FORUM D’ENTRAIDE INFORMATIQUE (FEI)Site d’assistance et de sécurité informatique

[EVALIA5776]

Bonjour,

je suis pas très douée en informatique alors je viens vous demander conseil pour éradiquer Nation Zoom. J'ai déjà fais une recherche malwarebyte et redémarrée mon PC mais y a rien a faire!!!! Au secours!

Comme j'ai lu certains messages, j'ai déjà installé ZHP et comme je suis sous windows 7, je l'ai exécuté en tant qu'administrateur. Voici mon résultat. 10000000 MerciS d'avance si vous m'aidez!

Je vous copie colle le résultat

~ Rapport de ZHPDiag v2014.1.17.19 - Nicolas Coolman  (17/01/2014)
~ Lancé par Emma (22/01/2014 20:39:41)
~ Adresse du Site Web  http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version : 
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by user


---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.16476
GCIE: Google Chrome v32.0.1700.76 (Defaut)

---\\ Informations sur les produits Windows
~ Langage: Français
Windows Vista (TM) Ultimate, 64-bit Service Pack 1 (Build 6000)
Windows Server License Manager Script : OK
System - Enable Open file C:\Users\Emma\AppData\Roaming\ZHP\Licence.txt  =.Nicolas Coolman

---\\ Logiciels de protection du système
Avira Free Antivirus v14.0.2.286
Malwarebytes Anti-Malware version 1.75.0.1300

---\\ Logiciels d'optimisation du système

---\\ Logiciels de partage PeerToPeer

---\\ Surveillance de Logiciels
Adobe Flash Player 11 ActiveX
Adobe Reader 64-bit fixes
Adobe Reader X
Java 7 Update 45

---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3889 MB (44% free)
System Restore: Activé (Enable)
System drive C: has 375 GB (83%) free of 449 GB

---\\ Mode de connexion au système
~ Computer Name: EMMA-PC
~ User Name: Emma
~ All Users Names: Emma, Administrateur, 
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Emma\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Emma\AppData\Roaming\
~ %Desktop% : C:\Users\Emma\Desktop\
~ %Favorites% : C:\Users\Emma\Favorites\
~ %LocalAppData% : C:\Users\Emma\AppData\Local\
~ %StartMenu% : C:\Users\Emma\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 375 Go of 449 Go)
D: CD-ROM drive (Free 0 Go of 0 Go)



---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
~ Security Center: 46 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.9B6678DB9C6A232C5A84D2FDFFF8B0E1] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.26/11/2013 - 08:07:57.) -- C:\Windows\System32\wininet.dll [2334208]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.21/11/2010 - 04:24:29.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.21/11/2010 - 04:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/09/2013 - 02:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 04:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 04:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes:  Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 2/415
~ Mes musiques (My Musics) : 1/272
~ Mes Favoris (My Favorites) : 1/26
~ Mes Documents (My Documents) : 4/540
~ Mon Bureau (My Desktop) : 6/1998
~ Menu demarrer (Programs) : 1/34
~ Hidden Files:  Scanned in 00mn 00s



---\\ Processus lancés
[MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe   [532040] [PID.1344]
[MD5.D213F06AE294341F3503FD74E22E7DDA] - (.Microsoft Corporation - Microsoft SkyDrive.) -- C:\Users\Emma\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe   [257136] [PID.5048]
[MD5.FF5E26337407DFC9198E1B726298EFAD] - (.RemoteMouse.net - Remote Mouse.) -- C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe   [1195520] [PID.4668]
[MD5.0AF43C2213819F43ECFF2B1E11BE4CBF] - (.Microsoft Corporation - Send to OneNote Tool.) -- C:\Program Files (x86)\Microsoft Office\Office15\ONENOTEM.exe   [193712] [PID.4740]
[MD5.4DDE3E01B5020B3D5DEEC7E3DC0F3185] - (.NTI Corporation - Acer Backup Manager.) -- C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe   [296984] [PID.4616]
[MD5.4D1DA8CE5E364D22B4FF00F163194514] - (.Intel Corporation - Intel(R) USB 3.0 Monitor.) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe   [291608] [PID.5136]
[MD5.FE668B0E3E87077A46FE77AFB0E27F9C] - (.Dritek System Inc. - Launch Manager.) -- C:\Program Files (x86)\Launch Manager\LManager.exe   [1105488] [PID.5148]
[MD5.DD231039B13EC2ABDE315D76E658EF0E] - (.Avira Operations GmbH Co. KG - Antivirus System Tray Tool (Desktop).) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe   [684600] [PID.5204]
[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe   [254336] [PID.5212]
[MD5.1A7F10605F9672E101BFA27CAED210D5] - (.Dritek System Inc. - Launch Manager Worker.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe   [343632] [PID.5332]
[MD5.9CC2AFA054D7B903FBBCD79D0C434796] - (.Pas de propriétaire - iuBrowserIEAgent.) -- C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe   [40552] [PID.5940]
[MD5.166341724BDAC91B620B4ECD7B2D72AC] - (.Pas de propriétaire - iuEmailOutlookAgent.) -- C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe   [22120] [PID.6148]
[MD5.0B8F9350595E330DC38ED24FED1BFDAF] - (.Microsoft Corporation - Microsoft Office Document Cache Sync Client.) -- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE15\CSISYNCCLIENT.exe   [78544] [PID.5188]
[MD5.3B0BA44D5691E00088B956394FDE64B6] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe   [866584] [PID.6432]
[MD5.8E5651B04BE775696B32F7F1F5DA8871] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe   [8336896] [PID.7892]
[MD5.A3A35EE79C64A640152B3113E6E254E2] - (.Microsoft Corporation - Microsoft ® Console Based Script Host.) -- C:\Windows\SysWOW64\cscript.exe   [126976] [PID.7652]
[MD5.FE79366FECD444A16CCA9979134DBEA8] - (.Avira Operations GmbH Co. KG - Antivirus Host Framework Service.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe   [440376] [PID.1432]
[MD5.B362181ED3771DC03B4141927C80F801] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe   [65432] [PID.1576]
[MD5.FDE9C7030FB1E9E2715E113EE6A10F90] - (.Avira Operations GmbH Co. KG - Antivirus Host Framework Service.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe   [440376] [PID.1604]
[MD5.C02FF01B821FBB72104132E56EC5B881] - (.Dritek System Inc. - Dritek WMI Service.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe   [355920] [PID.1876]
[MD5.D98B7ABBBB55FD3A4D9F7B8A7869FCBF] - (.Dritek System Inc. - Launch Manager utility process.) -- C:\Program Files (x86)\Launch Manager\LMutilps32.exe   [419408] [PID.1932]
[MD5.32096F187020A54D29C95B3A1467D963] - (.Acer Incorporated - Global Registration Service.) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe   [28264] [PID.1956]
[MD5.5A8C154DE7DDEE8ADA3375CC76C4351F] - (...) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe   [127320] [PID.2024]
[MD5.13E838EA8652F8451F29301D3B56B17B] - (.Intel Corporation - Intel(R) Dynamic Application Loader Host In.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe   [162648] [PID.440]
[MD5.6BB516A31DE232DAB436FF3A117E1E80] - (.Acer Incorporated - Updater Service.) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe   [255376] [PID.1184]
[MD5.65085456FD9A74D7F1A999520C299ECB] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe   [418376] [PID.1496]
[MD5.E0D7732F2D2E24B2DB3F67B6750295B8] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe   [701512] [PID.1640]
[MD5.D27A4546417ED7C4AEA7B3420D4F1F50] - (.NTI Corporation - Backup Manager Module.) -- C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe   [256536] [PID.2108]
[MD5.388AE59FE75F1B959DFA0900923C61BB] - (.Skype Technologies S.A. - Skype C2C Service.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe   [3064000] [PID.2248]
[MD5.342A8A4B8C85AD532451A5F1401D24CC] - (.Atheros - Atheros Coex Service Application.) -- C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe   [76960] [PID.2564]
[MD5.BD9457699AC9C1A0FE43398043617279] - (.Intel Corporation - Local Manageability Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe   [276824] [PID.1328]
[MD5.F76057596EF65049869098677AB72C30] - (.Intel Corporation - User Notification Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe   [362840] [PID.2980]
[MD5.2B8E4C792BED0E5882702720BC528AE5] - (.Microsoft Corporation - Office Source Engine.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.exe   [150648] [PID.8188]
~ Processes Running:  Scanned in 00mn 00s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Emma\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [dffhljlmcohcioeilbnpmbchdcbhifdh] WiseConvert 1.5 v.10.13.20.29 (Désactivé) =Toolbar.Conduit
G2 - GCE: Preference [User Data\Default] [fpnnogogihegcbpaodbnepofjfiepfcb] Fortunitas v.1.0.0 (Désactivé)
G2 - GCE: Preference [User Data\Default] [hoelbcjlbdmngpmhcljbiilahnlamdni] WhiteRabbit v.2.0.2 (Désactivé)
G2 - GCE: Preference [User Data\Default] [mlgdghcmmajjmogpdohmoemlbecifldo] Productivity 3 v.10.13.20.29 (Désactivé)
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [pkndmigholgfjlniaohblojbhgjbkakn] Lightning speedDial v.1.1.7, (Désactivé)
~ Google Browser: 15 Legitimates Filtered in 00mn 01s



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.nationzoom.com =Hijacker.NationZoom
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = preserve
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.nationzoom.com =Hijacker.NationZoom
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.nationzoom.com =Hijacker.NationZoom
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nationzoom.com =Hijacker.NationZoom
~ IE Browser: 19 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management:  Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys:  Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File:  Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Free PDF to Word Converter.lnk . (.SmartSoft - Free PDF to Word Converter.)  -- C:\Program Files\Free PDF to Word Converter\Free PDF to Word Converter.exe 
O4 - GS\Desktop [Public]: RegClean Pro.lnk . (...)  -- C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe (.not file.) =Rogue.RegistryPowerCleaner
O4 - GS\Desktop [Public]: Remote Mouse.lnk . (.RemoteMouse.net - Remote Mouse.)  -- C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe 
O4 - GS\Program [Public]: Prezi Desktop.lnk . (...)  -- C:\Program Files (x86)\Prezi Desktop 4\Prezi Desktop.exe
O4 - GS\QuickLaunch [Emma]: Google Chrome.lnk . (.Google Inc. - Google Chrome.)  -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.nationzoom.com =Hijacker.NationZoom
O4 - GS\QuickLaunch [Emma]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files\Internet Explorer\iexplore.exe http://www.nationzoom.com =Hijacker.NationZoom
O4 - GS\TaskBar [Emma]: Google Chrome.lnk . (.Google Inc. - Google Chrome.)  -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.nationzoom.com =Hijacker.NationZoom
O4 - GS\TaskBar [Emma]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files\Internet Explorer\iexplore.exe http://www.nationzoom.com =Hijacker.NationZoom
O4 - GS\TaskBar [Emma]: Lync 2013.lnk . (...)  -- C:\Windows\Installer\{90150000-0011-0000-0000-0000000FF1CE}\lyncicon.exe
O4 - GS\Program [Emma]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files\Internet Explorer\iexplore.exe http://www.nationzoom.com =Hijacker.NationZoom
O4 - GS\SystemTools [Emma]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files\Internet Explorer\iexplore.exe http://www.nationzoom.com =Hijacker.NationZoom
O4 - GS\Desktop [Emma]: Jawbone Updater.lnk . (...)  -- C:\Program Files (x86)\Jawbone\JawboneUpdater.exe
O4 - GS\Desktop [Emma]: Nettoyez votre registre gratuitement!.lnk - Clé orpheline
O4 - GS\Desktop [Emma]: Windows Update Troubleshooting Info.lnk - Clé orpheline
~ Global Startup: 71 Legitimates Filtered in 00mn 01s



---\\ Applications lancées au démarrage du sytème (O4)
O4 - GS\Startup [Emma]: Envoyer à OneNote.lnk . (.Microsoft Corporation - Send to OneNote Tool.)  -- C:\Program Files (x86)\Microsoft Office\Office15\ONENOTEM.exe 
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe 
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe 
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe 
O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe  =.Realtek Semiconductor Corp
O4 - HKLM\..\Run: [RtHDVBg_Dolby] . (.Realtek Semiconductor - HD Audio Background Process.) -- C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe 
O4 - HKLM\..\Run: [AtherosBtStack] . (.Atheros Communications - Serveur Stack Bluetooth.) -- C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe 
O4 - HKLM\..\Run: [AthBtTray] . (.Atheros Commnucations - Bluetooth Tray.) -- C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe 
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe (.not file.) 
O4 - HKLM\..\Run: [Power Management] . (.Acer Incorporated - ePowerTray.) -- C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe 
O4 - HKLM\..\Run: [InstantUpdate] . (...) -- C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuDaemon.exe 
O4 - HKCU\..\Run: [GoogleDriveSync] C:\Program Files (x86)\Google\Drive\googledrivesync.exe (.not file.) 
O4 - HKCU\..\Run: [SkyDrive] . (.Microsoft Corporation - Microsoft SkyDrive.) -- C:\Users\Emma\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe  =.Microsoft Corporation
O4 - HKCU\..\Run: [Remote Mouse] . (.RemoteMouse.net - Remote Mouse.) -- C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe 
O4 - HKLM\..\Wow6432Node\Run: [BackupManagerTray] . (.NTI Corporation - Acer Backup Manager.) -- C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe 
O4 - HKLM\..\Wow6432Node\Run: [Dolby Advanced Audio v2] . (.Dolby Laboratories Inc. - Dolby Profile Selector.) -- C:\Dolby PCEE4\pcee4.exe 
O4 - HKLM\..\Wow6432Node\Run: [USB3MON] . (.Intel Corporation - Intel(R) USB 3.0 Monitor.) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe 
O4 - HKLM\..\Wow6432Node\Run: [LManager] . (.Dritek System Inc. - Launch Manager.) -- C:\Program Files (x86)\Launch Manager\LManager.exe 
O4 - HKLM\..\Wow6432Node\Run: [SuiteTray] . (.Egis Technology Inc. - SuiteTray.) -- C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe 
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe  =.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [avgnt] . (.Avira Operations GmbH Co. KG - Antivirus System Tray Tool (Desktop).) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe 
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe  =.Oracle Corporation
O4 - HKLM\..\Wow6432Node\Run: [fst_fr_50] Clé orpheline =PUA.FSTfr9
O4 - HKLM\..\Wow6432Node\Run: [mobilegeni daemon] C:\Program Files (x86)\Mobogenie\DaemonProcess.exe (.not file.) 
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe  =.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe  =.Microsoft Corporation
O4 - HKUS\.DEFAULT\..\RunOnce: [IsMyWinLockerReboot] . (.Microsoft Corporation - Installateur Windows®.) -- C:\Windows\System32\msiexec.exe 
O4 - HKUS\S-1-5-18\..\RunOnce: [IsMyWinLockerReboot] . (.Microsoft Corporation - Installateur Windows®.) -- C:\Windows\System32\msiexec.exe 
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe  =.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [IsMyWinLockerReboot] . (.Microsoft Corporation - Installateur Windows®.) -- C:\Windows\System32\msiexec.exe 
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe  =.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [IsMyWinLockerReboot] . (.Microsoft Corporation - Installateur Windows®.) -- C:\Windows\System32\msiexec.exe 
O4 - HKUS\S-1-5-21-565357474-361032557-2479145070-1000\..\Run: [GoogleDriveSync] C:\Program Files (x86)\Google\Drive\googledrivesync.exe (.not file.) 
O4 - HKUS\S-1-5-21-565357474-361032557-2479145070-1000\..\Run: [SkyDrive] . (.Microsoft Corporation - Microsoft SkyDrive.) -- C:\Users\Emma\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe  =.Microsoft Corporation
O4 - HKUS\S-1-5-21-565357474-361032557-2479145070-1000\..\Run: [Remote Mouse] . (.RemoteMouse.net - Remote Mouse.) -- C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe 
~ Application:  Scanned in 00mn 00s



---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Envoyer à OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} -- C:\Program Files (x86)\MICROS~2\Office15\ONBttnIE.dll (.not file.)
O9 - Extra button: Cliquer pour appeler Lync [64Bits] - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -- C:\Program Files\Microsoft Office\Office15\lync.exe (.not file.)
O9 - Extra button: Notes liées OneNote [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} -- C:\Program Files (x86)\MICROS~2\Office15\ONBTTN~1.dll (.not file.)
O9 - Extra button: Skype Click to Call [64Bits] - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- c:\program files (x86)\skype\toolbars\internet explorer x64\icon.ico
~ IE Extra Buttons:  Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{4DCDF6AE-4C26-4256-9BDF-4C768B31A386}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{E593E977-4598-4B52-B1B2-18103BA53ECD}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{E593E977-4598-4B52-B1B2-18103BA53ECD}: DhcpDomain = ot-bitche.local
O17 - HKLM\System\CS1\Services\Tcpip\..\{4DCDF6AE-4C26-4256-9BDF-4C768B31A386}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{E593E977-4598-4B52-B1B2-18103BA53ECD}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{E593E977-4598-4B52-B1B2-18103BA53ECD}: DhcpDomain = ot-bitche.local
O17 - HKLM\System\CS2\Services\Tcpip\..\{4DCDF6AE-4C26-4256-9BDF-4C768B31A386}: DhcpNameServer = 109.0.66.20 109.0.66.10
O17 - HKLM\System\CS2\Services\Tcpip\..\{E593E977-4598-4B52-B1B2-18103BA53ECD}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{E593E977-4598-4B52-B1B2-18103BA53ECD}: DhcpDomain = ot-bitche.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain:  Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) -- 
O18 - Filter: text/xml [64Bits] - {807583E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.dll  =.Microsoft Corporation
~ Protocole Additionnel:  Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon:  Scanned in 00mn 00s



---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [RegClean Pro] (...) -- C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe (.not file.)   [0]  =Rogue.RegistryPowerCleaner
[MD5.00000000000000000000000000000000] [APT] [{97CBA30D-DC15-47F9-B36A-0F48D542FD3D}] (...) -- C:\Users\Emma\Desktop\wlsetup-we_fr.exe (.not file.)   [0]
[MD5.00000000000000000000000000000000] [APT] [{CA769A29-1450-49F1-9065-807B4274541E}] (...) -- c:\users\Emma\appdata\local\lollipop\lollipop.bat (.not file.)   [0]  =Adware.Lollipop
~ Scheduled Task: 20 Legitimates Filtered in 00mn 09s



---\\ Logiciels installés (O42)
O42 - Logiciel: fst_fr_6 - (.Freesofttoday.) [HKLM][64Bits] -- fst_fr_6_is1 =Adware.FreeSoftToday
~ Logic: 44 Legitimates Filtered in 00mn 01s



---\\ HKCU HKLM Software Keys
[HKCU\Software\FoxTab]
[HKCU\Software\TutoTag] =Spyware.AgenceExclusive
[HKCU\Software\WEDLMNGR] =PUP.weDownloadManager
[HKCU\Software\ssiap]
[HKCU\Software\weDownload] =PUP.weDownloadManager
[HKLM\Software\DomaIQ] =Adware.DomaIQ
[HKLM\Software\Wow6432Node\FoxTab]
[HKLM\Software\Wow6432Node\Tutorials] =Spyware.AgenceExclusive
[HKLM\Software\Wow6432Node\supWPM] =PUP.WpManager
~ Key Software: 335 Legitimates Filtered in 00mn 01s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 25/10/2013 - 21:13:55 - [0,703] ----D C:\Program Files (x86)\fst_fr_6 =PUA.FSTfr9
O43 - CFD: 16/05/2013 - 18:24:14 - [4,679] ----D C:\Program Files (x86)\GUM6FB5.tmp
O43 - CFD: 24/06/2013 - 13:33:42 - [0,076] ----D C:\Program Files (x86)\JOB-ATTITUDE
O43 - CFD: 22/01/2014 - 07:49:58 - [0,015] ----D C:\Program Files (x86)\MyPC Backup =PUP.MyPCBackup
O43 - CFD: 16/03/2013 - 09:50:36 - [0,081] ----D C:\ProgramData\InstallMate =PUP.Tarma
O43 - CFD: 23/02/2013 - 18:31:26 - [0] ----D C:\ProgramData\PDF2Printer
O43 - CFD: 22/01/2014 - 07:37:37 - [0] ----D C:\ProgramData\WPM =PUP.WpManager
O43 - CFD: 25/10/2013 - 13:39:59 - [0] ----D C:\Users\Emma\AppData\Local\fst_fr_6 =PUA.FSTfr9
O43 - CFD: 21/01/2014 - 21:58:23 - [1,224] ----D C:\Users\Emma\AppData\Local\genienext
~ 92 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 310 Legitimates Filtered in 00mn 04s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.5DB2E96514C8722BDB60F0C8EA0CF865] - 18/01/2014 - 17:14:46 ---A- . (...) -- C:\Windows\win.ini   [510]
O44 - LFC:[MD5.385D6438CE0D3DB25705F907D3019920] - 21/01/2014 - 22:04:43 ---A- . (.Systweak Inc., (http://www.systweak.com) - Regclean Pro.) -- C:\Windows\System32\roboot64.exe   [18816]  =Rogue.RegistryPowerCleaner
O44 - LFC:[MD5.36CD8791834708D3C33F22756EA34C7E] - 22/01/2014 - 19:42:46 ---A- . (...) -- C:\IFRToolLog.txt   [1402902]
~ Files: 25 Legitimates Filtered in 00mn 03s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 4 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.DE6759B8D8E62BF0FFF2B05F05AFCEE6] - 07/03/2013 - 00:33:21 ---A- . (...) -- C:\Windows\System32\Drivers\aswRvrt.sys   [65336]
O58 - SDL:[MD5.7E44C2684A6CA779B9D07CB4BD3F649D] - 07/03/2013 - 00:33:21 ---A- . (...) -- C:\Windows\System32\Drivers\aswVmm.sys   [178624]
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys   [530496]
O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys   [31232]
O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise  SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys   [24656]
O58 - SDL:[MD5.B280C4608AC389DA9515A35AC4CAB0FD] - 24/06/2010 - 23:53:04 ---A- . (.http://libusb-win32.sourceforge.net - LibUSB-Win32 - Kernel Driver.) -- C:\Windows\SysWOW64\drivers\libusb0.sys   [21504]
~ Drivers: 16 Legitimates Filtered in 00mn 01s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1  =.Nicolas Coolman
~ ADS:  Scanned in 00mn 00s



---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: [HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) --  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" http://www.nationzoom.com =Hijacker.NationZoom
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
~ Keys:  Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {EDFF4ACE-5DF7-42A8-B67C-EB06E07F8E4D} - (Ask Search) - http://websearch.ask.com =Toolbar.Ask
~ Keys:  Scanned in 00mn 00s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.858D895AD40DE9779E78C39A116F9553] [SPRF][21/01/2014] (...) -- C:\Users\Emma\AppData\Local\Temp\BackupSetup.exe   [10355400]
[MD5.702CAFA129A698906160B1605C354729] [SPRF][21/01/2014] (.Pas de propriétaire - myxjvifhwvoppx.) -- C:\Users\Emma\AppData\Local\Temp\djgmejcgdblwff.exe   [11776]
[MD5.AF7CE801C8471C5CD19B366333C153C4] [SPRF][12/03/2013] (.Tarma Software Research Pty Ltd - InstallMate® Setup Library.) -- C:\Users\Emma\AppData\Local\Temp\TsuAD327CD8.dll   [275552]  =PUP.Tarma
~ Files: 4 Legitimates Filtered in 00mn 01s



---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{09E870C6-FC97-479E-9655-37C845AA287A}" | In - Public - P6 - TRUE | .(...) -- C:\Program Files (x86)\Jawbone\JawboneUpdater.exe
O87 - FAEL: "{A799F112-B290-4A7E-9101-4CCCEFD58D1D}" | In - Public - P17 - TRUE | .(...) -- C:\Program Files (x86)\Jawbone\JawboneUpdater.exe
O87 - FAEL: "{F5023246-C867-40BD-AC76-EFA3538A3613}" |In - None - P17 - TRUE | .(...) -- C:\Users\Emma\Downloads\CorelWordperfectOfficeX616318_SoftangoDownloader.exe (.not file.)
O87 - FAEL: "{6CFEFC16-27D4-4EFA-8F3C-7F73EFFD244C}" |Out - None - P17 - TRUE | .(...) -- C:\Users\Emma\Downloads\CorelWordperfectOfficeX616318_SoftangoDownloader.exe (.not file.)
O87 - FAEL: "{E2942D40-C667-4FAA-BA5A-32D6960F5ACE}" |In - None - P17 - TRUE | .(...) -- C:\Users\Emma\AppData\Local\Temp\Softango  Downloader213706.exe (.not file.)
O87 - FAEL: "{48099557-4557-4B6B-B2A8-9E9E47A4778E}" |Out - None - P17 - TRUE | .(...) -- C:\Users\Emma\AppData\Local\Temp\Softango  Downloader213706.exe (.not file.)
O87 - FAEL: "{3F7C3E1D-FD0B-4F2E-9CC4-E564B87B94F5}" |In - Public - P6 - TRUE | .(...) -- C:\ProgramData\eSafe\eGdpSvc.exe (.not file.) =PUP.eSafeSecurity
O87 - FAEL: "{01B7BE77-C253-4C39-AB0E-088EA2BDB362}" | In - Public - P6 - TRUE | .(.RemoteMouse.net - Remote Mouse.) -- C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe
O87 - FAEL: "{74F8286F-687D-4ECA-B0CF-5777C0BC5CBC}" | In - Public - P17 - TRUE | .(.RemoteMouse.net - Remote Mouse.) -- C:\Program Files (x86)\Remote Mouse\RemoteMouse.exe
O87 - FAEL: "TCP Query User{B6DAC838-794A-4657-B81B-A559F0F59AE8}C:\program files (x86)\remote mouse\remotemouse.exe" | In - Private - P6 - TRUE | .(.RemoteMouse.net - Remote Mouse.) -- C:\program files (x86)\remote mouse\remotemouse.exe
O87 - FAEL: "UDP Query User{DBF4B3A4-DA6B-4593-8C37-D5C1831019D3}C:\program files (x86)\remote mouse\remotemouse.exe" | In - Private - P17 - TRUE | .(.RemoteMouse.net - Remote Mouse.) -- C:\program files (x86)\remote mouse\remotemouse.exe
~ Firewall: 251 Legitimates Filtered in 00mn 01s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 11/12/2013 257416 |  (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 23/04/2012 276248 |  (cphs) . (.Intel Corporation.) - C:\Windows\SysWow64\IntelCpHeciSvc.exe
SS - | Demand 21/06/2011 173424 |  (EgisTec Ticket Service) . (.Egis Technology Inc..) - C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe
SS - | Demand 30/03/2012 655624 |  (FLEXnet Licensing Service) . (.Acresso Software Inc..) - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
SS - | Demand 12/10/2010 206072 |  (GamesAppService) . (.WildTangent, Inc..) - C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe
SS - | Auto 24/06/2013 116648 |  (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 24/06/2013 116648 |  (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Auto 09/11/2012 160944 |  (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

SR - | Auto 18/12/2013 65432 |  (AdobeARMservice) . (.Adobe Systems Incorporated.) - c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 19/12/2013 440376 |  (AntiVirSchedulerService) . (.Avira Operations GmbH Co. KG.) - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
SR - | Auto 01/12/2013 440376 |  (AntiVirService) . (.Avira Operations GmbH Co. KG.) - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
SR - | Auto 08/03/2012 107648 |  (AtherosSvc) . (.Atheros Commnucations.) - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
SR - | Auto 24/03/2012 355920 |  (DsiWMIService) . (.Dritek System Inc..) - C:\Program Files (x86)\Launch Manager\dsiwmis.exe
SR - | Auto 07/02/2012 871296 |  (ePowerSvc) . (.Acer Incorporated.) - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
SR - | Auto 29/02/2012 28264 |  (GREGService) . (.Acer Incorporated.) - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
SR - | Auto 14/07/2009 27136 | C:\Users\Emma\AppData\Local\Temp\7zS2947\hpslpsvc64.dll (HPSLPSVC) . (.Hewlett-Packard Co..) - C:\Windows\System32\svchost.exe
SR - | Auto 02/02/2012 628448 |  (Intel(R) Capability Licensing Service Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\iCLS Client\HeciServer.exe
SR - | Auto 16/03/2012 127320 |  (Intel(R) ME Service) . (...) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
SR - | Auto 16/03/2012 162648 |  (jhi_service) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
SR - | Auto 07/02/2012 255376 |  (Live Updater Service) . (.Acer Incorporated.) - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
SR - | Auto 16/03/2012 276824 |  (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
SR - | Auto 04/04/2013 418376 |  (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
SR - | Auto 04/04/2013 701512 |  (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
SR - | Auto 05/01/2012 256536 |  (NTI IScheduleSvc) . (.NTI Corporation.) - C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
SR - | Auto 02/10/2012 3064000 |  (Skype C2C Service) . (.Skype Technologies S.A..) - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
SR - | Auto 16/03/2012 362840 |  (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
SR - | Auto 10/07/1658 0 |  (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe  =.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 27/02/2012 76960 |  (ZAtheros Wlan Agent) . (.Atheros.) - C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe

~ Services:  Scanned in 00mn 25s



---\\ Scan Additionnel (O88)
Database Version : 13024 - (17/01/2014)
Clés trouvées (Keys found) : 22
Valeurs trouvées (Values found) : 8
Dossiers trouvés  (Folders found) : 7
Fichiers trouvés  (Files found) : 6

[HKLM\Software\Google\Chrome\Extensions\dffhljlmcohcioeilbnpmbchdcbhifdh]   =Toolbar.Conduit^
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RegClean Pro]   =Rogue.RegistryPowerCleaner^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\fst_fr_6_is1]   =Adware.FreeSoftToday^
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]   =PUP.V9Software
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E]   =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6]   =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852]   =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0]   =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA]   =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96]   =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59]   =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC]   =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA]   =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E]   =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF]   =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E]   =Toolbar.Ask
[HKLM\Software\Wow6432Node\Tutorials]   =Spyware.AgenceExclusive
[HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASAPI32]   =Toolbar.Bing
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375]   =PUP.Tarma
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5]   =PUP.Tarma
[HKLM\Software\Classes\SpeedUpMyPC]   =Rogue.SpeedUpMyPC
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CA0054A5AB3EFFE4CB5660E44A1E7DCC]   =Adware.Boxore^
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:fst_fr_50   =PUA.FSTfr9^
C:\Users\Emma\AppData\Local\Google\Chrome\User Data\Default\Extensions\dffhljlmcohcioeilbnpmbchdcbhifdh   =Toolbar.Conduit^
C:\Program Files (x86)\fst_fr_6   =PUA.FSTfr9^
C:\Program Files (x86)\MyPC Backup   =PUP.MyPCBackup^
C:\ProgramData\InstallMate   =PUP.Tarma^
C:\ProgramData\WPM   =PUP.WpManager^
C:\Users\Emma\AppData\Local\fst_fr_6   =PUA.FSTfr9^
C:\Users\Emma\AppData\Local\Software   =Adware.Boxore
[HKCU\Software\TutoTag]   =Spyware.AgenceExclusive^
[HKCU\Software\WEDLMNGR]   =PUP.weDownloadManager^
[HKCU\Software\weDownload]   =PUP.weDownloadManager^
[HKLM\Software\DomaIQ]   =Adware.DomaIQ^
[HKLM\Software\Wow6432Node\supWPM]   =PUP.WpManager^
C:\Users\Emma\AppData\Local\Temp\TsuAD327CD8.dll   =PUP.Tarma^
~ Additionnel Scan: 266608 Items scanned in 01mn 17s



---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com/apps/blo ... ar-conduit   =Toolbar.Conduit
~ http://nicolascoolman.webs.com/apps/blo ... nationzoom    =Hijacker.NationZoom
~ http://nicolascoolman.webs.com/apps/blo ... wercleaner   =Rogue.RegistryPowerCleaner
~ http://nicolascoolman.webs.com/apps/blo ... pua-fstfr9    =PUA.FSTfr9
~ http://nicolascoolman.webs.com/apps/blo ... e-lollipop   =Adware.Lollipop
~ http://nicolascoolman.webs.com/apps/blo ... esofttoday   =Adware.FreeSoftToday
~ http://nicolascoolman.webs.com/apps/blo ... eexclusive   =Spyware.AgenceExclusive
~ http://nicolascoolman.webs.com/apps/blo ... oadmanager   =PUP.weDownloadManager
~ http://nicolascoolman.webs.com/apps/blo ... are-domaiq   =Adware.DomaIQ
~ http://nicolascoolman.webs.com/apps/blo ... -wpmanager   =PUP.WpManager
~ http://nicolascoolman.webs.com/apps/blo ... mypcbackup   =PUP.MyPCBackup
~ http://nicolascoolman.webs.com/apps/blo ... lbar-tarma   =PUP.Tarma
~ http://nicolascoolman.webs.com/apps/blo ... oolbar-ask   =Toolbar.Ask
~ http://nicolascoolman.webs.com/apps/blo ... fesecurity   =PUP.eSafeSecurity
~ http://nicolascoolman.webs.com/apps/blo ... v9software   =PUP.V9Software
~ http://nicolascoolman.webs.com/apps/blo ... peedupmypc   =Rogue.SpeedUpMyPC
~ http://nicolascoolman.webs.com/apps/blo ... are-boxore  =Adware.Boxore
~ MSI: 17 link(s) detected in 01mn 18s



~ 1343 Legitimates filtered by white list
End of the scan (526 lines in 02mn 47s)(0)

[2011N2]

Bonsoir,



Passe AdwCleaner et poste le rapport : http://www.forum-entraide-informatique. ... -de-xplode

Puis passe SFTGC et poste le rapport hébergé : http://www.forum-entraide-informatique. ... c-tutoriel

Gabriel.

[EVALIA5776]

coucou Gabriel,

merci pour ta réactivité, je suis un peu nulle en ce qui concerne les forums alors je te copie colle le bilan ADWCLEANER:

# AdwCleaner v3.017 - Rapport créé le 23/01/2014 à 18:28:56
# Mis à jour le 12/01/2014 par Xplode
# Système d'exploitation : Windows 7 Home Premium Service Pack 1 (64 bits)
# Nom d'utilisateur : Emma - EMMA-PC
# Exécuté depuis : C:\Users\Emma\Downloads\adwcleaner (1).exe
# Option : Scanner

***** [ Services ] *****


***** [ Fichiers / Dossiers ] *****

Dossier Présent C:\Program Files (x86)\Bench
Dossier Présent C:\Program Files (x86)\fst_fr_6
Dossier Présent C:\Program Files (x86)\Mobogenie
Dossier Présent C:\Program Files (x86)\MyPC Backup
Dossier Présent C:\ProgramData\WPM
Dossier Présent C:\Users\Emma\AppData\Local\fst_fr_6
Dossier Présent C:\Users\Emma\AppData\Local\genienext
Dossier Présent C:\Users\Emma\AppData\Local\Mobogenie
Dossier Présent C:\Users\Emma\AppData\LocalLow\FoxTab
Dossier Présent C:\Users\Emma\AppData\Roaming\Systweak
Dossier Présent C:\Users\Emma\Documents\Mobogenie
Fichier Présent : C:\Users\Emma\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx
Fichier Présent : C:\Users\Emma\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.delta-search.com_0.localstorage
Fichier Présent : C:\Users\Emma\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.delta-search.com_0.localstorage-journal
Fichier Présent : C:\Users\Emma\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.wajam.com_0.localstorage
Fichier Présent : C:\Users\Emma\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.wajam.com_0.localstorage-journal
Fichier Présent : C:\Users\Public\Desktop\RegClean Pro.lnk
Fichier Présent : C:\Windows\System32\roboot64.exe
Fichier Présent : C:\Windows\System32\Tasks\RegClean Pro

***** [ Raccourcis ] *****

Raccourci Présent : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk ( hxxp://www.nationzoom.com/?type=scts=139033771 ... 3006730067 )
Raccourci Présent : C:\Users\Emma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk ( hxxp://www.nationzoom.com/?type=scts=139033771 ... 3006730067 )
Raccourci Présent : C:\Users\Emma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk ( hxxp://www.nationzoom.com/?type=scts=139033771 ... 3006730067 )
Raccourci Présent : C:\Users\Emma\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk ( hxxp://www.nationzoom.com/?type=scts=139033771 ... 3006730067 )
Raccourci Présent : C:\Users\Emma\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk ( hxxp://www.nationzoom.com/?type=scts=139033771 ... 3006730067 )
Raccourci Présent : C:\Users\Emma\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk ( hxxp://www.nationzoom.com/?type=scts=139033771 ... 3006730067 )
Raccourci Présent : C:\Users\Emma\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk ( hxxp://www.nationzoom.com/?type=scts=139033771 ... 3006730067 )

***** [ Registre ] *****

Clé Présente : HKCU\Software\systweak
Clé Présente : HKCU\Software\TutoTag
Clé Présente : HKCU\Software\WEDLMNGR
Clé Présente : HKCU\Software\weDownload
Clé Présente : [x64] HKCU\Software\systweak
Clé Présente : [x64] HKCU\Software\TutoTag
Clé Présente : [x64] HKCU\Software\WEDLMNGR
Clé Présente : [x64] HKCU\Software\weDownload
Clé Présente : HKLM\Software\Bench
Clé Présente : HKLM\SOFTWARE\Classes\*\shell\filescout
Clé Présente : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{AF175732-0D59-716D-F757-9F1492D808D9}
Clé Présente : HKLM\SOFTWARE\Classes\speedupmypc
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\zulagames
Clé Présente : HKLM\Software\supWPM
Clé Présente : HKLM\Software\systweak
Clé Présente : HKLM\Software\Tutorials
Clé Présente : HKLM\Software\Uniblue
Clé Présente : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Clé Présente : [x64] HKLM\SOFTWARE\DomaIQ
Clé Présente : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Donnée Présente : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command [(Default)] - "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" hxxp://www.nationzoom.com/?type=scts=139033771 ... 3006730067
Valeur Présente : HKCU\Software\Mozilla\Firefox\Extensions [speedanalysis03@SpeedAnalysis.com]
Valeur Présente : HKCU\Software\Mozilla\Firefox\Extensions [zulagames@ZulaGames.com]
Valeur Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [mobilegeni daemon]
Valeur Présente : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [speedanalysis03@SpeedAnalysis.com]
Valeur Présente : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [zulagames@ZulaGames.com]

***** [ Navigateurs ] *****

-\\ Internet Explorer v11.0.9600.16428

Paramètre Présent : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.nationzoom.com/?type=hpts=139033771 ... 3006730067
Paramètre Présent : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL] - hxxp://www.nationzoom.com/web/?type=dsts=13903 ... earchTerms}
Paramètre Présent : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.nationzoom.com/?type=hpts=139033771 ... 3006730067
Paramètre Présent : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.nationzoom.com/web/?type=dsts=13903 ... earchTerms}

-\\ Google Chrome v32.0.1700.76

[ Fichier : C:\Users\Emma\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [29777 octets] - [25/10/2013 13:47:28]
AdwCleaner[R1].txt - [1133 octets] - [25/10/2013 15:37:02]
AdwCleaner[R2].txt - [6718 octets] - [23/01/2014 18:28:56]
AdwCleaner[S0].txt - [25920 octets] - [25/10/2013 13:48:38]
AdwCleaner[S1].txt - [1152 octets] - [25/10/2013 15:38:42]

########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [6899 octets] ##########

[2011N2]

Bonsoir,

Pas de problème.

Passe AdwCleaner en mode Nettoyer et poste le rapport.

Gabriel.

[EVALIA5776]

Je te remercie, il est éradiqué   

1000000000000000000 merciS      

[2011N2]

Salut,

Super.

Il y a probablement des restes, ne souhaites-tu pas continuer la désinfection ?

Gabriel.

[Dori@n]

Où en-est votre problème ?

Deux solutions,

• Votre problème est résolu, dans ce cas pensez à nous en faire part.
• Votre problème est toujours d'actualité, merci de nous renseigner sur ce qui ne va pas, et donner des nouvelles régulièrement.
  
  
  À bientôt sur FEI !

[WARRIORXAV]

Bonjour,

Nous n'avons plus de nouvelle de l'auteur de ce sujet depuis plus de 10 jours. Nous considérons donc ce problème comme résolu ou abandonné par son auteur. La prochaine fois, merci de nous tenir au courant de l'évolution de votre problème, ou à faire un UP régulièrement !

Ce sujet est verrouillé, si vous souhaitez le reprendre, merci de contacter par message privé un membre de l'équipe de modération du forum.

À bientôt sur FEI !