~ Rapport de ZHPDiag v2015.3.23.32 - Nicolas Coolman  (23/03/2015)
~ Lancé par moncef (26/03/2015 11:39:03)
~ Facebook : https://www.facebook.com/nicolascoolman1
~ Adresse du Forum http://forum.nicolascoolman.fr
~ Traduit par Nicolas Coolman
~ Etat de la version : Version à jour.
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by program


---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.17690
MFIE: Mozilla Firefox 36.0.4 (Defaut)
OBIE: Safari v5.34.57.2

---\\ Informations sur les produits Windows
~ Langage: Français
Windows Server License Manager Script : OK
~ Windows(R) Operating System, OEM_DM channel
Windows ID Activation : OK
~ Windows Partial Key : BKKF3
Windows License : OK
~ Windows Remaining Initializations Number : 998
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
Windows 8.1, 64-bit  (Build 9600)

---\\ Logiciels de protection du système
Avast Internet Security v10.2.2214
Windows Defender W8 (Deactivate)

---\\ Logiciels d'optimisation du système
CCleaner v5.01

---\\ Logiciels de partage PeerToPeer

---\\ Surveillance de Logiciels
Adobe Flash Player 17 NPAPI

---\\ Informations sur le système
~ Processor: AMD64 Family 21 Model 19 Stepping 1, AuthenticAMD
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 7604 MB (66% free)
System Restore: Activé (Enable)
System drive C: has 1749 GB (94%) free of 1849 GB

---\\ Mode de connexion au système
~ Computer Name: PCDEMONCEF
~ User Name: moncef
~ All Users Names: moncef, Administrateur, 
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\moncef\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\moncef\AppData\Roaming\
~ %Desktop% : C:\Users\moncef\Desktop\
~ %Favorites% : C:\Users\moncef\Favorites\
~ %LocalAppData% : C:\Users\moncef\AppData\Local\
~ %StartMenu% : C:\Users\moncef\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 1749 Go of 1849 Go)
D: Hard drive, Flash drive, Thumb drive (Free 2 Go of 13 Go)
E: CD-ROM drive (Not Inserted)



---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 49 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.C10A66189DC8C090E7C84873EDCEBC88] - (.Microsoft Corporation - Explorateur Windows.) (.28/01/2015 - 00:47:12.) -- C:\Windows\Explorer.exe [2501368]
[MD5.A570A64292214C43E0BA50E6A72A6380] - (.Microsoft Corporation - Application de démarrage de Windows.) (.29/10/2014 - 02:25:54.) -- C:\Windows\System32\Wininit.exe [145920]
[MD5.36F99BD8A0F09BDBB7850A138845A014] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.20/02/2015 - 02:28:25.) -- C:\Windows\System32\wininet.dll [2358784]
[MD5.EC498BAE1F0D3E0E401C963F8D76C437] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.29/10/2014 - 02:22:52.) -- C:\Windows\System32\Winlogon.exe [572416]
[MD5.AFCAB4DC692CCE37E283B00E2D7B438F] - (.Microsoft Corporation - Bibliothèque de licences.) (.18/03/2014 - 16:40:32.) -- C:\Windows\System32\sppcomapi.dll [447488]
[MD5.374E27295F0A9DCAA8FC96370F9BEEA5] - (.Microsoft Corporation - Pilote de fonction connexe pour WinSock.) (.30/05/2014 - 04:03:03.) -- C:\Windows\system32\Drivers\AFD.sys [563200]
[MD5.74B14192CF79A72F7536B27CB8814FBD] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.22/08/2013 - 13:43:41.) -- C:\Windows\system32\Drivers\atapi.sys [26464]
[MD5.2FA6510E33F7DEFEC03658B74101A9B9] - (.Microsoft Corporation - CD-ROM File System Driver.) (.22/08/2013 - 12:40:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [88576]
[MD5.C6796EA22B513E3457514D92DCDB1A3D] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.22/08/2013 - 09:46:35.) -- C:\Windows\system32\Drivers\Cdrom.sys [164352]
[MD5.A03F362C5557E238CBFA914689C77248] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.06/03/2014 - 10:22:50.) -- C:\Windows\system32\Drivers\DfsC.sys [134144]
[MD5.D4B7ED39C7900384D9E5C1283F1E7926] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.24/07/2014 - 12:45:39.) -- C:\Windows\system32\Drivers\HDAudBus.sys [76800]
[MD5.49EE0AE9E5B64FFBBD06D55C4984B598] - (.Microsoft Corporation - Pilote de port i8042.) (.04/11/2014 - 07:54:54.) -- C:\Windows\system32\Drivers\i8042prt.sys [108544]
[MD5.B7342B3C58E91107F6E946A93D9D4EFD] - (.Microsoft Corporation - IP Network Address Translator.) (.18/03/2014 - 16:40:35.) -- C:\Windows\system32\Drivers\IpNat.sys [142848]
[MD5.31233271EDE50D1BBB220F78AFA60486] - (.Microsoft Corporation - Minirdr SMB Windows NT.) (.08/10/2014 - 08:32:10.) -- C:\Windows\system32\Drivers\MRxSmb.sys [405504]
[MD5.0217532E19A748F0E5D569307363D5FD] - (.Microsoft Corporation - MBT Transport driver.) (.22/08/2013 - 12:37:02.) -- C:\Windows\system32\Drivers\netBT.sys [282624]
[MD5.7F68063A5A0461E02BC860CE0E6BFDDC] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.15/10/2014 - 09:32:37.) -- C:\Windows\system32\Drivers\ntfs.sys [2025792]
[MD5.764B1121867B2D9B31C491668AC72B2B] - (.Microsoft Corporation - Pilote de port parallèle.) (.22/08/2013 - 12:40:02.) -- C:\Windows\system32\Drivers\Parport.sys [94208]
[MD5.1BD3022FD6E450B00DE560265638FD2A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.08/11/2014 - 04:58:31.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [112640]
[MD5.680C1DAE268B6FB67FA21B389A8B79EF] - (.Microsoft Corporation - Redirecteur de périphérique de Microsoft RDP.) (.18/03/2014 - 16:09:07.) -- C:\Windows\system32\Drivers\rdpdr.sys [195584]
[MD5.FFF28F9F6823EB1756C60F1649560BBF] - (.Microsoft Corporation - TDI Translation Driver.) (.22/08/2013 - 14:25:35.) -- C:\Windows\system32\Drivers\tdx.sys [107520]
[MD5.64CA2B4A49A8EAF495E435623ECCE7DB] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.19/06/2014 - 03:13:36.) -- C:\Windows\system32\Drivers\volsnap.sys [310080]
~ Generic Processes:  Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 2/624
~ Mes musiques (My Musics) : 1/13
~ Mes Videos (My Videos) : 1/6
~ Mes Favoris (My Favorites) : 1/72
~ Mes Documents (My Documents) : 1/33028
~ Mon Bureau (My Desktop) : 1/21070
~ Menu demarrer (Programs) : 1/78
~ Hidden Files:  Scanned in 00mn 03s



---\\ Processus lancés
[MD5.938FA6F63B210FB8EF5A7B2FC1229431] - (.Avast Software s.r.o. - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastui.exe   [5511352] [PID.4748]
[MD5.EF6B4B38332C4EB7B74C0A1CB7094E83] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe   [8188928] [PID.6364]
~ Processes Running:  Scanned in 00mn 01s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions  (P2,M0,M1,M2,M3)
C:\Users\moncef\AppData\Roaming\Mozilla\Firefox\Profiles\iUrF1jIe.default\prefs.js (.not file.)
C:\Users\moncef\AppData\Roaming\Mozilla\Firefox\Profiles\mfttcv8d.default-1417345662966\prefs.js
M2 - MFEP: prefs.js [moncef - iUrF1jIe.default\abs@avira.com] [] Segurança do navegador Avira v1.4.3 (..)
M2 - MFEP: prefs.js [moncef - mfttcv8d.default-1417345662966\abs@avira.com] [] Segurança do navegador Avira v1.4.5 (..)
~ Firefox Browser: 9 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs,Tabs = about:newtab
~ IE Browser: 15 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management:  Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\windows\System32\Userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys:  Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (21)
~ Hosts File:  Scanned in 00mn 00s



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
~ Toolbar:  Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [moncef]: SpyHunter.lnk . (...)  -- C:\Program Files (x86)\Enigma Software Group\SpyHunter\SpyHunter4.exe (.not file.)  =>PUP.EnigmaSoftware
~ Global Startup: 1 Legitimates Filtered in 00mn 01s



---\\ Applications lancées au démarrage du système (O4)
O4 - HKLM\..\Run: [BeatsOSDApp] . (.Hewlett-Packard - HP Beats.) -- C:\Program Files\IDT\WDM\beats64.exe 
O4 - HKLM\..\Run: [SysTrayApp] . (.IDT, Inc. - IDT PC Audio.) -- C:\Program Files\IDT\WDM\sttray64.exe 
O4 - HKLM\..\Run: [SimplePass] . (.Hewlett-Packard - HP SimplePass Application.) -- C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe 
O4 - HKLM\..\Run: [OPBHOBroker] . (.Hewlett-Packard - HP SimplePass BHO Broker.) -- C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe 
O4 - HKLM\..\Run: [OPBHOBrokerDesktop] . (.Hewlett-Packard - HP SimplePass BHO Broker.) -- C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe 
O4 - HKLM\..\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe 
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] . (.Adobe Systems Incorporated - Adobe Updater Startup Utility.) -- C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe   =>.Adobe Systems Incorporated
O4 - HKCU\..\Run: [ScreenSplitter] . (.LG Electronics - Screen Split.) -- C:\Program Files (x86)\LG Electronics\Screen Split\bin\ScreenSplit.exe 
O4 - HKCU\..\Run: [HP ENVY 4500 series (NET)] . (.Hewlett-Packard Co. - ScanToPCActivationApp.) -- C:\Program Files\HP\HP ENVY 4500 series\Bin\ScanToPCActivationApp.exe   =>.Hewlett-Packard Co
O4 - HKCU\..\Run: [CCleaner Monitoring] . (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner64.exe   =>.Piriform Ltd
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe   =>.Skype Technologies S.A.
O4 - HKCU\..\Run: [Logitech Vid] . (.Logitech Inc. - Logitech Vid.) -- C:\Program Files (x86)\Logitech\Logitech Vid\vid.exe 
O4 - HKCU\..\Run: [iCloudServices] . (.Apple Inc. - iCloud.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe 
O4 - HKLM\..\Wow6432Node\Run: [LogitechQuickCamRibbon] . (...) -- C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe   =>.Logitech Inc
O4 - HKLM\..\Wow6432Node\Run: [ChicoSys] . (.Salfeld Computer - Salfeld Security Software Timer.) -- C:\windows\SysWOW64\cc32\webtmr.exe 
O4 - HKLM\..\Wow6432Node\Run: [AvastUI.exe] . (.Avast Software s.r.o. - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe 
O4 - HKUS\S-1-5-21-3960175300-3727063756-4143751807-1001\..\Run: [ScreenSplitter] . (.LG Electronics - Screen Split.) -- C:\Program Files (x86)\LG Electronics\Screen Split\bin\ScreenSplit.exe 
O4 - HKUS\S-1-5-21-3960175300-3727063756-4143751807-1001\..\Run: [HP ENVY 4500 series (NET)] . (.Hewlett-Packard Co. - ScanToPCActivationApp.) -- C:\Program Files\HP\HP ENVY 4500 series\Bin\ScanToPCActivationApp.exe   =>.Hewlett-Packard Co
O4 - HKUS\S-1-5-21-3960175300-3727063756-4143751807-1001\..\Run: [CCleaner Monitoring] . (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner64.exe   =>.Piriform Ltd
O4 - HKUS\S-1-5-21-3960175300-3727063756-4143751807-1001\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe   =>.Skype Technologies S.A.
O4 - HKUS\S-1-5-21-3960175300-3727063756-4143751807-1001\..\Run: [Logitech Vid] . (.Logitech Inc. - Logitech Vid.) -- C:\Program Files (x86)\Logitech\Logitech Vid\vid.exe 
O4 - HKUS\S-1-5-21-3960175300-3727063756-4143751807-1001\..\Run: [iCloudServices] . (.Apple Inc. - iCloud.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe 
~ Application:  Scanned in 00mn 00s



---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: @C:\Program Files (x86)\Evernote\Evernote\OLIEResource.dll,-101 [64Bits] - {A95fe080-8f5d-11d2-a20b-00aa003c157a} . (.Evernote Corp., 305 Walnut Street, Redwood - Evernote Clipper for Microsoft Internet Explorer.) -- C:\Program Files (x86)\Evernote\Evernote\EvernoteIEx64.dll
~ IE Extra Buttons:  Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{9163D2DA-CE7F-40D2-8FB1-886643B8F041}: DhcpNameServer = 212.27.40.241 212.27.40.240
O17 - HKLM\System\CS1\Services\Tcpip\..\{9163D2DA-CE7F-40D2-8FB1-886643B8F041}: DhcpNameServer = 212.27.40.241 212.27.40.240
~ Domain:  Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll  =>.Microsoft Corporation
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll  =>.Microsoft Corporation
~ Protocole Additionnel:  Scanned in 00mn 00s



---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [Run RoboForm TaskBar Icon] (...) -- C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (.not file.)   [0]
[MD5.00000000000000000000000000000000] [APT] [{3CAC3013-6EF6-4466-8238-AB6C6932EF26}] (...) -- C:\Users\moncef\AppData\Roaming\webssearches\UninstallManager.exe (.not file.)   [0]  =>Hijacker.WebsSearches
[MD5.00000000000000000000000000000000] [APT] [{A9308F85-E0E1-47E2-A566-61A5C016C62A}] (...) -- C:\Users\moncef\AppData\Roaming\sweet-page\UninstallManager.exe (.not file.)   [0]  =>PUP.SweetPage
[MD5.00000000000000000000000000000000] [APT] [{F6ED3602-20C3-4C05-B278-B81F738AECE0}] (...) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\unins000.exe (.not file.)   [0]
O39 - APT:  - (..) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater   [1002]
O39 - APT:  - (..) -- C:\Windows\Tasks\ASC8_SkipUac_moncef.job   [266]
O39 - APT:  - (..) -- C:\Windows\System32\Tasks\ASC8_SkipUac_moncef   [266]
O39 - APT:  - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore   [1086]
O39 - APT:  - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA   [1090]
O39 - APT:  - (..) -- C:\Windows\System32\Tasks\HP Photo Creations Communicator   [362]
O39 - APT:  - (..) -- C:\Windows\System32\Tasks\HPCeeScheduleFormoncef   [358]
~ Scheduled Task: 67 Legitimates Filtered in 00mn 07s



---\\ Pilotes lancés au démarrage du système (O41)
O41 - Driver:  (HWiNFO32) . (.REALiX(tm) - HWiNFO AMD64 Kernel Driver.) - C:\windows\sysWOW64\drivers\HWiNFO64A.sys
~ Drivers: 46 Legitimates Filtered in 00mn 00s



---\\ Logiciels installés (O42)
O42 - Logiciel: Free Internet Speed up Lite 4.3.0.24 - (.SOFTWAREDEPO.COM.) [HKLM][64Bits] -- Free Internet Speed up Lite_is1
~ Logic: 4 Legitimates Filtered in 00mn 00s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\Clubic]
[HKCU\Software\DefaultCompany]
[HKCU\Software\Free Internet Speed up Lite]
[HKCU\Software\PMU]
[HKCU\Software\ProductSetup]  =>Adware.InstallCore
[HKCU\Software\SmileFiles]  =>PUP.SmileFiles
[HKCU\Software\Toocharger]
[HKLM\Software\Wow6432Node\ADSRemoval]
[HKLM\Software\Wow6432Node\LGUACAPPCOUNT]
[HKLM\Software\Wow6432Node\QustodioInstaller]
~ Key Software: 295 Legitimates Filtered in 00mn 00s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 07/03/2015 - 14:57:44 - [] ----D C:\Program Files (x86)\EcoLotofootSha
O43 - CFD: 02/03/2015 - 14:15:29 - [] ----D C:\Program Files (x86)\Qustodio
O43 - CFD: 02/03/2015 - 13:50:24 - [] ----D C:\Program Files (x86)\Salfeld
O43 - CFD: 02/03/2015 - 13:50:35 - [] ----D C:\Program Files (x86)\Common Files\System Shared
O43 - CFD: 02/03/2015 - 12:39:11 - [] ----D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
O43 - CFD: 23/03/2015 - 09:50:24 - [] ----D C:\ProgramData\ProductData
O43 - CFD: 02/03/2015 - 14:42:20 - [] ----D C:\ProgramData\qustodio
O43 - CFD: 26/11/2014 - 18:16:12 - [] ----D C:\ProgramData\SUPPORTDIR
O43 - CFD: 04/02/2015 - 09:15:03 - [0] ----D C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}
O43 - CFD: 02/08/2014 - 05:08:26 - [] ----D C:\ProgramData\{C19CA186-4F06-4E22-A1E6-6BAB4723A0DE}
O43 - CFD: 12/12/2014 - 10:12:21 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
O43 - CFD: 26/11/2014 - 12:14:14 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Music, Photos and Videos
O43 - CFD: 28/11/2014 - 17:24:50 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Productivity and Tools
O43 - CFD: 29/09/2014 - 08:59:04 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Screen Split
O43 - CFD: 19/10/2014 - 10:16:50 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security and Protection
O43 - CFD: 02/08/2014 - 05:25:55 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SecurityandProtection
O43 - CFD: 18/03/2014 - 16:09:16 - [0] R-H-D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC
O43 - CFD: 23/12/2014 - 11:05:24 - [] ----D C:\Users\moncef\AppData\Roaming\driver
O43 - CFD: 03/01/2015 - 21:23:15 - [] ----D C:\Users\moncef\AppData\Roaming\Mediatronic
O43 - CFD: 14/12/2014 - 14:40:51 - [] ----D C:\Users\moncef\AppData\Roaming\PMU
O43 - CFD: 06/02/2015 - 17:15:43 - [] ----D C:\Users\moncef\AppData\Roaming\ProductData
O43 - CFD: 30/11/2014 - 11:16:11 - [] ----D C:\Users\moncef\AppData\Roaming\{37E99E86-D615-4B08-937F-F8F935C455F3}_ANZHUANG
O43 - CFD: 29/12/2014 - 00:15:05 - [] ----D C:\Users\moncef\AppData\Local\28512
O43 - CFD: 20/12/2014 - 15:36:14 - [] ----D C:\Users\moncef\AppData\Local\Canal.MyCanal
O43 - CFD: 21/11/2014 - 13:13:24 - [] -SH-D C:\Users\moncef\AppData\Local\EmieBrowserModeList
O43 - CFD: 12/12/2014 - 11:12:13 - [] ----D C:\Users\moncef\AppData\Local\F79C8880-A611-48D6-B5DE-A5FA90B4807A.aplzod
O43 - CFD: 26/03/2015 - 11:08:23 - [] ----D C:\Users\moncef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter  =>Crapware.SpyHunter
~ Program Folder: 258 Legitimates Filtered in 00mn 01s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.BA4B999D245287608A79C92CDAE6F3C1] - 21/03/2015 - 00:08:58 ---A- . (...) -- C:\Windows\System32\Drivers\aswHwid.sys   [29168]
O44 - LFC:[MD5.FCD6BCB56C1689FCEF28B57C22475BAD] - 25/03/2015 - 18:31:49 ---A- . (...) -- C:\Windows\System32\spu_storage.bin   [65536]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 26/03/2015 - 09:06:35 ---A- . (...) -- C:\Windows\System32\Drivers\lvuvc.hs   [0]
O44 - LFC:[MD5.3B32CAA07D672F8A2E0DF5CB3A873F45] - 26/03/2015 - 11:08:27 ---A- . (...) -- C:\Windows\System32\Drivers\EsgScanner.sys   [22704]
~ Files: 37 Legitimates Filtered in 00mn 04s



---\\ Déni du service (Local Security Authority) (O48)
~ LSA: 3 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 18 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 6 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:11/03/2014 - 15:19:46 ---A- . (.Windows (R) Win 7 DDK provider - KSL Kernel-Mode Dll.) -- C:\Windows\System32\Drivers\amdacpksl.sys   [142848]
O58 - SDL:21/03/2015 - 00:08:58 ---A- . (...) -- C:\Windows\System32\Drivers\aswHwid.sys   [29168]  =>.ALWIL Software
O58 - SDL:21/03/2015 - 00:08:59 ---A- . (...) -- C:\Windows\System32\Drivers\aswRvrt.sys   [65736]  =>.ALWIL Software
O58 - SDL:21/03/2015 - 00:08:59 ---A- . (...) -- C:\Windows\System32\Drivers\aswVmm.sys   [268640]  =>.ALWIL Software
O58 - SDL:13/08/2013 - 00:25:46 ---A- . (.Windows (R) Win 7 DDK provider - BCM Function 2  Device Driver.) -- C:\Windows\System32\Drivers\bcmfn2.sys   [17624]
O58 - SDL:29/05/2012 - 14:53:30 ---A- . (.Windows (R) Codename Longhorn DDK provider - hpvhd 64bit support driver.) -- C:\Windows\System32\Drivers\cpqdfw.sys   [27456]
O58 - SDL:19/10/2012 - 04:52:32 ---A- . (.Windows (R) Win 7 DDK provider - IEEE-1284.4-1999 Driver.) -- C:\Windows\System32\Drivers\Dot4.sys   [151968]
O58 - SDL:19/10/2012 - 04:52:30 ---A- . (.Windows (R) Win 7 DDK provider - IEEE-1284.4 Print Class Driver.) -- C:\Windows\System32\Drivers\Dot4Prt.sys   [27040]
O58 - SDL:22/06/2012 - 12:01:32 ---A- . (...) -- C:\Windows\System32\Drivers\EsgScanner.sys   [22704]
O58 - SDL:07/10/2009 - 01:45:50 ---A- . (...) -- C:\Windows\System32\Drivers\LVPr2M64.sys   [30232]
O58 - SDL:01/03/2013 - 02:49:12 ---A- . (.Riverbed Technology, Inc. - npf.sys (NT5/6 AMD64) Kernel Driver.) -- C:\Windows\System32\Drivers\npf.sys   [36600]
O58 - SDL:16/06/2014 - 07:01:38 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG USB Composite Device Driver (MSS Ver.3).) -- C:\Windows\System32\Drivers\ssudbus.sys   [110336]
O58 - SDL:16/06/2014 - 07:01:38 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG Android Modem Device Driver (MSS Ver.3).) -- C:\Windows\System32\Drivers\ssudmdm.sys   [206080]
O58 - SDL:22/08/2013 - 13:43:32 ---A- . (.Promise Technology, Inc. - Promise SuperTrak EX Series Driver for Windows x64.) -- C:\Windows\System32\Drivers\stexstor.sys   [31072]
O58 - SDL:07/01/2014 - 17:29:40 ---A- . (.IDT, Inc. - IDT PC Audio.) -- C:\Windows\System32\Drivers\stwrt64.sys   [551936]
O58 - SDL:19/01/2015 - 15:54:24 ---A- . (...) -- C:\Windows\System32\Drivers\TrueSight.sys   [35064]
O58 - SDL:28/07/2014 - 13:52:00 ---A- . (.Apple, Inc. - Apple Mobile Device USB Driver.) -- C:\Windows\System32\Drivers\usbaapl64.sys   [54784]
O58 - SDL:04/02/2015 - 09:15:20 ---A- . (.REALiX(tm) - HWiNFO AMD64 Kernel Driver.) -- C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS   [26528]
~ Drivers: 75 Legitimates Filtered in 00mn 02s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2015 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1  =>.Nicolas Coolman
~ ADS:  Scanned in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (...) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: <Safari.exe> <Safari>[HKLM\..\Shell\open\Command] (.Apple Inc. - Safari.) -- C:\Program Files (x86)\Safari\Safari.exe
~ Keys:  Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {BE7DB652-1B39-4A2A-9311-63F38B1426EC} - (Google) - http://www.google.com
~ Keys:  Scanned in 00mn 00s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.2A0502DF39C2FEAF53CE6C82F3442BD1] [SPRF][10/02/2015] (...) -- C:\ProgramData\ntuser.dat   [262144]
~ Files: 1 Legitimates Filtered in 00mn 00s



---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "5C9F59CB830AEE547A93698B6A7DF9D7" . (.Boxore Client.) -- C:\windows\Installer\{BC95F9C5-A038-45EE-A739-96B8A6D79F7D}\Boxore.ico  =>Adware.Boxore
~ Update Products: 1 Legitimates Filtered in 00mn 00s



---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.854A87AFC88107DD499487FD6291611F] [WIS][02/03/2015] (.The Software Group - Software Update Helper.) -- C:\Windows\Installer\cee4dc.msi   [45056]  =>Adware.Boxore
[MD5.05CD03200A151D8103BBD65C02EB3937] [WIS][02/03/2015] (.Boxore OU - Boxore Client Installer.) -- C:\Windows\Installer\cee4e1.msi   [5152768]  =>Adware.Boxore
~ WIS: 2 Legitimates Filtered in 00mn 01s



---\\ Recherche de clés de registre CLSID (O101)
[HKCR\CLSID\{320AF880-6646-11D3-ABEE-C5DBF3571F49}] (SavePass)  =>PUP.CrossRider
~ BCK: 6418 Legitimates Filtered in 00mn 21s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 16/03/2015 268464 |  (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Auto 27/09/2014 116648 |  (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 27/09/2014 116648 |  (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 13/05/2013 1129760 |  (hpqwmiex) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
SS - | Demand 13/02/2015 643880 |  (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SS - | Demand 22/03/2015 148080 |  (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Demand 07/02/2014 88064 |  (omniserv) . (.Softex Inc..) - C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe
SS - | Disabled 02/01/2015 315488 |  (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Demand 07/01/2014 340480 |  (STacSV) . (.IDT, Inc..) - C:\Program Files\IDT\WDM\STacSV64.exe
SS - | Disabled 22/07/1658 0 |  (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe  =>.Microsoft Corporation
SS - | Demand 29/10/2014 38792 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 20/06/2014 240128 |  (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 15/04/2014 344064 |  (AMD FUEL Service) . (.Advanced Micro Devices, Inc..) - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
SR - | Auto 19/01/2015 77128 |  (Apple Mobile Device Service) . (.Apple Inc..) - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 21/03/2015 343336 |  (avast! Antivirus) . (.Avast Software s.r.o..) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SR - | Auto 21/03/2015 107448 |  (avast! Firewall) . (.Avast Software s.r.o..) - C:\Program Files\AVAST Software\Avast\afwServ.exe
SR - | Auto 30/08/2011 462184 |  (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Auto 13/01/2014 92160 |  (HP Support Assistant Service) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe  =>.Hewlett-Packard Co
SR - | Auto 16/01/2015 2724128 |  (LiveUpdateSvc) . (.IObit.) - C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe
SR - | Auto 07/10/2009 191000 |  (LVPrcS64) . (.Logitech Inc..) - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
SR - | Auto 08/01/2014 254512 |  (RichVideo) . (...) - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
SR - | Demand 22/07/1658 0 |  (WdNisSvc) . (...) - C:\Program Files (x86)\Windows Defender\NisSrv.exe
SR - | Demand 22/07/1658 0 |  (WinDefend) . (...) - C:\Program Files (x86)\Windows Defender\MsMpEng.exe
~ Services:  Scanned in 00mn 22s



---\\ Scan Additionnel (O88)
Database Version : 13008 - (23/03/2015)
Clés trouvées (Keys found) : 3
Valeurs trouvées (Values found) : 1
Dossiers trouvés  (Folders found) : 3
Fichiers trouvés  (Files found) : 5

[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0DA5D75B5B33B4B83724742699814F]   =>Adware.Boxore^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C506B89D971FBA3418F37674F3BC1244]   =>Adware.Boxore^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FEA78903E905F6C41BA2E3CC615507CA]   =>Adware.Boxore^
C:\Users\moncef\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter   =>Crapware.SpyHunter^
C:\Program Files (x86)\Software   =>Adware.Boxore
C:\Users\moncef\AppData\Local\Software   =>Adware.Boxore
[HKCU\Software\ProductSetup]   =>Adware.InstallCore^
[HKCU\Software\SmileFiles]   =>PUP.SmileFiles^
C:\Windows\Installer\cee4dc.msi   =>Adware.Boxore^
C:\Windows\Installer\cee4e1.msi   =>Adware.Boxore^
[HKCR\CLSID\{320AF880-6646-11D3-ABEE-C5DBF3571F49}] (SavePass)   =>PUP.CrossRider^
~ Additionnel Scan: 413327 Items scanned in 00mn 53s



---\\ Informations complémentaires sur les modules
~ http://nicolascoolman.fr/r5-internet-explorer-proxy-management-iepm/  =>.Internet Explorer, Proxy Management (R5)
~ http://nicolascoolman.fr/o3-internet-explorer-toolbars/  =>.Internet Explorer Toolbars (O3)
~ http://nicolascoolman.fr/o4-applications-demarrees-par-le-registre/  =>.Applications lancées au démarrage du système (O4)
~ AMI: 3 Legitimates Filtered in 00mn 00s



---\\ Récapitulatif des détections trouvées sur votre station
http://www.nicolascoolman.fr/blog/  =>PUP.EnigmaSoftware
http://nicolascoolman.fr/hijacker-webssearches  =>Hijacker.WebsSearches
http://nicolascoolman.fr/pup-sweetpage  =>PUP.SweetPage
http://nicolascoolman.fr/adware-installcore  =>Adware.InstallCore
http://www.nicolascoolman.fr/blog/  =>PUP.SmileFiles
http://nicolascoolman.fr/crapware-spyhunter  =>Crapware.SpyHunter
http://nicolascoolman.fr/adware-boxore  =>Adware.Boxore
http://nicolascoolman.fr/pup-crossrider  =>PUP.CrossRider
~ MSI: 8 link(s) detected in 00mn 00s



~ 837 Legitimates filtered by white list
End of the scan (467 lines in 03mn 10s)(0.10)