FORUM D’ENTRAIDE INFORMATIQUE (FEI)Site d’assistance et de sécurité informatique

[Elkmar']

Bonjour, mon problème est exactement le meme que sur ce sujet : http://www.forum-entraide-informatique. ... tre-autres

J'ai juste utilisé Adwcleaner et roguekiller mais ça n'a pas suffit.

Pour le rapport Zhpdiag :

Rapport de ZHPDiag v2013.7.10.17 par Nicolas Coolman, Update du 10/07/2013
Run by Dimitri at 10/07/2013 17:56:59
WebSite: http://nicolascoolman.webs.com
State : Version à jour.
WhiteList : Enable
High Elevated Privileges : OK
UAC : Activate by user


---\\ Web Browser
MSIE: Internet Explorer v10.0.9200.16599
GCIE: Google Chrome v27.0.1453.116 (Defaut)

---\\ Windows Product Information
~ Langage: Français
Windows 8 Home Premium Edition, 64-bit  (Build 9200)
Windows Server License Manager Script : OK
~ ion : Windows(R) Operating System, OEM_DM channel
Windows ID Activation : OK
~ Windows Partial Key : 9HGBG
Windows License : OK
~ Windows Remaining Initializations Number : 998
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ System Protection
avast! Free Antivirus v8.0.1489.0
Spybot - Search Destroy v2.1.19
Windows Defender W8

---\\ System Optimizer
CCleaner v4.03  =Piriform Ltd

---\\ Peer To Peer (P2P)
µTorrent v3.3.0.29677  =P2P.µTorrent

---\\ Software Update
Adobe Reader XI

---\\ System Information
~ Processor: Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1931 MB (28% free)
System Restore: Activé (Enable)
System drive C: has 40 GB (33%) free of 119 GB

---\\ Logged in mode
~ Computer Name: DIM-PORTABLE
~ User Name: Dimitri
~ All Users Names: Dimitri, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Users\Dimitri\AppData\Roaming\
~ %Desktop% : C:\Users\Dimitri\Desktop\
~ %Favorites% : C:\Users\Dimitri\Favorites\
~ %LocalAppData% : C:\Users\Dimitri\AppData\Local\
~ %StartMenu% : C:\Users\Dimitri\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 40 Go of 119 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 157 Go of 158 Go)
E:\ CD-ROM drive (Not Inserted)



---\\ Security Center Tools Informations
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime :  Out Of Date
~ Security Center: 29 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.E13A31D5254C25406A7946BDD9B06364] - (.Microsoft Corporation - Explorateur Windows.) (.11/10/2012 - 08:35:16.) -- C:\Windows\Explorer.exe [2380944]
[MD5.FE9AB232B56A12224E8A3F3F9878C9A3] - (.Microsoft Corporation - Application de démarrage de Windows.) (.26/07/2012 - 04:08:50.) -- C:\Windows\System32\Wininit.exe [132608]
[MD5.36050B1CDF2DAE0B44286C7C46E4883E] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.28/04/2013 - 23:28:33.) -- C:\Windows\System32\wininet.dll [2241024]
[MD5.BCF2036A0DD579E47C008C133550283E] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.11/10/2012 - 06:46:58.) -- C:\Windows\System32\Winlogon.exe [517120]
[MD5.9448F5740A037EC0C18F0E9177232DD0] - (.Microsoft Corporation - Bibliothèque de licences.) (.26/07/2012 - 04:07:20.) -- C:\Windows\System32\sppcomapi.dll [273408]
[MD5.36D6A3201721558A8AFBCC09C2DA4C2C] - (.Microsoft Corporation - Pilote de fonction connexe pour WinSock.) (.06/11/2012 - 04:53:44.) -- C:\Windows\system32\Drivers\AFD.sys [560640]
[MD5.A721FF570C2387E383BDDEA9632863C9] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.26/07/2012 - 06:00:48.) -- C:\Windows\system32\Drivers\atapi.sys [25840]
[MD5.990B1BABE6E81FB18E65A87EBEFB1772] - (.Microsoft Corporation - CD-ROM File System Driver.) (.26/07/2012 - 03:30:10.) -- C:\Windows\system32\Drivers\Cdfs.sys [108544]
[MD5.339BFF85D788268752DA8C9644B188EE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.26/07/2012 - 03:26:36.) -- C:\Windows\system32\Drivers\Cdrom.sys [174080]
[MD5.09D9EB9E7898F8E6561473A20CC808B9] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.26/07/2012 - 03:26:53.) -- C:\Windows\system32\Drivers\DfsC.sys [118784]
[MD5.7D87B5B6C7188D553E11B59DC7F0B111] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/09/2012 - 07:08:44.) -- C:\Windows\system32\Drivers\HDAudBus.sys [71168]
[MD5.C9E9CBF73AFFBFE3E801EFB516787BA3] - (.Microsoft Corporation - Pilote de port i8042.) (.26/07/2012 - 03:28:51.) -- C:\Windows\system32\Drivers\i8042prt.sys [112640]
[MD5.3969B9C218DD3FAA9F4ED2FFC3651C02] - (.Microsoft Corporation - IP Network Address Translator.) (.26/07/2012 - 03:23:01.) -- C:\Windows\system32\Drivers\IpNat.sys [145920]
[MD5.93179D48066918323628CB016D8C94DC] - (.Microsoft Corporation - Minirdr SMB Windows NT.) (.05/02/2013 - 23:29:09.) -- C:\Windows\system32\Drivers\MRxSmb.sys [370688]
[MD5.7CEC25C682D319D484630B3952C31A11] - (.Microsoft Corporation - MBT Transport driver.) (.26/07/2012 - 03:24:28.) -- C:\Windows\system32\Drivers\netBT.sys [331776]
[MD5.76929F4A69E425911A63B407E26C2589] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.02/02/2013 - 11:54:54.) -- C:\Windows\system32\Drivers\ntfs.sys [1933544]
[MD5.4563DAF8C6A740AD7F501E219BD10766] - (.Microsoft Corporation - Pilote de port parallèle.) (.26/07/2012 - 03:29:53.) -- C:\Windows\system32\Drivers\Parport.sys [105984]
[MD5.A14D625C5AEE5FFE0F47D1A1D419FAAE] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.26/07/2012 - 03:23:17.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [124928]
[MD5.B2A3AD74FF2E2FFA73AF2567108231B3] - (.Microsoft Corporation - Redirecteur de périphérique de Microsoft RDP.) (.26/07/2012 - 03:25:18.) -- C:\Windows\system32\Drivers\rdpdr.sys [179712]
[MD5.73DC722CE5DF26D7638CE2446F2655C7] - (.Microsoft Corporation - TDI Translation Driver.) (.26/07/2012 - 06:26:47.) -- C:\Windows\system32\Drivers\tdx.sys [117248]
[MD5.2FB3CDFD5EAF4CD9D4AFAF96877D13AE] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.26/07/2012 - 05:57:09.) -- C:\Windows\system32\Drivers\volsnap.sys [332016]
~ Generic Processes:  Scanned in 00mn 01s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/417
~ Mes Videos (My Videos) : 1/69
~ Mes Favoris (My Favorites) : 1/7
~ Mes Documents (My Documents) : 1/2052
~ Mon Bureau (My Desktop) : 1/315
~ Menu demarrer (Programs) : 1/24
~ Hidden Files:  Scanned in 00mn 11s



---\\ Processus lancés
[MD5.2678604575AE727DE44949742E84069D] - (.Google - Google Drive.) -- C:\Program Files (x86)\Google\Drive\googledrivesync.exe   [19676256] [PID.3148]
[MD5.2D32F0EF950AED6AD007D042676FD39E] - (.ASUSTek Computer Inc. - ATKOSD2.) -- C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe   [328064] [PID.3260]
[MD5.0B50F07E63EE15383CDFDC26D7A3D3E3] - (.ASUSTek Computer Inc. - ATK Media.) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe   [205184] [PID.3268]
[MD5.B7BCA8A30CE13A283CDBDECEF5616C39] - (.ASUS - ACMON.) -- C:\Program Files (x86)\ASUS\Splendid\ACMON.exe   [107192] [PID.3516]
[MD5.48BE298F7FD1BEF4D8FBACB04D8D95C4] - (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe   [958576] [PID.3580]
[MD5.97202E9C0D86387888435470CCAF45BE] - (.ASUSTeK - ACEngSvr Module.) -- C:\Windows\SysWOW64\ACEngSvr.exe   [192000] [PID.3796]
[MD5.FA11F9B781654D3B4324A9217F399B5B] - (.Pas de propriétaire - System component.) -- C:\Program Files (x86)\Spyrix Free Keylogger\spkl.exe   [1795584] [PID.4016]
[MD5.3F11B20D12D89365D7721BDC860CE5F0] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe   [4858968] [PID.2892]
[MD5.09E9425AD8C61664A37ED84B8B58BDCF] - (.Safer-Networking Ltd. - Spybot - Search Destroy tray access.) -- C:\Program Files (x86)\Spybot - Search Destroy 2\SDTray.exe   [3830224] [PID.2424]
[MD5.35048D8E8A0BF7A797CD5757ACD7EED0] - (.CyberLink - CyberLink MediaLibray Service.) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe   [107816] [PID.3624]
[MD5.749949494676218FFA99501F4AA22ECC] - (.OpenOffice.org - OpenOffice.org 3.4.1.) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe   [10376704] [PID.4924]
[MD5.4EE367B8B1964160A1F1B80095183D3A] - (.OpenOffice.org - OpenOffice.org 3.4.1.) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin   [10368512] [PID.5016]
[MD5.25A51D18D48F1E144ABEC667E98C6261] - (.ASUSTeK Computer Inc. - ASUS Live Update.) -- C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe   [1558176] [PID.4264]
[MD5.97432AB9F1B3B3E63E778C1E69E71E91] - (.ASUSTek Computer Inc. - ASUS USB Charger Plus.) -- C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe   [1124032] [PID.4788]
[MD5.9813ECD17020A278984D945A022111A8] - (.ASUSTeK Computer Inc. - ASUS Quick Gesture Exe.) -- C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe   [20352] [PID.4936]
[MD5.5521928AA79079565B7CB8FCE6806131] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe   [825808] [PID.3452]
[MD5.E121530C2838C67C06A6AE0AEDC13B72] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe   [7693824] [PID.4444]
~ Processes Running:  Scanned in 00mn 02s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Dimitri\AppData\Local\Google\Chrome\User Data\Default\Preferences
~ Google Browser: 12 Legitimates Filtered in 00mn 11s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management:  Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys:  Scanned in 00mn 00s



---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File:  Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: (no name) [64Bits] - [HKLM]{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} Clé orpheline
~ Toolbar:  Scanned in 00mn 00s



---\\ Applications démarrées par registre par dossier (O4)
O4 - HKCU\..\Run: [Power2GoExpress] Clé orpheline
O4 - HKCU\..\Run: [FileHippo.com] . (.FileHippo.com - FileHippo.com Update Checker.) -- C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
O4 - HKLM\..\Wow6432Node\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe
O4 - HKLM\..\Wow6432Node\Run: [kbdsprt] Clé orpheline
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
O4 - HKLM\..\Wow6432Node\RunOnce: [daemontoolslite] Clé orpheline
O4 - HKLM\..\policies\Explorer\Run: [localSPM] . (.Pas de propriétaire - System component.) -- C:\Program Files (x86)\Spyrix Free Keylogger\spkl.exe
O4 - HKUS\S-1-5-21-2812769728-627241504-4235717230-1001\..\Run: [Power2GoExpress] Clé orpheline
O4 - HKUS\S-1-5-21-2812769728-627241504-4235717230-1001\..\Run: [FileHippo.com] . (.FileHippo.com - FileHippo.com Update Checker.) -- C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe
O4 - HKUS\S-1-5-21-2812769728-627241504-4235717230-1001\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
~ Application:  Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\QuickLaunch: Spybot-SD Start Center.lnk . (.Safer-Networking Ltd. - Start Center.)  -- C:\Program Files (x86)\Spybot - Search Destroy 2\SDWelcome.exe
O4 - GS\QuickLaunch: System Scan.lnk . (.Safer-Networking Ltd. - Malware Scanner.)  -- C:\Program Files (x86)\Spybot - Search Destroy 2\SDScan.exe
O4 - GS\Desktop: Google Chrome.lnk . (.Google Inc. - Google Chrome.)  -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop: Google Drive.lnk . (...)  -- C:\Users\Dimitri\Google Drive
O4 - GS\Desktop: TS3 - Raccourci.lnk . (...)  -- C:\Program Files (x86)\Electronic Arts\Les Sims 3\Game\Bin\TS3.exe
O4 - GS\Desktop: Update Checker.lnk . (.FileHippo.com - FileHippo.com Update Checker.)  -- C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe
~ Global Startup:  Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{ACF5BE5A-3650-4282-BBB6-2586E3A9E772}: DhcpNameServer = 30.50.1.1 30.50.1.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7E89821-A041-43B6-BBD8-CFA8A2F2980A}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{ACF5BE5A-3650-4282-BBB6-2586E3A9E772}: DhcpDomain = F3-NB3-WDS.COM
O17 - HKLM\System\CS1\Services\Tcpip\..\{ACF5BE5A-3650-4282-BBB6-2586E3A9E772}: DhcpNameServer = 30.50.1.1 30.50.1.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{F7E89821-A041-43B6-BBD8-CFA8A2F2980A}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{ACF5BE5A-3650-4282-BBB6-2586E3A9E772}: DhcpDomain = F3-NB3-WDS.COM
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain:  Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll
~ Protocole Additionnel:  Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon:  Scanned in 00mn 00s



---\\ Pilotes lancés au démarrage (O41)
O41 - Driver: oem15.inf (dtsoftbus01) . (.Disc Soft Ltd - DAEMON Tools Virtual Bus Driver.) - C:\Windows\system32\drivers\dtsoftbus01.sys
~ Drivers: 40 Legitimates Filtered in 00mn 00s



---\\ HKCU HKLM Software Keys
[HKCU\Software\Spyrix]
[HKCU\Software\lollipop]  =Adware.Lollipop
[HKLM\Software\Wow6432Node\Spyrix]
~ Key Software: 135 Legitimates Filtered in 00mn 01s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 30/06/2013 - 02:45:11 - [10,889] ----D C:\Program Files (x86)\Spyrix Free Keylogger
O43 - CFD: 30/06/2013 - 02:45:06 - [317,054] ----D C:\ProgramData\Spyrix Free Keylogger
O43 - CFD: 10/07/2013 - 17:56:34 - [0] ----D C:\Users\Dimitri\AppData\Local\Lollipop  =Adware.Lollipop
~ Program Folder: 100 Legitimates Filtered in 00mn 23s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.6A0E850DDCB136AA3D2FB7234382DF12] - 10/07/2013 - 16:36:15 RSHAD . (.Disc Soft Ltd - DAEMON Tools Virtual Bus Driver.) -- C:\Windows\System32\Drivers\dtsoftbus01.sys   [283064]
O44 - LFC:[MD5.3CE803ADAC08BD2B08898513B7FA85DA] - 10/07/2013 - 16:20:20 ---A- . (...) -- C:\Windows\SysNative\ServiceFilter.ini   [2544]
O44 - LFC:[MD5.3CE803ADAC08BD2B08898513B7FA85DA] - 10/07/2013 - 16:20:20 RSHAD . (...) -- C:\Windows\System32\ServiceFilter.ini   [2544]
O44 - LFC:[MD5.A5F29AC2F0ADE8B995B49D7350CE3AC0] - 10/07/2013 - 11:26:19 RSHAD . (...) -- C:\Windows\System32\Drivers\aswSP.sys.sum   [175]
O44 - LFC:[MD5.2E83D2621E87C493AB45DC6655BA77D4] - 10/07/2013 - 11:26:19 RSHAD . (...) -- C:\Windows\System32\Drivers\aswSnx.sys.sum   [175]
~ Files: 26 Legitimates Filtered in 00mn 42s



---\\ ShareTools MSconfig StartupReg (O53)
O53 - SMSR:HKLM\...\startupreg\avast  [Key] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe
O53 - SMSR:HKLM\...\startupreg\DisableS3S4  [Key] . (...) -- c:\windows\temp\DisableS3S464\sethigh.cmd (.not file.)
O53 - SMSR:HKLM\...\startupreg\PowerSkin  [Key] . (...) -- c:\windows\temp\PowerSkin\PowerSkin.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\uTorrent  [Key] . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Dimitri\AppData\Roaming\uTorrent\uTorrent.exe  =P2P.µTorrent
~ SMSR Keys: 18 Legitimates Filtered in 00mn 00s



---\\ Microsoft Windows Policies System (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 17 Legitimates Filtered in 00mn 00s



---\\ Microsoft Windows Policies Explorer (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s



---\\ Liste des Drivers Système (O58)
O58 - SDL:[MD5.4F18D4C7EA14F11A7211F60D553C03DB] - 26/07/2012 - 06:00:49 ---A- . (.LSI - LSI 3ware SCSI Storport Driver.) -- C:\Windows\System32\Drivers\3ware.sys   [106736]
O58 - SDL:[MD5.221F28472FB210E2D4A7B4488BC798F9] - 19/09/2012 - 01:15:20 ----- . (.Qualcomm Atheros Communications, Inc. - Qualcomm Atheros Extensible Wireless LAN device driver.) -- C:\Windows\System32\athw8x.sys   [3653632]
~ Drivers:  Scanned in 00mn 00s



---\\ Liste des outils de nettoyage (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
O63 - Logiciel: ZHPFix 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPFix_is1
~ ADS:  Scanned in 00mn 00s



---\\ File Associations Shell Spawning (O67)
O67 - Shell Spawning: .html ChromeHTML[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 19 Legitimates Filtered in 00mn 00s



---\\ Start Menu Internet (O68)
O68 - StartMenuInternet: Google Chrome Google Chrome[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: IEXPLORE.EXE Internet Explorer[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys:  Scanned in 00mn 00s



---\\ Recherche particuliere à la racine de certains dossiers (O84)
[MD5.4A93070098539B54FDA391D4D551C880] [SPRF][22/07/2009] (...) -- C:\ProgramData\SetStretch.exe   [24576]
[MD5.13A09BECABCE7CE7DE02D42D9C00A250] [SPRF][10/07/2013] (...) -- C:\Users\Dimitri\AppData\Local\Temp\bitool.dll   [38456]
[MD5.77BFC716EC79B0DEEB47AE8862DB5DBD] [SPRF][10/07/2013] (.-lop--o--i-llp - Pas de description.) -- C:\Users\Dimitri\AppData\Local\Temp\LollipopInstaller_somoto_14693.exe   [269312]  =Adware.MegaSearch
[MD5.AE995372EAB372C5BB6D6FC7D3990702] [SPRF][10/07/2013] (...) -- C:\Users\Dimitri\AppData\Roaming\sp_data.sys   [401]
~ Files:  Scanned in 00mn 00s



---\\ Scan Additionnel (O88)
Database Version : v2.12720 - (10/07/2013)
Clés trouvées (Keys found) : 3
Valeurs trouvées (Values found) : 0
Dossiers trouvés  (Folders found) : 3
Fichiers trouvés  (Files found) : 3

[HKCU\Software\lollipop] =Adware.Lollipop
[HKCU\Software\Spyrix] =Keylogger.Spyrix
[HKLM\Software\Wow6432Node\Spyrix] =Keylogger.Spyrix
C:\Program Files (x86)\Spyrix Free Keylogger =Keylogger.Spyrix
C:\ProgramData\Spyrix Free Keylogger =Keylogger.Spyrix
C:\Users\Dimitri\AppData\Local\lollipop =Adware.Lollipop
C:\Users\Dimitri\AppData\Local\Temp\LollipopInstaller_somoto_14693.exe =Adware.Lollipop
C:\Users\Dimitri\AppData\Local\Temp\nsd75AD.tmp =Adware.MegaSearch
~ Additionnel Scan: 141184 Items scanned in 01mn 26s



---\\ Product Upgrade Codes (O90)
O90 - PUC: "275E2715571C08F46A5DC54B8562DA16" . (.SceneSwitch.) -- C:\Windows\Installer\{5172E572-C175-4F80-A6D5-5CB45826AD61}\_853F67D554F05449430E7E.exe
~ Update Products: 30 Legitimates Filtered in 00mn 00s



---\\ Random Export Key (O91)
[HKLM\Software\Wow6432Node\14919ea49a8f3b4aa3cf1058d9a64cec] = Clé orpheline
~ Export Key Software:  Scanned in 00mn 00s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 11/05/2013 65640 |  (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 15/10/2012 1221808 |  (AFBAgent) . (.ASUSTeK Computer Inc..) - C:\Windows\system32\FBAgent.exe
SR - | Demand 05/10/2012 110976 |  (ASLDRService) . (.ASUSTek Computer Inc..) - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
SR - | Demand 13/04/2012 277120 |  (ASUS InstantOn) . (.ASUS.) - C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe
SR - | Demand 21/11/2011 96896 |  (ATKGFNEXSrv) . (.ASUS.) - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
SR - | Auto 09/05/2013 46808 |  (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SS - | Demand 02/11/2012 277024 |  (cphs) . (.Intel Corporation.) - C:\Windows\SysWow64\IntelCpHeciSvc.exe
SS - | Auto 02/04/2013 116648 |  (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 02/04/2013 116648 |  (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SR - | Demand 20/04/2012 635104 |  (Intel(R) Capability Licensing Service Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\iCLS Client\HeciServer.exe
SR - | Demand 27/06/2012 129856 |  (Intel(R) ME Service) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
SR - | Demand 25/06/2012 166720 |  (jhi_service) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
SR - | Demand 17/07/2012 277824 |  (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
SR - | Demand 16/05/2013 1817560 |  (SDScannerService) . (.Safer-Networking Ltd..) - C:\Program Files (x86)\Spybot - Search Destroy 2\SDFSSvc.exe
SR - | Demand 16/05/2013 1033688 |  (SDUpdateService) . (.Safer-Networking Ltd..) - C:\Program Files (x86)\Spybot - Search Destroy 2\SDUpdSvc.exe
SR - | Demand 15/05/2013 171928 |  (SDWSCService) . (.Safer-Networking Ltd..) - C:\Program Files (x86)\Spybot - Search Destroy 2\SDWSCSvc.exe
SR - | Demand 17/07/2012 365376 |  (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
SS - | Demand  0 |  (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe
SR - | Demand 20/09/2012 29696 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services:  Scanned in 00mn 03s



---\\ Malicius Software Information
~ http://nicolascoolman.webs.com/apps/blo ... e-lollipop   =Adware.Lollipop
~ http://nicolascoolman.webs.com/apps/blo ... megasearch   =Adware.MegaSearch
~ http://nicolascoolman.webs.com/apps/blo ... ger-spyrix   =Keylogger.Spyrix
~ MSI: 3 link(s) detected in 00mn 04s



~ 750 Legitimates filtered by white list
End of the scan (381 lines in 03mn 56s)(0)
Pour le keylogger Spyrix c'est moi meme qui l'ai installé et l'utilise.

[2011N2]

Bonsoir,

Pour mieux recevoir les réponses, tu peux t'inscrire au forum (plus d'informations ici).

1/ Tu peux désinstaller Spybot (obsolète).

2/ Aurais-tu les rapports AdwCleaner et RogueKiller ?

3/ Concernant Spyrix, aurais-tu la possibilité de le désinstaller pour voir si le problème persiste ?

@+

Gabriel.

[Elkmar]

Ok je désinstalle Spybot, et pour les rapports je relance les deux et je copie colle ça.

[2011N2]

Re,

Ok merci.
Et pour Spyrix ?

Gabriel.

[Elkmar]

Spyrix oui je peux le désinstaller pour vérifier ( Si y a un keylogger gratuit plus sur à télécharger je suis preneur au cas où )

Pour Roguekiller :

RogueKiller V8.6.2 [Jul  5 2013] par Tigzy
mail : tigzyRKatgmaildotcom
Remontees : http://www.adlice.com/forum/
Site Web : http://www.sur-la-toile.com/RogueKiller/
Blog : http://tigzyrk.blogspot.com/

Systeme d'exploitation : Windows 8 (6.2.9200 ) 64 bits version
Demarrage : Mode normal
Utilisateur : Dimitri [Droits d'admin]
Mode : Recherche -- Date : 07/10/2013 19:11:00
| ARK || FAK || MBR |

¤¤¤ Processus malicieux : 0 ¤¤¤

¤¤¤ Entrees de registre : 0 ¤¤¤

¤¤¤ Tâches planifiées : 0 ¤¤¤

¤¤¤ Entrées Startup : 0 ¤¤¤

¤¤¤ Navigateurs web : 0 ¤¤¤

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤

¤¤¤ Driver : [NON CHARGE 0x0] ¤¤¤

¤¤¤ Ruches Externes: ¤¤¤

¤¤¤ Infection :  ¤¤¤

¤¤¤ Fichier HOSTS: ¤¤¤
-- %SystemRoot%\System32\drivers\etc\hosts




¤¤¤ MBR Verif: ¤¤¤

+++++ PhysicalDrive0: Hitachi HTS545032A7E380 +++++
--- User ---
[MBR] cd52311c246fa061754837319ef65c4f
[BSP] ac8a90d37d46ff07688d184799fc8c86 : Empty MBR Code
Partition table:
0 - [XXXXXX] UNKNOWN (0x00) [VISIBLE] Offset (sectors): 1 | Size: 2097151 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Termine : RKreport[0]_S_07102013_191100.txt
RKreport[0]_S_07102013_182313.txt




Je désinstalles Spyrix et lance adwcleaner vu qu'il demande de redémarrer si je me trompe pas.

[2011N2]

Re,

Ok, mais tu as supprimé les anciens rapports ?
Tu peux faire uniquement AdwCleaner en recherche, comme ça il ne va pas redémarrer.

Ensuite, une fois Spyrix désinstallé, tu redémarres ton PC, et tu me fais un nouveau rapport ZHPdiag. Tu me dis aussi si ton souci persiste.
On verra s'il en est la cause.

@+

Gabriel.

[Elkmar]

Voilà Spyrix désinstallé, et pas eu besoin de redémarrer finalement pou Adw :

# AdwCleaner v2.304 - Rapport créé le 10/07/2013 à 19:17:29
# Mis à jour le 03/07/2013 par Xplode
# Système d'exploitation : Windows 8  (64 bits)
# Nom d'utilisateur : Dimitri - DIM-PORTABLE
# Mode de démarrage : Normal
# Exécuté depuis : C:\Users\Dimitri\Downloads\adwcleaner.exe
# Option [Recherche]


***** [Services] *****


***** [Fichiers / Dossiers] *****


***** [Registre] *****


***** [Navigateurs] *****

-\\ Internet Explorer v10.0.9200.16537

[OK] Le registre ne contient aucune entrée illégitime.

-\\ Google Chrome v27.0.1453.116

Fichier : C:\Users\Dimitri\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Le fichier ne contient aucune entrée illégitime.

*************************

AdwCleaner[R1].txt - [874 octets] - [10/07/2013 17:10:47]
AdwCleaner[R2].txt - [933 octets] - [10/07/2013 17:12:15]
AdwCleaner[R3].txt - [1226 octets] - [10/07/2013 18:08:11]
AdwCleaner[R4].txt - [1172 octets] - [10/07/2013 18:15:26]
AdwCleaner[R5].txt - [985 octets] - [10/07/2013 19:17:29]
AdwCleaner[S1].txt - [994 octets] - [10/07/2013 17:12:44]
AdwCleaner[S2].txt - [1291 octets] - [10/07/2013 18:08:59]

########## EOF - C:\AdwCleaner[R5].txt - [1163 octets] ##########

[2011N2]

Re,

Ok, redémarre le PC et dis moi si ton souci est résolu. Tu me feras aussi un nouveau ZHPdiag, comme indiqué dans mon précédent message.

Gabriel.

[Elkmar]

Plus l'air d'avoir le problème, bizarre le problème est pas apparu en même temps que le logiciel pourtant, merci beaucoup. SI tu as un autre Keylogger sûr à me conseiller je suis preneur alors.

Rapport de ZHPDiag v2013.7.10.17 par Nicolas Coolman, Update du 10/07/2013
Run by Dimitri at 10/07/2013 19:25:06
WebSite: http://nicolascoolman.webs.com
State : Version à jour.
WhiteList : Enable
High Elevated Privileges : OK
UAC : Deactivate by program


---\\ Web Browser
MSIE: Internet Explorer v10.0.9200.16599
GCIE: Google Chrome v27.0.1453.116 (Defaut)

---\\ Windows Product Information
~ Langage: Français
Windows 8 Home Premium Edition, 64-bit  (Build 9200)
Windows Server License Manager Script : OK
~ ion : Windows(R) Operating System, OEM_DM channel
Windows ID Activation : OK
~ Windows Partial Key : 9HGBG
Windows License : OK
~ Windows Remaining Initializations Number : 998
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ System Protection
avast! Free Antivirus v8.0.1489.0
Windows Defender W8

---\\ System Optimizer
CCleaner v4.03  =Piriform Ltd

---\\ Peer To Peer (P2P)
µTorrent v3.3.0.29677  =P2P.µTorrent

---\\ Software Update
Adobe Reader XI

---\\ System Information
~ Processor: Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1931 MB (51% free)
System Restore: Activé (Enable)
System drive C: has 41 GB (34%) free of 119 GB

---\\ Logged in mode
~ Computer Name: DIM-PORTABLE
~ User Name: Dimitri
~ All Users Names: Dimitri, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Users\Dimitri\AppData\Roaming\
~ %Desktop% : C:\Users\Dimitri\Desktop\
~ %Favorites% : C:\Users\Dimitri\Favorites\
~ %LocalAppData% : C:\Users\Dimitri\AppData\Local\
~ %StartMenu% : C:\Users\Dimitri\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 41 Go of 119 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 157 Go of 158 Go)
E:\ CD-ROM drive (Not Inserted)



---\\ Security Center Tools Informations
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime :  Out Of Date
~ Security Center: 29 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.E13A31D5254C25406A7946BDD9B06364] - (.Microsoft Corporation - Explorateur Windows.) (.11/10/2012 - 08:35:16.) -- C:\Windows\Explorer.exe [2380944]
[MD5.FE9AB232B56A12224E8A3F3F9878C9A3] - (.Microsoft Corporation - Application de démarrage de Windows.) (.26/07/2012 - 04:08:50.) -- C:\Windows\System32\Wininit.exe [132608]
[MD5.36050B1CDF2DAE0B44286C7C46E4883E] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.28/04/2013 - 23:28:33.) -- C:\Windows\System32\wininet.dll [2241024]
[MD5.BCF2036A0DD579E47C008C133550283E] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.11/10/2012 - 06:46:58.) -- C:\Windows\System32\Winlogon.exe [517120]
[MD5.9448F5740A037EC0C18F0E9177232DD0] - (.Microsoft Corporation - Bibliothèque de licences.) (.26/07/2012 - 04:07:20.) -- C:\Windows\System32\sppcomapi.dll [273408]
[MD5.36D6A3201721558A8AFBCC09C2DA4C2C] - (.Microsoft Corporation - Pilote de fonction connexe pour WinSock.) (.06/11/2012 - 04:53:44.) -- C:\Windows\system32\Drivers\AFD.sys [560640]
[MD5.A721FF570C2387E383BDDEA9632863C9] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.26/07/2012 - 06:00:48.) -- C:\Windows\system32\Drivers\atapi.sys [25840]
[MD5.990B1BABE6E81FB18E65A87EBEFB1772] - (.Microsoft Corporation - CD-ROM File System Driver.) (.26/07/2012 - 03:30:10.) -- C:\Windows\system32\Drivers\Cdfs.sys [108544]
[MD5.339BFF85D788268752DA8C9644B188EE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.26/07/2012 - 03:26:36.) -- C:\Windows\system32\Drivers\Cdrom.sys [174080]
[MD5.09D9EB9E7898F8E6561473A20CC808B9] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.26/07/2012 - 03:26:53.) -- C:\Windows\system32\Drivers\DfsC.sys [118784]
[MD5.7D87B5B6C7188D553E11B59DC7F0B111] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/09/2012 - 07:08:44.) -- C:\Windows\system32\Drivers\HDAudBus.sys [71168]
[MD5.C9E9CBF73AFFBFE3E801EFB516787BA3] - (.Microsoft Corporation - Pilote de port i8042.) (.26/07/2012 - 03:28:51.) -- C:\Windows\system32\Drivers\i8042prt.sys [112640]
[MD5.3969B9C218DD3FAA9F4ED2FFC3651C02] - (.Microsoft Corporation - IP Network Address Translator.) (.26/07/2012 - 03:23:01.) -- C:\Windows\system32\Drivers\IpNat.sys [145920]
[MD5.93179D48066918323628CB016D8C94DC] - (.Microsoft Corporation - Minirdr SMB Windows NT.) (.05/02/2013 - 23:29:09.) -- C:\Windows\system32\Drivers\MRxSmb.sys [370688]
[MD5.7CEC25C682D319D484630B3952C31A11] - (.Microsoft Corporation - MBT Transport driver.) (.26/07/2012 - 03:24:28.) -- C:\Windows\system32\Drivers\netBT.sys [331776]
[MD5.76929F4A69E425911A63B407E26C2589] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.02/02/2013 - 11:54:54.) -- C:\Windows\system32\Drivers\ntfs.sys [1933544]
[MD5.4563DAF8C6A740AD7F501E219BD10766] - (.Microsoft Corporation - Pilote de port parallèle.) (.26/07/2012 - 03:29:53.) -- C:\Windows\system32\Drivers\Parport.sys [105984]
[MD5.A14D625C5AEE5FFE0F47D1A1D419FAAE] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.26/07/2012 - 03:23:17.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [124928]
[MD5.B2A3AD74FF2E2FFA73AF2567108231B3] - (.Microsoft Corporation - Redirecteur de périphérique de Microsoft RDP.) (.26/07/2012 - 03:25:18.) -- C:\Windows\system32\Drivers\rdpdr.sys [179712]
[MD5.73DC722CE5DF26D7638CE2446F2655C7] - (.Microsoft Corporation - TDI Translation Driver.) (.26/07/2012 - 06:26:47.) -- C:\Windows\system32\Drivers\tdx.sys [117248]
[MD5.2FB3CDFD5EAF4CD9D4AFAF96877D13AE] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.26/07/2012 - 05:57:09.) -- C:\Windows\system32\Drivers\volsnap.sys [332016]
~ Generic Processes:  Scanned in 00mn 06s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/417
~ Mes Videos (My Videos) : 1/69
~ Mes Favoris (My Favorites) : 1/7
~ Mes Documents (My Documents) : 1/2052
~ Mon Bureau (My Desktop) : 1/316
~ Menu demarrer (Programs) : 1/24
~ Hidden Files:  Scanned in 00mn 42s



---\\ Processus lancés
[MD5.0B50F07E63EE15383CDFDC26D7A3D3E3] - (.ASUSTek Computer Inc. - ATK Media.) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe  [205184] [PID.1804]
[MD5.2D32F0EF950AED6AD007D042676FD39E] - (.ASUSTek Computer Inc. - ATKOSD2.) -- C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe  [328064] [PID.1700]
[MD5.2678604575AE727DE44949742E84069D] - (.Google - Google Drive.) -- C:\Program Files (x86)\Google\Drive\googledrivesync.exe  [19676256] [PID.2736]
[MD5.B7BCA8A30CE13A283CDBDECEF5616C39] - (.ASUS - ACMON.) -- C:\Program Files (x86)\ASUS\Splendid\ACMON.exe  [107192] [PID.3128]
[MD5.97202E9C0D86387888435470CCAF45BE] - (.ASUSTeK - ACEngSvr Module.) -- C:\Windows\SysWOW64\ACEngSvr.exe  [192000] [PID.3220]
[MD5.3F11B20D12D89365D7721BDC860CE5F0] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe  [4858968] [PID.3580]
[MD5.35048D8E8A0BF7A797CD5757ACD7EED0] - (.CyberLink - CyberLink MediaLibray Service.) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe  [107816] [PID.3864]
[MD5.749949494676218FFA99501F4AA22ECC] - (.OpenOffice.org - OpenOffice.org 3.4.1.) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe  [10376704] [PID.1540]
[MD5.4EE367B8B1964160A1F1B80095183D3A] - (.OpenOffice.org - OpenOffice.org 3.4.1.) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin  [10368512] [PID.3148]
[MD5.E121530C2838C67C06A6AE0AEDC13B72] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe  [7693824] [PID.3988]
[MD5.25A51D18D48F1E144ABEC667E98C6261] - (.ASUSTeK Computer Inc. - ASUS Live Update.) -- C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe  [1558176] [PID.3176]
[MD5.5521928AA79079565B7CB8FCE6806131] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe  [825808] [PID.2592]
[MD5.97432AB9F1B3B3E63E778C1E69E71E91] - (.ASUSTek Computer Inc. - ASUS USB Charger Plus.) -- C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe  [1124032] [PID.1264]
~ Processes Running:  Scanned in 00mn 01s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Dimitri\AppData\Local\Google\Chrome\User Data\Default\Preferences
~ Google Browser: 12 Legitimates Filtered in 00mn 13s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management:  Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys:  Scanned in 00mn 00s



---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File:  Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: (no name) [64Bits] - [HKLM]{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} Clé orpheline
~ Toolbar:  Scanned in 00mn 00s



---\\ Applications démarrées par registre par dossier (O4)
O4 - HKCU\..\Run: [Power2GoExpress] Clé orpheline
O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
O4 - HKLM\..\Wow6432Node\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe
O4 - HKLM\..\Wow6432Node\Run: [kbdsprt] Clé orpheline
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
O4 - HKUS\S-1-5-21-2812769728-627241504-4235717230-1001\..\Run: [Power2GoExpress] Clé orpheline
O4 - HKUS\S-1-5-21-2812769728-627241504-4235717230-1001\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
~ Application:  Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop: Google Chrome.lnk . (.Google Inc. - Google Chrome.)  -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop: Google Drive.lnk . (...)  -- C:\Users\Dimitri\Google Drive
O4 - GS\Desktop: TS3 - Raccourci.lnk . (...)  -- C:\Program Files (x86)\Electronic Arts\Les Sims 3\Game\Bin\TS3.exe
O4 - GS\Desktop: Update Checker.lnk . (.FileHippo.com - FileHippo.com Update Checker.)  -- C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe
~ Global Startup:  Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{ACF5BE5A-3650-4282-BBB6-2586E3A9E772}: DhcpNameServer = 30.50.1.1 30.50.1.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7E89821-A041-43B6-BBD8-CFA8A2F2980A}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{ACF5BE5A-3650-4282-BBB6-2586E3A9E772}: DhcpDomain = F3-NB3-WDS.COM
O17 - HKLM\System\CS1\Services\Tcpip\..\{ACF5BE5A-3650-4282-BBB6-2586E3A9E772}: DhcpNameServer = 30.50.1.1 30.50.1.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{F7E89821-A041-43B6-BBD8-CFA8A2F2980A}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{ACF5BE5A-3650-4282-BBB6-2586E3A9E772}: DhcpDomain = F3-NB3-WDS.COM
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain:  Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll
~ Protocole Additionnel:  Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon:  Scanned in 00mn 00s



---\\ Pilotes lancés au démarrage (O41)
O41 - Driver: oem15.inf (dtsoftbus01) . (.Disc Soft Ltd - DAEMON Tools Virtual Bus Driver.) - C:\Windows\system32\drivers\dtsoftbus01.sys
~ Drivers: 40 Legitimates Filtered in 00mn 00s



---\\ HKCU HKLM Software Keys
[HKCU\Software\Spyrix]
[HKLM\Software\Wow6432Node\Spyrix]
~ Key Software: 133 Legitimates Filtered in 00mn 01s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 10/07/2013 - 19:16:50 - [0,167] ----D C:\Program Files (x86)\Spyrix Free Keylogger
O43 - CFD: 10/07/2013 - 19:16:50 - [334,852] ----D C:\ProgramData\Spyrix Free Keylogger
~ Program Folder: 98 Legitimates Filtered in 00mn 51s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.0A34066D56D57C0DA73BFFC1E4169FF2] - 10/07/2013 - 18:05:15 ---A- . (...) -- C:\Windows\wininit.ini  [85]
O44 - LFC:[MD5.B10660C49808D6AEFBD8972C936386DA] - 10/07/2013 - 17:12:29 ---A- . (...) -- C:\Windows\SysNative\ServiceFilter.ini  [2588]
O44 - LFC:[MD5.B10660C49808D6AEFBD8972C936386DA] - 10/07/2013 - 17:12:29 RSHAD . (...) -- C:\Windows\System32\ServiceFilter.ini  [2588]
O44 - LFC:[MD5.6A0E850DDCB136AA3D2FB7234382DF12] - 10/07/2013 - 16:36:15 RSHAD . (.Disc Soft Ltd - DAEMON Tools Virtual Bus Driver.) -- C:\Windows\System32\Drivers\dtsoftbus01.sys  [283064]
O44 - LFC:[MD5.A5F29AC2F0ADE8B995B49D7350CE3AC0] - 10/07/2013 - 11:26:19 RSHAD . (...) -- C:\Windows\System32\Drivers\aswSP.sys.sum  [175]
O44 - LFC:[MD5.2E83D2621E87C493AB45DC6655BA77D4] - 10/07/2013 - 11:26:19 RSHAD . (...) -- C:\Windows\System32\Drivers\aswSnx.sys.sum  [175]
~ Files: 30 Legitimates Filtered in 00mn 46s



---\\ ShareTools MSconfig StartupReg (O53)
O53 - SMSR:HKLM\...\startupreg\avast  [Key] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe
O53 - SMSR:HKLM\...\startupreg\DisableS3S4  [Key] . (...) -- c:\windows\temp\DisableS3S464\sethigh.cmd (.not file.)
O53 - SMSR:HKLM\...\startupreg\PowerSkin  [Key] . (...) -- c:\windows\temp\PowerSkin\PowerSkin.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\uTorrent  [Key] . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Dimitri\AppData\Roaming\uTorrent\uTorrent.exe  =P2P.µTorrent
~ SMSR Keys: 19 Legitimates Filtered in 00mn 00s



---\\ Microsoft Windows Policies System (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 17 Legitimates Filtered in 00mn 00s



---\\ Microsoft Windows Policies Explorer (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s



---\\ Liste des Drivers Système (O58)
O58 - SDL:[MD5.4F18D4C7EA14F11A7211F60D553C03DB] - 26/07/2012 - 06:00:49 ---A- . (.LSI - LSI 3ware SCSI Storport Driver.) -- C:\Windows\System32\Drivers\3ware.sys  [106736]
O58 - SDL:[MD5.221F28472FB210E2D4A7B4488BC798F9] - 19/09/2012 - 01:15:20 ----- . (.Qualcomm Atheros Communications, Inc. - Qualcomm Atheros Extensible Wireless LAN device driver.) -- C:\Windows\System32\athw8x.sys  [3653632]
~ Drivers:  Scanned in 00mn 00s



---\\ Liste des outils de nettoyage (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
O63 - Logiciel: ZHPFix 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPFix_is1
~ ADS:  Scanned in 00mn 00s



---\\ File Associations Shell Spawning (O67)
O67 - Shell Spawning: .html ChromeHTML[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 19 Legitimates Filtered in 00mn 00s



---\\ Start Menu Internet (O68)
O68 - StartMenuInternet: Google Chrome Google Chrome[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: IEXPLORE.EXE Internet Explorer[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys:  Scanned in 00mn 00s



---\\ Recherche particuliere à la racine de certains dossiers (O84)
[MD5.4A93070098539B54FDA391D4D551C880] [SPRF][22/07/2009] (...) -- C:\ProgramData\SetStretch.exe  [24576]
[MD5.13A09BECABCE7CE7DE02D42D9C00A250] [SPRF][10/07/2013] (...) -- C:\Users\Dimitri\AppData\Local\Temp\bitool.dll  [38456]
[MD5.77BFC716EC79B0DEEB47AE8862DB5DBD] [SPRF][10/07/2013] (.-lop--o--i-llp - Pas de description.) -- C:\Users\Dimitri\AppData\Local\Temp\LollipopInstaller_somoto_14693.exe  [269312]  =Adware.MegaSearch
[MD5.AE995372EAB372C5BB6D6FC7D3990702] [SPRF][10/07/2013] (...) -- C:\Users\Dimitri\AppData\Roaming\sp_data.sys  [401]
~ Files:  Scanned in 00mn 00s



---\\ Scan Additionnel (O88)
Database Version : v2.12720 - (10/07/2013)
Clés trouvées (Keys found) : 2
Valeurs trouvées (Values found) : 0
Dossiers trouvés  (Folders found) : 2
Fichiers trouvés  (Files found) : 3

[HKCU\Software\Spyrix] =Keylogger.Spyrix
[HKLM\Software\Wow6432Node\Spyrix] =Keylogger.Spyrix
C:\Program Files (x86)\Spyrix Free Keylogger =Keylogger.Spyrix
C:\ProgramData\Spyrix Free Keylogger =Keylogger.Spyrix
C:\Users\Dimitri\AppData\Local\Temp\LollipopInstaller_somoto_14693.exe =Adware.Lollipop
C:\Users\Dimitri\AppData\Local\Temp\nsd75AD.tmp =Adware.MegaSearch
~ Additionnel Scan: 140538 Items scanned in 00mn 47s



---\\ Product Upgrade Codes (O90)
O90 - PUC: "275E2715571C08F46A5DC54B8562DA16" . (.SceneSwitch.) -- C:\Windows\Installer\{5172E572-C175-4F80-A6D5-5CB45826AD61}\_853F67D554F05449430E7E.exe
~ Update Products: 30 Legitimates Filtered in 00mn 00s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Demand 11/05/2013 65640 |  (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 15/10/2012 1221808 |  (AFBAgent) . (.ASUSTeK Computer Inc..) - C:\Windows\system32\FBAgent.exe
SR - | Demand 05/10/2012 110976 |  (ASLDRService) . (.ASUSTek Computer Inc..) - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
SR - | Demand 13/04/2012 277120 |  (ASUS InstantOn) . (.ASUS.) - C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe
SR - | Demand 21/11/2011 96896 |  (ATKGFNEXSrv) . (.ASUS.) - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
SR - | Auto 09/05/2013 46808 |  (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SS - | Demand 02/11/2012 277024 |  (cphs) . (.Intel Corporation.) - C:\Windows\SysWow64\IntelCpHeciSvc.exe
SS - | Auto 02/04/2013 116648 |  (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 02/04/2013 116648 |  (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SR - | Demand 20/04/2012 635104 |  (Intel(R) Capability Licensing Service Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\iCLS Client\HeciServer.exe
SR - | Demand 27/06/2012 129856 |  (Intel(R) ME Service) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
SR - | Demand 25/06/2012 166720 |  (jhi_service) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
SR - | Demand 17/07/2012 277824 |  (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
SR - | Demand 17/07/2012 365376 |  (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
SS - | Demand  0 |  (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe
SS - | Demand 20/09/2012 29696 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services:  Scanned in 00mn 03s



---\\ Malicius Software Information
~ http://nicolascoolman.webs.com/apps/blo ... megasearch  =Adware.MegaSearch
~ http://nicolascoolman.webs.com/apps/blo ... ger-spyrix  =Keylogger.Spyrix
~ http://nicolascoolman.webs.com/apps/blo ... e-lollipop  =Adware.Lollipop
~ MSI: 3 link(s) detected in 00mn 03s



~ 743 Legitimates filtered by white list
End of the scan (358 lines in 04mn 20s)(0)

[2011N2]

Re,

Désolé je connais mal les keyloggers...
En revanche, peux-tu recommencer ZHPdiag en cochant Tous dans le tournevis, puis cliquer sur la loupe à droite de ce dernier ?
Car il y a des restes.

Merci,

Gabriel.

[2011N2]

Où en-est votre problème ?

Deux solutions,

• Votre problème est résolu, dans ce cas pensez à nous en faire part.
• Votre problème est toujours d'actualité, merci de nous renseigner sur ce qui ne va pas, et donner des nouvelles régulièrement.
  
  
  À bientôt sur FEI !

[2011N2]

Bonjour,

Nous n'avons plus de nouvelle de l'auteur de ce sujet depuis plus de 10 jours. Nous considérons donc ce problème comme résolu ou abandonné par son auteur. La prochaine fois, merci de nous tenir au courant de l'évolution de votre problème, ou à faire un UP régulièrement !

Ce sujet est verrouillé, si vous souhaitez le reprendre, merci de contacter par message privé un membre de l'équipe de modération du forum.

À bientôt sur FEI !