Lancé par Concomitance (19/01/2014 15:51:28)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user
---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.16476
GCIE: Google Chrome v32.0.1700.76 (Defaut)
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Professional, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows® 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 733WD
Windows License : OK
~ Windows Remaining Initializations Number : 2
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ Logiciels de protection du système
avast! Free Antivirus v9.0.2011
Malwarebytes Anti-Malware version 1.75.0.1300
Windows Defender W7
---\\ Logiciels d'optimisation du système
---\\ Logiciels de partage PeerToPeer
Vuze v5.2.0.0 =>P2P.Azureus
---\\ Surveillance de Logiciels
Adobe Flash Player 11 ActiveX
Adobe Reader XI
Java 7 Update 51
---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 8088 MB (72% free)
System Restore: Activé (Enable)
System drive C: has 26 GB (11%) free of 219 GB
---\\ Mode de connexion au système
~ Computer Name: CONCOMITANCE-PG
~ User Name: Concomitance
~ All Users Names: HomeGroupUser$, Concomitance, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Concomitance\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Concomitance\AppData\Roaming\
~ %Desktop% : C:\Users\Concomitance\Desktop\
~ %Favorites% : C:\Users\Concomitance\Favorites\
~ %LocalAppData% : C:\Users\Concomitance\AppData\Local\
~ %StartMenu% : C:\Users\Concomitance\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 26 Go of 219 Go)
D: CD-ROM drive (Not Inserted)
---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowMyGames: Modified
~ Security Center: 44 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.04/02/2012 - 08:54:49.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.9B6678DB9C6A232C5A84D2FDFFF8B0E1] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.26/11/2013 - 08:07:57.) -- C:\Windows\System32\wininet.dll [2334208]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.21/11/2010 - 04:24:29.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.21/11/2010 - 04:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/09/2013 - 02:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.04/02/2012 - 08:54:44.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 04:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 04:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.1B6163C503398B23FF8B939C67747683] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.21/11/2010 - 04:25:07.) -- C:\Windows\system32\Drivers\rdpdr.sys [165888]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 04s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 2/1408
~ Mes Videos (My Videos) : 2/12
~ Mes Favoris (My Favorites) : 1/27
~ Mes Documents (My Documents) : 2/79789
~ Mon Bureau (My Desktop) : 2/826
~ Menu demarrer (Programs) : 1/30
~ Hidden Files: Scanned in 01mn 02s
---\\ Processus lancés
[MD5.7E6ACA6B6C89B7CD098944A9159DAED3] - (.TomTom - System Tray application for TomTom HOME.) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248208] [PID.3252]
[MD5.FF9C60DAE6E2B16557387C75206408BE] - (.Creative Technology Ltd - WebcamDell2.exe.) -- C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [462993] [PID.1988]
[MD5.88FD47E3BD31BC358AD1EF14E75C7681] - (.CyberLink Corp. - PowerDVD RC Service.) -- C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336] [PID.1592]
[MD5.58FC1B36032F03342E4C02813F80DAC1] - (.Dropbox, Inc. - Dropbox.) -- C:\Users\Concomitance\AppData\Roaming\Dropbox\bin\Dropbox.exe [30714328] [PID.2036]
[MD5.363C8F7EB51B14957CA84CD3751C1749] - (.Adobe Systems Inc. - AcroTray.) -- C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe [840568] [PID.4648]
[MD5.BED38B0ADFF5F5CC6E988A6491017E83] - (.Research In Motion Limited - Launch Agent Service.) -- C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [267792] [PID.5128]
[MD5.5B9624ACD8606D5FA9A64EFD90B3D067] - (.Memeo - Seagate Dashboard.) -- C:\Program Files (x86)\Seagate\Seagate Dashboard\MemeoDashboard.exe [65536] [PID.5256]
[MD5.AFEBF9E0B223FF04709F747C172D3540] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024] [PID.5276]
[MD5.D25A9FFBC92B5EED2A233C13F7842AB7] - (.Pas de propriétaire - Memeo Instant Backup Client.) -- C:\Program Files (x86)\Memeo\AutoBackup\InstantBackup.exe [325344] [PID.5680]
[MD5.74908C0DAAF4CCCE9300026B73EA4EE2] - (.Memeo Inc. - MemeoUpdater.) -- C:\Program Files (x86)\Memeo\AutoBackup\MemeoUpdater.exe [85272] [PID.5768]
[MD5.AC24D702FFB6E20669349EFEE145ED27] - (.Axentra Corporation - GoFlex Home Agent Application.) -- C:\Program Files (x86)\Seagate\Seagate Dashboard\HipServAgent\HipServAgent.exe [2260992] [PID.5916]
[MD5.51138BEEA3E2C21EC44D0932C71762A8] - (...) -- ysWOW64\RunDll32.exe [0] [PID.5444]
[MD5.540CFD3A3E2F6AB6411B1DFF4218C506] - (.Broadcom Corporation. - Bluetooth Headset Skype Proxy.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe [13600] [PID.5580]
[MD5.8E5651B04BE775696B32F7F1F5DA8871] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8336896] [PID.5948]
[MD5.3B0BA44D5691E00088B956394FDE64B6] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [866584] [PID.3968]
[MD5.D74884939D53612FD84AC82C59CCFE27] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344] [PID.1788]
[MD5.6C85719A21B3F62C2C76280F4BD36C7B] - (.Intel Corporation - Intel IPT Host Interface Service.) -- C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe [212944] [PID.2492]
[MD5.465680BDE344CE4FF6646626AA3A9125] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe [223112] [PID.2660]
[MD5.4E37455DB16AEC75862B1D0BC35B589E] - (.O2Micro International - O2 Flash Memory Service.) -- C:\Windows\system32\DRIVERS\o2flash.exe [72296] [PID.2604]
[MD5.A1A26E8EC51E199D873D85F3E2B6FC65] - (.Memeo - MemeoDashboardService.) -- C:\Program Files (x86)\Seagate\Seagate Dashboard\SeagateDashboardService.exe [8704] [PID.3156]
[MD5.E4FAD21646088D79F8889B6531396ACF] - (.TomTom - Windows Service for TomTom HOME.) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [93072] [PID.3504]
[MD5.686045905787B68D829CE647A6DFAD2B] - (.Research In Motion Limited - BlackBerry Device Manager.) -- C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [577536] [PID.5216]
[MD5.5F5899711DF18A02162B6D518C17B0D7] - (.Intel Corporation - Local Manageability Service.) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe [325656] [PID.2236]
[MD5.F7A1F83F28B125AA3737BC06EABB0CD5] - (.Intel Corporation - User Notification Service.) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2656280] [PID.2744]
[MD5.B362181ED3771DC03B4141927C80F801] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65432] [PID.2880]
~ Processes Running: Scanned in 00mn 03s
---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Concomitance\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [user Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)
~ Google Browser: 14 Legitimates Filtered in 00mn 00s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Concomitance\AppData\Roaming\Mozilla\Firefox\Profiles\0\prefs.js
~ Firefox Browser: 3 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page = http://allssearch.com =>Adware.SocialSkinz
~ IE Browser: 20 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: avast! Online Security - [HKLM]{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} . (.AVAST Software - IE Webrep plugin.) -- C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll =>Toolbar.Google
O3 - Toolbar: avast! Online Security - [HKLM]{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} . (.AVAST Software - IE Webrep plugin.) -- C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{47833539-D0C5-4125-9FA8-0819E2EAAC93} Clé orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Program [Public]: Documentation d'aide de Dell.lnk . (...) -- C:\Program Files (x86)\Dell Inc\Dell Edoc Viewer\EDocs.exe (.not file.)
O4 - GS\Program [Public]: Vuze.lnk . (...) -- C:\Program Files (x86)\Vuze\Azureus.exe (.not file.) =>P2P.Azureus
O4 - GS\Program [Public]: YouSendIt.lnk . (.YouSendIt - YouSendIt Express.) -- C:\Program Files (x86)\YouSendIt\Express\YouSendIt.exe
O4 - GS\QuickLaunch [Concomitance]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Concomitance]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch [Concomitance]: PrivaZer.lnk . (.Goversoft LLC - PrivaZer.) -- C:\Program Files (x86)\PrivaZer\PrivaZer.exe
O4 - GS\QuickLaunch [Concomitance]: Vuze.lnk . (...) -- C:\Program Files (x86)\Vuze\Azureus.exe (.not file.) =>P2P.Azureus
O4 - GS\TaskBar [Concomitance]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\TaskBar [Concomitance]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [Concomitance]: Utilitaire de connexion WiFi.lnk . (...) -- C:\Program Files (x86)\Common Files\Intel\WirelessCommon\iFrmewrk.exe (.not file.)
O4 - GS\Program [Concomitance]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Program [Concomitance]: PrivaZer.lnk . (.Goversoft LLC - PrivaZer.) -- C:\Program Files (x86)\PrivaZer\PrivaZer.exe
O4 - GS\SystemTools [Concomitance]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SendTo [Concomitance]: Send by YouSendIt.lnk . (.YouSendIt - YouSendIt Express.) -- C:\Program Files (x86)\YouSendIt\Express\YouSendIt.exe
~ Global Startup: 72 Legitimates Filtered in 00mn 03s
---\\ Applications lancées au démarrage du sytème (O4)
O4 - GS\Startup [Public]: Bluetooth.lnk . (...) -- C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BTTray.exe (.not file.)
O4 - GS\Startup [Concomitance]: Dropbox.lnk . (.Dropbox, Inc. - Dropbox.) -- C:\Users\Concomitance\AppData\Roaming\Dropbox\bin\Dropbox.exe =>.Dropbox
O4 - GS\Startup [Concomitance]: Smart Settings.lnk . (...) -- C:\Program Files (x86)\Dell\Feature Enhancement Pack\SmartSettings.exe (.not file.)
O4 - HKLM\..\Run: [Apoint] . (.Alps Electric Co., Ltd. - Alps Pointing-device Driver.) -- C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [sysTrayApp] . (.IDT, Inc. - IDT PC Audio.) -- C:\Program Files\IDT\WDM\sttray64.exe
O4 - HKLM\..\Run: [igfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [intelPROSet] . (.Intel® Corporation - Intel® PROSet/Wireless Framework.) -- C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
O4 - HKLM\..\Run: [DFEPApplication] . (.Dell Inc. - Dell Feature Enhancement Pack.) -- c:\Program Files\Dell\Feature Enhancement Pack\DFEPApplication.exe
O4 - HKLM\..\Run: [TdmNotify] . (.Wave Systems Corp. - Trusted Drive Manager User Notifier.) -- C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmNotify.exe
O4 - HKCU\..\Run: [Orange Installer] . (...) -- C:\Program Files (x86)\Orange\Orange Installer\OrangeInstaller.exe
O4 - HKCU\..\Run: [OrangeInside] . (.Orange - Executable Orange Inside.) -- C:\Users\Concomitance\AppData\Roaming\Orange\OrangeInside\one\OrangeInside.exe
O4 - HKCU\..\Run: [TomTomHOME.exe] . (.TomTom - System Tray application for TomTom HOME.) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
O4 - HKLM\..\Wow6432Node\Run: [Dell Webcam Central] . (.Creative Technology Ltd - WebcamDell2.exe.) -- C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
O4 - HKLM\..\Wow6432Node\Run: [RemoteControl9] . (.CyberLink Corp. - PowerDVD RC Service.) -- C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
O4 - HKLM\..\Wow6432Node\Run: [PDVD9LanguageShortcut] . (.CyberLink Corp. - PowerDVD Language Application.) -- C:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [Adobe Acrobat Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe
O4 - HKLM\..\Wow6432Node\Run: [Acrobat Assistant 8.0] . (.Adobe Systems Inc. - AcroTray.) -- C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe
O4 - HKLM\..\Wow6432Node\Run: [Memeo Instant Backup] . (.Memeo Inc. - Memeo Backup Launcher.) -- C:\Program Files (x86)\Memeo\AutoBackup\MemeoLauncher2.exe
O4 - HKLM\..\Wow6432Node\Run: [seagate Dashboard] . (.Pas de propriétaire - Memeo Dashboard Launcher.) -- C:\Program Files (x86)\Seagate\Seagate Dashboard\MemeoLauncher.exe
O4 - HKLM\..\Wow6432Node\Run: [OE] . (.Trend Micro Inc. - Trend Micro Anti-Spam for OE monitor.) -- c:\Program Files (x86)\Trend Micro\Client Server Security Agent\TMAS_OE\TMAS_OEMon.exe
O4 - HKLM\..\Wow6432Node\Run: [RIMBBLaunchAgent.exe] . (.Research In Motion Limited - Launch Agent Service.) -- C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
O4 - HKLM\..\Wow6432Node\Run: [AvastUI.exe] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
O4 - HKLM\..\Wow6432Node\Run: [sunJavaUpdateSched] . (.Oracle Corporation - Java Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKUS\S-1-5-19\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2626869156-1805537898-74337979-1000\..\Run: [Orange Installer] . (...) -- C:\Program Files (x86)\Orange\Orange Installer\OrangeInstaller.exe
O4 - HKUS\S-1-5-21-2626869156-1805537898-74337979-1000\..\Run: [OrangeInside] . (.Orange - Executable Orange Inside.) -- C:\Users\Concomitance\AppData\Roaming\Orange\OrangeInside\one\OrangeInside.exe
O4 - HKUS\S-1-5-21-2626869156-1805537898-74337979-1000\..\Run: [TomTomHOME.exe] . (.TomTom - System Tray application for TomTom HOME.) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
~ Application: Scanned in 00mn 00s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: &Envoyer à OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\MICROS~1\Office14\ONBttnIE.dll =>.Microsoft Corporation
O9 - Extra button: Notes &liées OneNote [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\MICROS~1\Office14\ONBTTN~1.dll =>.Microsoft Corporation
O9 - Extra button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 [64Bits] - {CCA281CA-C863-46ef-9331-5C8D4460577F} . (...) -- C:\Program Files\WIDCOMM\Bluetooth Software\bt_hot_icon.ico
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{8B0DF4D9-F9D5-4DDC-978A-6EB9569F8F6F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{8D2092F1-C1FA-428E-837B-9C8AD9D602FD}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{8B0DF4D9-F9D5-4DDC-978A-6EB9569F8F6F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{8D2092F1-C1FA-428E-837B-9C8AD9D602FD}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{8B0DF4D9-F9D5-4DDC-978A-6EB9569F8F6F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{8D2092F1-C1FA-428E-837B-9C8AD9D602FD}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
O20 - Winlogon Notify: spba . (...) -- C:\Program Files\Common Files\SPBA\homefus2.dll
~ Winlogon: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Trend Micro Client/Server Security Agent (svcGenericHost) . (...) - c:\Program Files (x86)\Trend Micro\Client Server Security Agent\HostedAgent\svcGenericHost.exe (.not file.)
O23 - Service: Intel® PROSet/Wireless ZeroConfig Service (ZcfgSvc7) . (.Intel® Corporation - Intel® PROSet/Wireless Zero Config Servic.) - C:\Program Files\Intel\WiFi\bin\ZCfgSvc7.exe
~ Services: 26 Legitimates Filtered in 00mn 09s
---\\ HKCU & HKLM Software Keys
[HKLM\Software\Wow6432Node\IncrediMail]
~ Key Software: 261 Legitimates Filtered in 00mn 00s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 09/05/2012 - 15:11:05 - [0,012] ----D C:\Users\Concomitance\AppData\Roaming\.oit
~ Program Folder: 169 Legitimates Filtered in 00mn 23s
---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKLM\...\Policies\System] - "DisableCAD"=1
~ MWPS: 19 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.1575A815C27789061F34B4F55AE0B5C3] - 22/07/2011 - 21:28:56 ---A- . (.ST Microelectronics - Accelerometer Port I/O.) -- C:\Windows\System32\Drivers\accelern.sys [27760]
O58 - SDL:[MD5.C04F7B373881009D7994D9BF55D24AB4] - 03/12/2013 - 15:46:23 ---A- . (...) -- C:\Windows\System32\Drivers\aswRvrt.sys [65776]
O58 - SDL:[MD5.90399625F341AB76BA4B85A5E860EB1F] - 19/12/2013 - 09:10:12 ---A- . (...) -- C:\Windows\System32\Drivers\aswVmm.sys [207904]
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:[MD5.E4EA2412FB1B8AEE33667A9CC6D456A4] - 15/07/2011 - 21:31:22 ---A- . (.ST Microelectronics - Disk Class Filter Driver for Accelerometer.) -- C:\Windows\System32\Drivers\stdcfltn.sys [22128]
O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
O58 - SDL:[MD5.EF5ACDE92BA3F691BBFEF781CB063501] - 25/01/2011 - 10:57:18 ---A- . (.IDT, Inc. - IDT PC Audio.) -- C:\Windows\System32\Drivers\stwrt64.sys [520192]
~ Drivers: 19 Legitimates Filtered in 00mn 05s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 08/11/2010 - C:\Windows\System32\DRIVERS\tmlwf.sys (tmlwf) .(.Trend Micro Inc. - Trend Micro NDIS 6.0 Filter Driver (amd64-f.) - LEGACY_TMLWF
~ Legacy: 87 Legitimates Filtered in 00mn 00s
---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com
~ Keys: Scanned in 00mn 00s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.246FE58EFFD357B2078842708155E46C] [sPRF][18/01/2014] (...) -- C:\Users\Concomitance\Desktop\AdwCleaner.exe [1236282]
[MD5.5829E29FCD8922D2A87528079BD39557] [sPRF][19/01/2014] (.Pas de propriétaire - Nettoyage des fichiers temporaires.) -- C:\Users\Concomitance\Desktop\SFTGC.exe [1064604]
~ Files: 4 Legitimates Filtered in 00mn 01s
---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "0C69D82C09A6E9540A776A07F6E40CCF" . (.Bing Bar.) -- C:\Windows\Installer\{C28D96C0-6A90-459E-A077-A6706F4EC0FC}\icon_installer_ico =>Toolbar.Bing
~ Update Products: 117 Legitimates Filtered in 00mn 00s
---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
~ WIS: 119 Legitimates Filtered in 00mn 28s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 11/12/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 07/06/2011 191752 | (BBSvc) . (.Microsoft Corporation..) - C:\Program Files (x86)\Microsoft\BingBar\BBSvc.exe
SS - | Demand 10/07/1658 0 | (CorelCreatorMessages) . (...) - C:\Windows\system32\CorelCreatorMessages.exe
SS - | Auto 21/06/2012 136176 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 21/06/2012 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 21/08/2012 194032 | (gusvc) . (.Google.) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
SS - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
SS - | Auto 10/07/1658 0 | (ntrtscan) . (...) - c:\Program Files (x86)\Trend Micro\Client Server Security Agent\ntrtscan.exe
SS - | Demand 24/05/2011 2154888 | (SecureStorageService) . (.Wave Systems Corp..) - C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Secure Storage Manager\SecureStorageService.exe
SS - | Auto 03/06/2013 162408 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Auto 10/07/1658 0 | (svcGenericHost) . (...) - c:\Program Files (x86)\Trend Micro\Client Server Security Agent\HostedAgent\svcGenericHost.exe
SS - | Auto 17/02/2011 1633280 | (tcsd_win32.exe) . (...) - C:\Program Files (x86)\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe
SS - | Demand 06/07/2009 570632 | (TMBMServer) . (.Trend Micro Inc..) - c:\Program Files (x86)\Trend Micro\BM\TMBMSRV.exe
SS - | Auto 10/07/1658 0 | (tmlisten) . (...) - c:\Program Files (x86)\Trend Micro\Client Server Security Agent\tmlisten.exe
SS - | Demand 10/07/1658 0 | (TmPfw) . (...) - c:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmPfw.exe
SS - | Demand 10/07/1658 0 | (TmProxy) . (...) - c:\Program Files (x86)\Trend Micro\Client Server Security Agent\TmProxy.exe
SR - | Auto 18/12/2013 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 03/03/2009 89600 | (AESTFilters) . (.Andrea Electronics Corporation.) - C:\Program Files\IDT\WDM\AESTSr64.exe
SR - | Auto 10/05/2010 2683712 | (ATService) . (.AuthenTec, Inc..) - C:\Program Files\Fingerprint Sensor\ATService.exe
SR - | Auto 19/12/2013 50344 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SR - | Auto 12/05/2011 249648 | (BBUpdate) . (.Microsoft Corporation.) - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.exe
SR - | Demand 18/01/2013 577536 | (Blackberry Device Manager) . (.Research In Motion Limited.) - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
SR - | Auto 29/06/2010 158720 | (BrcmMgmtAgent) . (.Broadcom Corporation.) - C:\Program Files\Broadcom\MgmtAgent\BrcmMgmtAgent.exe
SR - | Auto 08/02/2011 956192 | (btwdins) . (.Broadcom Corporation..) - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
SR - | Auto 28/03/2013 4970384 | (Canon Driver Information Assist Service) . (.CANON INC..) - C:\Program Files\Canon\DIAS\CnxDIAS.exe
SR - | Auto 24/08/2011 2279320 | (DFEPService) . (.Dell Inc..) - c:\Program Files\Dell\Feature Enhancement Pack\DFEPService.exe
SR - | Auto 23/12/2010 1515792 | (EvtEng) . (.Intel® Corporation.) - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
SR - | Auto 24/02/2011 212944 | (jhi_service) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
SR - | Auto 03/12/2010 325656 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
SR - | Auto 06/04/2011 25824 | (MemeoBackgroundService) . (.Memeo.) - C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
SR - | Auto 11/02/2010 72296 | (O2FLASH) . (.O2Micro International.) - C:\Windows\System32\DRIVERS\o2flash.exe
SR - | Auto 23/12/2010 845584 | (RegSrvc) . (.Intel® Corporation.) - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
SR - | Auto 03/11/2011 8704 | (SeagateDashboardService) . (.Memeo.) - C:\Program Files (x86)\Seagate\Seagate Dashboard\SeagateDashboardService.exe
SR - | Auto 25/01/2011 296448 | (STacSV) . (.IDT, Inc..) - C:\Program Files\IDT\WDM\STacSV64.exe
SR - | Auto 28/05/2011 3792240 | (TdmService) . (.Wave Systems Corp..) - C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmService.exe
SR - | Auto 27/08/2013 93072 | (TomTomHOMEService) . (.TomTom.) - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
SR - | Auto 03/12/2010 2656280 | (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
SR - | Auto 01/07/2011 1600000 | (Wave Authentication Manager Service) . (.Wave Systems Corp..) - C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Authentication Manager\WaveAMService.exe
SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 23/12/2010 992256 | (ZcfgSvc7) . (.Intel® Corporation.) - C:\Program Files\Intel\WiFi\bin\ZCfgSvc7.exe
~ Services: Scanned in 00mn 33s
---\\ Scan Additionnel (O88)
Database Version : 13024 - (17/01/2014)
Clés trouvées (Keys found) : 21
Valeurs trouvées (Values found) : 1
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 0
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E] =>Toolbar.Ask
[HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASAPI32] =>Toolbar.Bing
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2] =>Toolbar.Ask
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{2318C2B1-4965-11d4-9B18-009027A5CD4F} =>Toolbar.Google^
~ Additionnel Scan: 294462 Items scanned in 00mn 19s
---\\ Récapitulatif des détections trouvées sur votre station
~ MSI: 2 link(s) detected in 00mn 19s
~ 1123 Legitimates filtered by white list
End of the scan (482 lines in 03mn 22s)(0)
Merci
Philippe
Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

J'avais demandé d'héberger le rapport.

 

Comment va l'ordi?

 

Le Flash Player est à la version 12: décocher la case inutile: http://get.adobe.com/fr/flashplayer/

 

ZHPFix :

  • Ferme toutes les applications ouvertes
  • Double-clique sur ZHPFix, raccourci installé par ZHPDiag sur le Bureau
    Important:
    Sous Vista et Windows 7/8 : il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur.
  • Copie les lignes ci-dessous dans la fenêtre

sauf citation.

 

 

Script ZHPFix

R0 - HKCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page = <http://allssearch.com> =>Adware.SocialSkinz
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E] =>Toolbar.Ask
[HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASAPI32] =>Toolbar.Bing
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2] =>Toolbar.Ask
firewallraz
shortcutfix
proxyfix
emptytemp
emptyflash

Cliquer sur IMPORTER., cela devrait coller le contenu du presse papier dans la fenêtre ZHPFix.

  • Le script doit automatiquement apparaitre dans ZHPFix.
    Clique sur le bouton GO pour lancer le nettoyage

  • Valide par Oui la désinstallation des programmes si demandé.
  • Laisse l'outil travailler. Si un redémarrage est demandé, accepte et redémarre le PC
  • Le rapport ZHPFixReport.txt s'affiche. Copie-colle le contenu de ce rapport dans ta réponse.
    Le rapport ZHPFixReport.txt est enregistré sous C:\ZHP\ZHPFix.txt

Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr , Onglet Fichier , Nouvelle tâche , tape explorer.exe et valide.

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

×
 Partager
Aller sur la liste des sujets

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...