cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

~ Rapport de ZHPDiag v2015.3.15.30 - Nicolas Coolman (15/03/2015)
~ Lancé par Pascal (17/03/2015 01:26:23)
~ Facebook : https://www.facebook.com/nicolascoolman1
~ Adresse du Forum http://forum.nicolascoolman.fr
~ Traduit par Nicolas Coolman
~ Etat de la version : Version à jour.
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by user


---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.17691
MFIE: Mozilla Firefox 36.0.1 (Defaut)
GCIE: Google Chrome v41.0.2272.89

---\\ Informations sur les produits Windows
~ Langage: Français
Windows Server License Manager Script : OK
~ Windows Operating System - Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 3Q6C9
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)

---\\ Logiciels de protection du système
Avast Free Antivirus v10.0.2208
Malwarebytes Anti-Malware version 2.0.4.1028
Windows Defender W7 (Activate)

---\\ Logiciels d'optimisation du système
CCleaner v5.03

---\\ Logiciels de partage PeerToPeer

---\\ Surveillance de Logiciels
Adobe Flash Player 16 NPAPI
Adobe Reader XI

---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 15 Stepping 6, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3071 MB (52% free)
System Restore: Activé (Enable)
System drive C: has 42 GB (28%) free of 149 GB

---\\ Mode de connexion au système
~ Computer Name: PASCAL-PC
~ User Name: Pascal
~ All Users Names: Pascal, HomeGroupUser$, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Pascal\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Pascal\AppData\Roaming\
~ %Desktop% : C:\Users\Pascal\Desktop\
~ %Favorites% : C:\Users\Pascal\Favorites\
~ %LocalAppData% : C:\Users\Pascal\AppData\Local\
~ %StartMenu% : C:\Users\Pascal\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 42 Go of 149 Go)
D: CD-ROM drive (Not Inserted)
E: Hard drive, Flash drive, Thumb drive (Free 48 Go of 75 Go)



---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
~ Security Center: 49 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.36F99BD8A0F09BDBB7850A138845A014] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.20/02/2015 - 02:28:25.) -- C:\Windows\System32\wininet.dll [2358784]
[MD5.8CEBD9D0A0A879CDE9F36F4383B7CAEA] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.17/07/2014 - 03:07:24.) -- C:\Windows\System32\Winlogon.exe [455168]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.21/11/2010 - 04:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.FA886682CFC5D36718D3E436AACF10B9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.30/05/2014 - 07:45:52.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 04:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.24/01/2014 - 03:37:55.) -- C:\Windows\system32\Drivers\ntfs.sys [1684928]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 04:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.70988118145F5F10EF24720B97F35F65] - (.Microsoft Corporation - TDI Translation Driver.) (.11/11/2014 - 02:46:26.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/6754
~ Mes musiques (My Musics) : 1/256
~ Mes Videos (My Videos) : 2/133
~ Mes Favoris (My Favorites) : 1/30
~ Mes Documents (My Documents) : 3/422
~ Mon Bureau (My Desktop) : 2/368
~ Menu demarrer (Programs) : 1/35
~ Hidden Files: Scanned in 00mn 01s



---\\ Processus lancés
[MD5.695BE0A3D240FFF4B876D9289110634A] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastui.exe [5227648] [PID.2488]
[MD5.CA0DD8808296B996C267BDB032ACD346] - (.TeamViewer GmbH - TeamViewer 9.) -- C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe [14433552] [PID.3604]
[MD5.F51D682701B303ED6CC5474CE5FA5AAA] - (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [376944] [PID.3964]
[MD5.7799D7A7F1E8DA3AE35C9FA828C32995] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe [264816] [PID.704]
[MD5.0706510EDEDAF0F4C28B2D98E785DD42] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8186368] [PID.4548]
[MD5.69CDBA2B9C397E349A04FA70DD9170A2] - (.Creative Technology Ltd - Creative Audio Service.) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [307200] [PID.384]
[MD5.E3F7EC811923F3F1A77B185F22638E5E] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344] [PID.1280]
[MD5.FC5B75CA6A1DA31EDD4F8D53F5540B98] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [81088] [PID.1860]
[MD5.650D03E40F93FAE323CB841F80368E5C] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [60744] [PID.1944]
[MD5.F01CC856780524410EA86C07C39E5B77] - (.TeamViewer GmbH - TeamViewer 9.) -- C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [5249808] [PID.2132]
[MD5.70205A4A9C9A8BC5C2FEAECDB80ABA07] - (.TeamViewer GmbH - TeamViewer 9.) -- C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe [229648] [PID.3692]
[MD5.506708142BC63DABA64F2D3AD1DCD5BF] - (.Google Inc. - Programme d'installation de Google.) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [116648] [PID.1380]
~ Processes Running: Scanned in 00mn 00s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Pascal\AppData\Local\Google\Chrome\User Data\Default\Preferences

---\\ Liste des dossiers d'extension Google Chrome
~ Google Lines Browser: 0 Legitimates Filtered in 00mn 00s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\269q68ic.Utilisateur par défaut\prefs.js
C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\3aocckho.Pascal\prefs.js
C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\4n4s13p3.mes parents\prefs.js
C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\51i8dzss.Utilisateur par défaut\prefs.js
C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\5d2qplkd.Utilisateur par défaut\prefs.js
C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\jd4apkwp.default-1410543456642\prefs.js
C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\qlj99664.mes parents\prefs.js
C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\y9qojla3.default-1400798190289\prefs.js (.not file.)
C:\Users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\z0ffxjxl.Utilisateur par défaut\prefs.js
P2 - FPN: [HKCU] [@octoshape.com/Octoshape Streaming Services,version=1.0] - (.Octoshape ApS - Octoshape embedded video plugin.) -- C:\Users\Pascal\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1103234-0-npoctoshape.dll
~ Firefox Browser: 68 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = preserve
R3 - URLSearchHook: (no name) [64Bits] - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Octoshape ApS - Octoshape embedded video plugin.) (No version) -- (.not file.)
~ IE Browser: 12 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\System32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (24)
~ Hosts File: Scanned in 00mn 00s



---\\ Applications lancées au démarrage du système (O4)
O4 - HKLM\..\Wow6432Node\Run: [AvastUI.exe] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
~ Application: Scanned in 00mn 00s



---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: &Envoyer à OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} -- C:\Program Files (x86)\MICROS~2\Office14\ONBttnIE.dll (.not file.)
O9 - Extra button: Notes &liées OneNote [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} -- C:\Program Files (x86)\MICROS~2\Office14\ONBTTN~1.dll (.not file.)
O9 - Extra button: Skype Click to Call settings [64Bits] - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} -- c:\program files (x86)\skype\toolbars\internet explorer x64\icon.ico (.not file.)
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{79713D8C-3F87-4691-9537-78E7343700FA}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{BBCB2544-5229-45DD-9468-05795802F1A9}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{79713D8C-3F87-4691-9537-78E7343700FA}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{BBCB2544-5229-45DD-9468-05795802F1A9}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{79713D8C-3F87-4691-9537-78E7343700FA}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{BBCB2544-5229-45DD-9468-05795802F1A9}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation
O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [{C31BB8CE-4865-42AE-9025-8E7259FF2E80}] (...) -- C:\Users\Pascal\Downloads\ZHPDiag2.exe (.not file.) [0]
[MD5.7D653C1217B3414DFCAC80988742C32A] [APT] [{CA1A0AE1-6ABC-4881-ABC1-8AAFDEE949C2}] (...) -- C:\Users\Pascal\Downloads\ChromeSetup(1).exe [483888]
[MD5.00000000000000000000000000000000] [APT] [{EE8CAAC7-D948-4CF8-94FC-A920376FFAC2}] (...) -- C:\Users\Pascal\Downloads\ZHPDiag2(1).exe (.not file.) [0]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater [1002]
~ Scheduled Task: 9 Legitimates Filtered in 00mn 02s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\OB]
[HKCU\Software\oTweak] =>PUP.oTweak
[HKLM\Software\AdsFix]
[HKLM\Software\Shortcut_Module]
~ Key Software: 252 Legitimates Filtered in 00mn 00s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 08/09/2014 - 19:16:36 - [0] ----D C:\Program Files (x86)\oTweak =>PUP.oTweak
O43 - CFD: 12/04/2011 - 10:27:52 - [0] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC
O43 - CFD: 16/10/2014 - 01:27:15 - [] ----D C:\Users\Pascal\AppData\Local\5486
O43 - CFD: 15/11/2014 - 22:41:24 - [] -SH-D C:\Users\Pascal\AppData\Local\EmieBrowserModeList
~ Program Folder: 196 Legitimates Filtered in 00mn 00s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.41BD521592590D9C3EB59D3B6563A9BB] - 02/03/2015 - 10:37:55 ---A- . (...) -- C:\Windows\System32\2015-03-02-09-37-20.058-AvastVBoxSVC.exe-3372.log [197]
O44 - LFC:[MD5.9EF99DB1445F8885B7A6C55521556118] - 02/03/2015 - 20:07:39 ---A- . (...) -- C:\Windows\System32\2015-03-02-19-07-08.066-AvastVBoxSVC.exe-2764.log [197]
O44 - LFC:[MD5.69CFE6DF27943B49DC7A8E488CE2A4E6] - 03/03/2015 - 10:37:19 ---A- . (...) -- C:\Windows\System32\2015-03-03-09-37-09.082-AvastVBoxSVC.exe-3388.log [197]
O44 - LFC:[MD5.3C1DA6BB9AB27754E37B0AA8884008CB] - 03/03/2015 - 23:55:51 ---A- . (...) -- C:\Windows\System32\2015-03-03-22-55-49.094-AvastVBoxSVC.exe-596.log [197]
O44 - LFC:[MD5.F1ECFF7CAC0FA9E134F0550C5C6B5498] - 04/03/2015 - 10:29:07 ---A- . (...) -- C:\Windows\System32\2015-03-04-09-28-33.044-AvastVBoxSVC.exe-2768.log [197]
O44 - LFC:[MD5.C43A4820AFF015901BC43ADC836A86EE] - 04/03/2015 - 19:37:43 ---A- . (...) -- C:\Windows\System32\2015-03-04-18-37-10.060-AvastVBoxSVC.exe-2156.log [197]
O44 - LFC:[MD5.BB237495C3898ADAFBDFD0359DCB24E5] - 04/03/2015 - 23:50:39 ---A- . (...) -- C:\Windows\System32\2015-03-04-22-50-29.000-AvastVBoxSVC.exe-3056.log [197]
O44 - LFC:[MD5.99658AD220A1C017DB212E1F8D6445B0] - 05/03/2015 - 10:31:38 ---A- . (...) -- C:\Windows\System32\2015-03-05-09-31-37.026-AvastVBoxSVC.exe-2348.log [197]
O44 - LFC:[MD5.3C7C3D8363513F1B6679E0A25DF35AC5] - 05/03/2015 - 19:55:43 ---A- . (...) -- C:\Windows\System32\2015-03-05-18-55-14.066-AvastVBoxSVC.exe-1436.log [197]
O44 - LFC:[MD5.686A2172D9126BA65F1513DED1A0C81E] - 05/03/2015 - 23:49:48 ---A- . (...) -- C:\Windows\System32\2015-03-05-22-49-16.065-AvastVBoxSVC.exe-2448.log [197]
O44 - LFC:[MD5.D2930BE49827BD6A53844094E9B34731] - 06/03/2015 - 10:49:34 ---A- . (...) -- C:\Windows\System32\2015-03-06-09-49-17.032-AvastVBoxSVC.exe-972.log [197]
O44 - LFC:[MD5.8F0BCD362C0FFE65A5BF88B4A4767CC9] - 06/03/2015 - 21:10:05 ---A- . (...) -- C:\Windows\System32\2015-03-06-20-09-52.085-AvastVBoxSVC.exe-572.log [197]
O44 - LFC:[MD5.43D7C7CA507C5EDA703E2D4F1124FC49] - 07/03/2015 - 00:06:36 ---A- . (...) -- C:\Windows\System32\2015-03-06-23-06-26.070-AvastVBoxSVC.exe-3332.log [197]
O44 - LFC:[MD5.12F58A3E094D63ACF9B51ABAD716BF88] - 07/03/2015 - 10:38:25 ---A- . (...) -- C:\Windows\System32\2015-03-07-09-38-15.076-AvastVBoxSVC.exe-2872.log [197]
O44 - LFC:[MD5.D11BB06DE829A95800F64D77640EF4F6] - 07/03/2015 - 18:47:39 ---A- . (...) -- C:\Windows\System32\2015-03-07-17-47-31.073-AvastVBoxSVC.exe-3036.log [197]
O44 - LFC:[MD5.33D6DB1AD8C460FD963AF4C3080AC12D] - 07/03/2015 - 23:43:12 ---A- . (...) -- C:\Windows\System32\2015-03-07-22-42-37.092-AvastVBoxSVC.exe-2904.log [197]
O44 - LFC:[MD5.223B61595C21D5F479C26FF63CEAAA65] - 08/03/2015 - 10:42:04 ---A- . (...) -- C:\Windows\System32\2015-03-08-09-41-33.029-AvastVBoxSVC.exe-3116.log [197]
O44 - LFC:[MD5.E2F606B772307EC7388D7601FA4F73C4] - 08/03/2015 - 20:38:46 ---A- . (...) -- C:\Windows\System32\2015-03-08-19-38-45.000-AvastVBoxSVC.exe-3092.log [197]
O44 - LFC:[MD5.F1C8D2BA19F0F82D57D00C3BD36CB4B4] - 09/03/2015 - 00:04:57 ---A- . (...) -- C:\Windows\System32\2015-03-08-23-04-28.047-AvastVBoxSVC.exe-2896.log [197]
O44 - LFC:[MD5.C5013242C4E39BD724E0253249FF64BD] - 09/03/2015 - 10:32:33 ---A- . (...) -- C:\Windows\System32\2015-03-09-09-32-32.025-AvastVBoxSVC.exe-3164.log [197]
O44 - LFC:[MD5.1677F6DE05B78EBF07B29C6E3F81F3CA] - 09/03/2015 - 19:40:49 ---A- . (...) -- C:\Windows\System32\2015-03-09-18-40-21.093-AvastVBoxSVC.exe-392.log [197]
O44 - LFC:[MD5.06A9501ADADE1E027931DDE65AF9C5E0] - 09/03/2015 - 23:58:03 ---A- . (...) -- C:\Windows\System32\2015-03-09-22-57-35.011-AvastVBoxSVC.exe-2252.log [197]
O44 - LFC:[MD5.A87C0FB2EF6D3039AEA9A68B6C1DCF97] - 10/03/2015 - 10:34:38 ---A- . (...) -- C:\Windows\System32\2015-03-10-09-34-05.028-AvastVBoxSVC.exe-3208.log [197]
O44 - LFC:[MD5.9CE488E35CEB92F938358D8F46ADFD95] - 10/03/2015 - 19:35:17 ---A- . (...) -- C:\Windows\System32\2015-03-10-18-34-51.085-AvastVBoxSVC.exe-3132.log [197]
O44 - LFC:[MD5.E70049B9D8239317B46001585605ED9C] - 11/03/2015 - 19:39:57 ---A- . (...) -- C:\Windows\System32\2015-03-11-18-39-36.094-AvastVBoxSVC.exe-1592.log [197]
O44 - LFC:[MD5.BB33E5BC309624ED2D066C9F3CAAA596] - 11/03/2015 - 23:15:39 ---A- . (...) -- C:\Windows\System32\2015-03-11-22-15-39.083-AvastVBoxSVC.exe-2524.log [197]
O44 - LFC:[MD5.14D7192D69F287D11614FB151D6F4C6D] - 12/03/2015 - 19:36:34 ---A- . (...) -- C:\Windows\System32\2015-03-12-18-36-30.069-AvastVBoxSVC.exe-4076.log [197]
O44 - LFC:[MD5.51042D4CDA1628B7DB45E7D89E9D7009] - 12/03/2015 - 19:42:51 ---A- . (...) -- C:\Windows\System32\2015-03-12-18-36-36.089-aswFe.exe-3324.log [247]
O44 - LFC:[MD5.5B131A2B55F7A00F42C66B0D2846D513] - 12/03/2015 - 19:43:08 ---A- . (...) -- C:\Windows\System32\2015-03-12-18-42-59.063-aswFe.exe-1308.log [247]
O44 - LFC:[MD5.186204AE0E8D282862FCF53306BE1931] - 13/03/2015 - 01:13:56 ---A- . (...) -- C:\Windows\System32\2015-03-13-00-13-45.043-AvastVBoxSVC.exe-152.log [197]
O44 - LFC:[MD5.83EBF5D994B8E4F7D4110B0AE029C2EE] - 13/03/2015 - 10:36:14 ---A- . (...) -- C:\Windows\System32\2015-03-13-09-35-50.092-AvastVBoxSVC.exe-3092.log [197]
O44 - LFC:[MD5.49A6FFFACAABB68940BAB6D9C1864FA9] - 13/03/2015 - 19:32:12 ---A- . (...) -- C:\Windows\System32\2015-03-13-18-31-51.086-AvastVBoxSVC.exe-2956.log [197]
O44 - LFC:[MD5.BE0DDD49AB919C161B2DF5F0FF22C5FC] - 13/03/2015 - 23:15:42 ---A- . (...) -- C:\Windows\System32\2015-03-13-22-15-23.043-AvastVBoxSVC.exe-3236.log [197]
O44 - LFC:[MD5.9590B9D466E67EEF8A95354ABE3F044B] - 14/03/2015 - 21:36:49 ---A- . (...) -- C:\Windows\System32\2015-03-14-20-36-34.091-AvastVBoxSVC.exe-3092.log [197]
O44 - LFC:[MD5.20B165D16FD653CEB20F2F7B0885E442] - 15/03/2015 - 01:34:55 ---A- . (...) -- C:\Windows\System32\2015-03-15-00-34-54.019-AvastVBoxSVC.exe-3088.log [197]
O44 - LFC:[MD5.A8A81D2136EC787A9B6B9DB32CC1962F] - 15/03/2015 - 21:36:38 ---A- . (...) -- C:\Windows\System32\2015-03-15-20-36-06.096-AvastVBoxSVC.exe-2768.log [197]
O44 - LFC:[MD5.0AAB71609A3F8B75D3DCE7EB99B570AF] - 16/03/2015 - 00:14:05 ---A- . (...) -- C:\Windows\System32\2015-03-15-23-14-04.032-AvastVBoxSVC.exe-2864.log [197]
O44 - LFC:[MD5.45FB25BF3E8ED1085DA1574BB7449E07] - 16/03/2015 - 10:29:59 ---A- . (...) -- C:\Windows\System32\2015-03-16-09-29-30.058-AvastVBoxSVC.exe-1388.log [197]
O44 - LFC:[MD5.FAEE1B3B9AAED7AE5B8FBEFBA995B2DF] - 16/03/2015 - 19:34:10 ---A- . (...) -- C:\Windows\System32\2015-03-16-18-34-05.075-AvastVBoxSVC.exe-1928.log [197]
~ Files: 168 Legitimates Filtered in 00mn 02s



---\\ Opérations et fonctions au démarrage de Windows Explorer (O46)
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook [64Bits] - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
~ ShellExecuteHooks: Scanned in 00mn 00s



---\\ Enumération des clés de registre StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\Octoshape Streaming Services [Key] . (.Octoshape ApS - Main program for Octoshape client.) -- C:\Users\Pascal\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
~ SMSR Keys: 8 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 19 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 4 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:29/03/2005 - 00:30:38 ---A- . (.Pas de propriétaire - ATK0110 ACPI Utility.) -- C:\Windows\System32\Drivers\ASACPI.sys [8192]
O58 - SDL:15/11/2014 - 20:15:55 ---A- . (...) -- C:\Windows\System32\Drivers\aswHwid.sys [29208] =>.ALWIL Software
O58 - SDL:15/11/2014 - 20:15:55 ---A- . (...) -- C:\Windows\System32\Drivers\aswRvrt.sys [65776] =>.ALWIL Software
O58 - SDL:15/11/2014 - 20:15:55 ---A- . (...) -- C:\Windows\System32\Drivers\aswVmm.sys [267632] =>.ALWIL Software
O58 - SDL:14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:04/06/2009 - 09:34:40 ---A- . (.Guillemot Corp S.A. - Guillemot USB Audio Processing Filter.) -- C:\Windows\System32\Drivers\guillflt.sys [65024]
O58 - SDL:10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:16/06/2011 - 16:34:44 ---A- . (.Windows (R) Win 7 DDK provider - AVStream Simulated Hardware Sample.) -- C:\Windows\System32\Drivers\S6000KNT.sys [3359832]
O58 - SDL:14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
O58 - SDL:20/10/2014 - 20:36:31 ---A- . (...) -- C:\Windows\System32\Drivers\TrueSight.sys [37624]
O58 - SDL:15/08/2014 - 23:35:00 ---A- . (.Apple, Inc. - Apple Mobile Device USB Driver.) -- C:\Windows\System32\Drivers\usbaapl64.sys [54784]
~ Drivers: 68 Legitimates Filtered in 00mn 00s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2015 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
O63 - Logiciel: ZHPFix 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPFix_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 15/11/2014 - C:\Windows\system32\drivers\aswHwid.sys (aswHwid) .(...) - LEGACY_ASWHWID
O64 - Services: CurCS - 15/11/2014 - C:\Windows\system32\drivers\aswMonFlt.sys (aswMonFlt) .(.AVAST Software - avast! File System Minifilter for Windows 2.) - LEGACY_ASWMONFLT
O64 - Services: CurCS - 15/11/2014 - C:\Windows\System32\Drivers\aswVmm.sys (aswVmm) .(...) - LEGACY_ASWVMM
O64 - Services: CurCS - 10/06/2009 - C:\Windows\System32\Drivers\secdrv.sys (secdrv) .(.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) - LEGACY_SECDRV
~ Legacy: 121 Legitimates Filtered in 00mn 00s



---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> [HKLM\..\open\Command] (.Not Key.)
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <>[HKLM\..\Shell\open\Command] (.Not Key.)
~ Keys: Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {63AB08BF-9FAF-4490-BAC7-87A5F5B37C70} - (Yahoo!) - http://search.yahoo.com
O69 - SBI: SearchScopes [HKCU] {B1D3CC70-BA04-4F00-8956-69C28CEF5E73} - (Google) - http://www.google.com
~ Keys: Scanned in 00mn 00s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 04/02/2015 267440 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 14/10/2014 79360 | (Creative ALchemy AL6 Licensing Service) . (.Creative Labs.) - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
SS - | Demand 14/10/2014 79360 | (Creative Audio Engine Licensing Service) . (.Creative Labs.) - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
SS - | Auto 16/06/2014 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 16/06/2014 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 06/03/2015 148080 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Auto 02/01/2015 315488 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Auto 22/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 19/12/2014 81088 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 07/10/2014 60744 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 11/02/2010 952320 | (Ati External Event Utility) . (.ATI Technologies Inc..) - C:\Windows\System32\Ati2evxx.exe
SR - | Auto 15/11/2014 50344 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SR - | Demand 15/11/2014 4012248 | (AvastVBoxSvc) . (.Avast Software.) - C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
SR - | Auto 18/11/2008 307200 | (CTAudSvcService) . (.Creative Technology Ltd.) - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
SR - | Auto 09/02/2015 5249808 | (TeamViewer9) . (.TeamViewer GmbH.) - C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 11s



---\\ Scan Additionnel (O88)
Database Version : 13008 - (15/03/2015)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 1
Fichiers trouvés (Files found) : 1

C:\Program Files (x86)\oTweak =>PUP.oTweak^
[HKCU\Software\oTweak] =>PUP.oTweak^
~ Additionnel Scan: 246943 Items scanned in 00mn 57s



---\\ Informations complémentaires sur les modules
~ http://nicolascoolman.fr/r5-internet-explorer-proxy-management-iepm/ =>.Internet Explorer, Proxy Management (R5)
~ http://nicolascoolman.fr/o4-applications-demarrees-par-le-registre/ =>.Applications lancées au démarrage du système (O4)
~ AMI: 2 Legitimates Filtered in 00mn 00s



---\\ Récapitulatif des détections trouvées sur votre station
http://www.nicolascoolman.fr/blog/ =>PUP.oTweak
~ MSI: 1 link(s) detected in 00mn 00s



~ 1041 Legitimates filtered by white list
End of the scan (436 lines in 01mn 41s)(0.11)

Publicité


Signaler le contenu de ce document

Publicité