~ Rapport de ZHPDiag v2014.2.17.15 - Nicolas Coolman (17/02/2014)
~ Lancé par marie-laure (19/02/2014 09:08:49)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user


---\\ Navigateurs Internet
MSIE: Internet Explorer v9.0.8112.16421
GCIE: Google Chrome v32.0.1700.107 (Defaut)

---\\ Informations sur les produits Windows
~ Langage: Français
Windows Vista (TM) Home Basic, 32-bit Service Pack 2 (Build 6002)
Windows Server License Manager Script : OK
~ Vista, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 44MV3
Windows License : OK
Windows Automatic Updates : OK

---\\ Logiciels de protection du système
avast! Pro Antivirus v9.0.2011
Microsoft Security Client v4.4.0304.0

---\\ Logiciels d'optimisation du système

---\\ Logiciels de partage PeerToPeer

---\\ Surveillance de Logiciels
Adobe Flash Player ActiveX

---\\ Informations sur le système
~ Processor: x86 Family 6 Model 23 Stepping 10, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1975 MB (22% free)
System Restore: Activé (Enable)
System drive C: has 71 GB (31%) free of 223 GB

---\\ Mode de connexion au système
~ Computer Name: PC-DE-MALOUE
~ User Name: marie-laure
~ All Users Names: McAfeeMVSUser, marie-laure, Administrateur,
~ Unselected Option: None
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\marie-laure\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\marie-laure\AppData\Roaming\
~ %Desktop% : C:\Users\marie-laure\Desktop\
~ %Favorites% : C:\Users\marie-laure\Favorites\
~ %LocalAppData% : C:\Users\marie-laure\AppData\Local\
~ %StartMenu% : C:\Users\marie-laure\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 71 Go of 223 Go)
D: Hard drive, Flash drive, Thumb drive (Free 2 Go of 9 Go)
E: CD-ROM drive (Not Inserted)
F: Hard drive, Flash drive, Thumb drive (Free 1 Go of 1 Go)



---\\ Etat du Centre de Sécurité Windows
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowMyMusic: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowMyPics: Modified
~ Security Center: 42 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.D07D4C3038F3578FFCE1C0237F2A1253] - (.Microsoft Corporation - Explorateur Windows.) (.11/04/2009 - 07:27:36.) -- C:\Windows\Explorer.exe [2926592]
[MD5.101BA3EA053480BB5D957EF37C06B5ED] - (.Microsoft Corporation - Application de démarrage de Windows.) (.21/01/2008 - 03:33:13.) -- C:\Windows\System32\Wininit.exe [96768]
[MD5.679EAED8E703235BA81AA2E58F4E2D16] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.05/02/2014 - 09:50:39.) -- C:\Windows\System32\wininet.dll [1129472]
[MD5.898E7C06A350D4A1A64A9EA264D55452] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.11/04/2009 - 07:28:13.) -- C:\Windows\System32\Winlogon.exe [314368]
[MD5.3911B972B55FEA0478476B2E777B29FA] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.21/04/2011 - 14:58:27.) -- C:\Windows\system32\Drivers\AFD.sys [273408]
[MD5.2D9C903DC76A66813D350A562DE40ED9] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.21/01/2008 - 03:32:21.) -- C:\Windows\system32\Drivers\atapi.sys [21560]
[MD5.7ADD03E75BEB9E6DD102C3081D29840A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.21/01/2008 - 03:33:23.) -- C:\Windows\system32\Drivers\Cdfs.sys [70144]
[MD5.6B4BFFB9BECD728097024276430DB314] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.11/04/2009 - 05:39:17.) -- C:\Windows\system32\Drivers\Cdrom.sys [67072]
[MD5.622C41A07CA7E6DD91770F50D532CB6C] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.14/04/2011 - 15:59:03.) -- C:\Windows\system32\Drivers\DfsC.sys [75264]
[MD5.062452B7FFD68C8C042A6261FE8DFF4A] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.11/04/2009 - 05:42:42.) -- C:\Windows\system32\Drivers\HDAudBus.sys [561152]
[MD5.22D56C8184586B7A1F6FA60BE5F5A2BD] - (.Microsoft Corporation - Pilote de port i8042.) (.21/01/2008 - 03:32:45.) -- C:\Windows\system32\Drivers\i8042prt.sys [54784]
[MD5.8793643A67B42CEC66490B2A0CF92D68] - (.Microsoft Corporation - IP Network Address Translator.) (.21/01/2008 - 03:34:06.) -- C:\Windows\system32\Drivers\IpNat.sys [100864]
[MD5.1E94971C4B446AB2290DEB71D01CF0C2] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.29/04/2011 - 14:24:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [106496]
[MD5.ECD64230A59CBD93C85F1CD1CAB9F3F6] - (.Microsoft Corporation - MBT Transport driver.) (.11/04/2009 - 05:45:37.) -- C:\Windows\system32\Drivers\netBT.sys [185856]
[MD5.2C1121F2B87E9A6B12485DF53CD848C7] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.03/03/2013 - 20:07:52.) -- C:\Windows\system32\Drivers\ntfs.sys [1082232]
[MD5.8A79FDF04A73428597E2CAF9D0D67850] - (.Microsoft Corporation - Pilote de port parallèle.) (.21/01/2008 - 03:32:22.) -- C:\Windows\system32\Drivers\Parport.sys [79360]
[MD5.A214ADBAF4CB47DD2728859EF31F26B0] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/01/2008 - 03:34:44.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [76288]
[MD5.FBC0BACD9C3D7F6956853F64A66E252D] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.21/01/2008 - 03:32:22.) -- C:\Windows\system32\Drivers\rdpdr.sys [248832]
[MD5.7B75299A4D201D6A6533603D6914AB04] - (.Microsoft Corporation - SMB Transport driver.) (.11/04/2009 - 05:45:22.) -- C:\Windows\system32\Drivers\smb.sys [66560]
[MD5.76B06EB8A01FC8624D699E7045303E54] - (.Microsoft Corporation - TDI Translation Driver.) (.11/04/2009 - 05:45:56.) -- C:\Windows\system32\Drivers\tdx.sys [72192]
[MD5.786DB5771F05EF300390399F626BF30A] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/08/2012 - 12:47:42.) -- C:\Windows\system32\Drivers\volsnap.sys [224640]
~ Generic Processes: Scanned in 00mn 01s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/2
~ Mes musiques (My Musics) : 1/3
~ Mes Videos (My Videos) : 1/2
~ Mes Favoris (My Favorites) : 1/20
~ Mes Documents (My Documents) : 4/15
~ Mon Bureau (My Desktop) : 8/584
~ Menu demarrer (Programs) : 1/25
~ Hidden Files: Scanned in 00mn 02s



---\\ Processus lancés
[MD5.AD90DDBF37F0735FE0D2E1F6FA623814] - (.McAfee, Inc. - myAgtTry Module.) -- C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtTry.exe [271680] [PID.4024]
[MD5.7EAB127C64AAAA9134283C0FEA7177D1] - (.Bioscrypt Inc. - Global Virtual Card Host.) -- c:\Program Files\Hewlett-Packard\IAM\Bin\AsGHost.exe [65296] [PID.536]
[MD5.66B24E2EB8F8A8340F238A346F231C79] - (.Intel Corporation - Event Monitor User Notification Tool.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [178712] [PID.5456]
[MD5.85C1D3EE666A4A2B8071A570227A68A1] - (.ActivIdentity - ActivIdentity card event handler.) -- C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe [293168] [PID.4296]
[MD5.5C6EB59CE1E494A46AA7B61BB0958432] - (.Hewlett-Packard Development Company, L.P. - HP ProtectTools Security Manager.) -- C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe [238984] [PID.2624]
[MD5.8CB896C573FD15AE8B13180DA53E93D2] - (.Hewlett-Packard Development Company, L.P. - HPWAMain Module.) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [488752] [PID.1264]
[MD5.8D07F0687318214A3CEF62EA1048D101] - (.Hewlett-Packard Development Company, L.P. - Module to process WiFi messages..) -- C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.exe [316720] [PID.5196]
[MD5.2562EA6C84097C2529C4E0D1ABE6A2FB] - (...) -- C:\Program Files\SiteAdvisor\6173\SiteAdv.exe [36640] [PID.2832]
[MD5.E32453D5293DC1CA34A81561C21782CA] - (.Hewlett-Packard - File Sanitizer for HP ProtectTools.) -- C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe [10244096] [PID.2960]
[MD5.443ADA6FE624132C76D3CBF47F371D7C] - (. Hewlett-Packard Development Company, L.P. - Quick Launch Buttons.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe [177456] [PID.3420]
[MD5.9F37F219528DD026DCB195F653469DF0] - (.Analog Devices, Inc. - SoundMAX Audio Settings (32-bit).) -- C:\Program Files\Analog Devices\SoundMAX\SoundMAX.exe [3842048] [PID.3544]
[MD5.2620ABCC3ADC019520EFC131C82EA036] - (.Intel Corporation - igfxTray Module.) -- C:\Windows\System32\igfxtray.exe [150040] [PID.5204]
[MD5.D3DD48B59263881BCE0344E503B379A5] - (.Intel Corporation - hkcmd Module.) -- C:\Windows\System32\hkcmd.exe [170520] [PID.5292]
[MD5.3362CDE3C884A9F8D9626C632BA1A62F] - (.Intel Corporation - persistence Module.) -- C:\Windows\System32\igfxpers.exe [145944] [PID.4208]
[MD5.1EDC4865C8003A0251956835273904B1] - (.Pas de propriétaire - HpqToaster Module.) -- C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe [685360] [PID.4116]
[MD5.C637FC4638A96165256B28D38DE7B953] - (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files\HP\HP Software Update\hpwuschd2.exe [49208] [PID.1120]
[MD5.B77081F8221968C7DAB794B0BA55C43E] - (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe [254896] [PID.460]
[MD5.AFEBF9E0B223FF04709F747C172D3540] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024] [PID.5696]
[MD5.6438FF6F59D64E97E862F90AB66B7996] - (.Analog Devices, Inc. - SMax4PNP.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe [1314816] [PID.4760]
[MD5.58920E6A409046BA06548D9D139CE0F0] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe [20584608] [PID.5912]
[MD5.A9D6FD155C4143242BA1FEAFE54129A7] - (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\System32\spool\drivers\w32x86\3\E_TATIIVE.exe [249440] [PID.4872]
[MD5.22209643E16EB086B4E2D070E2C1789A] - (.Intel Corporation - igfxsrvc Module.) -- C:\windows\system32\igfxsrvc.exe [256536] [PID.4772]
[MD5.E433210DD9F9EF43D4D170E52FFFF116] - (.Microsoft Corporation - Microsoft Word.) -- C:\Program Files\Microsoft Office\Office14\WINWORD.exe [1423008] [PID.4436]
[MD5.FECB438F7ABEA262C9633616CBD8CFDF] - (.ActivIdentity - ActivIdentity Event Service.) -- c:\Program Files\ActivIdentity\ActivClient\acevents.exe [95024] [PID.2504]
[MD5.91C7B7340109693219CE5BCDA1B8CCAC] - (. Hewlett-Packard Development Company, L.P. - Volume related element.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe [91440] [PID.2376]
[MD5.A6430C0A0E1AAE273AA8F1BD1F341A36] - (.Sun Microsystems, Inc. - Java(TM) Update Checker.) -- C:\Program Files\Common Files\Java\Java Update\jucheck.exe [508336] [PID.6348]
[MD5.4B96654025B28EEB1E5D8F001E5D1B8A] - (.APN - Ask Toolbar Notifier.) -- C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1758160] [PID.5484] =>Toolbar.Ask
[MD5.5640B4C10682FBC39C86C8C7A8392B5E] - (.Google Inc. - Google Chrome.) -- C:\Users\marie-laure\AppData\Local\Google\Chrome\Application\chrome.exe [866632] [PID.1876]
[MD5.AB44884BC129FC04D75A4649E0710203] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8338432] [PID.5724]
[MD5.6080A176D09435FC8E6E800996656E18] - (.Microsoft Corporation - Console IME.) -- C:\windows\system32\conime.exe [69120] [PID.7116]
[MD5.EF55CD76A05A0675FE930036B7773943] - (.Hewlett-Packard - File Sanitizer for HP ProtectTools.) -- C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe [77824] [PID.1024]
[MD5.EB734EF9D7C4D02760F2D1342331BA41] - (.SafeBoot International - Drive Encryption for HP ProtectTools Servic.) -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [256512] [PID.1052]
[MD5.B0F49DA36F30922F5DDC3B623B778FCE] - (.Microsoft Corporation - Antimalware Service Executable.) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208] [PID.1132]
[MD5.862BB4CBC05D80C5B45BE430E5EF872F] - (.Microsoft Corporation - Service de gestion des licences Microsoft.) -- C:\windows\system32\SLsvc.exe [3408896] [PID.1492]
[MD5.3E940775A4970410F094E428BA94BBB7] - (.Hewlett-Packard Corporation - HpService.) -- C:\windows\system32\Hpservice.exe [24936] [PID.1664]
[MD5.D74884939D53612FD84AC82C59CCFE27] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344] [PID.1920]
[MD5.23C3A0680042C0D1DE1F360F8B62BC57] - (.Microsoft Corporation - Infrastructure d'extensibilité pour les ser.) -- C:\windows\system32\WLANExt.exe [74240] [PID.1928]
[MD5.EC4A5D4E36A8E49261CD823450E0BA51] - (.ActivIdentity - ActivIdentity Cache Server.) -- c:\Program Files\ActivIdentity\ActivClient\accoca.exe [182576] [PID.2240]
[MD5.585F5793BB5D79C8754EE63BCBAF2B3A] - (.Andrea Electronics Corporation - Andrea filters APO access service (32-bit).) -- C:\windows\system32\AEADISRV.exe [86016] [PID.2284]
[MD5.8ED60797908FD394EEE0D6949F493224] - (.Agere Systems - Agere Soft Modem Call Progress Service.) -- C:\Windows\system32\agrsmsvc.exe [12800] [PID.2320]
[MD5.EDC243EF33F8DA2A1A499331891D9472] - (.McAfee, Inc. - Common Shell3 - Scanners' interface to the.) -- C:\Program Files\McAfee\Managed VirusScan\VScan\EngineServer.exe [13632] [PID.0]
[MD5.E9EFCB47B90FD5498695BB7FEFD36CAE] - (.Seiko Epson Corporation - Epson Scanner Service (32bit).) -- C:\windows\system32\EscSvc.exe [122000] [PID.2520]
[MD5.07A85D6C053A0999FF450BBCA9825FB2] - (.Hewlett-Packard Development Company, L.P - PTChangeFilterService.) -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [34184] [PID.2552]
[MD5.3AD7614C487C948ADD435662265750FB] - (.Intel Corporation - RAID Monitor.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [354840] [PID.2684]
[MD5.213822072085B5BBAD9AF30AB577D817] - (.InterVideo - RegMgr Module.) -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe [112152] [PID.2712]
[MD5.C215E09622118383B236DD56C2065183] - (.Hewlett-Packard Company - LightScribe Service.) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728] [PID.2740]
[MD5.38BCCF016B694A745E1CDBC0B080A59C] - (.McAfee, Inc. - McAfee HackerWatch Service.) -- C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe [540776] [PID.2788]
[MD5.7869AE9E3533D5A6F006E7B97F5FB991] - (.McAfee, Inc. - McAfee Personal Firewall Service.) -- C:\Program Files\McAfee\MPF\MPFSrv.exe [841256] [PID.2816]
[MD5.9FC13942EDB6DCE2CCE765ADF1041D04] - (.McAfee, Inc. - Managed Services Agent.) -- C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [202048] [PID.2904]
[MD5.ACD411DE0A23E5ECBE57FE051CB4CC6E] - (.PDF Complete Inc - Dispatcher.) -- C:\Program Files\PDF Complete\pdfsvc.exe [576024] [PID.3024]
[MD5.675C575444AAFD56B4E8A99EF8A570CD] - (.Absolute Software Corp. - rpcnet.) -- C:\windows\system32\rpcnet.exe [69792] [PID.3116]
[MD5.BB2FACF58F87C299E823110C7921619C] - (...) -- C:\Program Files\SiteAdvisor\6173\SAService.exe [341280] [PID.3200]
[MD5.42D33042371BFB1A7D40834590CAFD30] - (.Microsoft Corporation - Microsoft Network Realtime Inspection Servi.) -- c:\Program Files\Microsoft Security Client\NisSrv.exe [280288] [PID.3720]
[MD5.1665C7121A026DF10C903DB9BC5E9D43] - (.Hewlett-Packard Development Company, L.P. - hpqwmiex Module.) -- C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [165192] [PID.3752]
[MD5.7795F8CEBC284A426B53F541E538695F] - (.Hewlett-Packard Development Company, L.P. - Com for QLB application.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [193840] [PID.5444]
[MD5.358A9CCA612C68EB2F07DDAD4CE1D8D7] - (.Microsoft Corporation - Microsoft Office Software Protection Platfo.) -- C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.exe [4640000] [PID.4204]
[MD5.97D9D6A04E3AD9B6C626B9931DB78DBA] - (.Microsoft Corporation - Programme d’installation de modules Windows.) -- C:\windows\servicing\TrustedInstaller.exe [39424] [PID.6880]
[MD5.C559672F31ABE6BA7277DD73C4502238] - (.Microsoft Corporation - Installateur Windows®.) -- C:\windows\system32\msiexec.exe [73216] [PID.6648]
[MD5.B342CD9AA44E4AE99E2368EBDBC2E17A] - (.APN LLC. - APN Updater.) -- C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352] [PID.4704] =>Toolbar.Ask
~ Processes Running: Scanned in 00mn 21s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\marie-laure\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [acjgmgmnpncajnhgckkempkobhlmolef] Quick Cite v.0.0.0.1 (Activé)
G2 - GCE: Preference [User Data\Default] [algmakeomkafjglfhpomolfhjppoojff] Pricora v.1.26.179, (Activé) =>Adware.Pricora
G2 - GCE: Preference [User Data\Default] [baaifhdfifpfjkpoliebdnkchanhmeil] Hot Hot Burger-HD v.2.3 (Activé)
G2 - GCE: Preference [User Data\Default] [bklodekjdjjkfhlaffopemibfjckfime] Ce qui est pour le dner v.4.3 (Activé)
G2 - GCE: Preference [User Data\Default] [ceeklmjonlihhnkincppdpimdhfhhdho] ESL, Order a Pizza v.1 (Activé)
G2 - GCE: Preference [User Data\Default] [chemohaemmfhjpmlgkmkanfpfbkaihop] Plugins v.0.8.0 (Activé)
G2 - GCE: Preference [User Data\Default] [ckmoikambnjgjnhaefiklkblfjoolnaf] Jeux classiques v.11 (Activé)
G2 - GCE: Preference [User Data\Default] [eahpcpckmhaneflmhiegmedhiegncgnf] Webplayer v.10.26.0.540, (Désactivé)
G2 - GCE: Preference [User Data\Default] [eekfgnblmeankckfddegeeokegfhnfkj] Basketball Theme v.1 (Activé)
G2 - GCE: Preference [User Data\Default] [eooncjejnppfjjklapaamhcdmjbilmde] Delta Toolbar v.1.4 (Désactivé) =>Toolbar.DeltaSearch
G2 - GCE: Preference [User Data\Default] [hnljegjnioppmpieleiegimongopeanj] UNO 3 3D v.1.0.0 (Activé)
G2 - GCE: Preference [User Data\Default] [kjfehndjkdkakpofmpkkjddfniaplgdc] Leon de cuisine v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [klhfgnobmdkblmbdahcnpajbjnfmknpn] Briser le mur v.1.5 (Activé)
G2 - GCE: Preference [User Data\Default] [mifnfdmjmiacjganljdegbhmomkdgfmp] Smoothie aux fruits : Cours de cuisine de Sara v.1 (Activé)
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [oiomepakkenneiifjocbinkmmampfbdn] Origami Player v.2.4 (Activé)
~ Google Browser: 25 Legitimates Filtered in 00mn 16s



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www1.delta-search.com =>Toolbar.DeltaSearch
~ IE Browser: 13 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 20



---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} . (...) -- C:\Program Files\SiteAdvisor\6173\SiteAdv.dll
O2 - BHO: CrossriderApp0035329 - {11111111-1111-1111-1111-110311531129} . (.Corporate Inc - Pricora BHO.) -- C:\Program Files\Pricora\Pricora-bho.dll =>PUP.CrossRider
~ BHO: 22 Legitimates Filtered in 00mn 01s



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: McAfee SiteAdvisor - [HKLM]{0BF43445-2F28-4351-9252-17FE6E806AA0} . (...) -- C:\Program Files\SiteAdvisor\6173\SiteAdv.dll
O3 - Toolbar: Ask Shopping Toolbar - [HKLM]{D4027C7F-154A-4066-A1AD-4243D8127440} . (.APN LLC. - Passport.) -- C:\Program Files\AskPartnerNetwork\Toolbar\ORJ\Passport.dll =>Toolbar.Ask
O3 - Toolbar: avast! Online Security - [HKLM]{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} . (.AVAST Software - IE Webrep plugin.) -- C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{D4027C7F-154A-4066-A1AD-4243D8127440} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{338C5D66-6B92-40A7-A216-9830D2E54103} Clé orpheline
~ Toolbar: Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: EPSON Scan.lnk . (.SEIKO EPSON CORP. - EPSON Scan.) -- C:\Windows\twain_32\escndv\escndv.exe
O4 - GS\Desktop [Public]: HP Help and Support.lnk . (.Hewlett-Packard - HPHS Launcher.) -- C:\Windows\Help\OEM\scripts\HPHS_Launcher.exe
O4 - GS\Desktop [Public]: InterVideo WinDVD.lnk . (.InterVideo Inc. - WinDVD MFC Application.) -- C:\Program Files\InterVideo\WinDVD\WinDVD.exe
O4 - GS\Program [Public]: HP ProtectTools Security Manager for Administrators.lnk . (.Hewlett-Packard Development Company, L.P. - HP ProtectTools Security manager.) -- C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTAdmin.exe
O4 - GS\Program [Public]: HP ProtectTools Security Manager.lnk . (.Hewlett-Packard Development Company, L.P. - HP ProtectTools Security Manager.) -- C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHost.exe
O4 - GS\Program [Public]: HP Software Setup.lnk . (.Hewlett-Packard Development Company, L.P. - Application Installer.) -- C:\Swsetup\AppInstl\Setup.exe =>.Hewlett-Packard Co
O4 - GS\QuickLaunch [marie-laure]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\marie-laure\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [marie-laure]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Program [marie-laure]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [marie-laure]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop [marie-laure]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\marie-laure\AppData\Local\Google\Chrome\Application\chrome.exe
~ Global Startup: 52 Legitimates Filtered in 00mn 23s



---\\ Applications lancées au démarrage du sytème (O4)
O4 - GS\Startup [Public]: DVD Check.lnk . (.InterVideo Inc. - DVDCheck Application.) -- C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [Windows Defender] . (.Microsoft Corporation - Windows Defender User Interface.) -- C:\Program Files\Windows Defender\MSASCui.exe
O4 - HKLM\..\Run: [IAAnotif] . (.Intel Corporation - Event Monitor User Notification Tool.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [accrdsub] . (.ActivIdentity - ActivIdentity card event handler.) -- c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
O4 - HKLM\..\Run: [PTHOSTTR] . (.Hewlett-Packard Development Company, L.P. - HP ProtectTools Security Manager.) -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.exe
O4 - HKLM\..\Run: [CognizanceTS] . (.Bioscrypt Inc. - Terminal Services Virtual Channel Client.) -- C:\Program Files\Hewlett-Packard\IAM\Bin\ASTSVCC.dll
O4 - HKLM\..\Run: [hpWirelessAssistant] . (.Hewlett-Packard Development Company, L.P. - HPWAMain Module.) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] . (.Hewlett-Packard - HP Health Check Scheduler.) -- c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [MVS Splash] . (.McAfee, Inc. - Splash Module.) -- C:\Program Files\McAfee\Managed VirusScan\Agent\Splash.exe
O4 - HKLM\..\Run: [McAfee Managed Services Tray] . (.McAfee, Inc. - StartmyAgtTry Module.) -- C:\Program Files\McAfee\Managed VirusScan\Agent\StartMyAgtTry.exe
O4 - HKLM\..\Run: [SiteAdvisor] . (...) -- C:\Program Files\SiteAdvisor\6173\SiteAdv.exe
O4 - HKLM\..\Run: [File Sanitizer] . (.Hewlett-Packard - File Sanitizer for HP ProtectTools.) -- C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe
O4 - HKLM\..\Run: [QlbCtrl.exe] . (. Hewlett-Packard Development Company, L.P. - Quick Launch Buttons.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
O4 - HKLM\..\Run: [WatchDog] . (.InterVideo Inc. - DVDCheck Application.) -- C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [SoundMAX] . (.Analog Devices, Inc. - SoundMAX Audio Settings (32-bit).) -- C:\Program Files\Analog Devices\SoundMAX\soundmax.exe
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKLM\..\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe =>.Hewlett-Packard Co
O4 - HKLM\..\Run: [BCSSync] . (.Microsoft Corporation - Microsoft Office 2010 component.) -- C:\Program Files\Microsoft Office\Office14\BCSSync.exe =>.Microsoft Corporation
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKLM\..\Run: [PDF Complete] . (.PDF Complete Inc - Sentry for PDF.) -- C:\Program Files\PDF Complete\pdfsty.exe =>.PDF Complete Inc
O4 - HKLM\..\Run: [AvastUI.exe] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
O4 - HKLM\..\Run: [SoundMAXPnP] . (.Analog Devices, Inc. - SMax4PNP.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [ApnTBMon] . (.APN - Ask Toolbar Notifier.) -- C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe =>Toolbar.Ask
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKCU\..\Run: [WindowsWelcomeCenter] Clé orpheline
O4 - HKCU\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe
O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\marie-laure\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe =>.Skype Technologies S.A.
O4 - HKCU\..\Run: [EPLTarget\P0000000000000001] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\windows\system32\spool\DRIVERS\W32X86\3\E_TATIIVE.exe =>.Epson Seiko Corporation
O4 - HKCU\..\Run: [WMPNSCFG] . (.Microsoft Corporation - Application de configuration du service Par.) -- C:\Program Files\Windows Media Player\WMPNSCFG.exe =>.Microsoft Corporation
O4 - HKCU\..\Run: [EPLTarget\P0000000000000002] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\windows\system32\spool\DRIVERS\W32X86\3\E_TATIIVE.exe =>.Epson Seiko Corporation
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] . (.Adobe Systems, Inc. - Adobe Flash Player Helper 9.0 r124.) -- C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe =>.Adobe Systems Incorporated
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] Clé orpheline
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] Clé orpheline
O4 - HKUS\S-1-5-21-1038042192-3592090317-4097671706-1004\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-1038042192-3592090317-4097671706-1004\..\Run: [WindowsWelcomeCenter] Clé orpheline
O4 - HKUS\S-1-5-21-1038042192-3592090317-4097671706-1004\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe
O4 - HKUS\S-1-5-21-1038042192-3592090317-4097671706-1004\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\marie-laure\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc
O4 - HKUS\S-1-5-21-1038042192-3592090317-4097671706-1004\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe =>.Skype Technologies S.A.
O4 - HKUS\S-1-5-21-1038042192-3592090317-4097671706-1004\..\Run: [EPLTarget\P0000000000000001] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\windows\system32\spool\DRIVERS\W32X86\3\E_TATIIVE.exe =>.Epson Seiko Corporation
O4 - HKUS\S-1-5-21-1038042192-3592090317-4097671706-1004\..\Run: [WMPNSCFG] . (.Microsoft Corporation - Application de configuration du service Par.) -- C:\Program Files\Windows Media Player\WMPNSCFG.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-1038042192-3592090317-4097671706-1004\..\Run: [EPLTarget\P0000000000000002] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\windows\system32\spool\DRIVERS\W32X86\3\E_TATIIVE.exe =>.Epson Seiko Corporation
O4 - HKUS\S-1-5-21-1038042192-3592090317-4097671706-1004\..\RunOnce: [FlashPlayerUpdate] . (.Adobe Systems, Inc. - Adobe Flash Player Helper 9.0 r124.) -- C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe =>.Adobe Systems Incorporated
~ Application: Scanned in 00mn 00s



---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office14\ONBttnIE.dll =>.Microsoft Corporation
O9 - Extra button: Notes &liées OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office14\ONBTTN~1.dll =>.Microsoft Corporation
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{1884168C-FA6A-4289-98F6-F8A2F17B2814}: DhcpNameServer = 88.86.225.214 88.86.225.218
O17 - HKLM\System\CS1\Services\Tcpip\..\{1884168C-FA6A-4289-98F6-F8A2F17B2814}: DhcpNameServer = 88.86.225.214 88.86.225.218
O17 - HKLM\System\CS2\Services\Tcpip\..\{1884168C-FA6A-4289-98F6-F8A2F17B2814}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{1884168C-FA6A-4289-98F6-F8A2F17B2814}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 88.86.225.214 88.86.225.218
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\system32\mshtml.dll =>.Microsoft Corporation
O18 - Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - AppInit_DLLs: . (.Bioscrypt Inc. - Application Protection Hook.) - C:\Windows\System32\apshook.dll
~ AppInit DLL: Scanned in 00mn 00s



---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\Windows\System32\browseui.dll
~ STS/SSO: Scanned in 00mn 00s



---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Service de mise à jour Ask (APNMCP) . (.APN LLC. - APN Updater.) - C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe =>Toolbar.Ask
O23 - Service: SiteAdvisor Service (SiteAdvisor Service) . (...) - C:\Program Files\SiteAdvisor\6173\SAService.exe
O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files\Skype\Updater\Updater.exe
~ Services: 22 Legitimates Filtered in 00mn 11s



---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-chromeinstaller.job [1860] =>Adware.Pricora
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-codedownloader.job [1174] =>Adware.Pricora
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-enabler.job [1074] =>Adware.Pricora
[MD5.59BE5C8AD4758A4405E13BCE1D3BE665] [APT] [Pricora-chromeinstaller] (.Corporate Inc.) -- C:\Program Files\Pricora\Pricora-chromeinstaller.exe [460800] =>Adware.Pricora
[MD5.DAA7EAAEEB67125192A16FCCE7EEDD9D] [APT] [Pricora-codedownloader] (.Corporate Inc.) -- C:\Program Files\Pricora\Pricora-codedownloader.exe [476672] =>Adware.Pricora
[MD5.1696645FDB0519682C3D79DACA321A71] [APT] [Pricora-enabler] (.Corporate Inc.) -- C:\Program Files\Pricora\Pricora-enabler.exe [342528] =>Adware.Pricora
~ Scheduled Task: 26 Legitimates Filtered in 00mn 05s



---\\ Pilotes lancés au démarrage du système (O41)
O41 - Driver: (dpjrchhi) . (. - .) - C:\windows\system32\drivers\dpjrchhi.sys (.not file.)
O41 - Driver: (oxndmuwd) . (. - .) - C:\windows\system32\drivers\oxndmuwd.sys (.not file.)
O41 - Driver: (rhijvavs) . (. - .) - C:\windows\system32\drivers\rhijvavs.sys (.not file.)
O41 - Driver: (vilgwyzq) . (. - .) - C:\windows\system32\drivers\vilgwyzq.sys (.not file.)
~ Drivers: 112 Legitimates Filtered in 00mn 51s



---\\ Logiciels installés (O42)
O42 - Logiciel: Ask Shopping Toolbar - (.APN, LLC.) [HKLM] -- {4F524A00-6A76-A76A-76A7-A758B70C0A03}
O42 - Logiciel: Pricora - (.Corporate Inc.) [HKLM] -- Pricora =>Adware.Pricora
~ Logic: 19 Legitimates Filtered in 00mn 01s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\AskPartnerNetwork]
[HKCU\Software\BabSolution] =>Hijacker.BabSolution
[HKCU\Software\Conduit] =>Toolbar.Conduit
[HKCU\Software\DataMngr] =>PUP.Datamngr
[HKCU\Software\DataMngr_Toolbar] =>PUP.Datamngr
[HKCU\Software\Delta]
[HKCU\Software\InstalledBrowserExtensions] =>Adware.VidSaver
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKCU\Software\d538cdab238e946] =>Hijacker.Hijacker.Eazel
[HKLM\Software\ActivCard]
[HKLM\Software\AskPartnerNetwork]
[HKLM\Software\Babylon] =>PUP.Babylon
[HKLM\Software\Conduit] =>Toolbar.Conduit
[HKLM\Software\DataMngr] =>PUP.Datamngr
[HKLM\Software\Delta]
[HKLM\Software\GSC]
[HKLM\Software\d538cdab238e946] =>Hijacker.Hijacker.Eazel
~ Key Software: 231 Legitimates Filtered in 00mn 01s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 19/02/2014 - 09:07:49 - [10,289] ----D C:\Program Files\AskPartnerNetwork
O43 - CFD: 12/05/2012 - 00:10:50 - [0,609] ----D C:\Program Files\Conduit
O43 - CFD: 12/01/2014 - 12:25:31 - [5,440] ----D C:\Program Files\Pricora =>Adware.Pricora
O43 - CFD: 19/02/2014 - 09:07:10 - [0] ----D C:\ProgramData\APN
O43 - CFD: 07/05/2012 - 20:49:31 - [0] ----D C:\ProgramData\Ask
O43 - CFD: 19/02/2014 - 09:07:49 - [0,682] ----D C:\ProgramData\AskPartnerNetwork
O43 - CFD: 12/05/2012 - 00:07:24 - [0] ----D C:\ProgramData\Babylon =>PUP.Babylon
O43 - CFD: 12/05/2012 - 00:07:24 - [0,010] ----D C:\Users\marie-laure\AppData\Roaming\Babylon =>PUP.Babylon
O43 - CFD: 10/01/2014 - 15:50:04 - [0,060] ----D C:\Users\marie-laure\AppData\Roaming\File Scout =>PUP.FileScout
O43 - CFD: 07/08/2013 - 22:42:17 - [0] ----D C:\Users\marie-laure\AppData\Local\Conduit
O43 - CFD: 25/09/2013 - 16:31:29 - [0,001] ----D C:\Users\marie-laure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard =>PUP.BitGuard
~ Program Folder: 144 Legitimates Filtered in 00mn 38s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.DE6576CD8B9C6A49E4E8D8D314A82D98] - 14/02/2014 - 16:53:51 ---A- . (...) -- C:\Windows\win.ini [219]
O44 - LFC:[MD5.C14731D94AF1EF0CAB3DA53BDF8710E1] - 19/02/2014 - 08:31:40 ---A- . (...) -- C:\Windows\System32\rpcnetp.exe [17408]
~ Files: 25 Legitimates Filtered in 00mn 25s



---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.16AF3D71E16E7CBDCD0811860D2DF5AD] - 17/02/2014 - 09:40:25 ---A- - C:\Windows\Prefetch\HTMLDLG.EXE-B0FB3D2C.pf
O45 - LFCP:[MD5.32C5C2B8226516500995E227029120B3] - 17/02/2014 - 11:58:50 ---A- - C:\Windows\Prefetch\VOLCTRL.EXE-9FD8FEC6.pf
O45 - LFCP:[MD5.9CCF70D19CF6E14A4E3EE3FE852CD0FC] - 17/02/2014 - 11:58:57 ---A- - C:\Windows\Prefetch\QLBPRESOV.EXE-E019976E.pf
O45 - LFCP:[MD5.F245D736DFFBA3B1B66A5EC294277A64] - 17/02/2014 - 11:59:29 ---A- - C:\Windows\Prefetch\ACEVENTS.EXE-F0DD1715.pf
O45 - LFCP:[MD5.4F25C51AB108C5DACDC5758B5926188F] - 17/02/2014 - 12:00:43 ---A- - C:\Windows\Prefetch\MYAGTTRY.EXE-2E033F35.pf
O45 - LFCP:[MD5.ED6467573D350AC5D10A18970F28459A] - 19/02/2014 - 08:37:50 ---A- - C:\Windows\Prefetch\PRICORA-ENABLER.EXE-B515EA7F.pf =>Adware.Pricora
O45 - LFCP:[MD5.712C696DBD3F176D2303AB460F65FF89] - 19/02/2014 - 08:37:57 ---A- - C:\Windows\Prefetch\INSTUP.EXE-20062FAA.pf
O45 - LFCP:[MD5.804F648BE5CF09342BEA400754DC56F0] - 19/02/2014 - 08:38:20 ---A- - C:\Windows\Prefetch\EPSDNAVI.EXE-62F0A00E.pf
O45 - LFCP:[MD5.632E10F7280D38AF168CDEA7FBB81FBD] - 19/02/2014 - 08:57:25 ---A- - C:\Windows\Prefetch\PRICORA-BG.EXE-6C355A67.pf =>Adware.Pricora
O45 - LFCP:[MD5.D0E5CE0C2CBA4BCD5AA5A347585B86BF] - 19/02/2014 - 09:08:05 ---A- - C:\Windows\Prefetch\APNMCP.EXE-E6A53660.pf
O45 - LFCP:[MD5.A64143055FA938F3839A20ED8BE29D5E] - 19/02/2014 - 09:08:07 ---A- - C:\Windows\Prefetch\TBNOTIFIER.EXE-71D9D038.pf
~ Prefetcher: 140 Legitimates Filtered in 00mn 03s



---\\ Opérations et fonctions au démarrage de Windows Explorer (O46)
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
~ ShellExecuteHooks: Scanned in 00mn 00s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.364A903711E84EB1386FA04106681B7A] - 11/04/2008 - 15:38:44 ---A- . (.Analog Devices, Inc. - High Definition Audio Function Driver.) -- C:\Windows\System32\Drivers\ADIHdAud.sys [382464]
O58 - SDL:[MD5.F385467DF95D0A73775CB3B076B8B969] - 10/01/2014 - 11:01:04 ---A- . (...) -- C:\Windows\System32\Drivers\aswRvrt.sys [49944]
O58 - SDL:[MD5.1B0662514A68C3A42E60D240C5ABEF28] - 10/01/2014 - 11:01:05 ---A- . (...) -- C:\Windows\System32\Drivers\aswVmm.sys [180248]
O58 - SDL:[MD5.23B62471681A124889978F6295B3F4C6] - 21/01/2008 - 03:32:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [342584]
O58 - SDL:[MD5.BCED60D16156E428F8DF8CF27B0DF150] - 02/11/2006 - 10:50:07 ---A- . (.Integrated Technology Express, Inc. - ITE IT8211 ATA/ATAPI SCSI miniport.) -- C:\Windows\System32\Drivers\iteatapi.sys [35944]
O58 - SDL:[MD5.06FA654504A498C30ADCA8BEC4E87E7E] - 02/11/2006 - 10:50:09 ---A- . (.Integrated Technology Express, Inc. - ITE IT8212 ATA RAID SCSI miniport.) -- C:\Windows\System32\Drivers\iteraid.sys [35944]
O58 - SDL:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 02/01/1601 - 23:00:00 ---A- . (...) -- C:\Windows\System32\Drivers\SafeBoot.sys [108752]
O58 - SDL:[MD5.52DCDE2D1787217E15FFDCA1CBF8CCE9] - 14/05/2008 - 01:36:26 ---A- . (.SafeBoot N.V. - SafeBoot FIPS AES Algorithm (256 bit).) -- C:\Windows\System32\Drivers\SbAlg.sys [51376]
O58 - SDL:[MD5.0057F29323C393A35903B4C5DAF9A144] - 10/05/2007 - 05:16:40 ---A- . (.Pas de propriétaire - USBCAMD for Sonix UVC.) -- C:\Windows\System32\Drivers\sncduvc.sys [28160]
O58 - SDL:[MD5.CF9CDE12FBC19DBA8DE528B7511A2F4F] - 10/04/2008 - 16:27:34 ---A- . (.Pas de propriétaire - UVC Camera Streaming Driver.) -- C:\Windows\System32\Drivers\snp2uvc.sys [1804160]
O58 - SDL:[MD5.9224BB254F591DE4CA8D572A5F0D635C] - 21/01/2008 - 03:32:45 ---A- . (.ULi Electronics Inc. - ULi SATA Controller Driver.) -- C:\Windows\System32\Drivers\uliahci.sys [238648]
O58 - SDL:[MD5.8514D0E5CD0534467C5FC61BE94A569F] - 02/11/2006 - 10:50:35 ---A- . (.Promise Technology, Inc. - Promise Ultra/Sata Series Driver for Win2003.) -- C:\Windows\System32\Drivers\ulsata.sys [98408]
O58 - SDL:[MD5.38C3C6E62B157A6BC46594FADA45C62B] - 21/01/2008 - 03:32:49 ---A- . (.Promise Technology, Inc. - Promise SATAII150 Series Windows Drivers.) -- C:\Windows\System32\Drivers\ulsata2.sys [115816]
O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 02/11/2006 - 08:09:42 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029]
O58 - SDL:[MD5.0FE9F16075C9ACB941C957B7C649176E] - 02/11/2006 - 08:09:45 ---A- . (...) -- C:\Windows\System32\country.sys [27097]
O58 - SDL:[MD5.E6BC0F98FECEF245A0010D350C1A0B9B] - 02/11/2006 - 08:09:41 ---A- . (...) -- C:\Windows\System32\HIMEM.SYS [4768]
O58 - SDL:[MD5.492090267B9608C62B956CD29BE3AFB7] - 02/11/2006 - 08:09:44 ---A- . (...) -- C:\Windows\System32\KEY01.SYS [42809]
O58 - SDL:[MD5.FBBCFEC1379C5C02D88A361993EDF1B8] - 02/11/2006 - 08:09:44 ---A- . (...) -- C:\Windows\System32\KEYBOARD.SYS [42537]
O58 - SDL:[MD5.FFFF296A08DBF2AC0126C62E3778AC0D] - 02/11/2006 - 08:09:29 ---A- . (...) -- C:\Windows\System32\NTDOS.SYS [27866]
O58 - SDL:[MD5.CF9ED169FF86D935E47999E82359E898] - 02/11/2006 - 08:09:35 ---A- . (...) -- C:\Windows\System32\NTDOS404.SYS [29146]
O58 - SDL:[MD5.03B945AC0481CD8BB161C3569D8ED1C3] - 02/11/2006 - 08:09:38 ---A- . (...) -- C:\Windows\System32\NTDOS411.SYS [29370]
O58 - SDL:[MD5.BBC957DC18C17CC027EB80B7C77F2AEA] - 02/11/2006 - 08:09:40 ---A- . (...) -- C:\Windows\System32\NTDOS412.SYS [29274]
O58 - SDL:[MD5.3CFFAEFFF23B0D208214A6D3061A5B1B] - 02/11/2006 - 08:09:31 ---A- . (...) -- C:\Windows\System32\NTDOS804.SYS [29146]
O58 - SDL:[MD5.2E4112FB7D1B76E11ADFD7487B5D0E95] - 02/11/2006 - 08:09:20 ---A- . (...) -- C:\Windows\System32\NTIO.SYS [33952]
O58 - SDL:[MD5.A98EBD4C2DF983665BF2D1AF49949974] - 02/11/2006 - 08:09:23 ---A- . (...) -- C:\Windows\System32\NTIO404.SYS [34672]
O58 - SDL:[MD5.3F7E6406EDEF197C5CAAB2240EEF6F48] - 02/11/2006 - 08:09:24 ---A- . (...) -- C:\Windows\System32\NTIO411.SYS [35776]
O58 - SDL:[MD5.3E64D681B776CC57BDC38A46D881F85B] - 02/11/2006 - 08:09:26 ---A- . (...) -- C:\Windows\System32\NTIO412.SYS [35536]
O58 - SDL:[MD5.D86B6435729231C171432B4E77801BDB] - 02/11/2006 - 08:09:22 ---A- . (...) -- C:\Windows\System32\NTIO804.SYS [34672]
~ Drivers: 16 Legitimates Filtered in 00mn 05s



---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 19/02/2014 - 09:13:18 ---A- . (...) -- C:\Users\marie-laure\AppData\Local\Google\Chrome\User Data\Certificate Revocation Lists [269014]
O61 - LFC: 19/02/2014 - 09:14:18 ---A- . (...) -- C:\Users\marie-laure\AppData\Local\Google\Chrome\User Data\Local State [60078]
O61 - LFC: 19/02/2014 - 09:18:10 ---A- . (...) -- C:\Users\marie-laure\AppData\Roaming\ZHP\Log.txt [21998] =>.Nicolas Coolman
O61 - LFC: 19/02/2014 - 09:18:10 ---A- . (...) -- C:\Users\marie-laure\AppData\Roaming\ZHP\TestsZHPDiag.txt [2973] =>.Nicolas Coolman
~ 21 Fichiers temporaires (Temporary files)
~ Files: 207 Legitimates Filtered in 05mn 44s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.com> <>[HKU\..\open\Command] (.Not Key.)
O67 - Shell Spawning: <.exe> <>[HKU\..\open\Command] (.Not Key.)
~ FASS Keys: 13 Legitimates Filtered in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\marie-laure\AppData\Local\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} - (Delta Search) - http://www1.delta-search.com =>Toolbar.DeltaSearch
O69 - SBI: SearchScopes [HKCU] {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} - (Ask Search) - http://www.search.ask.com
O69 - SBI: SearchScopes [HKCU] {6F715D10-8717-4CC7-A580-5A752578FD45} - (AOL Recherche) - http://slirsredirect.search.aol.com
O69 - SBI: SearchScopes [HKCU] {afdbddaa-5d3f-42ee-b79c-185a7020515b} - (Webplayer Customized Web Search) - http://search.conduit.com
~ Keys: Scanned in 00mn 00s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.8A3397E3292508FC2B30CDB5437BC98A] [SPRF][03/05/2012] (.SWFBOX - Pas de description.) -- C:\Users\marie-laure\Desktop\80-in-1-best-flash-games_80_in_1_best_flash_games_anglais_253530.exe [31731261]
[MD5.4428B8424E14A03769E6419E82D5EA80] [SPRF][20/05/2012] (.Media Player - Codec Pack.) -- C:\Users\marie-laure\Desktop\media.player.codec.pack.v3.9.6.setup.exe [23873711]
~ Files: 2 Legitimates Filtered in 00mn 03s



---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "00A425F467A6A67A677A7A857BC0A030" . (.Ask Shopping Toolbar.) -- C:\windows\Installer\{4F524A00-6A76-A76A-76A7-A758B70C0A03}\ToolbarIcon.exe
O90 - PUC: "558491CACA7F40D44B9C70AB64CF6B79" . (.ActivClient 6.1 x86.) -- c:\Windows\Installer\{AC194855-F7AC-4D04-B4C9-07BA46FCB697}\ARPPRODUCTICON.exe
O90 - PUC: "9B803B3A69EB433418F6D3281BA9D72E" . (.Software Updater.) -- C:\windows\Installer\{A3B308B9-BE96-4334-816F-3D82B19A7DE2}\icon.ico
~ Update Products: 85 Legitimates Filtered in 00mn 00s



---\\ Export de clés de registre aléatoires (O91)
[HKCU\Software\d538cdab238e946\2.6.1673.238\upd]:="upd=1" =>Hijacker.Hijacker.Eazel
[HKCU\Software\d538cdab238e946\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:dllName="BrowserDefender.dll" =>Hijacker.Hijacker.Eazel
[HKCU\Software\d538cdab238e946\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:exeName="BrowserDefender.exe" =>Hijacker.Hijacker.Eazel
[HKCU\Software\d538cdab238e946\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:folderName="BrowserDefender" =>Hijacker.Hijacker.Eazel
[HKCU\Software\d538cdab238e946\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:guid="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}" =>Hijacker.Hijacker.Eazel
[HKCU\Software\d538cdab238e946\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:serviceName="BrowserDefendert" =>PUA.BrowserDefendert
[HKCU\Software\d538cdab238e946\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:version="2.6.1519.190" =>Hijacker.Hijacker.Eazel
[HKCU\Software\d538cdab238e946]:version="2.6.1673.238" =>Hijacker.Hijacker.Eazel
[HKLM\Software\d538cdab238e946]:version="2.6.1673.238" =>Hijacker.Hijacker.Eazel
~ Export Key Software: Scanned in 00mn 00s



---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.4352657B55319ADD68A38E4E2B256C93] [WIS][10/01/2014] (.Google, Inc. - Google Drive.) -- C:\Windows\Installer\3a6eb9d9.msi [123392]
[MD5.2E35A65BECC46B6F1FDC34B6282FE4C4] [WIS][19/02/2014] (.APN, LLC - Ask Shopping Toolbar.) -- C:\Windows\Installer\65b5374.msi [595456]
~ WIS: 86 Legitimates Filtered in 00mn 12s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Auto 07/05/2012 136176 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 07/05/2012 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 22/10/2004 73728 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
SS - | Demand 29/04/2008 144704 | (McShield) . (.McAfee, Inc..) - C:\Program Files\McAfee\Managed VirusScan\VScan\McShield.exe
SS - | Auto 21/01/2008 21504 | C:\windows\system32\HPZinw12.dll (Net Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe
SS - | Auto 21/01/2008 21504 | C:\windows\system32\HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe
SS - | Demand 08/04/2008 1112560 | (RoxMediaDB10) . (.Sonic Solutions.) - c:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
SS - | Auto 23/10/2013 172192 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe
SS - | Demand 24/03/2008 74384 | (stllssvr) . (.MicroVision Development, Inc..) - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
SS - | Auto 21/01/2008 21504 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

SR - | Auto 16/05/2007 182576 | (accoca) . (.ActivIdentity.) - c:\Program Files\ActivIdentity\ActivClient\accoca.exe
SR - | Auto 19/10/2007 86016 | (AEADIFilters) . (.Andrea Electronics Corporation.) - C:\Windows\System32\AEADISRV.exe
SR - | Auto 11/12/2007 12800 | (AgereModemAudio) . (.Agere Systems.) - C:\Windows\system32\agrsmsvc.exe
SR - | Auto 14/02/2014 166352 | (APNMCP) . (.APN LLC..) - C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe =>Toolbar.Ask
SR - | Auto 21/01/2008 21504 | c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll (ASBroker) . (.Bioscrypt Inc..) - C:\Windows\System32\svchost.exe
SR - | Auto 21/01/2008 21504 | c:\Program Files\Hewlett-Packard\IAM\Bin\AsChnl.dll (ASChannel) . (.Bioscrypt Inc..) - C:\Windows\System32\svchost.exe
SR - | Auto 10/01/2014 50344 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SR - | Demand 03/04/2008 193840 | (Com4QLBEx) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
SR - | Auto 29/04/2008 13632 | (EngineServer) . (.McAfee, Inc..) - C:\Program Files\McAfee\Managed VirusScan\VScan\EngineServer.exe
SR - | Auto 12/12/2011 122000 | (EpsonScanSvc) . (.Seiko Epson Corporation.) - C:\windows\system32\EscSvc.exe
SR - | Auto 14/05/2008 34184 | (HP ProtectTools Service) . (.Hewlett-Packard Development Company, L.P.) - c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe
SR - | Auto 14/05/2008 256512 | (HpFkCryptService) . (.SafeBoot International.) - c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
SR - | Auto 02/05/2008 77824 | (HPFSService) . (.Hewlett-Packard.) - C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
SR - | Demand 16/04/2008 165192 | (hpqwmiex) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
SR - | Auto 07/04/2008 24936 | (hpsrv) . (.Hewlett-Packard Corporation.) - C:\Windows\System32\Hpservice.exe
SR - | Auto 18/04/2008 354840 | (IAANTMON) . (.Intel Corporation.) - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
SR - | Auto 05/01/2007 112152 | (IviRegMgr) . (.InterVideo.) - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
SR - | Auto 18/03/2008 73728 | (LightScribeService) . (.Hewlett-Packard Company.) - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
SR - | Auto 13/02/2007 540776 | (McAfee HackerWatch Service) . (.McAfee, Inc..) - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
SR - | Auto 23/05/2007 841256 | (MpfService) . (.McAfee, Inc..) - C:\Program Files\McAfee\MPF\MPFSrv.exe
SR - | Auto 23/10/2013 22208 | (MsMpSvc) . (.Microsoft Corporation.) - c:\Program Files\Microsoft Security Client\MsMpEng.exe
SR - | Auto 05/05/2008 202048 | (myAgtSvc) . (.McAfee, Inc..) - C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
SR - | Auto 12/05/2008 576024 | (pdfcDispatcher) . (.PDF Complete Inc.) - C:\Program Files\PDF Complete\pdfsvc.exe
SR - | Auto 22/04/2013 69792 | (rpcnet) . (.Absolute Software Corp..) - C:\windows\system32\rpcnet.exe
SR - | Auto 12/07/2008 341280 | (SiteAdvisor Service) . (...) - C:\Program Files\SiteAdvisor\6173\SAService.exe
SR - | Auto 21/01/2008 21504 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

~ Services: Scanned in 00mn 15s



---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

~ MBR: 1 Legitimates Filtered in 00mn 02s



---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by marie-laure at 19/02/2014 09:20:06

********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin

~ MBR: Scanned in 00mn 04s



---\\ Scan Additionnel (O88)
Database Version : 13031 - (17/02/2014)
Clés trouvées (Keys found) : 52
Valeurs trouvées (Values found) : 4
Dossiers trouvés (Folders found) : 14
Fichiers trouvés (Files found) : 22

[HKLM\Software\Google\Chrome\Extensions\algmakeomkafjglfhpomolfhjppoojff] =>Adware.Pricora^
[HKLM\Software\Google\Chrome\Extensions\eooncjejnppfjjklapaamhcdmjbilmde] =>Toolbar.DeltaSearch^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311531129}] =>PUP.CrossRider^
[HKLM\SYSTEM\CurrentControlSet\Services\APNMCP] =>Toolbar.Ask^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pricora] =>Adware.Pricora^
[HKLM\Software\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}] =>Toolbar.AskTBar
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9}] =>PUP.Babylon
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}] =>Toolbar.Ask
[HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] =>Toolbar.Ask
[HKLM\Software\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}] =>Adware.iWinArcade
[HKLM\Software\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}] =>Toolbar.Ask
[HKLM\Software\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}] =>Toolbar.Ask
[HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}] =>Toolbar.Ask
[HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}] =>Toolbar.Ask
[HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}] =>Toolbar.Ask
[HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}] =>Toolbar.Ask
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}] =>Toolbar.Conduit
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}] =>Toolbar.Conduit
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}] =>Toolbar.Avira
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}] =>Toolbar.Avira
[HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}] =>Toolbar.Avira
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] =>Toolbar.Avira
[HKLM\Software\Classes\AppID\GenericAskToolbar.DLL] =>Toolbar.Ask
[HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd] =>Toolbar.Ask
[HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd.1] =>Toolbar.Ask
[HKLM\Software\Classes\S] =>Toolbar.Agent
[HKCU\Software\AppDataLow\Software\ConduitSearchScopes] =>Toolbar.Conduit
[HKCU\Software\DataMngr] =>Adware.Bandoo
[HKLM\Software\DataMngr] =>Adware.Bandoo
[HKCU\Software\AppDataLow\Software\PriceGong] =>Adware.PriceGong
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKLM\Software\Classes\Prod.cap] =>PUP.Babylon
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings] =>PUP.BProtector
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{338C5D66-6B92-40A7-A216-9830D2E54103}] =>Toolbar.Conduit
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5491DED0-882E-4D5F-A1C8-F1684BFE90E5}] =>Toolbar.Conduit
[HKLM\Software\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}] =>Toolbar.DeltaSearch
[HKCU\Software\AppDataLow\Software\Crossrider] =>PUP.CrossRider
[HKCU\Software\InstalledBrowserExtensions\] =>PUP.CrossRider
[HKCU\Software\AskPartnerNetwork] =>Toolbar.Ask
[HKLM\Software\AskPartnerNetwork] =>Toolbar.Ask
[HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}] =>Adware.SimilarSites
[HKLM\Software\Google\Chrome\Extensions\eahpcpckmhaneflmhiegmedhiegncgnf] =>Toolbar.Conduit
[HKCU\Software\InstalledBrowserExtensions] =>PUP.CrossRider
[HKLM\Software\Classes\CrossriderApp0035329.BHO] =>PUP.CrossRider
[HKLM\Software\Classes\CrossriderApp0035329.BHO.1] =>PUP.CrossRider
[HKLM\Software\Classes\CrossriderApp0035329.Sandbox] =>PUP.CrossRider
[HKLM\Software\Classes\CrossriderApp0035329.Sandbox.1] =>PUP.CrossRider
[HKLM\Software\Classes\Toolbar.CT3201760] =>Toolbar.Conduit
[HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311531129}] =>PUP.CrossRider
[HKLM\Software\Classes\CLSID\{11111111-1111-1111-1111-110311531129}] =>PUP.CrossRider
[HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220322532229}] =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311531129}] =>PUP.CrossRider
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{D4027C7F-154A-4066-A1AD-4243D8127440} =>Toolbar.Ask^
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:ApnTBMon =>Toolbar.Ask^
[HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks]:{00000000-6E41-4FD3-8538-502F5495E5FC} =>Adware.ShopperReports
[HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]:{D4027C7F-154A-4066-A1AD-4243D8127440} =>Toolbar.Avira
C:\Users\marie-laure\AppData\Local\Google\Chrome\User Data\Default\Extensions\algmakeomkafjglfhpomolfhjppoojff =>Adware.Pricora^
C:\Users\marie-laure\AppData\Local\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde =>Toolbar.DeltaSearch^
C:\Program Files\Pricora =>Adware.Pricora^
C:\ProgramData\Babylon =>PUP.Babylon^
C:\Users\marie-laure\AppData\Roaming\Babylon =>PUP.Babylon^
C:\Users\marie-laure\AppData\Roaming\File Scout =>PUP.FileScout^
C:\Users\marie-laure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard =>PUP.BitGuard^
C:\Program Files\Conduit =>Toolbar.Conduit
C:\Program Files\AskPartnerNetwork =>Toolbar.Ask
C:\ProgramData\AskPartnerNetwork =>Toolbar.Ask
C:\Users\marie-laure\AppData\Roaming\WebPlayerBdd =>Adware.SocialSkinz
C:\Users\marie-laure\AppData\Local\Conduit =>Toolbar.Conduit
C:\Users\marie-laure\AppData\LocalLow\Conduit =>Toolbar.Conduit
C:\Users\marie-laure\AppData\LocalLow\PriceGong =>Adware.PriceGong
C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe =>Toolbar.Ask^
C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe =>Toolbar.Ask^
C:\Windows\Tasks\Pricora-chromeinstaller.job =>Adware.Pricora^
C:\Windows\Tasks\Pricora-codedownloader.job =>Adware.Pricora^
C:\Windows\Tasks\Pricora-enabler.job =>Adware.Pricora^
C:\Program Files\Pricora\Pricora-chromeinstaller.exe =>Adware.Pricora^
C:\Program Files\Pricora\Pricora-codedownloader.exe =>Adware.Pricora^
C:\Program Files\Pricora\Pricora-enabler.exe =>Adware.Pricora^
[HKCU\Software\BabSolution] =>Hijacker.BabSolution^
[HKCU\Software\Conduit] =>Toolbar.Conduit^
[HKCU\Software\DataMngr_Toolbar] =>PUP.Datamngr^
[HKLM\Software\Babylon] =>PUP.Babylon^
[HKLM\Software\Conduit] =>Toolbar.Conduit^
[HKCU\Software\d538cdab238e946\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:dllName="BrowserDefender.dll" =>Hijacker.Hijacker.Eazel^
C:\Users\marie-laure\AppData\Local\Temp\uninst1.exe =>PUP.Babylon
C:\Users\marie-laure\AppData\Local\Temp\MyBabylonTB.exe =>PUP.SweetIM
C:\Users\marie-laure\AppData\Local\Temp\conduitinstaller.exe =>Toolbar.Conduit
C:\Users\marie-laure\AppData\Local\Temp\tbWeb0.dll =>Toolbar.Conduit
~ Additionnel Scan: 309888 Items scanned in 01mn 09s



---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com/apps/blog/show/28927746-toolbar-ask =>Toolbar.Ask
~ http://nicolascoolman.webs.com/apps/blog/show/29294184-adware-pricora =>Adware.Pricora
~ http://nicolascoolman.webs.com/apps/blog/show/27875657-toolbar-deltasearch =>Toolbar.DeltaSearch
~ http://nicolascoolman.webs.com/apps/blog/show/27583526-pup-crossrider =>PUP.CrossRider
~ http://nicolascoolman.webs.com/apps/blog/show/26678994-hijacker-babsolution =>Hijacker.BabSolution
~ http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit
~ http://nicolascoolman.webs.com/apps/blog/show/27583992-pup-datamngr =>PUP.Datamngr
~ http://nicolascoolman.webs.com/apps/blog/show/27557062-adware-vidsaver =>Adware.VidSaver
~ http://nicolascoolman.webs.com/apps/blog/show/27161672-hijacker-eazel =>Hijacker.Eazel
~ http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon =>PUP.Babylon
~ http://nicolascoolman.webs.com/apps/blog/show/34311830-pup-filescout =>PUP.FileScout
~ http://nicolascoolman.webs.com/apps/blog/show/32979753-pup-bitguard =>PUP.BitGuard
~ http://nicolascoolman.webs.com/apps/blog/show/35127313-pua-browserdefendert =>PUA.BrowserDefendert
~ http://nicolascoolman.webs.com/apps/blog/show/28766471-adware-iwinarcade =>Adware.iWinArcade
~ http://nicolascoolman.webs.com/apps/blog/show/26611092-adware-bandoo =>Adware.Bandoo
~ http://nicolascoolman.webs.com/apps/blog/show/26666995-adware-pricegong =>Adware.PriceGong
~ http://nicolascoolman.webs.com/apps/blog/show/28133096-pup-bprotector =>PUP.BProtector
~ http://nicolascoolman.webs.com/apps/blog/show/29344956-adware-similarsites =>Adware.SimilarSites
~ http://nicolascoolman.webs.com/apps/blog/show/27480243-adware-socialskinz =>Adware.SocialSkinz
~ http://nicolascoolman.webs.com/apps/blog/show/29216159-pup-sweetim =>PUP.SweetIM
~ MSI: 20 link(s) detected in 01mn 10s



~ 1453 Legitimates filtered by white list
End of the scan (764 lines in 12mn 29s)(0)