Publicité
Publicité
Format du document : text/plain
Prévisualisation
~ Rapport de ZHPDiag v2013.9.1.2 - Nicolas Coolman (01/09/2013)
~ Lanc� par Neochris (02/09/2013 11:45:12)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Traduit par Nicolas Coolman
~ Etat de la version : Version � jour.
~ Liste blanche : Activ�e par le programme
~ El�vation des Privil�ges : OK
~ User Account Control (UAC): Activate by user
---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16660
MFIE: Mozilla Firefox 5.0
GCIE: Google Chrome v29.0.1547.62 (Defaut)
---\\ Informations sur les produits Windows
~ Langage: Fran�ais
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 7QJB7
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ Logiciels de protection du syst�me
avast! Free Antivirus v8.0.1489.0
Spybot - Search & Destroy v1.6.2
Windows Defender W7
---\\ Logiciels d'optimisation du syst�me
CCleaner v3.06 =>Piriform Ltd
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 11 Plugin
Adobe Reader XI
Java 7 Update 25
---\\ Informations sur le syst�me
~ Processor: AMD64 Family 16 Model 6 Stepping 3, AuthenticAMD
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 4095 MB (39% free)
System Restore: Activ� (Enable)
System drive C: has 232 GB (33%) free of 689 GB
---\\ Mode de connexion au syst�me
~ Computer Name: NEOCHRIS-PC
~ User Name: Neochris
~ All Users Names: UpdatusUser, Neochris, HomeGroupUser$, Administrateur,
~ Unselected Option: None
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppData% : C:\Users\Neochris\AppData\Roaming\
~ %Desktop% : C:\Users\Neochris\Desktop\
~ %Favorites% : C:\Users\Neochris\Favorites\
~ %LocalAppData% : C:\Users\Neochris\AppData\Local\
~ %StartMenu% : C:\Users\Neochris\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enum�ration des unit�s disques
C:\ Hard drive, Flash drive, Thumb drive (Free 232 Go of 689 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 468 Go of 690 Go)
E:\ CD-ROM drive (Not Inserted)
F:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
G:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
H:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
I:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
J:\ CD-ROM drive (Free 0 Go of 7 Go)
Q:\ Hard drive, Flash drive, Thumb drive (Free 0 Go of 0 Go)
---\\ Etat du Centre de S�curit� Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 29 Legitimates Filtered in 00mn 00s
---\\ Recherche particuli�re de fichiers g�n�riques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de d�marrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.AC155DD9BD1E6D3B740826A4D1C68AAE] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.26/07/2013 - 06:13:37.) -- C:\Windows\System32\wininet.dll [2241024]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d�ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Biblioth�que de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.1C7857B62DE5994A75B054A9FD4C3825] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/12/2011 - 04:59:24.) -- C:\Windows\system32\Drivers\AFD.sys [498688]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du syst�me de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parall�le.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de clich� instantan� du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s
---\\ Etat des fichiers cach�s (Cach�/Total)
~ Mes images (My Pictures) : 2/2163
~ Mes musiques (My Musics) : 8/2428
~ Mes Videos (My Videos) : 2/72
~ Mes Favoris (My Favorites) : 1/33
~ Mes Documents (My Documents) : 3/1869
~ Mon Bureau (My Desktop) : 1/9
~ Menu demarrer (Programs) : 1/66
~ Hidden Files: Scanned in 00mn 01s
---\\ Processus lanc�s au d�marrage du syst�me
[MD5.896A1DB9A972AD2339C2E8569EC926D1] - (.Safer Networking Limited - System settings protector.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088] [PID.1632]
[MD5.CEA0461AAE4B8B6216F164501B1B5A10] - (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [4910912] [PID.2700]
[MD5.C156DE6EB37B6C5D6498DD87C23F3FA4] - (.SFR - Mediacenter Evolution.) -- C:\Program Files (x86)\SFR\Mediacenter Evolution\MediaCenter.exe [2688368] [PID.4272]
[MD5.DD9EAE1C80561C509A8B8801E16BAA38] - (.Spotify Ltd - SpotifyWebHelper.) -- C:\Users\Neochris\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384] [PID.4288]
[MD5.D8A15B5A7ABD230ECBF9BF02FDF70871] - (.Pas de propri�taire - Hotkey Utility.) -- C:\Program Files (x86)\Packard Bell\Hotkey Utility\HotkeyUtility.exe [613992] [PID.4644]
[MD5.3F11B20D12D89365D7721BDC860CE5F0] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe [4858968] [PID.4652]
[MD5.F7E1CCBAD109329203AACB1E87BE614C] - (.Dropbox, Inc. - Dropbox.) -- C:\Users\Neochris\AppData\Roaming\Dropbox\bin\Dropbox.exe [27776968] [PID.4700]
[MD5.A7810B302294793DE88542AAE177D1B1] - (.ArcSoft Inc. - ArcSoft Connect Daemon.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424] [PID.4732]
[MD5.D63797E8E7781EE1500A810CB6194FA6] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816] [PID.4896]
[MD5.749949494676218FFA99501F4AA22ECC] - (.OpenOffice.org - OpenOffice.org 3.4.1.) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe [10376704] [PID.4636]
[MD5.4EE367B8B1964160A1F1B80095183D3A] - (.OpenOffice.org - OpenOffice.org 3.4.1.) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin [10368512] [PID.5072]
[MD5.8E436BD0D9C2CB57306070DFEA3D4513] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [829392] [PID.9900]
[MD5.68825D489DE0DC71FF3A62D6452684BA] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [7860224] [PID.10920]
[MD5.5A19667A580B1CE886EAF968B9743F45] - (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [383264] [PID.868]
[MD5.28D6701C710AD7BA3CB95E75F8F1A9AA] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808] [PID.1204]
[MD5.ADC420616C501B45D26C0FD3EF1E54E4] - (.ArcSoft Inc. - ArcSoft Connect Service.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152] [PID.1740]
[MD5.ADDA5E1951B90D3D23C56D3CF0622ADC] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65640] [PID.1764]
[MD5.0191DEE9B9EB7902AF2CF4F67301095D] - (.Acer Incorporated - Global Registration Service.) -- C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [23584] [PID.1904]
[MD5.FD062B4259B5D0599D4A649922D3FF02] - (.SoftwareForMe Inc - PhoneMyPC.) -- C:\Program Files\SoftwareForMe Inc\PhoneMyPC\PhoneMyPC.exe [128512] [PID.1676]
[MD5.C3CDDD18F43D44AB713CF8C4916F7696] - (.Microsoft Corporation - Microsoft Application Virtualization Virtua.) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [219496] [PID.2056]
[MD5.F9EC9ACD504D823D9B9CA98A4F8D3CA2] - (.Acer Group - Updater Service.) -- C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [243232] [PID.2784]
[MD5.13693B6354DD6E72DC5131DA7D764B90] - (.Microsoft Corporation - Microsoft Application Virtualization Client.) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [508776] [PID.2152]
[MD5.72794D112CBAFF3BC0C29BF7350D4741] - (.Microsoft Corporation - Microsoft Office Client Virtualization Serv.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.exe [822624] [PID.3648]
[MD5.FF10288C714E2FC35E8D84443DF58B7F] - (.Samsung - AllShareFrameworkDMS.) -- C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\AllShareFrameworkDMS.exe [755080] [PID.4848]
~ Processes Running: Scanned in 00mn 01s
---\\ Google Chrome, D�marrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Neochris\AppData\Local\Google\Chrome\User Data\Default\Preferences
G0 - GCSP: Preference [User Data\Default][HomePage] http://google.com
G2 - GCE: Preference [User Data\Default] [gaiilaahiahdejapggenmdmafpmbipje] DealPly v.3.0.7.2 (D�sactiv�) =>PUP.DealPly
G2 - GCE: Preference [User Data\Default] [gdlgbpbmiiagaikjbednkikinokbkbcb] Color My Facebook v.1.23.215 (Activ�)
G2 - GCE: Preference [User Data\Default] [iibmmjhgclhlahmjniokmhleigemjpbh] express-files v.10.14.370.24 (D�sactiv�) =>Adware.ExpressFiles
G2 - GCE: Preference [User Data\Default] [jpihmmhdcobmllpcnpfbhnipmhamldje] General Crawler v.2.0 (D�sactiv�) =>PUP.MediaFinder
G2 - GCE: Preference [User Data\Default] [mfjkgbjaikamkkojmakjclmkianficch] Download Assistant v.5.0.2 (Activ�)
G2 - GCE: Preference [User Data\Default] [mpfapcdfbbledbojijcbcclmlieaoogk] I Want This v.1.17.57 (D�sactiv�)
~ Google Browser: 21 Legitimates Filtered in 00mn 12s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Neochris\AppData\Roaming\Mozilla\Firefox\Profiles\kzlni9ol.default\prefs.js
M2 - MFEP: prefs.js [Neochris - kzlni9ol.default\@FissaPlugin] [] Fissa v1.0 (..) =>PUP.OfferBox
M2 - MFEP: prefs.js [Neochris - kzlni9ol.default\crossriderapp2258@crossrider.com] [] I Want This v1.0 (..) =>PUP.CrossRider
M2 - MFEP: prefs.js [Neochris - kzlni9ol.default\crossriderapp3847@crossrider.com] [] Color My Facebook v1.0 (..) =>PUP.CrossRider
~ Firefox Browser: 16 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: (no name) [64Bits] - [HKLM]{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} Cl� orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Applications d�marr�es par registre & par dossier (O4)
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
O4 - HKLM\..\Run: [Samsung Link] . (.Copyright 2013 SAMSUNG - Samsung Link Tray Agent.) -- C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] . (.Safer Networking Limited - System settings protector.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
O4 - HKCU\..\Run: [EPSON Stylus DX5000 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBVE.exe
O4 - HKCU\..\Run: [SFR Mediacenter] . (.SFR - Mediacenter Evolution.) -- C:\Program Files (x86)\SFR\Mediacenter Evolution\MediaCenter.exe
O4 - HKCU\..\Run: [Spotify Web Helper] . (.Spotify Ltd - SpotifyWebHelper.) -- C:\Users\Neochris\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
O4 - HKCU\..\Run: [Spotify] . (.Spotify Ltd - Spotify.) -- C:\Users\Neochris\AppData\Roaming\Spotify\Spotify.exe
O4 - HKCU\..\RunOnce: [SpUninstallDeleteDir] Cl� orpheline
O4 - HKLM\..\Wow6432Node\Run: [Hotkey Utility] . (.Pas de propri�taire - Hotkey Utility.) -- C:\Program Files (x86)\Packard Bell\Hotkey Utility\HotkeyUtility.exe
O4 - HKLM\..\Wow6432Node\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe
O4 - HKLM\..\Wow6432Node\Run: [ArcSoft Connection Service] . (.ArcSoft Inc. - ArcSoft Connect Daemon.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-21-3543433309-3597804886-3877114459-1000\..\Run: [SpybotSD TeaTimer] . (.Safer Networking Limited - System settings protector.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-21-3543433309-3597804886-3877114459-1000\..\Run: [DAEMON Tools Lite] . (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
O4 - HKUS\S-1-5-21-3543433309-3597804886-3877114459-1000\..\Run: [EPSON Stylus DX5000 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBVE.exe
O4 - HKUS\S-1-5-21-3543433309-3597804886-3877114459-1000\..\Run: [SFR Mediacenter] . (.SFR - Mediacenter Evolution.) -- C:\Program Files (x86)\SFR\Mediacenter Evolution\MediaCenter.exe
O4 - HKUS\S-1-5-21-3543433309-3597804886-3877114459-1000\..\Run: [Spotify Web Helper] . (.Spotify Ltd - SpotifyWebHelper.) -- C:\Users\Neochris\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
O4 - HKUS\S-1-5-21-3543433309-3597804886-3877114459-1000\..\Run: [Spotify] . (.Spotify Ltd - Spotify.) -- C:\Users\Neochris\AppData\Roaming\Spotify\Spotify.exe
O4 - HKUS\S-1-5-21-3543433309-3597804886-3877114459-1000\..\RunOnce: [SpUninstallDeleteDir] Cl� orpheline
~ Application: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\QuickLaunch: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Accessories: Private Character Editor.lnk . (.Microsoft Corporation - �diteur de caract�res priv�s.) -- C:\Windows\system32\eudcedit.exe
O4 - GS\SendTo: Fax Recipient.lnk . (.Microsoft Corporation - Microsoft Windows Fax and Scan.) -- C:\Windows\system32\WFS.exe
O4 - GS\Desktop: Installeur de World of Warcraft.lnk . (...) -- C:\Users\Public\Documents\Blizzard Entertainment\World of Warcraft Installer
O4 - GS\Desktop: PDF2Image v2.1.lnk . (...) -- C:\Program Files (x86)\VeryPDF PDF2Image v2.1\PDF2Image.exe (.not file.)
O4 - GS\Desktop: PhotoFiltre.lnk . (.Antonio Da Cruz - PhotoFiltre.) -- C:\Program Files (x86)\PhotoFiltre\PhotoFiltre.exe
O4 - GS\TaskBar: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\TaskBar: Welcome Center.lnk . (.Acer Incorporated - Welcome Center.) -- C:\Program Files (x86)\Packard Bell\Welcome Center\OEMWelcomeCenter.exe
O4 - GS\TaskBar: Windows Explorer.lnk . (.Microsoft Corporation - Explorateur Windows.) -- C:\Windows\explorer.exe
O4 - GS\TaskBar: Windows Media Player.lnk . (.Microsoft Corporation - Lecteur Windows Media.) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Programs: Spotify.lnk . (.Spotify Ltd - Spotify.) -- C:\Users\Neochris\AppData\Roaming\Spotify\spotify.exe
O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch: Packard Bell Games.lnk . (.WildTangent, Inc. - GameConsole.) -- C:\Program Files (x86)\Packard Bell Games\Packard Bell Game Console\GameConsole-wt.exe
O4 - GS\QuickLaunch: Spybot - Search & Destroy.lnk . (.Safer Networking Limited - Spybot - Search & Destroy.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SpybotSD.exe
O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SendTo: Dropbox.lnk . (...) -- C:\Users\Neochris\Dropbox
O4 - GS\SendTo: Transfert de fichiers Bluetooth.LNK . (.Microsoft Corporation - Pas de description.) -- C:\Windows\System32\fsquirt.exe
O4 - GS\SendTo: WinDirStat.lnk . (.Seifert - Windows Directory Statistics.) -- C:\Program Files (x86)\windirstat\windirstat.exe
O4 - GS\Desktop: 12 La grande sophie - Animal en quarantaine - Raccourci.lnk . (...) -- C:\Users\Neochris\Music\HFT\2002 Les fils du coupeur de joints\1 Les fils du coupeur de joints\12 La grande sophie - Animal en quarantaine.mp3
O4 - GS\Desktop: Cheat Engine.lnk . (...) -- C:\Program Files (x86)\Cheat Engine 6.1\Cheat Engine.exe
O4 - GS\Desktop: JDownloader.lnk . (.AppWork UG (haftungsbeschr�nkt) - JDownloader Launcher v3.) -- C:\Program Files (x86)\JDownloader\JDownloader.exe
O4 - GS\Desktop: Spotify.lnk . (.Spotify Ltd - Spotify.) -- C:\Users\Neochris\AppData\Roaming\Spotify\spotify.exe
O4 - GS\Desktop: Spybot - Search & Destroy.lnk . (.Safer Networking Limited - Spybot - Search & Destroy.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SpybotSD.exe
~ Global Startup: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{01A69E6D-C369-43B1-A6F0-B017817DB90F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{01A69E6D-C369-43B1-A6F0-B017817DB90F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{01A69E6D-C369-43B1-A6F0-B017817DB90F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s
---\\ Titr_HJT34=Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non d�sactiv�s (O23)
O23 - Service: PhoneMyPC_Helper (PhoneMyPC_Helper) . (.SoftwareForMe Inc - PhoneMyPC_Helper.) - C:\Program Files\SoftwareForMe Inc\PhoneMyPC\PhoneMyPC_Helper.exe
O23 - Service: Updater Service (Updater Service) . (.Acer Group - Updater Service.) - C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
~ Services: 16 Legitimates Filtered in 00mn 06s
---\\ T�ches planifi�es en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [Express FilesUpdate] (...) -- C:\Program Files (x86)\ExpressFiles\EFUpdater.exe (.not file.) [0] =>Adware.ExpressFiles
[MD5.00000000000000000000000000000000] [APT] [{70C74D0A-B64C-48B4-9031-657A179302A1}] (...) -- C:\Users\Neochris\Downloads\Setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{D556694A-ACC9-43D9-A049-DC778041B7A7}] (...) -- C:\Users\Neochris\Downloads\ParadiseBeachSetup.exe (.not file.) [0]
~ Scheduled Task: 16 Legitimates Filtered in 00mn 03s
---\\ Logiciels install�s (O42)
O42 - Logiciel: Cooking Dash 3 - Thrills and Spills - Collectors Edition - (.Aliasworlds Entertainment.) [HKLM][64Bits] -- Cooking Dash 3 - Thrills and Spills - Collectors Edition1.0.1.145
O42 - Logiciel: Hobby Farm - (...) [HKLM][64Bits] -- Hobby Farm
O42 - Logiciel: Joyeux chef - (.Alawar Entertainment Inc..) [HKLM][64Bits] -- Joyeux chef
O42 - Logiciel: Legends of Dawn - (...) [HKLM][64Bits] -- Legends of Dawn_is1
O42 - Logiciel: Multiskate - (...) [HKCU][64Bits] -- Multiskate
O42 - Logiciel: PhoneMyPC - (.SoftwareForMe Inc..) [HKLM][64Bits] -- {4B6CAE5A-1863-49CF-9F0E-CF8CFDFDADEE}
~ Logic: 194 Legitimates Filtered in 00mn 00s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\Akella]
[HKCU\Software\Whalebox Studio]
[HKLM\Software\Wow6432Node\CandleWorks]
[HKLM\Software\Wow6432Node\SweetIM] =>PUP.SweetIM
~ Key Software: 298 Legitimates Filtered in 00mn 00s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 27/01/2012 - 10:06:52 - [30,767] ----D C:\Program Files (x86)\Candleworks
O43 - CFD: 30/10/2012 - 13:11:38 - [86,908] ----D C:\Program Files (x86)\Cooking Dash 3 - Thrills and Spills - Collectors Edition
O43 - CFD: 10/08/2013 - 13:55:54 - [-652,108] ----D C:\Program Files (x86)\DreaMatrix
O43 - CFD: 12/08/2011 - 14:53:59 - [88,271] ----D C:\Program Files (x86)\Hobby Farm
O43 - CFD: 15/07/2011 - 11:56:28 - [0] ----D C:\Program Files (x86)\Jeux Chapelain
O43 - CFD: 21/12/2012 - 22:55:13 - [78,452] ----D C:\Program Files (x86)\La Brigade des Cuisiniers
O43 - CFD: 05/07/2011 - 16:27:11 - [100,286] ----D C:\Program Files (x86)\Paradise Beach
O43 - CFD: 11/09/2011 - 18:38:13 - [0,020] ----D C:\Program Files (x86)\PokerStars.FR
O43 - CFD: 07/11/2011 - 11:07:17 - [0,126] ----D C:\Program Files (x86)\Your Product
O43 - CFD: 31/01/2012 - 11:19:10 - [0] ----D C:\ProgramData\Egoset
O43 - CFD: 27/01/2012 - 10:06:57 - [13,699] --H-D C:\ProgramData\{60969585-BC44-4467-B939-0A78C09C06E9}
O43 - CFD: 04/10/2012 - 18:03:39 - [0,001] ----D C:\Users\Neochris\AppData\Roaming\#Hf
O43 - CFD: 10/08/2013 - 17:38:51 - [0,000] ----D C:\Users\Neochris\AppData\Roaming\Liam games
O43 - CFD: 15/08/2013 - 06:32:29 - [0,018] ----D C:\Users\Neochris\AppData\Roaming\Melesta
O43 - CFD: 09/08/2013 - 13:21:08 - [0,001] ----D C:\Users\Neochris\AppData\Roaming\PetStorePanic
O43 - CFD: 12/08/2011 - 14:54:41 - [0,119] ----D C:\Users\Neochris\AppData\Roaming\playmink
O43 - CFD: 24/06/2011 - 18:44:58 - [0,487] ----D C:\Users\Neochris\AppData\Local\PokerStars.FR
O43 - CFD: 04/02/2013 - 09:24:06 - [0] ----D C:\Users\Neochris\AppData\Local\Updater3847 =>PUP.CrossRider
O43 - CFD: 21/12/2012 - 22:55:07 - [0,002] ----D C:\Users\Neochris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\La Brigade des Cuisiniers
O43 - CFD: 05/07/2011 - 16:26:42 - [0,002] ----D C:\Users\Neochris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Paradise Beach
O43 - CFD: 27/01/2012 - 13:17:49 - [0,002] ----D C:\Users\Neochris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Your Product
~ 409 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 715 Legitimates Filtered in 00mn 09s
---\\ Derniers fichiers modifi�s ou cr�es sous Windows et System32 (O44)
O44 - LFC:[MD5.D1E75542EC8D1B4851765A57AC63618E] - 25/08/2013 - 16:58:55 ---A- . (...) -- C:\Windows\diagerr.xml [1908]
O44 - LFC:[MD5.68065F778B25B25FF6AA3889922B7E55] - 25/08/2013 - 16:58:55 ---A- . (...) -- C:\Windows\diagwrn.xml [2564]
~ Files: 16 Legitimates Filtered in 00mn 04s
---\\ Derniers fichiers cr��s dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.EF7441A4B9718142124E2BE099054D1A] - 01/09/2013 - 07:23:17 ---A- - C:\Windows\Prefetch\PMS.EXE-8E4C125F.pf
O45 - LFCP:[MD5.CEA380EF5BDE9AD678ADC7E8BE2EE4C2] - 02/09/2013 - 06:05:43 ---A- - C:\Windows\Prefetch\GETMAC.EXE-FE61CB22.pf
O45 - LFCP:[MD5.4ADB692A21F090CBF94560481375A37F] - 02/09/2013 - 06:06:28 ---A- - C:\Windows\Prefetch\YONTOODESKTOP.EXE-AB7A3F7B.pf =>Adware.Yontoo
O45 - LFCP:[MD5.0D9EBE493877C6C73D63380090833EB1] - 02/09/2013 - 09:45:36 ---A- - C:\Windows\Prefetch\MEDIACENTER.EXE-F5DA075C.pf
O45 - LFCP:[MD5.B1A88FF8DF54591B2C056494631195A1] - 02/09/2013 - 09:45:44 ---A- - C:\Windows\Prefetch\SPOTIFY.EXE-08A5FD05.pf
O45 - LFCP:[MD5.9A2B5A7B40566C8A87CEC5FFBB78CBCC] - 02/09/2013 - 09:47:08 ---A- - C:\Windows\Prefetch\ALLSHAREFRAMEWORKMANAGERDMS.E-0A3E631D.pf
O45 - LFCP:[MD5.D41A2850A3D92832F692A9BA0DA34812] - 02/09/2013 - 09:47:11 ---A- - C:\Windows\Prefetch\ALLSHAREFRAMEWORKDMS.EXE-14ADEFF6.pf
O45 - LFCP:[MD5.B832B7DB377716B02F320613A53326D6] - 31/08/2013 - 18:31:13 ---A- - C:\Windows\Prefetch\PRISONTYCOON4.EXE-B2737952.pf
O45 - LFCP:[MD5.AED66E2ABFD93E39BC3C1CC66BE0A214] - 31/08/2013 - 18:44:20 ---A- - C:\Windows\Prefetch\AQUASCAPES.EXE-961550E2.pf
O45 - LFCP:[MD5.826C976C5C4270A2D2DA31B506F4D8F9] - 31/08/2013 - 19:53:31 ---A- - C:\Windows\Prefetch\VIKINGBROTHERS.EXE-4A8968AF.pf
O45 - LFCP:[MD5.014FA25FF242B6555DEE613C9911D94D] - 31/08/2013 - 20:01:19 ---A- - C:\Windows\Prefetch\PKR.EXE-8C9F9C30.pf
O45 - LFCP:[MD5.426549AD7041D0E973839F8AB921A785] - 31/08/2013 - 20:01:24 ---A- - C:\Windows\Prefetch\POKERAPP.EXE-EDB7A7F1.pf
~ Prefetcher: 138 Legitimates Filtered in 00mn 00s
---\\ Cl� de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{10e4da6e-2631-11e1-b9f8-f80f410f76b2}\AutoRun\command. (.Pas de propri�taire - Legends of Dawn Setup.) -- J:\Setup.exe
~ Keys: Scanned in 00mn 00s
---\\ Enum�ration des cl�s de registre StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\Nero MediaHome 4 [Key] . (...) -- C:\Program Files (x86)\Nero\Nero MediaHome 4\NeroMediaHome.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\Skype [Key] . (...) -- C:\Program Files (x86)\Skype\Phone\Skype.exe (.not file.)
~ SMSR Keys: 5 Legitimates Filtered in 00mn 00s
---\\ Enum�ration des cl�s de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 17 Legitimates Filtered in 00mn 00s
---\\ Enum�ration des cl�s de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du syst�me (SDL) (O58)
O58 - SDL:[MD5.A3769020F7E8A70FD3E824C050F33306] - 24/02/2010 - 11:20:40 ---A- . (.Protect Software GmbH - ProtectDisc x64/x86 Hybrid Driver.) -- C:\Windows\System32\Drivers\acedrv11.sys [191616]
~ Drivers: 17 Legitimates Filtered in 00mn 00s
---\\ Derniers fichiers modifi�s ou cr�es (Utilisateur) (O61)
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Big City Adventure - Tokyo\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Burger Bustle - Cuisine Bio\data\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Farm Mania - Hot Vacation fr\Farm Mania - Hot Vacation\Data\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\House of 1000 Doors - Les Serpents Edition Collector\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Jo's Dream - Un P'tit Cafe\Data\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Legacy Tales - La Clemence du Bourreau Edition Collector\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Maestro - La Symphonie du Neant Edition Collector\data\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Motor Town - Ames et Machines\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Pet Store Panic\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Rolling Idols\data\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Sweet Kingdom - La Princesse de Pierre\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\jeux aout 2013\Dark Tales - Le Masque de la Mort Rouge par Edgar Allan Poe Edition Collector\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\jeux aout 2013\Hypnosis\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\jeux aout 2013\Love Chronicles - Au-dela du Mal Edition Collector\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\jeux aout 2013\Off the Record - Linden Shades Edition Collector\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\jeux aout 2013\Reveries - Les Deux Soeurs Edition Collector\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\jeux aout 2013\Rite of Passage - Le Fils de la Foret Edition Collector\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\jeux aout 2013\Viking Brothers fr.HURLUS.Zone-Telechargement.com\HURLUS.txt [20768]
O61 - LFC: 02/09/2013 - 07:29:29 ---A- . (...) -- C:\Users\Neochris\Downloads\AdwCleaner.exe [1037134]
O61 - LFC: 02/09/2013 - 07:31:37 ---A- . (...) -- C:\Users\Neochris\Downloads\Rosetta Stone v3.4.7 - iNTEGRALE WinAll.part01.rar.part [501188466]
O61 - LFC: 02/09/2013 - 07:40:16 ---A- . (...) -- C:\Users\Neochris\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_CC422A4497AB499C8A9F811597BF9115.dat [940]
O61 - LFC: 02/09/2013 - 10:46:18 ---A- . (...) -- C:\Users\Neochris\AppData\Local\Google\Chrome\User Data\Local State [52713]
O61 - LFC: 31/08/2013 - 07:25:58 ---A- . (...) -- C:\Users\Neochris\Downloads\justificatif.pdf [7698]
O61 - LFC: 31/08/2013 - 15:21:54 ---A- . (...) -- C:\Users\Neochris\AppData\Local\Google\Chrome\User Data\Certificate Revocation Lists [268170]
O61 - LFC: 31/08/2013 - 18:34:30 ---A- . (...) -- C:\Users\Neochris\AppData\Roaming\ValuSoft\Prison Tycoon 4\setup.xml [3225]
O61 - LFC: 31/08/2013 - 19:44:50 ---A- . (...) -- C:\Users\Neochris\Downloads\jeux aout 2013\AquaScapes_Premium_Edition_FR\Base.orig\ParticleGroups.xml [238992]
O61 - LFC: 31/08/2013 - 19:58:29 ---A- . (...) -- C:\Users\Neochris\AppData\Roaming\AlawarEntertainment\WhaleboxStudio\VikingBrothers\0.dat [600]
O61 - LFC: 31/08/2013 - 19:58:38 ---A- . (...) -- C:\Users\Neochris\AppData\Roaming\AlawarEntertainment\WhaleboxStudio\VikingBrothers\config.dat [232]
O61 - LFC: 31/08/2013 - 19:58:41 ---A- . (...) -- C:\Users\Neochris\Downloads\jeux aout 2013\Viking Brothers fr.HURLUS.Zone-Telechargement.com\Data\output_log.txt [21944]
~ 6 Fichiers temporaires (Temporary files)
~ Files: 368 Legitimates Filtered in 18mn 39s
---\\ Liste des outils de d�sinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
~ ADS: Scanned in 00mn 00s
---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 19 Legitimates Filtered in 00mn 00s
---\\ Menu de d�marrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: prefs.js [Neochris - kzlni9ol.default] user_pref("extensions.crossriderapp3847.3847.plugins.plugin_31.code", "if (!appAPI.monetize || appAPI.monetize.isNeedToRun(\"monit[...] =>PUP.CrossRider
~ Keys: Scanned in 00mn 00s
---\\ Enum�re les fichiers Crack & Keygen (CKF) (O82)
D:\NOUVEAU\logiciel\Keygen.exe
~ Files: Scanned in 02mn 09s
---\\ Recherche particuli�re � la racine du syst�me (SPRF) (O84)
[MD5.DC00FB25934FC0C55EB71B61E95281FB] [SPRF][02/05/2011] (...) -- C:\ProgramData\ezsidmv.dat [56]
[MD5.2A00675C8B0105BF938F22DAA5FC9B79] [SPRF][01/09/2013] (...) -- C:\Users\Neochris\AppData\Local\Temp\Quarantine.exe [344507]
~ Files: 5 Legitimates Filtered in 00mn 00s
---\\ Enum�re les codes produits des logiciels (PUC) (O90)
O90 - PUC: "A5EAC6B43681FC94F9E0FCC8DFDFDAEE" . (.PhoneMyPC.) -- C:\Windows\Installer\{4B6CAE5A-1863-49CF-9F0E-CF8CFDFDADEE}\_6FEFF9B68218417F98F549.exe
O90 - PUC: "E38332016F9DC8749A56324A56B7C3A9" . (.Sacred 2.) -- C:\Windows\Installer\{1023383E-D9F6-478C-A965-23A4657B3C9A}\ARPPRODUCTICON.exe
~ Update Products: 96 Legitimates Filtered in 00mn 00s
---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.7F998EF49DD0CCD3772B87D589356BC0] [WIS][27/04/2012] (.MaxTV Technologies - MaxTV Labs Certificate Authority.) -- C:\Windows\Installer\1476c94.msi [107520]
~ WIS: 98 Legitimates Filtered in 00mn 14s
---\\ Etat g�n�ral des services not Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 18/03/2010 113152 | (ACDaemon) . (.ArcSoft Inc..) - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
SS - | Demand 09/10/2009 169312 | (AdobeActiveFileMonitor8.0) . (.Adobe Systems Incorporated.) - c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
SR - | Auto 11/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 20/08/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 18/06/2013 404360 | (AllShare Framework DMS) . (.Samsung.) - C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\AllShareFrameworkManagerDMS.exe
SR - | Auto 09/05/2013 46808 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SR - | Auto 17/12/2007 163840 | (EPSON_EB_RPCV4_01) . (.SEIKO EPSON CORPORATION.) - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.exe
SR - | Auto 11/01/2007 126464 | (EPSON_PM_RPCV4_01) . (.SEIKO EPSON CORPORATION.) - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.exe
SS - | Demand 24/02/2011 867080 | (FLEXnet Licensing Service) . (.Acresso Software Inc..) - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
SR - | Auto 11/08/2009 626208 | (ForceWare Intelligent Application Manager (IAM)) . (...) - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
SS - | Demand 04/04/2010 246520 | (GameConsoleService) . (.WildTangent, Inc..) - C:\Program Files (x86)\Packard Bell Games\Packard Bell Game Console\GameConsoleService.exe
SR - | Auto 08/01/2010 23584 | (GREGService) . (.Acer Incorporated.) - C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe
SS - | Auto 02/05/2011 136176 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 02/05/2011 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 15/01/2010 935208 | (Nero BackItUp Scheduler 4.0) . (.Nero AG.) - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
SR - | Auto 11/08/2009 206880 | (nSvcIp) . (...) - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
SR - | Auto 18/01/2013 884512 | (NVSvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe
SS - | Auto 25/02/2013 1260320 | (nvUpdatusService) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
SR - | Auto 15/07/2011 31232 | (PhoneMyPC_Helper) . (.SoftwareForMe Inc.) - C:\Program Files\SoftwareForMe Inc\PhoneMyPC\PhoneMyPC_Helper.exe
SS - | Demand 25/06/2010 117264 | (rpcapd) . (.CACE Technologies, Inc..) - C:\Program Files (x86)\WinPcap\rpcapd.exe
SR - | Auto 11/07/2013 605768 | (Samsung Link Service) . (.Copyright 2013 SAMSUNG.) - C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
SR - | Auto 18/01/2013 383264 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
SR - | Auto 29/01/2010 243232 | (Updater Service) . (.Acer Group.) - C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 00\00\0000 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 17s
---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Run by Neochris at 02/09/2013 12:07:23
~ OS 64 not supported by MBR tool
~ MBR: 0 Legitimates Filtered in 00mn 00s
---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Neochris at 02/09/2013 12:07:25
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 02s
---\\ Scan Additionnel (O88)
Database Version : v2.12874 - (01/09/2013)
Cl�s trouv�es (Keys found) : 8
Valeurs trouv�es (Values found) : 0
Dossiers trouv�s (Folders found) : 5
Fichiers trouv�s (Files found) : 4
[HKLM\Software\Google\Chrome\Extensions\gaiilaahiahdejapggenmdmafpmbipje] =>PUP.DealPly^
[HKLM\Software\Google\Chrome\Extensions\iibmmjhgclhlahmjniokmhleigemjpbh] =>Adware.ExpressFiles^
[HKLM\Software\Google\Chrome\Extensions\jpihmmhdcobmllpcnpfbhnipmhamldje] =>PUP.MediaFinder^
[HKLM\Software\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}] =>Adware.Yontoo
[HKLM\Software\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}] =>Adware.Yontoo
[HKLM\Software\Wow6432Node\SweetIM] =>PUP.SweetIM
[HKCU\Software\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder] =>PUP.MediaFinder
[HKCU\Software\Classes\MF] =>PUP.MediaFinder
C:\Users\Neochris\AppData\Roaming\Mozilla\Firefox\Profiles\kzlni9ol.default\@FissaPlugin =>PUP.OfferBox^
C:\Users\Neochris\AppData\Roaming\Mozilla\Firefox\Profiles\kzlni9ol.default\crossriderapp2258@crossrider.com =>PUP.CrossRider^
C:\Users\Neochris\AppData\Roaming\Mozilla\Firefox\Profiles\kzlni9ol.default\crossriderapp3847@crossrider.com =>PUP.CrossRider^
C:\Users\Neochris\AppData\Local\Updater3847 =>PUP.CrossRider^
C:\Users\Neochris\AppData\Roaming\Mozilla\Firefox\Profiles\kzlni9ol.default\extensions\@FissaPlugin =>PUP.OfferBox
C:\Users\Neochris\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje =>PUP.DealPly^
C:\Users\Neochris\AppData\Local\Google\Chrome\User Data\Default\Extensions\iibmmjhgclhlahmjniokmhleigemjpbh =>Adware.ExpressFiles^
C:\Users\Neochris\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpihmmhdcobmllpcnpfbhnipmhamldje =>PUP.MediaFinder^
C:\Windows\Prefetch\YONTOODESKTOP.EXE-AB7A3F7B.pf =>Adware.Yontoo^
~ Additionnel Scan: 252706 Items scanned in 00mn 22s
---\\ R�capitulatif des d�tections trouv�es sur votre station
~ http://nicolascoolman.webs.com/apps/blog/show/28060597-pup-dealply =>PUP.DealPly
~ http://nicolascoolman.webs.com/apps/blog/show/26753274-adware-expressfiles =>Adware.ExpressFiles
~ http://nicolascoolman.webs.com/apps/blog/show/28445531-pup-mediafinder =>PUP.MediaFinder
~ http://nicolascoolman.webs.com/apps/blog/show/28606910-pup-offerbox =>PUP.OfferBox
~ http://nicolascoolman.webs.com/apps/blog/show/27583526-pup-crossrider =>PUP.CrossRider
~ http://nicolascoolman.webs.com/apps/blog/show/29216159-pup-sweetim =>PUP.SweetIM
~ http://nicolascoolman.webs.com/apps/blog/show/26811836-adware-yontoo =>Adware.Yontoo
~ MSI: 7 link(s) detected in 00mn 22s
~ 2233 Legitimates filtered by white list
End of the scan (577 lines in 22mn 35s)(1)
~ Lanc� par Neochris (02/09/2013 11:45:12)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Traduit par Nicolas Coolman
~ Etat de la version : Version � jour.
~ Liste blanche : Activ�e par le programme
~ El�vation des Privil�ges : OK
~ User Account Control (UAC): Activate by user
---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16660
MFIE: Mozilla Firefox 5.0
GCIE: Google Chrome v29.0.1547.62 (Defaut)
---\\ Informations sur les produits Windows
~ Langage: Fran�ais
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 7QJB7
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ Logiciels de protection du syst�me
avast! Free Antivirus v8.0.1489.0
Spybot - Search & Destroy v1.6.2
Windows Defender W7
---\\ Logiciels d'optimisation du syst�me
CCleaner v3.06 =>Piriform Ltd
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 11 Plugin
Adobe Reader XI
Java 7 Update 25
---\\ Informations sur le syst�me
~ Processor: AMD64 Family 16 Model 6 Stepping 3, AuthenticAMD
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 4095 MB (39% free)
System Restore: Activ� (Enable)
System drive C: has 232 GB (33%) free of 689 GB
---\\ Mode de connexion au syst�me
~ Computer Name: NEOCHRIS-PC
~ User Name: Neochris
~ All Users Names: UpdatusUser, Neochris, HomeGroupUser$, Administrateur,
~ Unselected Option: None
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppData% : C:\Users\Neochris\AppData\Roaming\
~ %Desktop% : C:\Users\Neochris\Desktop\
~ %Favorites% : C:\Users\Neochris\Favorites\
~ %LocalAppData% : C:\Users\Neochris\AppData\Local\
~ %StartMenu% : C:\Users\Neochris\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enum�ration des unit�s disques
C:\ Hard drive, Flash drive, Thumb drive (Free 232 Go of 689 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 468 Go of 690 Go)
E:\ CD-ROM drive (Not Inserted)
F:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
G:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
H:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
I:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
J:\ CD-ROM drive (Free 0 Go of 7 Go)
Q:\ Hard drive, Flash drive, Thumb drive (Free 0 Go of 0 Go)
---\\ Etat du Centre de S�curit� Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 29 Legitimates Filtered in 00mn 00s
---\\ Recherche particuli�re de fichiers g�n�riques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de d�marrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.AC155DD9BD1E6D3B740826A4D1C68AAE] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.26/07/2013 - 06:13:37.) -- C:\Windows\System32\wininet.dll [2241024]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d�ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Biblioth�que de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.1C7857B62DE5994A75B054A9FD4C3825] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/12/2011 - 04:59:24.) -- C:\Windows\system32\Drivers\AFD.sys [498688]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du syst�me de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parall�le.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de clich� instantan� du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s
---\\ Etat des fichiers cach�s (Cach�/Total)
~ Mes images (My Pictures) : 2/2163
~ Mes musiques (My Musics) : 8/2428
~ Mes Videos (My Videos) : 2/72
~ Mes Favoris (My Favorites) : 1/33
~ Mes Documents (My Documents) : 3/1869
~ Mon Bureau (My Desktop) : 1/9
~ Menu demarrer (Programs) : 1/66
~ Hidden Files: Scanned in 00mn 01s
---\\ Processus lanc�s au d�marrage du syst�me
[MD5.896A1DB9A972AD2339C2E8569EC926D1] - (.Safer Networking Limited - System settings protector.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088] [PID.1632]
[MD5.CEA0461AAE4B8B6216F164501B1B5A10] - (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [4910912] [PID.2700]
[MD5.C156DE6EB37B6C5D6498DD87C23F3FA4] - (.SFR - Mediacenter Evolution.) -- C:\Program Files (x86)\SFR\Mediacenter Evolution\MediaCenter.exe [2688368] [PID.4272]
[MD5.DD9EAE1C80561C509A8B8801E16BAA38] - (.Spotify Ltd - SpotifyWebHelper.) -- C:\Users\Neochris\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384] [PID.4288]
[MD5.D8A15B5A7ABD230ECBF9BF02FDF70871] - (.Pas de propri�taire - Hotkey Utility.) -- C:\Program Files (x86)\Packard Bell\Hotkey Utility\HotkeyUtility.exe [613992] [PID.4644]
[MD5.3F11B20D12D89365D7721BDC860CE5F0] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe [4858968] [PID.4652]
[MD5.F7E1CCBAD109329203AACB1E87BE614C] - (.Dropbox, Inc. - Dropbox.) -- C:\Users\Neochris\AppData\Roaming\Dropbox\bin\Dropbox.exe [27776968] [PID.4700]
[MD5.A7810B302294793DE88542AAE177D1B1] - (.ArcSoft Inc. - ArcSoft Connect Daemon.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424] [PID.4732]
[MD5.D63797E8E7781EE1500A810CB6194FA6] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816] [PID.4896]
[MD5.749949494676218FFA99501F4AA22ECC] - (.OpenOffice.org - OpenOffice.org 3.4.1.) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe [10376704] [PID.4636]
[MD5.4EE367B8B1964160A1F1B80095183D3A] - (.OpenOffice.org - OpenOffice.org 3.4.1.) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin [10368512] [PID.5072]
[MD5.8E436BD0D9C2CB57306070DFEA3D4513] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [829392] [PID.9900]
[MD5.68825D489DE0DC71FF3A62D6452684BA] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [7860224] [PID.10920]
[MD5.5A19667A580B1CE886EAF968B9743F45] - (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [383264] [PID.868]
[MD5.28D6701C710AD7BA3CB95E75F8F1A9AA] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808] [PID.1204]
[MD5.ADC420616C501B45D26C0FD3EF1E54E4] - (.ArcSoft Inc. - ArcSoft Connect Service.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152] [PID.1740]
[MD5.ADDA5E1951B90D3D23C56D3CF0622ADC] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65640] [PID.1764]
[MD5.0191DEE9B9EB7902AF2CF4F67301095D] - (.Acer Incorporated - Global Registration Service.) -- C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [23584] [PID.1904]
[MD5.FD062B4259B5D0599D4A649922D3FF02] - (.SoftwareForMe Inc - PhoneMyPC.) -- C:\Program Files\SoftwareForMe Inc\PhoneMyPC\PhoneMyPC.exe [128512] [PID.1676]
[MD5.C3CDDD18F43D44AB713CF8C4916F7696] - (.Microsoft Corporation - Microsoft Application Virtualization Virtua.) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [219496] [PID.2056]
[MD5.F9EC9ACD504D823D9B9CA98A4F8D3CA2] - (.Acer Group - Updater Service.) -- C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [243232] [PID.2784]
[MD5.13693B6354DD6E72DC5131DA7D764B90] - (.Microsoft Corporation - Microsoft Application Virtualization Client.) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [508776] [PID.2152]
[MD5.72794D112CBAFF3BC0C29BF7350D4741] - (.Microsoft Corporation - Microsoft Office Client Virtualization Serv.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.exe [822624] [PID.3648]
[MD5.FF10288C714E2FC35E8D84443DF58B7F] - (.Samsung - AllShareFrameworkDMS.) -- C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\AllShareFrameworkDMS.exe [755080] [PID.4848]
~ Processes Running: Scanned in 00mn 01s
---\\ Google Chrome, D�marrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Neochris\AppData\Local\Google\Chrome\User Data\Default\Preferences
G0 - GCSP: Preference [User Data\Default][HomePage] http://google.com
G2 - GCE: Preference [User Data\Default] [gaiilaahiahdejapggenmdmafpmbipje] DealPly v.3.0.7.2 (D�sactiv�) =>PUP.DealPly
G2 - GCE: Preference [User Data\Default] [gdlgbpbmiiagaikjbednkikinokbkbcb] Color My Facebook v.1.23.215 (Activ�)
G2 - GCE: Preference [User Data\Default] [iibmmjhgclhlahmjniokmhleigemjpbh] express-files v.10.14.370.24 (D�sactiv�) =>Adware.ExpressFiles
G2 - GCE: Preference [User Data\Default] [jpihmmhdcobmllpcnpfbhnipmhamldje] General Crawler v.2.0 (D�sactiv�) =>PUP.MediaFinder
G2 - GCE: Preference [User Data\Default] [mfjkgbjaikamkkojmakjclmkianficch] Download Assistant v.5.0.2 (Activ�)
G2 - GCE: Preference [User Data\Default] [mpfapcdfbbledbojijcbcclmlieaoogk] I Want This v.1.17.57 (D�sactiv�)
~ Google Browser: 21 Legitimates Filtered in 00mn 12s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Neochris\AppData\Roaming\Mozilla\Firefox\Profiles\kzlni9ol.default\prefs.js
M2 - MFEP: prefs.js [Neochris - kzlni9ol.default\@FissaPlugin] [] Fissa v1.0 (..) =>PUP.OfferBox
M2 - MFEP: prefs.js [Neochris - kzlni9ol.default\crossriderapp2258@crossrider.com] [] I Want This v1.0 (..) =>PUP.CrossRider
M2 - MFEP: prefs.js [Neochris - kzlni9ol.default\crossriderapp3847@crossrider.com] [] Color My Facebook v1.0 (..) =>PUP.CrossRider
~ Firefox Browser: 16 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: (no name) [64Bits] - [HKLM]{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} Cl� orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Applications d�marr�es par registre & par dossier (O4)
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
O4 - HKLM\..\Run: [Samsung Link] . (.Copyright 2013 SAMSUNG - Samsung Link Tray Agent.) -- C:\Program Files\Samsung\Samsung Link\Samsung Link Tray Agent.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] . (.Safer Networking Limited - System settings protector.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
O4 - HKCU\..\Run: [EPSON Stylus DX5000 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBVE.exe
O4 - HKCU\..\Run: [SFR Mediacenter] . (.SFR - Mediacenter Evolution.) -- C:\Program Files (x86)\SFR\Mediacenter Evolution\MediaCenter.exe
O4 - HKCU\..\Run: [Spotify Web Helper] . (.Spotify Ltd - SpotifyWebHelper.) -- C:\Users\Neochris\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
O4 - HKCU\..\Run: [Spotify] . (.Spotify Ltd - Spotify.) -- C:\Users\Neochris\AppData\Roaming\Spotify\Spotify.exe
O4 - HKCU\..\RunOnce: [SpUninstallDeleteDir] Cl� orpheline
O4 - HKLM\..\Wow6432Node\Run: [Hotkey Utility] . (.Pas de propri�taire - Hotkey Utility.) -- C:\Program Files (x86)\Packard Bell\Hotkey Utility\HotkeyUtility.exe
O4 - HKLM\..\Wow6432Node\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe
O4 - HKLM\..\Wow6432Node\Run: [ArcSoft Connection Service] . (.ArcSoft Inc. - ArcSoft Connect Daemon.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-21-3543433309-3597804886-3877114459-1000\..\Run: [SpybotSD TeaTimer] . (.Safer Networking Limited - System settings protector.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-21-3543433309-3597804886-3877114459-1000\..\Run: [DAEMON Tools Lite] . (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
O4 - HKUS\S-1-5-21-3543433309-3597804886-3877114459-1000\..\Run: [EPSON Stylus DX5000 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBVE.exe
O4 - HKUS\S-1-5-21-3543433309-3597804886-3877114459-1000\..\Run: [SFR Mediacenter] . (.SFR - Mediacenter Evolution.) -- C:\Program Files (x86)\SFR\Mediacenter Evolution\MediaCenter.exe
O4 - HKUS\S-1-5-21-3543433309-3597804886-3877114459-1000\..\Run: [Spotify Web Helper] . (.Spotify Ltd - SpotifyWebHelper.) -- C:\Users\Neochris\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
O4 - HKUS\S-1-5-21-3543433309-3597804886-3877114459-1000\..\Run: [Spotify] . (.Spotify Ltd - Spotify.) -- C:\Users\Neochris\AppData\Roaming\Spotify\Spotify.exe
O4 - HKUS\S-1-5-21-3543433309-3597804886-3877114459-1000\..\RunOnce: [SpUninstallDeleteDir] Cl� orpheline
~ Application: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\QuickLaunch: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Accessories: Private Character Editor.lnk . (.Microsoft Corporation - �diteur de caract�res priv�s.) -- C:\Windows\system32\eudcedit.exe
O4 - GS\SendTo: Fax Recipient.lnk . (.Microsoft Corporation - Microsoft Windows Fax and Scan.) -- C:\Windows\system32\WFS.exe
O4 - GS\Desktop: Installeur de World of Warcraft.lnk . (...) -- C:\Users\Public\Documents\Blizzard Entertainment\World of Warcraft Installer
O4 - GS\Desktop: PDF2Image v2.1.lnk . (...) -- C:\Program Files (x86)\VeryPDF PDF2Image v2.1\PDF2Image.exe (.not file.)
O4 - GS\Desktop: PhotoFiltre.lnk . (.Antonio Da Cruz - PhotoFiltre.) -- C:\Program Files (x86)\PhotoFiltre\PhotoFiltre.exe
O4 - GS\TaskBar: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\TaskBar: Welcome Center.lnk . (.Acer Incorporated - Welcome Center.) -- C:\Program Files (x86)\Packard Bell\Welcome Center\OEMWelcomeCenter.exe
O4 - GS\TaskBar: Windows Explorer.lnk . (.Microsoft Corporation - Explorateur Windows.) -- C:\Windows\explorer.exe
O4 - GS\TaskBar: Windows Media Player.lnk . (.Microsoft Corporation - Lecteur Windows Media.) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Programs: Spotify.lnk . (.Spotify Ltd - Spotify.) -- C:\Users\Neochris\AppData\Roaming\Spotify\spotify.exe
O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch: Packard Bell Games.lnk . (.WildTangent, Inc. - GameConsole.) -- C:\Program Files (x86)\Packard Bell Games\Packard Bell Game Console\GameConsole-wt.exe
O4 - GS\QuickLaunch: Spybot - Search & Destroy.lnk . (.Safer Networking Limited - Spybot - Search & Destroy.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SpybotSD.exe
O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SendTo: Dropbox.lnk . (...) -- C:\Users\Neochris\Dropbox
O4 - GS\SendTo: Transfert de fichiers Bluetooth.LNK . (.Microsoft Corporation - Pas de description.) -- C:\Windows\System32\fsquirt.exe
O4 - GS\SendTo: WinDirStat.lnk . (.Seifert - Windows Directory Statistics.) -- C:\Program Files (x86)\windirstat\windirstat.exe
O4 - GS\Desktop: 12 La grande sophie - Animal en quarantaine - Raccourci.lnk . (...) -- C:\Users\Neochris\Music\HFT\2002 Les fils du coupeur de joints\1 Les fils du coupeur de joints\12 La grande sophie - Animal en quarantaine.mp3
O4 - GS\Desktop: Cheat Engine.lnk . (...) -- C:\Program Files (x86)\Cheat Engine 6.1\Cheat Engine.exe
O4 - GS\Desktop: JDownloader.lnk . (.AppWork UG (haftungsbeschr�nkt) - JDownloader Launcher v3.) -- C:\Program Files (x86)\JDownloader\JDownloader.exe
O4 - GS\Desktop: Spotify.lnk . (.Spotify Ltd - Spotify.) -- C:\Users\Neochris\AppData\Roaming\Spotify\spotify.exe
O4 - GS\Desktop: Spybot - Search & Destroy.lnk . (.Safer Networking Limited - Spybot - Search & Destroy.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SpybotSD.exe
~ Global Startup: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{01A69E6D-C369-43B1-A6F0-B017817DB90F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{01A69E6D-C369-43B1-A6F0-B017817DB90F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{01A69E6D-C369-43B1-A6F0-B017817DB90F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s
---\\ Titr_HJT34=Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non d�sactiv�s (O23)
O23 - Service: PhoneMyPC_Helper (PhoneMyPC_Helper) . (.SoftwareForMe Inc - PhoneMyPC_Helper.) - C:\Program Files\SoftwareForMe Inc\PhoneMyPC\PhoneMyPC_Helper.exe
O23 - Service: Updater Service (Updater Service) . (.Acer Group - Updater Service.) - C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
~ Services: 16 Legitimates Filtered in 00mn 06s
---\\ T�ches planifi�es en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [Express FilesUpdate] (...) -- C:\Program Files (x86)\ExpressFiles\EFUpdater.exe (.not file.) [0] =>Adware.ExpressFiles
[MD5.00000000000000000000000000000000] [APT] [{70C74D0A-B64C-48B4-9031-657A179302A1}] (...) -- C:\Users\Neochris\Downloads\Setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{D556694A-ACC9-43D9-A049-DC778041B7A7}] (...) -- C:\Users\Neochris\Downloads\ParadiseBeachSetup.exe (.not file.) [0]
~ Scheduled Task: 16 Legitimates Filtered in 00mn 03s
---\\ Logiciels install�s (O42)
O42 - Logiciel: Cooking Dash 3 - Thrills and Spills - Collectors Edition - (.Aliasworlds Entertainment.) [HKLM][64Bits] -- Cooking Dash 3 - Thrills and Spills - Collectors Edition1.0.1.145
O42 - Logiciel: Hobby Farm - (...) [HKLM][64Bits] -- Hobby Farm
O42 - Logiciel: Joyeux chef - (.Alawar Entertainment Inc..) [HKLM][64Bits] -- Joyeux chef
O42 - Logiciel: Legends of Dawn - (...) [HKLM][64Bits] -- Legends of Dawn_is1
O42 - Logiciel: Multiskate - (...) [HKCU][64Bits] -- Multiskate
O42 - Logiciel: PhoneMyPC - (.SoftwareForMe Inc..) [HKLM][64Bits] -- {4B6CAE5A-1863-49CF-9F0E-CF8CFDFDADEE}
~ Logic: 194 Legitimates Filtered in 00mn 00s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\Akella]
[HKCU\Software\Whalebox Studio]
[HKLM\Software\Wow6432Node\CandleWorks]
[HKLM\Software\Wow6432Node\SweetIM] =>PUP.SweetIM
~ Key Software: 298 Legitimates Filtered in 00mn 00s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 27/01/2012 - 10:06:52 - [30,767] ----D C:\Program Files (x86)\Candleworks
O43 - CFD: 30/10/2012 - 13:11:38 - [86,908] ----D C:\Program Files (x86)\Cooking Dash 3 - Thrills and Spills - Collectors Edition
O43 - CFD: 10/08/2013 - 13:55:54 - [-652,108] ----D C:\Program Files (x86)\DreaMatrix
O43 - CFD: 12/08/2011 - 14:53:59 - [88,271] ----D C:\Program Files (x86)\Hobby Farm
O43 - CFD: 15/07/2011 - 11:56:28 - [0] ----D C:\Program Files (x86)\Jeux Chapelain
O43 - CFD: 21/12/2012 - 22:55:13 - [78,452] ----D C:\Program Files (x86)\La Brigade des Cuisiniers
O43 - CFD: 05/07/2011 - 16:27:11 - [100,286] ----D C:\Program Files (x86)\Paradise Beach
O43 - CFD: 11/09/2011 - 18:38:13 - [0,020] ----D C:\Program Files (x86)\PokerStars.FR
O43 - CFD: 07/11/2011 - 11:07:17 - [0,126] ----D C:\Program Files (x86)\Your Product
O43 - CFD: 31/01/2012 - 11:19:10 - [0] ----D C:\ProgramData\Egoset
O43 - CFD: 27/01/2012 - 10:06:57 - [13,699] --H-D C:\ProgramData\{60969585-BC44-4467-B939-0A78C09C06E9}
O43 - CFD: 04/10/2012 - 18:03:39 - [0,001] ----D C:\Users\Neochris\AppData\Roaming\#Hf
O43 - CFD: 10/08/2013 - 17:38:51 - [0,000] ----D C:\Users\Neochris\AppData\Roaming\Liam games
O43 - CFD: 15/08/2013 - 06:32:29 - [0,018] ----D C:\Users\Neochris\AppData\Roaming\Melesta
O43 - CFD: 09/08/2013 - 13:21:08 - [0,001] ----D C:\Users\Neochris\AppData\Roaming\PetStorePanic
O43 - CFD: 12/08/2011 - 14:54:41 - [0,119] ----D C:\Users\Neochris\AppData\Roaming\playmink
O43 - CFD: 24/06/2011 - 18:44:58 - [0,487] ----D C:\Users\Neochris\AppData\Local\PokerStars.FR
O43 - CFD: 04/02/2013 - 09:24:06 - [0] ----D C:\Users\Neochris\AppData\Local\Updater3847 =>PUP.CrossRider
O43 - CFD: 21/12/2012 - 22:55:07 - [0,002] ----D C:\Users\Neochris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\La Brigade des Cuisiniers
O43 - CFD: 05/07/2011 - 16:26:42 - [0,002] ----D C:\Users\Neochris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Paradise Beach
O43 - CFD: 27/01/2012 - 13:17:49 - [0,002] ----D C:\Users\Neochris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Your Product
~ 409 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 715 Legitimates Filtered in 00mn 09s
---\\ Derniers fichiers modifi�s ou cr�es sous Windows et System32 (O44)
O44 - LFC:[MD5.D1E75542EC8D1B4851765A57AC63618E] - 25/08/2013 - 16:58:55 ---A- . (...) -- C:\Windows\diagerr.xml [1908]
O44 - LFC:[MD5.68065F778B25B25FF6AA3889922B7E55] - 25/08/2013 - 16:58:55 ---A- . (...) -- C:\Windows\diagwrn.xml [2564]
~ Files: 16 Legitimates Filtered in 00mn 04s
---\\ Derniers fichiers cr��s dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.EF7441A4B9718142124E2BE099054D1A] - 01/09/2013 - 07:23:17 ---A- - C:\Windows\Prefetch\PMS.EXE-8E4C125F.pf
O45 - LFCP:[MD5.CEA380EF5BDE9AD678ADC7E8BE2EE4C2] - 02/09/2013 - 06:05:43 ---A- - C:\Windows\Prefetch\GETMAC.EXE-FE61CB22.pf
O45 - LFCP:[MD5.4ADB692A21F090CBF94560481375A37F] - 02/09/2013 - 06:06:28 ---A- - C:\Windows\Prefetch\YONTOODESKTOP.EXE-AB7A3F7B.pf =>Adware.Yontoo
O45 - LFCP:[MD5.0D9EBE493877C6C73D63380090833EB1] - 02/09/2013 - 09:45:36 ---A- - C:\Windows\Prefetch\MEDIACENTER.EXE-F5DA075C.pf
O45 - LFCP:[MD5.B1A88FF8DF54591B2C056494631195A1] - 02/09/2013 - 09:45:44 ---A- - C:\Windows\Prefetch\SPOTIFY.EXE-08A5FD05.pf
O45 - LFCP:[MD5.9A2B5A7B40566C8A87CEC5FFBB78CBCC] - 02/09/2013 - 09:47:08 ---A- - C:\Windows\Prefetch\ALLSHAREFRAMEWORKMANAGERDMS.E-0A3E631D.pf
O45 - LFCP:[MD5.D41A2850A3D92832F692A9BA0DA34812] - 02/09/2013 - 09:47:11 ---A- - C:\Windows\Prefetch\ALLSHAREFRAMEWORKDMS.EXE-14ADEFF6.pf
O45 - LFCP:[MD5.B832B7DB377716B02F320613A53326D6] - 31/08/2013 - 18:31:13 ---A- - C:\Windows\Prefetch\PRISONTYCOON4.EXE-B2737952.pf
O45 - LFCP:[MD5.AED66E2ABFD93E39BC3C1CC66BE0A214] - 31/08/2013 - 18:44:20 ---A- - C:\Windows\Prefetch\AQUASCAPES.EXE-961550E2.pf
O45 - LFCP:[MD5.826C976C5C4270A2D2DA31B506F4D8F9] - 31/08/2013 - 19:53:31 ---A- - C:\Windows\Prefetch\VIKINGBROTHERS.EXE-4A8968AF.pf
O45 - LFCP:[MD5.014FA25FF242B6555DEE613C9911D94D] - 31/08/2013 - 20:01:19 ---A- - C:\Windows\Prefetch\PKR.EXE-8C9F9C30.pf
O45 - LFCP:[MD5.426549AD7041D0E973839F8AB921A785] - 31/08/2013 - 20:01:24 ---A- - C:\Windows\Prefetch\POKERAPP.EXE-EDB7A7F1.pf
~ Prefetcher: 138 Legitimates Filtered in 00mn 00s
---\\ Cl� de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{10e4da6e-2631-11e1-b9f8-f80f410f76b2}\AutoRun\command. (.Pas de propri�taire - Legends of Dawn Setup.) -- J:\Setup.exe
~ Keys: Scanned in 00mn 00s
---\\ Enum�ration des cl�s de registre StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\Nero MediaHome 4 [Key] . (...) -- C:\Program Files (x86)\Nero\Nero MediaHome 4\NeroMediaHome.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\Skype [Key] . (...) -- C:\Program Files (x86)\Skype\Phone\Skype.exe (.not file.)
~ SMSR Keys: 5 Legitimates Filtered in 00mn 00s
---\\ Enum�ration des cl�s de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 17 Legitimates Filtered in 00mn 00s
---\\ Enum�ration des cl�s de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du syst�me (SDL) (O58)
O58 - SDL:[MD5.A3769020F7E8A70FD3E824C050F33306] - 24/02/2010 - 11:20:40 ---A- . (.Protect Software GmbH - ProtectDisc x64/x86 Hybrid Driver.) -- C:\Windows\System32\Drivers\acedrv11.sys [191616]
~ Drivers: 17 Legitimates Filtered in 00mn 00s
---\\ Derniers fichiers modifi�s ou cr�es (Utilisateur) (O61)
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Big City Adventure - Tokyo\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Burger Bustle - Cuisine Bio\data\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Farm Mania - Hot Vacation fr\Farm Mania - Hot Vacation\Data\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\House of 1000 Doors - Les Serpents Edition Collector\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Jo's Dream - Un P'tit Cafe\Data\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Legacy Tales - La Clemence du Bourreau Edition Collector\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Maestro - La Symphonie du Neant Edition Collector\data\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Motor Town - Ames et Machines\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Pet Store Panic\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Rolling Idols\data\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\Jeux\Sweet Kingdom - La Princesse de Pierre\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\jeux aout 2013\Dark Tales - Le Masque de la Mort Rouge par Edgar Allan Poe Edition Collector\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\jeux aout 2013\Hypnosis\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\jeux aout 2013\Love Chronicles - Au-dela du Mal Edition Collector\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\jeux aout 2013\Off the Record - Linden Shades Edition Collector\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\jeux aout 2013\Reveries - Les Deux Soeurs Edition Collector\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\jeux aout 2013\Rite of Passage - Le Fils de la Foret Edition Collector\HURLUS.txt [20768]
O61 - LFC: 01/01/2028 - 01:00:00 R-HA- . (...) -- C:\Users\Neochris\Downloads\jeux aout 2013\Viking Brothers fr.HURLUS.Zone-Telechargement.com\HURLUS.txt [20768]
O61 - LFC: 02/09/2013 - 07:29:29 ---A- . (...) -- C:\Users\Neochris\Downloads\AdwCleaner.exe [1037134]
O61 - LFC: 02/09/2013 - 07:31:37 ---A- . (...) -- C:\Users\Neochris\Downloads\Rosetta Stone v3.4.7 - iNTEGRALE WinAll.part01.rar.part [501188466]
O61 - LFC: 02/09/2013 - 07:40:16 ---A- . (...) -- C:\Users\Neochris\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_CC422A4497AB499C8A9F811597BF9115.dat [940]
O61 - LFC: 02/09/2013 - 10:46:18 ---A- . (...) -- C:\Users\Neochris\AppData\Local\Google\Chrome\User Data\Local State [52713]
O61 - LFC: 31/08/2013 - 07:25:58 ---A- . (...) -- C:\Users\Neochris\Downloads\justificatif.pdf [7698]
O61 - LFC: 31/08/2013 - 15:21:54 ---A- . (...) -- C:\Users\Neochris\AppData\Local\Google\Chrome\User Data\Certificate Revocation Lists [268170]
O61 - LFC: 31/08/2013 - 18:34:30 ---A- . (...) -- C:\Users\Neochris\AppData\Roaming\ValuSoft\Prison Tycoon 4\setup.xml [3225]
O61 - LFC: 31/08/2013 - 19:44:50 ---A- . (...) -- C:\Users\Neochris\Downloads\jeux aout 2013\AquaScapes_Premium_Edition_FR\Base.orig\ParticleGroups.xml [238992]
O61 - LFC: 31/08/2013 - 19:58:29 ---A- . (...) -- C:\Users\Neochris\AppData\Roaming\AlawarEntertainment\WhaleboxStudio\VikingBrothers\0.dat [600]
O61 - LFC: 31/08/2013 - 19:58:38 ---A- . (...) -- C:\Users\Neochris\AppData\Roaming\AlawarEntertainment\WhaleboxStudio\VikingBrothers\config.dat [232]
O61 - LFC: 31/08/2013 - 19:58:41 ---A- . (...) -- C:\Users\Neochris\Downloads\jeux aout 2013\Viking Brothers fr.HURLUS.Zone-Telechargement.com\Data\output_log.txt [21944]
~ 6 Fichiers temporaires (Temporary files)
~ Files: 368 Legitimates Filtered in 18mn 39s
---\\ Liste des outils de d�sinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
~ ADS: Scanned in 00mn 00s
---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html>
~ FASS Keys: 19 Legitimates Filtered in 00mn 00s
---\\ Menu de d�marrage Internet (SMI) (O68)
O68 - StartMenuInternet:
O68 - StartMenuInternet:
O68 - StartMenuInternet:
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: prefs.js [Neochris - kzlni9ol.default] user_pref("extensions.crossriderapp3847.3847.plugins.plugin_31.code", "if (!appAPI.monetize || appAPI.monetize.isNeedToRun(\"monit[...] =>PUP.CrossRider
~ Keys: Scanned in 00mn 00s
---\\ Enum�re les fichiers Crack & Keygen (CKF) (O82)
D:\NOUVEAU\logiciel\Keygen.exe
~ Files: Scanned in 02mn 09s
---\\ Recherche particuli�re � la racine du syst�me (SPRF) (O84)
[MD5.DC00FB25934FC0C55EB71B61E95281FB] [SPRF][02/05/2011] (...) -- C:\ProgramData\ezsidmv.dat [56]
[MD5.2A00675C8B0105BF938F22DAA5FC9B79] [SPRF][01/09/2013] (...) -- C:\Users\Neochris\AppData\Local\Temp\Quarantine.exe [344507]
~ Files: 5 Legitimates Filtered in 00mn 00s
---\\ Enum�re les codes produits des logiciels (PUC) (O90)
O90 - PUC: "A5EAC6B43681FC94F9E0FCC8DFDFDAEE" . (.PhoneMyPC.) -- C:\Windows\Installer\{4B6CAE5A-1863-49CF-9F0E-CF8CFDFDADEE}\_6FEFF9B68218417F98F549.exe
O90 - PUC: "E38332016F9DC8749A56324A56B7C3A9" . (.Sacred 2.) -- C:\Windows\Installer\{1023383E-D9F6-478C-A965-23A4657B3C9A}\ARPPRODUCTICON.exe
~ Update Products: 96 Legitimates Filtered in 00mn 00s
---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.7F998EF49DD0CCD3772B87D589356BC0] [WIS][27/04/2012] (.MaxTV Technologies - MaxTV Labs Certificate Authority.) -- C:\Windows\Installer\1476c94.msi [107520]
~ WIS: 98 Legitimates Filtered in 00mn 14s
---\\ Etat g�n�ral des services not Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 18/03/2010 113152 | (ACDaemon) . (.ArcSoft Inc..) - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
SS - | Demand 09/10/2009 169312 | (AdobeActiveFileMonitor8.0) . (.Adobe Systems Incorporated.) - c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
SR - | Auto 11/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 20/08/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 18/06/2013 404360 | (AllShare Framework DMS) . (.Samsung.) - C:\Program Files\Samsung\AllShare Framework DMS\1.3.14\AllShareFrameworkManagerDMS.exe
SR - | Auto 09/05/2013 46808 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SR - | Auto 17/12/2007 163840 | (EPSON_EB_RPCV4_01) . (.SEIKO EPSON CORPORATION.) - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.exe
SR - | Auto 11/01/2007 126464 | (EPSON_PM_RPCV4_01) . (.SEIKO EPSON CORPORATION.) - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.exe
SS - | Demand 24/02/2011 867080 | (FLEXnet Licensing Service) . (.Acresso Software Inc..) - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
SR - | Auto 11/08/2009 626208 | (ForceWare Intelligent Application Manager (IAM)) . (...) - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
SS - | Demand 04/04/2010 246520 | (GameConsoleService) . (.WildTangent, Inc..) - C:\Program Files (x86)\Packard Bell Games\Packard Bell Game Console\GameConsoleService.exe
SR - | Auto 08/01/2010 23584 | (GREGService) . (.Acer Incorporated.) - C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe
SS - | Auto 02/05/2011 136176 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 02/05/2011 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 15/01/2010 935208 | (Nero BackItUp Scheduler 4.0) . (.Nero AG.) - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
SR - | Auto 11/08/2009 206880 | (nSvcIp) . (...) - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
SR - | Auto 18/01/2013 884512 | (NVSvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe
SS - | Auto 25/02/2013 1260320 | (nvUpdatusService) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
SR - | Auto 15/07/2011 31232 | (PhoneMyPC_Helper) . (.SoftwareForMe Inc.) - C:\Program Files\SoftwareForMe Inc\PhoneMyPC\PhoneMyPC_Helper.exe
SS - | Demand 25/06/2010 117264 | (rpcapd) . (.CACE Technologies, Inc..) - C:\Program Files (x86)\WinPcap\rpcapd.exe
SR - | Auto 11/07/2013 605768 | (Samsung Link Service) . (.Copyright 2013 SAMSUNG.) - C:\Program Files\Samsung\Samsung Link\Samsung Link.exe
SR - | Auto 18/01/2013 383264 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
SR - | Auto 29/01/2010 243232 | (Updater Service) . (.Acer Group.) - C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 00\00\0000 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 17s
---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Run by Neochris at 02/09/2013 12:07:23
~ OS 64 not supported by MBR tool
~ MBR: 0 Legitimates Filtered in 00mn 00s
---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Neochris at 02/09/2013 12:07:25
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 02s
---\\ Scan Additionnel (O88)
Database Version : v2.12874 - (01/09/2013)
Cl�s trouv�es (Keys found) : 8
Valeurs trouv�es (Values found) : 0
Dossiers trouv�s (Folders found) : 5
Fichiers trouv�s (Files found) : 4
[HKLM\Software\Google\Chrome\Extensions\gaiilaahiahdejapggenmdmafpmbipje] =>PUP.DealPly^
[HKLM\Software\Google\Chrome\Extensions\iibmmjhgclhlahmjniokmhleigemjpbh] =>Adware.ExpressFiles^
[HKLM\Software\Google\Chrome\Extensions\jpihmmhdcobmllpcnpfbhnipmhamldje] =>PUP.MediaFinder^
[HKLM\Software\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}] =>Adware.Yontoo
[HKLM\Software\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}] =>Adware.Yontoo
[HKLM\Software\Wow6432Node\SweetIM] =>PUP.SweetIM
[HKCU\Software\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder] =>PUP.MediaFinder
[HKCU\Software\Classes\MF] =>PUP.MediaFinder
C:\Users\Neochris\AppData\Roaming\Mozilla\Firefox\Profiles\kzlni9ol.default\@FissaPlugin =>PUP.OfferBox^
C:\Users\Neochris\AppData\Roaming\Mozilla\Firefox\Profiles\kzlni9ol.default\crossriderapp2258@crossrider.com =>PUP.CrossRider^
C:\Users\Neochris\AppData\Roaming\Mozilla\Firefox\Profiles\kzlni9ol.default\crossriderapp3847@crossrider.com =>PUP.CrossRider^
C:\Users\Neochris\AppData\Local\Updater3847 =>PUP.CrossRider^
C:\Users\Neochris\AppData\Roaming\Mozilla\Firefox\Profiles\kzlni9ol.default\extensions\@FissaPlugin =>PUP.OfferBox
C:\Users\Neochris\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje =>PUP.DealPly^
C:\Users\Neochris\AppData\Local\Google\Chrome\User Data\Default\Extensions\iibmmjhgclhlahmjniokmhleigemjpbh =>Adware.ExpressFiles^
C:\Users\Neochris\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpihmmhdcobmllpcnpfbhnipmhamldje =>PUP.MediaFinder^
C:\Windows\Prefetch\YONTOODESKTOP.EXE-AB7A3F7B.pf =>Adware.Yontoo^
~ Additionnel Scan: 252706 Items scanned in 00mn 22s
---\\ R�capitulatif des d�tections trouv�es sur votre station
~ http://nicolascoolman.webs.com/apps/blog/show/28060597-pup-dealply =>PUP.DealPly
~ http://nicolascoolman.webs.com/apps/blog/show/26753274-adware-expressfiles =>Adware.ExpressFiles
~ http://nicolascoolman.webs.com/apps/blog/show/28445531-pup-mediafinder =>PUP.MediaFinder
~ http://nicolascoolman.webs.com/apps/blog/show/28606910-pup-offerbox =>PUP.OfferBox
~ http://nicolascoolman.webs.com/apps/blog/show/27583526-pup-crossrider =>PUP.CrossRider
~ http://nicolascoolman.webs.com/apps/blog/show/29216159-pup-sweetim =>PUP.SweetIM
~ http://nicolascoolman.webs.com/apps/blog/show/26811836-adware-yontoo =>Adware.Yontoo
~ MSI: 7 link(s) detected in 00mn 22s
~ 2233 Legitimates filtered by white list
End of the scan (577 lines in 22mn 35s)(1)