cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

~ Rapport de ZHPDiag v2014.1.17.18 - Nicolas Coolman (17/01/2014)
~ Lancé par Administrateur (19/01/2014 17:36:07)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Not Found


---\\ Navigateurs Internet
MSIE: Internet Explorer v8.0.6001.18702
MFIE: Mozilla Firefox 26.0 (Defaut)
GCIE: Google Chrome

---\\ Informations sur les produits Windows
~ Langage: Français
Microsoft Windows XP, 32-bit Service Pack 3 (Build 2600)
Windows Automatic Updates : OK
Windows Genuine Advantage : KO

---\\ Logiciels de protection du système
Emsisoft Anti-Malware

---\\ Logiciels d'optimisation du système
CCleaner v4.06 =>Piriform Ltd

---\\ Logiciels de partage PeerToPeer
Pando Media Booster v2.6.0.7

---\\ Surveillance de Logiciels
Adobe Flash Player 11 Plugin
Adobe Reader 9 - Français
Java 7 Update 45

---\\ Informations sur le système
~ Processor: x86 Family 6 Model 10 Stepping 0, AuthenticAMD
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1023 MB (31% free)
System Restore: Activé (Enable)
System drive C: has 19 GB (52%) free of 37 GB

---\\ Mode de connexion au système
~ Computer Name: TECHNI-AMECO-PC
~ User Name: Administrateur
~ All Users Names: HelpAssistant, ASPNET, Administrateur,
~ Unselected Option: O45,O61
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : \ZHP\
~ %AppData% : \
~ %Desktop% : \
~ %Favorites% : \
~ %LocalAppData% : \
~ %StartMenu% : \
~ %Windir% : C:\WINDOWS\
~ %System% : C:\WINDOWS\system32\

---\\ Enumération des unités disques
A: Floppy drive, Flash card reader, USB Key (Not Inserted)
C: Hard drive, Flash drive, Thumb drive (Free 19 Go of 37 Go)
D: Hard drive, Flash drive, Thumb drive (Free 3 Go of 76 Go)
E: CD-ROM drive (Not Inserted)
F: CD-ROM drive (Not Inserted)



---\\ Etat du Centre de Sécurité Windows
~ Security Center: 45 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.D84567752FB42D8DC55CFB85FE0EDECE] - (.Microsoft Corporation - Explorateur Windows.) (.12/01/2010 - 05:24:34.) -- C:\WINDOWS\Explorer.exe [1916416]
[MD5.897CA9DA6F568E24549719D5676385A1] - (.Microsoft Corporation - Internet Extensions for Win32.) (.29/10/2013 - 07:57:02.) -- C:\WINDOWS\system32\wininet.dll [920064]
[MD5.AE0D48AF37F5A48156D4A6BAE07C9121] - (.Microsoft Corporation - Application d'ouverture de session Windows NT.) (.12/01/2010 - 05:24:34.) -- C:\WINDOWS\system32\Winlogon.exe [568320]
[MD5.1E44BC1E83D8FD2305F8D452DB109CF9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.17/08/2011 - 13:49:54.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496]
[MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.12/01/2010 - 05:24:34.) -- C:\WINDOWS\system32\Drivers\atapi.sys [96512]
[MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.12/01/2010 - 05:24:34.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744]
[MD5.1F4260CC5B42272D71F79E570A27A4FE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.12/01/2010 - 05:24:34.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [62976]
[MD5.31F923EB2170FC172C81ABDA0045D18C] - (.Microsoft Corporation - Pilote de cryptographie FIPS.) (.12/01/2010 - 05:24:34.) -- C:\WINDOWS\system32\Drivers\Fips.sys [44672]
[MD5.573C7D0A32852B48F3058CFD8026F511] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.12/01/2010 - 05:24:34.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [144384]
[MD5.A09BDC4ED10E3B2E0EC27BB94AF32516] - (.Microsoft Corporation - Pilote de port i8042.) (.12/01/2010 - 05:24:34.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [54144]
[MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.12/01/2010 - 05:24:34.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [42112]
[MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.12/01/2010 - 05:24:34.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [152832]
[MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.12/01/2010 - 05:24:34.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [75264]
[MD5.7D304A5EB4344EBEEAB53A2FE3FFB9F0] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.15/07/2011 - 13:29:31.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [456320]
[MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.12/01/2010 - 05:24:34.) -- C:\WINDOWS\system32\Drivers\netBT.sys [162816]
[MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.12/01/2010 - 05:24:34.) -- C:\WINDOWS\system32\Drivers\ntfs.sys [574976]
[MD5.8FD0BDBEA875D06CCF6C945CA9ABAF75] - (.Microsoft Corporation - Pilote de port parallèle.) (.12/01/2010 - 05:24:34.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80384]
[MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.12/01/2010 - 05:24:34.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328]
[MD5.15CABD0F7C00C47C70124907916AF3F1] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.13/04/2008 - 07:32:52.) -- C:\WINDOWS\system32\Drivers\rdpdr.sys [196224]
[MD5.D8EB2A7904DB6C916EB5361878DDCBAE] - (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) (.13/04/2008 - 16:57:36.) -- C:\WINDOWS\system32\Drivers\redbook.sys [58752]
~ Generic Processes: Scanned in 00mn 02s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 0/0
~ Mes musiques (My Musics) : 0/0
~ Mes Videos (My Videos) : 0/0
~ Mes Favoris (My Favorites) : 0/0
~ Mes Documents (My Documents) : 0/0
~ Mon Bureau (My Desktop) : 0/0
~ Menu demarrer (Programs) : 0/0
~ Hidden Files: Scanned in 00mn 00s



---\\ Processus lancés
[MD5.A2EAEB497CA29ECAEAF0DF66AD85C57D] - (.ATI Technologies Inc. - ATI External Event Utility EXE Module.) -- C:\WINDOWS\system32\Ati2evxx.exe [413696] [PID.1976]
[MD5.BA5AD7EFD58FA965534BFFFC534CF571] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8336896] [PID.1436]
~ Processes Running: Scanned in 00mn 01s



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Pando Networks - Pando Web Plugin.) (No version) -- (.not file.)
~ IE Browser: 12 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\WINDOWS\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 0



---\\ Autres liens utilisateurs (O4)
O4 - GS\Program [AllUsers]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
~ Global Startup: 3 Legitimates Filtered in 00mn 00s



---\\ Applications lancées au démarrage du sytème (O4)
O4 - GS\Program [AllUsers]: Adobe Gamma Loader.lnk . (.Adobe Systems, Inc. - Adobe Gamma Loader.) -- C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - HKLM\..\Run: [SoundMan] . (.Realtek Semiconductor Corp. - Realtek Sound Manager.) -- C:\WINDOWS\SOUNDMAN.exe
O4 - HKLM\..\Run: [VistaDrive] . (...) -- C:\WINDOWS\VistaDrive\VistaDrive.exe
O4 - HKLM\..\Run: [MSConfig] . (.Microsoft Corporation - Utilitaire de configuration système.) -- C:\WINDOWS\system32\msconfig.exe
O4 - HKLM\..\Run: [egui] . (.ESET - ESET Main GUI.) -- C:\Program Files\ESET\ESET Smart Security\egui.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\.DEFAULT\..\Run: [RocketDock] . (...) -- C:\Program Files\RocketDock\RocketDock.exe
O4 - HKUS\.DEFAULT\..\Run: [VisualTaskTip] Clé orpheline
O4 - HKUS\S-1-5-18\..\Run: [RocketDock] . (...) -- C:\Program Files\RocketDock\RocketDock.exe
O4 - HKUS\S-1-5-18\..\Run: [VisualTaskTip] Clé orpheline
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] Clé orpheline
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] Clé orpheline
O4 - HKUS\S-1-5-21-1292428093-1592454029-1801674531-500\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
~ Application: Scanned in 00mn 06s



---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -- Clé orpheline
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{7F1F4FAB-2DD8-435E-A530-06B9B13AE6D7}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{7F1F4FAB-2DD8-435E-A530-06B9B13AE6D7}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} . (.Microsoft Corporation - WIA Scripting Layer.) -- C:\WINDOWS\system32\wiascr.dll
O18 - Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} . (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS\system32\SHELL32.dll
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: AtiExtEvent . (.ATI Technologies Inc. - ATI External Event Utility DLL Module.) -- C:\WINDOWS\system32\Ati2evxx.dll
O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dll
O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dll
O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agent réseau hors connexion.) -- C:\WINDOWS\system32\cscdll.dll
O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\system32\dimsntfy.dll
O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL secondaire de notification de service d.) -- C:\WINDOWS\system32\sclgntfy.dll
O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\WlNotify.dll
O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: WBSrv . (.Stardock - WBSrv.dll.) -- C:\Program Files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll
O20 - Winlogon Notify: WgaLogon . (.Microsoft Corporation - Windows Genuine Advantage Notification.) -- C:\WINDOWS\system32\WgaLogon.dll
O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll
~ Winlogon: Scanned in 00mn 01s



---\\ Tâches planifiées en automatique (O39)
[MD5.5DAF7081A4BB112FA3F1915819330A3E] [APT] [pv.exe ] (...) -- C:\Program Files\ZHPDiag\pv.exe [61440]
~ Scheduled Task: 3 Legitimates Filtered in 00mn 00s



---\\ Logiciels installés (O42)
O42 - Logiciel: Gadget Installer - (.VistaExperience.org.) [HKLM] -- {3F3733A5-8322-454D-A638-3B74E1C83752}
O42 - Logiciel: Patch PES6 to PES2014 - (...) [HKCU] -- Patch PES6 to PES2014
~ Logic: 16 Legitimates Filtered in 00mn 00s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\Pando Networks]
[HKLM\Software\Doug]
[HKLM\Software\NewTek]
[HKLM\Software\Pando Networks]
~ Key Software: 188 Legitimates Filtered in 00mn 00s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 13/10/2013 - 15:23:32 - [239,834] ----D C:\Program Files\ANGEL LOVE
O43 - CFD: 11/12/2013 - 19:40:39 - [848,481] ----D C:\Program Files\k
O43 - CFD: 11/01/2014 - 20:54:25 - [0] ----D C:\Program Files\NewTek
O43 - CFD: 14/12/2013 - 14:52:24 - [7,182] ----D C:\Program Files\Pando Networks
~ Program Folder: 75 Legitimates Filtered in 00mn 40s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.0E2D1F6633FD0CCC6006CBF3DA15FA1F] - 07/01/2014 - 12:11:45 ---A- . (...) -- C:\WINDOWS\Retafte.bmp [9522]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 16/01/2014 - 20:30:51 ---A- . (...) -- C:\WINDOWS\system32\Access.dat [0]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 17/01/2014 - 16:46:07 ---A- . (...) -- C:\WINDOWS\Sti_Trace.log [0]
O44 - LFC:[MD5.6C5B399AD3227EE8AB1B865D7853E726] - 17/01/2014 - 18:03:17 ---A- . (...) -- C:\WINDOWS\msxml4-KB954430-enu.LOG [315986]
O44 - LFC:[MD5.B24AE01A0BFA4858704ED7E030AD7747] - 17/01/2014 - 18:44:36 ---A- . (...) -- C:\WINDOWS\system32\TZLog.log [6734]
O44 - LFC:[MD5.1C9EF91C69527739750D9E5FFA014893] - 17/01/2014 - 19:00:51 ---A- . (...) -- C:\WINDOWS\wmsetup.log [1232]
O44 - LFC:[MD5.A1D028F64DD09DA78EC0484D8210F532] - 17/01/2014 - 19:44:36 ---A- . (...) -- C:\WINDOWS\ie8.log [124435]
O44 - LFC:[MD5.5A4AF2CF3BB15B5CD85A4CC7EBBD0A1B] - 17/01/2014 - 19:54:55 ---A- . (...) -- C:\WINDOWS\ie8_main.log [144654]
O44 - LFC:[MD5.77EC16F4A49BA289AAC3D3CF5E5E596E] - 17/01/2014 - 20:01:50 ---A- . (...) -- C:\WINDOWS\msmqinst.log [249006]
O44 - LFC:[MD5.827DA1B8D770701AE8FFF4734B1A075B] - 17/01/2014 - 20:01:53 ---A- . (...) -- C:\WINDOWS\ntdtcsetup.log [161482]
O44 - LFC:[MD5.4D8A2A313C2E92B102344228695AF484] - 17/01/2014 - 20:01:53 ---A- . (...) -- C:\WINDOWS\ocgen.log [530660]
O44 - LFC:[MD5.2E068BFA32136BCD1DB83A70C878430E] - 17/01/2014 - 20:01:53 ---A- . (...) -- C:\WINDOWS\tsoc.log [333250]
O44 - LFC:[MD5.6485478EAD61F413AEB0361D4DE6B0F0] - 17/01/2014 - 20:01:54 ---A- . (...) -- C:\WINDOWS\comsetup.log [266703]
O44 - LFC:[MD5.F4E7FE3F9279D6EB00A9D38BB4A50F87] - 17/01/2014 - 20:18:52 ---A- . (...) -- C:\WINDOWS\spupdsvc.log [8797]
O44 - LFC:[MD5.9224EB76C9EAC12F6DE5AB3279C535AE] - 18/01/2014 - 00:03:09 ---A- . (...) -- C:\WINDOWS\updspapi.log [95163]
~ Files: 168 Legitimates Filtered in 01mn 17s



---\\ Export de clé d'application autorisée (O47)
O47 - AAKE:Key Export SP - "C:\Program Files\Pando Networks\Media Booster\PMB.exe" [Enabled] .(..) -- C:\Program Files\Pando Networks\Media Booster\PMB.exe
O47 - AAKE:Key Export SP - "C:\Program Files\Garena Plus\ggdllhost.exe" [Enabled] .(..) -- C:\Program Files\Garena Plus\ggdllhost.exe
O47 - AAKE:Key Export DP - "C:\Program Files\Pando Networks\Media Booster\PMB.exe" [Enabled] .(..) -- C:\Program Files\Pando Networks\Media Booster\PMB.exe
~ Keys Export: 11 Legitimates Filtered in 00mn 02s



---\\ Contrôle du Safe Boot (CSB) (O49)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\CleanHlp.sys . (...) -- C:\WINDOWS\system32\Drivers\CleanHlp.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\CleanHlp.sys . (...) -- C:\WINDOWS\system32\Drivers\CleanHlp.sys (.not file.)
~ CSB: 23 Legitimates Filtered in 00mn 00s



---\\ Image File Execution Options (IFEO) (O50)
O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d
~ IFEO: Scanned in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoSMHelp"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoLowDiskSpaceChecks"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "MemCheckBoxInRunDlg"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoSMBalloonTip"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDesktopCleanupWizard"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoWelcomeScreen"=1
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoDesktopCleanupWizard"=1
~ MWPE Keys: 12 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.573C7D0A32852B48F3058CFD8026F511] - 12/01/2010 - 05:24:34 ---A- . (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) -- C:\WINDOWS\system32\Drivers\hdaudbus.sys [144384]
O58 - SDL:[MD5.80D317BD1C3DBC5D4FE7B1678C60CADD] - 12/01/2010 - 05:24:34 ---A- . (.Parallel Technologies, Inc. - Parallel Technologies DirectParallel IO Library.) -- C:\WINDOWS\system32\Drivers\ptilink.sys [17792]
O58 - SDL:[MD5.6D3ADA4CE95CECA7BCE527A08C4C474E] - 12/01/2010 - 05:24:34 ---A- . (...) -- C:\WINDOWS\system32\ansi.sys [9037]
O58 - SDL:[MD5.0FE9F16075C9ACB941C957B7C649176E] - 12/01/2010 - 05:24:34 ---A- . (...) -- C:\WINDOWS\system32\country.sys [27097]
O58 - SDL:[MD5.C6D29F29DE7427B1B0775E53E577B623] - 12/01/2010 - 05:24:34 ---A- . (...) -- C:\WINDOWS\system32\himem.sys [4912]
O58 - SDL:[MD5.582BCDD47CF4B68B5CB528F18E3CB808] - 12/01/2010 - 05:24:34 ---A- . (...) -- C:\WINDOWS\system32\key01.sys [42809]
O58 - SDL:[MD5.FBBCFEC1379C5C02D88A361993EDF1B8] - 12/01/2010 - 05:24:34 ---A- . (...) -- C:\WINDOWS\system32\keyboard.sys [42537]
O58 - SDL:[MD5.7D30A74B5FB9FE3B245A6CE5FBCD71D5] - 12/01/2010 - 05:24:34 ---A- . (...) -- C:\WINDOWS\system32\ntdos.sys [27916]
O58 - SDL:[MD5.CF9ED169FF86D935E47999E82359E898] - 12/01/2010 - 05:24:34 ---A- . (...) -- C:\WINDOWS\system32\ntdos404.sys [29146]
O58 - SDL:[MD5.03B945AC0481CD8BB161C3569D8ED1C3] - 12/01/2010 - 05:24:34 ---A- . (...) -- C:\WINDOWS\system32\ntdos411.sys [29370]
O58 - SDL:[MD5.BBC957DC18C17CC027EB80B7C77F2AEA] - 12/01/2010 - 05:24:34 ---A- . (...) -- C:\WINDOWS\system32\ntdos412.sys [29274]
O58 - SDL:[MD5.3CFFAEFFF23B0D208214A6D3061A5B1B] - 12/01/2010 - 05:24:34 ---A- . (...) -- C:\WINDOWS\system32\ntdos804.sys [29146]
O58 - SDL:[MD5.CAAA108FD7BF71989946B39704323455] - 12/01/2010 - 05:24:34 ---A- . (...) -- C:\WINDOWS\system32\ntio.sys [34000]
O58 - SDL:[MD5.6F73F50162DEF60C84B725C18CD9140F] - 12/01/2010 - 05:24:34 ---A- . (...) -- C:\WINDOWS\system32\ntio404.sys [34560]
O58 - SDL:[MD5.0FDD5E69C1FF3B58043D44F2CC743D45] - 12/01/2010 - 05:24:34 ---A- . (...) -- C:\WINDOWS\system32\ntio411.sys [35648]
O58 - SDL:[MD5.8842837C4D8311BF8E72BEE8CCC42217] - 12/01/2010 - 05:24:34 ---A- . (...) -- C:\WINDOWS\system32\ntio412.sys [35424]
O58 - SDL:[MD5.6B56CEB3C6F9D5CD7293DBD9FE23B311] - 12/01/2010 - 05:24:34 ---A- . (...) -- C:\WINDOWS\system32\ntio804.sys [34560]
~ Drivers: 7 Legitimates Filtered in 00mn 12s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com
~ Keys: Scanned in 00mn 00s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.9D6ADBC80D1D929088235F1C30806C3E] [SPRF][10/11/2013] (...) -- C:\Documents and Settings\All Users\Application Data\1384119597.bdinstall.bin [50209]
[MD5.76264BD16759F1753F62F8CDF638A28A] [SPRF][10/11/2013] (...) -- C:\Documents and Settings\All Users\Application Data\1384120608.bdinstall.bin [32559]
[MD5.C37C1B3F6505BD3A7F5AAE8B71973902] [SPRF][12/01/2010] (...) -- \Bootfont.bin [4952]
[MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][01/01/1601] (...) -- \pagefile.sys [1610612736]
[MD5.C37C1B3F6505BD3A7F5AAE8B71973902] [SPRF][12/01/2010] (...) -- \Bootfont.bin [4952]
[MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][01/01/1601] (...) -- \pagefile.sys [1610612736]
[MD5.C37C1B3F6505BD3A7F5AAE8B71973902] [SPRF][12/01/2010] (...) -- \Bootfont.bin [4952]
[MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][01/01/1601] (...) -- \pagefile.sys [1610612736]
~ Files: 8 Legitimates Filtered in 00mn 00s



---\\ Recherche détournement de DNS routeur (LIV) (O89)
PROCESS PID PRIO PATH
Ati2evxx.exe 972 Normal C:\WINDOWS\system32\Ati2evxx.exe
ZHPDiag.exe 1436 Normal C:\Program Files\ZHPDiag\ZHPDiag.exe =>.Nicolas Coolman
cmd.exe 1428 Normal C:\WINDOWS\system32\cmd.exe
pv.exe 1848 Normal C:\Program Files\ZHPDiag\pv.exe =>.Nicolas Coolman
~ DNS: Scanned in 00mn 04s



---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "5A3373F32238D4546A83B3471E8C7325" . (.Gadget Installer.) -- C:\WINDOWS\Installer\{3F3733A5-8322-454D-A638-3B74E1C83752}\_21F3885A18D238E15AAE81.exe
~ Update Products: 21 Legitimates Filtered in 00mn 00s



---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.EB3607D8A8D11373D7F3D311F80628B4] [WIS][13/10/2013] (.Shark007 - Adobe Shockwave Player.) -- C:\Windows\Installer\3fa76.msi [400896]
~ WIS: 21 Legitimates Filtered in 00mn 19s



---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by Administrateur at 19/01/2014 17:40:16

device: opened successfully
user: error reading MBR

Disk trace:
error: Read Descripteur non valide
kernel: error reading MBR

~ MBR: 9 Legitimates Filtered in 00mn 02s



---\\ Scan Additionnel (O88)
Database Version : 13024 - (17/01/2014)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 0

~ Additionnel Scan: 148555 Items scanned in 00mn 36s



~ 837 Legitimates filtered by white list
End of the scan (402 lines in 04mn 49s)(0)

Publicité


Signaler le contenu de ce document

Publicité