~ Rapport de ZHPDiag v2014.4.12.21 - Nicolas Coolman (12/04/2014) ~ Lancé par DEBRUYNE JOSIANE (12/04/2014 15:55:23) ~ Adresse du Site Web http://nicolascoolman.webs.com ~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/ ~ Traduit par Nicolas Coolman ~ Etat de la version : ~ Liste blanche : Activée par le programme ~ Elévation des Privilèges : OK ~ User Account Control (UAC): Deactivate by program ---\\ Navigateurs Internet MSIE: Internet Explorer v11.0.9600.17031 (Defaut) MFIE: Mozilla Firefox 28.0 ---\\ Informations sur les produits Windows ~ Langage: Français Windows 8.1 Pro, 32-bit (Build 9600) Windows Server License Manager Script : OK ---\\ Logiciels de protection du système Windows Defender W8 ---\\ Logiciels d'optimisation du système ---\\ Logiciels de partage PeerToPeer ---\\ Surveillance de Logiciels Adobe Flash Player 13 Plugin ---\\ Informations sur le système ~ Processor: x86 Family 15 Model 4 Stepping 9, GenuineIntel ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 1022 MB (21% free) System Restore: Désactivé (Disabled) System drive C: has 110 GB (73%) free of 149 GB ---\\ Mode de connexion au système ~ Computer Name: MAISON-101E0972 ~ User Name: DEBRUYNE JOSIANE ~ All Users Names: UpdatusUser, SUPPORT_388945a0, HelpAssistant, DEBRUYNE JOSIANE, Administrateur, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\\ Variables d'environnement ~ System Unit : C:\ ~ %AppZHP% : C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\ZHP\ ~ %AppData% : C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\ ~ %Desktop% : C:\Users\DEBRUYNE JOSIANE\Desktop\ ~ %Favorites% : C:\Users\DEBRUYNE JOSIANE\Favorites\ ~ %LocalAppData% : C:\Users\DEBRUYNE JOSIANE\AppData\Local\ ~ %StartMenu% : C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\\ Enumération des unités disques A: Floppy drive, Flash card reader, USB Key (Not Inserted) C: Hard drive, Flash drive, Thumb drive (Free 110 Go of 149 Go) D: Hard drive, Flash drive, Thumb drive (Free 9 Go of 10 Go) E: CD-ROM drive (Not Inserted) ---\\ Etat du Centre de Sécurité Windows ~ Security Center: 37 Legitimates Filtered in 00mn 00s ---\\ Recherche particulière de fichiers génériques [MD5.119E091B5386379BC5AA598BE9440C75] - (.Microsoft Corporation - Explorateur Windows.) (.11/04/2014 - 21:53:39.) -- C:\Windows\Explorer.exe [2088160] [MD5.02BC073156B3097E94D63C4D609020DD] - (.Microsoft Corporation - Application de démarrage de Windows.) (.22/08/2013 - 03:49:55.) -- C:\Windows\System32\Wininit.exe [112640] [MD5.F89C2BDB6E385ED6CA2AC0085BB6643A] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.18/03/2014 - 08:59:52.) -- C:\Windows\System32\wininet.dll [1789440] [MD5.70C57DC69D4A7D92D2CAC90C3AD16E6F] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.18/03/2014 - 08:59:51.) -- C:\Windows\System32\Winlogon.exe [459264] [MD5.BFB9E1202225113991F981D29BFB9029] - (.Microsoft Corporation - Bibliothèque de licences.) (.18/03/2014 - 08:59:51.) -- C:\Windows\System32\sppcomapi.dll [438272] [MD5.2AF7DA157FFF947A507FCB4AB8BB4C7C] - (.Microsoft Corporation - Pilote de fonction connexe pour WinSock.) (.22/08/2013 - 07:13:54.) -- C:\Windows\system32\Drivers\AFD.sys [455168] [MD5.72FCAE2CE6DFEAB2AB072435017F3417] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.22/08/2013 - 06:33:25.) -- C:\Windows\system32\Drivers\atapi.sys [23392] [MD5.CE232BB0965C0C0B786C3F976CCBFB7D] - (.Microsoft Corporation - CD-ROM File System Driver.) (.22/08/2013 - 05:11:55.) -- C:\Windows\system32\Drivers\Cdfs.sys [73728] [MD5.E2FC132D48EA4E8B04432C33EFB77801] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.22/08/2013 - 02:59:12.) -- C:\Windows\system32\Drivers\Cdrom.sys [124928] [MD5.55758EBBC45E1628161121D7CFEAD4A1] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.11/04/2014 - 21:53:38.) -- C:\Windows\system32\Drivers\DfsC.sys [102400] [MD5.A31901DE6A22EA67AB83AAF7036F98CC] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.22/08/2013 - 05:10:12.) -- C:\Windows\system32\Drivers\HDAudBus.sys [69632] [MD5.5043E69532392A43549E5D41E22638AA] - (.Microsoft Corporation - Pilote de port i8042.) (.22/08/2013 - 05:10:59.) -- C:\Windows\system32\Drivers\i8042prt.sys [82944] [MD5.FA6C94C754A566EA8A61D658932F32DE] - (.Microsoft Corporation - IP Network Address Translator.) (.18/03/2014 - 08:59:54.) -- C:\Windows\system32\Drivers\IpNat.sys [126976] [MD5.3225D40D8CBA74A79D3B10879A14755E] - (.Microsoft Corporation - Minirdr SMB Windows NT.) (.11/04/2014 - 21:53:38.) -- C:\Windows\system32\Drivers\MRxSmb.sys [333824] [MD5.BC242922B0D08F61CF7C87FD08FAFA8B] - (.Microsoft Corporation - MBT Transport driver.) (.22/08/2013 - 05:08:26.) -- C:\Windows\system32\Drivers\netBT.sys [218624] [MD5.BAFDB3519A9D1A6A0665A70696BA98D5] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.11/04/2014 - 21:53:38.) -- C:\Windows\system32\Drivers\ntfs.sys [1679704] [MD5.4F30970F15ADCC382544B31D5D7E368E] - (.Microsoft Corporation - Pilote de port parallèle.) (.22/08/2013 - 05:11:49.) -- C:\Windows\system32\Drivers\Parport.sys [81408] [MD5.C51AB62AB41A2E8560D12472B204CC00] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.22/08/2013 - 05:07:36.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [81920] [MD5.67E91843B0344411820A012063E876B2] - (.Microsoft Corporation - Redirecteur de périphérique de Microsoft RDP.) (.18/03/2014 - 08:38:09.) -- C:\Windows\system32\Drivers\rdpdr.sys [143872] [MD5.DB0C184142CF9FA1746F598A16EE92B2] - (.Microsoft Corporation - TDI Translation Driver.) (.22/08/2013 - 07:13:54.) -- C:\Windows\system32\Drivers\tdx.sys [87040] [MD5.085918BF459BCB835CFC535BE7138539] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.18/03/2014 - 08:59:36.) -- C:\Windows\system32\Drivers\volsnap.sys [265048] ~ Generic Processes: Scanned in 00mn 01s ---\\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 2/6 ~ Mes musiques (My Musics) : 1/14 ~ Mes Favoris (My Favorites) : 1/20 ~ Mes Documents (My Documents) : 1/4120 ~ Mon Bureau (My Desktop) : 5/168 ~ Menu demarrer (Programs) : 1/29 ~ Hidden Files: Scanned in 00mn 05s ---\\ Processus lancés [MD5.6E3C60AC09E03CAEF32AE3DEFD0CC410] - (.Microsoft Corporation - IPoint.exe.) -- c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [1693904] [PID.5008] [MD5.BFC91929336304802B21DC380F178444] - (.Microsoft Corporation - IType.exe.) -- c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1113296] [PID.3688] [MD5.2197DED64442B4B342971598208A7D1A] - (.Microsoft Corporation - Processus hôte pour Tâches Windows.) -- C:\WINDOWS\system32\taskhostex.exe [66624] [PID.6080] [MD5.CA8491E93B94F15E96939E9A8B651CF5] - (.Microsoft Corporation - OneDrive Sync Engine Host.) -- C:\Windows\System32\skydrive.exe [672256] [PID.3696] [MD5.E0344E54C8327EBF7269B0FC47D38533] - (.NVIDIA Corporation - NVIDIA Settings.) -- C:\Program Files\NVIDIA Corporation\Display\nvtray.exe [1821032] [PID.4436] [MD5.CDFFB0058BA113ED8C6099DE11FAAD49] - (.CANON INC. - Canon Quick Menu.) -- C:\Program Files\Canon\Quick Menu\CNQMMAIN.exe [1273448] [PID.5376] [MD5.16AFB34618E1286FF856DC600AC49C79] - (.Pas de propriétaire - DivX Update.) -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe [1861968] [PID.220] [MD5.847201672ECC9F15ED97F59F6CA2EBE6] - (.PriceMeter - PriceMeterW.) -- C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterw.exe [302080] [PID.2540] =>PUP.PriceMeter [MD5.6429D2F9ABE84CE1A54E99ABAC439923] - (.PC Drivers Headquarters - Driver Restore.) -- C:\Program Files\Driver Restore\Driver Restore\DriverRestore.exe [3988856] [PID.1612] [MD5.BE4F25620D39E7FA1A9CB715E2F60E96] - (.CANON INC. - Canon Quick Menu Updater.) -- C:\Program Files\Canon\Quick Menu\CNQMUPDT.exe [1087608] [PID.908] [MD5.C2AFC01FA404ADFD3B915730C7DB2D55] - (.CANON INC. - Canon Quick Menu Image Display.) -- C:\Program Files\Canon\Quick Menu\CNQMSWCS.exe [940168] [PID.2200] [MD5.DB0FE6E51909BEB42004242EB08FEF47] - (.Microsoft Corporation - Host Process for Setting Synchronization.) -- C:\Windows\System32\SettingSyncHost.exe [517120] [PID.2192] [MD5.8E556A72D54F7E3B7844AB9217F02DD7] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe [275568] [PID.4304] [MD5.CBA0013EBDE3F0B08B043F61857E9809] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files\Mozilla Firefox\plugin-container.exe [18544] [PID.4908] [MD5.2F777711F4A380AACADBB85A3E7EBFCB] - (.Adobe Systems, Inc. - Adobe Flash Player 13.0 r0.) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerPlugin_13_0_0_182.exe [1864368] [PID.4920] [MD5.5AD341E69E47F92588D42B4737D30C5A] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8210432] [PID.4312] ~ Processes Running: Scanned in 00mn 07s ---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\Mozilla\Firefox\Profiles\9gqwd3qc.default\prefs.js C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\Mozilla\Firefox\Profiles\9gqwd3qc.default\user.js M3 - MFPP: Plugins - [DEBRUYNE JOSIANE] -- C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\Mozilla\Firefox\Profiles\9gqwd3qc.default\searchplugins\Mysearchdial.xml =>Adware.MyWebSearch M0 - MFSP: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] http://start.mysearchdial.com =>Adware.MyWebSearch ~ Firefox Browser: 8 Legitimates Filtered in 00mn 01s ---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4) R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com =>Adware.MyWebSearch R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com =>Adware.MyWebSearch R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.PriceMeter - PriceMeterLiveUpdate Update.) (No version) -- (.not file.) =>PUP.PriceMeter ~ IE Browser: 9 Legitimates Filtered in 00mn 00s ---\\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe ~ Keys: Scanned in 00mn 00s ---\\ Hosts file redirection (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 01s ~ Nombre de lignes (Lines number): 21 ---\\ Browser Helper Objects de navigateur (O2) O2 - BHO: Amazon 1Button App for IE - {26B19FA4-E8A1-4A1B-A163-1A1E46F830DD} Clé orpheline O2 - BHO: Mega Browse - {4e6cd411-ce62-4584-97ff-6afbcf6900af} . (.Mega Browse - Mega Browse.) -- C:\Program Files\Mega Browse\MegaBrowsebho.dll =>PUP.MegaBrowse ~ BHO: 6 Legitimates Filtered in 00mn 00s ---\\ Internet Explorer Toolbars (O3) O3 - Toolbar: Canon Easy-WebPrint EX - [HKLM]{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} . (.CANON INC. - Easy-WebPrint EX.) -- C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll O3 - Toolbar\WebBrowser: (no name) - [HKCU]{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} Clé orpheline ~ Toolbar: Scanned in 00mn 00s ---\\ Autres liens utilisateurs (O4) O4 - GS\Desktop [Public]: Canon Quick Menu.lnk . (.CANON INC. - Canon Quick Menu.) -- C:\Program Files\Canon\Quick Menu\CNQMMAIN.exe O4 - GS\Desktop [Public]: Driver Restore.lnk . (.PC Drivers Headquarters - Driver Restore.) -- C:\Program Files\Driver Restore\Driver Restore\DriverRestore.exe O4 - GS\Desktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O4 - GS\Desktop [Public]: Puzzles Collection.lnk . (.Pavel Bobes - Jp2.) -- C:\Program Files\Micro Application\Puzzles Collection\jp2v.exe O4 - GS\Program [Public]: Desktop.lnk - Clé orpheline O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O4 - GS\QuickLaunch [DEBRUYNE JOSIANE]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\TaskBar [DEBRUYNE JOSIANE]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\TaskBar [DEBRUYNE JOSIANE]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O4 - GS\Program [DEBRUYNE JOSIANE]: Documents.lnk . (...) -- C:\Users\DEBRUYNE JOSIANE\Documents O4 - GS\Program [DEBRUYNE JOSIANE]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Desktop [DEBRUYNE JOSIANE]: AppSafe.lnk . (...) -- C:\Program Files\AppSafe\AppSafe.exe O4 - GS\Desktop [DEBRUYNE JOSIANE]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Desktop [DEBRUYNE JOSIANE]: iomega (H) - Raccourci.lnk - Clé orpheline O4 - GS\Program [Administrateur]: Documents.lnk . (...) -- C:\Users\DEBRUYNE JOSIANE\Documents ~ Global Startup: 42 Legitimates Filtered in 00mn 02s ---\\ Applications lancées au démarrage du système (O4) O4 - HKLM\..\Run: [CanonQuickMenu] . (.CANON INC. - Canon Quick Menu.) -- C:\Program Files\Canon\Quick Menu\CNQMMAIN.exe O4 - HKLM\..\Run: [DivXMediaServer] . (.DivX, LLC - DivX DLNA Media Server.) -- C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe O4 - HKLM\..\Run: [DivXUpdate] . (.Pas de propriétaire - DivX Update.) -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe O4 - HKCU\..\Run: [PriceMeterW] . (.PriceMeter - PriceMeterW.) -- C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterw.exe =>PUP.PriceMeter O4 - HKCU\..\Run: [Driver Restore] . (.PC Drivers Headquarters - Driver Restore.) -- C:\Program Files\Driver Restore\Driver Restore\DriverRestore.exe O4 - HKUS\S-1-5-21-1085031214-776561741-839522115-1004\..\Run: [PriceMeterW] . (.PriceMeter - PriceMeterW.) -- C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterw.exe =>PUP.PriceMeter O4 - HKUS\S-1-5-21-1085031214-776561741-839522115-1004\..\Run: [Driver Restore] . (.PC Drivers Headquarters - Driver Restore.) -- C:\Program Files\Driver Restore\Driver Restore\DriverRestore.exe ~ Application: Scanned in 00mn 00s ---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft Office OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO ~ IE Extra Buttons: Scanned in 00mn 00s ---\\ Site dans la Zone de confiance d'Internet Explorer (O15) O15 - Trusted Zone: [HKCU\...\Domains] http.ma-config.com O15 - Trusted Zone: [HKCU\...\Domains] http.touslesdrivers.com ~ IE Zone Confiance: Scanned in 00mn 00s ---\\ Objets ActiveX (Downloaded Program Files)(O16) O16 - DPF: {3A226D85-574D-4272-B73C-DBCAECF709B3} ((no name)) - http://www.consoclicker.com/TNSClickrb.CAB ~ Objets ActiveX: Scanned in 00mn 00s ---\\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{45F54502-FBAF-4026-AE34-CFC044890D7D}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{45F54502-FBAF-4026-AE34-CFC044890D7D}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 ~ Domain: Scanned in 00mn 00s ---\\ Protocole additionnel (O18) O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.dll =>.Microsoft Corporation ~ Protocole Additionnel: Scanned in 00mn 00s ---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - AppInit_DLLs: . (...) - C:\Program Files\Amazon\AMAZON~1\AMAZON~1.dll (.not file.) ~ AppInit DLL: Scanned in 00mn 00s ---\\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: PriceMeterLiveUpdate Service (pricemeterliveUpdate) (pricemeterliveUpdate) . (.PriceMeter - PriceMeterLiveUpdate Update.) - C:\Program Files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe =>PUP.PriceMeter ~ Services: 4 Legitimates Filtered in 00mn 14s ---\\ Tâches planifiées en automatique (O39) O39 - APT:Automatic Planified Task - C:\Windows\Tasks\MySearchDial.job [352] =>Adware.MyWebSearch O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Price Meter Updater.job [352] O39 - APT:Automatic Planified Task - C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job [1002] =>PUP.PriceMeter O39 - APT:Automatic Planified Task - C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job [1006] =>PUP.PriceMeter [MD5.00000000000000000000000000000000] [APT] [CreateChoiceProcessTask] (...) -- C:\Windows\BrowserChoice\browserchoice.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [MySearchDial] (...) -- C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\MYSEAR~1\UPDATE~1\UPDATE~1.exe (.not file.) [0] =>Adware.MyWebSearch [MD5.1245632D18B5337EB39BE78659C0936D] [APT] [Price Meter Updater] (...) -- C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\PRICEM~1\UPDATE~1\UPDATE~1.exe [272384] [MD5.19ACD8C35E65B649D0D0D336502D446D] [APT] [pricemeterdownloader] (.PriceMeter.) -- C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterd.exe [370696] =>PUP.PriceMeter [MD5.3D8B851E7EFCDC130E4B301BDDE10099] [APT] [PriceMeterLiveUpdateUpdateTaskMachineCore] (.PriceMeter.) -- C:\Program Files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [150504] =>PUP.PriceMeter [MD5.3D8B851E7EFCDC130E4B301BDDE10099] [APT] [PriceMeterLiveUpdateUpdateTaskMachineUA] (.PriceMeter.) -- C:\Program Files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [150504] =>PUP.PriceMeter [MD5.00000000000000000000000000000000] [APT] [pricemetertask] (...) -- C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\TEMP\pricemeter.exe (.not file.) [0] =>PUP.PriceMeter [MD5.847201672ECC9F15ED97F59F6CA2EBE6] [APT] [pricemeterwatcher] (.PriceMeter.) -- C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterw.exe [302080] =>PUP.PriceMeter ~ Scheduled Task: 20 Legitimates Filtered in 00mn 23s ---\\ Logiciels installés (O42) O42 - Logiciel: AppCloudUpdater - (.AppCloudUpdater.) [HKCU] -- AppCloudUpdater O42 - Logiciel: Mega Browse - (.Mega Browse.) [HKLM] -- Mega Browse =>PUP.MegaBrowse O42 - Logiciel: Puzzles Collection - (...) [HKLM] -- {C77A8277-C3BF-4260-A121-0AF897E12F18} O42 - Logiciel: Update for PriceMeter - (.Update for PriceMeter.) [HKCU] -- Price Meter Updater =>PUP.PriceMeter ~ Logic: 16 Legitimates Filtered in 00mn 01s ---\\ HKCU & HKLM Software Keys [HKCU\Software\InstallCore] =>Adware.InstallCore [HKCU\Software\Mega Browse] =>PUP.MegaBrowse [HKCU\Software\ParetoLogic] =>PUP.Paretologic [HKCU\Software\PriceMeterUpdater] =>PUP.PriceMeter [HKCU\Software\PriceMeter] =>PUP.PriceMeter [HKCU\Software\mysearchdial.com] =>Adware.MyWebSearch [HKLM\Software\DealPlyLive] =>PUP.DealPly [HKLM\Software\MySearchDial] =>Adware.MyWebSearch [HKLM\Software\ParetoLogic] =>PUP.Paretologic ~ Key Software: 140 Legitimates Filtered in 00mn 01s ---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 08/04/2014 - 16:23:29 - [2,385] ----D C:\Program Files\Mega Browse =>PUP.MegaBrowse O43 - CFD: 11/04/2014 - 10:55:39 - [0,564] ----D C:\Program Files\RegClean Pro =>Rogue.RegistryPowerCleaner O43 - CFD: 10/04/2014 - 21:53:37 - [0] ----D C:\ProgramData\ParetoLogic =>PUP.Paretologic O43 - CFD: 11/04/2014 - 10:23:07 - [1,063] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\1H1Q O43 - CFD: 08/04/2014 - 16:18:21 - [0,103] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\AppCloudUpdater O43 - CFD: 11/04/2014 - 10:24:20 - [0] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\mysearchdial =>Adware.MyWebSearch O43 - CFD: 10/04/2014 - 19:34:52 - [0,127] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\ParetoLogic =>PUP.Paretologic O43 - CFD: 11/04/2014 - 10:16:23 - [0,260] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\PriceMeterUpdater =>PUP.PriceMeter O43 - CFD: 11/04/2014 - 23:02:02 - [0] -SH-D C:\Users\DEBRUYNE JOSIANE\AppData\Local\EmieSiteList O43 - CFD: 11/04/2014 - 23:02:02 - [0] -SH-D C:\Users\DEBRUYNE JOSIANE\AppData\Local\EmieUserList O43 - CFD: 11/04/2014 - 11:19:48 - [54,767] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter =>PUP.PriceMeter O43 - CFD: 11/04/2014 - 22:31:34 - [0,001] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PriceMeter =>PUP.PriceMeter ~ Program Folder: 125 Legitimates Filtered in 00mn 50s ---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.93B885ADFE0DA089CDF634904FD59F71] - 07/04/2014 - 19:35:48 -SHA- . (...) -- C:\BOOTNXT [1] O44 - LFC:[MD5.5731146B3F478A623843192385F644BD] - 11/04/2014 - 09:17:04 ---A- . (.Systweak Inc., (www.systweak.com) - Regclean Pro.) -- C:\Windows\System32\roboot.exe [18776] =>Rogue.RegistryPowerCleaner O44 - LFC:[MD5.DDC0B6672AB7862A3C2D7AA2ADB6B645] - 11/04/2014 - 09:21:32 ---A- . (.Pas de propriétaire - Setup/Uninstall.) -- C:\Windows\unins000.exe [715038] O44 - LFC:[MD5.FA425C74CE2EB719B2A77A7A2ADDAE32] - 11/04/2014 - 09:21:46 ---A- . (.Pas de propriétaire - Lagarith.) -- C:\Windows\System32\lagarith.dll [216064] O44 - LFC:[MD5.94BE6C653028E67437D6D3650388ECF5] - 11/04/2014 - 09:21:52 ---A- . (...) -- C:\Windows\unins000.dat [1802] O44 - LFC:[MD5.72C57D8501528179C6957E2F541CE215] - 11/04/2014 - 09:22:09 ---A- . (...) -- C:\Windows\System32\unrar.dll [178688] O44 - LFC:[MD5.C0992C27E792440DA1DD5CFE8EE03E32] - 11/04/2014 - 09:22:45 ---A- . (.Pas de propriétaire - ffdshow VFW.) -- C:\Windows\System32\ff_vfw.dll [79360] O44 - LFC:[MD5.348AC3C5B87056E24C9E0039332BFB66] - 11/04/2014 - 09:23:52 ---A- . (...) -- C:\Windows\System32\xvidvfw.dll [240640] O44 - LFC:[MD5.E3833540C755C06EC18D414047448B14] - 11/04/2014 - 09:23:54 ---A- . (...) -- C:\Windows\System32\xvidcore.dll [645632] O44 - LFC:[MD5.5E8CD1804C1A035311F5DA9C1048F024] - 11/04/2014 - 09:23:55 ---A- . (...) -- C:\Windows\System32\xvid.ax [153088] O44 - LFC:[MD5.C8DF9379DBC36CF31FE4EB9FE925086F] - 11/04/2014 - 20:34:51 ---A- . (...) -- C:\Windows\WindowsUpdate (1).log [1732217] O44 - LFC:[MD5.978CC1FB5226010639C73BF00D69799E] - 11/04/2014 - 21:11:09 ---A- . (...) -- C:\Windows\System32\lvcoinst.log [2775] O44 - LFC:[MD5.91764D7D6153253AD851DB1839E5DEC1] - 11/04/2014 - 21:30:55 ---A- . (...) -- C:\Windows\DtcInstall.log [4893] O44 - LFC:[MD5.A5C9E1A520F0EDE4A3D4A499D9C345A5] - 11/04/2014 - 21:42:10 ---A- . (...) -- C:\Windows\System32\emptyregdb.dat [21680] O44 - LFC:[MD5.4C2B8733CC57D36D991EB331BEA626BB] - 11/04/2014 - 21:42:46 ---A- . (...) -- C:\Windows\comsetup.log [6645] O44 - LFC:[MD5.A59CA020A52569657D064CD0D38495E4] - 11/04/2014 - 21:42:47 ---A- . (...) -- C:\Windows\diagerr.xml [30483] O44 - LFC:[MD5.A59CA020A52569657D064CD0D38495E4] - 11/04/2014 - 21:42:47 ---A- . (...) -- C:\Windows\diagwrn.xml [30483] O44 - LFC:[MD5.12B0701B1CEC1A7BB0E4C71D97661E23] - 11/04/2014 - 21:53:39 ---A- . (...) -- C:\Windows\System32\ApnDatabase.xml [387210] ~ Files: 192 Legitimates Filtered in 00mn 24s ---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55) O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 ~ MWPS: 17 Legitimates Filtered in 00mn 00s ---\\ Liste des pilotes du système (SDL) (O58) O58 - SDL:[MD5.596DB7E4D0DB6AC32DF142C861001979] - 13/08/2013 - 00:25:32 ---A- . (.Windows (R) Win 7 DDK provider - BCM Function 2 Device Driver.) -- C:\Windows\System32\Drivers\bcmfn2.sys [16088] O58 - SDL:[MD5.B4489EA5810BF73778CD8BDC305109CE] - 22/08/2013 - 06:32:57 ---A- . (.Promise Technology, Inc. - Promise SuperTrak EX Series Driver for Windows x86.) -- C:\Windows\System32\Drivers\stexstor.sys [26976] ~ Drivers: 17 Legitimates Filtered in 00mn 06s ---\\ Liste des outils de désinfection (LATC) (O63) O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman ~ ADS: Scanned in 00mn 00s ---\\ Menu de démarrage Internet (SMI) (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69) O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("browser.search.defaultenginename", "Mysearchdial"); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("browser.search.selectedEngine", "Mysearchdial"); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("browser.startup.homepage", "http://start.mysearchdial.com/?f=1&a=dsites03_14_15_ie&cd=2XzuyEtN2Y1L1QzutDtDtCzyyCyCtCzy0[...] =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.AL", 2); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.aflt", "dsites03_14_15_ie"); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.appId", "{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}"); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.cd", "2XzuyEtN2Y1L1QzutDtDtCzyyCyCtCzy0CyD0BtB0DyE0C0FtN0D0Tzu0SzztAtCtN1L2XzutBtFtBtDtFtCtFtDt[...] =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.cntry", "FR"); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.cr", "1214897532"); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.dfltLng", ""); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.dfltSrch", true); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.dnsErr", true); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.dpkLst", "3654782829,1334533236,1121012847,231756876,1895130307,603719297,4288797614,3754950497[...] =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.excTlbr", false); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.hdrMd5", "5D6E650ECCED0BCAE68EF51C6A128E67"); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.hmpg", true); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.hmpgUrl", "http://start.mysearchdial.com/?f=1&a=dsites03_14_15_ie&cd=2XzuyEtN2Y1L1QzutDtDtCzyyC[...] =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.id", "00196619C5B2D4CF"); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.instlDay", "16171"); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.instlRef", "140305_b"); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.lastB", "http://start.mysearchdial.com/?f=1&a=dsites03_14_15_ie&cd=2XzuyEtN2Y1L1QzutDtDtCzyyCyC[...] =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.lastVrsnTs", "1.8.29.010:16:48"); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.newTabUrl", "http://start.mysearchdial.com/?f=2&a=dsites03_14_15_ie&cd=2XzuyEtN2Y1L1QzutDtDtCzy[...] =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.prdct", "mysearchdial"); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.prtnrId", "mysearchdial"); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.sg", "none"); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.srchPrvdr", "Mysearchdial"); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.tlbrId", "base"); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.tlbrSrchUrl", "http://start.mysearchdial.com/?f=3&a=dsites03_14_15_ie&cd=2XzuyEtN2Y1L1QzutDtDtC[...] =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.vrsn", "1.8.29.0"); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.vrsni", "1.8.29.0"); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial_i.newTab", false); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial_i.smplGrp", "none"); =>Adware.MyWebSearch O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial_i.vrsnTs", "1.8.29.010:16:48"); =>Adware.MyWebSearch O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com O69 - SBI: SearchScopes [HKCU] {77AA745B-F4F8-45DA-9B14-61D2D95054C8} - (Mysearchdial) - http://start.mysearchdial.com =>Adware.MyWebSearch ~ Keys: Scanned in 00mn 00s ---\\ Recherche particulière à la racine du système (SPRF) (O84) [MD5.02B84503B8540FFC1E4960975F3FC2B2] [SPRF][01/11/2007] (.TNS - Pas de description.) -- C:\Windows\Downloaded Program Files\TNSClickrb.dll [61440] ~ Files: 1 Legitimates Filtered in 00mn 00s ---\\ Enumère les codes produits des logiciels (PUC) (O90) O90 - PUC: "8E031372C71173240AAF38BEFB110E15" . (.Driver Restore.) -- C:\WINDOWS\Installer\{273130E8-117C-4237-A0FA-83EBBF11E051}\ARPPRODUCTICON.exe ~ Update Products: 18 Legitimates Filtered in 00mn 00s ---\\ Enumère les données de la clé NameSpace (MNS) (O92) O92 - MNS: - {1CF1260C-4DD0-4ebb-811F-33C572699FDE} O92 - MNS: - {374DE290-123F-4565-9164-39C4925E467B} O92 - MNS: - {3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA} O92 - MNS: - {A0953C92-50DC-43bf-BE83-3742FED03C9C} O92 - MNS: - {A8CDFF1C-4878-43be-B5FD-F8091C1C60D0} O92 - MNS: - {B4BFCC3A-DB2C-424C-B029-7FE99A87C641} ~ MNS: 6 Legitimates Filtered in 00mn 00s ---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS) [MD5.84DE2F73A2ED897A50CCCEE6CD233843] [WIS][12/04/2014] (.Driver Restore - Driver Restore.) -- C:\Windows\Installer\249062f.msi [7377408] ~ WIS: 18 Legitimates Filtered in 00mn 02s ---\\ Recherche de clés de registre CLSID (O101) [HKCR\CLSID\{126C78A0-36E7-4697-A3AB-32706144398B}] (PriceMeterLiveUpdate Legacy On Demand) =>PUP.PriceMeter [HKCR\CLSID\{30D1E30D-B7F5-4C7A-8EDA-9F02966538A8}] (PriceMeterLiveUpdate.OneClickProcessLauncher) =>PUP.PriceMeter [HKCR\CLSID\{41C35ADE-DEDA-439F-8140-D53F2C76C963}] (PriceMeterLiveUpdate Broker Class Factory) =>PUP.PriceMeter [HKCR\CLSID\{4825ACAD-F495-4CDD-9603-9C91BABB2B88}] (PriceMeterLiveUpdate Legacy On Demand) =>PUP.PriceMeter [HKCR\CLSID\{4e6cd411-ce62-4584-97ff-6afbcf6900af}] (Mega Browse) =>PUP.MegaBrowse [HKCR\CLSID\{5B60D1C0-453A-485D-AE91-61FAC9203719}] (PriceMeterLiveUpdate Core Class) =>PUP.PriceMeter [HKCR\CLSID\{89449F37-4AB2-46ED-A566-BB3A7797701B}] (PriceMeterLiveUpdate Update Plugin) =>PUP.PriceMeter [HKCR\CLSID\{B1F29F0C-2EC8-487B-97C2-8B8FEA6CEF14}] (PriceMeterLiveUpdate Broker Class Factory) =>PUP.PriceMeter [HKCR\CLSID\{C0756D99-64A1-4332-B783-A5A1B571D431}] (PriceMeterLiveUpdate Core Class) =>PUP.PriceMeter [HKCR\CLSID\{D8746A3A-A372-4C8B-96E5-B58F6474EB19}] (PriceMeterLiveUpdate Process Launcher Class) =>PUP.PriceMeter [HKCR\CLSID\{F509ADC2-B40E-470F-A7B7-45191486B5CB}] (PriceMeterLiveUpdate Update Plugin) =>PUP.PriceMeter ~ BCK: 5696 Legitimates Filtered in 00mn 25s ---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Demand 09/04/2014 257712 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe SS - | Demand 15/03/2014 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe SS - | Auto 11/04/2014 150504 | (pricemeterliveUpdate) . (.PriceMeter.) - C:\Program Files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe =>PUP.PriceMeter SS - | Demand 11/04/2014 150504 | (pricemeterliveUpdatem) . (.PriceMeter.) - C:\Program Files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe =>PUP.PriceMeter SS - | Demand 22/08/2013 31552 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 28/03/2012 140456 | (IJPLMSVC) . (...) - C:\Program Files\Canon\IJPLM\IJPLMSVC.exe SR - | Auto 01/04/2014 2117960 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe SR - | Auto 07/12/2012 645992 | (nvsvc) . (.NVIDIA Corporation.) - C:\WINDOWS\system32\nvvsvc.exe SR - | Auto 22/08/2013 22240 | (WinDefend) . (.Microsoft Corporation.) - C:\Program Files\Windows Defender\MsMpEng.exe ~ Services: Scanned in 00mn 29s ---\\ Scan Additionnel (O88) Database Version : 13044 - (12/04/2014) Clés trouvées (Keys found) : 11 Valeurs trouvées (Values found) : 2 Dossiers trouvés (Folders found) : 8 Fichiers trouvés (Files found) : 23 [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E6CD411-CE62-4584-97FF-6AFBCF6900AF}] =>PUP.MegaBrowse^ [HKLM\SYSTEM\CurrentControlSet\Services\pricemeterliveUpdate) (pricemeterliveUpdate] =>PUP.PriceMeter^ [HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Mega Browse] =>PUP.MegaBrowse^ [HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Price Meter Updater] =>PUP.PriceMeter^ [HKLM\Software\Classes\AppID\esrv.EXE] =>PUP.Babylon [HKCU\Software\InstallCore] =>Adware.InstallCore [HKCU\Software\ParetoLogic] =>PUP.Paretologic [HKLM\Software\ParetoLogic] =>PUP.Paretologic [HKLM\Software\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}] =>Adware.BrowseFox [HKLM\Software\Classes\esrv.mysearchdialESrvc] =>Adware.MyWebSearch [HKLM\Software\Classes\esrv.mysearchdialESrvc.1] =>Adware.MyWebSearch [HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks]:{CFBFAE00-17A6-11D0-99CB-00C04FD64497} =>PUP.PriceMeter^ [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:PriceMeterW =>PUP.PriceMeter^ C:\Program Files\Mega Browse =>PUP.MegaBrowse^ C:\Program Files\RegClean Pro =>Rogue.RegistryPowerCleaner^ C:\ProgramData\ParetoLogic =>PUP.Paretologic^ C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\mysearchdial =>Adware.MyWebSearch^ C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\ParetoLogic =>PUP.Paretologic^ C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\PriceMeterUpdater =>PUP.PriceMeter^ C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter =>PUP.PriceMeter^ C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PriceMeter =>PUP.PriceMeter^ C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterw.exe =>PUP.PriceMeter^ C:\Windows\Tasks\MySearchDial.job =>Adware.MyWebSearch^ C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job =>PUP.PriceMeter^ C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job =>PUP.PriceMeter^ C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterd.exe =>PUP.PriceMeter^ C:\Program Files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe =>PUP.PriceMeter^ [HKCU\Software\Mega Browse] =>PUP.MegaBrowse^ [HKCU\Software\PriceMeterUpdater] =>PUP.PriceMeter^ [HKCU\Software\PriceMeter] =>PUP.PriceMeter^ [HKCU\Software\mysearchdial.com] =>Adware.MyWebSearch^ [HKLM\Software\DealPlyLive] =>PUP.DealPly^ [HKLM\Software\MySearchDial] =>Adware.MyWebSearch^ [HKCR\CLSID\{126C78A0-36E7-4697-A3AB-32706144398B}] (PriceMeterLiveUpdate Legacy On Demand) =>PUP.PriceMeter^ [HKCR\CLSID\{30D1E30D-B7F5-4C7A-8EDA-9F02966538A8}] (PriceMeterLiveUpdate.OneClickProcessLauncher) =>PUP.PriceMeter^ [HKCR\CLSID\{41C35ADE-DEDA-439F-8140-D53F2C76C963}] (PriceMeterLiveUpdate Broker Class Factory) =>PUP.PriceMeter^ [HKCR\CLSID\{4825ACAD-F495-4CDD-9603-9C91BABB2B88}] (PriceMeterLiveUpdate Legacy On Demand) =>PUP.PriceMeter^ [HKCR\CLSID\{4e6cd411-ce62-4584-97ff-6afbcf6900af}] (Mega Browse) =>PUP.MegaBrowse^ [HKCR\CLSID\{5B60D1C0-453A-485D-AE91-61FAC9203719}] (PriceMeterLiveUpdate Core Class) =>PUP.PriceMeter^ [HKCR\CLSID\{89449F37-4AB2-46ED-A566-BB3A7797701B}] (PriceMeterLiveUpdate Update Plugin) =>PUP.PriceMeter^ [HKCR\CLSID\{B1F29F0C-2EC8-487B-97C2-8B8FEA6CEF14}] (PriceMeterLiveUpdate Broker Class Factory) =>PUP.PriceMeter^ [HKCR\CLSID\{C0756D99-64A1-4332-B783-A5A1B571D431}] (PriceMeterLiveUpdate Core Class) =>PUP.PriceMeter^ [HKCR\CLSID\{D8746A3A-A372-4C8B-96E5-B58F6474EB19}] (PriceMeterLiveUpdate Process Launcher Class) =>PUP.PriceMeter^ [HKCR\CLSID\{F509ADC2-B40E-470F-A7B7-45191486B5CB}] (PriceMeterLiveUpdate Update Plugin) =>PUP.PriceMeter^ ~ Additionnel Scan: 186276 Items scanned in 01mn 02s ---\\ Récapitulatif des détections trouvées sur votre station http://nicolascoolman.webs.com/apps/blog/show/41981105-pup-pricemeter =>PUP.PriceMeter http://nicolascoolman.webs.com/apps/blog/show/27146838-adware-mywebsearch =>Adware.MyWebSearch http://nicolascoolman.webs.com/apps/blog/show/41917380-pup-megabrowse =>PUP.MegaBrowse http://nicolascoolman.webs.com/apps/blog/show/29790567-adware-installcore =>Adware.InstallCore http://nicolascoolman.webs.com/apps/blog/show/30068076-pup-paretologic =>PUP.Paretologic http://nicolascoolman.webs.com/apps/blog/show/28060597-pup-dealply =>PUP.DealPly http://nicolascoolman.webs.com/apps/blog/show/29295819-rogue-registrypowercleaner =>Rogue.RegistryPowerCleaner http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon =>PUP.Babylon http://nicolascoolman.webs.com/apps/blog/show/32363262-adware-browsefox =>Adware.BrowseFox ~ MSI: 9 link(s) detected in 00mn 00s ~ 915 Legitimates filtered by white list End of the scan (541 lines in 04mn 44s)(0)