Rapport de ZHPDiag v2013.4.16.93 par Nicolas Coolman, Update du 16/04/2013 Run by Paguy at 17/04/2013 08:44:11 State : Version à jour. WhiteList : Enable High Elevated Privileges : OK UAC : Not Found ---\\ Web Browser MSIE: Internet Explorer v8.0.6001.18702 (Defaut) ---\\ Windows Product Information ~ Langage: Français Windows XP Home Edition Service Pack 3 (Build 2600) Windows Automatic Updates : OK Windows Genuine Advantage : OK ---\\ System Protection Malwarebytes Anti-Malware version 1.75.0.1300 ---\\ System Optimizer CCleaner v4.00 ---\\ Software Update Adobe Flash Player 11 ActiveX Adobe Reader X ---\\ System Information ~ Processor: x86 Family 15 Model 2 Stepping 9, GenuineIntel ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 511 MB (3% free) System Restore: Activé (Enable) System drive C: has 18 GB (31%) free of 56 GB ---\\ Logged in mode ~ Computer Name: JULES ~ User Name: Paguy ~ All Users Names: SUPPORT_388945a0, SUPPORT_0cbdf702, Paguy, Nannène, HelpAssistant, ASPNET, Administrateur, ~ Unselected Option: None Logged in as Administrator ---\\ Environnement Variables ~ System Unit : C:\ ~ %AppData% : C:\Documents and Settings\Paguy\Application Data\ ~ %Desktop% : C:\Documents and Settings\Paguy\Bureau\ ~ %Favorites% : C:\Documents and Settings\Paguy\Favoris\ ~ %LocalAppData% : C:\Documents and Settings\Paguy\Local Settings\Application Data\ ~ %StartMenu% : C:\Documents and Settings\Paguy\Menu Démarrer\ ~ %Windir% : C:\WINDOWS\ ~ %System% : C:\WINDOWS\system32\ ---\\ DOS/Devices C:\ Hard drive, Flash drive, Thumb drive (Free 18 Go of 56 Go) D:\ CD-ROM drive (Not Inserted) ---\\ Security Center & Tools Informations [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Intl: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] XMLLookup: OK [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK [HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] Load: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : OK ~ Security Center: Scanned in 00mn 00s ---\\ Recherche particulière de fichiers génériques [MD5.F2317622D29F9FF0F88AEECD5F60F0DD] - (.Microsoft Corporation - Explorateur Windows.) (.14/04/2008 - 03:34:03.) -- C:\WINDOWS\Explorer.exe [1037824] [MD5.48309E1F5ED8E72783EEFBA04898BDA1] - (.Microsoft Corporation - Internet Extensions for Win32.) (.02/03/2013 - 02:55:11.) -- C:\WINDOWS\system32\wininet.dll [916480] [MD5.DD73D6B9F6B4CB630CF35B438B540174] - (.Microsoft Corporation - Application d'ouverture de session Windows NT.) (.14/04/2008 - 03:34:28.) -- C:\WINDOWS\system32\Winlogon.exe [512000] [MD5.1E44BC1E83D8FD2305F8D452DB109CF9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.17/08/2011 - 14:49:54.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496] [MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.13/04/2008 - 19:40:30.) -- C:\WINDOWS\system32\Drivers\atapi.sys [96512] [MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/04/2008 - 20:14:21.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744] [MD5.1F4260CC5B42272D71F79E570A27A4FE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.13/04/2008 - 19:40:46.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [62976] [MD5.31F923EB2170FC172C81ABDA0045D18C] - (.Microsoft Corporation - Pilote de cryptographie FIPS.) (.14/04/2008 - 02:57:38.) -- C:\WINDOWS\system32\Drivers\Fips.sys [44672] [MD5.573C7D0A32852B48F3058CFD8026F511] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.13/04/2008 - 17:36:05.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [144384] [MD5.A09BDC4ED10E3B2E0EC27BB94AF32516] - (.Microsoft Corporation - Pilote de port i8042.) (.14/04/2008 - 03:00:52.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [54144] [MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.13/04/2008 - 19:40:58.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [42112] [MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.13/04/2008 - 19:57:15.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [152832] [MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.13/04/2008 - 20:19:42.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [75264] [MD5.7D304A5EB4344EBEEAB53A2FE3FFB9F0] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.15/07/2011 - 14:29:31.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [456320] [MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.13/04/2008 - 20:21:00.) -- C:\WINDOWS\system32\Drivers\netBT.sys [162816] [MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.13/04/2008 - 20:15:53.) -- C:\WINDOWS\system32\Drivers\ntfs.sys [574976] [MD5.8FD0BDBEA875D06CCF6C945CA9ABAF75] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/04/2008 - 03:09:40.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80384] [MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13/04/2008 - 20:19:43.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328] [MD5.15CABD0F7C00C47C70124907916AF3F1] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.13/04/2008 - 19:32:51.) -- C:\WINDOWS\system32\Drivers\rdpdr.sys [196224] [MD5.D8EB2A7904DB6C916EB5361878DDCBAE] - (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) (.14/04/2008 - 02:57:34.) -- C:\WINDOWS\system32\Drivers\redbook.sys [58752] [MD5.46DE1126684369BACE4849E4FC8C43CA] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.14/04/2008 - 02:56:04.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [53376] ~ Generic Processes: Scanned in 00mn 01s ---\\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 2/5315 ~ Mes musiques (My Musics) : 1/150 ~ Mes Videos (My Videos) : 2/4 ~ Mes Favoris (My Favorites) : 1/61 ~ Mes Documents (My Documents) : 2/5603 ~ Mon Bureau (My Desktop) : 0/27 ~ Menu demarrer (Programs) : 1/28 ~ Hidden Files: Scanned in 00mn 19s ---\\ Processus lancés [MD5.92C27887787E637185FEC2EE43DA390F] - (.Symantec Corporation - Symantec Settings Manager Service.) -- C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe [169632] [PID.168] [MD5.FF7DAA264887E850ABFDB8167A8685C9] - (.Symantec Corporation - Symantec Event Manager Service.) -- C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe [192160] [PID.484] [MD5.C830007369E18A54AED23B5BB3AFA2BA] - (.Symantec Corporation - SPBBC Service.) -- C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe [1160848] [PID.748] [MD5.793EF38A5FD086C3C8E48A8A861562ED] - (.Microsoft Corporation - Content Index service.) -- C:\WINDOWS\system32\cisvc.exe [5632] [PID.576] [MD5.99A1F9AE9FD8EB496CA4CB54D422D18C] - (.Symantec Corporation - Virus Definition Daemon.) -- C:\Program Files\Symantec AntiVirus\DefWatch.exe [31888] [PID.712] [MD5.A0D14B7538FA3AE9CB771B9E99CECF43] - (.Sun Microsystems, Inc. - Java(TM) Quick Starter Service.) -- C:\Program Files\Java\jre6\bin\jqs.exe [154032] [PID.1664] [MD5.11F714F85530A2BD134074DC30E99FCA] - (.Microsoft Corporation - Machine Debug Manager.) -- C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.exe [322120] [PID.1996] [MD5.B03E3F64B70F8031E65EB26DA23DE91A] - (.Microsoft Corporation - MsCamSvc.exe.) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe [135536] [PID.472] [MD5.44287C44FDAC6131F320916422540189] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 54.05.) -- C:\WINDOWS\system32\nvsvc32.exe [81920] [PID.1400] [MD5.2D091A99624FB9E7EEF0A86D872EC0C3] - (.HP - PML Driver.) -- C:\WINDOWS\system32\HPZipm12.exe [73728] [PID.1580] [MD5.753D254205E0A62100A050BD8B458D06] - (.Skype Technologies S.A. - Skype C2C Service.) -- C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000] [PID.1016] [MD5.253702E880D7167F706FC362BCE55BF4] - (.Symantec Corporation - Symantec AntiVirus.) -- C:\Program Files\Symantec AntiVirus\Rtvscan.exe [1827472] [PID.320] [MD5.72999AA48322DA948CE50C08B414A0EC] - (.Microsoft Corporation - Indexing Service filter daemon.) -- C:\WINDOWS\system32\cidaemon.exe [8192] [PID.3220] [MD5.DC79F4167BF4067CC0F2C72E4E6040B3] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [6808576] [PID.1436] [MD5.5E9A6658A2A69AE7EB195113B7A2E7A9] - (.Microsoft Corporation - Application Layer Gateway Service.) -- C:\WINDOWS\System32\alg.exe [44544] [PID.1484] ~ Processes Running: Scanned in 00mn 08s ---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2) C:\Documents and Settings\Paguy\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences ~ Google Browser: Scanned in 00mn 00s ---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4) R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://r.orange.fr R4 - HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,Enabled = 2 ~ IE Browser: 13 Legitimates Filtered in 00mn 00s ---\\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\WINDOWS\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl" ~ Keys: Scanned in 00mn 00s ---\\ Redirection du fichier Hosts (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 09s ~ Nombre de lignes (Lines number): 15362 ---\\ Browser Helper Objects de navigateur (O2) O2 - BHO: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} Clé orpheline ~ BHO: 15 Legitimates Filtered in 00mn 06s ---\\ Internet Explorer Toolbars (O3) O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O3 - Toolbar: (no name) - [HKCU]{1E796980-9CC5-11D1-A83F-00C04FC99D61} Clé orpheline ~ Toolbar: Scanned in 00mn 00s ---\\ Applications démarrées par registre & par dossier (O4) O4 - HKLM\..\Run: [NvCplDaemon] . (.NVIDIA Corporation - NVIDIA Display Properties Extension.) -- C:\WINDOWS\system32\NvCpl.dll O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe O4 - HKUS\S-1-5-21-2050404483-677177641-1429353510-1007\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe ~ Application: Scanned in 00mn 00s ---\\ Autres liens utilisateurs (O4) O4 - GS\Programs: Adobe Reader X.lnk . (...) -- C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-AA1000000001}\SC_Reader.ico O4 - GS\Programs: Apple Software Update.lnk . (...) -- C:\WINDOWS\Installer\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}\AppleSoftwareUpdateIco.exe O4 - GS\Programs: Lanceur de tâches Microsoft Works.lnk . (.Microsoft® Corporation - Lanceur de tâches Microsoft Works.) -- C:\Program Files\Microsoft Works\msworks.exe O4 - GS\Programs: Microsoft Office PowerPoint Viewer 2003.lnk . (...) -- C:\WINDOWS\Installer\{90AF040C-6000-11D3-8CFE-0150048383C9}\ppvwicon.exe O4 - GS\Programs: Windows Messenger.lnk . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe O4 - GS\Programs: Windows Movie Maker.lnk . (.Microsoft Corporation - Windows Movie Maker.) -- C:\Program Files\Movie Maker\moviemk.exe O4 - GS\Programs: Assistance à distance.lnk . (.Microsoft Corporation - Assistance à distance Microsoft.) -- C:\WINDOWS\system32\rcimlby.exe O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Programs: Outlook Express.lnk . (.Microsoft Corporation - Outlook Express.) -- C:\Program Files\Outlook Express\msimn.exe O4 - GS\Programs: Software Setup.lnk . (.Hewlett-Packard - Application Installer.) -- C:\SWSetup\AppInstl\Setup.exe O4 - GS\Programs: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe ~ Global Startup: Scanned in 00mn 02s ---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} . (.Microsoft Corporation - Windows Live Writer Blog This Extension.) -- C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- C:\Program Files\Skype\Toolbars\Internet Explorer\icon.ico O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\OFFICE11\REFBARH.ICO O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -- Clé orpheline O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe ~ IE Extra Buttons: Scanned in 00mn 00s ---\\ Piratage de l'Option 'Rétablir les paramètres Web' (O14) O14 - IERESET.INF: START_PAGE_URL=START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q304&bd=pavilion&pf=laptop ~ IE Paramètres WEB: Scanned in 00mn 00s ---\\ Objets ActiveX (Downloaded Program Files)(O16) O16 - DPF: {5A779DC0-837B-4590-AC42-C7C0847478C5} ((no name)) - http://logicielsgratuits.orange.fr/download_service/Install/OrangeInstaller.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} ((no name)) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab ~ Objets ActiveX: Scanned in 00mn 00s ---\\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{BD15A1D6-C100-4E04-A707-F0899C0DD63F}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{BD15A1D6-C100-4E04-A707-F0899C0DD63F}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS3\Services\Tcpip\..\{BD15A1D6-C100-4E04-A707-F0899C0DD63F}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 ~ Domain: Scanned in 00mn 00s ---\\ Protocole additionnel (O18) O18 - Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} . (.Microsoft Corporation - Windows Live Mail.) -- C:\Program Files\Windows Live\Mail\mailcomm.dll O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.dll ~ Protocole Additionnel: Scanned in 00mn 00s ---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dll O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dll O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agent réseau hors connexion.) -- C:\WINDOWS\system32\cscdll.dll O20 - Winlogon Notify: ddccyxw . (...) -- ddccyxw.dll O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\system32\dimsntfy.dll O20 - Winlogon Notify: NavLogon . (.Symantec Corporation - Symantec AntiVirus Logon Notification.) -- C:\WINDOWS\system32\NavLogon.dll O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL secondaire de notification de service d.) -- C:\WINDOWS\system32\sclgntfy.dll O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\WlNotify.dll O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll O20 - Winlogon Notify: WgaLogon . (.Microsoft Corporation - Notifications Windows Genuine Advantage.) -- C:\WINDOWS\system32\WgaLogon.dll O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll ~ Winlogon: Scanned in 00mn 00s ---\\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) . (.Symantec Corporation - Virus Definition Daemon.) - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Pml Driver HPZ12 (Pml Driver HPZ12) . (.HP - PML Driver.) - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SPBBCSvc (SPBBCSvc) . (.Symantec Corporation - SPBBC Service.) - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus (Symantec AntiVirus) . (.Symantec Corporation - Symantec AntiVirus.) - C:\Program Files\Symantec AntiVirus\Rtvscan.exe ~ Services: 12 Legitimates Filtered in 00mn 10s ---\\ Enumération Active Desktop & MHTML Editor (O24) O24 - Desktop General: BackupWallPaper - .(...) - C:\Documents and Settings\Paguy\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop General: WallPaper - .(...) - C:\Documents and Settings\Paguy\Local Settings\Application Data\Microsoft\Wallpaper1.bmp ~ Desktop Component: 1 Legitimates Filtered in 00mn 00s ---\\ Tâches planifiées en automatique (O39) O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_setup_exe.job [140] ~ Scheduled Task: 8 Legitimates Filtered in 00mn 00s ---\\ Pilotes lancés au démarrage (O41) O41 - Driver: (eabfiltr) . (.Hewlett-Packard Company - QLB PS/2 Keyboard filter driver.) - C:\WINDOWS\system32\drivers\EABFiltr.sys ~ Drivers: 75 Legitimates Filtered in 00mn 01s ---\\ Logiciels installés (O42) O42 - Logiciel: Java 2 Runtime Environment, SE v1.4.2_03 - (.Sun Microsystems, Inc..) [HKLM] -- {7148F0A8-6813-11D6-A77B-00B0D0142030} O42 - Logiciel: ZNsoft Free 2007 - (.Douali Nassim.) [HKLM] -- {ADA6814F-4DB9-468A-A3F0-A41E68C459EB}_is1 O42 - Logiciel: ZNsoft Optimizer Xp - (.Douali Nassim.) [HKLM] -- {66450A49-F7A1-4BE8-A626-609B8005ADB6}_is1 O42 - Logiciel: overland - (.HP.) [HKLM] -- {766273C1-A39B-47EB-ACE8-DEBDD8094BCC} ~ Logic: 109 Legitimates Filtered in 00mn 01s ---\\ HKCU & HKLM Software Keys [HKLM\Software\Voxmobili] ~ Key Software: 147 Legitimates Filtered in 00mn 01s ---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 16/02/2007 - 23:37:57 - [7,727] ----D C:\Program Files\Overland O43 - CFD: 03/05/2003 - 05:56:23 - [16,899] ----D C:\Program Files\RecordNow! O43 - CFD: 16/04/2013 - 09:06:38 - [2,467] ----D C:\Program Files\ZNsoft Corporation O43 - CFD: 19/09/2006 - 16:52:07 - [0] ----D C:\Documents and Settings\Paguy\Application Data\eConf O43 - CFD: 22/10/2007 - 09:22:10 - [0,002] ----D C:\Documents and Settings\Paguy\Application Data\Voxmobili O43 - CFD: 16/04/2011 - 10:09:20 - [0,159] ----D C:\Documents and Settings\Paguy\Local Settings\Application Data\ISL O43 - CFD: 18/09/2012 - 12:08:55 - [0,000] ----D C:\Documents and Settings\Paguy\Local Settings\Application Data\Proxure ~ Program Folder: 152 Legitimates Filtered in 00mn 48s ---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.9F7A847E7FD18E6770C752172C13DBB2] - 17/04/2013 - 07:25:28 ---A- . (...) -- C:\WINDOWS\wiadebug.log [1146] O44 - LFC:[MD5.A496A8A216954462F391743DA32AB8FF] - 17/04/2013 - 07:25:27 ---A- . (...) -- C:\WINDOWS\wiaservc.log [50] O44 - LFC:[MD5.D259AE1740B00EC97E55ABE881E0F10C] - 17/04/2013 - 07:20:59 ---A- . (...) -- C:\AdwCleaner[S2].txt [1132] O44 - LFC:[MD5.47D026C6716066FE0D1DBBF745CBA7AB] - 16/04/2013 - 08:06:38 ---A- . (.Jeff A. Miko - This file provides information regarding di.) -- C:\WINDOWS\system32\DrvFacts.ocx [57856] O44 - LFC:[MD5.6040F8484642D1C2C42A5BF0E5FCE247] - 16/04/2013 - 07:08:18 ---A- . (.Innovasys - Innovasys ButtonPlus Control.) -- C:\WINDOWS\system32\BtnPlus1.ocx [606208] O44 - LFC:[MD5.5BA7C680ECB4F2EED2978DA69A4D23BB] - 16/04/2013 - 07:08:18 ---A- . (.Innovasys - Innovasys FramePlus Control.) -- C:\WINDOWS\system32\FraPlus1.ocx [471040] O44 - LFC:[MD5.0DC2D11E3F3E1436DF9A932AB5CD8008] - 16/04/2013 - 07:08:18 ---A- . (.ZNsoft Corporation - Pas de description.) -- C:\WINDOWS\system32\OfficeMenu2003.ocx [225280] O44 - LFC:[MD5.F9FEC5A0700A6172D712D61739686727] - 15/04/2013 - 15:45:28 ---A- . (...) -- C:\WINDOWS\ntbtlog.txt [173808] O44 - LFC:[MD5.547374907194A7A2ECA5E5DFA861193E] - 15/04/2013 - 14:06:04 ---A- . (...) -- C:\WINDOWS\comsetup.log [2017] O44 - LFC:[MD5.9BE0F01B57C141D8249A2A0B09EC3C42] - 15/04/2013 - 14:06:04 ---A- . (...) -- C:\WINDOWS\iis6.log [979] O44 - LFC:[MD5.48604D3DF0367D0087ADB33AE4639A36] - 15/04/2013 - 14:06:04 ---A- . (...) -- C:\WINDOWS\imsins.log [1374] O44 - LFC:[MD5.900B38A2BC47599D443BF19F0F2796B9] - 15/04/2013 - 14:06:04 ---A- . (...) -- C:\WINDOWS\ntdtcsetup.log [1224] O44 - LFC:[MD5.02A2B060B11632B4C45EB7479F541097] - 15/04/2013 - 14:06:04 ---A- . (...) -- C:\WINDOWS\ocmsn.log [342] O44 - LFC:[MD5.11B1CE46427F8CCC051713D190D0AD72] - 15/04/2013 - 14:06:04 ---A- . (...) -- C:\WINDOWS\tsoc.log [2359] O44 - LFC:[MD5.5791CBC9BEC7531467A1781E407F9636] - 15/04/2013 - 14:06:03 ---A- . (...) -- C:\WINDOWS\msgsocm.log [309] O44 - LFC:[MD5.58E0B052976C4241AD9EC4DC20AE6741] - 15/04/2013 - 14:06:03 ---A- . (...) -- C:\WINDOWS\ocgen.log [2956] O44 - LFC:[MD5.886936405CD65F47B779CB2C67D8C800] - 15/04/2013 - 14:06:01 ---A- . (...) -- C:\WINDOWS\FaxSetup.log [6184] O44 - LFC:[MD5.A993D2039BB8E5CAFDD6D6289E796554] - 15/04/2013 - 12:11:46 ---A- . (...) -- C:\AdwCleaner[S1].txt [4108] O44 - LFC:[MD5.8ABDBA6D45B98C662C18F59FA3CDC18D] - 13/04/2013 - 00:24:19 ---A- . (...) -- C:\WINDOWS\hpoins05.dat [68960] ~ Files: 41 Legitimates Filtered in 02mn 26s ---\\ Derniers fichiers créés dans Windows Prefetcher (O45) O45 - LFCP:[MD5.7B39555A36DA121C6C1FDC3B215ADB92] - 16/04/2013 - 08:34:34 ---A- - C:\WINDOWS\Prefetch\SPBBCSVC.EXE-0E3F2ACD.pf O45 - LFCP:[MD5.D2DE85A442716A2C2C8C10C322BA5F95] - 16/04/2013 - 08:35:24 ---A- - C:\WINDOWS\Prefetch\CCSETMGR.EXE-0BD7C211.pf O45 - LFCP:[MD5.ECE50EDA1C0B6D9780EF8F55CD89900F] - 16/04/2013 - 08:37:40 ---A- - C:\WINDOWS\Prefetch\CCEVTMGR.EXE-16E10D66.pf O45 - LFCP:[MD5.C9CD2BAEC392E37AF8946A62E35FDE24] - 17/04/2013 - 07:14:00 ---A- - C:\WINDOWS\Prefetch\MESSAGECHECK.EXE-19FD9FD3.pf O45 - LFCP:[MD5.F57691CCC767FD7C5E7AFB6034928A4B] - 17/04/2013 - 07:24:32 ---A- - C:\WINDOWS\Prefetch\SERVICES.EXE-2F433351.pf O45 - LFCP:[MD5.597C053540FA694C8BC94A078826B2EF] - 17/04/2013 - 07:24:52 ---A- - C:\WINDOWS\Prefetch\CISVC.EXE-21F69875.pf O45 - LFCP:[MD5.22722F7301E1DE1007364BD3220B24FC] - 17/04/2013 - 07:24:56 ---A- - C:\WINDOWS\Prefetch\DEFWATCH.EXE-072A5A71.pf O45 - LFCP:[MD5.5031E00CBCA715644EF9D86727651B6A] - 17/04/2013 - 07:25:09 ---A- - C:\WINDOWS\Prefetch\MDM.EXE-1EFE14A5.pf O45 - LFCP:[MD5.11D946719D3D5A2E19C8CC4FFCE65AA5] - 17/04/2013 - 07:25:15 ---A- - C:\WINDOWS\Prefetch\MSCAMS32.EXE-0322BB5E.pf O45 - LFCP:[MD5.4DE13342AB9CAC7B470B015B47E7103D] - 17/04/2013 - 07:25:21 ---A- - C:\WINDOWS\Prefetch\OUCORE.EXE-10371D4D.pf O45 - LFCP:[MD5.576EFF3C4F323627763D0A405208E1D7] - 17/04/2013 - 07:25:36 ---A- - C:\WINDOWS\Prefetch\RTVSCAN.EXE-1D887DCC.pf ~ Prefetcher: 58 Legitimates Filtered in 00mn 02s ---\\ Opérations et fonctions au démarrage de Windows Explorer (O46) O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll ~ ShellExecuteHooks: Scanned in 00mn 00s ---\\ Export de clé d'application autorisée (O47) O47 - AAKE:Key Export SP - "C:\Program Files\Securitoo\av_fw\backweb\1044199\Program\backWeb-1044199.exe" [Enabled] .(...) -- C:\Program Files\Securitoo\av_fw\backweb\1044199\Program\backWeb-1044199.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Program Files\Orange Link\Application\eConfv4\olinkp.exe" [Enabled] .(...) -- C:\Program Files\Orange Link\Application\eConfv4\olinkp.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Program Files\Orange Link\Application\Exe\Orange Link.exe" [Enabled] .(...) -- C:\Program Files\Orange Link\Application\exe\Orange Link.exe (.not file.) O47 - AAKE:Key Export SP - "D:\setup.exe" [Enabled] .(...) -- D:\setup.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Program Files\Internet Explorer\DualPix Exchange\Station2.exe" [Enabled] .(...) -- C:\Program Files\Internet Explorer\DualPix Exchange\Station2.exe (.not file.) ~ Keys Export: 38 Legitimates Filtered in 00mn 06s ---\\ Déni du service (Local Security Authority) (O48) O48 - LSA:Local Security Authority Authentication Packages . (...) -- ~ LSA: 7 Legitimates Filtered in 00mn 00s ---\\ Image File Execution Options (IFEO) (O50) O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d ~ IFEO: Scanned in 00mn 00s ---\\ Microsoft Windows Policies Explorer (O56) O56 - MWPE:[HKCU\...\policies\Explorer] - "NoSMBalloonTip"=0 ~ MWPE Keys: 4 Legitimates Filtered in 00mn 00s ---\\ Liste des Drivers Système (O58) O58 - SDL:[MD5.C685CC27A2E637F0DCB5A45E67CC6F74] - 03/05/2003 - 05:10:46 ---A- . (.Oak Technology Inc. - Audio File System.) -- C:\WINDOWS\system32\Drivers\AFS2K.SYS [43672] O58 - SDL:[MD5.6D3ADA4CE95CECA7BCE527A08C4C474E] - 05/08/2004 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ansi.sys [9037] ~ Drivers: Scanned in 00mn 00s ---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61) O61 - LFC: 15/04/2013 - 13:20:15 -SHA- C:\Documents and Settings\Paguy\UserData\index.dat [16384] O61 - LFC: 15/04/2013 - 16:33:57 ---A- C:\Documents and Settings\Paguy\Local Settings\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\04152013.Log [770] O61 - LFC: 16/04/2013 - 07:09:04 ---A- C:\Documents and Settings\Paguy\Application Data\Microsoft\Internet Explorer\Quick Launch\ZNsoft Free.lnk [1845] O61 - LFC: 16/04/2013 - 07:09:04 ---A- C:\Documents and Settings\Paguy\Bureau\ZNsoft Free.lnk [1827] O61 - LFC: 16/04/2013 - 07:09:51 ---A- C:\Documents and Settings\Paguy\Local Settings\Application Data\Google\Toolbar\metrics_2493979574182.xml [5424] O61 - LFC: 16/04/2013 - 07:09:52 ---A- C:\Documents and Settings\Paguy\Local Settings\Application Data\Microsoft\Internet Explorer\frameiconcache.dat [18712] O61 - LFC: 16/04/2013 - 07:12:32 ---A- C:\Documents and Settings\Paguy\Local Settings\Application Data\Google\Toolbar\metrics_2974330035446.xml [3052] O61 - LFC: 16/04/2013 - 08:06:39 ---A- C:\Documents and Settings\Paguy\Application Data\Microsoft\Internet Explorer\Quick Launch\ZNsoft Xp.lnk [1909] O61 - LFC: 16/04/2013 - 08:06:39 ---A- C:\Documents and Settings\Paguy\Bureau\ZNsoft Xp.lnk [1891] O61 - LFC: 16/04/2013 - 08:07:06 ---A- C:\Documents and Settings\Paguy\Local Settings\Application Data\Google\Toolbar\metrics_12773472978042.xml [1549] O61 - LFC: 17/04/2013 - 07:18:40 ---A- C:\Documents and Settings\Paguy\Recent\mbam-log-2013-04-16 (21-38-36).txt.lnk [369] O61 - LFC: 17/04/2013 - 07:18:41 ---A- C:\Documents and Settings\Paguy\Recent\USB2GO (E).lnk [185] O61 - LFC: 17/04/2013 - 07:20:58 ---A- C:\Documents and Settings\Paguy\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences [328] O61 - LFC: 17/04/2013 - 07:27:36 -SHA- C:\Documents and Settings\Paguy\Application Data\Microsoft\Credentials\S-1-5-21-2050404483-677177641-1429353510-1007\Credentials [1332] O61 - LFC: 17/04/2013 - 07:27:36 -SHA- C:\Documents and Settings\Paguy\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-2050404483-677177641-1429353510-1007\Credentials [2954] O61 - LFC: 17/04/2013 - 07:40:45 -SHA- C:\Documents and Settings\Paguy\IETldCache\index.dat [262144] ~ 3 Fichiers temporaires (Temporary files) ~ 3 Fichiers cookies (Cookies files) ~ Files: 40 Legitimates Filtered in 06mn 17s ---\\ Liste des outils de nettoyage (O63) O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 ~ ADS: Scanned in 00mn 00s ---\\ Liste des services Legacy (O64) O64 - Services: CurCS - 14/04/2008 - C:\WINDOWS\system32\svchost.exe (EventSystem) .(.Microsoft Corporation - Generic Host Process for Win32 Services.) - LEGACY_EVENTSYSTEM O64 - Services: CurCS - 27/07/2004 - C:\Program Files\HPQ\SHARED\HPQWMI.exe (hpqwmi) .(.Hewlett-Packard Development Company, L.P. - hpqwmi Module.) - LEGACY_HPQWMI O64 - Services: CurCS - 10/05/2004 - C:\Program Files\iPod\bin\iPodService.exe (iPodService) .(.Apple Computer, Inc. - Module iPodService.) - LEGACY_IPODSERVICE O64 - Services: CurCS - 01/05/2003 - C:\WINDOWS\system32\DRIVERS\strmdisp.sys (StreamDispatcher) .(.Conexant Systems, Inc. - Conexant Stream Dispatcher.) - LEGACY_STREAMDISPATCHER O64 - Services: CurCS - ??\??\???? - Pas de propriétaire (ZDPSp50) .(...) - LEGACY_ZDPSP50 ~ Legacy: 163 Legitimates Filtered in 00mn 05s ---\\ File Associations Shell Spawning (O67) O67 - Shell Spawning: <.js> [HKLM\..\open\Command] (.Microsoft Corporation - Microsoft (R) Console Based Script Host.) -- C:\WINDOWS\system32\CScript.exe O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.Not Key.) O67 - Shell Spawning: <.js> [HKCR\..\open\Command] (.Microsoft Corporation - Microsoft (R) Console Based Script Host.) -- C:\WINDOWS\system32\CScript.exe ~ FASS Keys: 17 Legitimates Filtered in 00mn 00s ---\\ Start Menu Internet (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O68 - StartMenuInternet: <>[HKLM\..\Shell\open\Command] (.Not Key.) ~ Keys: Scanned in 00mn 00s ---\\ Search Browser Infection (O69) O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - http://www.bing.com O69 - SBI: SearchScopes [HKCU] {814C76CB-2623-43F4-AAD0-58A0E5190A20} - (Orange) - http://r.orange.fr O69 - SBI: SearchScopes [HKCU] {D34B1B88-B943-4964-A4C3-25AFAEB32641} - (Bing) - http://www.bing.com O69 - SBI: SearchScopes [HKCU] {DEC0D2B4-C57F-43CE-A300-DAEC186F35FD} - (Search) - http://flvdirect.iamwired.net ~ Keys: Scanned in 00mn 00s ---\\ Recherche particuliere à la racine de certains dossiers (O84) [MD5.030F8EB58FC0172F3F26BE0F98B6A249] [SPRF][12/01/2005] (...) -- C:\Documents and Settings\Paguy\Local Settings\Application Data\fusioncache.dat [128] [MD5.BDA238D4079311DB2C4C96A5A098C956] [SPRF][17/03/2013] (...) -- C:\Documents and Settings\Paguy\Bureau\adwcleaner (1).exe [597667] [MD5.02C4F6C257542FCB7C58B7164D674471] [SPRF][13/04/2013] (...) -- C:\Documents and Settings\Paguy\Bureau\adwcleaner.exe [613083] [MD5.0FB6D382FA5FBF72D05FC2A4503B7DF2] [SPRF][17/03/2013] (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Documents and Settings\Paguy\Bureau\mbam-setup-1.70.0.1100.exe [10156344] [MD5.8A200CBE3AF04B7212AF0F94FA143EBA] [SPRF][17/03/2013] (...) -- C:\Documents and Settings\Paguy\Bureau\RogueKiller-8.5.3.exe [816128] [MD5.6EAB6295856E32F8962EDE34C920FAD3] [SPRF][24/02/2007] (.InstallShield Software Corporation - InstallShield (R) Setup Launcher.) -- C:\Program Files\SetupSynchroInternetOrange_3.66.003.exe [3168212] [MD5.29CFE9ED23C55E55838A789EB1182A9B] [SPRF][04/10/2008] (.Adobe Systems Incorporated - Adobe® Flash® Player ActiveX Installer.) -- C:\WINDOWS\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe [1887080] ~ Files: Scanned in 00mn 04s ---\\ Scan Additionnel (O88) Database Version : v2.11560 - (16/04/2013) Clés trouvées (Keys found) : 21 Valeurs trouvées (Values found) : 0 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype [HKLM\Software\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype [HKLM\Software\Microsoft\Internet Explorer\extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype [HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{A047FE02-C91C-41CB-898C-4ED21B86025A}] =>Toolbar.Orange [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype [HKLM\Software\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}] =>Toolbar.Agent [HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}] =>Toolbar.Agent [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}] =>Toolbar.Agent [HKLM\Software\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}] =>Toolbar.Agent [HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}] =>Toolbar.Agent [HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}] =>Toolbar.Agent [HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] =>Toolbar.Bing [HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] =>Toolbar.Bing [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D970ED5-3EDA-438D-BFFD-715931E2775B}] =>Toolbar.Sorcim [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1D970ED5-3EDA-438D-BFFD-715931E2775B}] =>Toolbar.Sorcim [HKLM\Software\Classes\CLSID\{1D970ED5-3EDA-438D-BFFD-715931E2775B}] =>Toolbar.Sorcim [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1D970ED5-3EDA-438D-BFFD-715931E2775B}] =>Toolbar.Sorcim ~ Additionnel: Scanned in 00mn 39s ---\\ Product Upgrade Codes (O90) O90 - PUC: "160231E2A87C4D848A99D1319B1D98AF" . (.Memories Disc Creator 2.0.) -- C:\WINDOWS\Installer\{2E132061-C78A-48D4-A899-1D13B9D189FA}\HewlettPackard_0002ICON.exe ~ Update Products: 91 Legitimates Filtered in 00mn 00s ---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped) SR - | Auto 24/03/2006 192160 | (ccEvtMgr) . (.Symantec Corporation.) - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe SR - | Auto 24/03/2006 169632 | (ccSetMgr) . (.Symantec Corporation.) - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe SR - | Auto 01/08/2006 31888 | (DefWatch) . (.Symantec Corporation.) - C:\Program Files\Symantec AntiVirus\DefWatch.exe SS - | Demand 14/04/2008 225280 | (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\system32\dmadmin.exe SS - | Auto 05/02/2010 135664 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 05/02/2010 135664 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 29/11/2012 194032 | (gusvc) . (.Google.) - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe SS - | Demand 27/07/2004 98304 | (hpqwmi) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files\HPQ\SHARED\HPQWMI.exe SS - | Demand 14/11/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe SS - | Demand 10/05/2004 401408 | (iPodService) . (.Apple Computer, Inc..) - C:\Program Files\iPod\bin\iPodService.exe SR - | Auto 15/01/2013 154032 | (JavaQuickStarterService) . (.Sun Microsystems, Inc..) - C:\Program Files\Java\jre6\bin\jqs.exe SS - | Demand 29/03/2006 2045632 | C:\Program Files\Symantec\LIVEUP~1\LUCOMS~1.exe (LiveUpdate) . (.Symantec Corporation.) - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.exe SR - | Auto 12/03/2004 81920 | (NVSvc) . (.NVIDIA Corporation.) - C:\WINDOWS\system32\nvsvc32.exe SS - | Auto 18/09/2012 1082016 | (Orange update Core Service) . (.France Telecom SA.) - C:\Program Files\Orange\OrangeUpdate\Service\OUCore.exe SR - | Auto 09/08/2007 73728 | (Pml Driver HPZ12) . (.HP.) - C:\WINDOWS\system32\HPZipm12.exe SS - | Demand 01/08/2006 118928 | (SavRoam) . (.symantec.) - C:\Program Files\Symantec AntiVirus\SavRoam.exe SR - | Auto 13/08/2012 3064000 | (Skype C2C Service) . (.Skype Technologies S.A..) - C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe SS - | Auto 09/11/2012 160944 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe SS - | Demand 24/01/2006 214720 | (SNDSrvc) . (.Symantec Corporation.) - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe SR - | Auto 11/04/2006 1160848 | (SPBBCSvc) . (.Symantec Corporation.) - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe SR - | Auto 01/08/2006 1827472 | (Symantec AntiVirus) . (.Symantec Corporation.) - C:\Program Files\Symantec AntiVirus\Rtvscan.exe ~ Services: Scanned in 00mn 05s ---\\ Recherche Master Boot Record Infection (MBR)(O80) Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net Run by Paguy at 17/04/2013 09:01:36 device: opened successfully user: MBR read successfully Disk trace: called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 1 nt!IofCallDriver[0x804E13B9] >> \Device\Harddisk0\DR0[0x8234DAB8] kernel: MBR read successfully user & kernel MBR OK ~ MBR: 13 Legitimates Filtered in 00mn 02s ---\\ Recherche Master Boot Record Infection (MBRCheck)(O80) Written by ad13, http://ad13.geekstog Run by Paguy at 17/04/2013 09:01:38 ********* Dump file Name ********* C:\PhysicalDisk0_MBR.bin ~ MBR: Scanned in 00mn 04s ~ 1003 Legitimates filtered by white list End of the scan (567 lines in 17mn 27s)(0)