~ Rapport de ZHPDiag v2013.9.23.44 - Nicolas Coolman (23/09/2013) ~ Lancé par Moulis (24/09/2013 13:54:43) ~ Adresse du Site Web http://nicolascoolman.webs.com ~ Traduit par Nicolas Coolman ~ Etat de la version : ~ Liste blanche : Activée par le programme ~ Elévation des Privilèges : OK ~ User Account Control (UAC): Deactivate by program ---\\ Navigateurs Internet MSIE: Internet Explorer v10.0.9200.16686 MFIE: Mozilla Firefox 24.0 (Defaut) GCIE: Google Chrome v29.0.1547.76 ---\\ Informations sur les produits Windows ~ Langage: Français Windows 7 Home Premium Edition, 32-bit Service Pack 1 (Build 7601) Windows Server License Manager Script : OK ~ Windows(R) 7, OEM_COA_NSLP channel Windows ID Activation : OK ~ Windows Partial Key : 4RQY6 Windows License : OK ~ Windows Remaining Initializations Number : 4 Software Protection Service (Protection logicielle) : OK Windows Automatic Updates : OK Windows Activation Technologies : OK ---\\ Logiciels de protection du système Avira Free Antivirus v13.0.0.4042 Malwarebytes Anti-Malware version 1.75.0.1300 Windows Defender W7 ---\\ Logiciels d'optimisation du système CCleaner v4.05 =>Piriform Ltd ---\\ Logiciels de partage PeerToPeer Vuze v4.6 =>P2P.Azureus ---\\ Surveillance de Logiciels Adobe Flash Player 11 Plugin Adobe Reader XI Java 7 Update 40 ---\\ Informations sur le système ~ Processor: x86 Family 16 Model 6 Stepping 2, AuthenticAMD ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 1791 MB (38% free) System Restore: Activé (Enable) System drive C: has 160 GB (68%) free of 233 GB ---\\ Mode de connexion au système ~ Computer Name: FIFFE ~ User Name: Moulis ~ All Users Names: Moulis, HomeGroupUser$, Administrateur, ~ Unselected Option: O45,O61 Logged in as Administrator ---\\ Variables d'environnement ~ System Unit : C:\ ~ %AppData% : C:\Users\Moulis\AppData\Roaming\ ~ %Desktop% : C:\Users\Moulis\Desktop\ ~ %Favorites% : C:\Users\Moulis\Favorites\ ~ %LocalAppData% : C:\Users\Moulis\AppData\Local\ ~ %StartMenu% : C:\Users\Moulis\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\\ Enumération des unités disques C: Hard drive, Flash drive, Thumb drive (Free 160 Go of 233 Go) D: CD-ROM drive (Not Inserted) ---\\ Etat du Centre de Sécurité Windows ~ Security Center: 29 Legitimates Filtered in 00mn 00s ---\\ Recherche particulière de fichiers génériques [MD5.8B88EBBB05A0E56B7DCC708498C02B3E] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 06:30:54.) -- C:\Windows\Explorer.exe [2616320] [MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:14:45.) -- C:\Windows\System32\Wininit.exe [96256] [MD5.535F6263035F2530A62D5D64EF6E73D3] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.10/08/2013 - 04:59:10.) -- C:\Windows\System32\wininet.dll [1767936] [MD5.6D13E1406F50C66E2A95D97F22C47560] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.20/11/2010 - 13:17:54.) -- C:\Windows\System32\Winlogon.exe [286720] [MD5.E3AE23569749DE12D45BA3B489A036AE] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 13:21:24.) -- C:\Windows\System32\sppcomapi.dll [193536] [MD5.9EBBBA55060F786F0FCAA3893BFA2806] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.25/04/2011 - 03:18:03.) -- C:\Windows\system32\Drivers\AFD.sys [338944] [MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:26:15.) -- C:\Windows\system32\Drivers\atapi.sys [21584] [MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:11:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656] [MD5.BE167ED0FDB9C1FA1133953C18D5A6C9] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 09:38:10.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544] [MD5.F024449C97EC1E464AAFFDA18593DB88] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 09:42:32.) -- C:\Windows\system32\Drivers\DfsC.sys [78336] [MD5.9036377B8A6C15DC2EEC53E489D159B5] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 10:59:29.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544] [MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:11:24.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896] [MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 00:54:29.) -- C:\Windows\system32\Drivers\IpNat.sys [101888] [MD5.5D16C921E3671636C0EBA3BBAAC5FD25] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:17:22.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123904] [MD5.280122DDCF04B378EDD1AD54D71C1E54] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 09:39:44.) -- C:\Windows\system32\Drivers\netBT.sys [187904] [MD5.5E43D2B0EE64123D4880DFA6626DEFDE] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 14:45:29.) -- C:\Windows\system32\Drivers\ntfs.sys [1211752] [MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 00:45:35.) -- C:\Windows\system32\Drivers\Parport.sys [79360] [MD5.D9F91EAFEC2815365CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.14/07/2009 - 00:54:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848] [MD5.3E21C083B8A01CB70BA1F09303010FCE] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 00:53:41.) -- C:\Windows\system32\Drivers\smb.sys [71168] [MD5.B459575348C20E8121D6039DA063C704] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 09:39:17.) -- C:\Windows\system32\Drivers\tdx.sys [74752] [MD5.F497F67932C6FA693D7DE2780631CFE7] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 13:30:16.) -- C:\Windows\system32\Drivers\volsnap.sys [245632] ~ Generic Processes: Scanned in 00mn 01s ---\\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 2/10300 ~ Mes musiques (My Musics) : 1/4734 ~ Mes Videos (My Videos) : 2/35 ~ Mes Favoris (My Favorites) : 1/45 ~ Mes Documents (My Documents) : 1/695 ~ Mon Bureau (My Desktop) : 2/150 ~ Menu demarrer (Programs) : 1/31 ~ Hidden Files: Scanned in 01mn 10s ---\\ Processus lancés [MD5.CEC11C45A2728C8D8F1C7EC4638956E5] - (.VIA - VIA HD Audio CPL.) -- C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe [1690224] [PID.1904] [MD5.1B13227DB8271040CEB5128414EE2742] - (.Logitech Inc. - Logitech Webcam Software.) -- C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe [190808] [PID.1912] [MD5.E774F875819DEE4A312A921A88F779FE] - (.Microsoft Corporation - IPoint.exe.) -- C:\Program Files\Microsoft IntelliPoint\ipoint.exe [1821576] [PID.1920] [MD5.CFE4BD7C25A750D71A5BD2390953BEB6] - (.Microsoft Corporation - IType.exe.) -- C:\Program Files\Microsoft IntelliType Pro\itype.exe [1313640] [PID.1928] [MD5.DB3F7F19F942D3CE4E1A0E8D9FF541FB] - (.Avira Operations GmbH & Co. KG - Avira System Tray Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192] [PID.1936] [MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336] [PID.1952] [MD5.C861851A0BBD9903E324487011AA3705] - (.Advanced Micro Devices Inc. - Catalyst Control Center: Monitoring program.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [299008] [PID.1996] [MD5.3647D444D0A674EA494D43AC78D98D84] - (...) -- C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe [203096] [PID.2004] [MD5.8EA4AAF03CE0D00CB91FCEE88909E2E9] - (...) -- C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe [687448] [PID.1352] [MD5.D28C5A1411BB0B47E05E0D6AAF896690] - (.ATI Technologies Inc. - Catalyst Control Center: Host application.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [299008] [PID.2592] [MD5.5DC2734641995889DF9D53C04A2786D0] - (.Glarysoft Ltd - Glary Utilities 3.) -- C:\Program Files\Glary Utilities 3\Integrator.exe [470816] [PID.2900] [MD5.70C884779005698988DA6FB93D9B8DFA] - (.QFX Software Corporation - KeyScrambler.) -- C:\Program Files\KeyScrambler\KeyScrambler.exe [508048] [PID.3684] [MD5.197C93BA7B3BC1B6A0FDF3E4C4C77239] - (.Tencent Inc. - Internet Mail Client.) -- C:\Program Files\Foxmail\Foxmail.exe [7403336] [PID.3052] =>Adware.TencentAddressBar [MD5.D4B2479756A397805ACEA19BA3596E2A] - (.Sandboxie Holdings, LLC - Sandboxie Control.) -- C:\Program Files\Sandboxie\SbieCtrl.exe [543320] [PID.592] [MD5.A63AA5888E2CC73813E4F8BCB2802BF6] - (.Sandboxie Holdings, LLC - Sandboxie COM Services (RPC).) -- C:\Program Files\Sandboxie\SandboxieRpcSs.exe [26712] [PID.3004] [MD5.07B75686FC395B7171ACB1ADB8BB83D5] - (.Sandboxie Holdings, LLC - Sandboxie COM Services (DCOM).) -- C:\Program Files\Sandboxie\SandboxieDcomLaunch.exe [18520] [PID.3696] [MD5.A9182CE59CFC56F9C1DDE8B3C0AE8378] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe [274840] [PID.3660] [MD5.12FD4EF8F2CBBF98E0A5CED88258DDF3] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files\Mozilla Firefox\plugin-container.exe [17816] [PID.3880] [MD5.75B191596E6C2F149AA8E0228B3E0B3A] - (.Sandboxie Holdings, LLC - Sandboxie Service.) -- C:\Program Files\Sandboxie\SbieSvc.exe [129112] [PID.1188] [MD5.A63DC5C2EA944E6657203E0C8EDEAF61] - (.Microsoft Corporation - COM Surrogate.) -- C:\Windows\System32\dllhost.exe [7168] [PID.4036] [MD5.D63791AEA2D98C5B3A2881A230613B8E] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8006144] [PID.5436] ~ Processes Running: Scanned in 00mn 01s ---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2) C:\Users\Moulis\AppData\Local\Google\Chrome\User Data\Default\Preferences G1 - GCS: Preference [User Data\Default] http://www.google.com ~ Google Browser: 12 Legitimates Filtered in 00mn 11s ---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) C:\Users\Moulis\AppData\Roaming\Mozilla\Firefox\Profiles\x2vbk9z4.default\prefs.js M0 - MFSP: prefs.js [Moulis - x2vbk9z4.default] http://twitter.com M2 - MFEP: prefs.js [Moulis - x2vbk9z4.default\foxyproxy@eric.h.jung] [] FoxyProxy Basic v3.2.2 (..) =>Hijacker.Proxy M2 - MFEP: prefs.js [Moulis - x2vbk9z4.default\newtaburl@sogame.cat] [] NewTabURL v2.2.3 (..) M2 - MFEP: prefs.js [Moulis - x2vbk9z4.default\NPCamfrogWeb@camfrogweb.com] [] Camfrog Web Plugin for Mozilla Firefox v2,0,12,93 (..) P2 - FPN: [HKLM] [@camfrogweb.com/Camfrog Web Plugin,version=2,0] - (.Camshare Inc. - Camfrog Web FF Plugin ver:2,0,11,91.) -- C:\Program Files\CFWebAdvancedU2\npcamfrogweb.dll ~ Firefox Browser: 29 Legitimates Filtered in 00mn 01s ---\\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe ~ Keys: Scanned in 00mn 00s ---\\ Hosts file redirection (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 00s ~ Nombre de lignes (Lines number): 19 ---\\ Autres liens utilisateurs (O4) O4 - GS\Desktop [Public]: CanoScan Toolbox 4.9.lnk . (.CANON INC. - CanoScan Toolbox Application.) -- C:\Program Files\Canon\CanoScan Toolbox Ver4.9\CSTBox.exe O4 - GS\Desktop [Public]: CyberGhost VPN.lnk . (.CyberGhost SRL - CyberGhost VPN Client.) -- C:\Program Files\S.A.D\CyberGhost VPN\CyberGhost.exe O4 - GS\Desktop [Public]: FotoSketcher.lnk . (...) -- C:\Program Files\FotoSketcher\FotoSketcher.exe O4 - GS\Desktop [Public]: HD VDeck.lnk . (.VIA - VIA HD Audio CPL.) -- C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe O4 - GS\Desktop [Public]: TweetAdder4.lnk . (.TweetAdder.com - Pas de description.) -- C:\Program Files\TweetAdder4\TweetAdder4.exe O4 - GS\Desktop [Public]: Vuze.lnk . (.Vuze Inc. - Pas de description.) -- C:\Program Files\Vuze\Azureus.exe =>P2P.Azureus O4 - GS\Program [Public]: HD VDeck.lnk . (.VIA - VIA HD Audio CPL.) -- C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe O4 - GS\Program [Public]: Vuze.lnk . (.Vuze Inc. - Pas de description.) -- C:\Program Files\Vuze\Azureus.exe =>P2P.Azureus O4 - GS\QuickLaunch [Moulis]: Vuze.lnk . (.Vuze Inc. - Pas de description.) -- C:\Program Files\Vuze\Azureus.exe =>P2P.Azureus O4 - GS\Program [Moulis]: Windows Install Clean Up.lnk . (...) -- C:\Users\Moulis\AppData\Roaming\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe O4 - GS\SendTo [Moulis]: Foxmail.LNK . (.Tencent Inc. - Internet Mail Client.) -- C:\Program Files\Foxmail\Foxmail.exe =>Adware.TencentAddressBar O4 - GS\SendTo [Moulis]: Sandboxie - DefaultBox.lnk . (.Sandboxie Holdings, LLC - Sandboxie Start.) -- C:\Program Files\Sandboxie\Start.exe O4 - GS\Desktop [Moulis]: firefox - Raccourci.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O4 - GS\Desktop [Moulis]: Foxmail.lnk . (.Tencent Inc. - Internet Mail Client.) -- C:\Program Files\Foxmail\Foxmail.exe =>Adware.TencentAddressBar O4 - GS\Desktop [Moulis]: Téléchargements - Raccourci.lnk . (...) -- C:\Users\Moulis\Downloads ~ Global Startup: 73 Legitimates Filtered in 00mn 10s ---\\ Applications lancées au démarrage du sytème (O4) O4 - HKLM\..\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe =>.Advanced Micro Devices, Inc O4 - HKLM\..\Run: [HDAudDeck] . (.VIA - VIA HD Audio CPL.) -- C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe O4 - HKLM\..\Run: [LWS] . (.Logitech Inc. - Logitech Webcam Software.) -- C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe O4 - HKLM\..\Run: [IntelliPoint] . (.Microsoft Corporation - IPoint.exe.) -- c:\Program Files\Microsoft IntelliPoint\ipoint.exe O4 - HKLM\..\Run: [itype] . (.Microsoft Corporation - IType.exe.) -- c:\Program Files\Microsoft IntelliType Pro\itype.exe O4 - HKLM\..\Run: [avgnt] . (.Avira Operations GmbH & Co. KG - Avira System Tray Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation O4 - HKLM\..\Run: [KeyScrambler] . (.QFX Software Corporation - KeyScrambler.) -- C:\Program Files\KeyScrambler\keyscrambler.exe O4 - HKCU\..\Run: [Foxmail] . (.Tencent Inc. - Internet Mail Client.) -- C:\Program Files\Foxmail\Foxmail.exe =>Adware.TencentAddressBar O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation O4 - HKCU\..\Run: [FileHippo.com] . (.FileHippo.com - FileHippo.com Update Checker.) -- C:\Program Files\FileHippo.com\UpdateChecker.exe O4 - HKCU\..\Run: [SandboxieControl] . (.Sandboxie Holdings, LLC - Sandboxie Control.) -- C:\Program Files\Sandboxie\SbieCtrl.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-21-2266754613-444198248-96935908-1000\..\Run: [Foxmail] . (.Tencent Inc. - Internet Mail Client.) -- C:\Program Files\Foxmail\Foxmail.exe =>Adware.TencentAddressBar O4 - HKUS\S-1-5-21-2266754613-444198248-96935908-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-21-2266754613-444198248-96935908-1000\..\Run: [FileHippo.com] . (.FileHippo.com - FileHippo.com Update Checker.) -- C:\Program Files\FileHippo.com\UpdateChecker.exe O4 - HKUS\S-1-5-21-2266754613-444198248-96935908-1000\..\Run: [SandboxieControl] . (.Sandboxie Holdings, LLC - Sandboxie Control.) -- C:\Program Files\Sandboxie\SbieCtrl.exe ~ Application: Scanned in 00mn 00s ---\\ Site dans la Zone de confiance d'Internet Explorer (O15) O15 - Trusted Zone: [HKCU\...\Domains] *.chat-land.com =>Hijacker.ChercheUS O15 - Trusted Zone: [HKCU\...\Domains] *.chat-land.net =>Hijacker.ChercheUS O15 - Trusted Zone: [HKCU\...\Domains] *.search-web.net ~ IE Zone Confiance: Scanned in 00mn 00s ---\\ Objets ActiveX (Downloaded Program Files)(O16) O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} ((no name)) - http://liveupdate.msi.com.tw/autobios/LOnline/RELEASECAB/install.cab O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} ((no name)) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_5_1_2_1.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} ((no name)) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} ((no name)) - http://www.bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe ~ Objets ActiveX: Scanned in 00mn 00s ---\\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{C51AF8FE-BAF5-4B20-96A0-B249A8037FEF}: DhcpNameServer = 212.27.40.240 212.27.40.241 O17 - HKLM\System\CS1\Services\Tcpip\..\{C51AF8FE-BAF5-4B20-96A0-B249A8037FEF}: DhcpNameServer = 212.27.40.240 212.27.40.241 O17 - HKLM\System\CS2\Services\Tcpip\..\{C51AF8FE-BAF5-4B20-96A0-B249A8037FEF}: DhcpNameServer = 212.27.40.240 212.27.40.241 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.240 212.27.40.241 ~ Domain: Scanned in 00mn 00s ---\\ Protocole additionnel (O18) O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation O18 - Filter: application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll ~ Protocole Additionnel: Scanned in 00mn 00s ---\\ Enumère les données de BootExecute (BEX) (O34) O34 - HKLM BootExecute: (autocheck autochk * ) - File not found O34 - HKLM BootExecute: (BootDefrag.exe) - File not found O34 - HKLM BootExecute: (ennent et l'utilisation de l'espace disque sont coll) - File not found ~ BEX: 3 Legitimates Filtered in 00mn 00s ---\\ Tâches planifiées en automatique (O39) [MD5.00000000000000000000000000000000] [APT] [{116E7D0B-317B-45F7-97EB-5AEE970AC5D6}] (...) -- C:\Users\Moulis\Downloads\xiph_player_plugins_0.7.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [{F2950332-A0C5-41F8-80CF-0A1AF279A1EB}] (...) -- C:\Users\Moulis\AppData\Local\Temp\Temp1_SAGEM-Fast800-A_4_8.zip\setup.exe (.not file.) [0] ~ Scheduled Task: 19 Legitimates Filtered in 00mn 10s ---\\ Logiciels installés (O42) O42 - Logiciel: Suppress plus 1.8 - (.Perrysoft.) [HKLM] -- Suppress plus_is1 O42 - Logiciel: TweetAdder4 - (.TweetAdder.com.) [HKLM] -- {911174C5-85BF-4972-B5E0-4882B32E9396}_is1 ~ Logic: 84 Legitimates Filtered in 00mn 00s ---\\ HKCU & HKLM Software Keys [HKCU\Software\TFFP Package] [HKCU\Software\The Geek] ~ Key Software: 165 Legitimates Filtered in 00mn 00s ---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 08/07/2011 - 13:40:04 - [0,820] ----D C:\Program Files\ChangeWallpaper O43 - CFD: 20/09/2013 - 14:49:52 - [4,152] ----D C:\Program Files\splus O43 - CFD: 15/08/2013 - 22:59:58 - [22,252] ----D C:\Program Files\TweetAdder4 O43 - CFD: 18/04/2011 - 00:38:54 - [8,354] ----D C:\ProgramData\AGeeksToy O43 - CFD: 28/06/2012 - 20:15:33 - [0,000] ----D C:\ProgramData\Vivitar O43 - CFD: 26/01/2012 - 18:39:53 - [0,000] ----D C:\Users\Moulis\AppData\Roaming\AirVPN O43 - CFD: 16/12/2012 - 18:53:47 - [0] ----D C:\Users\Moulis\AppData\Roaming\TweetAdder.com O43 - CFD: 07/09/2013 - 18:52:05 - [6,030] ----D C:\Users\Moulis\AppData\Roaming\TweetAdder3 O43 - CFD: 28/06/2012 - 20:33:23 - [4,748] ----D C:\Users\Moulis\AppData\Local\Vivitar Experience Image Manager ~ Program Folder: 209 Legitimates Filtered in 00mn 46s ---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.FB66598FFD1F7773A6583A5085ABA346] - 21/09/2013 - 23:54:51 ---A- . (...) -- C:\Windows\Sandboxie.ini [1800] O44 - LFC:[MD5.995AE326D98358B7822542538FE4E851] - 20/09/2013 - 13:49:52 ---A- . (...) -- C:\Windows\System32\splus.cpl [447488] O44 - LFC:[MD5.86D35E90AECAC2AD1159AF1DD64AF904] - 20/09/2013 - 13:47:29 ---A- . (...) -- C:\Windows\System32\cc_20130920_144710.reg [110192] O44 - LFC:[MD5.AF5647AA827BC129A1B513CE94B13C9C] - 20/09/2013 - 13:33:49 ---A- . (...) -- C:\DiskDefrag.log [75] O44 - LFC:[MD5.CFC68161B61C0D1D180734A891FAB469] - 19/09/2013 - 11:53:37 ---A- . (...) -- C:\Windows\System32\???z [98352290] O44 - LFC:[MD5.73FE8285D075FE7F0CD980870A09AF3D] - 19/09/2013 - 01:21:03 ---A- . (...) -- C:\Windows\wininit.ini [79] O44 - LFC:[MD5.2332DE089F89447B9DB50D9506B5D0AA] - 17/09/2013 - 22:40:37 ---A- . (...) -- C:\PhysicalMBR.bin [512] O44 - LFC:[MD5.DC0F33BE0FBE4B64704732EE81CBDD42] - 17/09/2013 - 17:55:08 ---A- . (...) -- C:\Windows\System32\cc_20130917_185457.reg [398] O44 - LFC:[MD5.8EFADCE50A2CE2A3A1AE713455896540] - 16/09/2013 - 15:38:32 ---A- . (...) -- C:\Windows\System32\cc_20130916_163826.reg [2146] O44 - LFC:[MD5.106B67AD9B49597FF731281640878D87] - 16/09/2013 - 15:38:10 ---A- . (...) -- C:\Windows\System32\cc_20130916_163655.reg [191610] O44 - LFC:[MD5.04FA1A41069E5E936F45E9F6373DECF5] - 11/09/2013 - 23:54:59 ---A- . (...) -- C:\Windows\System32\???y [97181529] ~ Files: 93 Legitimates Filtered in 01mn 48s ---\\ Clé de registre Shell MountPoints2 (MPKS) (O51) O51 - MPSK:{5b85a279-6844-11e0-acef-806e6f6e6963}\AutoRun\command. (...) -- D:\autorun.exe (.not file.) ~ Keys: Scanned in 00mn 00s ---\\ Enumération des clés de registre StartupReg (SMSR) (O53) O53 - SMSR:HKLM\...\startupreg\ChangeWallpaper [Key] . (.T. Vacher - Logiciel de gestion de fond d'écrans à thèm.) -- C:\Program Files\ChangeWallpaper\ChangeWallpaper.exe O53 - SMSR:HKLM\...\startupreg\openvpn-gui [Key] . (...) -- C:\Program Files\UltraVPN\bin\openvpn-gui.exe (.not file.) ~ SMSR Keys: 10 Legitimates Filtered in 00mn 00s ---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55) O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 ~ MWPS: 18 Legitimates Filtered in 00mn 00s ---\\ Liste des pilotes du système (SDL) (O58) O58 - SDL:[MD5.0ED67910C8C326796FAA00B2BF6D9D3C] - 14/07/2009 - 02:20:28 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [453712] O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 13/07/2009 - 22:40:41 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029] ~ Drivers: 18 Legitimates Filtered in 00mn 00s ---\\ Liste des outils de désinfection (LATC) (O63) O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman O63 - Logiciel: RSIT - (.random/random.) ~ ADS: Scanned in 00mn 00s ---\\ Liste les services legacy du registre (LALS) (O64) O64 - Services: CurCS - 02/01/1601 - Pas de propriétaire (BootDefragDriver) .(...) - LEGACY_BOOTDEFRAGDRIVER ~ Legacy: 80 Legitimates Filtered in 00mn 00s ---\\ Menu de démarrage Internet (SMI) (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69) O69 - SBI: prefs.js [Moulis - x2vbk9z4.default] user_pref("weboftrust.search.ask.display", "Ask.com Web Search"); O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} [DefaultScope] - (Bing) - http://www.bing.com O69 - SBI: SearchScopes [HKCU] {9A82CDA6-A228-4E21-9CCD-C5C552E52FC7} - (Bing) - http://www.bing.com ~ Keys: Scanned in 00mn 00s ---\\ Recherche particulière à la racine du système (SPRF) (O84) [MD5.B28C334C03CEE7C5E829C43AE75DAE5A] [SPRF][28/01/2013] (.Ask.com - AskIC Dynamic Link Library.) -- C:\Users\Moulis\AppData\Local\Temp\AskSLib.dll [248008] [MD5.DC2AEF7E3EA6896F39725D9FC89A8F5F] [SPRF][26/01/2012] (...) -- C:\Users\Moulis\AppData\Local\Temp\A~NSISu_.exe [70577] [MD5.08AF557C8E6E74D7D92314F6B2C86273] [SPRF][12/09/2013] (...) -- C:\Users\Moulis\AppData\Local\Temp\i4jdel0.exe [4608] [MD5.3BF79E6868B44D3ADB2796BA99521891] [SPRF][07/09/2013] (...) -- C:\Users\Moulis\AppData\Local\Temp\Quarantine.exe [344583] [MD5.C7C92C88CAC832CCB382526447C7BC09] [SPRF][18/04/2013] (.Spotify Ltd - Spotify.) -- C:\Users\Moulis\AppData\Local\Temp\SpotifyUninstall.exe [4555776] [MD5.B22198403FFEAF57BE49FF5A08DA1EF4] [SPRF][20/09/2013] (...) -- C:\Users\Moulis\AppData\Local\Temp\vlc-2.0.8-win32.exe [23003252] [MD5.A7CAA9D2A41B10FD966BC105A21442DF] [SPRF][19/09/2013] (...) -- C:\Users\Moulis\AppData\Local\Temp\xuninst.exe [379904] [MD5.BCC65E920F35684391C35DD3C806541A] [SPRF][24/09/2013] (...) -- C:\Users\Moulis\AppData\Local\Temp\~gu3-ver.dat [95] [MD5.08512BFFB233FFA2D77379B74C4EBB54] [SPRF][24/09/2013] (...) -- C:\Users\Moulis\AppData\Local\Temp\~upgrade.dat [936] [MD5.E4B31B8CC2CEB446EE6A6003550FAAE4] [SPRF][08/08/2012] (...) -- C:\Windows\Downloaded Program Files\cfweb_www.bobtv.fr-download-v2_instmodule.exe [99936] ~ Files: 15 Legitimates Filtered in 00mn 02s ---\\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped) SR - | Auto 05/09/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe SS - | Demand 21/09/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe SR - | Auto 09/03/2011 176128 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe SR - | Auto 09/03/2011 294400 | (AMD FUEL Service) . (.Advanced Micro Devices, Inc..) - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe SR - | Auto 17/06/2010 140224 | (AMD Reservation Manager) . (.Advanced Micro Devices.) - C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe SR - | Auto 14/09/2013 84024 | (AntiVirSchedulerService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\sched.exe SR - | Auto 14/09/2013 108088 | (AntiVirService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\avguard.exe SS - | Disabled 14/09/2013 815160 | (AntiVirWebService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.exe SS - | Demand 26/04/2012 2438696 | (CGVPNCliSrvc) . (.mobile concepts GmbH.) - C:\Program Files\S.A.D\CyberGhost VPN\CGVPNCliService.exe SS - | Auto 04/05/2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 04/05/2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 19/09/2013 118680 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe SS - | Demand 01/07/2011 14848 | (OpenVPNService) . (...) - C:\Program Files\OpenVPN\bin\openvpnserv.exe SR - | Auto 08/07/2013 129112 | (SbieSvc) . (.Sandboxie Holdings, LLC.) - C:\Program Files\Sandboxie\SbieSvc.exe SS - | Auto 25/07/2013 162672 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe SR - | Auto 01/04/2011 428640 | (UMVPFSrv) . (.Logitech Inc..) - C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe SR - | Auto 14/07/2009 20992 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 14/07/2009 20992 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe ~ Services: Scanned in 00mn 08s ---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80) Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net ~ MBR: 1 Legitimates Filtered in 00mn 02s ---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80) Written by ad13, http://ad13.geekstog Run by Moulis at 24/09/2013 14:00:18 ********* Dump file Name ********* C:\PhysicalDisk0_MBR.bin ~ MBR: Scanned in 00mn 04s ---\\ Scan Additionnel (O88) Database Version : 12930 - (23/09/2013) Clés trouvées (Keys found) : 1 Valeurs trouvées (Values found) : 3 Dossiers trouvés (Folders found) : 1 Fichiers trouvés (Files found) : 1 [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\HssSrv] =>Toolbar.Agent [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:Foxmail =>Adware.TencentAddressBar^ C:\Users\Moulis\AppData\Roaming\Mozilla\Firefox\Profiles\x2vbk9z4.default\foxyproxy@eric.h.jung =>Hijacker.Proxy^ C:\Program Files\Foxmail\Foxmail.exe =>Adware.TencentAddressBar^ ~ Additionnel Scan: 191251 Items scanned in 01mn 13s ---\\ Récapitulatif des détections trouvées sur votre station ~ http://nicolascoolman.webs.com/apps/blog/show/27668065-adware-tencentaddressbar =>Adware.TencentAddressBar ~ http://nicolascoolman.webs.com/apps/blog/show/27232411-hijacker-proxy =>Hijacker.Proxy ~ http://nicolascoolman.webs.com/apps/blog/show/26609108-hijacker-chercheus =>Hijacker.ChercheUS ~ MSI: 3 link(s) detected in 01mn 13s ~ 1123 Legitimates filtered by white list End of the scan (461 lines in 06mn 51s)(0)