~ Rapport de ZHPDiag v2014.2.14.14 - Nicolas Coolman  (2014-02-14)
~ Lancé par ghislain (2014-02-17 08:46:26)
~ Adresse du Site Web  http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version : 
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by program


---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.16518
MFIE: Mozilla Firefox 27.0 (Defaut)
GCIE: Google Chrome v32.0.1700.107
OBIE: Pale Moon 24.2.2 v24.2.2
OBIE: Safari v5.34.57.2

---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_COA_NSLP channel
Windows ID Activation : OK
~ Windows Partial Key : J9HK3
Windows License : OK
~ Windows Remaining Initializations Number : 4
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ Logiciels de protection du système
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft Security Client v4.4.0304.0
Windows Defender W7

---\\ Logiciels d'optimisation du système

---\\ Logiciels de partage PeerToPeer
eMule

---\\ Surveillance de Logiciels
Adobe Flash Player 12 Plugin
Adobe Reader XI
Java 7 Update 51
Java 7 Update 25

---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 26 Stepping 5, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 12279 MB (79% free)
System Restore: Activé (Enable)
System drive C: has 458 GB (49%) free of 917 GB

---\\ Mode de connexion au système
~ Computer Name: GHISLAIN-PC
~ User Name: ghislain
~ All Users Names: HomeGroupUser$, GuestUser, ghislain, ASPNET, Administrateur, 
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\ghislain\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\ghislain\AppData\Roaming\
~ %Desktop% : C:\Users\ghislain\Desktop\
~ %Favorites% : C:\Users\ghislain\Contacts\Favorites\
~ %LocalAppData% : C:\Users\ghislain\AppData\Local\
~ %StartMenu% : C:\Users\ghislain\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 458 Go of 917 Go)
D: CD-ROM drive (Not Inserted)
E: CD-ROM drive (Not Inserted)
F: Hard drive, Flash drive, Thumb drive (Free 2004 Go of 2794 Go)
K: Hard drive, Flash drive, Thumb drive (Free 101 Go of 466 Go)



---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 44 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.2011-02-25 - 01:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.2009-07-13 - 20:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.263B6E451526A90FF8B1CEC759F22956] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.2014-02-06 - 04:24:52.) -- C:\Windows\System32\wininet.dll [2334208]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.2010-11-20 - 08:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.2010-11-20 - 08:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.2013-09-27 - 20:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.2009-07-13 - 20:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.2009-07-13 - 18:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.2010-11-20 - 04:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.2010-11-20 - 04:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.2010-11-20 - 05:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.2009-07-13 - 18:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.2009-07-13 - 19:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.2011-04-26 - 21:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.2010-11-20 - 04:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.2013-04-12 - 09:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.2009-07-13 - 19:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.2010-11-20 - 05:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.2009-07-13 - 19:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.2010-11-20 - 04:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.2010-11-20 - 08:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes:  Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 4/17211
~ Mes musiques (My Musics) : 4/6452
~ Mes Videos (My Videos) : 2/333
~ Mes Favoris (My Favorites) : 1/18
~ Mes Documents (My Documents) : 3/15032
~ Mon Bureau (My Desktop) : 2/749
~ Menu demarrer (Programs) : 1/221
~ Hidden Files:  Scanned in 00mn 05s



---\\ Processus lancés
[MD5.CAA0C16ADCCE6142A43AD83BFA20B38B] - (.Motorola Mobility LLC - MotoHelperAgent.) -- C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe   [698680] [PID.3284]
[MD5.E8592697D55B515379F781FAF199C73A] - (.Pelmorex Media Inc. - Pas de description.) -- C:\Users\ghislain\AppData\Local\MétéoMédia\weathereye.exe   [310920] [PID.4600]
[MD5.EF6B3E18CCEB5577C5700EBFD975C61D] - (.Saitek - Manual Configuration.) -- C:\Program Files (x86)\Saitek\Software\Profiler.exe   [159744] [PID.4692]
[MD5.3CA66EE8DC0377A80032C7039DA06282] - (.Saitek - Smart Button Special Sauce.) -- C:\Program Files (x86)\Saitek\Software\SaiSmart.exe   [98304] [PID.4724]
[MD5.A4F2C2A3885670F5836B5C383588D62E] - (.Saitek - MFD File System Driver.) -- C:\Program Files (x86)\Saitek\Software\SaiMfd.exe   [135168] [PID.4796]
[MD5.B5C774CFA944AF3E9A42B592B476F570] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe   [8337920] [PID.7504]
[MD5.B362181ED3771DC03B4141927C80F801] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe   [65432] [PID.2088]
[MD5.30E3850F303EAE5C364782EA78579CC9] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe   [55624] [PID.2132]
[MD5.C752A6902163B5E9C3554BA69A275F41] - (...) -- C:\Program Files (x86)\Roxio\BackOnTrack\App\BService.exe   [21488] [PID.2200]
[MD5.1355EBE184F9DAB1718BC587F8A7E05E] - (.MAGIX AG - Verzeichnisüberwachung und Hilfsaufgaben fü.) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe   [1253376] [PID.2244]
[MD5.876D29312C0A297EEE28F3DA30A994E8] - (.Garmin Ltd or its subsidiaries - Garmin Core Update Service.) -- C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe   [250712] [PID.2392]
[MD5.C98ACDE22458C8F46FD0503CB9E2D01F] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler.exe   [223112] [PID.2816]
[MD5.11F714F85530A2BD134074DC30E99FCA] - (.Microsoft Corporation - Machine Debug Manager.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.exe   [322120] [PID.1884]
[MD5.7ED3A9C3763725BD700946971215EE77] - (.Motorola Mobility LLC - MotoHelper Service.) -- C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe   [137528] [PID.3140]
[MD5.543A4EF0923BF70D126625B034EF25AF] - (.Protexis Inc. - PsiService PsiService.) -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe   [189728] [PID.3200]
[MD5.EA735BF6DF13A857A83C99BF27A422AD] - (.Motorola - ForwardDemon.) -- C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe   [65657] [PID.3304]
[MD5.A0FF419B61AE47E26ADF3BB15DB4F2FE] - (...) -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe   [38608] [PID.3344]
[MD5.E59AFB64C2F6E0C99350E1C944C75088] - (.Nero AG - NeroUpdate.) -- C:\Program Files (x86)\Nero\Update\NASvc.exe   [762192] [PID.3516]
~ Processes Running:  Scanned in 00mn 00s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\ghislain\AppData\Local\Google\Chrome\User Data\Default\Preferences
~ Google Browser: 0 Legitimates Filtered in 00mn 00s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions  (P2,M0,M1,M2,M3)
C:\Users\ghislain\AppData\Roaming\Mozilla\Firefox\Profiles\01rn421q.default\prefs.js
C:\Users\ghislain\AppData\Roaming\Mozilla\Firefox\Profiles\1myiu6b6.default\prefs.js
M0 - MFSP: prefs.js [ghislain - 1myiu6b6.default] http://fr.canoe.ca
~ Firefox Browser: 10 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page = http://allssearch.com =>Adware.SocialSkinz
~ IE Browser: 22 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.*.*;*.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management:  Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys:  Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File:  Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 93



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} Clé orpheline
~ Toolbar:  Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Assassin's Creed IV - Black Flag.lnk . (...)  -- F:\game\Assassin's Creed IV - Black Flag\GameUpdater.exe
O4 - GS\Desktop [Public]: Call of Duty - Ghosts.lnk . (.Activision - Call of Duty: Ghosts.)  -- C:\games\Call of Duty - Ghosts\iw6sp64_ship.exe 
O4 - GS\Desktop [Public]: MP3 Rocket 6.4.6.lnk . (...)  -- C:\Program Files (x86)\MP3 Rocket\MP3Rocket.exe
O4 - GS\Desktop [Public]: QuickBooks SuccèsPME.lnk . (.Intuit Canada, a General Partnership - QuickBooks Application.)  -- C:\Program Files (x86)\Intuit\QuickBooks 2009\QBW32Simplestart.exe 
O4 - GS\Desktop [Public]: Saitek Smart Technology Programming Software.lnk . (.Saitek - Profile Editor.)  -- C:\Program Files (x86)\Saitek\Software\Profile.exe 
O4 - GS\Program [Public]: Bluetooth Problem Report.lnk . (...)  -- C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BtwProblemReport.exe (.not file.)
O4 - GS\Program [Public]: F1 2013.lnk . (.Codemasters - F1 2013 Executable.)  -- F:\game\F1 2013\F1_2013.exe 
O4 - GS\Program [Public]: IP Camera Viewer 1.2.lnk . (.DeskShare - IPCameraViewer.)  -- C:\Program Files (x86)\Deskshare\IP Camera Viewer 1.0\IP Camera Viewer.exe 
O4 - GS\Program [Public]: LabelCreator  Pro.lnk . (.LabelWhiz of MN, Inc. - Pas de description.)  -- C:\Program Files (x86)\LabelCreator Pro\LabelCreatorPro.exe 
O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.)  -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe 
O4 - GS\Program [Public]: Pale Moon.lnk . (.Moonchild Productions - Pale Moon web browser.)  -- C:\Program Files (x86)\Pale Moon\palemoon.exe 
O4 - GS\Program [Public]: Safari.lnk . (...)  -- C:\Windows\Installer\{C779648B-410E-4BBA-B75B-5815BCEFE71D}\SafariIco.exe
O4 - GS\Program [Public]: Serif AlbumPlus Organizer Starter Edition.lnk . (...)  -- C:\Windows\Installer\{A0765939-76F5-48D8-82B1-8D0BBFAD0702}\AlbumPlus.ico 
O4 - GS\Program [Public]: Serif PhotoPlus Starter Edition.lnk . (...)  -- C:\Windows\Installer\{A0765939-76F5-48D8-82B1-8D0BBFAD0702}\PhotoPlus.ico 
O4 - GS\QuickLaunch [GuestUser]: Google Chrome.lnk . (.Google Inc. - Google Chrome.)  -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 
O4 - GS\QuickLaunch [GuestUser]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files (x86)\Internet Explorer\iexplore.exe 
O4 - GS\TaskBar [GuestUser]: Google Chrome.lnk . (.Google Inc. - Google Chrome.)  -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 
O4 - GS\TaskBar [GuestUser]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files (x86)\Internet Explorer\iexplore.exe 
O4 - GS\Program [GuestUser]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files (x86)\Internet Explorer\iexplore.exe 
O4 - GS\SystemTools [GuestUser]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files (x86)\Internet Explorer\iexplore.exe 
O4 - GS\Desktop [GuestUser]: ATR Configuration Manager.lnk . (.Flight One Software - Pas de description.)  -- C:\Program Files (x86)\Microsoft Games\Flight Simulator 9\Aircraft\Flight 1 ATR-72-500\ATR_Config_Manager.exe 
O4 - GS\QuickLaunch [ghislain]: Apple Safari.lnk . (...)  -- C:\Windows\Installer\{C779648B-410E-4BBA-B75B-5815BCEFE71D}\SafariIco.exe
O4 - GS\QuickLaunch [ghislain]: Google Chrome.lnk . (.Google Inc. - Google Chrome.)  -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 
O4 - GS\QuickLaunch [ghislain]: ImageConverter Plus.lnk . (.fCoder Group, Inc. - ImageConverter Plus.)  -- C:\Program Files (x86)\ImageConverter Plus\icp.exe 
O4 - GS\QuickLaunch [ghislain]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files (x86)\Internet Explorer\iexplore.exe 
O4 - GS\QuickLaunch [ghislain]: MAGIX Photo Manager 10.lnk . (.MAGIX - MAGIX Foto Manager 10 deluxe.)  -- C:\Program Files (x86)\MAGIX\Photo_Manager_10\FotoManager_dlx.exe 
O4 - GS\QuickLaunch [ghislain]: MP3 Rocket 6.4.6.lnk . (...)  -- C:\Program Files (x86)\MP3 Rocket\MP3Rocket.exe
O4 - GS\QuickLaunch [ghislain]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.)  -- C:\Users\ghislain\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\TaskBar [ghislain]: Google Chrome.lnk . (.Google Inc. - Google Chrome.)  -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 
O4 - GS\TaskBar [ghislain]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.)  -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe 
O4 - GS\TaskBar [ghislain]: Pale Moon.lnk . (.Moonchild Productions - Pale Moon web browser.)  -- C:\Program Files\Pale Moon\palemoon.exe 
O4 - GS\TaskBar [ghislain]: Roxio Creator 2012 Pro.lnk . (...)  -- C:\Program Files (x86)\Roxio 2012\Roxio Central\RoxioCentralFx.exe
O4 - GS\TaskBar [ghislain]: Safari.lnk . (...)  -- C:\Windows\Installer\{C779648B-410E-4BBA-B75B-5815BCEFE71D}\SafariIco.exe
O4 - GS\Program [ghislain]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files (x86)\Internet Explorer\iexplore.exe 
O4 - GS\Program [ghislain]: MegaDébrideur Download Manager.lnk . (.Microsoft Corporation - Microsoft Silverlight Out-of-Browser Launch.)  -- C:\Program Files (x86)\Microsoft Silverlight\sllauncher.exe 
O4 - GS\SystemTools [ghislain]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files (x86)\Internet Explorer\iexplore.exe 
O4 - GS\Desktop [ghislain]: 4 Elements.exe - Raccourci.lnk . (...)  -- C:\Program Files (x86)\4.Elements.II.Collector's.Edition.v1.0.Cracked-F4CG\4.Elements.II.Collector's.Edition.v1.0.Cracked-F4CG\4 Elements.exe (.not file.)
O4 - GS\Desktop [ghislain]: Bébé Éliot - Raccourci.lnk . (...)  -- C:\Users\ghislain\Pictures\Bébé Éliot 
O4 - GS\Desktop [ghislain]: C.I.P..lnk . (.CyberAvia - CyberAvia Interface Pilote.)  -- C:\CYBERAVIA\CIP.exe 
O4 - GS\Desktop [ghislain]: fsx.exe - Raccourci.lnk . (.Microsoft Corp. - Microsoft Flight Simulator®.)  -- C:\Program Files (x86)\Microsoft Games\Microsoft Flight Simulator X\fsx.exe 
O4 - GS\Desktop [ghislain]: mbam-setup-1.75.0.1300.exe - Raccourci.lnk . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.)  -- C:\Users\ghislain\Desktop\logiciels divers\mbam-setup-1.75.0.1300.exe 
O4 - GS\Desktop [ghislain]: Poker - Espacejeux.lnk . (...)  -- C:\Program Files (x86)\Poker - Espacejeux\poker.exe
O4 - GS\Desktop [ghislain]: Puerto vallarta 2014.lnk . (...)  -- C:\Users\ghislain\Pictures\Puerto vallarta 2014 
O4 - GS\Desktop [ghislain]: RM.exe - Raccourci.lnk . (.www.moofdev.net - Ratio Master.)  -- C:\ratio master\RM.exe 
O4 - GS\Desktop [ghislain]: Tower Simulator v1.lnk . (...)  -- C:\Program Files\Tower Simulator v1\Tower.exe
~ Global Startup: 121 Legitimates Filtered in 00mn 00s



---\\ Applications lancées au démarrage du sytème (O4)
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- C:\Program Files\Microsoft Security Client\msseces.exe 
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe  =>.Realtek Semiconductor Corp
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe  =>.Microsoft Corporation
O4 - HKCU\..\Run: [WeatherEye] . (.Pelmorex Media Inc. - Pas de description.) -- C:\Users\ghislain\AppData\Local\MétéoMédia\WeatherEye.exe 
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe  =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [Profiler] . (.Saitek - Manual Configuration.) -- C:\Program Files (x86)\Saitek\Software\Profiler.exe 
O4 - HKLM\..\Wow6432Node\Run: [SaiSmart] . (.Saitek - Smart Button Special Sauce.) -- C:\Program Files (x86)\Saitek\Software\SaiSmart.exe 
O4 - HKLM\..\Wow6432Node\Run: [SaiMfd] . (.Saitek - MFD File System Driver.) -- C:\Program Files (x86)\Saitek\Software\SaiMfd.exe 
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe  =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe  =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe  =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe  =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-1409875168-3970991592-3381297945-1001\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe  =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-1409875168-3970991592-3381297945-1001\..\Run: [WeatherEye] . (.Pelmorex Media Inc. - Pas de description.) -- C:\Users\ghislain\AppData\Local\MétéoMédia\WeatherEye.exe 
~ Application:  Scanned in 00mn 00s



---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Se&nd to OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} -- C:\Program Files (x86)\MICROS~4\Office14\ONBttnIE.dll (.not file.)
O9 - Extra button: OneNote Lin&ked Notes [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} -- C:\Program Files (x86)\MICROS~4\Office14\ONBTTN~1.dll (.not file.)
O9 - Extra button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 [64Bits] - {CCA281CA-C863-46ef-9331-5C8D4460577F} . (...) -- C:\Program Files\WIDCOMM\Bluetooth Software\bt_hot_icon.ico
~ IE Extra Buttons:  Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{54B07495-146F-4731-8C08-153087470684}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{54B07495-146F-4731-8C08-153087470684}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{54B07495-146F-4731-8C08-153087470684}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain:  Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll  =>.Microsoft Corporation
O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll  =>.Microsoft Corporation
~ Protocole Additionnel:  Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: LBTWlgn . (.Logitech, Inc. - Logitech Bluetooth Service.) -- c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
~ Winlogon:  Scanned in 00mn 00s



---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: BOT4Service (BOT4Service) . (...) - C:\Program Files (x86)\Roxio\BackOnTrack\App\BService.exe
O23 - Service: SessionLauncher (SessionLauncher) . (...) - C:\Users\ghislain\AppData\Local\Temp\DX9\SessionLauncher.exe (.not file.)
O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
~ Services: 17 Legitimates Filtered in 00mn 02s



---\\ Tâches planifiées en automatique (O39)
[MD5.B6037110B175707A353B12C814D34968] [APT] [Motorola Device Manager Engine] (...) -- C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe   [196920]
[MD5.B6037110B175707A353B12C814D34968] [APT] [Motorola Device Manager Initial Update] (...) -- C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe   [196920]
[MD5.B6037110B175707A353B12C814D34968] [APT] [Motorola Device Manager Update] (...) -- C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe   [196920]
[MD5.CAA5E2B9030007FB7EFA74E5211FBBAA] [APT] [ZOTAC FireStorm] (...) -- C:\Program Files (x86)\ZOTAC FireStorm\FireStorm.exe   [4741120]
[MD5.00000000000000000000000000000000] [APT] [{21ABCACB-CF6E-4D88-A81E-5F4D06D5FB96}] (...) -- C:\Program Files (x86)\Google\Picasa3\Picasa3.exe (.not file.)   [0]
[MD5.99A1D140BAB36CD3B40E61E7CBF9922D] [APT] [{44B9D117-9675-4718-969C-C291AB15525D}] (...) -- C:\Eufloria\Eufloria.exe   [108429864]
[MD5.00000000000000000000000000000000] [APT] [{7EC363FD-9902-4399-A750-68428E129E53}] (...) -- C:\Program Files (x86)\Google\Picasa3\Picasa3.exe (.not file.)   [0]
~ Scheduled Task: 30 Legitimates Filtered in 00mn 01s



---\\ Pilotes lancés au démarrage du système (O41)
O41 - Driver:  (nvport) . (. - .) - C:\Windows\system32\Drivers\nvport.sys (.not file.)
~ Drivers: 81 Legitimates Filtered in 00mn 00s



---\\ Logiciels installés (O42)
O42 - Logiciel: CyberAvia Interface Pilote - (...) [HKCU][64Bits] -- CyberAvia Interface Pilote
O42 - Logiciel: F1 2013 - (...) [HKLM][64Bits] -- RjEyMDEz_is1
O42 - Logiciel: FileParade bundle uninstaller - (.FileParade.) [HKLM][64Bits] -- FileParade bundle uninstaller
O42 - Logiciel: Free 3D Christmas Screensaver 1.0 - (...) [HKLM][64Bits] -- Free 3D Christmas Screensaver_is1
O42 - Logiciel: Free 3D Valley Screensaver 1.0 - (...) [HKLM][64Bits] -- Free 3D Valley Screensaver_is1
O42 - Logiciel: GPS TrackMaker - (.Geo Studio Technology Ltd.) [HKLM][64Bits] -- {1FEE9698-33D4-4633-B7BA-7368C87E49AA}
O42 - Logiciel: ICP 9.0 - (...) [HKLM][64Bits] -- ICP install2_is1
O42 - Logiciel: Lotto Pro - (.Data Solutions.) [HKLM][64Bits] -- Lotto Pro
O42 - Logiciel: MP3 Rocket - (.MP3 Rocket Inc.) [HKLM][64Bits] -- MP3 Rocket
O42 - Logiciel: NoDupe 64-bit (v1.16.8.2) - (.OTIS Soft.) [HKLM][64Bits] -- {C38C0BF4-586B-4D57-B08C-AB1571F01674}
O42 - Logiciel: Poker - Espacejeux - (...) [HKLM][64Bits] -- Poker - Espacejeux
O42 - Logiciel: QuickBooks SuccèsPME - (...) [HKLM][64Bits] -- {111EBC34-F370-4d78-AD0A-FB04B62E89D3}
O42 - Logiciel: Rocketfish Bluetooth Combo - (.RocketFish.) [HKLM][64Bits] -- {8C099AC0-189B-4413-AC25-AC461A172223}
O42 - Logiciel: Roger Wilco - (...) [HKLM][64Bits] -- Roger Wilco
O42 - Logiciel: SearchExpress.B Toolbar for IE - (.SearchExpress.B.) [HKLM][64Bits] -- IECT3281621
O42 - Logiciel: Tilt Wheel Driver V1.1 20110217 - (...) [HKLM][64Bits] -- Tilt_Wheel
O42 - Logiciel: Tower Simulator - (...) [HKCU][64Bits] -- Tower Simulator
O42 - Logiciel: Wilco Fleet : A380 - (...) [HKLM][64Bits] -- Wilco Fleet : A380
O42 - Logiciel: melondrea - (.melondrea.) [HKLM][64Bits] -- melondrea
O42 - Logiciel: voip platform - (...) [HKLM][64Bits] -- {DBAE4A41-8CBC-4964-BBC2-0A558FC01690}
~ Logic: 51 Legitimates Filtered in 00mn 01s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\2K75]
[HKCU\Software\3DSavers]
[HKCU\Software\Casino]
[HKCU\Software\CyberAvia]
[HKCU\Software\Data Solutions]
[HKCU\Software\HCW]
[HKCU\Software\MiniGet]
[HKCU\Software\OTIS Soft]
[HKCU\Software\RHR Technologies]
[HKCU\Software\SilentBob]
[HKCU\Software\Titan Casino]
[HKLM\Software\OTIS Soft]
[HKLM\Software\Wow6432Node\CyberAvia]
[HKLM\Software\Wow6432Node\Florenc]
[HKLM\Software\Wow6432Node\MediaPlayerV1]
[HKLM\Software\Wow6432Node\RocketFish]
[HKLM\Software\Wow6432Node\SD EnterNET]
[HKLM\Software\Wow6432Node\voip]
~ Key Software: 804 Legitimates Filtered in 00mn 01s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 2012-05-22 - 22:13:59 - [0,360] ----D C:\Program Files (x86)\DNA
O43 - CFD: 2013-02-18 - 13:38:14 - [109,080] ----D C:\Program Files (x86)\Eufloria
O43 - CFD: 2011-11-09 - 18:48:00 - [28,125] ----D C:\Program Files (x86)\Every Day Genius Square Logic
O43 - CFD: 2011-12-05 - 19:18:04 - [0,651] ----D C:\Program Files (x86)\Free 3D Christmas Screensaver
O43 - CFD: 2011-12-05 - 19:24:03 - [0,651] ----D C:\Program Files (x86)\Free 3D Valley Screensaver
O43 - CFD: 2012-10-16 - 13:32:15 - [252,859] ----D C:\Program Files (x86)\Google ori
O43 - CFD: 2011-11-09 - 14:12:11 - [74,715] ----D C:\Program Files (x86)\ImageConverter Plus
O43 - CFD: 2014-02-09 - 12:56:04 - [599,647] ----D C:\Program Files (x86)\Le Mystere de la Momie Demo
O43 - CFD: 2014-02-13 - 11:32:38 - [0,089] ----D C:\Program Files (x86)\MiniGet
O43 - CFD: 2014-02-12 - 09:22:49 - [47,186] ----D C:\Program Files (x86)\MP3 Rocket
O43 - CFD: 2012-03-14 - 19:40:52 - [0,072] ----D C:\Program Files (x86)\Mystère a Londres
O43 - CFD: 2012-05-14 - 15:18:32 - [0,016] ----D C:\Program Files (x86)\OrgBusiness
O43 - CFD: 2013-11-24 - 08:05:47 - [17,156] ----D C:\Program Files (x86)\Poker - Espacejeux
O43 - CFD: 2014-02-13 - 15:44:42 - [1,071] ----D C:\Program Files (x86)\Roger Wilco
O43 - CFD: 2013-06-01 - 09:19:37 - [0,567] ----D C:\Program Files (x86)\Tilt_Wheel
O43 - CFD: 2012-12-05 - 20:42:06 - [116,177] ----D C:\Program Files (x86)\TrackMaker
O43 - CFD: 2013-03-27 - 10:59:07 - [1030,830] ----D C:\Program Files (x86)\Transport Giant
O43 - CFD: 2012-12-14 - 14:24:00 - [8,252] ----D C:\Program Files (x86)\voip
O43 - CFD: 2011-11-24 - 13:10:31 - [4,974] ----D C:\Program Files (x86)\Windows Lotto Pro 2000
O43 - CFD: 2013-12-09 - 11:35:45 - [0,001] ----D C:\ProgramData\Gamerizon
O43 - CFD: 2011-11-21 - 14:09:41 - [5,012] ----D C:\Users\ghislain\AppData\Roaming\Data Solutions
O43 - CFD: 2012-11-18 - 09:45:19 - [0,001] ----D C:\Users\ghislain\AppData\Roaming\Marine Aquarium Lite
O43 - CFD: 2014-02-13 - 11:32:17 - [0,004] ----D C:\Users\ghislain\AppData\Roaming\MiniGet
O43 - CFD: 2014-02-12 - 09:22:49 - [4,116] ----D C:\Users\ghislain\AppData\Roaming\MP3Rocket
O43 - CFD: 2011-11-08 - 23:32:59 - [0,001] ----D C:\Users\ghislain\AppData\Roaming\RCP 6
O43 - CFD: 2013-08-08 - 16:14:58 - [0] ----D C:\Users\ghislain\AppData\Roaming\Search tool
O43 - CFD: 2011-11-09 - 19:13:28 - [0,312] ----D C:\Users\ghislain\AppData\Roaming\SquareLogic
O43 - CFD: 2012-05-22 - 09:11:35 - [0,023] ----D C:\Users\ghislain\AppData\Local\Ares
O43 - CFD: 2013-10-06 - 18:15:24 - [0,008] ----D C:\Users\ghislain\AppData\Local\BusCableCarSimulator
O43 - CFD: 2013-12-26 - 14:39:17 - [1,531] ----D C:\Users\ghislain\AppData\Local\Game Updater
O43 - CFD: 2013-12-03 - 21:21:33 - [0] -SH-D C:\Users\ghislain\AppData\Local\ms-drivers
O43 - CFD: 2012-03-11 - 11:52:59 - [0,022] ----D C:\Users\ghislain\AppData\Local\OTIS_Soft
O43 - CFD: 2013-12-26 - 14:25:13 - [0] ----D C:\Users\ghislain\AppData\Local\Setup Integrity Check
O43 - CFD: 2011-10-23 - 08:43:19 - [0] ----D C:\Users\ghislain\AppData\Local\VHS to DVD
O43 - CFD: 2014-02-13 - 13:43:54 - [0,006] ----D C:\Users\ghislain\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberAvia
O43 - CFD: 2013-02-18 - 13:37:41 - [0,003] ----D C:\Users\ghislain\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Eufloria
O43 - CFD: 2011-11-09 - 18:45:15 - [0,004] ----D C:\Users\ghislain\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Every Day Genius Square Logic
O43 - CFD: 2011-11-21 - 14:09:58 - [0] ----D C:\Users\ghislain\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lotto Pro
O43 - CFD: 2013-04-10 - 07:41:20 - [0,003] ----D C:\Users\ghislain\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MemOptimizer 3
O43 - CFD: 2011-12-20 - 13:48:11 - [0,002] ----D C:\Users\ghislain\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Poker - Espacejeux
O43 - CFD: 2014-02-13 - 15:44:42 - [0] ----D C:\Users\ghislain\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roger Wilco
~ Program Folder: 571 Legitimates Filtered in 00mn 04s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.E13F489F0B1E52319A86BDD996263F4B] - 2014-02-12 - 21:03:11 ---A- . (...) -- C:\Windows\win.ini   [478]
O44 - LFC:[MD5.2E4BA0F0C3891F88C9CB435B48E51F12] - 2014-02-13 - 11:41:39 ---A- . (...) -- C:\Windows\IE11_main.log   [17768]
O44 - LFC:[MD5.81629B565C101A07ABC8A7F985BD94E2] - 2014-02-14 - 20:19:16 ---A- . (...) -- C:\Windows\Directx.log   [111573]
O44 - LFC:[MD5.14B7CB152E191B34D2359458FB17A0C3] - 2014-02-14 - 20:57:07 ---A- . (...) -- C:\Windows\UHOS6BHH.ocx   [3120]
~ Files: 56 Legitimates Filtered in 00mn 00s



---\\ Opérations et fonctions au démarrage de Windows Explorer (O46)
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook [64Bits] - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
~ ShellExecuteHooks:  Scanned in 00mn 00s



---\\ Enumération des clés de registre StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\AppleSyncNotifier  [Key] . (...) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\boincmgr  [Key] . (...) -- C:\Program Files (x86)\BOINC\boincmgr.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\boinctray  [Key] . (...) -- C:\Program Files (x86)\BOINC\boinctray.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\Intermediate  [Key] . (...) -- C:\Users\ghislain\AppData\Roaming\Intermediate\Intermediate.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\Megakey  [Key] . (...) -- C:\Users\ghislain\AppData\Local\Megamedia\Megakey\Megakey.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\MegakeyUpdater  [Key] . (...) -- C:\Users\ghislain\AppData\Local\Megamedia\Megakey\MegakeyUpdater.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\Multimedia Keyboard  [Key] . (.NONE - Pas de description.) -- C:\Program Files (x86)\MultiMedia Keyboard\KBLED.exe
O53 - SMSR:HKLM\...\startupreg\Norton Ghost 15.0  [Key] . (...) -- C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\Rocketfish Input Device Main Program  [Key] . (.Pas de propriétaire - xDaemon.) -- C:\Program Files\RocketFish\Rocketfish Bluetooth Combo\TSR\xDaemon.exe
O53 - SMSR:HKLM\...\startupreg\SSync  [Key] . (...) -- C:\Users\ghislain\AppData\Roaming\SSync\SSync.exe (.not file.)
~ SMSR Keys: 53 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 18 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.FC0E8778C000291CAF60EB88C011E931] - 2011-10-23 - 16:07:20 ---A- . (...) -- C:\Windows\System32\Drivers\atksgt.sys   [314016]
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 2009-07-13 - 20:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys   [530496]
O58 - SDL:[MD5.23E2233788D654526B5EDFC1B1971603] - 2008-12-01 - 10:06:44 ---A- . (.eMPIA Technology, Inc. - USB EMP Audio Device.) -- C:\Windows\System32\Drivers\emAudio64.sys   [70144]
O58 - SDL:[MD5.A2A94AABF5200A19A2510E94775D6423] - 2008-12-01 - 10:06:44 ---A- . (.eMPIA Technology, Inc. - USB 28xx BDA Driver.) -- C:\Windows\System32\Drivers\emBDA64.sys   [658560]
O58 - SDL:[MD5.B92D2C09EBADE76117B06F9FC58EED5B] - 2008-12-01 - 10:06:44 ---A- . (.Hauppauge Computer Works, Inc. - USB 28xx BDA Lower filter.) -- C:\Windows\System32\Drivers\emOEM64.sys   [151808]
O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 2009-06-10 - 15:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys   [31232]
O58 - SDL:[MD5.8DECF397B091FF0AF81CC48C601C6B94] - 2013-12-04 - 14:46:36 ---A- . (.Highlightly - Highlightly Driver x64.) -- C:\Windows\System32\Drivers\hlnfd.sys   [58256]
O58 - SDL:[MD5.156AB2E56DC3CA0B582E3362E07CDED7] - 2011-10-23 - 16:07:19 ---A- . (...) -- C:\Windows\System32\Drivers\lirsgt.sys   [43680]
O58 - SDL:[MD5.CA88F2094C8746BA6A4F3885AE062B49] - 2009-06-23 - 14:50:44 ---A- . (.Primax Electronics Ltd. - PS/2 Mouse Filter Driver (For Windows 2000 Only).) -- C:\Windows\System32\Drivers\rbbtm.SYS   [16384]
O58 - SDL:[MD5.61ACBE94CEE5E6BA507352489526F1FD] - 2009-06-23 - 14:50:28 ---A- . (.Primax Electronics Ltd. - Mouse Suite Driver (For Windows 2000 and Whistler Only).) -- C:\Windows\System32\Drivers\rbmouse.SYS   [22016]
O58 - SDL:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 1601-01-01 - 05:00:00 ---A- . (...) -- C:\Windows\System32\Drivers\sptd.sys   [530488]
O58 - SDL:[MD5.6060106CE00F32F63F1A73160E46E9D2] - 2012-05-20 - 21:09:00 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG USB Composite Device Driver (MSS Ver.3).) -- C:\Windows\System32\Drivers\ssudbus.sys   [99384]
O58 - SDL:[MD5.855335BF5792E56164F98C012E3D92DD] - 2012-05-20 - 21:09:00 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG Android Modem Device Driver (MSS Ver.3).) -- C:\Windows\System32\Drivers\ssudmdm.sys   [203320]
O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 2009-07-13 - 20:45:55 ---A- . (.Promise Technology - Promise  SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys   [24656]
O58 - SDL:[MD5.48D9D00C2E0E72C3D4F52772C80355F6] - 2010-10-04 - 08:40:18 ---A- . (.Teruten Inc - File System Mini Filter Drvier.) -- C:\Windows\System32\Drivers\TFsExDisk.sys   [16448]
O58 - SDL:[MD5.DA86016F0672ADA925F589EDE715F185] - 2006-03-29 - 08:49:26 ----- . (.Padus, Inc. - Padus(R) ASPI Shell.) -- C:\Windows\SysWOW64\drivers\pfc.sys   [9856]
O58 - SDL:[MD5.306521935042FC0A6988D528643619B3] - 2007-10-25 - 16:26:10 ----- . (...) -- C:\Windows\SysWOW64\drivers\StarOpen.sys   [5632]
O58 - SDL:[MD5.48D9D00C2E0E72C3D4F52772C80355F6] - 2010-10-04 - 08:40:18 ----- . (.Teruten Inc - File System Mini Filter Drvier.) -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys   [16448]
~ Drivers: 18 Legitimates Filtered in 00mn 00s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1  =>.Nicolas Coolman
~ ADS:  Scanned in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: <PALEMOON.EXE> <Pale Moon>[HKLM\..\Shell\open\Command] (.Moonchild Productions - Pale Moon web browser.) -- C:\Program Files (x86)\Pale Moon\palemoon.exe
O68 - StartMenuInternet: <Safari.exe> <Safari>[HKLM\..\Shell\open\Command] (.Apple Inc. - Safari.) -- C:\Program Files (x86)\Safari\Safari.exe
~ Keys:  Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] ${searchCLSID} - (Yahoo! Search) - http://search.yahoo.com
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Google) - http://www.google.com
O69 - SBI: SearchScopes [HKCU] {89DAA5D8-DB16-49B7-989A-8A68908B0C20} - (Bing) - http://www.bing.com
~ Keys:  Scanned in 00mn 00s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.83824D4567A53AC19E40E82B3E5E317F] [SPRF][2013-05-01] (...) -- C:\ProgramData\a3Hvy46k.dat   [112]
[MD5.B3861FF4424139E104B203E07A86B978] [SPRF][2012-01-15] (...) -- C:\ProgramData\ezsidmv.dat   [56]
~ Files: 7 Legitimates Filtered in 00mn 00s



---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "TCP Query User{CA690FAF-5975-4AFB-AC32-E62B032D22F7}C:\program files (x86)\windows lotto pro 2000\proupdt.exe" | In - Private - P6 - TRUE | .(...) -- C:\program files (x86)\windows lotto pro 2000\proupdt.exe
O87 - FAEL: "UDP Query User{9CFF8884-1577-4809-B137-0AF6CAB40891}C:\program files (x86)\windows lotto pro 2000\proupdt.exe" | In - Private - P17 - TRUE | .(...) -- C:\program files (x86)\windows lotto pro 2000\proupdt.exe
O87 - FAEL: "TCP Query User{4CB3B20A-F99D-41C6-9613-40F9C2C73F1B}C:\program files\tower simulator v1\tower.exe" | In - Private - P6 - TRUE | .(...) -- C:\program files\tower simulator v1\tower.exe
O87 - FAEL: "UDP Query User{6E4D7257-0DE6-4D7A-B0A6-91A85A859889}C:\program files\tower simulator v1\tower.exe" | In - Private - P17 - TRUE | .(...) -- C:\program files\tower simulator v1\tower.exe
O87 - FAEL: "{8790FD35-4F71-4305-A1BC-2FFDDE806920}" | In - Private - P6 - TRUE | .(...) -- C:\Program Files (x86)\DNA\btdna.exe
O87 - FAEL: "{B26BE4A8-B785-4586-90A0-6914F2E39322}" | In - Private - P17 - TRUE | .(...) -- C:\Program Files (x86)\DNA\btdna.exe
O87 - FAEL: "TCP Query User{07112D4A-787C-445C-9373-2E63E673492E}C:\wanscam\english\search tool.exe" | In - Private - P6 - TRUE | .(...) -- C:\wanscam\english\search tool.exe
O87 - FAEL: "UDP Query User{15C93E89-A8F2-43D9-95FC-6B5A2CA382E6}C:\wanscam\english\search tool.exe" | In - Private - P17 - TRUE | .(...) -- C:\wanscam\english\search tool.exe
~ Firewall: 364 Legitimates Filtered in 00mn 00s



---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "4FB0C83CB68575D40BC8BA51170F6147" . (.NoDupe 64-bit (v1.16.8.2).) -- C:\Windows\Installer\{C38C0BF4-586B-4D57-B08C-AB1571F01674}\NoDupeIcon
O90 - PUC: "8969EEF14D3333647BAB37868CE794AA" . (.GPS TrackMaker.) -- C:\Windows\Installer\{1FEE9698-33D4-4633-B7BA-7368C87E49AA}\ARPPRODUCTICON.exe
O90 - PUC: "ABB33403853514B418E76E4990D21C87" . (.Crazy Machines II.) -- C:\Windows\Installer\{30433BBA-5358-4B41-817E-E694092DC178}\ARPPRODUCTICON.exe
O90 - PUC: "D5FC3DD537598A4459346DB5DE591329" . (.Prepar3D v2 Professional.) -- C:\Windows\Installer\{5DD3CF5D-9573-44A8-9543-D65BED953192}\Prepar3D.ico
O90 - PUC: "E154C8CC028A8C84EA290AFF8098968D" . (.Stereoscopic Player.) -- C:\Windows\Installer\{CC8C451E-A820-48C8-AE92-A0FF088969D8}\_853F67D554F05449430E7E.exe
~ Update Products: 208 Legitimates Filtered in 00mn 00s



---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.27CAFC59EE89ADF0C09C09AFC3EBC503] [WIS][2008-12-17] (.Intuit Inc. - QuickBooks.) -- C:\Windows\Installer\1b27b2.msi   [60766720]
[MD5.AC826AC63E988366F25BB7286FC6AEEB] [WIS][2012-06-05] (.Sterling Wight - LEC Translate DotNet.) -- C:\Windows\Installer\343bfee.msi   [10913792]
[MD5.A6DBE1F133F81280CE2B373FA75D6C26] [WIS][2004-03-30] (.Gerhard Rotter - LabelWhiz LabelCreator Pro.) -- C:\Windows\Installer\4a94d2e3.msi   [17918464]
[MD5.65242CF37BC2B7733CDB2929D4972FD8] [WIS][2008-07-21] (.FAKT Software GmbH - Crazy Machines II.) -- C:\Windows\Installer\87ffd34.msi   [1553408]
[MD5.D2F34AF196CCAF29A124324392FC3DFF] [WIS][2011-10-04] (.Valve Corporation - Steam.) -- C:\Windows\Installer\ae0f81.msi   [8532992]
[MD5.9D77EBADD06770237B9DC914B1D1DF06] [WIS][2012-02-16] (.OTIS Soft - NoDupe 64-bit (v1.16.8.2).) -- C:\Windows\Installer\f5b6857.msi   [851968]
~ WIS: 214 Legitimates Filtered in 00mn 09s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Disabled 2014-02-06 257928 |  (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Disabled 2013-02-01 135272 |  (atashost) . (.Cisco WebEx LLC.) - C:\Windows\SysWOW64\atashost.exe
SS - | Disabled 2011-10-01 69120 |  (Boonty Games) . (.BOONTY.) - C:\Program Files (x86)\Common Files\BOONTY Shared\Service\Boonty.exe
SS - | Disabled 2011-07-14 211440 |  (BOTService) . (.Rovi Corporation.) - C:\Program Files (x86)\Roxio\BackOnTrack\Instant Restore\BOTService.exe
SS - | Disabled 2013-02-27 1008344 |  (btwdins) . (.Broadcom Corporation..) - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
SS - | Disabled 2011-02-15 19968 |  (CronService) . (.Fork Ltd..) - C:\Prey\platform\windows\cronsvc.exe
SS - | Disabled 2009-09-14 166400 |  (EPSON_EB_RPCV4_04) . (.SEIKO EPSON CORPORATION.) - C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.exe
SS - | Disabled 2009-09-14 128512 |  (EPSON_PM_RPCV4_04) . (.SEIKO EPSON CORPORATION.) - C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.exe
SS - | Disabled 2008-08-07 3276800 |  (FirebirdServerMAGIXInstance) . (.MAGIX®.) - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe
SS - | Disabled 2012-04-02 1044816 |  (FLEXnet Licensing Service) . (.Flexera Software, Inc..) - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
SS - | Auto 2012-12-15 116648 |  (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 2012-12-15 116648 |  (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 1658-07-10 0 |  (gusvc) . (...) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Disabled 2012-09-07 2464400 |  (IconMan_R) . (.Realsil Microelectronics Inc..) - C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
SS - | Disabled 2005-04-03 69632 |  (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
SS - | Demand 2009-07-20 160784 |  (LBTServ) . (.Logitech, Inc..) - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
SS - | Disabled 2014-02-04 118896 |  (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Disabled 2012-05-24 20480 |  (QBCFMonitorService) . (.Intuit.) - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
SS - | Disabled 2006-11-09 65536 |  (QBFCService) . (.Intuit Inc..) - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
SS - | Auto 1658-07-10 0 |  (RoxLiveShare10) . (...) - C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe
SS - | Demand 2011-07-13 1095664 |  (RoxMediaDB13) . (.Rovi Corporation.) - C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxMediaDB13.exe
SS - | Auto 2011-07-13 340976 |  (RoxWatch12) . (.Rovi Corporation.) - C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatch13.exe
SS - | Auto 1658-07-10 0 |  (SessionLauncher) . (...) - C:\Users\ghislain\AppData\Local\Temp\DX9\SessionLauncher.exe
SS - | Auto 2013-10-23 172192 |  (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Disabled 2012-04-09 489256 |  (Steam Client Service) . (.Valve Corporation.) - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
SS - | Disabled 2012-11-29 3463080 |  (TeamViewer8) . (.TeamViewer GmbH.) - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
SS - | Demand 2009-07-13 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

SR - | Auto 2012-05-05 1192272 |  (AcrSch2Svc) . (.Acronis.) - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
SR - | Auto 2013-12-21 65432 |  (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 2013-09-07 55624 |  (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 2011-08-30 462184 |  (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Auto 2011-07-15 21488 |  (BOT4Service) . (...) - C:\Program Files (x86)\Roxio\BackOnTrack\App\BService.exe
SR - | Auto 2009-08-27 1253376 |  (Fabs) . (.MAGIX AG.) - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
SR - | Auto 2013-11-08 250712 |  (Garmin Core Update Service) . (.Garmin Ltd or its subsidiaries.) - C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
SR - | Auto 2013-05-15 1144144 |  (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe
SR - | Auto 2013-11-15 137528 |  (Motorola Device Manager) . (.Motorola Mobility LLC.) - C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
SR - | Auto 2013-10-23 23808 |  (MsMpSvc) . (.Microsoft Corporation.) - c:\Program Files\Microsoft Security Client\MsMpEng.exe
SR - | Auto 2013-07-18 762192 |  (NAUpdate) . (.Nero AG.) - C:\Program Files (x86)\Nero\Update\NASvc.exe
SR - | Auto 2013-10-23 922912 |  (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe
SR - | Auto 2010-03-10 189728 |  (PSI_SVC_2) . (.Protexis Inc..) - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
SR - | Auto 2011-09-02 65657 |  (PST Service) . (.Motorola.) - C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe
SR - | Auto 2012-11-29 38608 |  (RealNetworks Downloader Resolver Service) . (...) - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
SR - | Auto 1658-07-10 0 |  (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe  =>.Microsoft Corporation
SR - | Auto 2009-07-13 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

~ Services:  Scanned in 00mn 10s



---\\ Liste des émulateurs de CD/DVD (MBR Hook)
O58 - SDL:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 1601-01-01 - 05:00:00 ---A- . (...) -- C:\Windows\System32\Drivers\sptd.sys   [530488]
~ Emulateurs:  Scanned in 00mn 10s



---\\ Scan Additionnel (O88)
Database Version : 13031 - (2014-02-14)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 1
Dossiers trouvés  (Folders found) : 0
Fichiers trouvés  (Files found) : 0

~ Additionnel Scan: 1206093 Items scanned in 00mn 31s



---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com/apps/blog/show/27480243-adware-socialskinz   =>Adware.SocialSkinz
~ MSI: 1 link(s) detected in 00mn 31s



~ 2219 Legitimates filtered by white list
End of the scan (626 lines in 01mn 12s)(0)