~ Rapport de ZHPDiag v2014.4.18.33 - Nicolas Coolman (18/04/2014) ~ Lancé par Male (18/04/2014 18:13:11) ~ Adresse du Site Web http://nicolascoolman.webs.com ~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/ ~ Traduit par Nicolas Coolman ~ Etat de la version : ~ Liste blanche : Activée par le programme ~ Elévation des Privilèges : OK ~ User Account Control (UAC): Deactivate by program ---\\ Navigateurs Internet MSIE: Internet Explorer v11.0.9600.17041 GCIE: Google Chrome v34.0.1847.116 (Defaut) ---\\ Informations sur les produits Windows ~ Langage: Français Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601) Windows Server License Manager Script : OK ~ Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel Windows ID Activation : OK ~ Windows Partial Key : RWM9H Windows License : OK ~ Windows Remaining Initializations Number : 3 Software Protection Service (Protection logicielle) : OK Windows Automatic Updates : OK Windows Activation Technologies : OK ---\\ Logiciels de protection du système Bitdefender Internet Security v17.23.0.996 Malwarebytes Anti-Malware version 1.75.0.1300 Windows Defender W7 ---\\ Logiciels d'optimisation du système CCleaner v4.11 =>.Piriform Ltd ---\\ Logiciels de partage PeerToPeer ---\\ Surveillance de Logiciels Adobe Flash Player 12 Plugin Java 7 Update 51 ---\\ Informations sur le système ~ Processor: Intel64 Family 6 Model 58 Stepping 9, GenuineIntel ~ Operating System: 64 Bits Boot mode: Normal (Normal boot) Total RAM: 8175 MB (53% free) System Restore: Activé (Enable) System drive C: has 63 GB (35%) free of 180 GB ---\\ Mode de connexion au système ~ Computer Name: VENGEANCE ~ User Name: Male ~ All Users Names: Male, Administrateur, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\\ Variables d'environnement ~ System Unit : C:\ ~ %AppZHP% : C:\Users\Male\AppData\Roaming\ZHP\ ~ %AppData% : C:\Users\Male\AppData\Roaming\ ~ %Desktop% : C:\Users\Male\Desktop\ ~ %Favorites% : C:\Users\Male\Favorites\ ~ %LocalAppData% : C:\Users\Male\AppData\Local\ ~ %StartMenu% : C:\Users\Male\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\\ Enumération des unités disques C: Hard drive, Flash drive, Thumb drive (Free 63 Go of 180 Go) D: Hard drive, Flash drive, Thumb drive (Free 97 Go of 286 Go) E: CD-ROM drive (Not Inserted) F: Floppy drive, Flash card reader, USB Key (Not Inserted) G: Floppy drive, Flash card reader, USB Key (Not Inserted) H: Floppy drive, Flash card reader, USB Key (Not Inserted) I: Floppy drive, Flash card reader, USB Key (Not Inserted) ---\\ Etat du Centre de Sécurité Windows [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified ~ Security Center: 41 Legitimates Filtered in 00mn 00s ---\\ Recherche particulière de fichiers génériques [MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808] [MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024] [MD5.F220BA78AB542C70211D73AE4729B2CD] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.06/03/2014 - 07:22:40.) -- C:\Windows\System32\wininet.dll [2260480] [MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.21/11/2010 - 04:24:29.) -- C:\Windows\System32\Winlogon.exe [390656] [MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.21/11/2010 - 04:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448] [MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/09/2013 - 02:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152] [MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128] [MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160] [MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456] [MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400] [MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368] [MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472] [MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224] [MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208] [MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 04:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632] [MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.24/01/2014 - 03:37:55.) -- C:\Windows\system32\Drivers\ntfs.sys [1684928] [MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280] [MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 04:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536] [MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184] [MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296] [MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808] ~ Generic Processes: Scanned in 00mn 00s ---\\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 1/3660 ~ Mes Videos (My Videos) : 1/67 ~ Mes Favoris (My Favorites) : 1/26 ~ Mes Documents (My Documents) : 1/13 ~ Mon Bureau (My Desktop) : 1/1693 ~ Menu demarrer (Programs) : 0/45 ~ Hidden Files: Scanned in 00mn 00s ---\\ Processus lancés [MD5.E98D481EEF14767B1615DE88674D307A] - (.ASUS - GPUTweak.) -- C:\Program Files (x86)\ASUS\GPU Tweak\GPUTweak.exe [3282680] [PID.2256] [MD5.EE316C8D7C1B99412F2C8F1C64268182] - (.NVIDIA Corporation - NVIDIA GeForce Experience Backend.) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144] [PID.2736] [MD5.597CF4BEDFDC81B8903982664CAC6ED0] - (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe [614232] [PID.1616] [MD5.5E32AEE9866C484D041AA1C0776D6976] - (.Bogdan Sharkov - Clownfish for Skype.) -- C:\Program Files (x86)\Clownfish\Clownfish.exe [1313536] [PID.2484] [MD5.6441EB9BA26BE495ECA68CF579BDCC8E] - (.Dropbox, Inc. - Dropbox.) -- C:\Users\Male\AppData\Roaming\Dropbox\bin\Dropbox.exe [32179440] [PID.3124] [MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336] [PID.3168] [MD5.CDE6586CC383BCAC4D1E4F8A57DCB291] - (.Corsair Components, Inc. - Corsair Vengeance Headset.) -- C:\Program Files (x86)\Corsair\Corsair Headset Software\HeadsetControlPanel.exe [3167544] [PID.3180] [MD5.A63DC5C2EA944E6657203E0C8EDEAF61] - (.Microsoft Corporation - COM Surrogate.) -- C:\Windows\SysWOW64\DllHost.exe [7168] [PID.3244] [MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.2712] [MD5.40B887A9D6EA6181E26CC82BF179096F] - (.ASUS - Monitor.) -- C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe [2701048] [PID.1476] [MD5.2EBBBFC120593C683796092F2DDA0EFC] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [841032] [PID.4280] [MD5.C0EAE6AC1C580FC39754180A3726180E] - (.Bitdefender - Bitdefender Wallet Chrome Extension Native.) -- C:\Program Files\Bitdefender\Bitdefender\Antispam32\pmbxcrnmh.exe [62664] [PID.4576] [MD5.84FCBA7D88B92804A3D28A24DC5223EB] - (...) -- C:\ProgramData\BOINC\projects\aerospaceresearch.net_constellation\trackjack_0.10_windows_x86_64 [492288] [PID.5032] =>Hijacker.SearchNet [MD5.161233DC79656145086BDBD6918A08D4] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8216576] [PID.2080] [MD5.B5D2F4BF587FD60AF75B09EFC1AD0E0A] - (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [411936] [PID.1092] [MD5.E536856E96A7605EBF580D62A868E5FE] - (...) -- C:\Windows\SysWOW64\ASGT.exe [55296] [PID.1624] [MD5.8C856E531A1170F53AC6844E89CD0B5F] - (...) -- C:\Program Files (x86)\Dokan\DokanLibrary\mounter.exe [14848] [PID.1380] [MD5.7E6B107120108B3A15BFECE0DE3201DB] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler.exe [228744] [PID.2440] [MD5.65085456FD9A74D7F1A999520C299ECB] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376] [PID.4000] [MD5.E0D7732F2D2E24B2DB3F67B6750295B8] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512] [PID.2704] [MD5.6F5D2728019DCE7BFF3BAC1885CC0449] - (.NVIDIA Corporation - NVIDIA Network Service.) -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632] [PID.1744] [MD5.E4E034F79D88B34C5B4BA28BAE2259F7] - (.Razer Inc. - RzKLService.) -- C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe [105448] [PID.3496] [MD5.52069AEB42D3D0F97CBCA1085EBF55E6] - (.Intel Corporation - Intel(R) Dynamic Application Loader Host In.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432] [PID.6120] [MD5.6DC3A4E939B0F3EE16B54C5EC431D8C1] - (.Intel Corporation - Intel(R) Local Management Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [390616] [PID.2324] ~ Processes Running: Scanned in 00mn 00s ---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2) C:\Users\Male\AppData\Local\Google\Chrome\User Data\Default\Preferences G1 - GCS: Preference [User Data\Default] http://feed.snapdo.com =>Hijacker.SmartBar G0 - GCSP: Preference [User Data\Default][HomePage] http://www.delta-search.com =>Toolbar.DeltaSearch G2 - GCE: Preference [User Data\Default] [apdfllckaahabafndbhieahigkjlhalf] Google Drive v.6.3 (Activé) G2 - GCE: Preference [User Data\Default] [ccahoghmggldkcdjiebjkidpfongdfbl] Bitdefender Wallet v.17.28.1 (Activé) G2 - GCE: Preference [User Data\Default] [hkdmamhlklklmdocdapicehaaljgphkk] Prévisions Météo v.1.0 (Activé) G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé) G2 - GCE: Preference [User Data\Default] [nfmgehhghdejfcdmbdiphiemhfpjeaaa] gorueAtssaver v.2.7 (Désactivé) =>PUP.GreatSaver G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé) G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Wallet v.0.0.6.1 (Activé) ---\\ Liste des dossiers d'extension Google Chrome ~ Google Lines Browser: 21 Legitimates Filtered in 00mn 03s ---\\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe ~ Keys: Scanned in 00mn 00s ---\\ Hosts file redirection (O1) O1 - Hosts: 54.204.28.26 achhmapmjlcjlomcbmbicbgkihghgnie ~ Hosts File: Scanned in 00mn 00s ~ Nombre de lignes (Lines number): 23 ---\\ Internet Explorer Toolbars (O3) O3 - Toolbar: Snap.Do - [HKLM]{ae07101b-46d4-4a98-af68-0333ea26e113} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation ~ Toolbar: Scanned in 00mn 00s ---\\ Autres liens utilisateurs (O4) O4 - GS\Desktop [Public]: ASUS GPU Tweak.lnk . (.ASUS - GPUTweak.) -- C:\Program Files (x86)\ASUS\GPU Tweak\GPUTweak.exe O4 - GS\Desktop [Public]: GeForce Experience.lnk . (.NVIDIA - NVIDIA GeForce Experience.) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\GFExperience.exe O4 - GS\Desktop [Public]: Intel(R) Extreme Tuning Utility.lnk . (.Intel(R) Corporation - PerfTune.) -- C:\Windows\Installer\{57482760-8D96-4DDB-B11A-E57180465EDE}\PerfTuneIcon.B089625E_E454_492E_B2F2_7E934E4807F0.exe O4 - GS\Desktop [Public]: Oracle VM VirtualBox.lnk . (...) -- C:\Program Files (x86)\Oracle\VirtualBox\VirtualBox.exe (.not file.) O4 - GS\Desktop [Public]: Razer Game Booster.lnk . (.Razer Inc. - RazerGameBooster.) -- C:\Program Files (x86)\Razer\Razer Game Booster\RazerGameBooster.exe O4 - GS\QuickLaunch [Male]: BitTorrent.lnk . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Male\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent O4 - GS\QuickLaunch [Male]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe O4 - GS\QuickLaunch [Male]: Oracle VM VirtualBox.lnk . (...) -- C:\Program Files (x86)\Oracle\VirtualBox\VirtualBox.exe (.not file.) O4 - GS\TaskBar [Male]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe O4 - GS\Desktop [Male]: BitTorrent.lnk . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Male\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent O4 - GS\Desktop [Male]: FurMark.lnk . (.Geeks3D (www.geeks3d.com) - FurMark - swiss made GPU stress test and Op.) -- C:\Program Files (x86)\Geeks3D\Benchmarks\FurMark_1.10.3\FurMark.exe O4 - GS\Desktop [Male]: PC Remote Server.lnk . (.PC Remote - PC Remote Server.) -- C:\Program Files (x86)\PC Remote\PC Remote\PCRemote.exe O4 - GS\Desktop [Male]: Recup - Raccourci.lnk . (...) -- D:\Recup O4 - GS\Desktop [Male]: Smellyriver.TankInspector.exe - Raccourci.lnk . (.Smellyriver - Tank Inspector.) -- C:\Users\Male\Desktop\Nouveau dossier\Smellyriver.TankInspector.exe ~ Global Startup: 70 Legitimates Filtered in 00mn 01s ---\\ Applications lancées au démarrage du système (O4) O4 - GS\Startup [Male]: Dropbox.lnk . (.Dropbox, Inc. - Dropbox.) -- C:\Users\Male\AppData\Roaming\Dropbox\bin\Dropbox.exe =>.Dropbox O4 - HKLM\..\Run: [ShadowPlay] . (.NVIDIA Corporation - NVIDIA Capture Server Proxy.) -- C:\Windows\system32\nvspcap64.dll O4 - HKLM\..\Run: [IAStorIcon] . (.Intel Corporation - Delayed launcher.) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =>.Realtek Semiconductor Corp O4 - HKLM\..\Run: [Bdagent] . (.Bitdefender - Bitdefender Agent.) -- C:\Program Files\Bitdefender\Bitdefender\bdagent.exe O4 - HKLM\..\Run: [NvBackend] . (.NVIDIA Corporation - NVIDIA GeForce Experience Backend.) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe O4 - HKLM\..\Run: [boinctray] . (.Space Sciences Laboratory - BOINC System Tray for Windows.) -- C:\Program Files\BOINC\boinctray.exe O4 - HKLM\..\Run: [boincmgr] . (.Space Sciences Laboratory - BOINC Manager for Windows.) -- C:\Program Files\BOINC\boincmgr.exe O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation O4 - HKCU\..\Run: [BitTorrent] . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Male\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent O4 - HKCU\..\Run: [Bitdefender Wallet Agent] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe O4 - HKCU\..\Run: [Bitdefender Wallet] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe O4 - HKCU\..\Run: [Bitdefender Agent de l'application Wallet] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe O4 - HKCU\..\Run: [PC Remote Server] . (.PC Remote - PC Remote Server.) -- C:\Program Files (x86)\PC Remote\PC Remote\PCRemote.exe O4 - HKCU\..\Run: [Clownfish] . (.Bogdan Sharkov - Clownfish for Skype.) -- C:\Program Files (x86)\Clownfish\Clownfish.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe =>.DT Soft Ltd O4 - HKCU\..\Run: [CCleaner Monitoring] . (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner64.exe =>.Piriform Ltd O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation O4 - HKLM\..\Wow6432Node\Run: [Corsair Headset Software] . (.Corsair Components, Inc. - Corsair Vengeance Headset.) -- C:\Program Files (x86)\Corsair\Corsair Headset Software\HeadsetControlPanel.exe O4 - HKUS\.DEFAULT\..\Run: [Bitdefender Wallet Agent] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe O4 - HKUS\.DEFAULT\..\Run: [Bitdefender Wallet] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe O4 - HKUS\.DEFAULT\..\Run: [Bitdefender Agent de l'application Wallet] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe O4 - HKUS\S-1-5-18\..\Run: [Bitdefender Wallet Agent] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe O4 - HKUS\S-1-5-18\..\Run: [Bitdefender Wallet] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe O4 - HKUS\S-1-5-18\..\Run: [Bitdefender Agent de l'application Wallet] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [BitTorrent] . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Male\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [Bitdefender Wallet Agent] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [Bitdefender Wallet] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [Bitdefender Agent de l'application Wallet] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [PC Remote Server] . (.PC Remote - PC Remote Server.) -- C:\Program Files (x86)\PC Remote\PC Remote\PCRemote.exe O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [Clownfish] . (.Bogdan Sharkov - Clownfish for Skype.) -- C:\Program Files (x86)\Clownfish\Clownfish.exe O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe =>.DT Soft Ltd O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [CCleaner Monitoring] . (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner64.exe =>.Piriform Ltd ~ Application: Scanned in 00mn 00s ---\\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{38FEA77E-9FB4-4794-B08E-BE42886F8312}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{9A46A404-B4B9-402C-812A-187171ED3950}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{9A46A404-B4B9-402C-812A-187171ED3950}: DhcpDomain = netgear.com O17 - HKLM\System\CS1\Services\Tcpip\..\{38FEA77E-9FB4-4794-B08E-BE42886F8312}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{9A46A404-B4B9-402C-812A-187171ED3950}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{9A46A404-B4B9-402C-812A-187171ED3950}: DhcpDomain = netgear.com O17 - HKLM\System\CS2\Services\Tcpip\..\{38FEA77E-9FB4-4794-B08E-BE42886F8312}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{9A46A404-B4B9-402C-812A-187171ED3950}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{9A46A404-B4B9-402C-812A-187171ED3950}: DhcpDomain = netgear.com O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 ~ Domain: Scanned in 00mn 00s ---\\ Protocole additionnel (O18) O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation ~ Protocole Additionnel: Scanned in 00mn 00s ---\\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: ASGT (ASGT) . (...) - C:\Windows\SysWOW64\ASGT.exe O23 - Service: DokanMounter (DokanMounter) . (...) - C:\Program Files (x86)\Dokan\DokanLibrary\mounter.exe O23 - Service: GS-Supporter (e81a9dc1) . (...) - C:\Program Files (x86)\gs-ena~1\AssistantSvc.dll (.not file.) =>PUP.SaveClicker ~ Services: 19 Legitimates Filtered in 00mn 06s ---\\ Tâches planifiées en automatique (O39) [MD5.00000000000000000000000000000000] [APT] [SomotoUpdateCheckerAutoStart] (...) -- C:\Users\Male\AppData\Local\FilesFrog Update Checker\update_checker.exe (.not file.) [0] =>Adware.MegaSearch ~ Scheduled Task: 9 Legitimates Filtered in 00mn 02s ---\\ Logiciels installés (O42) O42 - Logiciel: AndroozBarre M-B-v2.12e - (.Agia3D.) [HKLM][64Bits] -- {FAA33BD4-EC73-43BB-9E0D-D04FCB37D756}_is1 O42 - Logiciel: CashobarreV1.2 - (.Legend-Edition.) [HKCU][64Bits] -- 9573548c9ce6ad12 O42 - Logiciel: Click-CPM-Barre M-B-v2.12e - (.Agia3D.) [HKLM][64Bits] -- {0BE2D054-1DB5-4F22-A1A5-84481F7E42F5}_is1 O42 - Logiciel: Dead Surf - (.Legend Edition.) [HKCU][64Bits] -- ca5afe92da7ae5fe O42 - Logiciel: DiscoveryBarre M-B-v2.15e - (.Agia3D.) [HKLM][64Bits] -- {4F1CFE21-CFA8-4BE9-8581-B403B51A9DCB}_is1 O42 - Logiciel: LPT System Updater Service - (.LPT.) [HKLM][64Bits] -- {BC0BF363-63AB-4FF7-8EF1-AE0D7F711B24} =>Adware.IncrediBar O42 - Logiciel: LaBoitaKados M-B-v1.1 - (.Agia3D.) [HKLM][64Bits] -- {0B19DC32-C613-4B1C-8116-98A808261AE9}_is1 O42 - Logiciel: PackBarre - (.BPMconcept.) [HKLM][64Bits] -- {EF9C70A5-CE26-48A1-9578-172706628019} =>Adware.ADON O42 - Logiciel: Soul-Code - (.Legend Edition.) [HKCU][64Bits] -- b04e6fc329b9f61e O42 - Logiciel: Sun7Barre version 1.4 - (.WiwildBarre.) [HKLM][64Bits] -- {988B07B6-DCAE-4091-AC3F-14BDCCCEF63E}_is1 O42 - Logiciel: TunesBarre version 1.2 - (.TunesBarre.Com.) [HKLM][64Bits] -- {C045FCE6-E4EB-4D9C-881E-E959E053AA40}_is1 =>Toolbar.TunesBarre O42 - Logiciel: pipilajeux - (.Legend Edition.) [HKCU][64Bits] -- f96643f978ef374a O42 - Logiciel: v1.1 - (.Agia3D.) [HKLM][64Bits] -- {979B9A3E-EBFA-472B-9508-5A30A86C3551}_is1 ~ Logic: 23 Legitimates Filtered in 00mn 00s ---\\ HKCU & HKLM Software Keys [HKCU\Software\ELIGCHK] [HKCU\Software\Smartbar] =>Hijacker.SmartBar ~ Key Software: 245 Legitimates Filtered in 00mn 00s ---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 10/01/2014 - 20:57:12 - [] ----D C:\Program Files (x86)\PackBarre =>Adware.ADON O43 - CFD: 04/02/2014 - 17:54:52 - [] ----D C:\Program Files (x86)\Sun7Barre O43 - CFD: 10/01/2014 - 20:53:36 - [] ----D C:\Program Files (x86)\Thread Manager O43 - CFD: 11/01/2014 - 23:03:10 - [] ----D C:\Program Files (x86)\TunesBarre =>Toolbar.TunesBarre O43 - CFD: 17/01/2014 - 20:14:12 - [] ----D C:\ProgramData\87c24eac7fe2ee8d O43 - CFD: 17/01/2014 - 20:12:59 - [] ----D C:\ProgramData\InstallMate =>PUP.Tarma O43 - CFD: 12/03/2014 - 10:07:05 - [] ----D C:\Users\Male\AppData\Local\Smellyriver O43 - CFD: 01/02/2014 - 19:40:59 - [] ----D C:\Users\Male\AppData\Local\Wiwild O43 - CFD: 19/03/2014 - 18:54:52 - [] ----D C:\Users\Male\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Legend Edition O43 - CFD: 11/01/2014 - 23:12:06 - [] ----D C:\Users\Male\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Legend-Edition O43 - CFD: 10/01/2014 - 20:57:12 - [] ----D C:\Users\Male\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PackBarre =>Adware.ADON ~ Program Folder: 167 Legitimates Filtered in 00mn 00s ---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.2BF6DE757CBC9DC4D69FE9C0156BC762] - 17/04/2014 - 20:14:23 ---A- . (...) -- C:\bdlog.txt [105538] ~ Files: 47 Legitimates Filtered in 00mn 06s ---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55) O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 ~ MWPS: 16 Legitimates Filtered in 00mn 00s ---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56) O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1 ~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s ---\\ Liste des pilotes du système (SDL) (O58) O58 - SDL:[MD5.FA122BC1451B1B35B7814FBE1ACF1924] - 10/01/2011 - 13:51:40 ----- . (.Windows (R) Win 7 DDK provider - Dokan Filesystem Driver.) -- C:\Windows\System32\Drivers\dokan.sys [120408] O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496] O58 - SDL:[MD5.FD291A75ECAF197F07BD2040C2A7322A] - 17/07/2013 - 14:23:50 ----- . (.Etron Technology Inc - Etron eXtensible Hub Driver..) -- C:\Windows\System32\Drivers\EtronHub3.sys [65408] O58 - SDL:[MD5.DDE9068F9BAC0210195F217AA39B9276] - 17/07/2013 - 14:23:46 ----- . (.Etron Technology Inc - Etron eXtensible Host Controller Driver..) -- C:\Windows\System32\Drivers\EtronXHCI.sys [94208] O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232] O58 - SDL:[MD5.385044010950C76471A4F1AE47435157] - 19/04/2013 - 04:56:48 ---A- . (...) -- C:\Windows\System32\Drivers\nvflash.sys [15648] O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656] ~ Drivers: 16 Legitimates Filtered in 00mn 01s ---\\ Liste des outils de désinfection (LATC) (O63) O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman ~ ADS: Scanned in 00mn 00s ---\\ Associations Shell Spawning (O67) O67 - Shell Spawning: <.html> [HKLM\..\open\Command] (.Not Key.) O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.Not Key.) ~ FASS Keys: 11 Legitimates Filtered in 00mn 00s ---\\ Menu de démarrage Internet (SMI) (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: <>[HKLM\..\Shell\open\Command] (.Not Key.) ~ Keys: Scanned in 00mn 00s ---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69) O69 - SBI: SearchScopes [HKCU] {006ee092-9658-4fd6-bd8e-a21a348e59f5} [DefaultScope] - (Web Search) - http://feed.snapdo.com =>Hijacker.SmartBar ~ Keys: Scanned in 00mn 00s ---\\ Recherche particulière à la racine du système (SPRF) (O84) [MD5.F72FE7F8D1D7BB53383F95DB98BF1A82] [SPRF][08/01/2014] (...) -- C:\ProgramData\1389185697.bdinstall.bin [544510] ~ Files: 2 Legitimates Filtered in 00mn 00s ---\\ Enumère les codes produits des logiciels (PUC) (O90) O90 - PUC: "266110108A678E141B8AF4881275A05C" . (.Advanced Archive Password Recovery.) -- C:\Windows\Installer\{01011662-76A8-41E8-B1A8-4F8821570AC5}\product_icon ~ Update Products: 28 Legitimates Filtered in 00mn 00s ---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS) [MD5.7A6570D2B4609776B65B7B8DFB5E34B5] [WIS][17/02/2014] (.PC Remote - PC Remote Server - Installer.) -- C:\Windows\Installer\11179c9.msi [1183744] [MD5.CCF09B872963321F1A5018A24DA92FEC] [WIS][24/03/2014] (.LPT - LPT System Updater Service.) -- C:\Windows\Installer\28ce670.msi [1884160] =>Adware.IncrediBar [MD5.4F23992ABF894691390C29F83F8CD758] [WIS][10/01/2014] (.BPMconcept - PackBarre.) -- C:\Windows\Installer\b03815c.msi [1646592] =>Adware.ADON ~ WIS: 31 Legitimates Filtered in 00mn 07s ---\\ Recherche de clés de registre Tracing (O100) HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BitTorrent [1]_RASAPI32 =>P2P.BitTorrent HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BitTorrent [1]_RASMANCS =>P2P.BitTorrent HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BitTorrent_RASAPI32 =>P2P.BitTorrent HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BitTorrent_RASMANCS =>P2P.BitTorrent HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SnapDo_RASAPI32 =>Hijacker.SmartBar HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SnapDo_RASMANCS =>Hijacker.SmartBar ~ BTK: 99 Legitimates Filtered in 00mn 00s ---\\ Recherche de clés de registre CLSID (O101) [HKCR\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}] (SmartbarInternetExplorerBHOEngine) =>Hijacker.SmartBar [HKCR\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}] (Snap.Do) =>Hijacker.SmartBar ~ BCK: 4429 Legitimates Filtered in 00mn 02s ---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Demand 18/03/2014 257928 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe SS - | Disabled 21/11/2013 77632 | (BdDesktopParental) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender\bdparentalservice.exe SS - | Auto 10/07/1658 0 | (e81a9dc1) . (...) - C:\Program Files (x86)\gs-ena~1\AssistantSvc.dll SS - | Auto 02/01/2014 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe SS - | Demand 02/01/2014 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe SS - | Auto 21/11/2013 15720 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe SS - | Demand 01/02/2012 160256 | (ICCS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe SS - | Demand 11/05/2013 822232 | (Intel(R) Capability Licensing Service TCP IP Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe SS - | Auto 23/10/2013 172192 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe SS - | Auto 17/01/2014 18384 | (XTU3SERVICE) . (.Intel(R) Corporation.) - C:\Program Files (x86)\Intel\Extreme Tuning Utility\XtuService.exe SR - | Auto 17/01/2012 55296 | (ASGT) . (...) - C:\Windows\SysWOW64\ASGT.exe SR - | Auto 10/01/2011 14848 | (DokanMounter) . (...) - C:\Program Files (x86)\Dokan\DokanLibrary\mounter.exe SR - | Auto 11/05/2013 733696 | (Intel(R) Capability Licensing Service Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\iCLS Client\HeciServer.exe SR - | Auto 27/08/2013 169432 | (jhi_service) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe SR - | Auto 27/08/2013 390616 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe SR - | Auto 25/10/2013 2768208 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe SR - | Auto 21/01/2014 1593632 | (NvNetworkService) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe SR - | Auto 21/01/2014 16939296 | (NvStreamSvc) . (.NVIDIA Corporation.) - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe SR - | Auto 08/02/2014 923936 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe SR - | Auto 25/02/2014 105448 | (RzKLService) . (.Razer Inc..) - C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe SR - | Auto 08/02/2014 411936 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe SR - | Auto 07/10/2013 67320 | (UPDATESRV) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender\updatesrv.exe SR - | Auto 04/04/2014 1523728 | (VSSERV) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender\vsserv.exe SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe ~ Services: Scanned in 00mn 03s ---\\ Scan Additionnel (O88) Database Version : 13044 - (18/04/2014) Clés trouvées (Keys found) : 17 Valeurs trouvées (Values found) : 3 Dossiers trouvés (Folders found) : 6 Fichiers trouvés (Files found) : 6 [HKLM\Software\Google\Chrome\Extensions\nfmgehhghdejfcdmbdiphiemhfpjeaaa] =>PUP.GreatSaver^ [HKLM\SYSTEM\CurrentControlSet\Services\e81a9dc1] =>PUP.SaveClicker^ [HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{BC0BF363-63AB-4FF7-8EF1-AE0D7F711B24}] =>Adware.IncrediBar^ [HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{EF9C70A5-CE26-48A1-9578-172706628019}] =>Adware.ADON^ [HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{C045FCE6-E4EB-4D9C-881E-E959E053AA40}_is1] =>Toolbar.TunesBarre^ [HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}] =>Hijacker.SmartBar [HKLM\Software\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}] =>Toolbar.Agent [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}] =>Toolbar.Agent [HKLM\Software\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}] =>Hijacker.SmartBar [HKLM\Software\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}] =>Hijacker.SmartBar [HKLM\Software\Wow6432Node\Microsoft\Tracing\SnapDo_RASAPI32] =>Hijacker.SmartBar [HKLM\Software\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}] =>Hijacker.SmartBar [HKLM\Software\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}] =>Hijacker.SmartBar [HKLM\Software\Wow6432Node\Microsoft\Tracing\SnapDo_RASMANCS] =>Hijacker.SmartBar [HKLM\Software\Classes\CLSID\{ae07101b-46d4-4a98-af68-0333ea26e113}] =>Adware.Agent [HKLM\Software\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}] =>Hijacker.SmartBar [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CA0054A5AB3EFFE4CB5660E44A1E7DCC] =>Adware.Boxore^ [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:BitTorrent =>P2P.BitTorrent^ C:\Users\Male\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfmgehhghdejfcdmbdiphiemhfpjeaaa =>PUP.GreatSaver^ C:\Program Files (x86)\PackBarre =>Adware.ADON^ C:\Program Files (x86)\TunesBarre =>Toolbar.TunesBarre^ C:\ProgramData\InstallMate =>PUP.Tarma^ C:\Users\Male\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PackBarre =>Adware.ADON^ C:\Users\Male\AppData\Local\Software =>Adware.Boxore C:\ProgramData\BOINC\projects\aerospaceresearch.net_constellation\trackjack_0.10_windows_x86_64 =>Hijacker.SearchNet^ [HKCU\Software\Smartbar] =>Hijacker.SmartBar^ C:\Windows\Installer\28ce670.msi =>Adware.IncrediBar^ C:\Windows\Installer\b03815c.msi =>Adware.ADON^ [HKCR\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}] (SmartbarInternetExplorerBHOEngine) =>Hijacker.SmartBar^ [HKCR\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}] (Snap.Do) =>Hijacker.SmartBar^ ~ Additionnel Scan: 183791 Items scanned in 00mn 11s ---\\ Récapitulatif des détections trouvées sur votre station http://nicolascoolman.webs.com/apps/blog/show/42042097-hijacker-searchnet =>Hijacker.SearchNet http://nicolascoolman.webs.com/apps/blog/show/26990375-hijacker-smartbar =>Hijacker.SmartBar http://nicolascoolman.webs.com/apps/blog/show/27875657-toolbar-deltasearch =>Toolbar.DeltaSearch http://nicolascoolman.webs.com/apps/blog/show/41737185-pup-saveclicker =>PUP.SaveClicker http://nicolascoolman.webs.com/apps/blog/show/26919368-adware-megasearch =>Adware.MegaSearch http://nicolascoolman.webs.com/apps/blog/show/26898222-adware-incredibar =>Adware.IncrediBar http://nicolascoolman.webs.com/apps/blog/show/27154930-adware-adon =>Adware.ADON http://nicolascoolman.webs.com/apps/blog/show/34019179-toolbar-tunesbarre =>Toolbar.TunesBarre http://nicolascoolman.webs.com/apps/blog/show/29637859-toolbar-tarma =>PUP.Tarma http://nicolascoolman.webs.com/apps/blog/show/26626977-adware-boxore =>Adware.Boxore ~ MSI: 10 link(s) detected in 00mn 00s ~ 989 Legitimates filtered by white list End of the scan (526 lines in 01mn 04s)(0)