~ Rapport de ZHPDiag v2014.6.25.98 - Nicolas Coolman (25/06/2014) ~ Lancé par Administrateur (18/07/2014 02:46:33) ~ Adresse du Site Web http://nicolascoolman.fr ~ Traduit par Nicolas Coolman ~ Etat de la version : Nouvelle version disponible ~ Liste blanche : Activée par le programme ~ Elévation des Privilèges : OK ~ User Account Control (UAC): Activate by user ---\\ Navigateurs Internet MSIE: Internet Explorer v11.0.9600.17207 MFIE: Mozilla Firefox 28.0 GCIE: Google Chrome v35.0.1916.153 (Defaut) ---\\ Informations sur les produits Windows ~ Langage: Français Windows 7 Home Basic, 64-bit Service Pack 1 (Build 7601) Windows Server License Manager Script : OK ~ Windows Operating System - Windows(R) 7, OEM_SLP channel System Locked Preinstallation (OEM_SLP) : OK Windows ID Activation : OK ~ Windows Partial Key : TJHTH Windows License : OK ~ Windows Remaining Initializations Number : 2 Software Protection Service (Protection logicielle) : OK Windows Automatic Updates : OK Windows Activation Technologies : OK ---\\ Logiciels de protection du système avast! Internet Security v8.0.1489.0 Bitdefender 60-Second Virus Scanner v1.0.3.76 Windows Defender W7 (Deactivate) ---\\ Logiciels d'optimisation du système CCleaner v3.24 ---\\ Logiciels de partage PeerToPeer Pando Media Booster v2.6.0.7 µTorrent v3.3.0.29544 =>P2P.µTorrent ---\\ Surveillance de Logiciels Adobe Flash Player 14 Plugin Adobe Reader XI Java 7 Update 51 ---\\ Informations sur le système ~ Processor: Intel64 Family 6 Model 37 Stepping 5, GenuineIntel ~ Operating System: 64 Bits Boot mode: Normal (Normal boot) Total RAM: 2933 MB (29% free) System Restore: Activé (Enable) System drive C: has 3 GB (0%) free of 283 GB ---\\ Mode de connexion au système ~ Computer Name: HAMZA-HP ~ User Name: Administrateur ~ All Users Names: Hamza, Administrateur, ~ Unselected Option: O45,O61 Logged in as Administrator ---\\ Variables d'environnement ~ System Unit : C:\ ~ %AppZHP% : C:\Users\Administrateur\AppData\Roaming\ZHP\ ~ %AppData% : C:\Users\Administrateur\AppData\Roaming\ ~ %Desktop% : C:\Users\Administrateur\Desktop\ ~ %Favorites% : C:\Users\Administrateur\Favorites\ ~ %LocalAppData% : C:\Users\Administrateur\AppData\Local\ ~ %StartMenu% : C:\Users\Administrateur\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\\ Enumération des unités disques C: Hard drive, Flash drive, Thumb drive (Free 3 Go of 283 Go) D: Hard drive, Flash drive, Thumb drive (Free 2 Go of 15 Go) E: CD-ROM drive (Not Inserted) ---\\ Etat du Centre de Sécurité Windows [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified ~ Security Center: 46 Legitimates Filtered in 00mn 00s ---\\ Recherche particulière de fichiers génériques [MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 06:19:30.) -- C:\Windows\Explorer.exe [2871808] [MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 01:39:52.) -- C:\Windows\System32\Wininit.exe [129024] [MD5.2EE102DF0EDD8A1EDD3D1E9B99A91BEC] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.18/06/2014 - 22:58:27.) -- C:\Windows\System32\wininet.dll [2266112] [MD5.88AB9B72B4BF3963A0DE0820B4B0B06C] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.04/03/2014 - 09:43:50.) -- C:\Windows\System32\Winlogon.exe [455168] [MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 13:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448] [MD5.FA886682CFC5D36718D3E436AACF10B9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.30/05/2014 - 06:45:52.) -- C:\Windows\system32\Drivers\AFD.sys [497152] [MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 01:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128] [MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 23:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160] [MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 09:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456] [MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 09:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400] [MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 10:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368] [MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.13/07/2009 - 23:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472] [MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 00:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224] [MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 02:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208] [MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 09:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632] [MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.24/01/2014 - 02:37:55.) -- C:\Windows\system32\Drivers\ntfs.sys [1684928] [MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 00:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280] [MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 10:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536] [MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 00:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184] [MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 09:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296] [MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 13:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808] ~ Generic Processes: Scanned in 00mn 00s ---\\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 1/69 ~ Mes musiques (My Musics) : 1/87 ~ Mes Favoris (My Favorites) : 1/4 ~ Mes Documents (My Documents) : 1/1021 ~ Mon Bureau (My Desktop) : 5/13653 ~ Menu demarrer (Programs) : 1/35 ~ Hidden Files: Scanned in 00mn 39s ---\\ Processus lancés [MD5.8EDE61AD829449DC37458C29B73B6788] - (.Hewlett-Packard Company - Pas de description.) -- C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128] [PID.5220] [MD5.C0B97E53A0E39A48EEA2DCD500EEA07A] - (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160] [PID.5640] [MD5.3F11B20D12D89365D7721BDC860CE5F0] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe [4858968] [PID.5768] [MD5.048EA4B978851788E9F5E8E4F081DF7A] - (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904] [PID.5804] [MD5.8192B2E274607D1D530F5C191698C544] - (.Hewlett-Packard Development Company, L.P. - HP Message Service.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944] [PID.5812] [MD5.8A3B69683E63808719D24E1C68C21CC7] - (.Hewlett-Packard Development Company, L.P. - HP On Screen Display.) -- C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960] [PID.5832] [MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336] [PID.2196] [MD5.D2E3E6D94A9E1CFA1561D9C748136FD0] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392] [PID.4520] [MD5.B00F98FF6FE8682FF941BEB2559BF191] - (.CyberLink - YouCam Mirage.) -- C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [136488] [PID.4580] [MD5.7DCE7A74764EB7C67D21A32BC579453D] - (.Oracle Corporation - Java(TM) Update Checker.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe [507264] [PID.5980] [MD5.799BCC829F48F19C5689478179060435] - (.Apple Inc. - Apple Photostreams Uploader Executable.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720] [PID.9000] [MD5.A5FCD42334CCC682DA1882A54338686C] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [860488] [PID.6456] [MD5.1F62DCBF33A67CAA5E68ADECBB25C3C7] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8071680] [PID.10352] [MD5.C2009C6A452BD07B30D773349589B762] - (.AVAST Software - avast! firewall service.) -- C:\Program Files\AVAST Software\Avast\afwServ.exe [137960] [PID.1660] [MD5.ADDA5E1951B90D3D23C56D3CF0622ADC] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65640] [PID.1964] [MD5.53EA061ECC67223A430F153C3682AD54] - (.Apache Software Foundation - Apache HTTP Server.) -- c:\xampp\apache\bin\httpd.exe [20549] [PID.1244] [MD5.221564CC7BE37611FE15EACF443E1BF6] - (.Apple Inc. - YSLoader.exe.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [43336] [PID.1444] [MD5.CA793DCC1D5F619021EF1D37CC7A831E] - (.EasyBits Software AS - Shared EasyBits services for Windows.) -- C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232] [PID.3044] [MD5.2BEC76BDCD1BC080210325E7B5094834] - (.Hewlett-Packard Development Company, L.P. - HP Quick Launch WMI Service.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [35200] [PID.3220] [MD5.FA4A45C179AB0E0F1A31B9751D4B18D7] - (.Hewlett-Packard Company - LightScribe Service.) -- C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728] [PID.3272] [MD5.0405F4BCD1C7A7B309F620FE0B5DE5E6] - (.Intel Corporation - Local Manageability Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [268824] [PID.3328] [MD5.BFAD6C4C16379E46CDE7F50E7E4961AD] - (...) -- c:\xampp\mysql\bin\mysqld.exe [8133120] [PID.3780] [MD5.A1688A4FB2EC49D040C027EF6DC7A87B] - (.pdfforge GbR - PDF Architect Helper Service.) -- C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104] [PID.3956] [MD5.E23FF9B2F8EEAB2BDDA681C21C48E843] - (.pdfforge GbR - PDF Architect Conversion Service.) -- C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208] [PID.3996] [MD5.97F6FFB8A305A77D25C6C0E07B71D252] - (.TeamViewer GmbH - TeamViewer 9.) -- C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [5024576] [PID.3420] [MD5.B348EE97B001E144352778AB786EB094] - (.VMware, Inc. - VMware NAT Service.) -- C:\Windows\SysWOW64\vmnat.exe [433264] [PID.3560] [MD5.3ACCF0C817A2BB34EFBFB72B57B00252] - (.VMware, Inc. - VMware Authorization Service.) -- C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe [79872] [PID.3120] [MD5.8B98F284BAE83E300E4BCDE18716207A] - (.VMware, Inc. - VMware VMnet DHCP service.) -- C:\Windows\SysWOW64\vmnetdhcp.exe [354416] [PID.4140] [MD5.28D6701C710AD7BA3CB95E75F8F1A9AA] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808] [PID.3308] [MD5.B25F192EA1F84A316EB7C19EFCCCF33D] - (.Intel Corporation - IAStorDataSvc.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [13336] [PID.3356] [MD5.D2946D9F020AE76E9CEF9B4A6DF838C0] - (.Hewlett-Packard Company - HP Software Framework WMI Service.) -- C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe [1129760] [PID.4780] [MD5.6F895CA96552069B3D3EF5B4F6E90D3E] - (.Intel Corporation - User Notification Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2320920] [PID.4496] ~ Processes Running: Scanned in 00mn 05s ---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2) C:\Users\Administrateur\AppData\Local\Google\Chrome\User Data\Default\Preferences G2 - GCE: Preference [User Data\Default] [ahigpjeolkfgjdaeodlmaceggigbpeoh] Unfriend Notify pour Facebook v.1.3 (Désactivé) G2 - GCE: Preference [User Data\Default] [apdfllckaahabafndbhieahigkjlhalf] Google Drive v.6.3 (Activé) G2 - GCE: Preference [User Data\Default] [beobeededemalmllhkmnkinmfembdimh] TV v.1.0.12 (Activé) G2 - GCE: Preference [User Data\Default] [mfffpogegjflfpflabcdkioaeobkgjik] GaiaAuthExtension v.0.0.1, (Activé) G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé) G2 - GCE: Preference [User Data\Default] [nhalnajmigjnpjpdbpkpgfhekbjmolhp] Curling v.1.0.10 (Activé) G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé) G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Wallet v.0.0.6.1 (Activé) G2 - GCE: Preference [User Data\Default] [pafkbggdmjlpgkdkcbjmhmfcdpncadgh] Google Now v.1.2.0.1 (Activé) G2 - GCE: Preference [User Data\Default] [pipnnjjknlabchljabhmnpdfpdobpnkk] Blank Canvas Script Handler v.0.0.20 (Désactivé) ---\\ Liste des dossiers d'extension Google Chrome ~ Google Lines Browser: 29 Legitimates Filtered in 01mn 22s ---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) M2 - MFEP: prefs.js [Administrateur - 9ubyzsum.default\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}] [] iMacros for Firefox v8.8.1 (..) ~ Firefox Browser: 21 Legitimates Filtered in 00mn 00s ---\\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe ~ Keys: Scanned in 00mn 00s ---\\ Hosts file redirection (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 00s ~ Nombre de lignes (Lines number): 23 ---\\ Internet Explorer Toolbars (O3) O3 - Toolbar: avast! WebRep - [HKLM]{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} . (.AVAST Software - IE Webrep plugin.) -- C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll ~ Toolbar: Scanned in 00mn 00s ---\\ Autres liens utilisateurs (O4) O4 - GS\QuickLaunch [Hamza]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Program Files (x86)\uTorrent\uTorrent.exe =>P2P.BitTorrent ~ Global Startup: 1 Legitimates Filtered in 00mn 08s ---\\ Applications lancées au démarrage du système (O4) O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe (.not file.) O4 - HKLM\..\Run: [SysTrayApp] . (.IDT, Inc. - IDT PC Audio.) -- C:\Program Files\IDT\WDM\sttray64.exe O4 - HKLM\..\Run: [HPWirelessAssistant] . (...) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe O4 - HKLM\..\RunOnce: [NCPluginUpdater] . (.Hewlett-Packard - NCPluginUpdater.) -- C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe O4 - HKCU\..\Run: [LightScribe Control Panel] . (.Hewlett-Packard Company - Pas de description.) -- C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe O4 - HKCU\..\Run: [pdiface] . (.Bitdefender - 60-Second Interface.) -- C:\Program Files\Bitdefender\60-Second Virus Scanner\pdiface.exe O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\Administrateur\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc O4 - HKLM\..\Wow6432Node\Run: [IAStorIcon] . (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe O4 - HKLM\..\Wow6432Node\Run: [IMSS] . (.Pas de propriétaire - PIconStartup application.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe O4 - HKLM\..\Wow6432Node\Run: [Easybits Recovery] . (.EasyBits Software AS - Pas de description.) -- C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe =>.EasyBits Software AS O4 - HKLM\..\Wow6432Node\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated O4 - HKLM\..\Wow6432Node\Run: [HP Quick Launch] . (.Hewlett-Packard Development Company, L.P. - HP Message Service.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe O4 - HKLM\..\Wow6432Node\Run: [HPOSD] . (.Hewlett-Packard Development Company, L.P. - HP On Screen Display.) -- C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation O4 - HKLM\..\Wow6432Node\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-21-3977677533-3912670835-1999053008-500\..\Run: [LightScribe Control Panel] . (.Hewlett-Packard Company - Pas de description.) -- C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe O4 - HKUS\S-1-5-21-3977677533-3912670835-1999053008-500\..\Run: [pdiface] . (.Bitdefender - 60-Second Interface.) -- C:\Program Files\Bitdefender\60-Second Virus Scanner\pdiface.exe O4 - HKUS\S-1-5-21-3977677533-3912670835-1999053008-500\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\Administrateur\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc ~ Application: Scanned in 00mn 00s ---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll,-102 [64Bits] - {25510184-5A38-4A99-B273-DCA8EEF6CD08} . (...) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\Resources\Icons\HP.ico O9 - Extra button: &Envoyer à OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} -- C:\Program Files (x86)\MICROS~2\Office14\ONBttnIE.dll (.not file.) O9 - Extra button: Notes &liées OneNote [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} -- C:\Program Files (x86)\MICROS~2\Office14\ONBTTN~1.dll (.not file.) O9 - Extra button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 [64Bits] - {CCA281CA-C863-46ef-9331-5C8D4460577F} . (...) -- C:\Program Files\WIDCOMM\Bluetooth Software\bt_hot_icon.ico ~ IE Extra Buttons: Scanned in 00mn 00s ---\\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{9EC1A36E-AAFE-4909-9348-735F11C2AD76}: DhcpNameServer = 172.20.10.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{EDCD2655-52EA-457F-95A0-9298DDC22D85}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{9EC1A36E-AAFE-4909-9348-735F11C2AD76}: DhcpNameServer = 172.20.10.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{EDCD2655-52EA-457F-95A0-9298DDC22D85}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{9EC1A36E-AAFE-4909-9348-735F11C2AD76}: DhcpNameServer = 172.20.10.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{EDCD2655-52EA-457F-95A0-9298DDC22D85}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 ~ Domain: Scanned in 00mn 00s ---\\ Protocole additionnel (O18) O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) -- O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll =>.Microsoft Corporation ~ Protocole Additionnel: Scanned in 00mn 00s ---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll ~ Winlogon: Scanned in 00mn 00s ---\\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: mysql (mysql) . (...) - c:\xampp\mysql\bin\mysqld.exe O23 - Service: NSClient++ (x64) (nscp) . (.MySolutions Nordic (Michael Medin) - Monitoring Agent.) - C:\Program Files\NSClient++\nscp.exe ~ Services: 32 Legitimates Filtered in 00mn 07s ---\\ Tâches planifiées en automatique (O39) [MD5.00000000000000000000000000000000] [APT] [{BECA99BB-D685-4745-92D4-9D24B0D62CC5}] (...) -- C:\Users\Administrateur\Desktop\camtasia.exe (.not file.) [0] O39 - APT: - (..) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater [1002] O39 - APT: - (..) -- C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3977677533-3912670835-1999053008-1000Core [906] O39 - APT: - (..) -- C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3977677533-3912670835-1999053008-1000UA [928] O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore [1062] O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA [1066] O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3977677533-3912670835-1999053008-500Core [1062] O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3977677533-3912670835-1999053008-500UA [1114] O39 - APT: - (..) -- C:\Windows\System32\Tasks\HPCeeScheduleForAdministrateur [368] O39 - APT: - (..) -- C:\Windows\System32\Tasks\HPCeeScheduleForHAMZA-HP$ [344] O39 - APT: APT: - (..) -- C:\Windows\System32\System32\Tasks\HPCeeScheduleForHAMZA-HP$ [344] - (..) -- C:\Windows\System32\Tasks\HPCeeScheduleForHamza [332] ~ Scheduled Task: 33 Legitimates Filtered in 00mn 06s ---\\ Logiciels installés (O42) O42 - Logiciel: BarracudaDrive MxTunnel - (.RealTimeLogic.) [HKLM][64Bits] -- BarracudaDrive MxTunnel O42 - Logiciel: GNS3 0.8.3.1 - (...) [HKLM][64Bits] -- GNS3 O42 - Logiciel: NSClient++ (x64) - (.MySolutions NORDIC.) [HKLM][64Bits] -- {FCADF425-BAA9-4201-AB3E-2B6EFD6CDD8C} O42 - Logiciel: PPÖúÊÖ PC°æ 1.0.5.0 - (.¹ãÖÝÌúÈËÍøÂç¿Æ¼¼ÓÐÏÞ¹«Ë¾.) [HKLM][64Bits] -- PPÖúÊÖ PC°æ ~ Logic: 45 Legitimates Filtered in 00mn 00s ---\\ HKCU & HKLM Software Keys [HKLM\Software\Wow6432Node\Pando Networks] [HKLM\Software\Wow6432Node\RealTimeLogic] ~ Key Software: 414 Legitimates Filtered in 00mn 00s ---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 10/05/2013 - 12:47:26 - [] ----D C:\Program Files (x86)\BarracudaDrive O43 - CFD: 13/10/2013 - 21:56:01 - [] ----D C:\Program Files (x86)\Pando Networks O43 - CFD: 28/04/2013 - 13:08:52 - [] ----D C:\Program Files (x86)\PPÖúÊÖ O43 - CFD: 03/01/2013 - 00:33:23 - [] ----D C:\Program Files (x86)\Remove Logo Now! O43 - CFD: 12/03/2014 - 00:52:18 - [] ----D C:\ProgramData\XDMessaging O43 - CFD: 05/02/2014 - 16:30:22 - [] ----D C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F} O43 - CFD: 19/03/2014 - 17:22:07 - [] ----D C:\Users\Administrateur\AppData\Roaming\Crash Reports O43 - CFD: 19/03/2014 - 17:22:07 - [] ----D C:\Users\Administrateur\AppData\Roaming\Profiles O43 - CFD: 19/03/2014 - 17:22:07 - [] ----D C:\Users\Administrateur\AppData\Local\Profiles O43 - CFD: 12/03/2014 - 00:52:00 - [0] ----D C:\Users\Administrateur\AppData\Local\SENukeX O43 - CFD: 12/03/2014 - 00:50:53 - [] ----D C:\Users\Administrateur\AppData\Local\SENukeXUpdateConfig ~ 22 Dossier CLSID vide (CLSID Empty Folder) ~ Program Folder: 243 Legitimates Filtered in 00mn 01s ---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.A86C9371B9C7CAEE28F6F2A6D3F7920F] - 17/07/2014 - 12:05:39 ---A- . (...) -- C:\Windows\win.ini [676] ~ Files: 56 Legitimates Filtered in 00mn 28s ---\\ Clé de registre Shell MountPoints2 (MPKS) (O51) O51 - MPSK:{26b0eb2a-7879-11e2-a03a-e02a82d5e327}\AutoRun\command. (...) -- F:\autorun.exe (.not file.) O51 - MPSK:{87fe99f3-bca1-11e3-9623-005056c00008}\AutoRun\command. (...) -- F:\.\Setup.exe (.not file.) ~ Keys: Scanned in 00mn 00s ---\\ Enumération des clés de registre StartupReg (SMSR) (O53) O53 - SMSR:HKLM\...\startupreg\uTorrent [Key] . (.BitTorrent Inc. - µTorrent.) -- C:\Program Files (x86)\uTorrent\uTorrent.exe =>P2P.BitTorrent ~ SMSR Keys: 19 Legitimates Filtered in 00mn 00s ---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55) O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 ~ MWPS: 17 Legitimates Filtered in 00mn 00s ---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56) O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1 ~ MWPE Keys: 5 Legitimates Filtered in 00mn 00s ---\\ Liste des pilotes du système (SDL) (O58) O58 - SDL:21/09/2012 - 09:26:08 ---A- . (.ALWIL Software - avast! Filtering NDIS driver.) -- C:\Windows\System32\Drivers\aswNdis.sys [12368] O58 - SDL:09/05/2013 - 08:59:07 ---A- . (...) -- C:\Windows\System32\Drivers\aswRvrt.sys [65336] =>.ALWIL Software O58 - SDL:27/06/2013 - 20:11:08 ---A- . (...) -- C:\Windows\System32\Drivers\aswSnx.sys.sum [175] O58 - SDL:27/06/2013 - 20:11:08 ---A- . (...) -- C:\Windows\System32\Drivers\aswSP.sys.sum [175] O58 - SDL:27/06/2013 - 20:11:08 ---A- . (...) -- C:\Windows\System32\Drivers\aswVmm.sys [189936] =>.ALWIL Software O58 - SDL:27/06/2013 - 20:11:08 ---A- . (...) -- C:\Windows\System32\Drivers\aswVmm.sys.sum [175] =>.ALWIL Software O58 - SDL:25/01/2013 - 23:01:16 ---A- . (.Connectify - NDIS filter driver.) -- C:\Windows\System32\Drivers\cnnctfy2.sys [31344] O58 - SDL:14/07/2009 - 01:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496] O58 - SDL:10/06/2009 - 20:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232] O58 - SDL:26/02/2013 - 15:34:06 ---A- . (.Windows (R) Win 7 DDK provider - Kinoni Virtual Audio Device.) -- C:\Windows\System32\Drivers\kinonivad.sys [23040] O58 - SDL:26/02/2013 - 15:34:12 ---A- . (.Windows (R) Win 7 DDK provider - AVStream Simulated Hardware Sample.) -- C:\Windows\System32\Drivers\kinonivd.sys [2782848] O58 - SDL:22/01/2014 - 07:52:10 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG USB Composite Device Driver (MSS Ver.3).) -- C:\Windows\System32\Drivers\ssudbus.sys [108800] O58 - SDL:22/01/2014 - 07:52:10 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG Android Modem Device Driver (MSS Ver.3).) -- C:\Windows\System32\Drivers\ssudmdm.sys [206080] O58 - SDL:20/09/2012 - 04:35:36 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG USB Mobile OBEX Device Driver (MSS Ver.3).) -- C:\Windows\System32\Drivers\ssudobex.sys [203104] O58 - SDL:22/01/2014 - 07:52:12 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG USB Mobile Logging Device Driver (MSS Ver.3).) -- C:\Windows\System32\Drivers\ssudserd.sys [206080] O58 - SDL:14/07/2009 - 01:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656] O58 - SDL:13/12/2010 - 22:04:48 ---A- . (.IDT, Inc. - IDT PC Audio.) -- C:\Windows\System32\Drivers\stwrt64.sys [520192] O58 - SDL:13/12/2012 - 13:50:36 ---A- . (.Apple, Inc. - Apple Mobile Device USB Driver.) -- C:\Windows\System32\Drivers\usbaapl64.sys [54784] ~ Drivers: 106 Legitimates Filtered in 00mn 03s ---\\ Liste des outils de désinfection (LATC) (O63) O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman ~ ADS: Scanned in 00mn 00s ---\\ Associations Shell Spawning (O67) O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.Not Key.) ~ FASS Keys: 11 Legitimates Filtered in 00mn 00s ---\\ Menu de démarrage Internet (SMI) (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\\ Enumère les fichiers Crack & Keygen (CKF) (O82) C:\Users\Administrateur\Downloads\Keygen.and.Patch.Only by Rif Ghost.rar =>.Crack,Keygen C:\Users\Hamza\Downloads\mikrotik keygen + key hu6i-xpt - 3.30 full.rar =>.Crack,Keygen C:\Users\Administrateur\Downloads\Keygen.and.Patch.Only by Rif Ghost.rar =>.Crack,Keygen C:\Users\Hamza\Downloads\mikrotik keygen + key hu6i-xpt - 3.30 full.rar =>.Crack,Keygen ~ Files: Scanned in 02mn 36s ---\\ Recherche particulière à la racine du système (SPRF) (O84) [MD5.96AF2EF0F7D466F0138D537774D1D02D] [SPRF][07/11/2013] (...) -- C:\ProgramData\1383843760.bdinstall.bin [50972] [MD5.06643B73503BA414F56A0B5722B42324] [SPRF][20/11/2013] (...) -- C:\ProgramData\1384972712.bdinstall.bin [54241] [MD5.1D96392840858822B051D6AB0C1F4FD0] [SPRF][20/11/2013] (...) -- C:\ProgramData\1384974555.bdinstall.bin [54085] [MD5.2C09926E3A258E9E182488817E2BF46A] [SPRF][20/11/2013] (...) -- C:\ProgramData\1384976373.bdinstall.bin [54085] [MD5.B05AF07A7D7C8144A92AD68E3A0B59AD] [SPRF][20/11/2013] (...) -- C:\ProgramData\1384978199.bdinstall.bin [54085] [MD5.1CCD3479ED0022993B3085E148A27B94] [SPRF][20/11/2013] (...) -- C:\ProgramData\1384980018.bdinstall.bin [54084] [MD5.343CB96A2FC6241A05E651A3E88B5C36] [SPRF][20/11/2013] (...) -- C:\ProgramData\1384981851.bdinstall.bin [54085] [MD5.7B34F7CA2330DDF3A270BB743530BB87] [SPRF][20/11/2013] (...) -- C:\ProgramData\1384983669.bdinstall.bin [54085] [MD5.E78E2373D55ECA5A8E93AFBE7006830C] [SPRF][20/11/2013] (...) -- C:\ProgramData\1384985485.bdinstall.bin [54085] [MD5.2A5B156F861640DAF28D28D22B2C2F5F] [SPRF][20/11/2013] (...) -- C:\ProgramData\1384987305.bdinstall.bin [54084] [MD5.C260A792EB0558DE9F4C7B0AAB025496] [SPRF][20/11/2013] (...) -- C:\ProgramData\1384989144.bdinstall.bin [54085] [MD5.3166D8F30DA83F62119F761547818B98] [SPRF][20/11/2013] (...) -- C:\ProgramData\1384990986.bdinstall.bin [54085] [MD5.65EE906DA6FE196C68949C716C2A1E6A] [SPRF][21/11/2013] (...) -- C:\ProgramData\1385071554.bdinstall.bin [54085] [MD5.6E0F6972306DF18CBAF5B782EC79D1A6] [SPRF][21/11/2013] (...) -- C:\ProgramData\1385073421.bdinstall.bin [54084] [MD5.9DAB953FFDD4D867B02F6B663E1BF34B] [SPRF][21/11/2013] (...) -- C:\ProgramData\1385075242.bdinstall.bin [54085] [MD5.4899BC403E50DD9C315ADCF6394C6267] [SPRF][22/11/2013] (...) -- C:\ProgramData\1385126083.bdinstall.bin [54085] [MD5.E809289F861C70C28162059B3376D3F5] [SPRF][22/11/2013] (...) -- C:\ProgramData\1385127993.bdinstall.bin [54085] [MD5.33C8DCD158C3490F0BE8BE70E7BFC077] [SPRF][22/11/2013] (...) -- C:\ProgramData\1385129816.bdinstall.bin [54085] [MD5.5B3B55C4DADE391AE9788598430B76C0] [SPRF][22/11/2013] (...) -- C:\ProgramData\1385131635.bdinstall.bin [54085] [MD5.D7BB55298168B59FBAE4D62A8E418CFC] [SPRF][22/11/2013] (...) -- C:\ProgramData\1385133452.bdinstall.bin [54084] [MD5.680A255546C136299EA7DDBD8C20D48D] [SPRF][22/11/2013] (...) -- C:\ProgramData\1385135274.bdinstall.bin [54085] [MD5.7AB87FB9CB455CD69480E85CC82800D5] [SPRF][22/11/2013] (...) -- C:\ProgramData\1385161265.bdinstall.bin [54085] [MD5.4122BA8DEF9CC05050AFD247FE3F0E5C] [SPRF][22/11/2013] (...) -- C:\ProgramData\1385163131.bdinstall.bin [54085] [MD5.0BC07324920221857CABFB9584F254A8] [SPRF][23/11/2013] (...) -- C:\ProgramData\1385164955.bdinstall.bin [54085] [MD5.EF7FA709C653E854EA5F4702F0BF830B] [SPRF][23/11/2013] (...) -- C:\ProgramData\1385166777.bdinstall.bin [54085] [MD5.961650B3AB06F3F82F47EE8BCDFEAD2F] [SPRF][23/11/2013] (...) -- C:\ProgramData\1385168592.bdinstall.bin [54084] [MD5.476C625BDC80DECFF76E0FCBD2A5CEF3] [SPRF][23/11/2013] (...) -- C:\ProgramData\1385204341.bdinstall.bin [54085] [MD5.9E440B521F7DF3CE89B266142AE9114E] [SPRF][24/11/2013] (...) -- C:\ProgramData\1385291648.bdinstall.bin [54085] [MD5.A5E9A7125C6B882E6099C0A09BB5C408] [SPRF][24/11/2013] (...) -- C:\ProgramData\1385293479.bdinstall.bin [54084] [MD5.544307C9DE08737E98425C1A6C5CF081] [SPRF][24/11/2013] (...) -- C:\ProgramData\1385295297.bdinstall.bin [54085] [MD5.43403467366A2FAEC8D522293960C138] [SPRF][24/11/2013] (...) -- C:\ProgramData\1385297118.bdinstall.bin [54085] [MD5.17440A20BDA769EA72542E1A86C74EC7] [SPRF][24/11/2013] (...) -- C:\ProgramData\1385298936.bdinstall.bin [54084] [MD5.352F56322EDB51F0E056952792FA60FB] [SPRF][24/11/2013] (...) -- C:\ProgramData\1385300754.bdinstall.bin [54085] [MD5.011F9E81A377BB83DC1BC000102F7850] [SPRF][24/11/2013] (...) -- C:\ProgramData\1385302570.bdinstall.bin [54085] [MD5.F1F664068635319728A3498B6A08A47A] [SPRF][24/11/2013] (...) -- C:\ProgramData\1385304388.bdinstall.bin [54085] [MD5.A586AE2E93AB8D32E172DD829FD14A00] [SPRF][24/11/2013] (...) -- C:\ProgramData\1385312639.bdinstall.bin [54085] [MD5.A7571D89DED8DDC870DADA8A640E1861] [SPRF][24/11/2013] (...) -- C:\ProgramData\1385318128.bdinstall.bin [54242] [MD5.1E1A1B739B0DB910EBAE1F02BE35C453] [SPRF][24/11/2013] (...) -- C:\ProgramData\1385319952.bdinstall.bin [54085] [MD5.612D75E11E42FDF21A5519EAAB8DEC9E] [SPRF][24/11/2013] (...) -- C:\ProgramData\1385321779.bdinstall.bin [54085] [MD5.FF9D85BC0733F7E249D294B201155AEB] [SPRF][24/11/2013] (...) -- C:\ProgramData\1385323598.bdinstall.bin [54085] [MD5.0BA783056B52B6D43D15A3AF1CB94CBF] [SPRF][24/11/2013] (...) -- C:\ProgramData\1385325418.bdinstall.bin [54085] [MD5.088EEA6CA9F85DF5AD3871C4CD9C80A0] [SPRF][24/11/2013] (...) -- C:\ProgramData\1385327238.bdinstall.bin [54085] [MD5.20188605A46B786D57559DDA435FC75E] [SPRF][24/11/2013] (...) -- C:\ProgramData\1385329053.bdinstall.bin [54085] [MD5.AE35EC4227301812D76ED059FDA3D4A6] [SPRF][24/11/2013] (...) -- C:\ProgramData\1385330871.bdinstall.bin [54085] [MD5.125EAADA53879B92024A41BE3CEBA6F1] [SPRF][24/11/2013] (...) -- C:\ProgramData\1385332691.bdinstall.bin [54085] [MD5.DB6BC528EC9A5FE9ABBBB4A43FD63E8B] [SPRF][24/11/2013] (...) -- C:\ProgramData\1385334510.bdinstall.bin [54085] [MD5.37B46812C997B69D1366283291BCEDE8] [SPRF][25/11/2013] (...) -- C:\ProgramData\1385372819.bdinstall.bin [54268] ~ Files: 48 Legitimates Filtered in 00mn 05s ---\\ Liste des exceptions du parefeu (FirewallRules) (O87) O87 - FAEL: "{333B5855-79A0-4B54-9E90-7714DD5BD310}" | In - None - P6 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Program Files (x86)\uTorrent\uTorrent.exe =>P2P.BitTorrent O87 - FAEL: "{06550AF6-2B8A-4883-8734-0A9A797AC6CC}" | In - None - P17 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Program Files (x86)\uTorrent\uTorrent.exe =>P2P.BitTorrent ~ Firewall: 2 Legitimates Filtered in 00mn 02s ---\\ Recherche de clés de registre Tracing (O100) HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_for_itools-iphone-manager_RASAPI32 =>Toolbar.Conduit HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_for_itools-iphone-manager_RASMANCS =>Toolbar.Conduit HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_for_pdfcreator_RASAPI32 =>Toolbar.Conduit HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_for_pdfcreator_RASMANCS =>Toolbar.Conduit HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\uTorrent_RASAPI32 =>P2P.µTorrent HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\uTorrent_RASMANCS =>P2P.µTorrent ~ BTK: 307 Legitimates Filtered in 00mn 00s ---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Demand 09/07/2014 262320 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe SS - | Auto 25/10/2012 393080 | (BstHdAndroidSvc) . (.BlueStack Systems, Inc..) - C:\Program Files (x86)\BlueStacks\HD-Service.exe SS - | Auto 25/10/2012 384888 | (BstHdLogRotatorSvc) . (.BlueStack Systems, Inc..) - C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe SS - | Demand 17/10/2010 742912 | (FileZilla Server) . (.FileZilla Project.) - c:\xampp\FileZillaFTP\FileZillaServer.exe SS - | Demand 19/06/2010 246520 | (GameConsoleService) . (.WildTangent, Inc..) - C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe SS - | Auto 07/11/2012 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe SS - | Demand 07/11/2012 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe SS - | Auto 05/08/2010 291896 | (HPClientSvc) . (.Hewlett-Packard Company.) - C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe SS - | Demand 14/05/2014 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe SS - | Demand 25/06/2010 117264 | (rpcapd) . (.CACE Technologies, Inc..) - C:\Program Files (x86)\WinPcap\rpcapd.exe SS - | Auto 18/01/2012 11839488 | (VMwareHostd) . (...) - C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe =>.VMware, Inc SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 11/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe SR - | Auto 18/10/2010 20549 | (Apache2.2) . (.Apache Software Foundation.) - c:\xampp\apache\bin\httpd.exe SR - | Auto 12/02/2014 43336 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe SR - | Auto 09/05/2013 46808 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe SR - | Auto 09/05/2013 137960 | (avast! Firewall) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\afwServ.exe SR - | Auto 30/08/2011 462184 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe SR - | Auto 29/07/2010 951584 | (btwdins) . (.Broadcom Corporation..) - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe SR - | Auto 10/07/1658 0 | (ezSharedSvc) . (.EasyBits Software AS.) - C:\Windows\System32\ezSharedSvcHost.exe =>.EasyBits Software AS SR - | Auto 04/11/2013 92160 | (HP Support Assistant Service) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe =>.Hewlett-Packard Co SR - | Auto 21/07/2010 103992 | (HP Wireless Assistant Service) . (.Hewlett-Packard Company.) - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe SR - | Demand 13/05/2013 1129760 | (hpqwmiex) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe SR - | Auto 05/03/2012 35200 | (HPWMISVC) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe SR - | Auto 14/09/2010 13336 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe SR - | Auto 11/02/2014 2425960 | (IconMan_R) . (.Realsil Microelectronics Inc..) - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe SR - | Demand 26/05/2014 641352 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe SR - | Auto 22/11/2010 73728 | (LightScribeService) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe SR - | Auto 23/07/2010 268824 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe SR - | Auto 25/10/2013 2768208 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe SR - | Auto 03/12/2010 8133120 | (mysql) . (...) - c:\xampp\mysql\bin\mysqld.exe SR - | Auto 04/02/2013 4516864 | (nscp) . (.MySolutions Nordic (Michael Medin).) - C:\Program Files\NSClient++\nscp.exe SR - | Auto 09/01/2013 1324104 | (PDF Architect Helper Service) . (.pdfforge GbR.) - C:\Program Files (x86)\PDF Architect\HelperService.exe SR - | Auto 09/01/2013 795208 | (PDF Architect Service) . (.pdfforge GbR.) - C:\Program Files (x86)\PDF Architect\ConversionService.exe SR - | Auto 11/11/2013 1445424 | (pdserv) . (.Bitdefender.) - C:\Program Files\Bitdefender\60-Second Virus Scanner\pdscan.exe SR - | Auto 13/12/2010 275968 | (STacSV) . (.IDT, Inc..) - C:\Program Files\IDT\WDM\STacSV64.exe SR - | Auto 25/04/2014 5024576 | (TeamViewer9) . (.TeamViewer GmbH.) - C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe SR - | Auto 23/07/2010 2320920 | (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe SR - | Auto 18/01/2012 79872 | (VMAuthdService) . (.VMware, Inc..) - C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe =>.VMware, Inc SR - | Auto 10/07/1658 0 | (VMnetDHCP) . (.VMware, Inc..) - C:\Windows\system32\vmnetdhcp.exe SR - | Auto 29/08/2011 846448 | (VMUSBArbService) . (.VMware, Inc..) - C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe SR - | Auto 10/07/1658 0 | (VMware NAT Service) . (.VMware, Inc..) - C:\Windows\system32\vmnat.exe SR - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe ~ Services: Scanned in 00mn 09s ---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80) Run by Administrateur at 18/07/2014 02:53:03 ~ OS 64 not supported by MBR tool ~ MBR: 0 Legitimates Filtered in 00mn 00s ---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80) Written by ad13, http://ad13.geekstog Run by Administrateur at 18/07/2014 02:53:05 ********* Dump file Name ********* C:\PhysicalDisk0_MBR.bin ~ MBR: Scanned in 00mn 02s ---\\ Scan Additionnel (O88) Database Version : 13026 - (25/06/2014) Clés trouvées (Keys found) : 9 Valeurs trouvées (Values found) : 1 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 0 [HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\uTorrent] =>P2P.BitTorrent^ [HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}] =>PUP.Babylon [HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}] =>PUP.Babylon [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}] =>Toolbar.Agent [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}] =>Toolbar.Agent [HKLM\Software\Wow6432Node\Microsoft\Tracing\apnstub_RASMANCS] =>Toolbar.Ask [HKLM\Software\Wow6432Node\Microsoft\Tracing\apnstub_RASAPI32] =>Toolbar.Ask [HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}] =>Toolbar.Yahoo [HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}] =>Toolbar.Yahoo ~ Additionnel Scan: 400641 Items scanned in 00mn 33s ---\\ Informations complémentaires sur les modules ~ http://nicolascoolman.fr/g2-google-chrome-extensions/ =>.Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2) ~ http://nicolascoolman.fr/r5-internet-explorer-proxy-management-iepm/ =>.Internet Explorer, Proxy Management (R5) ~ http://nicolascoolman.fr/o3-internet-explorer-toolbars/ =>.Internet Explorer Toolbars (O3) ~ http://nicolascoolman.fr/o4-applications-demarrees-par-le-registre/ =>.Applications lancées au démarrage du système (O4) ~ http://nicolascoolman.fr/o51-mountpoints2-shell-key-mpsk/ =>.Clé de registre Shell MountPoints2 (MPKS) (O51) ~ AMI: 5 Legitimates Filtered in 00mn 00s ---\\ Récapitulatif des détections trouvées sur votre station http://nicolascoolman.fr/toolbar-conduit =>Toolbar.Conduit http://nicolascoolman.fr/pup-babylon =>PUP.Babylon http://nicolascoolman.fr/toolbar-ask =>Toolbar.Ask ~ MSI: 3 link(s) detected in 00mn 00s ~ 1028 Legitimates filtered by white list End of the scan (599 lines in 07mn 06s)(4)