cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

~ Rapport de ZHPDiag v2013.9.17.310 - Nicolas Coolman (17/09/2013)
~ Lanc� par Moulis (18/09/2013 19:13:35)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activ�e par le programme
~ El�vation des Privil�ges : OK
~ User Account Control (UAC):


---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16686
MFIE: Mozilla Firefox 23.0.1 (Defaut)
GCIE: Google Chrome v29.0.1547.66

---\\ Informations sur les produits Windows
~ Langage: Fran�ais
Windows 7 Home Premium Edition, 32-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_COA_NSLP channel
Windows ID Activation : OK
~ Windows Partial Key : 4RQY6
Windows License : OK
~ Windows Remaining Initializations Number : 4
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ Logiciels de protection du syst�me
Avira Free Antivirus v13.0.0.4042
Malwarebytes Anti-Malware version 1.75.0.1300
McAfee Security Scan Plus v3.0.318.3
Spybot - Search & Destroy v2.1.19
Windows Defender W7

---\\ Logiciels d'optimisation du syst�me
CCleaner v3.27 =>Piriform Ltd

---\\ Logiciels de partage PeerToPeer
Vuze v4.6 =>P2P.Azureus

---\\ Surveillance de Logiciels
Adobe Flash Player 11 Plugin
Adobe Reader X
Java 7 Update 25

---\\ Informations sur le syst�me
~ Processor: x86 Family 16 Model 6 Stepping 2, AuthenticAMD
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1791 MB (55% free)
System Restore: Activ� (Enable)
System drive C: has 161 GB (69%) free of 233 GB

---\\ Mode de connexion au syst�me
~ Computer Name: FIFFE
~ User Name: Moulis
~ All Users Names: Moulis, HomeGroupUser$, Administrateur,
~ Unselected Option: O45,O61
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppData% : C:\Users\Moulis\AppData\Roaming\
~ %Desktop% : C:\Users\Moulis\Desktop\
~ %Favorites% : C:\Users\Moulis\Favorites\
~ %LocalAppData% : C:\Users\Moulis\AppData\Local\
~ %StartMenu% : C:\Users\Moulis\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enum�ration des unit�s disques
C:\ Hard drive, Flash drive, Thumb drive (Free 161 Go of 233 Go)
D:\ CD-ROM drive (Not Inserted)



---\\ Etat du Centre de S�curit� Windows
~ Security Center: 26 Legitimates Filtered in 00mn 00s



---\\ Recherche particuli�re de fichiers g�n�riques
[MD5.8B88EBBB05A0E56B7DCC708498C02B3E] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 06:30:54.) -- C:\Windows\Explorer.exe [2616320]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Application de d�marrage de Windows.) (.14/07/2009 - 02:14:45.) -- C:\Windows\System32\Wininit.exe [96256]
[MD5.535F6263035F2530A62D5D64EF6E73D3] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.10/08/2013 - 04:59:10.) -- C:\Windows\System32\wininet.dll [1767936]
[MD5.6D13E1406F50C66E2A95D97F22C47560] - (.Microsoft Corporation - Application d�ouverture de session Windows.) (.20/11/2010 - 13:17:54.) -- C:\Windows\System32\Winlogon.exe [286720]
[MD5.E3AE23569749DE12D45BA3B489A036AE] - (.Microsoft Corporation - Biblioth�que de licences.) (.20/11/2010 - 13:21:24.) -- C:\Windows\System32\sppcomapi.dll [193536]
[MD5.9EBBBA55060F786F0FCAA3893BFA2806] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.25/04/2011 - 03:18:03.) -- C:\Windows\system32\Drivers\AFD.sys [338944]
[MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:26:15.) -- C:\Windows\system32\Drivers\atapi.sys [21584]
[MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:11:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656]
[MD5.BE167ED0FDB9C1FA1133953C18D5A6C9] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 09:38:10.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544]
[MD5.F024449C97EC1E464AAFFDA18593DB88] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 09:42:32.) -- C:\Windows\system32\Drivers\DfsC.sys [78336]
[MD5.9036377B8A6C15DC2EEC53E489D159B5] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 10:59:29.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544]
[MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:11:24.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896]
[MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 00:54:29.) -- C:\Windows\system32\Drivers\IpNat.sys [101888]
[MD5.5D16C921E3671636C0EBA3BBAAC5FD25] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:17:22.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123904]
[MD5.280122DDCF04B378EDD1AD54D71C1E54] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 09:39:44.) -- C:\Windows\system32\Drivers\netBT.sys [187904]
[MD5.5E43D2B0EE64123D4880DFA6626DEFDE] - (.Microsoft Corporation - Pilote du syst�me de fichiers NT.) (.12/04/2013 - 14:45:29.) -- C:\Windows\system32\Drivers\ntfs.sys [1211752]
[MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - Pilote de port parall�le.) (.14/07/2009 - 00:45:35.) -- C:\Windows\system32\Drivers\Parport.sys [79360]
[MD5.D9F91EAFEC2815365CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.14/07/2009 - 00:54:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848]
[MD5.3E21C083B8A01CB70BA1F09303010FCE] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 00:53:41.) -- C:\Windows\system32\Drivers\smb.sys [71168]
[MD5.B459575348C20E8121D6039DA063C704] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 09:39:17.) -- C:\Windows\system32\Drivers\tdx.sys [74752]
[MD5.F497F67932C6FA693D7DE2780631CFE7] - (.Microsoft Corporation - Pilote de clich� instantan� du volume.) (.20/11/2010 - 13:30:16.) -- C:\Windows\system32\Drivers\volsnap.sys [245632]
~ Generic Processes: Scanned in 00mn 00s



---\\ Etat des fichiers cach�s (Cach�/Total)
~ Mes images (My Pictures) : 2/10300
~ Mes musiques (My Musics) : 1/4734
~ Mes Videos (My Videos) : 2/35
~ Mes Favoris (My Favorites) : 1/45
~ Mes Documents (My Documents) : 1/693
~ Mon Bureau (My Desktop) : 2/432
~ Menu demarrer (Programs) : 1/36
~ Hidden Files: Scanned in 00mn 26s



---\\ Processus lanc�s
[MD5.CEC11C45A2728C8D8F1C7EC4638956E5] - (.VIA - VIA HD Audio CPL.) -- C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe [1690224] [PID.2012]
[MD5.1B13227DB8271040CEB5128414EE2742] - (.Logitech Inc. - Logitech Webcam Software.) -- C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe [190808] [PID.2020]
[MD5.E774F875819DEE4A312A921A88F779FE] - (.Microsoft Corporation - IPoint.exe.) -- C:\Program Files\Microsoft IntelliPoint\ipoint.exe [1821576] [PID.2036]
[MD5.CFE4BD7C25A750D71A5BD2390953BEB6] - (.Microsoft Corporation - IType.exe.) -- C:\Program Files\Microsoft IntelliType Pro\itype.exe [1313640] [PID.2044]
[MD5.D63797E8E7781EE1500A810CB6194FA6] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816] [PID.316]
[MD5.DB3F7F19F942D3CE4E1A0E8D9FF541FB] - (.Avira Operations GmbH & Co. KG - Avira System Tray Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192] [PID.320]
[MD5.468FE7A9CC68870F7D59A0AB08316374] - (.APN - Ask Toolbar Notifier.) -- C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1603024] [PID.328] =>Toolbar.Ask
[MD5.197C93BA7B3BC1B6A0FDF3E4C4C77239] - (.Tencent Inc. - Internet Mail Client.) -- C:\Program Files\Foxmail\Foxmail.exe [7403336] [PID.372] =>Adware.TencentAddressBar
[MD5.3647D444D0A674EA494D43AC78D98D84] - (...) -- C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe [203096] [PID.1888]
[MD5.C861851A0BBD9903E324487011AA3705] - (.Advanced Micro Devices Inc. - Catalyst Control Center: Monitoring program.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [299008] [PID.364]
[MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.2264]
[MD5.8EA4AAF03CE0D00CB91FCEE88909E2E9] - (...) -- C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe [687448] [PID.2428]
[MD5.D28C5A1411BB0B47E05E0D6AAF896690] - (.ATI Technologies Inc. - Catalyst Control Center: Host application.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [299008] [PID.3348]
[MD5.B6624D1D446A9683BAF8E482B1774C05] - (.Glarysoft Ltd - Glary Utilities 3.) -- C:\Program Files\Glary Utilities 3\Integrator.exe [470816] [PID.3432]
[MD5.C77C6AEA775F70C7EE39E88FDE408C3F] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7968256] [PID.164]
~ Processes Running: Scanned in 00mn 00s



---\\ Google Chrome, D�marrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Moulis\AppData\Local\Google\Chrome\User Data\Default\Preferences
G1 - GCS: Preference [User Data\Default] http://www.google.com
G2 - GCE: Preference [User Data\Default] [aaaaacalgebmfelllfiaoknifldpngjh] Avira SearchFree Toolbar plus Web Protection v.22.57772, (Activ�) =>Toolbar.Avira
~ Google Browser: 9 Legitimates Filtered in 00mn 13s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Moulis\AppData\Roaming\Mozilla\Firefox\Profiles\x2vbk9z4.default\prefs.js
M3 - MFPP: Plugins - [Moulis] -- C:\Users\Moulis\AppData\Roaming\Mozilla\Firefox\Profiles\x2vbk9z4.default\searchplugins\01netcom-customized-web-search.xml =>Toolbar.Conduit
M3 - MFPP: Plugins - [Moulis] -- C:\Users\Moulis\AppData\Roaming\Mozilla\Firefox\Profiles\x2vbk9z4.default\searchplugins\ask-search.xml
M3 - MFPP: Plugins - [Moulis] -- C:\Users\Moulis\AppData\Roaming\Mozilla\Firefox\Profiles\x2vbk9z4.default\searchplugins\askcom.xml
M0 - MFSP: prefs.js [Moulis - x2vbk9z4.default] http://twitter.com
M2 - MFEP: prefs.js [Moulis - x2vbk9z4.default\newtaburl@sogame.cat] [] NewTabURL v2.2.3 (..)
M2 - MFEP: prefs.js [Moulis - x2vbk9z4.default\NPCamfrogWeb@camfrogweb.com] [] Camfrog Web Plugin for Mozilla Firefox v2,0,12,93 (..)
P2 - FPN: [HKLM] [@camfrogweb.com/Camfrog Web Plugin,version=2,0] - (.Camshare Inc. - Camfrog Web FF Plugin ver:2,0,11,91.) -- C:\Program Files\CFWebAdvancedU2\npcamfrogweb.dll
~ Firefox Browser: 42 Legitimates Filtered in 00mn 02s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:21320
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Avira SearchFree Toolbar - [HKLM]{41564952-412D-5637-00A7-7A786E7484D7} . (.APN LLC. - Passport.) -- C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll =>Toolbar.Avira
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{D4027C7F-154A-4066-A1AD-4243D8127440} Cl� orpheline
~ Toolbar: Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: CanoScan Toolbox 4.9.lnk . (.CANON INC. - CanoScan Toolbox Application.) -- C:\Program Files\Canon\CanoScan Toolbox Ver4.9\CSTBox.exe
O4 - GS\Desktop [Public]: CyberGhost VPN.lnk . (.CyberGhost SRL - CyberGhost VPN Client.) -- C:\Program Files\S.A.D\CyberGhost VPN\CyberGhost.exe
O4 - GS\Desktop [Public]: FotoSketcher.lnk . (...) -- C:\Program Files\FotoSketcher\FotoSketcher.exe
O4 - GS\Desktop [Public]: Geeks Toy (Betfair).lnk . (...) -- C:\Windows\Installer\{89AE2E7A-9CFF-49EF-AF4A-4BB576773510}\_481FEA06F5B3F6C218BF1B.exe
O4 - GS\Desktop [Public]: HD VDeck.lnk . (.VIA - VIA HD Audio CPL.) -- C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe
O4 - GS\Desktop [Public]: Logitech Vid HD.lnk . (.Logitech Inc. - Logitech Vid HD.) -- C:\Program Files\Logitech\Vid HD\Vid.exe
O4 - GS\Desktop [Public]: Logitech Webcam Software .lnk . (...) -- C:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\HelpMain\launchershortcut.exe
O4 - GS\Desktop [Public]: TweetAdder4.lnk . (.TweetAdder.com - Pas de description.) -- C:\Program Files\TweetAdder4\TweetAdder4.exe
O4 - GS\Desktop [Public]: Vuze.lnk . (.Vuze Inc. - Pas de description.) -- C:\Program Files\Vuze\Azureus.exe =>P2P.Azureus
O4 - GS\Program [Public]: AGT Pro - Betfair.lnk . (...) -- C:\Windows\Installer\{89AE2E7A-9CFF-49EF-AF4A-4BB576773510}\_1AC6F02744B1B77B4B8B3F.exe
O4 - GS\Program [Public]: HD VDeck.lnk . (.VIA - VIA HD Audio CPL.) -- C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe
O4 - GS\Program [Public]: Spybot-S&D Start Center.lnk . (.Safer-Networking Ltd. - Start Center.) -- C:\Program Files\Spybot - Search & Destroy 2\SDWelcome.exe
O4 - GS\Program [Public]: Vuze.lnk . (.Vuze Inc. - Pas de description.) -- C:\Program Files\Vuze\Azureus.exe =>P2P.Azureus
O4 - GS\QuickLaunch [Moulis]: VDownloader.lnk . (.Vitzo - VDownloader.) -- C:\Program Files\VDownloader\VDownloader.exe
O4 - GS\QuickLaunch [Moulis]: Vuze.lnk . (.Vuze Inc. - Pas de description.) -- C:\Program Files\Vuze\Azureus.exe =>P2P.Azureus
O4 - GS\TaskBar [Moulis]: firefox - Raccourci.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O4 - GS\Program [Moulis]: Windows Install Clean Up.lnk . (...) -- C:\Users\Moulis\AppData\Roaming\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
O4 - GS\SendTo [Moulis]: Foxmail.LNK . (.Tencent Inc. - Internet Mail Client.) -- C:\Program Files\Foxmail\Foxmail.exe =>Adware.TencentAddressBar
O4 - GS\Desktop [Moulis]: ask1 - Raccourci.lnk . (...) -- C:\Users\Moulis\Desktop\Ask\ask1.txt
O4 - GS\Desktop [Moulis]: Foxmail.lnk . (.Tencent Inc. - Internet Mail Client.) -- C:\Program Files\Foxmail\Foxmail.exe =>Adware.TencentAddressBar
O4 - GS\Desktop [Moulis]: JAP.lnk . (.JAP-Team - A native launcher for JAP/JonDo.) -- C:\Program Files\JAP\jap.exe
O4 - GS\Desktop [Moulis]: Radio Fr Solo.lnk . (...) -- C:\Program Files\Radio Fr Solo\Radio_Fr_Solo.exe
O4 - GS\Desktop [Moulis]: T�l�chargements - Raccourci.lnk . (...) -- C:\Users\Moulis\Downloads
O4 - GS\Desktop [Moulis]: Vivitar Experience Image Manager.lnk . (.Hyperlync Technologies - HubManager.) -- C:\Program Files\Vivitar Experience Image Manager\Vivitar.exe
~ Global Startup: 91 Legitimates Filtered in 00mn 14s



---\\ Applications lanc�es au d�marrage du syt�me (O4)
O4 - HKLM\..\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst� Control Center Launcher.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [HDAudDeck] . (.VIA - VIA HD Audio CPL.) -- C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe
O4 - HKLM\..\Run: [LWS] . (.Logitech Inc. - Logitech Webcam Software.) -- C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
O4 - HKLM\..\Run: [IntelliPoint] . (.Microsoft Corporation - IPoint.exe.) -- c:\Program Files\Microsoft IntelliPoint\ipoint.exe
O4 - HKLM\..\Run: [itype] . (.Microsoft Corporation - IType.exe.) -- c:\Program Files\Microsoft IntelliType Pro\itype.exe
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] . (.Adobe Systems Incorporated - Adobe Updater Startup Utility.) -- C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe
O4 - HKLM\..\Run: [SwitchBoard] . (.Adobe Systems Incorporated - SwitchBoard Server (32 bit).) -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] . (.Adobe Systems Incorporated - Adobe CS6 Service Manager.) -- C:\Program Files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe
O4 - HKLM\..\Run: [avgnt] . (.Avira Operations GmbH & Co. KG - Avira System Tray Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
O4 - HKLM\..\Run: [ApnTBMon] . (.APN - Ask Toolbar Notifier.) -- C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe =>Toolbar.Ask
O4 - HKCU\..\Run: [Foxmail] . (.Tencent Inc. - Internet Mail Client.) -- C:\Program Files\Foxmail\Foxmail.exe =>Adware.TencentAddressBar
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-21-2266754613-444198248-96935908-1000\..\Run: [Foxmail] . (.Tencent Inc. - Internet Mail Client.) -- C:\Program Files\Foxmail\Foxmail.exe =>Adware.TencentAddressBar
O4 - HKUS\S-1-5-21-2266754613-444198248-96935908-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
~ Application: Scanned in 00mn 00s



---\\ Boutons situ�s sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} . (.Microsoft Corporation - Windows Live Messenger Companion core resources.) -- C:\Program Files\Windows Live\Companion\companionres.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} . (.Microsoft Corporation - Windows Live Writer Blog This Extension.) -- C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Site dans la Zone de confiance d'Internet Explorer (O15)
O15 - Trusted Zone: [HKCU\...\Domains] *.chat-land.com =>Hijacker.ChercheUS
O15 - Trusted Zone: [HKCU\...\Domains] *.chat-land.net =>Hijacker.ChercheUS
O15 - Trusted Zone: [HKCU\...\Domains] *.search-web.net
~ IE Zone Confiance: Scanned in 00mn 00s



---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} ((no name)) - http://liveupdate.msi.com.tw/autobios/LOnline/RELEASECAB/install.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} ((no name)) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_5_1_2_1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} ((no name)) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} ((no name)) - http://www.bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe
~ Objets ActiveX: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{C51AF8FE-BAF5-4B20-96A0-B249A8037FEF}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CS1\Services\Tcpip\..\{C51AF8FE-BAF5-4B20-96A0-B249A8037FEF}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CS2\Services\Tcpip\..\{C51AF8FE-BAF5-4B20-96A0-B249A8037FEF}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.240 212.27.40.241
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (.Microsoft Corporation - Windows Live Album Download Protocol Handle.) -- C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter: application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-cl�s Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: SDWinLogon . (...) -- SDWinLogon.dll
~ Winlogon: Scanned in 00mn 00s



---\\ Liste des services NT non Microsoft et non d�sactiv�s (O23)
O23 - Service: Service de mise � jour Ask (APNMCP) . (.APN LLC. - APN Updater.) - C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) . (.Safer-Networking Ltd. - Windows Security Center integration..) - C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: (UMVPFSrv) . (.Logitech Inc. - Logitech User mode UMVPF service.) - C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
~ Services: 16 Legitimates Filtered in 00mn 04s



---\\ Enum�re les donn�es de BootExecute (BEX) (O34)
O34 - HKLM BootExecute: (autocheck autochk * ) - File not found
O34 - HKLM BootExecute: (BootDefrag.exe) - File not found
~ BEX: 3 Legitimates Filtered in 00mn 00s



---\\ T�ches planifi�es en automatique (O39)
[MD5.08AAAA18BD9EEDE8B5648A479EC1432F] [APT] [{116E7D0B-317B-45F7-97EB-5AEE970AC5D6}] (...) -- C:\Users\Moulis\Downloads\xiph_player_plugins_0.7.exe [203115]
[MD5.00000000000000000000000000000000] [APT] [{F2950332-A0C5-41F8-80CF-0A1AF279A1EB}] (...) -- C:\Users\Moulis\AppData\Local\Temp\Temp1_SAGEM-Fast800-A_4_8.zip\setup.exe (.not file.) [0]
~ Scheduled Task: 22 Legitimates Filtered in 00mn 04s



---\\ Logiciels install�s (O42)
O42 - Logiciel: AGT Pro - Betfair - (.The Geek.) [HKLM] -- {89AE2E7A-9CFF-49EF-AF4A-4BB576773510}
O42 - Logiciel: JAP - (.JAP-Team.) [HKLM] -- JAP
O42 - Logiciel: Orban/Coding Technologies AAC/aacPlus Player Plugin� 1.0 - (.Orban, Inc..) [HKLM] -- {DB0A8A2A-4EA7-4FE3-802E-8A6DEE32696C}_is1
O42 - Logiciel: Tweet Adder 3 - (.TweetAdder.com.) [HKLM] -- {BBBA179E-593A-46CB-8915-669E7A7F6076}
O42 - Logiciel: TweetAdder4 - (.TweetAdder.com.) [HKLM] -- {911174C5-85BF-4972-B5E0-4882B32E9396}_is1
O42 - Logiciel: Vivitar Experience Image Manager - (.Sakar.) [HKLM] -- Vivitar Experience Image Manager
~ Logic: 122 Legitimates Filtered in 00mn 00s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\AskPartnerNetwork]
[HKCU\Software\TFFP Package]
[HKCU\Software\The Geek]
[HKCU\Software\YahooPartnerToolbar] =>Toolbar.Yahoo
[HKLM\Software\AskPartnerNetwork]
~ Key Software: 198 Legitimates Filtered in 00mn 00s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 14/09/2013 - 19:39:26 - [5,149] ----D C:\Program Files\Ask.com
O43 - CFD: 14/09/2013 - 02:03:25 - [9,281] ----D C:\Program Files\AskPartnerNetwork
O43 - CFD: 08/07/2011 - 13:40:04 - [0,820] ----D C:\Program Files\ChangeWallpaper
O43 - CFD: 26/01/2012 - 17:50:50 - [12,662] ----D C:\Program Files\JAP
O43 - CFD: 26/04/2011 - 09:40:40 - [1,875] ----D C:\Program Files\Orban
O43 - CFD: 13/04/2012 - 16:29:21 - [20,715] ----D C:\Program Files\The Geek
O43 - CFD: 27/03/2013 - 11:25:43 - [14,844] ----D C:\Program Files\Tweet Adder 3
O43 - CFD: 15/08/2013 - 22:59:58 - [22,252] ----D C:\Program Files\TweetAdder4
O43 - CFD: 28/06/2012 - 20:15:03 - [120,223] ----D C:\Program Files\Vivitar Experience Image Manager
O43 - CFD: 18/04/2011 - 00:38:54 - [8,354] ----D C:\ProgramData\AGeeksToy
O43 - CFD: 14/09/2013 - 00:46:45 - [0] ----D C:\ProgramData\APN
O43 - CFD: 14/09/2013 - 02:03:25 - [1,488] ----D C:\ProgramData\AskPartnerNetwork
O43 - CFD: 28/06/2012 - 20:15:33 - [0,000] ----D C:\ProgramData\Vivitar
O43 - CFD: 26/01/2012 - 18:39:53 - [0,000] ----D C:\Users\Moulis\AppData\Roaming\AirVPN
O43 - CFD: 16/12/2012 - 18:53:47 - [0] ----D C:\Users\Moulis\AppData\Roaming\TweetAdder.com
O43 - CFD: 07/09/2013 - 18:52:05 - [6,030] ----D C:\Users\Moulis\AppData\Roaming\TweetAdder3
O43 - CFD: 04/05/2013 - 18:36:06 - [0,187] ----D C:\Users\Moulis\AppData\Local\APN
O43 - CFD: 28/06/2012 - 20:33:23 - [4,748] ----D C:\Users\Moulis\AppData\Local\Vivitar Experience Image Manager
O43 - CFD: 26/01/2012 - 17:50:50 - [0] ----D C:\Users\Moulis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JAP
O43 - CFD: 28/06/2012 - 20:15:33 - [0,003] ----D C:\Users\Moulis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Vivitar Experience Image Manager
~ 831 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 1096 Legitimates Filtered in 00mn 53s



---\\ Derniers fichiers modifi�s ou cr�es sous Windows et System32 (O44)
O44 - LFC:[MD5.2332DE089F89447B9DB50D9506B5D0AA] - 17/09/2013 - 22:40:37 ---A- . (...) -- C:\PhysicalMBR.bin [512]
O44 - LFC:[MD5.DC0F33BE0FBE4B64704732EE81CBDD42] - 17/09/2013 - 17:55:08 ---A- . (...) -- C:\Windows\System32\cc_20130917_185457.reg [398]
O44 - LFC:[MD5.396A47DA443416D4B1B03744D9554172] - 16/09/2013 - 16:30:31 ---A- . (...) -- C:\DiskDefrag.log [75]
O44 - LFC:[MD5.8EFADCE50A2CE2A3A1AE713455896540] - 16/09/2013 - 15:38:32 ---A- . (...) -- C:\Windows\System32\cc_20130916_163826.reg [2146]
O44 - LFC:[MD5.106B67AD9B49597FF731281640878D87] - 16/09/2013 - 15:38:10 ---A- . (...) -- C:\Windows\System32\cc_20130916_163655.reg [191610]
O44 - LFC:[MD5.04FA1A41069E5E936F45E9F6373DECF5] - 11/09/2013 - 23:54:59 ---A- . (...) -- C:\Windows\System32\???y [97181529]
~ Files: 79 Legitimates Filtered in 01mn 09s



---\\ Cl� de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{5b85a279-6844-11e0-acef-806e6f6e6963}\AutoRun\command. (...) -- D:\autorun.exe (.not file.)
~ Keys: Scanned in 00mn 00s



---\\ Enum�ration des cl�s de registre StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\ChangeWallpaper [Key] . (.T. Vacher - Logiciel de gestion de fond d'�crans � th�m.) -- C:\Program Files\ChangeWallpaper\ChangeWallpaper.exe
O53 - SMSR:HKLM\...\startupreg\openvpn-gui [Key] . (...) -- C:\Program Files\UltraVPN\bin\openvpn-gui.exe
~ SMSR Keys: 10 Legitimates Filtered in 00mn 00s



---\\ Enum�ration des cl�s de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du syst�me (SDL) (O58)
O58 - SDL:[MD5.0ED67910C8C326796FAA00B2BF6D9D3C] - 14/07/2009 - 02:20:28 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [453712]
O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 13/07/2009 - 22:40:41 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029]
~ Drivers: 16 Legitimates Filtered in 00mn 00s



---\\ Liste des outils de d�sinfection (LATC) (O63)
O63 - Logiciel: OTL - (.OldTimer.)
O63 - Logiciel: RSIT - (.random/random.)
~ ADS: Scanned in 00mn 00s



---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 02/01/1601 - Pas de propri�taire (BootDefragDriver) .(...) - LEGACY_BOOTDEFRAGDRIVER
~ Legacy: 78 Legitimates Filtered in 00mn 00s



---\\ Menu de d�marrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: C:\Users\Moulis\AppData\Roaming\Mozilla\Firefox\Profiles\x2vbk9z4.default\searchplugins\askcom.xml
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {9A82CDA6-A228-4E21-9CCD-C5C552E52FC7} - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {BD766527-4E49-40B7-91CF-01806D0D04EC} [DefaultScope] - (Ask Search) - http://websearch.ask.com =>Toolbar.Ask
~ Keys: Scanned in 00mn 00s



---\\ Recherche particuli�re � la racine du syst�me (SPRF) (O84)
[MD5.B28C334C03CEE7C5E829C43AE75DAE5A] [SPRF][28/01/2013] (.Ask.com - AskIC Dynamic Link Library.) -- C:\Users\Moulis\AppData\Local\Temp\AskSLib.dll [248008]
[MD5.08AF557C8E6E74D7D92314F6B2C86273] [SPRF][12/09/2013] (...) -- C:\Users\Moulis\AppData\Local\Temp\i4jdel0.exe [4608]
[MD5.C7C92C88CAC832CCB382526447C7BC09] [SPRF][18/04/2013] (.Spotify Ltd - Spotify.) -- C:\Users\Moulis\AppData\Local\Temp\SpotifyUninstall.exe [4555776]
[MD5.10FF523100F6826608225676DD385CCB] [SPRF][17/09/2013] (...) -- C:\Users\Moulis\AppData\Local\Temp\~gu3-ver.dat [95]
[MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][18/09/2013] (...) -- C:\Users\Moulis\AppData\Local\Temp\~upgrade.dat [0]
[MD5.E4B31B8CC2CEB446EE6A6003550FAAE4] [SPRF][08/08/2012] (...) -- C:\Windows\Downloaded Program Files\cfweb_www.bobtv.fr-download-v2_instmodule.exe [99936]
~ Files: 14 Legitimates Filtered in 00mn 01s



---\\ Enum�re les codes produits des logiciels (PUC) (O90)
O90 - PUC: "25946514D2147365007A7A857BC04000" . (.Avira SearchFree Toolbar.) -- C:\Windows\Installer\{41564952-412D-5637-00A7-A758B70C0400}\ToolbarIcon.exe =>Toolbar.Avira
O90 - PUC: "E971ABBBA395BC64985166E9A7F70667" . (.Tweet Adder 3.) -- C:\Windows\Installer\{BBBA179E-593A-46CB-8915-669E7A7F6076}\controlPanelIcon.exe
~ Update Products: 99 Legitimates Filtered in 00mn 00s



---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.637BBA15100B11CB56EE8C5D38EA97E4] [WIS][12/09/2013] (.APN, LLC - Avira SearchFree Toolbar.) -- C:\Windows\Installer\1121cb.msi [765952] =>Toolbar.Avira
[MD5.93A7E8249FABC3F6635C58BD384E75B8] [WIS][27/03/2013] (.TweetAdder.com - Tweet Adder 3.) -- C:\Windows\Installer\55f0f2.msi [487424]
~ WIS: 106 Legitimates Filtered in 00mn 11s



---\\ Etat g�n�ral des services not Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 10/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 14/09/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 09/03/2011 176128 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 09/03/2011 294400 | (AMD FUEL Service) . (.Advanced Micro Devices, Inc..) - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
SR - | Auto 17/06/2010 140224 | (AMD Reservation Manager) . (.Advanced Micro Devices.) - C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe
SR - | Auto 14/09/2013 84024 | (AntiVirSchedulerService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\sched.exe
SR - | Auto 14/09/2013 108088 | (AntiVirService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
SR - | Auto 14/09/2013 815160 | (AntiVirWebService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.exe
SR - | Auto 12/09/2013 164816 | (APNMCP) . (.APN LLC..) - C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
SS - | Demand 26/04/2012 2438696 | (CGVPNCliSrvc) . (.mobile concepts GmbH.) - C:\Program Files\S.A.D\CyberGhost VPN\CGVPNCliService.exe
SS - | Auto 04/05/2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 04/05/2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 12/04/2011 311744 | (maconfservice) . (.CybelSoft.) - C:\Program Files\ma-config.com\maconfservice.exe
SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
SS - | Demand 05/02/2013 235216 | (McComponentHostService) . (.McAfee, Inc..) - C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe
SS - | Demand 17/08/2013 117656 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Demand 01/07/2011 14848 | (OpenVPNService) . (...) - C:\Program Files\OpenVPN\bin\openvpnserv.exe
SS - | Auto 16/05/2013 1817560 | (SDScannerService) . (.Safer-Networking Ltd..) - C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
SS - | Auto 16/05/2013 1033688 | (SDUpdateService) . (.Safer-Networking Ltd..) - C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
SR - | Auto 15/05/2013 171928 | (SDWSCService) . (.Safer-Networking Ltd..) - C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
SS - | Auto 21/06/2013 162408 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe
SS - | Demand 19/02/2010 517096 | (SwitchBoard) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
SR - | Auto 01/04/2011 428640 | (UMVPFSrv) . (.Logitech Inc..) - C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
SR - | Auto 14/07/2009 20992 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 14/07/2009 20992 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 13s



---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by Moulis at 18/09/2013 19:17:32

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
1 ntkrnlpa!IofCallDriver[0x82A54BBA] >> \Device\Harddisk0\DR0[0x85465030]
kernel: MBR read successfully
user & kernel MBR OK
~ MBR: 13 Legitimates Filtered in 00mn 02s



---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Moulis at 18/09/2013 19:17:34

********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 04s



---\\ Scan Additionnel (O88)
Database Version : 12920 - (17/09/2013)
Cl�s trouv�es (Keys found) : 16
Valeurs trouv�es (Values found) : 4
Dossiers trouv�s (Folders found) : 3
Fichiers trouv�s (Files found) : 8

[HKLM\Software\Google\Chrome\Extensions\aaaaacalgebmfelllfiaoknifldpngjh] =>Toolbar.Avira^
[HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\HssSrv] =>Toolbar.Agent
[HKLM\Software\Classes\ScriptHost.Tool.1] =>Toolbar.Agent
[HKLM\Software\Classes\ScriptHost.Tool] =>Toolbar.Agent
[HKLM\Software\Classes\CLSID\{26249267-15F4-4DA3-8247-C5A78E4FA918}] =>Toolbar.Ask
[HKLM\Software\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}] =>Toolbar.Ask
[HKLM\Software\Classes\CLSID\{061F450C-37B9-4330-9235-0F25D9F75B33}] =>Toolbar.Ask
[HKLM\Software\Classes\Interface\{061F450C-37B9-4330-9235-0F25D9F75B33}] =>Toolbar.Ask
[HKLM\Software\Classes\CLSID\{05366194-3126-4601-AC1A-DDE573E093DC}] =>Toolbar.Ask
[HKLM\Software\Classes\AppID\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}] =>Toolbar.Ask
[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}] =>Toolbar.Ask
[HKLM\Software\Classes\AppID\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}] =>Toolbar.Ask
[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}] =>Toolbar.Ask
[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F}] =>Toolbar.Ask
[HKCU\Software\AskPartnerNetwork] =>Toolbar.Ask
[HKLM\Software\AskPartnerNetwork] =>Toolbar.Ask
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{41564952-412D-5637-00A7-7A786E7484D7} =>Toolbar.Avira^
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:ApnTBMon =>Toolbar.Ask^
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:Foxmail =>Adware.TencentAddressBar^
[HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]:{D4027C7F-154A-4066-A1AD-4243D8127440} =>Toolbar.Avira
C:\Program Files\Ask.com =>Toolbar.AskBar
C:\Program Files\AskPartnerNetwork =>Toolbar.Ask
C:\ProgramData\AskPartnerNetwork =>Toolbar.Ask
C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe =>Toolbar.Ask^
C:\Program Files\Foxmail\Foxmail.exe =>Adware.TencentAddressBar^
C:\Users\Moulis\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaacalgebmfelllfiaoknifldpngjh =>Toolbar.Avira^
C:\Users\Moulis\AppData\Roaming\Mozilla\Firefox\Profiles\x2vbk9z4.default\searchplugins\01netcom-customized-web-search.xml =>Toolbar.Conduit^
C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll =>Toolbar.Avira^
[HKCU\Software\YahooPartnerToolbar] =>Toolbar.Yahoo^
C:\Windows\Installer\{41564952-412D-5637-00A7-A758B70C0400}\ToolbarIcon.exe =>Toolbar.Avira^
C:\Windows\Installer\1121cb.msi =>Toolbar.Avira^
~ Additionnel Scan: 232051 Items scanned in 00mn 20s



---\\ R�capitulatif des d�tections trouv�es sur votre station
~ http://nicolascoolman.webs.com/apps/blog/show/28927746-toolbar-ask =>Toolbar.Ask
~ http://nicolascoolman.webs.com/apps/blog/show/27668065-adware-tencentaddressbar =>Adware.TencentAddressBar
~ http://nicolascoolman.webs.com/apps/blog/show/28419247-toolbar-avira =>Toolbar.Avira
~ http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit
~ http://nicolascoolman.webs.com/apps/blog/show/26609108-hijacker-chercheus =>Hijacker.ChercheUS
~ http://nicolascoolman.webs.com/apps/blog/show/30268689-toolbar-yahoo =>Toolbar.Yahoo
~ MSI: 6 link(s) detected in 00mn 20s



~ 2130 Legitimates filtered by white list
End of the scan (568 lines in 04mn 20s)(0)

Publicité


Signaler le contenu de ce document

Publicité