~ Rapport de ZHPDiag v2014.3.26.33 - Nicolas Coolman (26/03/2014) ~ Lancé par Maurice (27/03/2014 08:50:56) ~ Adresse du Site Web http://nicolascoolman.webs.com ~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/ ~ Traduit par Nicolas Coolman ~ Etat de la version : ~ Liste blanche : Activée par le programme ~ Elévation des Privilèges : OK ~ User Account Control (UAC): Deactivate by program ---\\ Navigateurs Internet MSIE: Internet Explorer v11.0.9600.16521 (Defaut) MFIE: Mozilla Firefox 28.0 ---\\ Informations sur les produits Windows ~ Langage: Français Windows 8.1, 64-bit (Build 9600) Windows Server License Manager Script : OK ~ ion : Windows(R) Operating System, OEM_COA_NSLP channel Windows ID Activation : OK ~ Windows Partial Key : W8CMH Windows License : OK ~ Windows Remaining Initializations Number : 999 Software Protection Service (Protection logicielle) : OK Windows Automatic Updates : OK Windows Activation Technologies : OK ---\\ Logiciels de protection du système Trusteer Sécurité des points d'accès v3.5.1304.61 Malwarebytes Anti-Malware version 1.75.0.1300 Windows Defender W8 ---\\ Logiciels d'optimisation du système CCleaner v4.11 =>.Piriform Ltd ---\\ Logiciels de partage PeerToPeer ---\\ Surveillance de Logiciels Adobe Flash Player 13 Plugin Adobe Reader XI Java 7 Update 51 Java 7 Update 21 ---\\ Informations sur le système ~ Processor: Intel64 Family 6 Model 58 Stepping 9, GenuineIntel ~ Operating System: 64 Bits Boot mode: Normal (Normal boot) Total RAM: 7884 MB (73% free) System Restore: Activé (Enable) System drive C: has 844 GB (90%) free of 931 GB ---\\ Mode de connexion au système ~ Computer Name: BUREAU ~ User Name: Maurice ~ All Users Names: Maurice, HomeGroupUser$, Administrateur, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\\ Variables d'environnement ~ System Unit : C:\ ~ %AppZHP% : C:\Users\Maurice\AppData\Roaming\ZHP\ ~ %AppData% : C:\Users\Maurice\AppData\Roaming\ ~ %Desktop% : C:\Users\Maurice\Desktop\ ~ %Favorites% : C:\Users\Maurice\Favorites\ ~ %LocalAppData% : C:\Users\Maurice\AppData\Local\ ~ %StartMenu% : C:\Users\Maurice\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\\ Enumération des unités disques C: Hard drive, Flash drive, Thumb drive (Free 844 Go of 931 Go) D: Hard drive, Flash drive, Thumb drive (Free 741 Go of 932 Go) G: CD-ROM drive (Free 0 Go of 3 Go) ---\\ Etat du Centre de Sécurité Windows [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified ~ Security Center: 49 Legitimates Filtered in 00mn 00s ---\\ Recherche particulière de fichiers génériques [MD5.63DC38C3E4564B2405D562855643ABA2] - (.Microsoft Corporation - Explorateur Windows.) (.03/12/2013 - 11:28:36.) -- C:\Windows\Explorer.exe [2328872] [MD5.48CFA7BE561A7BE144C29BB912055016] - (.Microsoft Corporation - Application de démarrage de Windows.) (.22/08/2013 - 10:58:29.) -- C:\Windows\System32\Wininit.exe [144384] [MD5.DF79CE9B950C62677D232154E93A81C7] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.01/03/2014 - 04:10:28.) -- C:\Windows\System32\wininet.dll [2334208] [MD5.7C94FDA3809015B8F2208D2E1C221F17] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.22/08/2013 - 10:55:08.) -- C:\Windows\System32\Winlogon.exe [564736] [MD5.AFCAB4DC692CCE37E283B00E2D7B438F] - (.Microsoft Corporation - Bibliothèque de licences.) (.21/12/2013 - 09:54:07.) -- C:\Windows\System32\sppcomapi.dll [447488] [MD5.239268BAB58EAE9A3FF4E08334C00451] - (.Microsoft Corporation - Pilote de fonction connexe pour WinSock.) (.22/08/2013 - 14:25:35.) -- C:\Windows\system32\Drivers\AFD.sys [567296] [MD5.74B14192CF79A72F7536B27CB8814FBD] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.22/08/2013 - 13:43:41.) -- C:\Windows\system32\Drivers\atapi.sys [26464] [MD5.2FA6510E33F7DEFEC03658B74101A9B9] - (.Microsoft Corporation - CD-ROM File System Driver.) (.22/08/2013 - 12:40:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [88576] [MD5.C6796EA22B513E3457514D92DCDB1A3D] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.22/08/2013 - 09:46:35.) -- C:\Windows\system32\Drivers\Cdrom.sys [164352] [MD5.5DB26D7E0216D0BF364A81D3829AD7B9] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.22/08/2013 - 12:38:00.) -- C:\Windows\system32\Drivers\DfsC.sys [134656] [MD5.03909BDBFF0DCACCABF2B2D4ADEE44DC] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.22/08/2013 - 12:38:38.) -- C:\Windows\system32\Drivers\HDAudBus.sys [78336] [MD5.84CFC5EFA97D0C965EDE1D56F116A541] - (.Microsoft Corporation - Pilote de port i8042.) (.22/08/2013 - 12:39:15.) -- C:\Windows\system32\Drivers\i8042prt.sys [107520] [MD5.B7342B3C58E91107F6E946A93D9D4EFD] - (.Microsoft Corporation - IP Network Address Translator.) (.27/11/2013 - 13:02:29.) -- C:\Windows\system32\Drivers\IpNat.sys [142848] [MD5.79B6F3DF7CDFD12159871FF71464F0CE] - (.Microsoft Corporation - Minirdr SMB Windows NT.) (.23/11/2013 - 08:08:19.) -- C:\Windows\system32\Drivers\MRxSmb.sys [403456] [MD5.0217532E19A748F0E5D569307363D5FD] - (.Microsoft Corporation - MBT Transport driver.) (.22/08/2013 - 12:37:02.) -- C:\Windows\system32\Drivers\netBT.sys [282624] [MD5.4412D565C0278C401575E11072C7DCE3] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.22/08/2013 - 14:25:41.) -- C:\Windows\system32\Drivers\ntfs.sys [2011488] [MD5.764B1121867B2D9B31C491668AC72B2B] - (.Microsoft Corporation - Pilote de port parallèle.) (.22/08/2013 - 12:40:02.) -- C:\Windows\system32\Drivers\Parport.sys [94208] [MD5.BBB6272B7F46C4640A8CDB8A70C3450F] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.22/08/2013 - 12:35:51.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [120832] [MD5.680C1DAE268B6FB67FA21B389A8B79EF] - (.Microsoft Corporation - Redirecteur de périphérique de Microsoft RDP.) (.30/09/2013 - 04:59:53.) -- C:\Windows\system32\Drivers\rdpdr.sys [195584] [MD5.FFF28F9F6823EB1756C60F1649560BBF] - (.Microsoft Corporation - TDI Translation Driver.) (.22/08/2013 - 14:25:35.) -- C:\Windows\system32\Drivers\tdx.sys [107520] [MD5.C85C075DE5B6D0FE116043054DE8EE02] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.31/01/2014 - 17:15:23.) -- C:\Windows\system32\Drivers\volsnap.sys [311640] ~ Generic Processes: Scanned in 00mn 00s ---\\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 2/13377 ~ Mes musiques (My Musics) : 1/24 ~ Mes Videos (My Videos) : 2/114 ~ Mes Favoris (My Favorites) : 1/4 ~ Mes Documents (My Documents) : 4/957 ~ Mon Bureau (My Desktop) : 3/7 ~ Menu demarrer (Programs) : 1/66 ~ Hidden Files: Scanned in 00mn 05s ---\\ Processus lancés [MD5.65F5702109057C9BF7C45366992199D2] - (.Trusteer Ltd. - RapportService.) -- C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe [2484504] [PID.1828] [MD5.01B64830DE6341004AC00EB8CC302DA0] - (.Acronis - Acronis Scheduler Helper.) -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [403816] [PID.3856] [MD5.615E58F9963734185756AEE4959BA964] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe [20728480] [PID.4200] [MD5.57C635C41750117D206C90DA9C599777] - (.Pas de propriétaire - Status Monitor Application.) -- C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1163264] [PID.4500] [MD5.490F9A7948EF661DF32A9F0DC8534284] - (.Brother Industries, Ltd. - Brother Status Monitor (Local).) -- C:\Program Files (x86)\Brother\Brmfcmon\BrMfcmon.exe [221184] [PID.4624] [MD5.69F509A8A4A3FB81CB809E60B0BEAC2E] - (.Brother Industries, Ltd. - Control Center 3 Main Program.) -- C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe [872448] [PID.4716] [MD5.BED38B0ADFF5F5CC6E988A6491017E83] - (.Research In Motion Limited - Launch Agent Service.) -- C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [267792] [PID.4756] [MD5.12FD7C1EADDDA10A67B1D6F905B3CC1E] - (.Sony Corporation - Content Transfer Walkman Detector.) -- C:\Program Files (x86)\Sony\Content Transfer\ContentTransferWMDetector.exe [583016] [PID.4828] [MD5.8E556A72D54F7E3B7844AB9217F02DD7] - (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [275568] [PID.4536] [MD5.CBA0013EBDE3F0B08B043F61857E9809] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe [18544] [PID.2500] [MD5.0C4CA3667C77F573CBD224F368FB1D62] - (.Adobe Systems, Inc. - Adobe Flash Player 13.0 d0.) -- C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_168.exe [1864368] [PID.1420] [MD5.51B4461F32E67D4F5C57B0C89E4BCA48] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8177664] [PID.4684] ~ Processes Running: Scanned in 00mn 00s ---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) M2 - MFEP: prefs.js [Maurice - 39bgljcm.default\{ada4b710-8346-4b82-8199-5de2b400a6ae}] [] ReminderFox v2.1.4.2 (..) ~ Firefox Browser: 24 Legitimates Filtered in 00mn 00s ---\\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe ~ Keys: Scanned in 00mn 00s ---\\ Hosts file redirection (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 00s ~ Nombre de lignes (Lines number): 4 ---\\ Internet Explorer Toolbars (O3) O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll =>Toolbar.Google O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline ~ Toolbar: Scanned in 00mn 00s ---\\ Autres liens utilisateurs (O4) O4 - GS\Desktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O4 - GS\Program [Public]: Desktop.lnk - Clé orpheline O4 - GS\Program [Public]: Encore plus de jeux.lnk - Clé orpheline O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O4 - GS\Program [Public]: Pervasive System Analyzer.lnk . (.Pervasive Software Inc. - Pervasive.SQL V8.6 Component.) -- C:\Program Files (x86)\Common Files\Pervasive Software Shared\PSA\psawizrd.exe O4 - GS\QuickLaunch [Maurice]: CodeStuff Starter.lnk . (.CodeStuff - Startup Manager for Windows 9x/Me/NT/2000/X.) -- C:\Program Files (x86)\CodeStuff\Starter\Starter.exe O4 - GS\QuickLaunch [Maurice]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\TaskBar [Maurice]: Emoticon.lnk . (.GregLand - Pas de description.) -- C:\Program Files (x86)\Emoticon\emoticon.exe O4 - GS\TaskBar [Maurice]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\TaskBar [Maurice]: JDs Auto Speed Tester.lnk . (...) -- C:\Program Files (x86)\JDAST\JDAutoSpeedTester.exe O4 - GS\TaskBar [Maurice]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O4 - GS\TaskBar [Maurice]: Paint Shop Pro 7.lnk . (...) -- C:\Windows\Installer\{0F211D27-C463-43A9-9B8A-12CA8D6D90DE}\psp7.exe O4 - GS\TaskBar [Maurice]: Stopper Windows.lnk . (.Microsoft Corporation - Outil d’arrêt et d’annotation Windows.) -- C:\WINDOWS\system32\shutdown.exe O4 - GS\Program [Maurice]: Bibliothèques.lnk . (...) -- C:\Users\Maurice\AppData\Roaming\Microsoft\Windows\Libraries O4 - GS\Program [Maurice]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\Program [Maurice]: Lecteur DVD RW (G) Hi8 (2).lnk . (...) -- G:\ O4 - GS\Program [Maurice]: RecentPlaces.lnk - Clé orpheline O4 - GS\Desktop [Maurice]: Numériser un document ou une photo - Raccourci.lnk - Clé orpheline O4 - GS\Desktop [Maurice]: photos.lnk . (...) -- C:\Users\Maurice\Pictures O4 - GS\Desktop [Maurice]: Téléchargements.lnk . (...) -- C:\Users\Maurice\Downloads ~ Global Startup: 63 Legitimates Filtered in 00mn 00s ---\\ Applications lancées au démarrage du sytème (O4) O4 - GS\Startup [Maurice]: Emoticon.lnk . (.GregLand - Pas de description.) -- C:\Program Files (x86)\Emoticon\emoticon.exe O4 - HKLM\..\Run: [Logitech Download Assistant] . (.Logitech, Inc. - Logitech Download Assistant.) -- C:\Windows\System32\LogiLDA.dll O4 - HKLM\..\Run: [Acronis Scheduler2 Service] . (.Acronis - Acronis Scheduler Helper.) -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe =>.Skype Technologies S.A. O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated O4 - HKLM\..\Wow6432Node\Run: [DivXMediaServer] . (.DivX, LLC - DivX DLNA Media Server.) -- C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe O4 - HKLM\..\Wow6432Node\Run: [PowerDVD12DMREngine] . (.CyberLink - DMREngine.) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe O4 - HKLM\..\Wow6432Node\Run: [PowerDVD12Agent] . (.CyberLink Corp. - PowerDVD 12.) -- C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe O4 - HKLM\..\Wow6432Node\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe O4 - HKLM\..\Wow6432Node\Run: [BrMfcWnd] . (.Pas de propriétaire - Status Monitor Application.) -- C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe O4 - HKLM\..\Wow6432Node\Run: [ControlCenter3] . (.Brother Industries, Ltd. - ControlCenter Program.) -- C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe O4 - HKLM\..\Wow6432Node\Run: [DivXUpdate] . (.Pas de propriétaire - DivX Update.) -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe O4 - HKLM\..\Wow6432Node\Run: [RIMBBLaunchAgent.exe] . (.Research In Motion Limited - Launch Agent Service.) -- C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe O4 - HKLM\..\Wow6432Node\Run: [AcronisTibMounterMonitor] . (.Acronis - Acronis TIB Monitor.) -- C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe O4 - HKLM\..\Wow6432Node\Run: [TrueImageMonitor.exe] . (.Acronis - Acronis True Image Monitor.) -- C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe O4 - HKLM\..\Wow6432Node\Run: [ContentTransferWMDetector.exe] . (.Sony Corporation - Content Transfer Walkman Detector.) -- C:\Program Files (x86)\Sony\Content Transfer\ContentTransferWMDetector.exe O4 - HKLM\..\Wow6432Node\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- C:\Program Files (x86)\QuickTime\QTTask.exe O4 - HKUS\S-1-5-21-981503625-3735549741-1778780651-1001\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe =>.Skype Technologies S.A. ~ Application: Scanned in 00mn 00s ---\\ Site dans la Zone de confiance d'Internet Explorer (O15) O15 - Trusted Zone: [HKCU\...\Domains] http.ma-config.com O15 - Trusted Zone: [HKCU\...\Domains] http.touslesdrivers.com ~ IE Zone Confiance: Scanned in 00mn 00s ---\\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{F85DF1A6-A0E9-4C12-9AF5-F51496E5EE4F}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{F85DF1A6-A0E9-4C12-9AF5-F51496E5EE4F}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 ~ Domain: Scanned in 00mn 00s ---\\ Protocole additionnel (O18) O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) -- O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.dll =>.Microsoft Corporation ~ Protocole Additionnel: Scanned in 00mn 00s ---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll ~ Winlogon: Scanned in 00mn 00s ---\\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: DirMngr (DirMngr) . (...) - C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe O23 - Service: EBP Pervasive.SQL (EBP Pervasive.SQL) . (...) - C:\PVSW\Bin\WGE_SRV.exe ~ Services: 15 Legitimates Filtered in 00mn 05s ---\\ Tâches planifiées en automatique (O39) [MD5.00000000000000000000000000000000] [APT] [{4207733F-6998-4FEF-B565-720CEB838ACA}] (...) -- G:\EAutorun.exe (.not file.) [0] ~ Scheduled Task: 10 Legitimates Filtered in 00mn 02s ---\\ Logiciels installés (O42) O42 - Logiciel: Alabama Smith: Escape from Pompeii - (...) [HKLM][64Bits] -- BFG-Alabama Smith - Escape from Pompeii O42 - Logiciel: Aqua Words - (...) [HKLM][64Bits] -- BFG-Aqua Words O42 - Logiciel: Birds on a Wire - (...) [HKLM][64Bits] -- BFG-Birds on a Wire O42 - Logiciel: Cérébral Challenge - (...) [HKLM][64Bits] -- BFG-Cerebral Challenge O42 - Logiciel: Fashion Craze - (...) [HKLM][64Bits] -- BFG-Fashion Craze O42 - Logiciel: Gpg4win (2.2.1) - (.The Gpg4win Project.) [HKLM][64Bits] -- GPG4Win O42 - Logiciel: JDs Auto Speed Tester - (...) [HKLM][64Bits] -- JDs Auto Speed Tester O42 - Logiciel: National Geographic ™ presents: Herod's Lost Tomb - (...) [HKLM][64Bits] -- BFG-Herods Lost Tomb O42 - Logiciel: Pervasive System Analyzer - (...) [HKLM][64Bits] -- Pervasive System Analyzer O42 - Logiciel: Pervasive.SQL V8 Workgroup (v8.6) - (.Pervasive Software Inc. .) [HKLM][64Bits] -- {5FCFC78C-438A-4F4D-B266-E32B8468BAFC} O42 - Logiciel: Puzzling Paws - (...) [HKLM][64Bits] -- BFG-Puzzling Paws O42 - Logiciel: Sheep's Quest - (...) [HKLM][64Bits] -- BFG-Sheep's Quest O42 - Logiciel: Word Mojo Gold - (...) [HKLM][64Bits] -- BFG-Word Mojo Gold ~ Logic: 39 Legitimates Filtered in 00mn 00s ---\\ HKCU & HKLM Software Keys [HKLM\Software\Wow6432Node\JDAST] ~ Key Software: 358 Legitimates Filtered in 00mn 00s ---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 03/04/2013 - 16:30:17 - [73,390] ----D C:\Program Files (x86)\Alabama Smith - Escape from Pompeii O43 - CFD: 03/04/2013 - 18:09:15 - [17,806] ----D C:\Program Files (x86)\Aqua Words O43 - CFD: 03/04/2013 - 18:06:42 - [14,770] ----D C:\Program Files (x86)\Birds on a Wire O43 - CFD: 03/04/2013 - 18:18:54 - [98,372] ----D C:\Program Files (x86)\Cerebral Challenge O43 - CFD: 26/03/2014 - 10:41:44 - [100,636] ----D C:\Program Files (x86)\Emoticon O43 - CFD: 03/04/2013 - 17:41:50 - [253,264] ----D C:\Program Files (x86)\Fashion Craze O43 - CFD: 03/04/2013 - 17:35:13 - [157,427] ----D C:\Program Files (x86)\Herods Lost Tomb O43 - CFD: 31/01/2014 - 20:46:25 - [11,446] ----D C:\Program Files (x86)\JDAST O43 - CFD: 21/04/2013 - 07:29:47 - [0] ----D C:\Program Files (x86)\Nouveau dossier O43 - CFD: 03/04/2013 - 18:05:03 - [129,451] ----D C:\Program Files (x86)\Puzzling Paws O43 - CFD: 03/04/2013 - 18:06:08 - [99,559] ----D C:\Program Files (x86)\Sheep's Quest O43 - CFD: 03/04/2013 - 18:05:22 - [4,212] ----D C:\Program Files (x86)\Word Mojo Gold O43 - CFD: 02/04/2013 - 15:16:31 - [128,534] --H-D C:\ProgramData\{6A6BFF56-8325-4101-A340-724548B1F63F} O43 - CFD: 02/04/2013 - 15:17:24 - [85,696] --H-D C:\ProgramData\{845E6EA1-4172-4A99-AC74-1FA650D4F7B2} O43 - CFD: 26/03/2014 - 18:42:07 - [0,009] ----D C:\Users\Maurice\AppData\Roaming\jdast O43 - CFD: 02/02/2014 - 13:38:16 - [0] ----D C:\Users\Maurice\AppData\Roaming\jdnetmon O43 - CFD: 10/04/2013 - 19:40:01 - [0,006] ----D C:\Users\Maurice\AppData\Local\.SIPPS O43 - CFD: 27/08/2013 - 19:35:50 - [10,294] ----D C:\Users\Maurice\AppData\Local\SpaceKace O43 - CFD: 03/12/2013 - 11:39:58 - [0,004] ----D C:\Users\Maurice\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Alabama Smith - Escape from Pompeii O43 - CFD: 03/12/2013 - 11:39:58 - [0,003] ----D C:\Users\Maurice\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aqua Words O43 - CFD: 03/12/2013 - 11:39:58 - [0,003] ----D C:\Users\Maurice\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Emoticon O43 - CFD: 31/01/2014 - 20:46:25 - [0,011] ----D C:\Users\Maurice\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JDs Auto Speed Tester O43 - CFD: 03/12/2013 - 11:39:58 - [0,003] ----D C:\Users\Maurice\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Puzzling Paws ~ Program Folder: 262 Legitimates Filtered in 00mn 29s ---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.110BE5198A63D3FF3CE9C30F1DC12EC3] - 15/03/2014 - 13:59:18 ---A- . (...) -- C:\Windows\System32\ApnDatabase.xml [386722] O44 - LFC:[MD5.3891C680CB90D823B912B979B3200BF6] - 27/03/2014 - 06:21:06 ---A- . (...) -- C:\Windows\S.dirmngr [22] O44 - LFC:[MD5.C6E7BD47E8B242CC0ADDF05F8D93FBFC] - 27/03/2014 - 06:21:12 ---A- . (...) -- C:\Windows\pvsw.log [16540] ~ Files: 75 Legitimates Filtered in 00mn 01s ---\\ Contrôle du Safe Boot (CSB) (O49) O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\29120950.sys . (...) -- C:\Windows\System32\Drivers\29120950.sys (.not file.) O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\29120950.sys . (...) -- C:\Windows\System32\Drivers\29120950.sys (.not file.) ~ CSB: 19 Legitimates Filtered in 00mn 00s ---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55) O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 O55 - MWPS:[HKLM\...\Policies\System] - "EnableLinkedConnections"=1 ~ MWPS: 18 Legitimates Filtered in 00mn 00s ---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56) O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1 ~ MWPE Keys: 5 Legitimates Filtered in 00mn 00s ---\\ Liste des pilotes du système (SDL) (O58) O58 - SDL:[MD5.C1ABB0F7E3BEA48A0417BDF6FF14AB21] - 13/08/2013 - 00:25:46 ---A- . (.Windows (R) Win 7 DDK provider - BCM Function 2 Device Driver.) -- C:\Windows\System32\Drivers\bcmfn2.sys [17624] O58 - SDL:[MD5.366DEA74BBA65B362BCCFC6FC2ADFD8B] - 22/08/2013 - 13:43:32 ---A- . (.Promise Technology, Inc. - Promise SuperTrak EX Series Driver for Windows x64.) -- C:\Windows\System32\Drivers\stexstor.sys [31072] ~ Drivers: 18 Legitimates Filtered in 00mn 00s ---\\ Liste des outils de désinfection (LATC) (O63) O63 - Logiciel: SEAF By C_XX - (.C_XX.) [HKLM] -- SEAF O63 - Logiciel: UsbFix - (.El Desaparecido - www.usbfix.net - www.sosvirus.net.) [HKLM] -- Usbfix O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman ~ ADS: Scanned in 00mn 00s ---\\ Menu de démarrage Internet (SMI) (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69) O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com O69 - SBI: SearchScopes [HKCU] {08645F7C-F7EF-487C-8D78-6FA42F603361} - (Google) - http://www.google.com ~ Keys: Scanned in 00mn 00s ---\\ Liste des exceptions du parefeu (FirewallRules) (O87) O87 - FAEL: "{CFA52E87-E219-48AE-9A8F-336ABECDCC8A}" | In - Private - P17 - TRUE | .(...) -- C:\PVSW\Bin\w3dbsmgr.exe O87 - FAEL: "{62902BB1-FC48-43F5-A9E6-89775DB11CF2}" | In - Private - P6 - TRUE | .(...) -- C:\PVSW\Bin\w3dbsmgr.exe O87 - FAEL: "{33AE326C-6D56-4D12-B185-6828B9A50C57}" | In - Domain - P17 - TRUE | .(...) -- C:\PVSW\Bin\w3dbsmgr.exe O87 - FAEL: "{FC851083-1EBA-4F43-8DD8-0B0B10D88154}" | In - Domain - P6 - TRUE | .(...) -- C:\PVSW\Bin\w3dbsmgr.exe ~ Firewall: 255 Legitimates Filtered in 00mn 00s ---\\ Enumère les codes produits des logiciels (PUC) (O90) O90 - PUC: "C87CFCF5A834D4F42B663EB24886ABCF" . (.Pervasive.SQL V8 Workgroup (v8.6).) -- C:\Windows\Installer\{5FCFC78C-438A-4F4D-B266-E32B8468BAFC}\ARPPRODUCTICON.exe ~ Update Products: 106 Legitimates Filtered in 00mn 00s ---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS) [MD5.56136281D2441E213380AA902F5B3566] [WIS][01/02/2007] (.Pervasive Software - WGE msi project.) -- C:\Windows\Installer\3d16f0.msi [29354496] ~ WIS: 106 Legitimates Filtered in 00mn 08s ---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Demand 22/03/2014 257712 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe SS - | Disabled 02/04/2013 3717112 | (afcdpsrv) . (.Acronis.) - C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe SS - | Disabled 18/01/2013 577536 | (Blackberry Device Manager) . (.Research In Motion Limited.) - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe SS - | Demand 21/12/2013 279000 | (cphs) . (.Intel Corporation.) - C:\Windows\SysWow64\IntelCpHeciSvc.exe SS - | Auto 02/04/2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe SS - | Demand 02/04/2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe SS - | Demand 02/04/2013 194032 | (gusvc) . (.Google.) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe SS - | Demand 20/03/2014 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe SS - | Auto 21/01/2014 699912 | (Orange update Core Service) . (.Orange SA.) - C:\Program Files (x86)\Orange\OrangeUpdate\Service\OUCore.exe SS - | Disabled 07/12/2006 32768 | (Pervasive.SQL Workgroup) . (...) - C:\PVSW\bin\WGE_SRV.exe SS - | Auto 23/10/2013 172192 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe SS - | Disabled 18/08/2012 7026408 | (syncagentsrv) . (.Acronis.) - C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe SS - | Disabled 06/03/2013 3560288 | (TeamViewer8) . (.TeamViewer GmbH.) - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe SS - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation SS - | Demand 22/08/2013 37768 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 23/08/2012 1127392 | (AcrSch2Svc) . (.Acronis.) - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe SR - | Auto 21/12/2013 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe SR - | Auto 30/08/2011 462184 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe SR - | Auto 29/11/2013 89864 | (CLHNServiceForPowerDVD12) . (.CyberLink Corp..) - C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe SR - | Auto 29/11/2013 77576 | (CyberLink PowerDVD 12 Media Server Monitor Service) . (.CyberLink.) - C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe SR - | Auto 29/11/2013 294664 | (CyberLink PowerDVD 12 Media Server Service) . (.CyberLink.) - C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe SR - | Auto 07/10/2013 218112 | (DirMngr) . (...) - C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe SR - | Auto 07/12/2006 32768 | (EBP Pervasive.SQL) . (...) - C:\PVSW\Bin\WGE_SRV.exe SR - | Auto 25/10/2013 2768208 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe SR - | Auto 10/03/2010 189728 | (PSI_SVC_2) . (.Protexis Inc..) - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe SR - | Auto 19/03/2014 1444120 | (RapportMgmtService) . (.Trusteer Ltd..) - C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe SR - | Demand 10/07/1658 0 | (WdNisSvc) . (...) - C:\Program Files (x86)\Windows Defender\NisSrv.exe SR - | Auto 10/07/1658 0 | (WinDefend) . (...) - C:\Program Files (x86)\Windows Defender\MsMpEng.exe SR - | Auto 29/11/2013 32456 | ({73526619-C24F-470B-9BED-53D455FBB5C6}) . (.CyberLink Corp..) - C:\Program Files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl ~ Services: Scanned in 00mn 09s ---\\ Scan Additionnel (O88) Database Version : 13031 - (26/03/2014) Clés trouvées (Keys found) : 0 Valeurs trouvées (Values found) : 1 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 0 [HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{2318C2B1-4965-11d4-9B18-009027A5CD4F} =>Toolbar.Google^ ~ Additionnel Scan: 321836 Items scanned in 00mn 17s ---\\ Récapitulatif des détections trouvées sur votre station ~ MSI: 0 link(s) detected in 00mn 00s ~ 1234 Legitimates filtered by white list End of the scan (454 lines in 01mn 23s)(0)