FORUM D’ENTRAIDE INFORMATIQUE (FEI)Site d’assistance et de sécurité informatique

[dav86]

bonjour,j ai un probleme avec ma page d acceuil car depuit au moin deux semaine j ai do searches.com qui s affiche dans ma barre d adresse alors que j avais mis google et je n arrive pas a le supprimer ,j ai essayer beaucoup de choses mais rien ne fonctionne j ai meme reinitialiser firefox,mais rien ni fait j ai fait des scane a tout va ,rien non plus.et la franchement je ne c est plus quoi faire donc si quelqu un pouvait m aider ce serrai vraiment simpas en vous remerciant d avance

[roro04]

Salut !

Nous allons essayer de régler ton problème ensemble. D'abord, quelques rappels :
- N'ouvre pas d'autres sujets pour le même problème (que ce soit sur ce forum ou sur un autre)
- N'hésite pas à poser des questions en cas de besoin :wink:
- Sois patient(e) quand tu postes un message, je ne réponds pas instantanément : je suis bénévole et je ne suis pas en permanence devant mon ordinateur. Mais rassure toi, je ne laisse jamais tomber personne :wink:
- La désinfection (si nécessaire) va se dérouler en plusieurs étapes. Même si les symptômes de l'infection disparaissent, la désinfection ne sera terminée que quand je te le confirmerai -- Merci de revenir jusqu'au bout, sinon ce qu'on a fait n'aura servi à rien.
- Ne télécharge pas n'importe quel programme gratuit sans te renseigner dessus.
- Ne télécharge aucun programme proposé dans des publicités ou sur des sites suspects, préfère les sites connus ou le téléchargement directement sur le site de l'éditeur.
- Lis attentivement lorsque tu installes un programme gratuit, et décoche tous les programmes additionnels qui sont proposés, en particulier les barres d'outils !

On va rechercher si des adwares sont présents sur ton PC

• Télécharge AdwCleaner (de Xplode) sur ton bureau.
• Lance-le (Clique droit/Exécuter en tant qu'administrateur pour Vista/7)
• Clique sur Scanner.
• Patiente le temps du scan.
• Clique sur Nettoyer.
• Patiente quelques instants et accepte le redémarrage du PC.
• Poste le rapport qui apparaît au redémarrage.
• Clique sur Quitter

Ensuite

On va faire un diagnostic de ton pc

• Télécharge ZHPDiag (de Nicolas coolman) sur ton bureau.
• Une fois le téléchargement terminé, double clique sur ZHPDiag.exe et suis les instructions d'installation. (Clique droit/Exécuter en tant qu'administrateur pour Vista/7).
• Coche la case Créer une icône sur le bureau lors de l'installation.
• A la fin de l'installation, lance ZHPDiag.
• Clique sur Configurer.
• Dans les icônes qui apparaissent en bas, clique sur la loupe la plus à droite (Diagnostic avec légitimes)
• Dans la fenêtre qui apparaît demandant un rapport avec full options, clique sur Oui, puis patiente le temps du scan.
• En fin de scan, un rapport s'ouvre. Ferme-le.
• Héberge le rapport ZHPDiag présent sur ton bureau sur Cjoint puis copie/colle le lien fourni dans ta prochaine réponse sur le forum.

@+

[dav86]

# AdwCleaner v3.007 - Rapport créé le 13/10/2013 à 14:43:11
# Mis à jour le 09/10/2013 par Xplode
# Système d'exploitation : Windows 7 Home Premium Service Pack 1 (64 bits)
# Nom d'utilisateur : Alatte - ALATTE-PC
# Exécuté depuis : C:\Users\Alatte\Downloads\adwcleaner(2).exe
# Option : Nettoyer

***** [ Services ] *****


***** [ Fichiers / Dossiers ] *****

Fichier Supprimé : C:\Users\sandrine\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_dnpmlnedpdikbgdghljdepnljfpkhccn_0

***** [ Raccourcis ] *****


***** [ Registre ] *****


***** [ Navigateurs ] *****

-\\ Internet Explorer v10.0.9200.16720


-\\ Mozilla Firefox v24.0 (fr)

[ Fichier : C:\Users\Alatte\AppData\Roaming\Mozilla\Firefox\Profiles\hl5cnu5x.default-1381266156581\prefs.js ]


[ Fichier : C:\Users\sandrine\AppData\Roaming\Mozilla\Firefox\Profiles\89am248y.default\prefs.js ]


-\\ Google Chrome v30.0.1599.69

[ Fichier : C:\Users\Alatte\AppData\Local\Google\Chrome\User Data\Default\preferences ]


[ Fichier : C:\Users\sandrine\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R4].txt - [1303 octets] - [13/10/2013 14:42:03]
AdwCleaner[S3].txt - [1225 octets] - [13/10/2013 14:43:11]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1285 octets] ##########

[roro04]

Tu as excécuté plusieurs fois Adwcleaner. Peux tu me communiquer les rapport AdxCleaner[S1] et Adwcleaner[S2] situés dans C:\AdwCleaner\ ?

[dav86]

et je les est comment car j ai envyer ceux qu il ma mis ,et comme je suis pas tres doue en informatique je c est pas comment faire ,desoler si je t embete

[dav86]

je vient de reverifier mais je ne les est pas ,en plus de ce que je t ai envoyez il y a un fichier backup et quarantaine c est tout ce qu il y a

[dav86]

http://cjoint.com/?CJnqbxJsDSM le lien que tu ma demander le bon car je m etait tromper je l avait mis en priver

[roro04]

Re,

Ok pas grave Ne t'inquiète pas je vais te guider pas à pas.


On va faire un scan généraliste de ton PC

• Télécharges Malwarebytes sur ton bureau.
• Lance le. Laisse les options par défaut lors de l'installation. A la fin, il va se mettre à jour, laisse-le faire.
• Branche toutes tes sources de données externes à ton PC. (Clés USB...)
• Rends-toi dans l'onglet Recherche, clique sur Exécuter un examen complet puis clique sur Rechercher.
• Sélectionnes tes disques durs et disques amovibles puis clique sur Rechercher
• A la fin du scan, un rapport s'ouvre. Clique sur Fichier puis sur Enregistrer sous. Clique sur Bureau et met le nom Malwarebytes.
• Si MalwareBytes détecte des infections, clique sur Afficher les résultats, puis sur Supprimer la sélection.
• Si Malwarebytes te demande de redémarrer ton pc, clique sur Oui.
• Poste le rapport.
  
  !!! Ne pas vider la quarantaine de MBAM sans avis !!!
  
  Tuto pour t'aider Ici

Ensuite refais un ZHPDiag.

@+

[dav86]

Malwarebytes Anti-Malware 1.75.0.1300
http://www.malwarebytes.org

Version de la base de données: v2013.10.14.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16721
Alatte :: ALATTE-PC [administrateur]

14/10/2013 16:25:21
malwarebytes.txt

Type d'examen: Examen complet (C:\|D:\|E:\|F:\|G:\|)
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 391314
Temps écoulé: 1 heure(s), 3 minute(s), 34 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 3
HKLM\SYSTEM\CurrentControlSet\Services\wlcomm32 (Malware.Trace) - Aucune action effectuée.
HKLM\SOFTWARE\dosearchesSoftware (PUP.Optional.DoSearches.A) - Aucune action effectuée.
HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) - Aucune action effectuée.

Valeur(s) du Registre détectée(s): 1
HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) - Données: {8DA18782-522B-11E2-A9B6-90FBA687D251} - Aucune action effectuée.

Elément(s) de données du Registre détecté(s): 4
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.DoSearches) - Mauvais: (http://www.dosearches.com/?utm_source=b ... 1381152335) Bon: (http://www.google.com) - Aucune action effectuée.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Default_Page_URL (PUP.Optional.DoSearches) - Mauvais: (http://www.dosearches.com/?utm_source=b ... 1381152335) Bon: (http://www.google.com) - Aucune action effectuée.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Default_Page_URL (PUP.Optional.DoSearches) - Mauvais: (http://www.dosearches.com/?utm_source=b ... 1381152335) Bon: (http://www.google.com) - Aucune action effectuée.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.DoSearches) - Mauvais: (http://www.dosearches.com/?utm_source=b ... 1381152335) Bon: (http://www.google.com) - Aucune action effectuée.

Dossier(s) détecté(s): 1
C:\Program Files (x86)\Windows Service (Malware.Trace) - Aucune action effectuée.

Fichier(s) détecté(s): 13
C:\Program Files (x86)\RealArcade\Installer\bin\OCSetupHlp.dll (PUP.Optional.OpenCandy) - Aucune action effectuée.
C:\Users\Alatte\Downloads\openoffice setup.exe (PUP.Optional.Soft32.A) - Aucune action effectuée.
C:\Users\Alatte\Downloads\Patch.exe (RiskWare.Tool.HCK) - Aucune action effectuée.
C:\Users\Alatte\Downloads\SoftonicDownloader_pour_avira-free-antivirus-2013.exe (PUP.Optional.Softonic) - Aucune action effectuée.
C:\Users\Alatte\Downloads\SoftonicDownloader_pour_teamspeak.exe (PUP.Optional.Softonic.A) - Aucune action effectuée.
C:\Users\Alatte\Downloads\SoftonicDownloader_pour_unity-web-player.exe (PUP.Optional.Softonic.A) - Aucune action effectuée.
C:\Users\Alatte\Downloads\version_actuelle_du_plugin_unity_player_downloader_98935.exe (PUP.Optional.GoForFiles.A) - Aucune action effectuée.
C:\Users\sandrine\AppData\Local\Temp\8ZK1fdH6.exe.part (PUP.Adware.Domalq) - Aucune action effectuée.
C:\Program Files (x86)\Windows Service\srvctrlver.dat (Malware.Trace) - Aucune action effectuée.
C:\Program Files (x86)\Windows Service\libntkrnldmp.dll (Malware.Trace) - Aucune action effectuée.
C:\Program Files (x86)\Windows Service\mozspfr.xpi (Malware.Trace) - Aucune action effectuée.
C:\Program Files (x86)\Windows Service\service.exe (Malware.Trace) - Aucune action effectuée.
C:\Program Files (x86)\Windows Service\sqlite3.dll (Malware.Trace) - Aucune action effectuée.

(fin)

[dav86]

http://cjoint.com/?CJosioMFLuF voila tout est fait

[roro04]

Salut !

Vide la quarantaine de Malwarebytes

• Copie les lignes en gras ci dessous :
  
  
  G0 - GCSP: Preference [User Data\Default] http://www.do = Hijacker.wwwDo
  G2 - GCE: Preference [User Data\Default] [injgpjnjaabcegnbloghlbboneidnjjl] Chrome Service Pack v.3.0.0, (Désactivé) =PUP.ChromeServicePack
  G2 - GCE: Preference [User Data\Default] [jcdgjdiieiljkfkdcloehkohchhpekkn] SweetIM for Facebook v.1.2.0.0 (Désactivé) =PUP.SweetIM
  R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.do = Hijacker.wwwDo
  R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.do = Hijacker.wwwDo
  R0 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.do = Hijacker.wwwDo
  R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.do = Hijacker.wwwDo
  OPT:O4 - GS\Desktop [Public]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.do =Hijacker.wwwDo
  OPT:O4 - GS\Desktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe http://www.do =Hijacker.wwwDo
  OPT:O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe http://www.do =Hijacker.wwwDo
  OPT:O4 - GS\QuickLaunch [Alatte]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.do =Hijacker.wwwDo
  OPT:O4 - GS\QuickLaunch [Alatte]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe http://www.do =Hijacker.wwwDo
  OPT:O4 - GS\TaskBar [Alatte]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe http://www.do =Hijacker.wwwDo
  OPT:O4 - GS\Program [Alatte]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe http://www.do =Hijacker.wwwDo
  OPT:O4 - GS\SystemTools [Alatte]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe http://www.do =Hijacker.wwwDo
  OPT:O4 - GS\Desktop [Alatte]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe http://www.do =Hijacker.wwwDo
  [HKCU\Software\WEDLMNGR] =PUP.weDownloadManager
  [HKLM\Software\Wow6432Node\SweetIM] =PUP.SweetIM
  [HKLM\Software\Wow6432Node\Trymedia Systems] =Adware.Trymedia
  [HKLM\Software\Wow6432Node\dosearchesSoftware] =PUP.DoSearches
  O43 - CFD: 02/01/2013 - 13:59:13 - [0] ----D C:\ProgramData\Software = Infection PUP (Adware.Boxore)
  O43 - CFD: 30/12/2012 - 04:49:24 - [0] ----D C:\Users\Alatte\AppData\Local\Software = Infection PUP (Adware.Boxore)
  O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- searches.com\?utm_source=butm_medium=s32utm_campaign=eXQutm_content=scfrom=s32uid=WDCXWD10EARS-22Y5B1_WD-WCAV5A19477494774ts=1381152335 C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" http://www.do = Hijacker.wwwDo*
  O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- searches.com\?utm_source=butm_medium=s32utm_campaign=eXQutm_content=scfrom=s32uid=WDCXWD10EARS-22Y5B1_WD-WCAV5A19477494774ts=1381152335 C:\Program Files\Internet Explorer\iexplore.exe http://www.do =Hijacker.wwwDo
  [MD5.EB3AF094342327FAE3EF5C615CE2A656] [SPRF][30/08/2012] (.Unity Technologies ApS - Unity Web Player Installer.) -- C:\Users\Alatte\Desktop\UnityWebPlayer.exe [3249480] =Adware.SocialSkinz
  [HKLM\Software\Google\Chrome\Extensions\injgpjnjaabcegnbloghlbboneidnjjl] =PUP.ChromeServicePack^
  [HKLM\Software\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn] =PUP.SweetIM^
  [HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110011501160}] =PUP.SpecialSavings
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9] =Adware.MyWebSearch
  [HKLM\Software\Wow6432Node\SweetIM] =PUP.SweetIM
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375] =PUP.Tarma
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5] =PUP.Tarma
  [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0CC09160-108C-4759-BAB1-5C12C216E005}] =PUP.AppBario
  [HKLM\Software\Classes\CLSID\{11111111-1111-1111-1111-110011501160}] =PUP.CrossRider
  [HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220022502260}] =PUP.CrossRider
  [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011501160}] =PUP.CrossRider
  [HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011501160}] =PUP.CrossRider
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CA0054A5AB3EFFE4CB5660E44A1E7DCC] =Adware.Boxore^
  C:\ProgramData\Software =Adware.Boxore
  C:\Users\Alatte\AppData\Local\Software =Adware.Boxore
  C:\Users\Alatte\AppData\Local\Google\Chrome\User Data\Default\Extensions\injgpjnjaabcegnbloghlbboneidnjjl =PUP.ChromeServicePack^
  C:\Users\Alatte\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn =PUP.SweetIM^
  [HKCU\Software\WEDLMNGR] =PUP.weDownloadManager^
  [HKLM\Software\Wow6432Node\Trymedia Systems] =Adware.Trymedia^
  [HKLM\Software\Wow6432Node\dosearchesSoftware] =PUP.DoSearches^
  C:\Users\Alatte\Desktop\UnityWebPlayer.exe =Adware.SocialSkinz^
  O4 - GS\Accessories [sandrine]: Run.lnk - Clé orpheline = Orphean Key not necessary
  O4 - GS\Accessories [Alatte]: Run.lnk - Clé orpheline = Orphean Key not necessary
  [MD5.00000000000000000000000000000000] [APT] [{0BCA32E6-2394-4D1D-BD75-A5832D77DF2C}] (...) -- C:\Program Files (x86)\Codemasters\Soldiers - Heroes of World War II\Soldiers.exe (.not file.) [0] = Fichier absent
  [MD5.00000000000000000000000000000000] [APT] [{1DDE2A7B-810B-4866-975C-69BB1BAEF8F5}] (...) -- C:\Program Files (x86)\Eidos Interactive\Elixir Studios\Republic\Main\Republic\exe\Republic.exe (.not file.) [0] = Fichier absent
  [MD5.00000000000000000000000000000000] [APT] [{2E6AD472-6CBF-4DD8-839D-B73EAD4B7D4C}] (...) -- E:\gameInst.exe (.not file.) [0] = Fichier absent
  [MD5.00000000000000000000000000000000] [APT] [{3CA39778-A89D-4FD7-AB92-7D51833A801C}] (...) -- E:\AcroSetup.exe (.not file.) [0] = Fichier absent
  [MD5.00000000000000000000000000000000] [APT] [{761F9B3F-1ADC-45D2-ABB2-393C083C7069}] (...) -- C:\Users\Alatte\Downloads\msert(1).exe (.not file.) [0] = Fichier absent
  [MD5.00000000000000000000000000000000] [APT] [{8BB9E53E-A44C-4AA6-B86E-FD8E47C9D9BF}] (...) -- C:\Program Files (x86)\L'Amerzone\Amerzone.exe (.not file.) [0] = Fichier absent
  [MD5.00000000000000000000000000000000] [APT] [{DC230E34-B4C0-4AF5-9A65-B39A582A7B1D}] (...) -- C:\Program Files (x86)\L'Amerzone\Amerzone.exe (.not file.) [0] = Fichier absent
  [MD5.00000000000000000000000000000000] [APT] [{E1D00926-682D-42A6-8BEC-A8F42290DA71}] (...) -- C:\Program Files (x86)\Xfire\uninst.exe (.not file.) [0] = Fichier absent
  OPT:O4 - GS\TaskBar [sandrine]: Choix de navigateur .lnk . (.Microsoft Corporation - Choix de navigateur .) -- C:\Windows\System32\browserchoice.exe
  O45 - LFCP:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 05/10/2142 - 11:02:31 ----D - C:\Windows\Prefetch\ReadyBoot = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.F76AAA96F9C99572342601AD48F79B93] - 08/10/2013 - 19:03:33 ---A- - C:\Windows\Prefetch\AgCx_S1_S-1-5-21-337464992-296471290-3356353711-1000.snp.db = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.FB188E52125981B6D5592857200E82AC] - 08/10/2013 - 19:25:54 ---A- - C:\Windows\Prefetch\AgCx_SC3_E4CCDB21E4290A9F.db = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.74F86A5CEB81F85A77C5FE5EB0375DFC] - 13/10/2013 - 09:23:17 ---A- - C:\Windows\Prefetch\QUARANTINE.EXE-68987195.pf = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.182A86410B779E2E9EEB42484DFF009F] - 13/10/2013 - 09:26:28 ---A- - C:\Windows\Prefetch\SETUP.EXE-CE57E542.pf = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.A19B4EC6713E907F2A851DBD29E8EC89] - 13/10/2013 - 09:41:26 ---A- - C:\Windows\Prefetch\SUITETRAY.EXE-42757614.pf = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.1041FC7397BBD4C3F3F3B9EBA39D7345] - 13/10/2013 - 09:51:36 ---A- - C:\Windows\Prefetch\OVERWOLFHELPER.EXE-5557486E.pf = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.508D61A1C9771BB0A4FA664C81163F71] - 13/10/2013 - 09:51:44 ---A- - C:\Windows\Prefetch\OVERWOLFHELPER64.EXE-A55C3070.pf = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.5B80DE278763BF94AB6C0D0ED6047041] - 13/10/2013 - 13:45:39 ---A- - C:\Windows\Prefetch\NTOSBOOT-B00DFAAD.pf = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.E3E51F164AA9E073F036AFDF4D03CEB0] - 13/10/2013 - 14:45:04 ---A- - C:\Windows\Prefetch\FILESHREDDER.EXE-86BD4296.pf = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.3B0DC4DAC0D9C6EB26E6FF00C399E405] - 14/10/2013 - 03:16:02 ---A- - C:\Windows\Prefetch\UPDATE.EXE-5CF8B53B.pf = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.9A1D5B512F476F781F4472FC021FD67B] - 14/10/2013 - 14:28:37 ---A- - C:\Windows\Prefetch\JABSWITCH.EXE-5312D480.pf = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.0CD7D88CEFE5F6DD0170246F7A62BCA8] - 14/10/2013 - 16:36:15 ---A- - C:\Windows\Prefetch\AgGlUAD_P_S-1-5-21-337464992-296471290-3356353711-1000.db = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.3871E46AEB97137827FCF6AD71C336C7] - 14/10/2013 - 16:36:15 ---A- - C:\Windows\Prefetch\AgGlUAD_S-1-5-21-337464992-296471290-3356353711-1000.db = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.302C3E5E690D405E556562189649F120] - 14/10/2013 - 16:40:17 ---A- - C:\Windows\Prefetch\EGISUPDATE.EXE-AB9B9CA5.pf = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.66DA795D3A4BC0AD07BE328B51107A1C] - 14/10/2013 - 16:40:22 ---A- - C:\Windows\Prefetch\PMMUPDATE.EXE-7508F507.pf = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.BE1D41A755E495E4A385CAB9BFEB1A53] - 14/10/2013 - 16:40:24 ---A- - C:\Windows\Prefetch\ARCADEMOVIESERVICE.EXE-A8FA7CD9.pf = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.E9A34AAA8E6C99B1F89048F894B0DD85] - 14/10/2013 - 16:40:26 ---A- - C:\Windows\Prefetch\HOTKEYUI.EXE-916B6E7B.pf = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.24E60AFEF27CD0EC1972DF85933BED48] - 14/10/2013 - 16:41:37 ---A- - C:\Windows\Prefetch\FLASHPLAYERPLUGIN_11_9_900_11-0DC817F6.pf = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.5BA3EE9AD1074EA18D2690D9B932581F] - 21/09/2013 - 21:22:38 ---A- - C:\Windows\Prefetch\AgGlUAD_P_S-1-5-21-337464992-296471290-3356353711-1001.db = Fichier du dossier Prefetcher
  O45 - LFCP:[MD5.6204E28F16A7C26F35952BF58197AD8E] - 21/09/2013 - 21:22:38 ---A- - C:\Windows\Prefetch\AgGlUAD_S-1-5-21-337464992-296471290-3356353711-1001.db = Fichier du dossier Prefetcher
  O61 - LFC: 13/10/2013 - 17:47:08 ---A- . (...) -- C:\Users\Alatte\AppData\Local\Temp\UnityWebPlayer\log\log_015545752a3204429955d4c0f8292644.txt [26674] = Temporary file not necessary
  O61 - LFC: 13/10/2013 - 17:47:08 ---A- . (...) -- C:\Users\Alatte\AppData\Local\Temp\UnityWebPlayer\log\log_3f72460a197bbe4ab91948ce22d15ec6.txt [17187] = Temporary file not necessary
  O61 - LFC: 13/10/2013 - 17:47:08 ---A- . (...) -- C:\Users\Alatte\AppData\Local\Temp\UnityWebPlayer\log\manager_5e508140dd4e494990a3b020873a2496.txt [135] = Temporary file not necessary
  O61 - LFC: 13/10/2013 - 17:47:08 ---A- . (...) -- C:\Users\Alatte\AppData\Local\Temp\UnityWebPlayer\log\manager_6a5e22c4925f7f48b24469fb00b48521.txt [135] = Temporary file not necessary
  O61 - LFC: 13/10/2013 - 17:47:08 ---A- . (...) -- C:\Users\Alatte\AppData\Local\Temp\preferences [0] = Temporary file not necessary
  O61 - LFC: 14/10/2013 - 17:47:08 ---A- . (...) -- C:\Users\Alatte\AppData\Local\Temp\~DF875908F554248B1E.TMP [376832] = Temporary file not necessary
  R0 - HKCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.chatzum.com = Toolbar.ChatZum
  O2 - BHO: Google Toolbar Helper [64Bits] - {AA58ED58-01DD-4d91-8333-CF10577473F7} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll =Toolbar.Google
  O3 - Toolbar: Google Toolbar [64Bits] - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll =Toolbar.Google
  O3 - Toolbar\WebBrowser: (no name) [64Bits] - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline = Toolbar.Google
  O42 - Logiciel: Google Toolbar for Internet Explorer - (.Google Inc..) [HKLM][64Bits] -- {18455581-E099-4BA8-BC6B-F34B2F06600C} =Toolbar.Google
  O42 - Logiciel: Google Toolbar for Internet Explorer - (.Google Inc..) [HKLM][64Bits] -- {2318C2B1-4965-11d4-9B18-009027A5CD4F} =Toolbar.Google
  [HKCU\Software\APN] = Toolbar.Ask
  [HKCU\Software\Rencontres Hard] = Toolbar.RencontresHard
  [HKLM\Software\Wow6432Node\APN] = Toolbar.Ask
  [HKLM\Software\Wow6432Node\VBMZ] = Toolbar.Conduit
  [MD5.0235566E5134C79D5D40C1397220AC4E] [WIS][07/11/2012] (.Google Inc. - Google Toolbar for Internet Explorer.) -- C:\Windows\Installer\3c862.msi [28160] =Toolbar.Google
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4D91-8333-CF10577473F7}] =Toolbar.Google^
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{18455581-E099-4BA8-BC6B-F34B2F06600C}] =Toolbar.Google^
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}] =Toolbar.Google^
  [HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}] =Toolbar.Ask
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7] =Toolbar.Ask
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8] =Toolbar.Ask
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01] =Toolbar.Ask
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED] =Toolbar.Ask
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF] =Toolbar.AVGSearch
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472] =Toolbar.Ask
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296] =Toolbar.Ask
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888] =Toolbar.Ask
  [HKCU\Software\APN] =Toolbar.Ask
  [HKLM\Software\Wow6432Node\APN] =Toolbar.Ask
  [HKCU\Software\Rencontres Hard] =Toolbar.RencontresHard
  [HKLM\Software\Wow6432Node\VBMZ] =Toolbar.Conduit
  [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2] =Toolbar.Ask
  [HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{2318C2B1-4965-11d4-9B18-009027A5CD4F} =Toolbar.Google^
  C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll =Toolbar.Google^
  C:\Windows\Installer\3c862.msi =Toolbar.Google^
  
• Ouvre ZHPfix, icone seringue (Vista/7/8 : "Exécuter en tant qu'administrateur").
• Colle les lignes helpers si elles ne sont déjà présentes. Pour ce, clique sur Importer.
• Clique sur Go.
• Clique sur Oui pour confirmer le nettoyage des données et pour celui de la corbeille.
• Copie le rapport, et colle-le dans la prochaine réponse sur le forum.

P.S. Si le bureau disparaît, fais Ctrl + Alt + Suppr afin d'ouvrir le gestionnaire des tâches puis dans Applications, clique sur Nouvelle tâche puis tape explorer.exe. Le bureau devrait normalement réapparaître.

/!\ Attention, ta corbeille va être vidée. Vérifie qu'il n'y ait aucun fichier supprimé par mégarde à l'intérieur. /!\

Ensuite refais un ZHPDiag.

Bonne soirée,
@+

[dav86]

salut, j ai ouvert zhpfixe j y est coller les ligne en gras mais quand je clic sur ok il m ouvre une fenetre

excemple:
script ZHPfixe (ligne obligatoire)
c:\program files\magnipic
[HKEY-CURRENT-USER\software\magnipic]
[HKEY-USERS\s-1-5-18\control magnipic]
[HKCU\software\magnipic]

et quand je la referme ca reste comme c est et il ce passe plus rien je doit faire quoi,j ai bien vider la quarantaine avant ,a part go il y a retour au menu general ou effacer le script

[roro04]

Salut !

Désolé erreur de ma part, met ce script :

Script ZHPFix
G0 - GCSP: Preference [User Data\Default] http://www.do = Hijacker.wwwDo
G2 - GCE: Preference [User Data\Default] [injgpjnjaabcegnbloghlbboneidnjjl] Chrome Service Pack v.3.0.0, (Désactivé) =PUP.ChromeServicePack
G2 - GCE: Preference [User Data\Default] [jcdgjdiieiljkfkdcloehkohchhpekkn] SweetIM for Facebook v.1.2.0.0 (Désactivé) =PUP.SweetIM
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.do = Hijacker.wwwDo
R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.do = Hijacker.wwwDo
R0 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.do = Hijacker.wwwDo
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.do = Hijacker.wwwDo
OPT:O4 - GS\Desktop [Public]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.do =Hijacker.wwwDo
OPT:O4 - GS\Desktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe http://www.do =Hijacker.wwwDo
OPT:O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe http://www.do =Hijacker.wwwDo
OPT:O4 - GS\QuickLaunch [Alatte]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.do =Hijacker.wwwDo
OPT:O4 - GS\QuickLaunch [Alatte]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe http://www.do =Hijacker.wwwDo
OPT:O4 - GS\TaskBar [Alatte]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe http://www.do =Hijacker.wwwDo
OPT:O4 - GS\Program [Alatte]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe http://www.do =Hijacker.wwwDo
OPT:O4 - GS\SystemTools [Alatte]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe http://www.do =Hijacker.wwwDo
OPT:O4 - GS\Desktop [Alatte]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe http://www.do =Hijacker.wwwDo
[HKCU\Software\WEDLMNGR] =PUP.weDownloadManager
[HKLM\Software\Wow6432Node\SweetIM] =PUP.SweetIM
[HKLM\Software\Wow6432Node\Trymedia Systems] =Adware.Trymedia
[HKLM\Software\Wow6432Node\dosearchesSoftware] =PUP.DoSearches
O43 - CFD: 02/01/2013 - 13:59:13 - [0] ----D C:\ProgramData\Software = Infection PUP (Adware.Boxore)
O43 - CFD: 30/12/2012 - 04:49:24 - [0] ----D C:\Users\Alatte\AppData\Local\Software = Infection PUP (Adware.Boxore)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- searches.com\?utm_source=butm_medium=s32utm_campaign=eXQutm_content=scfrom=s32uid=WDCXWD10EARS-22Y5B1_WD-WCAV5A19477494774ts=1381152335 C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" http://www.do = Hijacker.wwwDo*
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- searches.com\?utm_source=butm_medium=s32utm_campaign=eXQutm_content=scfrom=s32uid=WDCXWD10EARS-22Y5B1_WD-WCAV5A19477494774ts=1381152335 C:\Program Files\Internet Explorer\iexplore.exe http://www.do =Hijacker.wwwDo
[MD5.EB3AF094342327FAE3EF5C615CE2A656] [SPRF][30/08/2012] (.Unity Technologies ApS - Unity Web Player Installer.) -- C:\Users\Alatte\Desktop\UnityWebPlayer.exe [3249480] =Adware.SocialSkinz
[HKLM\Software\Google\Chrome\Extensions\injgpjnjaabcegnbloghlbboneidnjjl] =PUP.ChromeServicePack^
[HKLM\Software\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn] =PUP.SweetIM^
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110011501160}] =PUP.SpecialSavings
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9] =Adware.MyWebSearch
[HKLM\Software\Wow6432Node\SweetIM] =PUP.SweetIM
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375] =PUP.Tarma
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5] =PUP.Tarma
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0CC09160-108C-4759-BAB1-5C12C216E005}] =PUP.AppBario
[HKLM\Software\Classes\CLSID\{11111111-1111-1111-1111-110011501160}] =PUP.CrossRider
[HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220022502260}] =PUP.CrossRider
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011501160}] =PUP.CrossRider
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011501160}] =PUP.CrossRider
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CA0054A5AB3EFFE4CB5660E44A1E7DCC] =Adware.Boxore^
C:\ProgramData\Software =Adware.Boxore
C:\Users\Alatte\AppData\Local\Software =Adware.Boxore
C:\Users\Alatte\AppData\Local\Google\Chrome\User Data\Default\Extensions\injgpjnjaabcegnbloghlbboneidnjjl =PUP.ChromeServicePack^
C:\Users\Alatte\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn =PUP.SweetIM^
[HKCU\Software\WEDLMNGR] =PUP.weDownloadManager^
[HKLM\Software\Wow6432Node\Trymedia Systems] =Adware.Trymedia^
[HKLM\Software\Wow6432Node\dosearchesSoftware] =PUP.DoSearches^
C:\Users\Alatte\Desktop\UnityWebPlayer.exe =Adware.SocialSkinz^
O4 - GS\Accessories [sandrine]: Run.lnk - Clé orpheline = Orphean Key not necessary
O4 - GS\Accessories [Alatte]: Run.lnk - Clé orpheline = Orphean Key not necessary
[MD5.00000000000000000000000000000000] [APT] [{0BCA32E6-2394-4D1D-BD75-A5832D77DF2C}] (...) -- C:\Program Files (x86)\Codemasters\Soldiers - Heroes of World War II\Soldiers.exe (.not file.) [0] = Fichier absent
[MD5.00000000000000000000000000000000] [APT] [{1DDE2A7B-810B-4866-975C-69BB1BAEF8F5}] (...) -- C:\Program Files (x86)\Eidos Interactive\Elixir Studios\Republic\Main\Republic\exe\Republic.exe (.not file.) [0] = Fichier absent
[MD5.00000000000000000000000000000000] [APT] [{2E6AD472-6CBF-4DD8-839D-B73EAD4B7D4C}] (...) -- E:\gameInst.exe (.not file.) [0] = Fichier absent
[MD5.00000000000000000000000000000000] [APT] [{3CA39778-A89D-4FD7-AB92-7D51833A801C}] (...) -- E:\AcroSetup.exe (.not file.) [0] = Fichier absent
[MD5.00000000000000000000000000000000] [APT] [{761F9B3F-1ADC-45D2-ABB2-393C083C7069}] (...) -- C:\Users\Alatte\Downloads\msert(1).exe (.not file.) [0] = Fichier absent
[MD5.00000000000000000000000000000000] [APT] [{8BB9E53E-A44C-4AA6-B86E-FD8E47C9D9BF}] (...) -- C:\Program Files (x86)\L'Amerzone\Amerzone.exe (.not file.) [0] = Fichier absent
[MD5.00000000000000000000000000000000] [APT] [{DC230E34-B4C0-4AF5-9A65-B39A582A7B1D}] (...) -- C:\Program Files (x86)\L'Amerzone\Amerzone.exe (.not file.) [0] = Fichier absent
[MD5.00000000000000000000000000000000] [APT] [{E1D00926-682D-42A6-8BEC-A8F42290DA71}] (...) -- C:\Program Files (x86)\Xfire\uninst.exe (.not file.) [0] = Fichier absent
OPT:O4 - GS\TaskBar [sandrine]: Choix de navigateur .lnk . (.Microsoft Corporation - Choix de navigateur .) -- C:\Windows\System32\browserchoice.exe
O45 - LFCP:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 05/10/2142 - 11:02:31 ----D - C:\Windows\Prefetch\ReadyBoot = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.F76AAA96F9C99572342601AD48F79B93] - 08/10/2013 - 19:03:33 ---A- - C:\Windows\Prefetch\AgCx_S1_S-1-5-21-337464992-296471290-3356353711-1000.snp.db = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.FB188E52125981B6D5592857200E82AC] - 08/10/2013 - 19:25:54 ---A- - C:\Windows\Prefetch\AgCx_SC3_E4CCDB21E4290A9F.db = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.74F86A5CEB81F85A77C5FE5EB0375DFC] - 13/10/2013 - 09:23:17 ---A- - C:\Windows\Prefetch\QUARANTINE.EXE-68987195.pf = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.182A86410B779E2E9EEB42484DFF009F] - 13/10/2013 - 09:26:28 ---A- - C:\Windows\Prefetch\SETUP.EXE-CE57E542.pf = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.A19B4EC6713E907F2A851DBD29E8EC89] - 13/10/2013 - 09:41:26 ---A- - C:\Windows\Prefetch\SUITETRAY.EXE-42757614.pf = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.1041FC7397BBD4C3F3F3B9EBA39D7345] - 13/10/2013 - 09:51:36 ---A- - C:\Windows\Prefetch\OVERWOLFHELPER.EXE-5557486E.pf = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.508D61A1C9771BB0A4FA664C81163F71] - 13/10/2013 - 09:51:44 ---A- - C:\Windows\Prefetch\OVERWOLFHELPER64.EXE-A55C3070.pf = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.5B80DE278763BF94AB6C0D0ED6047041] - 13/10/2013 - 13:45:39 ---A- - C:\Windows\Prefetch\NTOSBOOT-B00DFAAD.pf = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.E3E51F164AA9E073F036AFDF4D03CEB0] - 13/10/2013 - 14:45:04 ---A- - C:\Windows\Prefetch\FILESHREDDER.EXE-86BD4296.pf = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.3B0DC4DAC0D9C6EB26E6FF00C399E405] - 14/10/2013 - 03:16:02 ---A- - C:\Windows\Prefetch\UPDATE.EXE-5CF8B53B.pf = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.9A1D5B512F476F781F4472FC021FD67B] - 14/10/2013 - 14:28:37 ---A- - C:\Windows\Prefetch\JABSWITCH.EXE-5312D480.pf = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.0CD7D88CEFE5F6DD0170246F7A62BCA8] - 14/10/2013 - 16:36:15 ---A- - C:\Windows\Prefetch\AgGlUAD_P_S-1-5-21-337464992-296471290-3356353711-1000.db = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.3871E46AEB97137827FCF6AD71C336C7] - 14/10/2013 - 16:36:15 ---A- - C:\Windows\Prefetch\AgGlUAD_S-1-5-21-337464992-296471290-3356353711-1000.db = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.302C3E5E690D405E556562189649F120] - 14/10/2013 - 16:40:17 ---A- - C:\Windows\Prefetch\EGISUPDATE.EXE-AB9B9CA5.pf = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.66DA795D3A4BC0AD07BE328B51107A1C] - 14/10/2013 - 16:40:22 ---A- - C:\Windows\Prefetch\PMMUPDATE.EXE-7508F507.pf = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.BE1D41A755E495E4A385CAB9BFEB1A53] - 14/10/2013 - 16:40:24 ---A- - C:\Windows\Prefetch\ARCADEMOVIESERVICE.EXE-A8FA7CD9.pf = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.E9A34AAA8E6C99B1F89048F894B0DD85] - 14/10/2013 - 16:40:26 ---A- - C:\Windows\Prefetch\HOTKEYUI.EXE-916B6E7B.pf = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.24E60AFEF27CD0EC1972DF85933BED48] - 14/10/2013 - 16:41:37 ---A- - C:\Windows\Prefetch\FLASHPLAYERPLUGIN_11_9_900_11-0DC817F6.pf = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.5BA3EE9AD1074EA18D2690D9B932581F] - 21/09/2013 - 21:22:38 ---A- - C:\Windows\Prefetch\AgGlUAD_P_S-1-5-21-337464992-296471290-3356353711-1001.db = Fichier du dossier Prefetcher
O45 - LFCP:[MD5.6204E28F16A7C26F35952BF58197AD8E] - 21/09/2013 - 21:22:38 ---A- - C:\Windows\Prefetch\AgGlUAD_S-1-5-21-337464992-296471290-3356353711-1001.db = Fichier du dossier Prefetcher
O61 - LFC: 13/10/2013 - 17:47:08 ---A- . (...) -- C:\Users\Alatte\AppData\Local\Temp\UnityWebPlayer\log\log_015545752a3204429955d4c0f8292644.txt [26674] = Temporary file not necessary
O61 - LFC: 13/10/2013 - 17:47:08 ---A- . (...) -- C:\Users\Alatte\AppData\Local\Temp\UnityWebPlayer\log\log_3f72460a197bbe4ab91948ce22d15ec6.txt [17187] = Temporary file not necessary
O61 - LFC: 13/10/2013 - 17:47:08 ---A- . (...) -- C:\Users\Alatte\AppData\Local\Temp\UnityWebPlayer\log\manager_5e508140dd4e494990a3b020873a2496.txt [135] = Temporary file not necessary
O61 - LFC: 13/10/2013 - 17:47:08 ---A- . (...) -- C:\Users\Alatte\AppData\Local\Temp\UnityWebPlayer\log\manager_6a5e22c4925f7f48b24469fb00b48521.txt [135] = Temporary file not necessary
O61 - LFC: 13/10/2013 - 17:47:08 ---A- . (...) -- C:\Users\Alatte\AppData\Local\Temp\preferences [0] = Temporary file not necessary
O61 - LFC: 14/10/2013 - 17:47:08 ---A- . (...) -- C:\Users\Alatte\AppData\Local\Temp\~DF875908F554248B1E.TMP [376832] = Temporary file not necessary
R0 - HKCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.chatzum.com = Toolbar.ChatZum
O2 - BHO: Google Toolbar Helper [64Bits] - {AA58ED58-01DD-4d91-8333-CF10577473F7} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll =Toolbar.Google
O3 - Toolbar: Google Toolbar [64Bits] - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll =Toolbar.Google
O3 - Toolbar\WebBrowser: (no name) [64Bits] - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline = Toolbar.Google
O42 - Logiciel: Google Toolbar for Internet Explorer - (.Google Inc..) [HKLM][64Bits] -- {18455581-E099-4BA8-BC6B-F34B2F06600C} =Toolbar.Google
O42 - Logiciel: Google Toolbar for Internet Explorer - (.Google Inc..) [HKLM][64Bits] -- {2318C2B1-4965-11d4-9B18-009027A5CD4F} =Toolbar.Google
[HKCU\Software\APN] = Toolbar.Ask
[HKCU\Software\Rencontres Hard] = Toolbar.RencontresHard
[HKLM\Software\Wow6432Node\APN] = Toolbar.Ask
[HKLM\Software\Wow6432Node\VBMZ] = Toolbar.Conduit
[MD5.0235566E5134C79D5D40C1397220AC4E] [WIS][07/11/2012] (.Google Inc. - Google Toolbar for Internet Explorer.) -- C:\Windows\Installer\3c862.msi [28160] =Toolbar.Google
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4D91-8333-CF10577473F7}] =Toolbar.Google^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{18455581-E099-4BA8-BC6B-F34B2F06600C}] =Toolbar.Google^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{2318C2B1-4965-11d4-9B18-009027A5CD4F}] =Toolbar.Google^
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF] =Toolbar.AVGSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888] =Toolbar.Ask
[HKCU\Software\APN] =Toolbar.Ask
[HKLM\Software\Wow6432Node\APN] =Toolbar.Ask
[HKCU\Software\Rencontres Hard] =Toolbar.RencontresHard
[HKLM\Software\Wow6432Node\VBMZ] =Toolbar.Conduit
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2] =Toolbar.Ask
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{2318C2B1-4965-11d4-9B18-009027A5CD4F} =Toolbar.Google^
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll =Toolbar.Google^
C:\Windows\Installer\3c862.msi =Toolbar.Google^

Bonne journée,
@+

[dav86]

slt , jai refait la manip tout allais bien puis la barre de chargement c est arreter a la moitier et puis plus rien ,ca ma mis sur le burreau un icone de chrome.exe,firefox.exe et iexplorer.exe,et dans ma corbeil j avait juste mon programme de unity player que j ai vider je le reinstalerais pas de souci je m en sert pour les jeux en ligne,et donc pour le chargement la fenetre principal reste ouverte ainsi qu un autre plus petite a fond bleu,et je ne peut pas les fermer sans devoir faire un control+alt+supprime, bonne soire a+

[roro04]

Salut !

As-tu tenté de redémarrer le PC ?

Bonne soirée,
@+

[dav86]

slt, si le bute est que sa me réinstale mes icones des moteurs de recherche qui y etait c est bon c juste qu'il y a marquer apres le nom (exe) ,et oui j ai redemarer mon pc et j ai recommencer la manip et la barre d instalation reste toujour bloquer au milieux

bonne soiree a+

[roro04]

Laisse plus longtemps ça devrait finir par se débloquer.

[dav86]

salut rien a faire ca ne se deblaque pas je l ai laissez chercher toute la journee mais rien ne ce passeje fait quoi

bonne soiree a+

[roro04]

On va résoudre le problème ensemble

Je vais te faire démarrer en Mode Sans Echec (mode alléger de Windows)

• Redémarre ton ordinateur et, avant l'apparition de logo Windows, tapotes la touche F8 de ton clavier.
• Avec les flèche directionnels Haut et Bas de ton clavier, déplace toi jusqu'a Mode sans Echec avec prise en charge Réseau.
• Valide par la touche Entrée de ton clavier.
• Sélectionne ta session si l'invite de session apprait.
• Clique sur Oui.
  
  Remarque: Une fois sur ton bureau, le font est noir et tu n'as pas le même thème, c'est normal.

Ensuite retente ZHPFix.

Bonne soirée,
@+

[dav86]

salut j ai refait en mode sans echec comme tu me la indiquer ,mais je l avait dejas fait je pensai te l avoir dit mais c est un oubli de ma part donc c est pareil ca reste bloquer ,par curiositer je suis aller voir la compatibiliter avec le programme et apres la recherche dans le systeme il me dit que le programme n est pas compatible

exemple: zhpfix incompatible et j ai in triangle jaune avec un point d exclamation en bout
je c est pas quoi faire

a+

[roro04]

Ok, refais moi un ZHPDiag On va supprimer les lignes autrement.

[dav86]

~ Rapport de ZHPDiag v2013.10.27.68 - Nicolas Coolman (27/10/2013)
~ Lancé par Alatte (28/10/2013 10:57:22)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by program


---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16721
MFIE: Mozilla Firefox 24.0 (Defaut)
GCIE: Google Chrome v30.0.1599.101

---\\ Informations sur les produits Windows
~ Langage: Français
Windows Vista Home Premium Edition, 64-bit (Build 6000)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 7QJB7
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK

---\\ Logiciels de protection du système
Avira Free Antivirus v13.0.0.4042
Malwarebytes Anti-Malware version 1.75.0.1300

---\\ Logiciels d'optimisation du système
CCleaner v3.20 =Piriform Ltd

---\\ Logiciels de partage PeerToPeer
Pando Media Booster v2.6.0.8

---\\ Surveillance de Logiciels
Adobe Flash Player 11 Plugin
Adobe Reader XI
Java 7 Update 7
Java 7 Update 45

---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 37 Stepping 2, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 6135 MB (67% free)
System Restore: Activé (Enable)
System drive C: has 263 GB (57%) free of 459 GB

---\\ Mode de connexion au système
~ Computer Name: ALATTE-PC
~ User Name: Alatte
~ All Users Names: sandrine, Alatte, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Alatte\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Alatte\AppData\Roaming\
~ %Desktop% : C:\Users\Alatte\Desktop\
~ %Favorites% : C:\Users\Alatte\Favorites\
~ %LocalAppData% : C:\Users\Alatte\AppData\Local\
~ %StartMenu% : C:\Users\Alatte\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 263 Go of 459 Go)
D: Hard drive, Flash drive, Thumb drive (Free 458 Go of 459 Go)
E: CD-ROM drive (Not Inserted)
F: Floppy drive, Flash card reader, USB Key (Not Inserted)
G: Floppy drive, Flash card reader, USB Key (Not Inserted)



---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: 41 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.D28B35DE88D27EFB27DF4B1E8319E3C0] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.22/09/2013 - 23:55:10.) -- C:\Windows\System32\wininet.dll [2241024]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.314C17917AC8523EC77A710215012A65] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.14/09/2013 - 02:10:19.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/3
~ Mes Videos (My Videos) : 1/2
~ Mes Favoris (My Favorites) : 1/65
~ Mes Documents (My Documents) : 1/664
~ Mon Bureau (My Desktop) : 1/26
~ Menu demarrer (Programs) : 1/50
~ Hidden Files: Scanned in 00mn 01s



---\\ Processus lancés
[MD5.89F7B7CCC82D7E6FF9832FE3D24988C4] - (.Egis Technology Inc. - MyWinLocker.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552] [PID.1896]
[MD5.4458989C34FA84B5A75DD3ABCFBE786A] - (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624] [PID.1300]
[MD5.F0EA603E7B91046CA48EA4B3593A007D] - (.Micro Application - Pas de description.) -- C:\Program Files (x86)\Micro Application\LauncherMA.exe [485376] [PID.1272]
[MD5.27964C4676D0F4B34DB7332AFA2B1474] - (.Egis Technology Inc. - PMM Update Application.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [401192] [PID.3236]
[MD5.AD16557CECFB17CF7393D28DC40F6D09] - (.Pas de propriétaire - Hotkey Utility.) -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [563744] [PID.3256]
[MD5.80C1D422AAE807CF20A5E353EB8B5661] - (.CyberLink Corp. - Arcade Movie Resident Program.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe [124136] [PID.3280]
[MD5.DB3F7F19F942D3CE4E1A0E8D9FF541FB] - (.Avira Operations GmbH Co. KG - Avira System Tray Tool.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192] [PID.3300]
[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336] [PID.3372]
[MD5.6C695B04E2E29459CDC2E5C0970B883B] - (.Egis Technology Inc. - EgisUpdate Release Application.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201512] [PID.3652]
[MD5.A9182CE59CFC56F9C1DDE8B3C0AE8378] - (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [274840] [PID.3872]
[MD5.12FD4EF8F2CBBF98E0A5CED88258DDF3] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe [17816] [PID.3396]
[MD5.EB68851F020D35293EADAADEB18B8220] - (.Adobe Systems, Inc. - Adobe Flash Player 11.9 r900.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe [1862536] [PID.2432]
[MD5.084D14D1283EC4D78A1D0B8C3D0187DD] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8137728] [PID.3640]
[MD5.8769E2D1072B62AB071F166F03B3E3DC] - (.Avira Operations GmbH Co. KG - Avira Scheduler.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024] [PID.1436]
[MD5.ADDA5E1951B90D3D23C56D3CF0622ADC] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65640] [PID.1644]
[MD5.AD1D13E6326E0B8DA2A7BE13B39A8FE0] - (.Avira Operations GmbH Co. KG - Avira On-Access Service.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088] [PID.1668]
[MD5.816FD5A6F3C2F3D600900096632FC60E] - (.Acer Incorporated - Global Registration Service.) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe [1150496] [PID.1712]
[MD5.EDCCC8C13B1EB882F77BA0ABB84566E7] - (.Pas de propriétaire - Inkjet Printer/Scanner/Fax Extended Survey.) -- C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.exe [140456] [PID.1768]
[MD5.3A2BDD76E7D2A5F40A7174793D1BA794] - (...) -- C:\Windows\SysWOW64\PnkBstrA.exe [75136] [PID.1844]
[MD5.F12A68ED55053940CADD59CA5E3468DD] - (.Pas de propriétaire - RichVideo Module.) -- C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe [244904] [PID.1884]
[MD5.F9EC9ACD504D823D9B9CA98A4F8D3CA2] - (.Acer Group - Updater Service.) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe [243232] [PID.2000]
[MD5.B5E6C4F280EBF0B16F74A5B415F2E0DF] - (.Pas de propriétaire - USB S3S4 Detection.) -- C:\OEM\USBDECTION\USBS3S4Detection.exe [76320] [PID.2028]
~ Processes Running: Scanned in 00mn 00s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Alatte\AppData\Local\Google\Chrome\User Data\Default\Preferences
~ Google Browser: 12 Legitimates Filtered in 00mn 06s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Alatte\AppData\Roaming\Mozilla\Firefox\Profiles\hl5cnu5x.default-1381266156581\prefs.js
~ Firefox Browser: 8 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.chatzum.com
R0 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.do
~ IE Browser: 16 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar\WebBrowser: (no name) [64Bits] - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
~ Toolbar: Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Acrobat Reader 5.0.lnk . (.Adobe Systems Incorporated - Acrobat Reader 5.0.) -- C:\Program Files (x86)\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
O4 - GS\Desktop [Public]: Canon Quick Menu.lnk . (.CANON INC. - Canon Quick Menu.) -- C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.exe
O4 - GS\Desktop [Public]: chrome.exe.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [Public]: firefox.exe.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Desktop [Public]: OpenOffice 4.0.0.lnk . (.Apache Software Foundation - OpenOffice 4.0.0.) -- C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
O4 - GS\Desktop [Public]: TeamSpeak 3 Client.lnk . (.TeamSpeak Systems GmbH - TeamSpeak 3 Client.) -- C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe
O4 - GS\Program [Public]: Acrobat Reader 5.0.lnk . (.Adobe Systems Incorporated - Acrobat Reader 5.0.) -- C:\Program Files (x86)\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
O4 - GS\Program [Public]: firefox.exe.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\QuickLaunch [sandrine]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\QuickLaunch [sandrine]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [sandrine]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [sandrine]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Program [sandrine]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [sandrine]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [sandrine]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\Desktop [sandrine]: Ubi Soft Product Registration.lnk . (.Ubi Soft - Pas de description.) -- C:\Program Files (x86)\Ubi Soft\Register\register.exe
O4 - GS\QuickLaunch [Alatte]: chrome.exe.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Alatte]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\QuickLaunch [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Program [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Accessories [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SendTo [Alatte]: Xfire Ami(e).lnk . (...) -- C:\Program Files (x86)\Xfire\Xfire.exe (.not file.)
O4 - GS\Desktop [Alatte]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\Desktop [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Alatte]: ZHPFix.lnk . (.Nicolas Coolman - ZHPDiag Setup.) -- C:\Program Files (x86)\ZHPDiag\ZHPFix\ZHPhep.exe =.Nicolas Coolman
~ Global Startup: 101 Legitimates Filtered in 00mn 04s



---\\ Applications lancées au démarrage du sytème (O4)
O4 - GS\Startup [Alatte]: Lanceur.lnk . (.Micro Application - Pas de description.) -- C:\Program Files (x86)\Micro Application\LauncherMA.exe
O4 - GS\Startup [Alatte]: Registration .LNK . (...) -- C:\Program Files (x86)\Ubisoft\Tom Clancy's Splinter Cell Double Agent\support\Register\Reg.exe (.not file.)
O4 - HKLM\..\Run: [mwlDaemon] . (.Egis Technology Inc. - MyWinLocker.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =.Realtek Semiconductor Corp
O4 - HKCU\..\Run: [Pando Media Booster] . (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
O4 - HKLM\..\Wow6432Node\Run: [SuiteTray] . (.Egis Technology Inc. - SuiteTray.) -- C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe
O4 - HKLM\..\Wow6432Node\Run: [EgisUpdate] . (.Egis Technology Inc. - EgisUpdate Release Application.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [EgisTecPMMUpdate] . (.Egis Technology Inc. - PMM Update Application.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [Hotkey Utility] . (.Pas de propriétaire - Hotkey Utility.) -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
O4 - HKLM\..\Wow6432Node\Run: [MDS_Menu] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Wow6432Node\Run: [ArcadeMovieService] . (.CyberLink Corp. - Arcade Movie Resident Program.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [avgnt] . (.Avira Operations GmbH Co. KG - Avira System Tray Tool.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe =.Advanced Micro Devices, Inc
O4 - HKLM\..\Wow6432Node\Run: [CanonQuickMenu] . (.CANON INC. - Canon Quick Menu.) -- C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.exe
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =.Oracle Corporation
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-21-337464992-296471290-3356353711-1000\..\Run: [Pando Media Booster] . (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
~ Application: Scanned in 00mn 00s



---\\ Site dans la Zone de confiance d'Internet Explorer (O15)
O15 - Trusted Zone: [HKCU\...\Domains] http.ma-config.com
O15 - Trusted Zone: [HKCU\...\Domains] http.touslesdrivers.com
~ IE Zone Confiance: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CS1\Services\Tcpip\..\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CS2\Services\Tcpip\..\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.241 212.27.40.240
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll =.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [Go for FilesUpdate] (...) -- C:\Program Files (x86)\GoforFiles\GFFUpdater.exe (.not file.) [0] =P2P.GoforFiles
[MD5.00000000000000000000000000000000] [APT] [{12057A87-6954-4D95-BCF4-1870896417FD}] (...) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{2479915F-EC78-4E9B-8546-3DA8189B0AC6}] (...) -- C:\Program Files (x86)\Illusion Softworks\Hidden Dangerous 2\hd2.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{278243B5-6EBF-49BD-B40A-7A5BF92FFFD8}] (...) -- E:\Setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{32531348-75F0-43BA-843A-4DF2A1547216}] (...) -- E:\Setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{38C1E288-0CD4-428D-ADC0-6174A9904F97}] (...) -- E:\setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{503F180A-D616-495E-BF81-A597E44ADAF0}] (...) -- E:\Setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{68583218-406A-44A9-8521-5D560795A2B7}] (...) -- C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{9D91A3C0-95F8-4F7A-9032-82F944226937}] (...) -- E:\SETUP.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{B9361F11-902B-4607-87BB-FC7FDF924331}] (...) -- C:\Program Files\Bohemia Interactive\ArmA\arma.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{F31478B2-9672-4546-AB4F-D32E87AB604E}] (...) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (.not file.) [0]
~ Scheduled Task: 26 Legitimates Filtered in 00mn 06s



---\\ HKCU HKLM Software Keys
[HKCU\Software\APN]
[HKCU\Software\Pando Networks]
[HKCU\Software\Rencontres Hard]
[HKLM\Software\Wow6432Node\APN]
[HKLM\Software\Wow6432Node\IncrediMail]
[HKLM\Software\Wow6432Node\Pando Networks]
[HKLM\Software\Wow6432Node\VBMZ]
~ Key Software: 276 Legitimates Filtered in 00mn 00s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 11/04/2012 - 23:15:41 - [7,234] ----D C:\Program Files (x86)\Pando Networks
O43 - CFD: 16/07/2012 - 19:09:40 - [0,001] ----D C:\Users\Alatte\AppData\Local\reakktor
~ 1217 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 1499 Legitimates Filtered in 00mn 45s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.D39DB3CDBBC6488ED74A5ACC01BA4DCA] - 25/10/2013 - 12:35:11 ---A- . (...) -- C:\Windows\ntbtlog.txt [150616]
~ Files: 18 Legitimates Filtered in 00mn 58s



---\\ Enumération des clés de registre StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\Overwolf [Key] . (.Overwolf - Overwolf.) -- C:\Program Files (x86)\Overwolf\Overwolf.exe
~ SMSR Keys: 4 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.B8B7DF85909DE0E0DA5B8E1BF67EF033] - 06/03/2013 - 20:50:17 ---A- . (.Protect Software GmbH - ProtectDisc Filter Driver x64.) -- C:\Windows\System32\Drivers\acedrv10.sys [276480]
O58 - SDL:[MD5.CE4B6956E4E12492715A53076E58761F] - 09/11/2009 - 00:42:00 ---A- . (.Teruten Inc - File System Mini Filter Drvier.) -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys [16392]
~ Drivers: 16 Legitimates Filtered in 00mn 00s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 06/03/2013 - C:\Windows\system32\drivers\acedrv10.sys (acedrv10) .(.Protect Software GmbH - ProtectDisc Filter Driver x64.) - LEGACY_ACEDRV10
~ Legacy: 93 Legitimates Filtered in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- searches.com\?utm_source=butm_medium=s32utm_campaign=eXQutm_content=scfrom=s32uid=WDCXWD10EARS-22Y5B1_WD-WCAV5A19477494774ts=1381152335 C:\Program Files (x86)\Mozilla Firefox\firefox.exe" http://www.do
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- searches.com\?utm_source=butm_medium=s32utm_campaign=eXQutm_content=scfrom=s32uid=WDCXWD10EARS-22Y5B1_WD-WCAV5A19477494774ts=1381152335 C:\Program Files\Internet Explorer\iexplore.exe http://www.do =Hijacker.wwwDo
~ Keys: Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com
~ Keys: Scanned in 00mn 00s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.6ACBD475647D7A160657CB3E460F0F35] [SPRF][27/01/2010] (...) -- C:\ProgramData\FullRemove.exe [131472]
[MD5.7EFA501C050F35610A750928C8F246BE] [SPRF][07/10/2013] (...) -- C:\Users\Alatte\AppData\Roaming\wklnhst.dat [226]
[MD5.FC05CF5526BA0C9CCDEB02BB61503ED1] [SPRF][29/04/2013] (...) -- C:\Users\Alatte\Desktop\avira_free_antivirus_fr.exe [104833992]
~ Files: 7 Legitimates Filtered in 00mn 02s



---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "70140BF22CB7C94419A535B0925B0EEF" . (.UE3Redist.) -- C:\Windows\Installer\{2FB04107-7BC2-449C-915A-530B29B5E0FE}\ARPPRODUCTICON.exe
~ Update Products: 155 Legitimates Filtered in 00mn 00s



---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.23E107196CB1CB6E66C5689C8EC06C1C] [WIS][02/07/2009] (.Nokia - PC Connectivity Solution.) -- C:\Windows\Installer\1516a1.msi [21368832]
~ WIS: 162 Legitimates Filtered in 00mn 23s



---\\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 11/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 08/10/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 24/07/2013 239616 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 10/09/2013 84024 | (AntiVirSchedulerService) . (.Avira Operations GmbH Co. KG.) - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
SR - | Auto 10/09/2013 108088 | (AntiVirService) . (.Avira Operations GmbH Co. KG.) - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
SR - | Auto 28/08/2009 1150496 | (Greg_Service) . (.Acer Incorporated.) - C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
SS - | Auto 15/12/2011 136176 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 15/12/2011 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 03/04/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
SR - | Auto 28/03/2012 140456 | (IJPLMSVC) . (...) - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.exe
SR - | Auto 04/08/2013 2650960 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe
SS - | Demand 01/10/2013 118680 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Demand 01/02/2010 305520 | (MWLService) . (.Egis Technology Inc..) - C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
SS - | Demand 22/08/2013 18360 | (OverwolfUpdaterService) . (.Overwolf Ltd.) - C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe
SR - | Auto 10/07/1658 0 | (PnkBstrA) . (...) - C:\Windows\system32\PnkBstrA.exe
SR - | Auto 03/02/2010 244904 | (RichVideo) . (...) - C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe
SS - | Demand 11/11/2008 620544 | (ServiceLayer) . (.Nokia..) - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
SS - | Auto 03/06/2013 162408 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Demand 21/09/2013 565672 | (Steam Client Service) . (.Valve Corporation.) - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
SR - | Auto 29/01/2010 243232 | (Updater Service) . (.Acer Group.) - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
SR - | Auto 09/12/2009 76320 | (USBS3S4Detection) . (...) - C:\OEM\USBDECTION\USBS3S4Detection.exe
SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SS - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\system32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 24s



---\\ Scan Additionnel (O88)
Database Version : 12960 - (27/10/2013)
Clés trouvées (Keys found) : 16
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 1

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF] =Toolbar.AVGSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888] =Toolbar.Ask
[HKCU\Software\APN] =Toolbar.Ask
[HKLM\Software\Wow6432Node\APN] =Toolbar.Ask
[HKCU\Software\Rencontres Hard] =Toolbar.RencontresHard
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar] =Toolbar.AskTBar
[HKLM\Software\Wow6432Node\VBMZ] =Toolbar.Conduit
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OpenCandyHelperRunOnce] =Adware.OpenCandy
C:\Users\Alatte\AppData\Local\Temp\GoogleToolbarInstaller1.log =Toolbar.Babylon
~ Additionnel Scan: 299896 Items scanned in 00mn 31s



---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com/apps/blo ... cker-wwwdo =Hijacker.wwwDo
~ http://nicolascoolman.webs.com/apps/blo ... oolbar-ask =Toolbar.Ask
~ http://nicolascoolman.webs.com/apps/blo ... ar-conduit =Toolbar.Conduit
~ http://nicolascoolman.webs.com/apps/blo ... -opencandy =Adware.OpenCandy
~ http://nicolascoolman.webs.com/apps/blo ... ar-babylon =Toolbar.Babylon
~ MSI: 5 link(s) detected in 00mn 31s



~ 2578 Legitimates filtered by white list
End of the scan (463 lines in 03mn 24s)(0)


voila c est fait bonne journee a+

[roro04]

Salut

ZHPFix a quand même supprimé pas mal de lignes ce qui est une très bonne chose.

Script ZHPFix
R0 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.do
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- searches.com\?utm_source=butm_medium=s32utm_campaign=eXQutm_content=scfrom=s32uid=WDCXWD10EARS-22Y5B1_WD-WCAV5A19477494774ts=1381152335 C:\Program Files\Internet Explorer\iexplore.exe http://www.do =Hijacker.wwwDo
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OpenCandyHelperRunOnce]
C:\Users\Alatte\AppData\Local\Temp\GoogleToolbarInstaller1.log =Toolbar.Babylon
R0 - HKCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.chatzum.com
O3 - Toolbar\WebBrowser: (no name) [64Bits] - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
[HKCU\Software\APN]
[HKCU\Software\Rencontres Hard]
[HKLM\Software\Wow6432Node\APN]
[HKLM\Software\Wow6432Node\VBMZ]
[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888]
[HKCU\Software\APN]
[HKLM\Software\Wow6432Node\APN]
[HKCU\Software\Rencontres Hard]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar]
[HKLM\Software\Wow6432Node\VBMZ]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2]

Ensuite refais un ZHPDiag

Bonne soirée,
@+

[dav86]

le rapport de nettoyage ca a marcher cette fois :

Rapport de ZHPFix 2013.10.21.17 par Nicolas Coolman, Update du 21/10/2013
Fichier d'export Registre :
Run by Alatte at 29/10/2013 11:55:19
High Elevated Privileges : OK
Windows XP Home Edition Service Pack 2 (Build 2600)

Corbeille vidée (00mn 04s)

========== Clés du Registre ==========
SUPPRIMÉ:³ HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OpenCandyHelperRunOnce
SUPPRIMÉ: HKCU\Software\APN
SUPPRIMÉ: HKCU\Software\Rencontres Hard
SUPPRIMÉ: HKLM\Software\Wow6432Node\APN
SUPPRIMÉ: HKLM\Software\Wow6432Node\VBMZ
SUPPRIMÉ: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
SUPPRIMÉ:³ HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7
SUPPRIMÉ:³ HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
SUPPRIMÉ:³ HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
SUPPRIMÉ:³ HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
SUPPRIMÉ:³ HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
SUPPRIMÉ:³ HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
SUPPRIMÉ:³ HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
SUPPRIMÉ:³ HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
SUPPRIMÉ:³ HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
SUPPRIMÉ:³ HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2

========== Valeurs du Registre ==========
SUPPRIMÉ: Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F}

========== Eléments de donnée du Registre ==========
SUPPRIMÉ: R0 - Main,Start Page = KLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page
SUPPRIMÉ: R0 - Main,Start Page = KCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page

========== Fichiers ==========
SUPPRIMÉ: C:\Users\Alatte\AppData\Local\Temp\GoogleToolbarInstaller1.log


========== Récapitulatif ==========
16 : Clés du Registre
1 : Valeurs du Registre
2 : Eléments de donnée du Registre
1 : Fichiers


End of clean in 00mn 08s

========== Chemin de fichier rapport ==========
C:\Users\Alatte\AppData\Roaming\ZHP\ZHPFix[R1].txt - 29/10/2013 11:55:24 [2675]

[dav86]

rapport zhpdiag:

~ Rapport de ZHPDiag v2013.10.28.74 - Nicolas Coolman (28/10/2013)
~ Lancé par Alatte (29/10/2013 12:00:03)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by program


---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16721
MFIE: Mozilla Firefox 24.0 (Defaut)
GCIE: Google Chrome v30.0.1599.101

---\\ Informations sur les produits Windows
~ Langage: Français
Windows Vista Home Premium Edition, 64-bit (Build 6000)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 7QJB7
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK

---\\ Logiciels de protection du système
Avira Free Antivirus v13.0.0.4042
Malwarebytes Anti-Malware version 1.75.0.1300

---\\ Logiciels d'optimisation du système
CCleaner v3.20 =Piriform Ltd

---\\ Logiciels de partage PeerToPeer
Pando Media Booster v2.6.0.8

---\\ Surveillance de Logiciels
Adobe Flash Player 11 Plugin
Adobe Reader XI
Java 7 Update 7
Java 7 Update 45

---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 37 Stepping 2, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 6135 MB (71% free)
System Restore: Activé (Enable)
System drive C: has 265 GB (57%) free of 459 GB

---\\ Mode de connexion au système
~ Computer Name: ALATTE-PC
~ User Name: Alatte
~ All Users Names: sandrine, Alatte, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Alatte\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Alatte\AppData\Roaming\
~ %Desktop% : C:\Users\Alatte\Desktop\
~ %Favorites% : C:\Users\Alatte\Favorites\
~ %LocalAppData% : C:\Users\Alatte\AppData\Local\
~ %StartMenu% : C:\Users\Alatte\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 265 Go of 459 Go)
D: Hard drive, Flash drive, Thumb drive (Free 458 Go of 459 Go)
E: CD-ROM drive (Not Inserted)
F: Floppy drive, Flash card reader, USB Key (Not Inserted)
G: Floppy drive, Flash card reader, USB Key (Not Inserted)



---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: 41 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.D28B35DE88D27EFB27DF4B1E8319E3C0] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.22/09/2013 - 23:55:10.) -- C:\Windows\System32\wininet.dll [2241024]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.314C17917AC8523EC77A710215012A65] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.14/09/2013 - 02:10:19.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/3
~ Mes Videos (My Videos) : 1/2
~ Mes Favoris (My Favorites) : 1/65
~ Mes Documents (My Documents) : 1/665
~ Mon Bureau (My Desktop) : 1/27
~ Menu demarrer (Programs) : 1/50
~ Hidden Files: Scanned in 00mn 01s



---\\ Processus lancés
[MD5.89F7B7CCC82D7E6FF9832FE3D24988C4] - (.Egis Technology Inc. - MyWinLocker.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552] [PID.2800]
[MD5.4458989C34FA84B5A75DD3ABCFBE786A] - (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624] [PID.2848]
[MD5.F0EA603E7B91046CA48EA4B3593A007D] - (.Micro Application - Pas de description.) -- C:\Program Files (x86)\Micro Application\LauncherMA.exe [485376] [PID.3024]
[MD5.27964C4676D0F4B34DB7332AFA2B1474] - (.Egis Technology Inc. - PMM Update Application.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [401192] [PID.2468]
[MD5.AD16557CECFB17CF7393D28DC40F6D09] - (.Pas de propriétaire - Hotkey Utility.) -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [563744] [PID.2488]
[MD5.80C1D422AAE807CF20A5E353EB8B5661] - (.CyberLink Corp. - Arcade Movie Resident Program.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe [124136] [PID.2660]
[MD5.DB3F7F19F942D3CE4E1A0E8D9FF541FB] - (.Avira Operations GmbH Co. KG - Avira System Tray Tool.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192] [PID.2680]
[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336] [PID.2920]
[MD5.6C695B04E2E29459CDC2E5C0970B883B] - (.Egis Technology Inc. - EgisUpdate Release Application.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201512] [PID.3208]
[MD5.A9182CE59CFC56F9C1DDE8B3C0AE8378] - (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [274840] [PID.2016]
[MD5.12FD4EF8F2CBBF98E0A5CED88258DDF3] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe [17816] [PID.1916]
[MD5.EB68851F020D35293EADAADEB18B8220] - (.Adobe Systems, Inc. - Adobe Flash Player 11.9 r900.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe [1862536] [PID.2896]
[MD5.3B605772669BDFD6DC266B9320E87B45] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8143872] [PID.4676]
[MD5.8769E2D1072B62AB071F166F03B3E3DC] - (.Avira Operations GmbH Co. KG - Avira Scheduler.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024] [PID.1420]
[MD5.ADDA5E1951B90D3D23C56D3CF0622ADC] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65640] [PID.1600]
[MD5.AD1D13E6326E0B8DA2A7BE13B39A8FE0] - (.Avira Operations GmbH Co. KG - Avira On-Access Service.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088] [PID.1640]
[MD5.816FD5A6F3C2F3D600900096632FC60E] - (.Acer Incorporated - Global Registration Service.) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe [1150496] [PID.1688]
[MD5.EDCCC8C13B1EB882F77BA0ABB84566E7] - (.Pas de propriétaire - Inkjet Printer/Scanner/Fax Extended Survey.) -- C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.exe [140456] [PID.1744]
[MD5.3A2BDD76E7D2A5F40A7174793D1BA794] - (...) -- C:\Windows\SysWOW64\PnkBstrA.exe [75136] [PID.1820]
[MD5.F12A68ED55053940CADD59CA5E3468DD] - (.Pas de propriétaire - RichVideo Module.) -- C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe [244904] [PID.1848]
[MD5.F9EC9ACD504D823D9B9CA98A4F8D3CA2] - (.Acer Group - Updater Service.) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe [243232] [PID.2004]
[MD5.B5E6C4F280EBF0B16F74A5B415F2E0DF] - (.Pas de propriétaire - USB S3S4 Detection.) -- C:\OEM\USBDECTION\USBS3S4Detection.exe [76320] [PID.2044]
~ Processes Running: Scanned in 00mn 00s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Alatte\AppData\Local\Google\Chrome\User Data\Default\Preferences
~ Google Browser: 12 Legitimates Filtered in 00mn 06s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Alatte\AppData\Roaming\Mozilla\Firefox\Profiles\hl5cnu5x.default-1381266156581\prefs.js
~ Firefox Browser: 8 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.chatzum.com
R0 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.do
~ IE Browser: 16 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Acrobat Reader 5.0.lnk . (.Adobe Systems Incorporated - Acrobat Reader 5.0.) -- C:\Program Files (x86)\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
O4 - GS\Desktop [Public]: Canon Quick Menu.lnk . (.CANON INC. - Canon Quick Menu.) -- C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.exe
O4 - GS\Desktop [Public]: chrome.exe.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [Public]: firefox.exe.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Desktop [Public]: OpenOffice 4.0.0.lnk . (.Apache Software Foundation - OpenOffice 4.0.0.) -- C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
O4 - GS\Desktop [Public]: TeamSpeak 3 Client.lnk . (.TeamSpeak Systems GmbH - TeamSpeak 3 Client.) -- C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe
O4 - GS\Program [Public]: Acrobat Reader 5.0.lnk . (.Adobe Systems Incorporated - Acrobat Reader 5.0.) -- C:\Program Files (x86)\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
O4 - GS\Program [Public]: firefox.exe.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\QuickLaunch [sandrine]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\QuickLaunch [sandrine]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [sandrine]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [sandrine]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Program [sandrine]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [sandrine]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [sandrine]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\Desktop [sandrine]: Ubi Soft Product Registration.lnk . (.Ubi Soft - Pas de description.) -- C:\Program Files (x86)\Ubi Soft\Register\register.exe
O4 - GS\QuickLaunch [Alatte]: chrome.exe.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Alatte]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\QuickLaunch [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Program [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Accessories [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SendTo [Alatte]: Xfire Ami(e).lnk . (...) -- C:\Program Files (x86)\Xfire\Xfire.exe (.not file.)
O4 - GS\Desktop [Alatte]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\Desktop [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Alatte]: ZHPFix.lnk . (.Nicolas Coolman - ZHPDiag Setup.) -- C:\Program Files (x86)\ZHPDiag\ZHPFix\ZHPhep.exe =.Nicolas Coolman
~ Global Startup: 101 Legitimates Filtered in 00mn 05s



---\\ Applications lancées au démarrage du sytème (O4)
O4 - GS\Startup [Alatte]: Lanceur.lnk . (.Micro Application - Pas de description.) -- C:\Program Files (x86)\Micro Application\LauncherMA.exe
O4 - GS\Startup [Alatte]: Registration .LNK . (...) -- C:\Program Files (x86)\Ubisoft\Tom Clancy's Splinter Cell Double Agent\support\Register\Reg.exe (.not file.)
O4 - HKLM\..\Run: [mwlDaemon] . (.Egis Technology Inc. - MyWinLocker.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =.Realtek Semiconductor Corp
O4 - HKCU\..\Run: [Pando Media Booster] . (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
O4 - HKLM\..\Wow6432Node\Run: [SuiteTray] . (.Egis Technology Inc. - SuiteTray.) -- C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe
O4 - HKLM\..\Wow6432Node\Run: [EgisUpdate] . (.Egis Technology Inc. - EgisUpdate Release Application.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [EgisTecPMMUpdate] . (.Egis Technology Inc. - PMM Update Application.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [Hotkey Utility] . (.Pas de propriétaire - Hotkey Utility.) -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
O4 - HKLM\..\Wow6432Node\Run: [MDS_Menu] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Wow6432Node\Run: [ArcadeMovieService] . (.CyberLink Corp. - Arcade Movie Resident Program.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [avgnt] . (.Avira Operations GmbH Co. KG - Avira System Tray Tool.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe =.Advanced Micro Devices, Inc
O4 - HKLM\..\Wow6432Node\Run: [CanonQuickMenu] . (.CANON INC. - Canon Quick Menu.) -- C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.exe
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =.Oracle Corporation
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-21-337464992-296471290-3356353711-1000\..\Run: [Pando Media Booster] . (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
~ Application: Scanned in 00mn 00s



---\\ Site dans la Zone de confiance d'Internet Explorer (O15)
O15 - Trusted Zone: [HKCU\...\Domains] http.ma-config.com
O15 - Trusted Zone: [HKCU\...\Domains] http.touslesdrivers.com
~ IE Zone Confiance: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CS1\Services\Tcpip\..\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CS2\Services\Tcpip\..\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.241 212.27.40.240
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll =.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [Go for FilesUpdate] (...) -- C:\Program Files (x86)\GoforFiles\GFFUpdater.exe (.not file.) [0] =P2P.GoforFiles
[MD5.00000000000000000000000000000000] [APT] [{12057A87-6954-4D95-BCF4-1870896417FD}] (...) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{2479915F-EC78-4E9B-8546-3DA8189B0AC6}] (...) -- C:\Program Files (x86)\Illusion Softworks\Hidden Dangerous 2\hd2.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{278243B5-6EBF-49BD-B40A-7A5BF92FFFD8}] (...) -- E:\Setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{32531348-75F0-43BA-843A-4DF2A1547216}] (...) -- E:\Setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{38C1E288-0CD4-428D-ADC0-6174A9904F97}] (...) -- E:\setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{503F180A-D616-495E-BF81-A597E44ADAF0}] (...) -- E:\Setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{68583218-406A-44A9-8521-5D560795A2B7}] (...) -- C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{9D91A3C0-95F8-4F7A-9032-82F944226937}] (...) -- E:\SETUP.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{B9361F11-902B-4607-87BB-FC7FDF924331}] (...) -- C:\Program Files\Bohemia Interactive\ArmA\arma.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{F31478B2-9672-4546-AB4F-D32E87AB604E}] (...) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (.not file.) [0]
~ Scheduled Task: 26 Legitimates Filtered in 00mn 07s



---\\ HKCU HKLM Software Keys
[HKCU\Software\Pando Networks]
[HKLM\Software\Wow6432Node\IncrediMail]
[HKLM\Software\Wow6432Node\Pando Networks]
~ Key Software: 272 Legitimates Filtered in 00mn 00s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 11/04/2012 - 23:15:41 - [7,234] ----D C:\Program Files (x86)\Pando Networks
O43 - CFD: 16/07/2012 - 19:09:40 - [0,001] ----D C:\Users\Alatte\AppData\Local\reakktor
~ 1216 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 1499 Legitimates Filtered in 00mn 48s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.D39DB3CDBBC6488ED74A5ACC01BA4DCA] - 25/10/2013 - 12:35:11 ---A- . (...) -- C:\Windows\ntbtlog.txt [150616]
~ Files: 18 Legitimates Filtered in 00mn 56s



---\\ Enumération des clés de registre StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\Overwolf [Key] . (.Overwolf - Overwolf.) -- C:\Program Files (x86)\Overwolf\Overwolf.exe
~ SMSR Keys: 4 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.B8B7DF85909DE0E0DA5B8E1BF67EF033] - 06/03/2013 - 20:50:17 ---A- . (.Protect Software GmbH - ProtectDisc Filter Driver x64.) -- C:\Windows\System32\Drivers\acedrv10.sys [276480]
O58 - SDL:[MD5.CE4B6956E4E12492715A53076E58761F] - 09/11/2009 - 00:42:00 ---A- . (.Teruten Inc - File System Mini Filter Drvier.) -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys [16392]
~ Drivers: 16 Legitimates Filtered in 00mn 00s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 06/03/2013 - C:\Windows\system32\drivers\acedrv10.sys (acedrv10) .(.Protect Software GmbH - ProtectDisc Filter Driver x64.) - LEGACY_ACEDRV10
~ Legacy: 93 Legitimates Filtered in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- searches.com\?utm_source=butm_medium=s32utm_campaign=eXQutm_content=scfrom=s32uid=WDCXWD10EARS-22Y5B1_WD-WCAV5A19477494774ts=1381152335 C:\Program Files (x86)\Mozilla Firefox\firefox.exe" http://www.do
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- searches.com\?utm_source=butm_medium=s32utm_campaign=eXQutm_content=scfrom=s32uid=WDCXWD10EARS-22Y5B1_WD-WCAV5A19477494774ts=1381152335 C:\Program Files\Internet Explorer\iexplore.exe http://www.do =Hijacker.wwwDo
~ Keys: Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com
~ Keys: Scanned in 00mn 00s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.6ACBD475647D7A160657CB3E460F0F35] [SPRF][27/01/2010] (...) -- C:\ProgramData\FullRemove.exe [131472]
[MD5.7EFA501C050F35610A750928C8F246BE] [SPRF][07/10/2013] (...) -- C:\Users\Alatte\AppData\Roaming\wklnhst.dat [226]
[MD5.FC05CF5526BA0C9CCDEB02BB61503ED1] [SPRF][29/04/2013] (...) -- C:\Users\Alatte\Desktop\avira_free_antivirus_fr.exe [104833992]
~ Files: 7 Legitimates Filtered in 00mn 02s



---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "70140BF22CB7C94419A535B0925B0EEF" . (.UE3Redist.) -- C:\Windows\Installer\{2FB04107-7BC2-449C-915A-530B29B5E0FE}\ARPPRODUCTICON.exe
~ Update Products: 155 Legitimates Filtered in 00mn 00s



---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.23E107196CB1CB6E66C5689C8EC06C1C] [WIS][02/07/2009] (.Nokia - PC Connectivity Solution.) -- C:\Windows\Installer\1516a1.msi [21368832]
~ WIS: 162 Legitimates Filtered in 00mn 23s



---\\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 11/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 08/10/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 24/07/2013 239616 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 10/09/2013 84024 | (AntiVirSchedulerService) . (.Avira Operations GmbH Co. KG.) - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
SR - | Auto 10/09/2013 108088 | (AntiVirService) . (.Avira Operations GmbH Co. KG.) - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
SR - | Auto 28/08/2009 1150496 | (Greg_Service) . (.Acer Incorporated.) - C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
SS - | Auto 15/12/2011 136176 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 15/12/2011 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 03/04/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
SR - | Auto 28/03/2012 140456 | (IJPLMSVC) . (...) - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.exe
SR - | Auto 04/08/2013 2650960 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe
SS - | Demand 01/10/2013 118680 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Demand 01/02/2010 305520 | (MWLService) . (.Egis Technology Inc..) - C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
SS - | Demand 22/08/2013 18360 | (OverwolfUpdaterService) . (.Overwolf Ltd.) - C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe
SR - | Auto 10/07/1658 0 | (PnkBstrA) . (...) - C:\Windows\system32\PnkBstrA.exe
SR - | Auto 03/02/2010 244904 | (RichVideo) . (...) - C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe
SS - | Demand 11/11/2008 620544 | (ServiceLayer) . (.Nokia..) - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
SS - | Auto 03/06/2013 162408 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Demand 21/09/2013 565672 | (Steam Client Service) . (.Valve Corporation.) - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
SR - | Auto 29/01/2010 243232 | (Updater Service) . (.Acer Group.) - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
SR - | Auto 09/12/2009 76320 | (USBS3S4Detection) . (...) - C:\OEM\USBDECTION\USBS3S4Detection.exe
SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SS - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\system32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 25s



---\\ Scan Additionnel (O88)
Database Version : 12960 - (28/10/2013)
Clés trouvées (Keys found) : 11
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 0

[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF] =Toolbar.AVGSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar] =Toolbar.AskTBar
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OpenCandyHelperRunOnce] =Adware.OpenCandy
~ Additionnel Scan: 299867 Items scanned in 00mn 31s



---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com/apps/blo ... cker-wwwdo =Hijacker.wwwDo
~ http://nicolascoolman.webs.com/apps/blo ... oolbar-ask =Toolbar.Ask
~ http://nicolascoolman.webs.com/apps/blo ... -opencandy =Adware.OpenCandy
~ MSI: 3 link(s) detected in 00mn 31s



~ 2574 Legitimates filtered by white list
End of the scan (445 lines in 03mn 28s)(0)

voila tout est fait bonne journee a+

[roro04]

Re,

Bien

/!\ Le script proposé ci-dessous n'est valable que pour l'helpé en cours /!\

• Télécharge OTM (de Olt_Timer) sur ton bureau.
• Lance-le (Clique droit/Exécuter en tant qu'administrateur pour Vista/7)
• Dans la partie de gauche, copie/colle les lignes suivantes.
  
  :processes
  iexplorer.exe
  firefox.exe
  chrome.exe
  
  :reg
  [HKEY_CURRENT_USER\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main]
  "Start Page"="http://www.google.fr/"
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7]
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8]
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01]
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED]
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF]
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472]
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296]
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888]
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar]
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main]
  "Start Page"="http://www.google.fr/"
  [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OpenCandyHelperRunOnce]
  
  :commands
  [EMPTYTEMP]
  [REBOOT]
• Clique sur Movelt!.
• Patiente le temps du nettoyage, ton ordinateur va redémarrer.
• Poste le rapport situé sous C:\_OTM\MovedFiles\[MMJJAAAA_***].txt
  précédemment hébergé sur http://www.cjoint.com

Ensuite suis ce tuto http://www.forum-entraide-informatique. ... e-tutoriel
Ensuite refais un ZHPDiag.

Bonne soirée,
@+

[dav86]

salut

http://cjoint.com/?CJEmG6TXcBf

ok c est fait a+

[dav86]

re le rapport apres avoir lu le tutoriel
http://cjoint.com/?CJEmWzYL578
je t envoi le rapport de zhpdiag.

[dav86]

~ Rapport de ZHPDiag v2013.10.28.74 - Nicolas Coolman (28/10/2013)
~ Lancé par Alatte (30/10/2013 12:50:59)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user


---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16721
MFIE: Mozilla Firefox 24.0 (Defaut)
GCIE: Google Chrome v30.0.1599.101

---\\ Informations sur les produits Windows
~ Langage: Français
Windows Vista Home Premium Edition, 64-bit (Build 6000)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 7QJB7
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK

---\\ Logiciels de protection du système
Avira Free Antivirus v13.0.0.4042
Malwarebytes Anti-Malware version 1.75.0.1300

---\\ Logiciels d'optimisation du système
CCleaner v3.20 =Piriform Ltd

---\\ Logiciels de partage PeerToPeer
Pando Media Booster v2.6.0.8

---\\ Surveillance de Logiciels
Adobe Flash Player 11 Plugin
Adobe Reader XI
Java 7 Update 7
Java 7 Update 45

---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 37 Stepping 2, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 6135 MB (72% free)
System Restore: Activé (Enable)
System drive C: has 266 GB (57%) free of 459 GB

---\\ Mode de connexion au système
~ Computer Name: ALATTE-PC
~ User Name: Alatte
~ All Users Names: sandrine, Alatte, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Alatte\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Alatte\AppData\Roaming\
~ %Desktop% : C:\Users\Alatte\Desktop\
~ %Favorites% : C:\Users\Alatte\Favorites\
~ %LocalAppData% : C:\Users\Alatte\AppData\Local\
~ %StartMenu% : C:\Users\Alatte\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 266 Go of 459 Go)
D: Hard drive, Flash drive, Thumb drive (Free 458 Go of 459 Go)
E: CD-ROM drive (Not Inserted)
F: Floppy drive, Flash card reader, USB Key (Not Inserted)
G: Floppy drive, Flash card reader, USB Key (Not Inserted)



---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: 41 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.D28B35DE88D27EFB27DF4B1E8319E3C0] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.22/09/2013 - 23:55:10.) -- C:\Windows\System32\wininet.dll [2241024]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.314C17917AC8523EC77A710215012A65] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.14/09/2013 - 02:10:19.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/5
~ Mes Videos (My Videos) : 1/2
~ Mes Favoris (My Favorites) : 1/65
~ Mes Documents (My Documents) : 1/667
~ Mon Bureau (My Desktop) : 1/28
~ Menu demarrer (Programs) : 1/50
~ Hidden Files: Scanned in 00mn 00s



---\\ Processus lancés
[MD5.89F7B7CCC82D7E6FF9832FE3D24988C4] - (.Egis Technology Inc. - MyWinLocker.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552] [PID.920]
[MD5.4458989C34FA84B5A75DD3ABCFBE786A] - (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624] [PID.252]
[MD5.F0EA603E7B91046CA48EA4B3593A007D] - (.Micro Application - Pas de description.) -- C:\Program Files (x86)\Micro Application\LauncherMA.exe [485376] [PID.2956]
[MD5.27964C4676D0F4B34DB7332AFA2B1474] - (.Egis Technology Inc. - PMM Update Application.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [401192] [PID.552]
[MD5.AD16557CECFB17CF7393D28DC40F6D09] - (.Pas de propriétaire - Hotkey Utility.) -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [563744] [PID.3080]
[MD5.80C1D422AAE807CF20A5E353EB8B5661] - (.CyberLink Corp. - Arcade Movie Resident Program.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe [124136] [PID.3120]
[MD5.DB3F7F19F942D3CE4E1A0E8D9FF541FB] - (.Avira Operations GmbH Co. KG - Avira System Tray Tool.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192] [PID.3164]
[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336] [PID.3188]
[MD5.6C695B04E2E29459CDC2E5C0970B883B] - (.Egis Technology Inc. - EgisUpdate Release Application.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201512] [PID.3720]
[MD5.A9182CE59CFC56F9C1DDE8B3C0AE8378] - (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [274840] [PID.3440]
[MD5.12FD4EF8F2CBBF98E0A5CED88258DDF3] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe [17816] [PID.2000]
[MD5.EB68851F020D35293EADAADEB18B8220] - (.Adobe Systems, Inc. - Adobe Flash Player 11.9 r900.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe [1862536] [PID.248]
[MD5.3B605772669BDFD6DC266B9320E87B45] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8143872] [PID.468]
[MD5.8769E2D1072B62AB071F166F03B3E3DC] - (.Avira Operations GmbH Co. KG - Avira Scheduler.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024] [PID.1436]
[MD5.ADDA5E1951B90D3D23C56D3CF0622ADC] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65640] [PID.1620]
[MD5.AD1D13E6326E0B8DA2A7BE13B39A8FE0] - (.Avira Operations GmbH Co. KG - Avira On-Access Service.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088] [PID.1660]
[MD5.816FD5A6F3C2F3D600900096632FC60E] - (.Acer Incorporated - Global Registration Service.) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe [1150496] [PID.1700]
[MD5.EDCCC8C13B1EB882F77BA0ABB84566E7] - (.Pas de propriétaire - Inkjet Printer/Scanner/Fax Extended Survey.) -- C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.exe [140456] [PID.1760]
[MD5.3A2BDD76E7D2A5F40A7174793D1BA794] - (...) -- C:\Windows\SysWOW64\PnkBstrA.exe [75136] [PID.1836]
[MD5.F12A68ED55053940CADD59CA5E3468DD] - (.Pas de propriétaire - RichVideo Module.) -- C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe [244904] [PID.1860]
[MD5.F9EC9ACD504D823D9B9CA98A4F8D3CA2] - (.Acer Group - Updater Service.) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe [243232] [PID.2004]
[MD5.B5E6C4F280EBF0B16F74A5B415F2E0DF] - (.Pas de propriétaire - USB S3S4 Detection.) -- C:\OEM\USBDECTION\USBS3S4Detection.exe [76320] [PID.2040]
~ Processes Running: Scanned in 00mn 00s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Alatte\AppData\Local\Google\Chrome\User Data\Default\Preferences
~ Google Browser: 12 Legitimates Filtered in 00mn 06s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Alatte\AppData\Roaming\Mozilla\Firefox\Profiles\hl5cnu5x.default-1381266156581\prefs.js
~ Firefox Browser: 8 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Acrobat Reader 5.0.lnk . (.Adobe Systems Incorporated - Acrobat Reader 5.0.) -- C:\Program Files (x86)\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
O4 - GS\Desktop [Public]: Canon Quick Menu.lnk . (.CANON INC. - Canon Quick Menu.) -- C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.exe
O4 - GS\Desktop [Public]: chrome.exe.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [Public]: firefox.exe.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Desktop [Public]: OpenOffice 4.0.0.lnk . (.Apache Software Foundation - OpenOffice 4.0.0.) -- C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
O4 - GS\Desktop [Public]: TeamSpeak 3 Client.lnk . (.TeamSpeak Systems GmbH - TeamSpeak 3 Client.) -- C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe
O4 - GS\Program [Public]: Acrobat Reader 5.0.lnk . (.Adobe Systems Incorporated - Acrobat Reader 5.0.) -- C:\Program Files (x86)\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
O4 - GS\Program [Public]: firefox.exe.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\QuickLaunch [sandrine]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\QuickLaunch [sandrine]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [sandrine]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [sandrine]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Program [sandrine]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [sandrine]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [sandrine]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\Desktop [sandrine]: Ubi Soft Product Registration.lnk . (.Ubi Soft - Pas de description.) -- C:\Program Files (x86)\Ubi Soft\Register\register.exe
O4 - GS\QuickLaunch [Alatte]: chrome.exe.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Alatte]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\QuickLaunch [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Program [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Accessories [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SendTo [Alatte]: Xfire Ami(e).lnk . (...) -- C:\Program Files (x86)\Xfire\Xfire.exe (.not file.)
O4 - GS\Desktop [Alatte]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\Desktop [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Alatte]: OTM - Raccourci.lnk . (.OldTimer Tools - Pas de description.) -- C:\Users\Alatte\Downloads\OTM.exe
O4 - GS\Desktop [Alatte]: ZHPFix.lnk . (.Nicolas Coolman - ZHPDiag Setup.) -- C:\Program Files (x86)\ZHPDiag\ZHPFix\ZHPhep.exe =.Nicolas Coolman
~ Global Startup: 102 Legitimates Filtered in 00mn 03s



---\\ Applications lancées au démarrage du sytème (O4)
O4 - GS\Startup [Alatte]: Lanceur.lnk . (.Micro Application - Pas de description.) -- C:\Program Files (x86)\Micro Application\LauncherMA.exe
O4 - GS\Startup [Alatte]: Registration .LNK . (...) -- C:\Program Files (x86)\Ubisoft\Tom Clancy's Splinter Cell Double Agent\support\Register\Reg.exe (.not file.)
O4 - HKLM\..\Run: [mwlDaemon] . (.Egis Technology Inc. - MyWinLocker.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =.Realtek Semiconductor Corp
O4 - HKCU\..\Run: [Pando Media Booster] . (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
O4 - HKLM\..\Wow6432Node\Run: [SuiteTray] . (.Egis Technology Inc. - SuiteTray.) -- C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe
O4 - HKLM\..\Wow6432Node\Run: [EgisUpdate] . (.Egis Technology Inc. - EgisUpdate Release Application.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [EgisTecPMMUpdate] . (.Egis Technology Inc. - PMM Update Application.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [Hotkey Utility] . (.Pas de propriétaire - Hotkey Utility.) -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
O4 - HKLM\..\Wow6432Node\Run: [MDS_Menu] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Wow6432Node\Run: [ArcadeMovieService] . (.CyberLink Corp. - Arcade Movie Resident Program.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [avgnt] . (.Avira Operations GmbH Co. KG - Avira System Tray Tool.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe =.Advanced Micro Devices, Inc
O4 - HKLM\..\Wow6432Node\Run: [CanonQuickMenu] . (.CANON INC. - Canon Quick Menu.) -- C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.exe
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =.Oracle Corporation
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-21-337464992-296471290-3356353711-1000\..\Run: [Pando Media Booster] . (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
~ Application: Scanned in 00mn 00s



---\\ Site dans la Zone de confiance d'Internet Explorer (O15)
O15 - Trusted Zone: [HKCU\...\Domains] http.ma-config.com
O15 - Trusted Zone: [HKCU\...\Domains] http.touslesdrivers.com
~ IE Zone Confiance: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CS1\Services\Tcpip\..\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CS2\Services\Tcpip\..\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.241 212.27.40.240
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll =.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [Go for FilesUpdate] (...) -- C:\Program Files (x86)\GoforFiles\GFFUpdater.exe (.not file.) [0] =P2P.GoforFiles
[MD5.00000000000000000000000000000000] [APT] [{12057A87-6954-4D95-BCF4-1870896417FD}] (...) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{2479915F-EC78-4E9B-8546-3DA8189B0AC6}] (...) -- C:\Program Files (x86)\Illusion Softworks\Hidden Dangerous 2\hd2.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{278243B5-6EBF-49BD-B40A-7A5BF92FFFD8}] (...) -- E:\Setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{32531348-75F0-43BA-843A-4DF2A1547216}] (...) -- E:\Setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{38C1E288-0CD4-428D-ADC0-6174A9904F97}] (...) -- E:\setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{503F180A-D616-495E-BF81-A597E44ADAF0}] (...) -- E:\Setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{68583218-406A-44A9-8521-5D560795A2B7}] (...) -- C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{9D91A3C0-95F8-4F7A-9032-82F944226937}] (...) -- E:\SETUP.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{B9361F11-902B-4607-87BB-FC7FDF924331}] (...) -- C:\Program Files\Bohemia Interactive\ArmA\arma.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{F31478B2-9672-4546-AB4F-D32E87AB604E}] (...) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (.not file.) [0]
~ Scheduled Task: 26 Legitimates Filtered in 00mn 06s



---\\ HKCU HKLM Software Keys
[HKCU\Software\Pando Networks]
[HKLM\Software\Wow6432Node\IncrediMail]
[HKLM\Software\Wow6432Node\Pando Networks]
~ Key Software: 273 Legitimates Filtered in 00mn 00s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 11/04/2012 - 23:15:41 - [7,234] ----D C:\Program Files (x86)\Pando Networks
O43 - CFD: 16/07/2012 - 19:09:40 - [0,001] ----D C:\Users\Alatte\AppData\Local\reakktor
~ 1216 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 1501 Legitimates Filtered in 00mn 26s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.D39DB3CDBBC6488ED74A5ACC01BA4DCA] - 25/10/2013 - 12:35:11 ---A- . (...) -- C:\Windows\ntbtlog.txt [150616]
O44 - LFC:[MD5.B88F8D738C1B5A1B8F06544DE658ECB9] - 30/10/2013 - 12:41:37 ---A- . (...) -- C:\rapport.txt [413]
~ Files: 17 Legitimates Filtered in 01mn 02s



---\\ Enumération des clés de registre StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\Overwolf [Key] . (.Overwolf - Overwolf.) -- C:\Program Files (x86)\Overwolf\Overwolf.exe
~ SMSR Keys: 4 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.B8B7DF85909DE0E0DA5B8E1BF67EF033] - 06/03/2013 - 20:50:17 ---A- . (.Protect Software GmbH - ProtectDisc Filter Driver x64.) -- C:\Windows\System32\Drivers\acedrv10.sys [276480]
O58 - SDL:[MD5.CE4B6956E4E12492715A53076E58761F] - 09/11/2009 - 00:42:00 ---A- . (.Teruten Inc - File System Mini Filter Drvier.) -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys [16392]
~ Drivers: 16 Legitimates Filtered in 00mn 00s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 06/03/2013 - C:\Windows\system32\drivers\acedrv10.sys (acedrv10) .(.Protect Software GmbH - ProtectDisc Filter Driver x64.) - LEGACY_ACEDRV10
~ Legacy: 93 Legitimates Filtered in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- searches.com\?utm_source=butm_medium=s32utm_campaign=eXQutm_content=scfrom=s32uid=WDCXWD10EARS-22Y5B1_WD-WCAV5A19477494774ts=1381152335 C:\Program Files (x86)\Mozilla Firefox\firefox.exe" http://www.do
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- searches.com\?utm_source=butm_medium=s32utm_campaign=eXQutm_content=scfrom=s32uid=WDCXWD10EARS-22Y5B1_WD-WCAV5A19477494774ts=1381152335 C:\Program Files\Internet Explorer\iexplore.exe http://www.do =Hijacker.wwwDo
~ Keys: Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com
~ Keys: Scanned in 00mn 00s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.6ACBD475647D7A160657CB3E460F0F35] [SPRF][27/01/2010] (...) -- C:\ProgramData\FullRemove.exe [131472]
[MD5.7EFA501C050F35610A750928C8F246BE] [SPRF][07/10/2013] (...) -- C:\Users\Alatte\AppData\Roaming\wklnhst.dat [226]
[MD5.FC05CF5526BA0C9CCDEB02BB61503ED1] [SPRF][29/04/2013] (...) -- C:\Users\Alatte\Desktop\avira_free_antivirus_fr.exe [104833992]
~ Files: 6 Legitimates Filtered in 00mn 02s



---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "70140BF22CB7C94419A535B0925B0EEF" . (.UE3Redist.) -- C:\Windows\Installer\{2FB04107-7BC2-449C-915A-530B29B5E0FE}\ARPPRODUCTICON.exe
~ Update Products: 155 Legitimates Filtered in 00mn 00s



---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.23E107196CB1CB6E66C5689C8EC06C1C] [WIS][02/07/2009] (.Nokia - PC Connectivity Solution.) -- C:\Windows\Installer\1516a1.msi [21368832]
~ WIS: 162 Legitimates Filtered in 00mn 24s



---\\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 11/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 08/10/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 24/07/2013 239616 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 10/09/2013 84024 | (AntiVirSchedulerService) . (.Avira Operations GmbH Co. KG.) - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
SR - | Auto 10/09/2013 108088 | (AntiVirService) . (.Avira Operations GmbH Co. KG.) - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
SR - | Auto 28/08/2009 1150496 | (Greg_Service) . (.Acer Incorporated.) - C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
SS - | Auto 15/12/2011 136176 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 15/12/2011 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 03/04/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
SR - | Auto 28/03/2012 140456 | (IJPLMSVC) . (...) - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.exe
SR - | Auto 04/08/2013 2650960 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe
SS - | Demand 01/10/2013 118680 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Demand 01/02/2010 305520 | (MWLService) . (.Egis Technology Inc..) - C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
SS - | Demand 22/08/2013 18360 | (OverwolfUpdaterService) . (.Overwolf Ltd.) - C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe
SR - | Auto 10/07/1658 0 | (PnkBstrA) . (...) - C:\Windows\system32\PnkBstrA.exe
SR - | Auto 03/02/2010 244904 | (RichVideo) . (...) - C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe
SS - | Demand 11/11/2008 620544 | (ServiceLayer) . (.Nokia..) - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
SS - | Auto 03/06/2013 162408 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Demand 21/09/2013 565672 | (Steam Client Service) . (.Valve Corporation.) - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
SR - | Auto 29/01/2010 243232 | (Updater Service) . (.Acer Group.) - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
SR - | Auto 09/12/2009 76320 | (USBS3S4Detection) . (...) - C:\OEM\USBDECTION\USBS3S4Detection.exe
SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SS - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\system32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 26s



---\\ Scan Additionnel (O88)
Database Version : 12960 - (28/10/2013)
Clés trouvées (Keys found) : 11
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 0

[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF] =Toolbar.AVGSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar] =Toolbar.AskTBar
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OpenCandyHelperRunOnce] =Adware.OpenCandy
~ Additionnel Scan: 299534 Items scanned in 00mn 31s



---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com/apps/blo ... cker-wwwdo =Hijacker.wwwDo
~ http://nicolascoolman.webs.com/apps/blo ... oolbar-ask =Toolbar.Ask
~ http://nicolascoolman.webs.com/apps/blo ... -opencandy =Adware.OpenCandy
~ MSI: 3 link(s) detected in 00mn 31s



~ 2576 Legitimates filtered by white list
End of the scan (440 lines in 03mn 08s)(0)

voila tout est envoyer bonne journee a+

[roro04]

Salut !

Arf il reste quelques traces.


On va faire un scan généraliste de ton PC

• Télécharges Malwarebytes sur ton bureau.
• Lance le. Laisse les options par défaut lors de l'installation. A la fin, il va se mettre à jour, laisse-le faire.
• Branche toutes tes sources de données externes à ton PC. (Clés USB...)
• Rends-toi dans l'onglet Recherche, clique sur Exécuter un examen complet puis clique sur Rechercher.
• Sélectionnes tes disques durs et disques amovibles puis clique sur Rechercher
• A la fin du scan, un rapport s'ouvre. Clique sur Fichier puis sur Enregistrer sous. Clique sur Bureau et met le nom Malwarebytes.
• Si MalwareBytes détecte des infections, clique sur Afficher les résultats, puis sur Supprimer la sélection.
• Si Malwarebytes te demande de redémarrer ton pc, clique sur Oui.
• Poste le rapport.
  
  !!! Ne pas vider la quarantaine de MBAM sans avis !!!
  
  Tuto pour t'aider Ici

Ensuite refais un ZHPDiag.

Bonne soirée,
@+

[dav86]

salut ok pas de souci

Malwarebytes Anti-Malware (Essai) 1.75.0.1300
http://www.malwarebytes.org

Version de la base de données: v2013.10.31.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16721
Alatte :: ALATTE-PC [administrateur]

Protection: Activé

31/10/2013 15:27:14
mbam-log-2013-10-31 (15-27-14).txt

Type d'examen: Examen complet (C:\|D:\|E:\|F:\|G:\|)
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 391538
Temps écoulé: 59 minute(s), 8 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 1
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Default_Page_URL (PUP.Optional.DoSearches) - Mauvais: (http://www.dosearches.com/?utm_source=b ... 1381152335) Bon: (http://www.google.com) - Mis en quarantaine et réparé avec succès

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 7
C:\Program Files (x86)\RealArcade\Installer\bin\OCSetupHlp.dll (PUP.Optional.OpenCandy) - Mis en quarantaine et supprimé avec succès.
C:\Users\Alatte\Downloads\openoffice setup.exe (PUP.Optional.Soft32.A) - Mis en quarantaine et supprimé avec succès.
C:\Users\Alatte\Downloads\Setup.exe (PUP.Optional.Ibryte) - Mis en quarantaine et supprimé avec succès.
C:\Users\Alatte\Downloads\SoftonicDownloader_pour_avira-free-antivirus-2013.exe (PUP.Optional.Softonic) - Mis en quarantaine et supprimé avec succès.
C:\Users\Alatte\Downloads\SoftonicDownloader_pour_teamspeak.exe (PUP.Optional.Softonic.A) - Mis en quarantaine et supprimé avec succès.
C:\Users\Alatte\Downloads\SoftonicDownloader_pour_unity-web-player.exe (PUP.Optional.Softonic.A) - Mis en quarantaine et supprimé avec succès.
C:\Users\Alatte\Downloads\version_actuelle_du_plugin_unity_player_downloader_98935.exe (PUP.Optional.GoForFiles.A) - Mis en quarantaine et supprimé avec succès.

(fin)

[dav86]

~ Rapport de ZHPDiag v2013.10.30.78 - Nicolas Coolman (30/10/2013)
~ Lancé par Alatte (31/10/2013 17:03:20)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user


---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16721
MFIE: Mozilla Firefox 25.0 (Defaut)
GCIE: Google Chrome v30.0.1599.101

---\\ Informations sur les produits Windows
~ Langage: Français
Windows Vista Home Premium Edition, 64-bit (Build 6000)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 7QJB7
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK

---\\ Logiciels de protection du système
Avira Free Antivirus v13.0.0.4042
Malwarebytes Anti-Malware version 1.75.0.1300

---\\ Logiciels d'optimisation du système
CCleaner v3.20 =Piriform Ltd

---\\ Logiciels de partage PeerToPeer
Pando Media Booster v2.6.0.8

---\\ Surveillance de Logiciels
Adobe Flash Player 11 Plugin
Adobe Reader XI
Java 7 Update 7
Java 7 Update 45

---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 37 Stepping 2, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 6135 MB (72% free)
System Restore: Activé (Enable)
System drive C: has 262 GB (57%) free of 459 GB

---\\ Mode de connexion au système
~ Computer Name: ALATTE-PC
~ User Name: Alatte
~ All Users Names: sandrine, Alatte, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Alatte\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Alatte\AppData\Roaming\
~ %Desktop% : C:\Users\Alatte\Desktop\
~ %Favorites% : C:\Users\Alatte\Favorites\
~ %LocalAppData% : C:\Users\Alatte\AppData\Local\
~ %StartMenu% : C:\Users\Alatte\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 262 Go of 459 Go)
D: Hard drive, Flash drive, Thumb drive (Free 458 Go of 459 Go)
E: CD-ROM drive (Free 0 Go of 6 Go)
F: Floppy drive, Flash card reader, USB Key (Not Inserted)
G: Floppy drive, Flash card reader, USB Key (Not Inserted)



---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: 41 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.D28B35DE88D27EFB27DF4B1E8319E3C0] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.22/09/2013 - 23:55:10.) -- C:\Windows\System32\wininet.dll [2241024]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.314C17917AC8523EC77A710215012A65] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.14/09/2013 - 02:10:19.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/5
~ Mes Videos (My Videos) : 1/2
~ Mes Favoris (My Favorites) : 1/65
~ Mes Documents (My Documents) : 1/697
~ Mon Bureau (My Desktop) : 1/28
~ Menu demarrer (Programs) : 1/50
~ Hidden Files: Scanned in 00mn 01s



---\\ Processus lancés
[MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.740]
[MD5.89F7B7CCC82D7E6FF9832FE3D24988C4] - (.Egis Technology Inc. - MyWinLocker.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552] [PID.2696]
[MD5.4458989C34FA84B5A75DD3ABCFBE786A] - (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624] [PID.1248]
[MD5.F0EA603E7B91046CA48EA4B3593A007D] - (.Micro Application - Pas de description.) -- C:\Program Files (x86)\Micro Application\LauncherMA.exe [485376] [PID.2092]
[MD5.27964C4676D0F4B34DB7332AFA2B1474] - (.Egis Technology Inc. - PMM Update Application.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [401192] [PID.3144]
[MD5.AD16557CECFB17CF7393D28DC40F6D09] - (.Pas de propriétaire - Hotkey Utility.) -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [563744] [PID.3192]
[MD5.80C1D422AAE807CF20A5E353EB8B5661] - (.CyberLink Corp. - Arcade Movie Resident Program.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe [124136] [PID.3356]
[MD5.DB3F7F19F942D3CE4E1A0E8D9FF541FB] - (.Avira Operations GmbH Co. KG - Avira System Tray Tool.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192] [PID.3528]
[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336] [PID.3808]
[MD5.6C695B04E2E29459CDC2E5C0970B883B] - (.Egis Technology Inc. - EgisUpdate Release Application.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201512] [PID.3372]
[MD5.EF01D104449CC654FDCF423C92BD8846] - (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [275568] [PID.2780]
[MD5.2A43A30EF7FCFD1284F8C3318B784A68] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe [18544] [PID.3076]
[MD5.EB68851F020D35293EADAADEB18B8220] - (.Adobe Systems, Inc. - Adobe Flash Player 11.9 r900.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe [1862536] [PID.2072]
[MD5.A7766D3BCB614BC77AA06579D84AE8ED] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8153600] [PID.2440]
[MD5.8769E2D1072B62AB071F166F03B3E3DC] - (.Avira Operations GmbH Co. KG - Avira Scheduler.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024] [PID.1408]
[MD5.ADDA5E1951B90D3D23C56D3CF0622ADC] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65640] [PID.1600]
[MD5.AD1D13E6326E0B8DA2A7BE13B39A8FE0] - (.Avira Operations GmbH Co. KG - Avira On-Access Service.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088] [PID.1644]
[MD5.816FD5A6F3C2F3D600900096632FC60E] - (.Acer Incorporated - Global Registration Service.) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe [1150496] [PID.1688]
[MD5.EDCCC8C13B1EB882F77BA0ABB84566E7] - (.Pas de propriétaire - Inkjet Printer/Scanner/Fax Extended Survey.) -- C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.exe [140456] [PID.1736]
[MD5.65085456FD9A74D7F1A999520C299ECB] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376] [PID.1804]
[MD5.E0D7732F2D2E24B2DB3F67B6750295B8] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512] [PID.1832]
[MD5.3A2BDD76E7D2A5F40A7174793D1BA794] - (...) -- C:\Windows\SysWOW64\PnkBstrA.exe [75136] [PID.1872]
[MD5.F12A68ED55053940CADD59CA5E3468DD] - (.Pas de propriétaire - RichVideo Module.) -- C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe [244904] [PID.1900]
[MD5.F9EC9ACD504D823D9B9CA98A4F8D3CA2] - (.Acer Group - Updater Service.) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe [243232] [PID.2024]
[MD5.B5E6C4F280EBF0B16F74A5B415F2E0DF] - (.Pas de propriétaire - USB S3S4 Detection.) -- C:\OEM\USBDECTION\USBS3S4Detection.exe [76320] [PID.1192]
~ Processes Running: Scanned in 00mn 00s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Alatte\AppData\Local\Google\Chrome\User Data\Default\Preferences
~ Google Browser: 12 Legitimates Filtered in 00mn 06s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Alatte\AppData\Roaming\Mozilla\Firefox\Profiles\hl5cnu5x.default-1381266156581\prefs.js
~ Firefox Browser: 8 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Acrobat Reader 5.0.lnk . (.Adobe Systems Incorporated - Acrobat Reader 5.0.) -- C:\Program Files (x86)\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
O4 - GS\Desktop [Public]: Canon Quick Menu.lnk . (.CANON INC. - Canon Quick Menu.) -- C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.exe
O4 - GS\Desktop [Public]: chrome.exe.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [Public]: firefox.exe.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Desktop [Public]: OpenOffice 4.0.0.lnk . (.Apache Software Foundation - OpenOffice 4.0.0.) -- C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
O4 - GS\Desktop [Public]: TeamSpeak 3 Client.lnk . (.TeamSpeak Systems GmbH - TeamSpeak 3 Client.) -- C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe
O4 - GS\Program [Public]: Acrobat Reader 5.0.lnk . (.Adobe Systems Incorporated - Acrobat Reader 5.0.) -- C:\Program Files (x86)\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
O4 - GS\Program [Public]: firefox.exe.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\QuickLaunch [sandrine]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\QuickLaunch [sandrine]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [sandrine]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [sandrine]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Program [sandrine]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [sandrine]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [sandrine]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\Desktop [sandrine]: Ubi Soft Product Registration.lnk . (.Ubi Soft - Pas de description.) -- C:\Program Files (x86)\Ubi Soft\Register\register.exe
O4 - GS\QuickLaunch [Alatte]: chrome.exe.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Alatte]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\QuickLaunch [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Program [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Accessories [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SendTo [Alatte]: Xfire Ami(e).lnk . (...) -- C:\Program Files (x86)\Xfire\Xfire.exe (.not file.)
O4 - GS\Desktop [Alatte]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\Desktop [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Alatte]: OTM - Raccourci.lnk . (.OldTimer Tools - Pas de description.) -- C:\Users\Alatte\Downloads\OTM.exe
O4 - GS\Desktop [Alatte]: ZHPFix.lnk . (.Nicolas Coolman - ZHPDiag Setup.) -- C:\Program Files (x86)\ZHPDiag\ZHPFix\ZHPhep.exe =.Nicolas Coolman
~ Global Startup: 102 Legitimates Filtered in 00mn 04s



---\\ Applications lancées au démarrage du sytème (O4)
O4 - GS\Startup [Alatte]: Lanceur.lnk . (.Micro Application - Pas de description.) -- C:\Program Files (x86)\Micro Application\LauncherMA.exe
O4 - GS\Startup [Alatte]: Registration .LNK . (...) -- C:\Program Files (x86)\Ubisoft\Tom Clancy's Splinter Cell Double Agent\support\Register\Reg.exe (.not file.)
O4 - HKLM\..\Run: [mwlDaemon] . (.Egis Technology Inc. - MyWinLocker.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =.Realtek Semiconductor Corp
O4 - HKCU\..\Run: [Pando Media Booster] . (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
O4 - HKLM\..\Wow6432Node\Run: [SuiteTray] . (.Egis Technology Inc. - SuiteTray.) -- C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe
O4 - HKLM\..\Wow6432Node\Run: [EgisUpdate] . (.Egis Technology Inc. - EgisUpdate Release Application.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [EgisTecPMMUpdate] . (.Egis Technology Inc. - PMM Update Application.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [Hotkey Utility] . (.Pas de propriétaire - Hotkey Utility.) -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
O4 - HKLM\..\Wow6432Node\Run: [MDS_Menu] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Wow6432Node\Run: [ArcadeMovieService] . (.CyberLink Corp. - Arcade Movie Resident Program.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [avgnt] . (.Avira Operations GmbH Co. KG - Avira System Tray Tool.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe =.Advanced Micro Devices, Inc
O4 - HKLM\..\Wow6432Node\Run: [CanonQuickMenu] . (.CANON INC. - Canon Quick Menu.) -- C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.exe
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =.Oracle Corporation
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-21-337464992-296471290-3356353711-1000\..\Run: [Pando Media Booster] . (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
~ Application: Scanned in 00mn 00s



---\\ Site dans la Zone de confiance d'Internet Explorer (O15)
O15 - Trusted Zone: [HKCU\...\Domains] http.ma-config.com
O15 - Trusted Zone: [HKCU\...\Domains] http.touslesdrivers.com
~ IE Zone Confiance: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CS1\Services\Tcpip\..\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CS2\Services\Tcpip\..\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.241 212.27.40.240
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll =.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [Go for FilesUpdate] (...) -- C:\Program Files (x86)\GoforFiles\GFFUpdater.exe (.not file.) [0] =P2P.GoforFiles
[MD5.00000000000000000000000000000000] [APT] [{12057A87-6954-4D95-BCF4-1870896417FD}] (...) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{2479915F-EC78-4E9B-8546-3DA8189B0AC6}] (...) -- C:\Program Files (x86)\Illusion Softworks\Hidden Dangerous 2\hd2.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{68583218-406A-44A9-8521-5D560795A2B7}] (...) -- C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{B9361F11-902B-4607-87BB-FC7FDF924331}] (...) -- C:\Program Files\Bohemia Interactive\ArmA\arma.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{F31478B2-9672-4546-AB4F-D32E87AB604E}] (...) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (.not file.) [0]
~ Scheduled Task: 26 Legitimates Filtered in 00mn 09s



---\\ Logiciels installés (O42)
O42 - Logiciel: Spec Ops: The Line - (.Yager.) [HKLM][64Bits] -- Steam App 50300
~ Logic: 115 Legitimates Filtered in 00mn 00s



---\\ HKCU HKLM Software Keys
[HKCU\Software\Pando Networks]
[HKLM\Software\Wow6432Node\IncrediMail]
[HKLM\Software\Wow6432Node\Pando Networks]
~ Key Software: 274 Legitimates Filtered in 00mn 00s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 11/04/2012 - 23:15:41 - [7,234] ----D C:\Program Files (x86)\Pando Networks
O43 - CFD: 16/07/2012 - 19:09:40 - [0,001] ----D C:\Users\Alatte\AppData\Local\reakktor
~ 1216 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 1501 Legitimates Filtered in 00mn 48s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.D39DB3CDBBC6488ED74A5ACC01BA4DCA] - 25/10/2013 - 12:35:11 ---A- . (...) -- C:\Windows\ntbtlog.txt [150616]
O44 - LFC:[MD5.B88F8D738C1B5A1B8F06544DE658ECB9] - 30/10/2013 - 12:41:37 ---A- . (...) -- C:\rapport.txt [413]
O44 - LFC:[MD5.F25E5E8B160F7B1228137F65CF4459E6] - 30/10/2013 - 13:46:32 ---A- . (...) -- C:\Windows\DirectX.log [17551]
~ Files: 18 Legitimates Filtered in 00mn 54s



---\\ Clé de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{0b5ab857-893d-11e0-b816-806e6f6e6963}\AutoRun\command. (...) -- E:\Launcher.exe
~ Keys: Scanned in 00mn 00s



---\\ Enumération des clés de registre StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\Overwolf [Key] . (.Overwolf - Overwolf.) -- C:\Program Files (x86)\Overwolf\Overwolf.exe
~ SMSR Keys: 4 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.B8B7DF85909DE0E0DA5B8E1BF67EF033] - 06/03/2013 - 20:50:17 ---A- . (.Protect Software GmbH - ProtectDisc Filter Driver x64.) -- C:\Windows\System32\Drivers\acedrv10.sys [276480]
O58 - SDL:[MD5.CE4B6956E4E12492715A53076E58761F] - 09/11/2009 - 00:42:00 ---A- . (.Teruten Inc - File System Mini Filter Drvier.) -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys [16392]
~ Drivers: 16 Legitimates Filtered in 00mn 00s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 06/03/2013 - C:\Windows\system32\drivers\acedrv10.sys (acedrv10) .(.Protect Software GmbH - ProtectDisc Filter Driver x64.) - LEGACY_ACEDRV10
~ Legacy: 94 Legitimates Filtered in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- searches.com\?utm_source=butm_medium=s32utm_campaign=eXQutm_content=scfrom=s32uid=WDCXWD10EARS-22Y5B1_WD-WCAV5A19477494774ts=1381152335 C:\Program Files\Internet Explorer\iexplore.exe http://www.do =Hijacker.wwwDo
~ Keys: Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com
~ Keys: Scanned in 00mn 00s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.6ACBD475647D7A160657CB3E460F0F35] [SPRF][27/01/2010] (...) -- C:\ProgramData\FullRemove.exe [131472]
[MD5.7EFA501C050F35610A750928C8F246BE] [SPRF][07/10/2013] (...) -- C:\Users\Alatte\AppData\Roaming\wklnhst.dat [226]
[MD5.FC05CF5526BA0C9CCDEB02BB61503ED1] [SPRF][29/04/2013] (...) -- C:\Users\Alatte\Desktop\avira_free_antivirus_fr.exe [104833992]
~ Files: 6 Legitimates Filtered in 00mn 02s



---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "70140BF22CB7C94419A535B0925B0EEF" . (.UE3Redist.) -- C:\Windows\Installer\{2FB04107-7BC2-449C-915A-530B29B5E0FE}\ARPPRODUCTICON.exe
~ Update Products: 155 Legitimates Filtered in 00mn 00s



---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.23E107196CB1CB6E66C5689C8EC06C1C] [WIS][02/07/2009] (.Nokia - PC Connectivity Solution.) -- C:\Windows\Installer\1516a1.msi [21368832]
~ WIS: 162 Legitimates Filtered in 00mn 23s



---\\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 11/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 08/10/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 24/07/2013 239616 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 10/09/2013 84024 | (AntiVirSchedulerService) . (.Avira Operations GmbH Co. KG.) - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
SR - | Auto 10/09/2013 108088 | (AntiVirService) . (.Avira Operations GmbH Co. KG.) - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
SR - | Auto 28/08/2009 1150496 | (Greg_Service) . (.Acer Incorporated.) - C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
SS - | Auto 15/12/2011 136176 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 15/12/2011 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 03/04/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
SR - | Auto 28/03/2012 140456 | (IJPLMSVC) . (...) - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.exe
SR - | Auto 04/08/2013 2650960 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe
SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
SS - | Demand 30/10/2013 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Demand 01/02/2010 305520 | (MWLService) . (.Egis Technology Inc..) - C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
SS - | Demand 22/08/2013 18360 | (OverwolfUpdaterService) . (.Overwolf Ltd.) - C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe
SR - | Auto 10/07/1658 0 | (PnkBstrA) . (...) - C:\Windows\system32\PnkBstrA.exe
SR - | Auto 03/02/2010 244904 | (RichVideo) . (...) - C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe
SS - | Demand 11/11/2008 620544 | (ServiceLayer) . (.Nokia..) - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
SS - | Auto 03/06/2013 162408 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Demand 09/10/2013 565672 | (Steam Client Service) . (.Valve Corporation.) - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
SR - | Auto 29/01/2010 243232 | (Updater Service) . (.Acer Group.) - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
SR - | Auto 09/12/2009 76320 | (USBS3S4Detection) . (...) - C:\OEM\USBDECTION\USBS3S4Detection.exe
SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SS - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\system32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 24s



---\\ Scan Additionnel (O88)
Database Version : 12965 - (30/10/2013)
Clés trouvées (Keys found) : 11
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 0

[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF] =Toolbar.AVGSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar] =Toolbar.AskTBar
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OpenCandyHelperRunOnce] =Adware.OpenCandy
~ Additionnel Scan: 308459 Items scanned in 00mn 31s



---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com/apps/blo ... cker-wwwdo =Hijacker.wwwDo
~ http://nicolascoolman.webs.com/apps/blo ... oolbar-ask =Toolbar.Ask
~ http://nicolascoolman.webs.com/apps/blo ... -opencandy =Adware.OpenCandy
~ MSI: 3 link(s) detected in 00mn 31s



~ 2583 Legitimates filtered by white list
End of the scan (453 lines in 03mn 29s)(0)

voila bonne soiree a+

[roro04]

Bon on a toujours deux-trois lignes qui veulent pas virer... On va changer de stratégie.

Suis ce tuto pour réinitialiser Internet Explorer.
http://www.forum-entraide-informatique. ... t-explorer

Ensuite refais un ZHPDiag.

Bonne soirée,
@+

[dav86]

~ Rapport de ZHPDiag v2013.11.1.1 - Nicolas Coolman (01/11/2013)
~ Lancé par Alatte (01/11/2013 14:53:45)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user


---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16721
MFIE: Mozilla Firefox 25.0 (Defaut)
GCIE: Google Chrome v30.0.1599.101

---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 7QJB7
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ Logiciels de protection du système
Avira Free Antivirus v13.0.0.4042
Malwarebytes Anti-Malware version 1.75.0.1300
Windows Defender W7

---\\ Logiciels d'optimisation du système
CCleaner v3.20 =Piriform Ltd

---\\ Logiciels de partage PeerToPeer
Pando Media Booster v2.6.0.8

---\\ Surveillance de Logiciels
Adobe Flash Player 11 Plugin
Adobe Reader XI
Java 7 Update 7
Java 7 Update 45

---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 37 Stepping 2, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 6135 MB (64% free)
System Restore: Activé (Enable)
System drive C: has 261 GB (56%) free of 459 GB

---\\ Mode de connexion au système
~ Computer Name: ALATTE-PC
~ User Name: Alatte
~ All Users Names: sandrine, Alatte, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Alatte\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Alatte\AppData\Roaming\
~ %Desktop% : C:\Users\Alatte\Desktop\
~ %Favorites% : C:\Users\Alatte\Favorites\
~ %LocalAppData% : C:\Users\Alatte\AppData\Local\
~ %StartMenu% : C:\Users\Alatte\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 261 Go of 459 Go)
D: Hard drive, Flash drive, Thumb drive (Free 458 Go of 459 Go)
E: CD-ROM drive (Free 0 Go of 6 Go)
F: Floppy drive, Flash card reader, USB Key (Not Inserted)
G: Floppy drive, Flash card reader, USB Key (Not Inserted)



---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: 41 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.D28B35DE88D27EFB27DF4B1E8319E3C0] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.22/09/2013 - 23:55:10.) -- C:\Windows\System32\wininet.dll [2241024]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.314C17917AC8523EC77A710215012A65] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.14/09/2013 - 02:10:19.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/7
~ Mes Videos (My Videos) : 1/2
~ Mes Favoris (My Favorites) : 1/66
~ Mes Documents (My Documents) : 1/698
~ Mon Bureau (My Desktop) : 1/28
~ Menu demarrer (Programs) : 1/50
~ Hidden Files: Scanned in 00mn 01s



---\\ Processus lancés
[MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.2656]
[MD5.89F7B7CCC82D7E6FF9832FE3D24988C4] - (.Egis Technology Inc. - MyWinLocker.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552] [PID.3060]
[MD5.4458989C34FA84B5A75DD3ABCFBE786A] - (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624] [PID.2496]
[MD5.F0EA603E7B91046CA48EA4B3593A007D] - (.Micro Application - Pas de description.) -- C:\Program Files (x86)\Micro Application\LauncherMA.exe [485376] [PID.2680]
[MD5.27964C4676D0F4B34DB7332AFA2B1474] - (.Egis Technology Inc. - PMM Update Application.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [401192] [PID.2572]
[MD5.AD16557CECFB17CF7393D28DC40F6D09] - (.Pas de propriétaire - Hotkey Utility.) -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [563744] [PID.2664]
[MD5.80C1D422AAE807CF20A5E353EB8B5661] - (.CyberLink Corp. - Arcade Movie Resident Program.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe [124136] [PID.2836]
[MD5.DB3F7F19F942D3CE4E1A0E8D9FF541FB] - (.Avira Operations GmbH Co. KG - Avira System Tray Tool.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192] [PID.2740]
[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336] [PID.2500]
[MD5.6C695B04E2E29459CDC2E5C0970B883B] - (.Egis Technology Inc. - EgisUpdate Release Application.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201512] [PID.1264]
[MD5.EF01D104449CC654FDCF423C92BD8846] - (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [275568] [PID.3320]
[MD5.2A43A30EF7FCFD1284F8C3318B784A68] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe [18544] [PID.4500]
[MD5.EB68851F020D35293EADAADEB18B8220] - (.Adobe Systems, Inc. - Adobe Flash Player 11.9 r900.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe [1862536] [PID.5040]
[MD5.A68514D84A7660D63F543B86C4A65747] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8160768] [PID.3376]
[MD5.8769E2D1072B62AB071F166F03B3E3DC] - (.Avira Operations GmbH Co. KG - Avira Scheduler.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024] [PID.1428]
[MD5.ADDA5E1951B90D3D23C56D3CF0622ADC] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65640] [PID.1616]
[MD5.AD1D13E6326E0B8DA2A7BE13B39A8FE0] - (.Avira Operations GmbH Co. KG - Avira On-Access Service.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088] [PID.1664]
[MD5.816FD5A6F3C2F3D600900096632FC60E] - (.Acer Incorporated - Global Registration Service.) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe [1150496] [PID.1716]
[MD5.EDCCC8C13B1EB882F77BA0ABB84566E7] - (.Pas de propriétaire - Inkjet Printer/Scanner/Fax Extended Survey.) -- C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.exe [140456] [PID.1768]
[MD5.65085456FD9A74D7F1A999520C299ECB] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376] [PID.1832]
[MD5.E0D7732F2D2E24B2DB3F67B6750295B8] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512] [PID.1860]
[MD5.3A2BDD76E7D2A5F40A7174793D1BA794] - (...) -- C:\Windows\SysWOW64\PnkBstrA.exe [75136] [PID.1896]
[MD5.F12A68ED55053940CADD59CA5E3468DD] - (.Pas de propriétaire - RichVideo Module.) -- C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe [244904] [PID.1940]
[MD5.F9EC9ACD504D823D9B9CA98A4F8D3CA2] - (.Acer Group - Updater Service.) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe [243232] [PID.548]
[MD5.B5E6C4F280EBF0B16F74A5B415F2E0DF] - (.Pas de propriétaire - USB S3S4 Detection.) -- C:\OEM\USBDECTION\USBS3S4Detection.exe [76320] [PID.1216]
~ Processes Running: Scanned in 00mn 00s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Alatte\AppData\Local\Google\Chrome\User Data\Default\Preferences
~ Google Browser: 12 Legitimates Filtered in 00mn 06s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Alatte\AppData\Roaming\Mozilla\Firefox\Profiles\hl5cnu5x.default-1381266156581\prefs.js
~ Firefox Browser: 8 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = preserve
~ IE Browser: 15 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Acrobat Reader 5.0.lnk . (.Adobe Systems Incorporated - Acrobat Reader 5.0.) -- C:\Program Files (x86)\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
O4 - GS\Desktop [Public]: Canon Quick Menu.lnk . (.CANON INC. - Canon Quick Menu.) -- C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.exe
O4 - GS\Desktop [Public]: chrome.exe.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [Public]: firefox.exe.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Desktop [Public]: OpenOffice 4.0.0.lnk . (.Apache Software Foundation - OpenOffice 4.0.0.) -- C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
O4 - GS\Desktop [Public]: TeamSpeak 3 Client.lnk . (.TeamSpeak Systems GmbH - TeamSpeak 3 Client.) -- C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe
O4 - GS\Program [Public]: Acrobat Reader 5.0.lnk . (.Adobe Systems Incorporated - Acrobat Reader 5.0.) -- C:\Program Files (x86)\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
O4 - GS\Program [Public]: firefox.exe.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\QuickLaunch [sandrine]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\QuickLaunch [sandrine]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [sandrine]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [sandrine]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Program [sandrine]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [sandrine]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [sandrine]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\Desktop [sandrine]: Ubi Soft Product Registration.lnk . (.Ubi Soft - Pas de description.) -- C:\Program Files (x86)\Ubi Soft\Register\register.exe
O4 - GS\QuickLaunch [Alatte]: chrome.exe.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Alatte]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\QuickLaunch [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Program [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Accessories [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SendTo [Alatte]: Xfire Ami(e).lnk . (...) -- C:\Program Files (x86)\Xfire\Xfire.exe (.not file.)
O4 - GS\Desktop [Alatte]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\Desktop [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Alatte]: OTM - Raccourci.lnk . (.OldTimer Tools - Pas de description.) -- C:\Users\Alatte\Downloads\OTM.exe
O4 - GS\Desktop [Alatte]: ZHPFix.lnk . (.Nicolas Coolman - ZHPDiag Setup.) -- C:\Program Files (x86)\ZHPDiag\ZHPFix\ZHPhep.exe =.Nicolas Coolman
~ Global Startup: 102 Legitimates Filtered in 00mn 06s



---\\ Applications lancées au démarrage du sytème (O4)
O4 - GS\Startup [Alatte]: Lanceur.lnk . (.Micro Application - Pas de description.) -- C:\Program Files (x86)\Micro Application\LauncherMA.exe
O4 - GS\Startup [Alatte]: Registration .LNK . (...) -- C:\Program Files (x86)\Ubisoft\Tom Clancy's Splinter Cell Double Agent\support\Register\Reg.exe (.not file.)
O4 - HKLM\..\Run: [mwlDaemon] . (.Egis Technology Inc. - MyWinLocker.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =.Realtek Semiconductor Corp
O4 - HKCU\..\Run: [Pando Media Booster] . (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
O4 - HKLM\..\Wow6432Node\Run: [SuiteTray] . (.Egis Technology Inc. - SuiteTray.) -- C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe
O4 - HKLM\..\Wow6432Node\Run: [EgisUpdate] . (.Egis Technology Inc. - EgisUpdate Release Application.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [EgisTecPMMUpdate] . (.Egis Technology Inc. - PMM Update Application.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [Hotkey Utility] . (.Pas de propriétaire - Hotkey Utility.) -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
O4 - HKLM\..\Wow6432Node\Run: [MDS_Menu] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Wow6432Node\Run: [ArcadeMovieService] . (.CyberLink Corp. - Arcade Movie Resident Program.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [avgnt] . (.Avira Operations GmbH Co. KG - Avira System Tray Tool.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe =.Advanced Micro Devices, Inc
O4 - HKLM\..\Wow6432Node\Run: [CanonQuickMenu] . (.CANON INC. - Canon Quick Menu.) -- C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.exe
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =.Oracle Corporation
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-21-337464992-296471290-3356353711-1000\..\Run: [Pando Media Booster] . (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
~ Application: Scanned in 00mn 00s



---\\ Site dans la Zone de confiance d'Internet Explorer (O15)
O15 - Trusted Zone: [HKCU\...\Domains] http.ma-config.com
O15 - Trusted Zone: [HKCU\...\Domains] http.touslesdrivers.com
~ IE Zone Confiance: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CS1\Services\Tcpip\..\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CS2\Services\Tcpip\..\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.241 212.27.40.240
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll =.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [Go for FilesUpdate] (...) -- C:\Program Files (x86)\GoforFiles\GFFUpdater.exe (.not file.) [0] =P2P.GoforFiles
[MD5.00000000000000000000000000000000] [APT] [{12057A87-6954-4D95-BCF4-1870896417FD}] (...) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{2479915F-EC78-4E9B-8546-3DA8189B0AC6}] (...) -- C:\Program Files (x86)\Illusion Softworks\Hidden Dangerous 2\hd2.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{68583218-406A-44A9-8521-5D560795A2B7}] (...) -- C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{B9361F11-902B-4607-87BB-FC7FDF924331}] (...) -- C:\Program Files\Bohemia Interactive\ArmA\arma.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{F31478B2-9672-4546-AB4F-D32E87AB604E}] (...) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (.not file.) [0]
~ Scheduled Task: 26 Legitimates Filtered in 00mn 08s



---\\ Logiciels installés (O42)
O42 - Logiciel: Spec Ops: The Line - (.Yager.) [HKLM][64Bits] -- Steam App 50300
~ Logic: 115 Legitimates Filtered in 00mn 00s



---\\ HKCU HKLM Software Keys
[HKCU\Software\Pando Networks]
[HKLM\Software\Wow6432Node\IncrediMail]
[HKLM\Software\Wow6432Node\Pando Networks]
~ Key Software: 273 Legitimates Filtered in 00mn 00s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 11/04/2012 - 23:15:41 - [7,234] ----D C:\Program Files (x86)\Pando Networks
O43 - CFD: 16/07/2012 - 19:09:40 - [0,001] ----D C:\Users\Alatte\AppData\Local\reakktor
~ 1216 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 1501 Legitimates Filtered in 00mn 58s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.D39DB3CDBBC6488ED74A5ACC01BA4DCA] - 25/10/2013 - 12:35:11 ---A- . (...) -- C:\Windows\ntbtlog.txt [150616]
O44 - LFC:[MD5.B88F8D738C1B5A1B8F06544DE658ECB9] - 30/10/2013 - 12:41:37 ---A- . (...) -- C:\rapport.txt [413]
O44 - LFC:[MD5.F25E5E8B160F7B1228137F65CF4459E6] - 30/10/2013 - 13:46:32 ---A- . (...) -- C:\Windows\DirectX.log [17551]
~ Files: 17 Legitimates Filtered in 01mn 05s



---\\ Clé de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{0b5ab857-893d-11e0-b816-806e6f6e6963}\AutoRun\command. (...) -- E:\Launcher.exe
~ Keys: Scanned in 00mn 02s



---\\ Enumération des clés de registre StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\Overwolf [Key] . (.Overwolf - Overwolf.) -- C:\Program Files (x86)\Overwolf\Overwolf.exe
~ SMSR Keys: 4 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.B8B7DF85909DE0E0DA5B8E1BF67EF033] - 06/03/2013 - 20:50:17 ---A- . (.Protect Software GmbH - ProtectDisc Filter Driver x64.) -- C:\Windows\System32\Drivers\acedrv10.sys [276480]
O58 - SDL:[MD5.CE4B6956E4E12492715A53076E58761F] - 09/11/2009 - 00:42:00 ---A- . (.Teruten Inc - File System Mini Filter Drvier.) -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys [16392]
~ Drivers: 16 Legitimates Filtered in 00mn 00s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 06/03/2013 - C:\Windows\system32\drivers\acedrv10.sys (acedrv10) .(.Protect Software GmbH - ProtectDisc Filter Driver x64.) - LEGACY_ACEDRV10
~ Legacy: 94 Legitimates Filtered in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- searches.com\?utm_source=butm_medium=s32utm_campaign=eXQutm_content=scfrom=s32uid=WDCXWD10EARS-22Y5B1_WD-WCAV5A19477494774ts=1381152335 C:\Program Files\Internet Explorer\iexplore.exe http://www.do =Hijacker.wwwDo
~ Keys: Scanned in 00mn 00s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.6ACBD475647D7A160657CB3E460F0F35] [SPRF][27/01/2010] (...) -- C:\ProgramData\FullRemove.exe [131472]
[MD5.7EFA501C050F35610A750928C8F246BE] [SPRF][07/10/2013] (...) -- C:\Users\Alatte\AppData\Roaming\wklnhst.dat [226]
[MD5.FC05CF5526BA0C9CCDEB02BB61503ED1] [SPRF][29/04/2013] (...) -- C:\Users\Alatte\Desktop\avira_free_antivirus_fr.exe [104833992]
~ Files: 6 Legitimates Filtered in 00mn 01s



---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "70140BF22CB7C94419A535B0925B0EEF" . (.UE3Redist.) -- C:\Windows\Installer\{2FB04107-7BC2-449C-915A-530B29B5E0FE}\ARPPRODUCTICON.exe
~ Update Products: 155 Legitimates Filtered in 00mn 00s



---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.23E107196CB1CB6E66C5689C8EC06C1C] [WIS][02/07/2009] (.Nokia - PC Connectivity Solution.) -- C:\Windows\Installer\1516a1.msi [21368832]
~ WIS: 162 Legitimates Filtered in 00mn 23s



---\\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 11/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 08/10/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 24/07/2013 239616 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 10/09/2013 84024 | (AntiVirSchedulerService) . (.Avira Operations GmbH Co. KG.) - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
SR - | Auto 10/09/2013 108088 | (AntiVirService) . (.Avira Operations GmbH Co. KG.) - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
SR - | Auto 28/08/2009 1150496 | (Greg_Service) . (.Acer Incorporated.) - C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
SS - | Auto 15/12/2011 136176 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 15/12/2011 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 03/04/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
SR - | Auto 28/03/2012 140456 | (IJPLMSVC) . (...) - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.exe
SR - | Auto 04/08/2013 2650960 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe
SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
SS - | Demand 30/10/2013 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Demand 01/02/2010 305520 | (MWLService) . (.Egis Technology Inc..) - C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
SS - | Demand 22/08/2013 18360 | (OverwolfUpdaterService) . (.Overwolf Ltd.) - C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe
SR - | Auto 10/07/1658 0 | (PnkBstrA) . (...) - C:\Windows\system32\PnkBstrA.exe
SR - | Auto 03/02/2010 244904 | (RichVideo) . (...) - C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe
SS - | Demand 11/11/2008 620544 | (ServiceLayer) . (.Nokia..) - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
SS - | Auto 03/06/2013 162408 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Demand 09/10/2013 565672 | (Steam Client Service) . (.Valve Corporation.) - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
SR - | Auto 29/01/2010 243232 | (Updater Service) . (.Acer Group.) - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
SR - | Auto 09/12/2009 76320 | (USBS3S4Detection) . (...) - C:\OEM\USBDECTION\USBS3S4Detection.exe
SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SS - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\system32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 24s



---\\ Scan Additionnel (O88)
Database Version : 12965 - (01/11/2013)
Clés trouvées (Keys found) : 9
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 0

[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF] =Toolbar.AVGSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2] =Toolbar.Ask
~ Additionnel Scan: 308624 Items scanned in 00mn 14s



---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com/apps/blo ... cker-wwwdo =Hijacker.wwwDo
~ http://nicolascoolman.webs.com/apps/blo ... oolbar-ask =Toolbar.Ask
~ MSI: 2 link(s) detected in 00mn 14s



~ 2571 Legitimates filtered by white list
End of the scan (453 lines in 03mn 31s)(0)

voila c est fait
par-contre je voulais te demander si c'était normal qu'à chaque fois que je fait un zhpdiag, il me fait réinstaller la dernière version .
bonne journée a+

[roro04]

Étrange, essaye de désinstaller ZHPDiag et de le retélécharger.

Ensuite, fixe ces lignes avec ZHPFix.
Script ZHPFix
OPT:O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- searches.com\?utm_source=butm_medium=s32utm_campaign=eXQutm_content=scfrom=s32uid=WDCXWD10EARS-22Y5B1_WD-WCAV5A19477494774ts=1381152335 C:\Program Files\Internet Explorer\iexplore.exe http://www.doEnsuite refais un ZHPDiag.

@+

[dav86]

salut le rapport zhpfix
Rapport de ZHPFix 2013.10.21.17 par Nicolas Coolman, Update du 21/10/2013
Fichier d'export Registre :
Run by Alatte at 02/11/2013 14:11:22
High Elevated Privileges : OK
Windows XP Home Edition Service Pack 2 (Build 2600)

Corbeille vidée (00mn 03s)


========== Récapitulatif ==========


End of clean in 00mn 03s

========== Chemin de fichier rapport ==========
C:\Users\Alatte\AppData\Roaming\ZHP\ZHPFix[R1].txt - 29/10/2013 11:55:24 [2756]
C:\Users\Alatte\AppData\Roaming\ZHP\ZHPFix[R2].txt - 02/11/2013 14:11:25 [460]

[dav86]

et le rapport zhpdiag
~ Rapport de ZHPDiag v2013.11.1.1 - Nicolas Coolman (01/11/2013)
~ Lancé par Alatte (02/11/2013 14:14:27)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by program


---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16721
MFIE: Mozilla Firefox 25.0 (Defaut)
GCIE: Google Chrome v30.0.1599.101

---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 7QJB7
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ Logiciels de protection du système
Avira Free Antivirus v13.0.0.4042
Malwarebytes Anti-Malware version 1.75.0.1300
Windows Defender W7

---\\ Logiciels d'optimisation du système
CCleaner v3.20 =Piriform Ltd

---\\ Logiciels de partage PeerToPeer
Pando Media Booster v2.6.0.8

---\\ Surveillance de Logiciels
Adobe Flash Player 11 Plugin
Adobe Reader XI
Java 7 Update 7
Java 7 Update 45

---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 37 Stepping 2, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 6135 MB (73% free)
System Restore: Activé (Enable)
System drive C: has 257 GB (56%) free of 459 GB

---\\ Mode de connexion au système
~ Computer Name: ALATTE-PC
~ User Name: Alatte
~ All Users Names: sandrine, Alatte, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Alatte\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Alatte\AppData\Roaming\
~ %Desktop% : C:\Users\Alatte\Desktop\
~ %Favorites% : C:\Users\Alatte\Favorites\
~ %LocalAppData% : C:\Users\Alatte\AppData\Local\
~ %StartMenu% : C:\Users\Alatte\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 257 Go of 459 Go)
D: Hard drive, Flash drive, Thumb drive (Free 458 Go of 459 Go)
E: CD-ROM drive (Free 0 Go of 6 Go)
F: Floppy drive, Flash card reader, USB Key (Not Inserted)
G: Floppy drive, Flash card reader, USB Key (Not Inserted)



---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: 41 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.D28B35DE88D27EFB27DF4B1E8319E3C0] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.22/09/2013 - 23:55:10.) -- C:\Windows\System32\wininet.dll [2241024]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.314C17917AC8523EC77A710215012A65] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.14/09/2013 - 02:10:19.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/7
~ Mes Videos (My Videos) : 1/2
~ Mes Favoris (My Favorites) : 1/64
~ Mes Documents (My Documents) : 1/700
~ Mon Bureau (My Desktop) : 1/28
~ Menu demarrer (Programs) : 1/50
~ Hidden Files: Scanned in 00mn 01s



---\\ Processus lancés
[MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.2316]
[MD5.89F7B7CCC82D7E6FF9832FE3D24988C4] - (.Egis Technology Inc. - MyWinLocker.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552] [PID.2980]
[MD5.4458989C34FA84B5A75DD3ABCFBE786A] - (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624] [PID.1356]
[MD5.F0EA603E7B91046CA48EA4B3593A007D] - (.Micro Application - Pas de description.) -- C:\Program Files (x86)\Micro Application\LauncherMA.exe [485376] [PID.2836]
[MD5.27964C4676D0F4B34DB7332AFA2B1474] - (.Egis Technology Inc. - PMM Update Application.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [401192] [PID.2388]
[MD5.AD16557CECFB17CF7393D28DC40F6D09] - (.Pas de propriétaire - Hotkey Utility.) -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [563744] [PID.2788]
[MD5.80C1D422AAE807CF20A5E353EB8B5661] - (.CyberLink Corp. - Arcade Movie Resident Program.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe [124136] [PID.1216]
[MD5.DB3F7F19F942D3CE4E1A0E8D9FF541FB] - (.Avira Operations GmbH Co. KG - Avira System Tray Tool.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192] [PID.2636]
[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336] [PID.2568]
[MD5.6C695B04E2E29459CDC2E5C0970B883B] - (.Egis Technology Inc. - EgisUpdate Release Application.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201512] [PID.3824]
[MD5.EF01D104449CC654FDCF423C92BD8846] - (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [275568] [PID.700]
[MD5.A68514D84A7660D63F543B86C4A65747] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8160768] [PID.4148]
[MD5.8769E2D1072B62AB071F166F03B3E3DC] - (.Avira Operations GmbH Co. KG - Avira Scheduler.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024] [PID.1456]
[MD5.ADDA5E1951B90D3D23C56D3CF0622ADC] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65640] [PID.1604]
[MD5.AD1D13E6326E0B8DA2A7BE13B39A8FE0] - (.Avira Operations GmbH Co. KG - Avira On-Access Service.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088] [PID.1652]
[MD5.816FD5A6F3C2F3D600900096632FC60E] - (.Acer Incorporated - Global Registration Service.) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe [1150496] [PID.1708]
[MD5.EDCCC8C13B1EB882F77BA0ABB84566E7] - (.Pas de propriétaire - Inkjet Printer/Scanner/Fax Extended Survey.) -- C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.exe [140456] [PID.1748]
[MD5.65085456FD9A74D7F1A999520C299ECB] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376] [PID.1812]
[MD5.E0D7732F2D2E24B2DB3F67B6750295B8] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512] [PID.1840]
[MD5.3A2BDD76E7D2A5F40A7174793D1BA794] - (...) -- C:\Windows\SysWOW64\PnkBstrA.exe [75136] [PID.1884]
[MD5.F12A68ED55053940CADD59CA5E3468DD] - (.Pas de propriétaire - RichVideo Module.) -- C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe [244904] [PID.1904]
[MD5.F9EC9ACD504D823D9B9CA98A4F8D3CA2] - (.Acer Group - Updater Service.) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe [243232] [PID.1528]
[MD5.B5E6C4F280EBF0B16F74A5B415F2E0DF] - (.Pas de propriétaire - USB S3S4 Detection.) -- C:\OEM\USBDECTION\USBS3S4Detection.exe [76320] [PID.1164]
~ Processes Running: Scanned in 00mn 00s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Alatte\AppData\Local\Google\Chrome\User Data\Default\Preferences
~ Google Browser: 12 Legitimates Filtered in 00mn 06s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Alatte\AppData\Roaming\Mozilla\Firefox\Profiles\hl5cnu5x.default-1381266156581\prefs.js
~ Firefox Browser: 8 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = preserve
~ IE Browser: 16 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Acrobat Reader 5.0.lnk . (.Adobe Systems Incorporated - Acrobat Reader 5.0.) -- C:\Program Files (x86)\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
O4 - GS\Desktop [Public]: Canon Quick Menu.lnk . (.CANON INC. - Canon Quick Menu.) -- C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.exe
O4 - GS\Desktop [Public]: chrome.exe.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [Public]: firefox.exe.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Desktop [Public]: OpenOffice 4.0.0.lnk . (.Apache Software Foundation - OpenOffice 4.0.0.) -- C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
O4 - GS\Desktop [Public]: TeamSpeak 3 Client.lnk . (.TeamSpeak Systems GmbH - TeamSpeak 3 Client.) -- C:\Program Files (x86)\TeamSpeak 3 Client\ts3client_win32.exe
O4 - GS\Desktop [Public]: Unity.lnk . (.Unity Technologies ApS - Unity Editor.) -- C:\Program Files (x86)\Unity\Editor\Unity.exe
O4 - GS\Program [Public]: Acrobat Reader 5.0.lnk . (.Adobe Systems Incorporated - Acrobat Reader 5.0.) -- C:\Program Files (x86)\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
O4 - GS\Program [Public]: firefox.exe.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\QuickLaunch [sandrine]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\QuickLaunch [sandrine]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [sandrine]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [sandrine]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Program [sandrine]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [sandrine]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [sandrine]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\Desktop [sandrine]: Ubi Soft Product Registration.lnk . (.Ubi Soft - Pas de description.) -- C:\Program Files (x86)\Ubi Soft\Register\register.exe
O4 - GS\QuickLaunch [Alatte]: chrome.exe.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Alatte]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\QuickLaunch [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Program [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Accessories [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SendTo [Alatte]: Xfire Ami(e).lnk . (...) -- C:\Program Files (x86)\Xfire\Xfire.exe (.not file.)
O4 - GS\Desktop [Alatte]: GameSpy Arcade.lnk . (.GameSpy Industries, Inc. - GameSpy Arcade 1.4.) -- C:\Program Files (x86)\GameSpy Arcade\Aphex.exe
O4 - GS\Desktop [Alatte]: iexplore.exe.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Alatte]: OTM - Raccourci.lnk . (.OldTimer Tools - Pas de description.) -- C:\Users\Alatte\Downloads\OTM.exe
O4 - GS\Desktop [Alatte]: ZHPFix.lnk . (.Nicolas Coolman - ZHPDiag Setup.) -- C:\Program Files (x86)\ZHPDiag\ZHPFix\ZHPhep.exe =.Nicolas Coolman
~ Global Startup: 103 Legitimates Filtered in 00mn 04s



---\\ Applications lancées au démarrage du sytème (O4)
O4 - GS\Startup [Alatte]: Lanceur.lnk . (.Micro Application - Pas de description.) -- C:\Program Files (x86)\Micro Application\LauncherMA.exe
O4 - GS\Startup [Alatte]: Registration .LNK . (...) -- C:\Program Files (x86)\Ubisoft\Tom Clancy's Splinter Cell Double Agent\support\Register\Reg.exe (.not file.)
O4 - HKLM\..\Run: [mwlDaemon] . (.Egis Technology Inc. - MyWinLocker.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =.Realtek Semiconductor Corp
O4 - HKCU\..\Run: [Pando Media Booster] . (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
O4 - HKLM\..\Wow6432Node\Run: [SuiteTray] . (.Egis Technology Inc. - SuiteTray.) -- C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe
O4 - HKLM\..\Wow6432Node\Run: [EgisUpdate] . (.Egis Technology Inc. - EgisUpdate Release Application.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [EgisTecPMMUpdate] . (.Egis Technology Inc. - PMM Update Application.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [Hotkey Utility] . (.Pas de propriétaire - Hotkey Utility.) -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
O4 - HKLM\..\Wow6432Node\Run: [MDS_Menu] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Wow6432Node\Run: [ArcadeMovieService] . (.CyberLink Corp. - Arcade Movie Resident Program.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [avgnt] . (.Avira Operations GmbH Co. KG - Avira System Tray Tool.) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe =.Advanced Micro Devices, Inc
O4 - HKLM\..\Wow6432Node\Run: [CanonQuickMenu] . (.CANON INC. - Canon Quick Menu.) -- C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.exe
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =.Oracle Corporation
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =.Microsoft Corporation
O4 - HKUS\S-1-5-21-337464992-296471290-3356353711-1000\..\Run: [Pando Media Booster] . (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
~ Application: Scanned in 00mn 00s



---\\ Site dans la Zone de confiance d'Internet Explorer (O15)
O15 - Trusted Zone: [HKCU\...\Domains] http.ma-config.com
O15 - Trusted Zone: [HKCU\...\Domains] http.touslesdrivers.com
~ IE Zone Confiance: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CS1\Services\Tcpip\..\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CS2\Services\Tcpip\..\{77E05783-9DA1-425A-BBC3-9A5C89C94808}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.241 212.27.40.240
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll =.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [Go for FilesUpdate] (...) -- C:\Program Files (x86)\GoforFiles\GFFUpdater.exe (.not file.) [0] =P2P.GoforFiles
[MD5.00000000000000000000000000000000] [APT] [{12057A87-6954-4D95-BCF4-1870896417FD}] (...) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{2479915F-EC78-4E9B-8546-3DA8189B0AC6}] (...) -- C:\Program Files (x86)\Illusion Softworks\Hidden Dangerous 2\hd2.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{68583218-406A-44A9-8521-5D560795A2B7}] (...) -- C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{B9361F11-902B-4607-87BB-FC7FDF924331}] (...) -- C:\Program Files\Bohemia Interactive\ArmA\arma.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{F31478B2-9672-4546-AB4F-D32E87AB604E}] (...) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (.not file.) [0]
~ Scheduled Task: 26 Legitimates Filtered in 00mn 07s



---\\ Logiciels installés (O42)
O42 - Logiciel: Spec Ops: The Line - (.Yager.) [HKLM][64Bits] -- Steam App 50300
~ Logic: 116 Legitimates Filtered in 00mn 00s



---\\ HKCU HKLM Software Keys
[HKCU\Software\Pando Networks]
[HKLM\Software\Wow6432Node\IncrediMail]
[HKLM\Software\Wow6432Node\Pando Networks]
~ Key Software: 275 Legitimates Filtered in 00mn 00s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 11/04/2012 - 23:15:41 - [7,234] ----D C:\Program Files (x86)\Pando Networks
O43 - CFD: 16/07/2012 - 19:09:40 - [0,001] ----D C:\Users\Alatte\AppData\Local\reakktor
~ 1216 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 1505 Legitimates Filtered in 00mn 54s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.D39DB3CDBBC6488ED74A5ACC01BA4DCA] - 25/10/2013 - 12:35:11 ---A- . (...) -- C:\Windows\ntbtlog.txt [150616]
O44 - LFC:[MD5.B88F8D738C1B5A1B8F06544DE658ECB9] - 30/10/2013 - 12:41:37 ---A- . (...) -- C:\rapport.txt [413]
O44 - LFC:[MD5.F25E5E8B160F7B1228137F65CF4459E6] - 30/10/2013 - 13:46:32 ---A- . (...) -- C:\Windows\DirectX.log [17551]
~ Files: 17 Legitimates Filtered in 00mn 57s



---\\ Clé de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{0b5ab857-893d-11e0-b816-806e6f6e6963}\AutoRun\command. (...) -- E:\Launcher.exe
~ Keys: Scanned in 00mn 00s



---\\ Enumération des clés de registre StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\Overwolf [Key] . (.Overwolf - Overwolf.) -- C:\Program Files (x86)\Overwolf\Overwolf.exe
~ SMSR Keys: 4 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.B8B7DF85909DE0E0DA5B8E1BF67EF033] - 06/03/2013 - 20:50:17 ---A- . (.Protect Software GmbH - ProtectDisc Filter Driver x64.) -- C:\Windows\System32\Drivers\acedrv10.sys [276480]
O58 - SDL:[MD5.CE4B6956E4E12492715A53076E58761F] - 09/11/2009 - 00:42:00 ---A- . (.Teruten Inc - File System Mini Filter Drvier.) -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys [16392]
~ Drivers: 16 Legitimates Filtered in 00mn 00s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 06/03/2013 - C:\Windows\system32\drivers\acedrv10.sys (acedrv10) .(.Protect Software GmbH - ProtectDisc Filter Driver x64.) - LEGACY_ACEDRV10
~ Legacy: 94 Legitimates Filtered in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- searches.com\?utm_source=butm_medium=s32utm_campaign=eXQutm_content=scfrom=s32uid=WDCXWD10EARS-22Y5B1_WD-WCAV5A19477494774ts=1381152335 C:\Program Files\Internet Explorer\iexplore.exe http://www.do =Hijacker.wwwDo
~ Keys: Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com
~ Keys: Scanned in 00mn 00s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.6ACBD475647D7A160657CB3E460F0F35] [SPRF][27/01/2010] (...) -- C:\ProgramData\FullRemove.exe [131472]
[MD5.7EFA501C050F35610A750928C8F246BE] [SPRF][07/10/2013] (...) -- C:\Users\Alatte\AppData\Roaming\wklnhst.dat [226]
[MD5.FC05CF5526BA0C9CCDEB02BB61503ED1] [SPRF][29/04/2013] (...) -- C:\Users\Alatte\Desktop\avira_free_antivirus_fr.exe [104833992]
~ Files: 6 Legitimates Filtered in 00mn 01s



---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "70140BF22CB7C94419A535B0925B0EEF" . (.UE3Redist.) -- C:\Windows\Installer\{2FB04107-7BC2-449C-915A-530B29B5E0FE}\ARPPRODUCTICON.exe
~ Update Products: 155 Legitimates Filtered in 00mn 00s



---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.23E107196CB1CB6E66C5689C8EC06C1C] [WIS][02/07/2009] (.Nokia - PC Connectivity Solution.) -- C:\Windows\Installer\1516a1.msi [21368832]
~ WIS: 162 Legitimates Filtered in 00mn 23s



---\\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 11/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 08/10/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 24/07/2013 239616 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 10/09/2013 84024 | (AntiVirSchedulerService) . (.Avira Operations GmbH Co. KG.) - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
SR - | Auto 10/09/2013 108088 | (AntiVirService) . (.Avira Operations GmbH Co. KG.) - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
SR - | Auto 28/08/2009 1150496 | (Greg_Service) . (.Acer Incorporated.) - C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
SS - | Auto 15/12/2011 136176 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 15/12/2011 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 03/04/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
SR - | Auto 28/03/2012 140456 | (IJPLMSVC) . (...) - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.exe
SR - | Auto 04/08/2013 2650960 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe
SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
SS - | Demand 30/10/2013 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Demand 01/02/2010 305520 | (MWLService) . (.Egis Technology Inc..) - C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
SS - | Demand 22/08/2013 18360 | (OverwolfUpdaterService) . (.Overwolf Ltd.) - C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe
SR - | Auto 10/07/1658 0 | (PnkBstrA) . (...) - C:\Windows\system32\PnkBstrA.exe
SR - | Auto 03/02/2010 244904 | (RichVideo) . (...) - C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe
SS - | Demand 11/11/2008 620544 | (ServiceLayer) . (.Nokia..) - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
SS - | Auto 03/06/2013 162408 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Demand 09/10/2013 565672 | (Steam Client Service) . (.Valve Corporation.) - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
SR - | Auto 29/01/2010 243232 | (Updater Service) . (.Acer Group.) - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
SR - | Auto 09/12/2009 76320 | (USBS3S4Detection) . (...) - C:\OEM\USBDECTION\USBS3S4Detection.exe
SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SS - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\system32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 24s



---\\ Scan Additionnel (O88)
Database Version : 12965 - (01/11/2013)
Clés trouvées (Keys found) : 9
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 0

[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF] =Toolbar.AVGSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888] =Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2] =Toolbar.Ask
~ Additionnel Scan: 323030 Items scanned in 00mn 14s



---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com/apps/blo ... cker-wwwdo =Hijacker.wwwDo
~ http://nicolascoolman.webs.com/apps/blo ... oolbar-ask =Toolbar.Ask
~ MSI: 2 link(s) detected in 00mn 14s



~ 2578 Legitimates filtered by white list
End of the scan (458 lines in 03mn 14s)(0)

bonne journee a+

[roro04]

Re,

Ok, fixe cette ligne avec ZHPFix.

ShorcutFix

Ensuite refais un ZHPDiag

@+

[dav86]

salut il me dit script obligatoir
bonne soiree a+

[roro04]

Ok entre ceci dans ce cas :

Script ZHPFix
ShorcutFix

@+