cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

~ Report of ZHPDiag v2015.3.19.31 - Nicolas Coolman (19-03-2015)
~ Launched by ali (20-03-2015 4:36:46)
~ Facebook : https://www.facebook.com/nicolascoolman1
~ Web forum address : http://forum.nicolascoolman.fr
~ Translated by
~ Version State : Updated version.
~ White List : Deactivate by user
~ Elevation of privilege : OK
~ User Account Control : Not Found


---\\ Internet browsers
MSIE: Internet Explorer v6.0.2900.5512 (Defaut)
MFIE: Mozilla Firefox 34.0.5
GCIE: Google Chrome v41.0.2272.101
OPIE: Opera v11.01

---\\ Windows product information
~ Langage: Anglais
Windows Automatic Updates : OK
Windows Genuine Advantage : KO
Microsoft Windows XP, 32-bit Service Pack 3 (Build 2600)

---\\ System protection software

---\\ System optimization software

---\\ Sharing software PeerToPeer

---\\ Surveillance software
Adobe Flash Player 16 NPAPI

---\\ Information on the system
~ Processor: x86 Family 6 Model 15 Stepping 13, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 2046.2 MB (53% free)
System Restore: Activé (Enable)
System drive C: has 5 GB (12%) free of 39 GB

---\\ Connection to the system mode
~ Computer Name: OUSSAMA
~ User Name: ali
~ All Users Names: SUPPORT_388945a0, HelpAssistant, ASPNET, ali, Administrateur,
~ Unselected Option: None
Logged in as Administrator

---\\ Environment variables
~ System Unit : C:\
~ %AppZHP% : C:\Documents and Settings\ali\Application Data\ZHP\
~ %AppData% : C:\Documents and Settings\ali\Application Data\
~ %Desktop% : C:\Documents and Settings\ali\Bureau\
~ %Favorites% : C:\Documents and Settings\ali\Favoris\
~ %LocalAppData% : C:\Documents and Settings\ali\Local Settings\Application Data\
~ %StartMenu% : C:\Documents and Settings\ali\Menu Démarrer\
~ %Windir% : C:\WINDOWS.0\
~ %System% : C:\WINDOWS.0\system32\

---\\ Enumeration of the disk units
A: Floppy drive, Flash card reader, USB Key (Not Inserted)
C: Hard drive, Flash drive, Thumb drive (Free 5 Go of 39 Go)
D: Hard drive, Flash drive, Thumb drive (Free 0 Go of 39 Go)
E: Hard drive, Flash drive, Thumb drive (Free 23 Go of 39 Go)
F: Hard drive, Flash drive, Thumb drive (Free 31 Go of 32 Go)
G: CD-ROM drive (Not Inserted)



---\\ State of the Windows Security Center
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Intl: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] XMLLookup: OK
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK
[HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] Load: OK
[HKLM\SYSTEM\CurrentControlSet\Services\COMSysApp] Type: OK
~ Security Center: 37 Scanned in 00mn 00s



---\\ Search Generic System Files
[MD5.1384D4A46ABEF2EB253819CE38C79E98] - (.Microsoft Corporation - Explorateur Windows.) (.13-09-2007 - 23:22:49.) -- C:\WINDOWS.0\Explorer.exe [1037824]
[MD5.4A6E04EA20F48D750D9BFED8600D516B] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.14-04-2008 - 3:33:50.) -- C:\WINDOWS.0\system32\wininet.dll [670208]
[MD5.DD73D6B9F6B4CB630CF35B438B540174] - (.Microsoft Corporation - Application d'ouverture de session Windows NT.) (.14-04-2008 - 3:34:30.) -- C:\WINDOWS.0\system32\Winlogon.exe [512000]
[MD5.322D0E36693D6E24A2398BEE62A268CD] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.13-04-2008 - 20:19:24.) -- C:\WINDOWS.0\system32\Drivers\AFD.sys [138112]
[MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.13-04-2008 - 19:40:32.) -- C:\WINDOWS.0\system32\Drivers\atapi.sys [96512]
[MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13-04-2008 - 20:14:22.) -- C:\WINDOWS.0\system32\Drivers\Cdfs.sys [63744]
[MD5.1F4260CC5B42272D71F79E570A27A4FE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.13-04-2008 - 19:40:48.) -- C:\WINDOWS.0\system32\Drivers\Cdrom.sys [62976]
[MD5.31F923EB2170FC172C81ABDA0045D18C] - (.Microsoft Corporation - Pilote de cryptographie FIPS.) (.14-04-2008 - 2:57:40.) -- C:\WINDOWS.0\system32\Drivers\Fips.sys [44672]
[MD5.573C7D0A32852B48F3058CFD8026F511] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.13-04-2008 - 17:36:06.) -- C:\WINDOWS.0\system32\Drivers\HDAudBus.sys [144384]
[MD5.A09BDC4ED10E3B2E0EC27BB94AF32516] - (.Microsoft Corporation - Pilote de port i8042.) (.14-04-2008 - 3:00:54.) -- C:\WINDOWS.0\system32\Drivers\i8042prt.sys [54144]
[MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.13-04-2008 - 19:41:00.) -- C:\WINDOWS.0\system32\Drivers\Imapi.sys [42112]
[MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.13-04-2008 - 19:57:16.) -- C:\WINDOWS.0\system32\Drivers\IpNat.sys [152832]
[MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.13-04-2008 - 20:19:44.) -- C:\WINDOWS.0\system32\Drivers\IPSec.sys [75264]
[MD5.68755F0FF16070178B54674FE5B847B0] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.13-04-2008 - 20:17:02.) -- C:\WINDOWS.0\system32\Drivers\MRxSmb.sys [456576]
[MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.13-04-2008 - 20:21:02.) -- C:\WINDOWS.0\system32\Drivers\netBT.sys [162816]
[MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.13-04-2008 - 20:15:54.) -- C:\WINDOWS.0\system32\Drivers\ntfs.sys [574976]
[MD5.8FD0BDBEA875D06CCF6C945CA9ABAF75] - (.Microsoft Corporation - Pilote de port parallèle.) (.14-04-2008 - 3:47:24.) -- C:\WINDOWS.0\system32\Drivers\Parport.sys [80384]
[MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13-04-2008 - 20:19:44.) -- C:\WINDOWS.0\system32\Drivers\Rasl2tp.sys [51328]
[MD5.15CABD0F7C00C47C70124907916AF3F1] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.13-04-2008 - 11:32:52.) -- C:\WINDOWS.0\system32\Drivers\rdpdr.sys [196224]
[MD5.D8EB2A7904DB6C916EB5361878DDCBAE] - (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) (.13-04-2008 - 19:57:36.) -- C:\WINDOWS.0\system32\Drivers\redbook.sys [58752]
[MD5.46DE1126684369BACE4849E4FC8C43CA] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.14-04-2008 - 2:56:06.) -- C:\WINDOWS.0\system32\Drivers\volsnap.sys [53376]
~ Generic Processes: Scanned in 00mn 00s



---\\ Hidden files state (Hidden/Total)
Mes images (My Pictures) : 2/2 (Modified)
~ Mes Videos (My Videos) : 0/0
~ Mes Favoris (My Favorites) : 1/7
~ Mes Documents (My Documents) : 2/162
~ Mon Bureau (My Desktop) : 3/3050
~ Menu demarrer (Programs) : 1/48
~ Hidden Files: Scanned in 00mn 00s



---\\ Process running
[MD5.BD421E6F0827CB66619B61631BD1713C] - (.ATI Technologies Inc. - ATI External Event Utility EXE Module.) -- C:\WINDOWS.0\system32\Ati2evxx.exe [643072] [PID.1144]
[MD5.335D0B4D2CADA2C9714B76E3A782F7E1] - (...) -- \system32\rundll32.exe [0] [PID.1464]
[MD5.8DD9C4243510CCB45844A6C5FBCC6421] - (.Oppoos.com - GenieCleanService.exe.) -- C:\Program Files\Genie Soft\Genie Cleaner\GenieCleanService.exe [53400] [PID.1736]
[MD5.3FF37FDC4D490F8092753E2E268209AD] - (.Mobogenie.com - MobogenieService.exe.) -- C:\Program Files\Mobogenie3\MobogenieService.exe [127168] [PID.1848] =>PUP.Mobogenie
[MD5.9DA3B55B17B54789AFB8C657D4ACE4D7] - (.DEVGURU Co., LTD. - MSS CS Connectivity Service.) -- C:\Program Files\SAMSUNG\USB Drivers\25_escape\conn\ss_conn_service.exe [743688] [PID.1352]
[MD5.6FACA9C62024E14251C7ED33A8E8B660] - (.WIBU-SYSTEMS AG - CodeMeter Runtime Server.) -- C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe [2571704] [PID.292]
[MD5.2A1BFA17B6C5F60F6150A9FA4EDB312F] - (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\IDMan.exe [3825232] [PID.2068]
[MD5.9201E92771F3D536DA4A53FDCC4B976B] - (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe [809288] [PID.216]
[MD5.A9BF6E5F3A667DA088A6268EBC53DB63] - (...) -- C:\Program Files\Mobogenie3\MoboGenieHelper.exe [105152] [PID.2104] =>PUP.Mobogenie
[MD5.6577E0208F612DAF5DE5AD4081BE7696] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8187904] [PID.3612]
~ Processes Running: Scanned in 00mn 00s



---\\ Opera, Plugins,Start,Search (P1,B0,B1)
B0 - SPO: operaprefs.ini [ali] Home URL=http://www.default-search.net/search?sid=503&aid=112&itype=n&ver=13986&tm=575&src=hmp =>Hijacker.Browsers
B1 - OSP: search.ini [ali] URL=http://www.default-search.net/search?sid=503&aid=112&itype=n&ver=13986&tm=575&src=ds&p=%s =>Hijacker.Browsers
~ Opera Browser: 2 Scanned in 00mn 00s



---\\ Google Chrome, Start,Search,Extensions (G0,G1,G2)
C:\Documents and Settings\ali\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences

---\\ Google Chrome Extension Folder
~ Google Lines Browser: 0 Scanned in 00mn 12s



---\\ Mozilla Firefox,Plugins,Start,Search,Extensions (P2,M0,M1,M2,M3)
M2 - MFEP: RegExtension {B64D9B05-48E1-4CEB-BF58-E0643994E900} . (...) -- C:\Program Files\Fichiers communs\DVDVideoSoft\plugins\ff\ (.not file.)
M2 - MFEP: prefs.js [ali - yuj1hr66.default-1421946452526\31@k.com] [] UniDeAlsse v2.0 (..) =>PUP.UniDeals
M2 - MFEP: prefs.js [ali - yuj1hr66.default-1421946452526\E5@Lj.com] [] Feun2Save v4.5 (..) =>PUP.Fun2Save
M2 - MFEP: Extension [ali - yuj1hr66.default-1421946452526] {f3bd3dd2-2888-44c5-91a2-2caeb33fb898}.xpi
P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (...) -- C:\WINDOWS.0\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll
P2 - FPN: [HKLM] [@microsoft.com/WPF,version=3.5] - (.Microsoft Corporation - Windows Presentation Foundation (WPF) plug-in for Mozilla browsers.) -- C:\WINDOWS.0\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=3] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll
P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=9] - (.Google Inc. - Google Update.) -- C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll
P2 - FPN: [HKLM] [@videolan.org/vlc,version=2.0.7] - (.VideoLAN - VLC media player Web Plugin 2.0.6.) -- C:\Program Files\VideoLAN\VLC\npvlc.dll =>.VideoLAN
P2 - FPN: [HKCU] [@Skype Limited.com/Facebook Video Calling Plugin] - (.Skype Limited - Facebook Video Calling Plugin.) -- C:\Documents and Settings\ali\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll
~ Firefox Browser: 10 Scanned in 00mn 00s



---\\ Internet Explorer Extensions, Start, Search (R4,R3,R0,R1)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com
R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Skype Limited - Facebook Video Calling Plugin.) (No version) -- (.not file.)
~ IE Browser: 7 Scanned in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Line Analysis F0, F1, F2, F3 - IniFiles, Auto loading programs
F2 - REG:system.ini: USERINIT=C:\WINDOWS.0\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\WINDOWS.0\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (0)
~ Hosts File: Scanned in 00mn 00s



---\\ Browser Helper Objects (O2)
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} . (.Internet Download Manager, Tonec Inc. - IDM Browser Helper Object.) -- C:\Program Files\IDMIECC.dll
O2 - BHO: TTaKeTheCoaupon - {1d323cf5-af3b-4c93-ba7e-b5356b98749a} . (...) -- C:\Program Files\TTaKeTheCoaupon\1w3Y8AfjsVMEr2.dll =>PUP.TakeTheCoupon
O2 - BHO: DeAlExpresis - {ef73607b-7088-477c-8d17-6622f63c85d2} . (...) -- C:\Program Files\DeAlExpresis\1SZofLXgnhSAqV.dll =>PUP.DealExpress
~ BHO: 6 Scanned in 00mn 00s



---\\ Internet Explorer toolbars (O3)
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{01E04581-4EEE-11D0-BFE9-00AA005B4383} Orphan key
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{0E5CBF21-D15F-11D0-8301-00AA005B4383} Orphan key
~ Toolbar: Scanned in 00mn 00s



---\\ Auto loading programs from Registry and folders (O4)
O4 - HKLM\..\Run: [AntiWormUpdate] C:\Google\AutoIt3.exe (.not file.)
O4 - HKLM\..\Run: [AntiUsbWorm] . (.Microsoft Corporation - Interpréteur de commandes Windows.) -- C:\WINDOWS.0\system32\cmd.exe =>.Microsoft Corporation
O4 - HKLM\..\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe =>.Advanced Micro Devices, Inc
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [BlueStacks Agent] C:\Program Files\BlueStacks\HD-Agent.exe (.not file.)
O4 - HKCU\..\Run: [AntiWormUpdate] C:\Google\AutoIt3.exe (.not file.)
O4 - HKCU\..\Run: [AntiUsbWorm] . (.Microsoft Corporation - Interpréteur de commandes Windows.) -- C:\WINDOWS.0\system32\cmd.exe =>.Microsoft Corporation
O4 - HKCU\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS.0\system32\CTFMON.exe
O4 - HKCU\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\IDMan.exe
O4 - HKCU\..\Run: [GenieFloater] . (.Oppoos.com - GenieFloater.) -- C:\Program Files\Genie Soft\Genie Cleaner\GenieFloater.exe
O4 - HKCU\..\Run: [uTorrent] . (.BitTorrent Inc. - µTorrent.) -- C:\Documents and Settings\ali\Application Data\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - HKCU\..\Run: [Skype] C:\Program Files\Skype\Phone\Skype.exe (.not file.)
O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Documents and Settings\ali\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS.0\system32\CTFMON.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS.0\system32\CTFMON.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS.0\system32\CTFMON.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS.0\system32\CTFMON.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
O4 - HKUS\S-1-5-21-1123561945-1275210071-1417001333-1003\..\Run: [AntiWormUpdate] C:\Google\AutoIt3.exe (.not file.)
O4 - HKUS\S-1-5-21-1123561945-1275210071-1417001333-1003\..\Run: [AntiUsbWorm] . (.Microsoft Corporation - Interpréteur de commandes Windows.) -- C:\WINDOWS.0\system32\cmd.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-1123561945-1275210071-1417001333-1003\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS.0\system32\CTFMON.exe
O4 - HKUS\S-1-5-21-1123561945-1275210071-1417001333-1003\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\IDMan.exe
O4 - HKUS\S-1-5-21-1123561945-1275210071-1417001333-1003\..\Run: [GenieFloater] . (.Oppoos.com - GenieFloater.) -- C:\Program Files\Genie Soft\Genie Cleaner\GenieFloater.exe
O4 - HKUS\S-1-5-21-1123561945-1275210071-1417001333-1003\..\Run: [uTorrent] . (.BitTorrent Inc. - µTorrent.) -- C:\Documents and Settings\ali\Application Data\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - HKUS\S-1-5-21-1123561945-1275210071-1417001333-1003\..\Run: [Skype] C:\Program Files\Skype\Phone\Skype.exe (.not file.)
O4 - HKUS\S-1-5-21-1123561945-1275210071-1417001333-1003\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Documents and Settings\ali\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe
~ Application: Scanned in 00mn 00s



---\\ Extra buttons on main IE button toolbar, or extra items in IE 'Tools' menu (O9)
O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -- Orphan key
O9 - Extra button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} . (...) -- C:\Program Files\Fichiers communs\DVDVideoSoft\plugins\dvdvideosoft.ico
O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\WINDOWS.0\system32\mswsock.dll =>.Microsoft Corporation
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\WINDOWS.0\system32\winrnr.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\WINDOWS.0\system32\mswsock.dll =>.Microsoft Corporation
O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - Windows Sockets Helper DLL.) -- C:\WINDOWS.0\system32\wshbth.dll
~ Winsock: 4 Scanned in 00mn 00s



---\\ Lop.com/Domain Hijackers (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{C018E5E6-398A-4E0F-9D06-0ACC8DE6C97F}: DhcpNameServer = 0.0.0.0
O17 - HKLM\System\CCS\Services\Tcpip\..\{E2F21ED5-ECCC-4F89-A77B-62E3F27C047E}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{C018E5E6-398A-4E0F-9D06-0ACC8DE6C97F}: DhcpNameServer = 0.0.0.0
O17 - HKLM\System\CS1\Services\Tcpip\..\{E2F21ED5-ECCC-4F89-A77B-62E3F27C047E}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{68A75FD6-69A9-4B0D-8BF7-4282E940E19C}: NameServer = 8.8.8.8 193.251.169.165
O17 - HKLM\System\CS2\Services\Tcpip\..\{D895B13C-2A1B-4606-9E20-C247F5990C1C}: NameServer = 209.244.0.3 8.8.8.8
O17 - HKLM\System\CS2\Services\Tcpip\..\{C018E5E6-398A-4E0F-9D06-0ACC8DE6C97F}: DhcpNameServer = 0.0.0.0
O17 - HKLM\System\CS2\Services\Tcpip\..\{E2F21ED5-ECCC-4F89-A77B-62E3F27C047E}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 0.0.0.0
~ Domain: Scanned in 00mn 00s



---\\ Extra protocols (O18)
O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} . (.Microsoft Corporation - WIA Scripting Layer.) -- C:\WINDOWS.0\system32\wiascr.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ AppInit_DLLs Registry value Autorun (O20)
O20 - Winlogon Notify: AtiExtEvent . (.ATI Technologies Inc. - ATI External Event Utility DLL Module.) -- C:\WINDOWS.0\system32\Ati2evxx.dll
O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS.0\system32\crypt32.dll
O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS.0\system32\cryptnet.dll
O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agent réseau hors connexion.) -- C:\WINDOWS.0\system32\cscdll.dll
O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS.0\system32\dimsntfy.dll
O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS.0\system32\wlnotify.dll
O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS.0\system32\wlnotify.dll
O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL secondaire de notification de service d.) -- C:\WINDOWS.0\system32\sclgntfy.dll
O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS.0\system32\WlNotify.dll
O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS.0\system32\wlnotify.dll
O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL commune de réception des notifications.) -- C:\WINDOWS.0\system32\wlnotify.dll
~ Winlogon: Scanned in 00mn 00s



---\\ ShellServiceObjectDelayLoad (O21)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} . (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS.0\system32\SHELL32.dll
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} . (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS.0\system32\SHELL32.dll
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} . (.Microsoft Corporation - Contrôleur de site Web.) -- C:\WINDOWS.0\system32\webcheck.dll
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} . (.Microsoft Corporation - Objet du service d'environnement Systray.) -- C:\WINDOWS.0\system32\stobject.dll
~ SSODL: 4 Scanned in 00mn 00s



---\\ Non Microsoft non disabled Windows XP/NT/2000 Services (O23)
O23 - Service: SegmentEnhancer (21a6d46d) . (...) - c:\Program Files\SegmentEnhancer\SegmentEnhancer.dll
O23 - Service: (Ati HotKey Poller) . (.ATI Technologies Inc. - ATI External Event Utility EXE Module.) - C:\WINDOWS.0\system32\Ati2evxx.exe
O23 - Service: BlueStacks Android Service (BstHdAndroidSvc) . (...) - C:\Program Files\BlueStacks\HD-Service.exe (.not file.)
O23 - Service: BlueStacks Log Rotator Service (BstHdLogRotatorSvc) . (...) - C:\Program Files\BlueStacks\HD-LogRotatorService.exe (.not file.)
O23 - Service: BlueStacks Updater Service (BstHdUpdaterSvc) . (...) - C:\Program Files\BlueStacks\HD-UpdaterService.exe (.not file.)
O23 - Service: CodeMeter Runtime Server (CodeMeter.exe) . (.WIBU-SYSTEMS AG - CodeMeter Runtime Server.) - C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe
O23 - Service: GenieCleanService (GenieCleanService) . (.Oppoos.com - GenieCleanService.exe.) - C:\Program Files\Genie Soft\Genie Cleaner\GenieCleanService.exe
O23 - Service: Service Google Update (gupdate) (gupdate) . (.Google Inc. - Programme d'installation de Google.) - C:\Program Files\Google\Update\GoogleUpdate.exe =>.Google Inc
O23 - Service: MobogenieService (MobogenieService) . (.Mobogenie.com - MobogenieService.exe.) - C:\Program Files\Mobogenie3\MobogenieService.exe =>PUP.Mobogenie
O23 - Service: Skype Updater (SkypeUpdate) . (...) - C:\Program Files\Skype\Updater\Updater.exe (.not file.)
O23 - Service: SAMSUNG Mobile Connectivity Service (ss_conn_service) . (.DEVGURU Co., LTD. - MSS CS Connectivity Service.) - C:\Program Files\SAMSUNG\USB Drivers\25_escape\conn\ss_conn_service.exe
~ Services: 7 Scanned in 00mn 02s



---\\ Windows Active Desktop & MHTML Editor (O24)
O24 - Default MHTML Editor: Last - .(.Microsoft Corporation - Microsoft Office Word.) - C:\Program Files\Microsoft Office\OFFICE11\WINWORD.exe
O24 - Desktop General: BackupWallPaper - .(...) - C:\Documents and Settings\ali\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop General: WallPaper - .(...) - C:\Documents and Settings\ali\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
~ Desktop Component: 4 Scanned in 00mn 00s



---\\ BootExecute (BEX) (O34)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
~ BEX: 1 Scanned in 00mn 00s



---\\ Session Manager Key (AppCertDlls,KnownDLLs) (O36)
O36 - AppCertDlls: (x64) . (...) -- c:\program files\settings manager\smdmf\x64\sysapcrt.dll (Not file) =>PUP.SystemK
~ Keys: Scanned in 00mn 00s



---\\ Task Planned Automatically (039)
[MD5.080255CDCB878813B481B8C348D47D8E] [APT] [Adobe Flash Player Updater] (.Adobe Systems Incorporated.) -- C:\WINDOWS.0\system32\Macromed\Flash\FlashPlayerUpdateService.exe [267440]
[MD5.2A3FB4C98F139038E23330D2439DB8A4] [APT] [FacebookUpdateTaskUserS-1-5-21-1123561945-1275210071-1417001333-1003Core] (.Facebook Inc..) -- C:\Documents and Settings\ali\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [138096]
[MD5.2A3FB4C98F139038E23330D2439DB8A4] [APT] [FacebookUpdateTaskUserS-1-5-21-1123561945-1275210071-1417001333-1003UA] (.Facebook Inc..) -- C:\Documents and Settings\ali\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [138096]
[MD5.F172AD4E906D97ED8F071896FC6789DC] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe [107912]
[MD5.F172AD4E906D97ED8F071896FC6789DC] [APT] [GoogleUpdateTaskMachineUA] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe [107912]
[MD5.00000000000000000000000000000000] [APT] [JetBoost_AutoUpdate] (...) -- C:\Program Files\BlueSprig\JetBoost\AutoUpdate.exe (.not file.) [0]
O39 - APT: Adobe Flash Player Updater - (.Adobe Systems Incorporated.) -- C:\WINDOWS.0\Tasks\Adobe Flash Player Updater.job [1006]
O39 - APT: FacebookUpdateTaskUserS-1-5-21-1123561945-1275210071-1417001333-1003Core - (.Facebook Inc..) -- C:\WINDOWS.0\Tasks\FacebookUpdateTaskUserS-1-5-21-1123561945-1275210071-1417001333-1003Core.job [968]
O39 - APT: FacebookUpdateTaskUserS-1-5-21-1123561945-1275210071-1417001333-1003UA - (.Facebook Inc..) -- C:\WINDOWS.0\Tasks\FacebookUpdateTaskUserS-1-5-21-1123561945-1275210071-1417001333-1003UA.job [990]
O39 - APT: GoogleUpdateTaskMachineCore - (.Google Inc..) -- C:\WINDOWS.0\Tasks\GoogleUpdateTaskMachineCore.job [1052]
O39 - APT: GoogleUpdateTaskMachineUA - (.Google Inc..) -- C:\WINDOWS.0\Tasks\GoogleUpdateTaskMachineUA.job [1056]
O39 - APT: JetBoost_AutoUpdate - (...) -- C:\WINDOWS.0\Tasks\JetBoost_AutoUpdate.job [270]
~ Scheduled Task: 13 Scanned in 00mn 00s



---\\ ActiveSetup Installed Components (O40)
O40 - ASIC: Microsoft Windows Media Player - >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} . (.Microsoft Corporation - Utilitaire d'installation du Lecteur Windows Media Microsoft.) -- C:\WINDOWS.0\inf\unregmp2.exe =>.Microsoft Corporation
O40 - ASIC: Internet Explorer - >{26923b43-4d38-484f-9b9e-de460746276c} . (.Microsoft Corporation - Windows NT User Data Migration Tool.) -- C:\WINDOWS.0\system32\shmgrate.exe
O40 - ASIC: Outlook Express - >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} . (.Microsoft Corporation - Windows NT User Data Migration Tool.) -- C:\WINDOWS.0\system32\shmgrate.exe =>.Microsoft Corporation
O40 - ASIC: Microsoft NetShow Player - {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} . (.Microsoft Corporation - Windows Media 6.4 Player Shim.) -- C:\WINDOWS.0\system32\wmpdxm.dll
O40 - ASIC: Lecteur Windows Media Microsoft 6.4 - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} . (.Microsoft Corporation - Windows Media 6.4 Player Shim.) -- C:\WINDOWS.0\system32\wmpdxm.dll =>.Microsoft Corporation
O40 - ASIC: DirectAnimation - {283807B5-2C60-11D0-A31D-00AA00B92C03} . (.Microsoft Corporation - DirectX Media -- DirectAnimation.) -- C:\WINDOWS.0\system32\danim.dll
O40 - ASIC: Themes Setup - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} . (.Microsoft Corporation - API Windows Theme.) -- C:\WINDOWS.0\system32\themeui.dll
O40 - ASIC: Microsoft Outlook Express 6 - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} . (.Microsoft Corporation - Bibliothèque d'installation Outlook Express.) -- C:\Program Files\Outlook Express\setup50.exe =>.Microsoft Corporation
O40 - ASIC: NetMeeting 3.01 - {44BBA842-CC51-11CF-AAFA-00AA00B6015B} . (...) -- C:\WINDOWS.0\INF\msnetmtg.inf
O40 - ASIC: Windows Messenger 4.7 - {5945c046-1e7d-11d1-bc44-00c04fd912be} . (...) -- C:\WINDOWS.0\INF\msmsgs.inf
O40 - ASIC: Améliorations pour la navigation - {630b1da0-b465-11d1-9948-00c04f98bbc9} . (.Microsoft Corporation - Extension Shell dossier FTP Microsoft Internet Explorer..) -- C:\WINDOWS.0\system32\msieftp.dll
O40 - ASIC: Microsoft Windows Media Player - {6BF52A52-394A-11d3-B153-00C04F79FAA6} . (...) -- C:\WINDOWS.0\INF\wmp.inf =>.Microsoft Corporation
O40 - ASIC: Carnet d'adresses 6 - {7790769C-0471-11d2-AF11-00C04FA35D02} . (.Microsoft Corporation - Bibliothèque d'installation Outlook Express.) -- C:\Program Files\Outlook Express\setup50.exe =>.Microsoft Corporation
O40 - ASIC: Mise à jour du Bureau Windows - {89820200-ECBD-11cf-8B85-00AA005B4340} . (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS.0\system32\shell32.dll
O40 - ASIC: Internet Explorer 6 - {89820200-ECBD-11cf-8B85-00AA005B4383} . (.Microsoft Corporation - Utilitaire d'installation individualisée de Internet Explorer.) -- C:\WINDOWS.0\system32\ie4uinit.exe
O40 - ASIC: (no name) - {89B4C1CD-B018-4511-B0A1-5476DBF70820} . (.Microsoft Corporation - Microsoft .NET IE SECURITY REGISTRATION.) -- C:\WINDOWS.0\system32\mscories.dll
O40 - ASIC: Google Chrome - {8A69D345-D564-463c-AFF1-A69D9E530F96} . (.Google Inc. - Google Chrome Installer.) -- C:\Program Files\Google\Chrome\Application\41.0.2272.101\Installer\chrmstp.exe
O40 - ASIC: Macromedia Shockwave Flash - {D27CDB6E-AE6D-11cf-96B8-444553540000} . (.Macromedia, Inc. - Macromedia Flash Player 6.0 r79.) -- C:\WINDOWS.0\system32\macromed\flash\flash.ocx
O40 - ASIC: Installed Component - S-1-5-21-1123561945-1275210071-1417001333-1003 - >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS -- Not Hexadécimal CLSID
~ Active Setup: 19 Scanned in 00mn 00s



---\\ Drivers launched at startup (O41)
O41 - Driver: (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\WINDOWS.0\system32\drivers\afd.sys
O41 - Driver: (Cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\WINDOWS.0\system32\DRIVERS\cdrom.sys
O41 - Driver: (i8042prt) . (.Microsoft Corporation - Pilote de port i8042.) - C:\WINDOWS.0\system32\DRIVERS\i8042prt.sys
O41 - Driver: (IDMTDI) . (.Tonec Inc. - Internet Download Manager TDI Driver.) - C:\WINDOWS.0\system32\DRIVERS\idmtdi.sys
O41 - Driver: (Imapi) . (.Microsoft Corporation - IMAPI Kernel Driver.) - C:\WINDOWS.0\system32\DRIVERS\imapi.sys
O41 - Driver: (intelppm) . (.Microsoft Corporation - Pilote de périphérique processeur.) - C:\WINDOWS.0\system32\DRIVERS\intelppm.sys
O41 - Driver: (IPSec) . (.Microsoft Corporation - IPSec Driver.) - C:\WINDOWS.0\system32\DRIVERS\ipsec.sys
O41 - Driver: (Kbdclass) . (.Microsoft Corporation - Pilote de la classe Clavier.) - C:\WINDOWS.0\system32\DRIVERS\kbdclass.sys
O41 - Driver: (kbdhid) . (.Microsoft Corporation - Pilote de filtre souris HID.) - C:\WINDOWS.0\system32\DRIVERS\kbdhid.sys
O41 - Driver: (Mouclass) . (.Microsoft Corporation - Pilote de la classe Souris.) - C:\WINDOWS.0\system32\DRIVERS\mouclass.sys
O41 - Driver: (MRxSmb) . (.Microsoft Corporation - Windows NT SMB Minirdr.) - C:\WINDOWS.0\system32\DRIVERS\mrxsmb.sys
O41 - Driver: (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\WINDOWS.0\system32\DRIVERS\netbios.sys
O41 - Driver: (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\WINDOWS.0\system32\DRIVERS\netbt.sys
O41 - Driver: (RasAcd) . (.Microsoft Corporation - RAS Automatic Connection Driver.) - C:\WINDOWS.0\system32\DRIVERS\rasacd.sys
O41 - Driver: (Rdbss) . (.Microsoft Corporation - Redirected Drive Buffering SubSystem Driver.) - C:\WINDOWS.0\system32\DRIVERS\rdbss.sys
O41 - Driver: (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\WINDOWS.0\system32\DRIVERS\RDPCDD.sys
O41 - Driver: (redbook) . (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) - C:\WINDOWS.0\system32\DRIVERS\redbook.sys
O41 - Driver: (Serial) . (.Microsoft Corporation - Pilote de périphérique série.) - C:\WINDOWS.0\system32\DRIVERS\serial.sys
O41 - Driver: (Tcpip) . (.Microsoft Corporation - TCP/IP Protocol Driver.) - C:\WINDOWS.0\system32\DRIVERS\tcpip.sys
O41 - Driver: (TermDD) . (.Microsoft Corporation - Terminal Server Driver.) - C:\WINDOWS.0\system32\DRIVERS\termdd.sys
O41 - Driver: (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\WINDOWS.0\system32\drivers\vga.sys
~ Drivers: 63 Scanned in 00mn 00s



---\\ Software installed (O42)
O42 - Logiciel: AdPunisher - (.AdPunisher.) [HKLM] -- {37476589-E48E-439E-A706-56189E2ED4C4}_is1
O42 - Logiciel: Adobe Flash Player 16 NPAPI - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player NPAPI
O42 - Logiciel: Amara - News Ticker - (...) [HKLM] -- Amara - News Ticker
O42 - Logiciel: BlueStacks Notification Center - (.BlueStack Systems, Inc..) [HKLM] -- {01961AE4-2F93-408B-AAED-AC582C4F5059}
O42 - Logiciel: Catalyst Control Center - Branding - (.Advanced Micro Devices, Inc..) [HKLM] -- {25A3B953-1423-3F15-640E-B620DD0F419A}
O42 - Logiciel: DVBViewer Pro - (.CM&V.) [HKLM] -- DVBViewer Pro_is1
O42 - Logiciel: DeAlExpresis - (."".) [HKLM] -- {25F259ED-12F6-429F-5783-527C3E2F8586} =>PUP.DealExpress
O42 - Logiciel: Facebook Video Calling 3.1.0.521 - (.Skype Limited.) [HKLM] -- {2091F234-EB58-4B80-8C96-8EB78C808CF7}
O42 - Logiciel: Feun2Save - (."".) [HKLM] -- {9D9BEFAE-9499-F52B-6CC4-94818CCC2AB5} =>PUP.Fun2Save
O42 - Logiciel: Genie Cleaner - (.Oppoos.com.) [HKLM] -- Genie Cleaner
O42 - Logiciel: Google Chrome - (.Google Inc‎.‎.) [HKLM] -- Google Chrome
O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM] -- {60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM] -- {A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
O42 - Logiciel: Hotfix for Windows XP (KB954550-v5) - (.Microsoft Corporation.) [HKLM] -- KB954550-v5
O42 - Logiciel: HydraVision - (.Advanced Micro Devices, Inc..) [HKLM] -- {48F63660-D275-0A69-7700-A8102CB117A6}
O42 - Logiciel: Internet Download Manager - (.Tonec Inc..) [HKLM] -- Internet Download Manager
O42 - Logiciel: KMPlayer - (.PandoraTV.) [HKLM] -- The KMPlayer
O42 - Logiciel: MainConcept DTV Decoder Pro - (.MainConcept GmbH.) [HKLM] -- {793FCE60-DE5E-4977-A942-A7B69A45B17D}
O42 - Logiciel: Microsoft Kernel-Mode Driver Framework Feature Pack 1.9 - (.Microsoft Corporation.) [HKLM] -- Wdf01009
O42 - Logiciel: Microsoft WinUsb 1.0 - (.Microsoft Corporation.) [HKLM] -- winusb0100
O42 - Logiciel: Microsoft WinUsb 2.0 - (.Microsoft Corporation.) [HKLM] -- winusb0200
O42 - Logiciel: Mixlr version 2.8.6 - (.Mixlr, Ltd..) [HKLM] -- {F021F776-6BD4-4301-985D-0C1D27EEC8ED}_is1
O42 - Logiciel: Mobogenie3 - (.Mobogenie.com.) [HKLM] -- Mobogenie3 =>PUP.Mobogenie
O42 - Logiciel: Mozilla Firefox 34.0.5 (x86 ar) - (.Mozilla.) [HKLM] -- Mozilla Firefox 34.0.5 (x86 ar)
O42 - Logiciel: Mozilla Maintenance Service - (.Mozilla.) [HKLM] -- MozillaMaintenanceService
O42 - Logiciel: Opera 11.01 - (.Opera Software ASA.) [HKLM] -- Opera 11.01.1190
O42 - Logiciel: PhotoFiltre 7 - (...) [HKCU] -- PhotoFiltre 7
O42 - Logiciel: PhotoScape - (.PhotoScape.) [HKLM] -- PhotoScape
O42 - Logiciel: Pro Evolution Soccer 2013 version 5.1 - (.Black_Box.) [HKLM] -- {B810D852-DFD6-PES13-89A5-CC4D47756DAF}_is1
O42 - Logiciel: Pro Evolution Soccer 2015 - (...) [HKLM] -- UHJvRXZvbHV0aW9uU29jY2VyMjAxNQ==_is1
O42 - Logiciel: ProgDVB - (...) [HKLM] -- ProgDVB
O42 - Logiciel: Prolonger - (.Prolonger.) [HKLM] -- {12DA0E6F-5543-440C-BAA2-28BF01070AFA}{21a6d46d} =>Adware.Graftor
O42 - Logiciel: Recover My Files - (.GetData Pty Ltd.) [HKLM] -- Recover My Files v5_is1
O42 - Logiciel: SAMSUNG USB Driver for Mobile Phones - (.SAMSUNG Electronics Co., Ltd..) [HKLM] -- {D0795B21-0CDA-4a92-AB9E-6E92D8111E44}
O42 - Logiciel: Skype™ 7.2 - (.Skype Technologies S.A..) [HKLM] -- {24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}
O42 - Logiciel: Startimes Codecs v1.0 - (...) [HKLM] -- Startimes Codecs_is1
O42 - Logiciel: SumatraPDF - (.SumatraPDF.) [HKLM] -- SumatraPDF
O42 - Logiciel: TTaKeTheCoaupon - (."".) [HKLM] -- {53B21E29-3967-C332-57EB-C02631658584} =>PUP.TakeTheCoupon
O42 - Logiciel: TechniSat DVB-PC TV Star - (.TechniSat.) [HKLM] -- {D032A7F0-8B5C-4603-8B46-235025D5F9C1}
O42 - Logiciel: Topaz Adjust 5 - (.Topaz Labs, LLC.) [HKLM] -- Topaz Adjust 5
O42 - Logiciel: Topaz Fusion Express 2 - (.Topaz Labs.) [HKLM] -- Topaz Fusion Express 2
O42 - Logiciel: UGamesFree - (."".) [HKLM] -- {A3FC46A0-9B62-0EF3-B475-743B3A2762B1}
O42 - Logiciel: VIA Display Driver 6.14.10.0099 - (...) [HKLM] -- VIA Chrome9 HC IGP Family Display
O42 - Logiciel: VLC media player 2.0.7 - (.VideoLAN.) [HKLM] -- VLC media player =>.VideoLAN
O42 - Logiciel: WinRAR 5.20 (32-بت) - (.win.rar GmbH.) [HKLM] -- WinRAR archiver
O42 - Logiciel: XML Paper Specification Shared Components Language Pack 1.0 - (.Microsoft Corporation.) [HKLM] -- XPSEPSCLP
O42 - Logiciel: Your Free Net v2.2 - (.Your Free Net v2.2.) [HKLM] -- Your Free Net v2.22.2
O42 - Logiciel: µTorrent - (.BitTorrent Inc..) [HKCU] -- uTorrent =>P2P.BitTorrent
~ Logic: 40 Scanned in 00mn 00s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\ATI]
[HKCU\Software\Adobe]
[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}] =>Adware.Graftor
[HKCU\Software\AppDataLow]
[HKCU\Software\BitCtrl Systems GmbH]
[HKCU\Software\BitTorrent] =>P2P.BitTorrent
[HKCU\Software\CYBERLINK]
[HKCU\Software\Classes]
[HKCU\Software\Clients]
[HKCU\Software\CoreAAC]
[HKCU\Software\DScaler5]
[HKCU\Software\DVDVideoSoft]
[HKCU\Software\DebugNano]
[HKCU\Software\DownloadManager]
[HKCU\Software\Dz4-EvEr]
[HKCU\Software\ESET]
[HKCU\Software\Elecard]
[HKCU\Software\Facebook]
[HKCU\Software\Gabest]
[HKCU\Software\Genie Soft]
[HKCU\Software\GetData]
[HKCU\Software\Google]
[HKCU\Software\IM Providers]
[HKCU\Software\IPCameraDSFilter]
[HKCU\Software\Intel]
[HKCU\Software\InterVideo]
[HKCU\Software\KMPlayer]
[HKCU\Software\LAV]
[HKCU\Software\Lake]
[HKCU\Software\Linkey] =>PUP.LinkeySearch
[HKCU\Software\Macromedia]
[HKCU\Software\MainConcept]
[HKCU\Software\Mediachance]
[HKCU\Software\MiniLyrics] =>Adware.AddLyrics
[HKCU\Software\Mobogenie3] =>PUP.Mobogenie
[HKCU\Software\Mobogenie] =>PUP.Mobogenie
[HKCU\Software\Mort]
[HKCU\Software\MozillaPlugins]
[HKCU\Software\Mozilla]
[HKCU\Software\Netscape]
[HKCU\Software\ODBC]
[HKCU\Software\Opera Software]
[HKCU\Software\Policies]
[HKCU\Software\SBMAV Software]
[HKCU\Software\Skype]
[HKCU\Software\Trend Micro]
[HKCU\Software\VB and VBA Program Settings]
[HKCU\Software\WebApp]
[HKCU\Software\WinRAR SFX]
[HKCU\Software\WinRAR]
[HKCU\Software\Wondershare]
[HKCU\Software\mixlr]
[HKCU\Software\nanocosmos]
[HKLM\Software\ASProtect]
[HKLM\Software\ATI Technologies]
[HKLM\Software\ATI]
[HKLM\Software\Activision]
[HKLM\Software\BlueStacks]
[HKLM\Software\C07ft5Y]
[HKLM\Software\CM&V]
[HKLM\Software\Classes]
[HKLM\Software\Clients]
[HKLM\Software\CoreCodec]
[HKLM\Software\DVBDream]
[HKLM\Software\DVDVideoSoft]
[HKLM\Software\DebugNano]
[HKLM\Software\Debug]
[HKLM\Software\EA Games]
[HKLM\Software\ESET]
[HKLM\Software\Elecard]
[HKLM\Software\Gemplus]
[HKLM\Software\Genie Soft]
[HKLM\Software\Google]
[HKLM\Software\HaaliMkx]
[HKLM\Software\IM Providers]
[HKLM\Software\IPCameraDSFilter]
[HKLM\Software\InstallShield]
[HKLM\Software\Intel]
[HKLM\Software\InterVideo]
[HKLM\Software\KONAMI]
[HKLM\Software\Lake]
[HKLM\Software\Licenses]
[HKLM\Software\Macromedia]
[HKLM\Software\MainConcept]
[HKLM\Software\McAfee.com]
[HKLM\Software\MimarSinan]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\Mozilla]
[HKLM\Software\ND]
[HKLM\Software\NVIDIA Corporation]
[HKLM\Software\Netscape]
[HKLM\Software\ODBC]
[HKLM\Software\Opera Software]
[HKLM\Software\Policies]
[HKLM\Software\Prog]
[HKLM\Software\Program Groups]
[HKLM\Software\RegisteredApplications]
[HKLM\Software\S3]
[HKLM\Software\SAMSUNG]
[HKLM\Software\SNC]
[HKLM\Software\Schlumberger]
[HKLM\Software\Secure]
[HKLM\Software\Skype]
[HKLM\Software\SmdmF] =>PUP.SystemK
[HKLM\Software\Stardvb]
[HKLM\Software\TDS]
[HKLM\Software\TechSmith]
[HKLM\Software\TechniSat]
[HKLM\Software\Topaz Labs]
[HKLM\Software\TrendMicro]
[HKLM\Software\VideoLAN]
[HKLM\Software\WIBU-SYSTEMS]
[HKLM\Software\WafCX]
[HKLM\Software\WinRAR]
[HKLM\Software\Windows 3.1 Migration Status]
[HKLM\Software\Wondershare]
[HKLM\Software\Wow6432Node]
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc] =>PUP.CrossRider
[HKLM\Software\mozilla.org]
~ Key Software: 210 Scanned in 00mn 00s



---\\ Contents of the Common Files folders (O43)
O43 - CFD: 17-03-2015 - 16:13:04 - [] ----D C:\Program Files\Amara - News Ticker
O43 - CFD: 23-01-2015 - 16:51:18 - [] ----D C:\Program Files\ATI
O43 - CFD: 23-01-2015 - 16:53:06 - [] ----D C:\Program Files\ATI Technologies
O43 - CFD: 24-01-2015 - 20:22:14 - [0] ----D C:\Program Files\Black_Box
O43 - CFD: 01-03-2015 - 22:15:03 - [] ----D C:\Program Files\BlueSprig
O43 - CFD: 13-03-2015 - 14:13:10 - [0] ----D C:\Program Files\BlueStacks
O43 - CFD: 13-10-2014 - 2:37:41 - [] ----D C:\Program Files\CodeMeter
O43 - CFD: 13-09-2007 - 1:10:43 - [0] ----D C:\Program Files\ComPlus Applications
O43 - CFD: 06-12-2014 - 3:15:19 - [0] ----D C:\Program Files\CoreCodec
O43 - CFD: 12-03-2015 - 9:31:56 - [] ----D C:\Program Files\DeAlExpresis =>PUP.DealExpress
O43 - CFD: 20-02-2015 - 14:30:37 - [] ----D C:\Program Files\DLLSuite
O43 - CFD: 22-02-2015 - 19:04:14 - [] ----D C:\Program Files\DroidCam
O43 - CFD: 24-01-2015 - 17:36:46 - [] ----D C:\Program Files\DVBViewer
O43 - CFD: 05-12-2014 - 1:12:18 - [0] ----D C:\Program Files\Elecard
O43 - CFD: 24-01-2015 - 13:34:47 - [] ----D C:\Program Files\Electronic Arts
O43 - CFD: 19-03-2015 - 23:52:30 - [] ----D C:\Program Files\ESET
O43 - CFD: 13-09-2007 - 1:50:25 - [] ----D C:\Program Files\Eterlogic.com
O43 - CFD: 12-03-2015 - 9:31:20 - [] ----D C:\Program Files\Feun2Save =>PUP.Fun2Save
O43 - CFD: 19-03-2015 - 14:55:19 - [] ----D C:\Program Files\Fichiers communs
O43 - CFD: 19-03-2015 - 23:20:42 - [] ----D C:\Program Files\Genie Soft
O43 - CFD: 13-10-2014 - 2:37:37 - [] ----D C:\Program Files\GetData
O43 - CFD: 18-12-2014 - 11:02:20 - [] ----D C:\Program Files\Google
O43 - CFD: 18-03-2015 - 12:03:27 - [0] ----D C:\Program Files\Hostless Modem
O43 - CFD: 07-03-2015 - 2:00:17 - [] ----D C:\Program Files\HSPA USB Modem
O43 - CFD: 19-03-2015 - 10:08:24 - [] --H-D C:\Program Files\InstallShield Installation Information
O43 - CFD: 13-09-2007 - 23:52:54 - [] ----D C:\Program Files\Internet Explorer
O43 - CFD: 06-03-2015 - 2:16:55 - [] ----D C:\Program Files\IPCameraDSFilter
O43 - CFD: 19-03-2015 - 10:44:06 - [] ----D C:\Program Files\KMPlayer
O43 - CFD: 09-02-2015 - 1:41:58 - [] ----D C:\Program Files\Languages
O43 - CFD: 14-09-2007 - 16:33:32 - [] ----D C:\Program Files\MainConcept
O43 - CFD: 13-09-2007 - 23:53:27 - [] ----D C:\Program Files\Messenger
O43 - CFD: 13-09-2007 - 23:58:48 - [0] ----D C:\Program Files\Microsoft
O43 - CFD: 09-03-2015 - 0:49:28 - [] ----D C:\Program Files\Microsoft ActiveSync
O43 - CFD: 13-09-2007 - 1:14:40 - [] ----D C:\Program Files\microsoft frontpage
O43 - CFD: 09-03-2015 - 0:48:50 - [] ----D C:\Program Files\Microsoft Office
O43 - CFD: 16-02-2015 - 7:15:39 - [] ----D C:\Program Files\Microsoft.NET
O43 - CFD: 18-03-2015 - 12:03:39 - [] ----D C:\Program Files\MiniLyrics =>Adware.AddLyrics
O43 - CFD: 07-01-2015 - 19:55:54 - [] ----D C:\Program Files\Mixlr
O43 - CFD: 20-03-2015 - 0:09:34 - [] ----D C:\Program Files\Mobogenie3 =>PUP.Mobogenie
O43 - CFD: 13-09-2007 - 23:53:44 - [] ----D C:\Program Files\Movie Maker
O43 - CFD: 09-12-2014 - 9:58:55 - [] ----D C:\Program Files\Mozilla Firefox
O43 - CFD: 09-12-2014 - 17:11:32 - [] ----D C:\Program Files\Mozilla Maintenance Service
O43 - CFD: 11-02-2015 - 23:14:18 - [] ----D C:\Program Files\MSBuild
O43 - CFD: 07-12-2014 - 3:39:08 - [] ----D C:\Program Files\MSN
O43 - CFD: 13-09-2007 - 1:10:18 - [] ----D C:\Program Files\MSN Gaming Zone
O43 - CFD: 07-03-2015 - 2:02:53 - [0] ----D C:\Program Files\MyRealGames.com
O43 - CFD: 07-12-2014 - 3:41:59 - [] ----D C:\Program Files\NetMeeting
O43 - CFD: 07-12-2014 - 3:39:58 - [] ----D C:\Program Files\Online Services
O43 - CFD: 13-09-2007 - 0:37:44 - [] ----D C:\Program Files\Opera
O43 - CFD: 13-09-2007 - 23:54:03 - [] ----D C:\Program Files\Outlook Express =>.Microsoft Corporation
O43 - CFD: 19-03-2015 - 10:22:41 - [] ----D C:\Program Files\PhotoFiltre 7
O43 - CFD: 05-03-2015 - 7:58:50 - [] ----D C:\Program Files\PhotoScape
O43 - CFD: 15-03-2015 - 17:59:53 - [] ----D C:\Program Files\QuickTime
O43 - CFD: 11-02-2015 - 23:14:08 - [] ----D C:\Program Files\Reference Assemblies
O43 - CFD: 29-11-2014 - 4:15:59 - [] ----D C:\Program Files\S3
O43 - CFD: 17-01-2015 - 17:13:58 - [] ----D C:\Program Files\SAMSUNG
O43 - CFD: 04-03-2015 - 23:16:59 - [] ----D C:\Program Files\SegmentEnhancer
O43 - CFD: 13-09-2007 - 1:12:55 - [] ----D C:\Program Files\Services en ligne
O43 - CFD: 24-01-2015 - 17:56:08 - [] ----D C:\Program Files\Startimes Codecs
O43 - CFD: 13-03-2015 - 19:29:25 - [] ----D C:\Program Files\SumatraPDF
O43 - CFD: 07-12-2014 - 4:04:15 - [] ----D C:\Program Files\TechniSat DVB
O43 - CFD: 09-02-2015 - 1:41:58 - [] ----D C:\Program Files\Toolbar
O43 - CFD: 19-03-2015 - 16:03:19 - [] ----D C:\Program Files\Topaz Labs
O43 - CFD: 24-01-2015 - 15:54:13 - [] ----D C:\Program Files\Trend Micro
O43 - CFD: 12-03-2015 - 9:31:36 - [] ----D C:\Program Files\TTaKeTheCoaupon =>PUP.TakeTheCoupon
O43 - CFD: 12-03-2015 - 9:34:00 - [] ----D C:\Program Files\UGamesFree
O43 - CFD: 07-03-2015 - 2:04:57 - [0] ----D C:\Program Files\UniDeals =>PUP.UniDeals
O43 - CFD: 04-03-2015 - 23:14:41 - [] ----D C:\Program Files\UniDeAlsse =>PUP.UniDeals
O43 - CFD: 13-09-2007 - 1:16:44 - [0] --H-D C:\Program Files\Uninstall Information
O43 - CFD: 29-11-2014 - 3:06:56 - [] ----D C:\Program Files\VIA
O43 - CFD: 14-09-2007 - 1:18:51 - [] ----D C:\Program Files\VideoLAN
O43 - CFD: 13-09-2007 - 23:57:31 - [] ----D C:\Program Files\Windows Media Player =>.Microsoft Corporation
O43 - CFD: 13-09-2007 - 23:57:42 - [] ----D C:\Program Files\Windows NT
O43 - CFD: 13-09-2007 - 1:12:58 - [0] --H-D C:\Program Files\WindowsUpdate
O43 - CFD: 15-09-2007 - 1:41:13 - [] ----D C:\Program Files\WinRAR
O43 - CFD: 13-09-2007 - 1:14:41 - [] ----D C:\Program Files\xerox
O43 - CFD: 20-03-2015 - 4:27:58 - [] ----D C:\Program Files\ZHPDiag =>.Nicolas Coolman
O43 - CFD: 24-01-2015 - 17:55:50 - [] ----D C:\Program Files\Fichiers communs\ArcSoft
O43 - CFD: 24-01-2015 - 17:55:51 - [] ----D C:\Program Files\Fichiers communs\BitCtrl
O43 - CFD: 24-01-2015 - 17:55:51 - [] ----D C:\Program Files\Fichiers communs\Blaze
O43 - CFD: 13-09-2007 - 2:32:16 - [] ----D C:\Program Files\Fichiers communs\DESIGNER
O43 - CFD: 16-12-2014 - 2:05:26 - [] ----D C:\Program Files\Fichiers communs\DVBViewer Shared
O43 - CFD: 13-09-2007 - 1:45:58 - [] ----D C:\Program Files\Fichiers communs\DVDVideoSoft
O43 - CFD: 24-01-2015 - 17:56:02 - [] ----D C:\Program Files\Fichiers communs\Elecard
O43 - CFD: 19-03-2015 - 10:21:18 - [] ----D C:\Program Files\Fichiers communs\InstallShield
O43 - CFD: 09-03-2015 - 0:47:26 - [] ----D C:\Program Files\Fichiers communs\Microsoft Shared
O43 - CFD: 13-09-2007 - 1:12:02 - [] ----D C:\Program Files\Fichiers communs\MSSoap
O43 - CFD: 13-09-2007 - 3:06:03 - [] ----D C:\Program Files\Fichiers communs\ODBC
O43 - CFD: 07-12-2014 - 3:41:58 - [] ----D C:\Program Files\Fichiers communs\Services
O43 - CFD: 04-03-2015 - 4:44:58 - [] ----D C:\Program Files\Fichiers communs\Skype
O43 - CFD: 13-09-2007 - 3:05:59 - [] ----D C:\Program Files\Fichiers communs\SpeechEngines
O43 - CFD: 07-12-2014 - 3:41:13 - [] ----D C:\Program Files\Fichiers communs\System
O43 - CFD: 19-03-2015 - 14:56:36 - [] ----D C:\Program Files\Fichiers communs\Topaz Labs
O43 - CFD: 12-03-2015 - 9:34:01 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\4920013869632162124
O43 - CFD: 09-03-2015 - 17:12:57 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\AdPunisher
O43 - CFD: 24-01-2015 - 17:55:50 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\ArcSoft
O43 - CFD: 23-01-2015 - 16:55:08 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\ATI
O43 - CFD: 01-03-2015 - 22:15:05 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\BlueSprig
O43 - CFD: 03-03-2015 - 5:05:53 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\BlueStacks
O43 - CFD: 03-03-2015 - 8:23:40 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\BlueStacksSetup
O43 - CFD: 16-12-2014 - 2:04:22 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\CMUV
O43 - CFD: 19-03-2015 - 23:40:41 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\ESET
O43 - CFD: 15-09-2007 - 1:41:54 - [0] ----D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\IDM
O43 - CFD: 04-03-2015 - 23:14:09 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\kldgbmgndjlboplibhadhjjcbifkgimi
O43 - CFD: 07-03-2015 - 3:16:20 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\McAfee
O43 - CFD: 09-03-2015 - 0:48:31 - [] -S--D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Microsoft
O43 - CFD: 13-09-2007 - 0:09:07 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Mozilla
O43 - CFD: 17-01-2015 - 17:07:43 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Samsung
O43 - CFD: 04-03-2015 - 4:45:05 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Skype
O43 - CFD: 07-12-2014 - 4:04:06 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Technisat
O43 - CFD: 15-03-2015 - 18:00:05 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\TechSmith
O43 - CFD: 18-03-2015 - 12:04:19 - [0] ---AD C:\Documents and Settings\All Users.WINDOWS.0\Application Data\TEMP
O43 - CFD: 18-03-2015 - 12:03:38 - [0] ----D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\ZDSupport
O43 - CFD: 19-03-2015 - 14:56:37 - [] --H-D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\{7E8842F4-ECF1-457B-9B22-AA8299B810D9}
O43 - CFD: 06-03-2015 - 1:19:08 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Application Data\{af65cd61-6660-02b5-af65-5cd616663585}
O43 - CFD: 08-03-2015 - 7:04:34 - [] R---D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\Accessoires
O43 - CFD: 23-01-2015 - 16:53:26 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\Catalyst Control Center
O43 - CFD: 24-01-2015 - 17:36:45 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\DVBViewer
O43 - CFD: 13-09-2007 - 1:45:52 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\DVDVideoSoft
O43 - CFD: 20-03-2015 - 1:24:21 - [] R---D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\Démarrage
O43 - CFD: 19-03-2015 - 23:19:58 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\Genie Soft
O43 - CFD: 18-12-2014 - 11:05:47 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\Google Chrome
O43 - CFD: 09-02-2015 - 1:41:59 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\Internet Download Manager
O43 - CFD: 07-12-2014 - 3:40:35 - [] R---D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\Jeux
O43 - CFD: 09-03-2015 - 0:49:57 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\Microsoft Office
O43 - CFD: 07-01-2015 - 19:55:54 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\Mixlr
O43 - CFD: 19-03-2015 - 21:33:36 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\Mobogenie3 =>PUP.Mobogenie
O43 - CFD: 07-03-2015 - 2:02:53 - [0] ----D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\MyRealGames.com
O43 - CFD: 07-12-2014 - 3:44:19 - [] R---D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\Outils d'administration
O43 - CFD: 05-03-2015 - 7:58:50 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\PhotoScape
O43 - CFD: 24-01-2015 - 9:17:23 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\Pro Evolution Soccer 2013
O43 - CFD: 24-01-2015 - 17:56:08 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\Startimes Codecs
O43 - CFD: 07-12-2014 - 4:04:06 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\TechniSat DVB
O43 - CFD: 19-03-2015 - 14:56:36 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\Topaz Labs
O43 - CFD: 13-09-2007 - 1:52:38 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\VideoLAN
O43 - CFD: 15-09-2007 - 1:41:13 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\WinRAR
O43 - CFD: 20-03-2015 - 4:27:58 - [] ----D C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\ZHP =>.Nicolas Coolman
O43 - CFD: 07-12-2014 - 3:53:41 - [] ----D C:\Documents and Settings\ali\Application Data\Adobe
O43 - CFD: 23-01-2015 - 16:55:08 - [] ----D C:\Documents and Settings\ali\Application Data\ATI
O43 - CFD: 20-03-2015 - 1:47:41 - [] ----D C:\Documents and Settings\ali\Application Data\DMCache
O43 - CFD: 19-03-2015 - 3:42:04 - [] ----D C:\Documents and Settings\ali\Application Data\dvdcss
O43 - CFD: 13-09-2007 - 1:46:00 - [] ----D C:\Documents and Settings\ali\Application Data\DVDVideoSoft
O43 - CFD: 28-12-2014 - 22:48:15 - [] ----D C:\Documents and Settings\ali\Application Data\FirefoxToolbar
O43 - CFD: 07-12-2014 - 3:49:40 - [] ----D C:\Documents and Settings\ali\Application Data\Identities
O43 - CFD: 09-03-2015 - 1:46:02 - [] ----D C:\Documents and Settings\ali\Application Data\IDM
O43 - CFD: 07-03-2015 - 3:20:40 - [] ----D C:\Documents and Settings\ali\Application Data\Macromedia
O43 - CFD: 09-03-2015 - 1:10:53 - [] -S--D C:\Documents and Settings\ali\Application Data\Microsoft
O43 - CFD: 18-03-2015 - 12:03:35 - [] ----D C:\Documents and Settings\ali\Application Data\MiniLyrics =>Adware.AddLyrics
O43 - CFD: 13-03-2015 - 12:16:46 - [] ----D C:\Documents and Settings\ali\Application Data\Mobogenie =>PUP.Mobogenie
O43 - CFD: 13-09-2007 - 0:09:13 - [] ----D C:\Documents and Settings\ali\Application Data\Mozilla
O43 - CFD: 04-03-2015 - 1:15:44 - [] ----D C:\Documents and Settings\ali\Application Data\OpenCandy =>Adware.OpenCandy
O43 - CFD: 13-09-2007 - 6:20:09 - [] ----D C:\Documents and Settings\ali\Application Data\Opera
O43 - CFD: 19-03-2015 - 10:22:48 - [] ----D C:\Documents and Settings\ali\Application Data\PhotoFiltre 7
O43 - CFD: 13-09-2007 - 1:45:25 - [] ----D C:\Documents and Settings\ali\Application Data\RHEng =>PUP.Conduit
O43 - CFD: 22-12-2014 - 18:09:23 - [] ----D C:\Documents and Settings\ali\Application Data\SimpleTV V03
O43 - CFD: 07-03-2015 - 2:04:19 - [] ----D C:\Documents and Settings\ali\Application Data\skygrabber
O43 - CFD: 09-03-2015 - 10:53:30 - [] ----D C:\Documents and Settings\ali\Application Data\Skype
O43 - CFD: 19-03-2015 - 16:04:26 - [] ----D C:\Documents and Settings\ali\Application Data\SumatraPDF
O43 - CFD: 20-03-2015 - 1:22:58 - [] ----D C:\Documents and Settings\ali\Application Data\uTorrent =>P2P.µTorrent
O43 - CFD: 20-03-2015 - 2:31:18 - [] ----D C:\Documents and Settings\ali\Application Data\vlc
O43 - CFD: 07-12-2014 - 3:57:49 - [] ----D C:\Documents and Settings\ali\Application Data\WinRAR
O43 - CFD: 20-03-2015 - 4:37:08 - [] ----D C:\Documents and Settings\ali\Application Data\ZHP =>.Nicolas Coolman
O43 - CFD: 07-03-2015 - 3:18:06 - [0] ----D C:\Documents and Settings\ali\Local Settings\Application Data\Adobe
O43 - CFD: 15-03-2015 - 18:11:44 - [] ----D C:\Documents and Settings\ali\Local Settings\Application Data\Amara
O43 - CFD: 24-01-2015 - 17:55:50 - [] ----D C:\Documents and Settings\ali\Local Settings\Application Data\ArcSoft
O43 - CFD: 23-01-2015 - 16:55:08 - [] ----D C:\Documents and Settings\ali\Local Settings\Application Data\ATI
O43 - CFD: 03-03-2015 - 5:04:18 - [] ----D C:\Documents and Settings\ali\Local Settings\Application Data\Bluestacks
O43 - CFD: 20-03-2015 - 1:16:32 - [] ----D C:\Documents and Settings\ali\Local Settings\Application Data\ESET
O43 - CFD: 09-03-2015 - 4:38:28 - [] ----D C:\Documents and Settings\ali\Local Settings\Application Data\Facebook
O43 - CFD: 18-12-2014 - 11:05:54 - [] ----D C:\Documents and Settings\ali\Local Settings\Application Data\Google
O43 - CFD: 19-03-2015 - 10:44:03 - [] ----D C:\Documents and Settings\ali\Local Settings\Application Data\GscWare
O43 - CFD: 01-01-2015 - 3:37:11 - [] ----D C:\Documents and Settings\ali\Local Settings\Application Data\Identities
O43 - CFD: 09-03-2015 - 1:56:51 - [] ----D C:\Documents and Settings\ali\Local Settings\Application Data\Microsoft
O43 - CFD: 07-01-2015 - 2:05:39 - [] ----D C:\Documents and Settings\ali\Local Settings\Application Data\mixlr
O43 - CFD: 13-09-2007 - 0:09:13 - [] ----D C:\Documents and Settings\ali\Local Settings\Application Data\Mozilla
O43 - CFD: 13-09-2007 - 6:20:09 - [] ----D C:\Documents and Settings\ali\Local Settings\Application Data\Opera
O43 - CFD: 19-03-2015 - 14:56:17 - [0] ----D C:\Documents and Settings\ali\Local Settings\Application Data\PackageAware
O43 - CFD: 19-03-2015 - 10:40:49 - [] ----D C:\Documents and Settings\ali\Local Settings\Application Data\PCHealth
O43 - CFD: 12-02-2015 - 0:09:14 - [] ----D C:\Documents and Settings\ali\Local Settings\Application Data\SkinSoft
O43 - CFD: 04-03-2015 - 4:45:17 - [] ----D C:\Documents and Settings\ali\Local Settings\Application Data\Skype
O43 - CFD: 09-03-2015 - 4:38:16 - [] ----D C:\Documents and Settings\ali\Local Settings\Application Data\temp
O43 - CFD: 07-12-2014 - 3:49:43 - [] R---D C:\Documents and Settings\ali\Menu Démarrer\Programmes\Accessoires
O43 - CFD: 15-03-2015 - 22:22:29 - [] ----D C:\Documents and Settings\ali\Menu Démarrer\Programmes\Amara - News Ticker
O43 - CFD: 20-03-2015 - 1:24:15 - [] R---D C:\Documents and Settings\ali\Menu Démarrer\Programmes\Démarrage
O43 - CFD: 24-01-2015 - 15:54:13 - [] ----D C:\Documents and Settings\ali\Menu Démarrer\Programmes\HiJackThis
O43 - CFD: 09-02-2015 - 1:41:59 - [] ----D C:\Documents and Settings\ali\Menu Démarrer\Programmes\Internet Download Manager
O43 - CFD: 07-12-2014 - 4:03:45 - [] ----D C:\Documents and Settings\ali\Menu Démarrer\Programmes\MainConcept
O43 - CFD: 19-03-2015 - 10:22:41 - [] ----D C:\Documents and Settings\ali\Menu Démarrer\Programmes\PhotoFiltre 7
O43 - CFD: 27-02-2015 - 9:24:53 - [] ----D C:\Documents and Settings\ali\Menu Démarrer\Programmes\ProgDVB
O43 - CFD: 19-03-2015 - 6:23:21 - [] ----D C:\Documents and Settings\ali\Menu Démarrer\Programmes\Recover My Files v5
O43 - CFD: 15-09-2007 - 1:41:13 - [] ----D C:\Documents and Settings\ali\Menu Démarrer\Programmes\WinRAR
~ Program Folder: 191 Scanned in 00mn 00s



---\\ Last modified or created files under Windows and System32 (O44)
O44 - LFC:[MD5.E51B539FEC6A6485289F650E5E7D5156] - 07-03-2015 - 3:16:17 ---A- . (.Adobe Systems Incorporated - Adobe Flash Player Control Panel Applet.) -- C:\WINDOWS.0\system32\FlashPlayerApp.exe [701616]
O44 - LFC:[MD5.4713ED2510365E9102172816D2CFB832] - 07-03-2015 - 3:16:17 ---A- . (.Adobe Systems Incorporated - Adobe Flash Player Control Panel Applet.) -- C:\WINDOWS.0\system32\FlashPlayerCPLApp.cpl [71344]
O44 - LFC:[MD5.2DC3A2BDF341BA4D2B029AEA714CFEEF] - 08-03-2015 - 7:04:19 ---A- . (.Microsoft Corporation - Universal Serial Bus Camera DShow Extension.) -- C:\WINDOWS.0\system32\dshowext.ax [20992]
O44 - LFC:[MD5.63BBFCA7F390F4C49ED4B96BFB1633E0] - 08-03-2015 - 7:04:26 ---A- . (.Microsoft Corporation - USB Video Class Driver.) -- C:\WINDOWS.0\system32\Drivers\usbvideo.sys [121984]
O44 - LFC:[MD5.6981F475DDC4594E930EB446C32209DC] - 09-03-2015 - 0:50:33 ---A- . (...) -- C:\WINDOWS.0\ODBC.INI [385]
O44 - LFC:[MD5.65D5328611433D96435900DE16DB6392] - 09-03-2015 - 0:54:30 ---A- . (...) -- C:\WINDOWS.0\system32\FNTCACHE.DAT [175464]
O44 - LFC:[MD5.DC17DD0189B0C36D863B4DD0A036C10F] - 15-03-2015 - 17:54:19 ---A- . (...) -- C:\WINDOWS.0\WMSysPr9.prx [316640]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 19-03-2015 - 10:20:44 ---A- . (...) -- C:\WINDOWS.0\lucispro.INI [0]
O44 - LFC:[MD5.CB3DA64A6D994B62BA03593DA009ECF8] - 19-03-2015 - 10:46:00 ---A- . (...) -- C:\WINDOWS.0\SchedLgU.Txt [32398]
O44 - LFC:[MD5.CA80A282458D49637A22799C2B55F484] - 19-03-2015 - 6:23:15 ---A- . (.WIBU-SYSTEMS AG - CodeMeter Library.) -- C:\WINDOWS.0\system32\WibuCm32.dll [666024]
O44 - LFC:[MD5.0210D6EC2A4C4D79A08324E3122506F2] - 20-03-2015 - 0:10:19 ---A- . (...) -- C:\WINDOWS.0\system32\wpa.dbl [2206]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 20-03-2015 - 0:11:17 ---A- . (...) -- C:\WINDOWS.0\Sti_Trace.log [0]
O44 - LFC:[MD5.6CF813081A64B2DD4DB4B8ABFFDAE3E5] - 20-03-2015 - 0:20:38 ---A- . (...) -- C:\WINDOWS.0\setupapi.log [12177]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 20-03-2015 - 1:11:47 ---A- . (...) -- C:\WINDOWS.0\MEMORY.DMP [0]
O44 - LFC:[MD5.4233961F577C7968A8A9098B59B3384B] - 20-03-2015 - 1:12:37 ---A- . (...) -- C:\WINDOWS.0\ntbtlog.txt [163426]
O44 - LFC:[MD5.0877AC09CAA217471589644C398FA572] - 20-03-2015 - 1:20:23 -S-A- . (...) -- C:\WINDOWS.0\bootstat.dat [2048]
O44 - LFC:[MD5.745AE77DEC8F737590B5AC8B02610D3A] - 20-03-2015 - 1:21:18 ---A- . (...) -- C:\WINDOWS.0\wiadebug.log [157]
O44 - LFC:[MD5.4A283DC3F90D1B9E9E44C1E5258FC7C5] - 20-03-2015 - 1:21:19 ---A- . (...) -- C:\WINDOWS.0\wiaservc.log [48]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 20-03-2015 - 1:21:37 ---A- . (...) -- C:\WINDOWS.0\0.log [0]
O44 - LFC:[MD5.9A917D034C0A361142A627EB4CB20CC2] - 20-03-2015 - 1:26:00 ---A- . (...) -- C:\WINDOWS.0\system32\PerfStringBackup.INI [6546]
O44 - LFC:[MD5.64A21FB2C4C1B6F42C48BF469ABF8391] - 20-03-2015 - 1:26:02 ---A- . (...) -- C:\WINDOWS.0\system32\perfc009.dat [158478]
O44 - LFC:[MD5.F4C5BC1A5D1824CE41FCCA2A56D3706E] - 20-03-2015 - 1:26:03 ---A- . (...) -- C:\WINDOWS.0\system32\perfc00C.dat [176250]
O44 - LFC:[MD5.26523CA833F953EFD9C96787BC49B172] - 20-03-2015 - 1:26:03 ---A- . (...) -- C:\WINDOWS.0\system32\perfh009.dat [629220]
O44 - LFC:[MD5.C5D175FA19CB8D2B8EF9634B5228096A] - 20-03-2015 - 1:26:04 ---A- . (...) -- C:\WINDOWS.0\system32\perfh00C.dat [703658]
O44 - LFC:[MD5.A73F6F61CE36DF1ED509D32890F00B0A] - 20-03-2015 - 1:27:33 ---A- . (...) -- C:\WINDOWS.0\WindowsUpdate.log [3841]
~ Files: 26 Scanned in 00mn 01s



---\\ Latest files created in Windows Prefetcher (O45)
O45 - LFCP:[MD5.EAB6FB025C4225CD0ADA1FDA100A4A7A] - 20-03-2015 - 4:19:45 ---A- - C:\WINDOWS.0\Prefetch\MOBOGENIE.EXE-2B929E88.pf =>PUP.Mobogenie
O45 - LFCP:[MD5.849A484DF97F927710A66E3AC63911A2] - 19-03-2015 - 23:23:19 ---A- - C:\WINDOWS.0\Prefetch\MOBOGENIE.EXE-53B1C917.pf =>PUP.Mobogenie
O45 - LFCP:[MD5.7F4DB29A088A2EAE5F812FDC99394F31] - 20-03-2015 - 4:19:45 ---A- - C:\WINDOWS.0\Prefetch\MOBOGENIEHELPER.EXE-33D535F7.pf =>PUP.Mobogenie
O45 - LFCP:[MD5.BF25223148A01C6A7109C72CDF133D8C] - 20-03-2015 - 2:21:48 ---A- - C:\WINDOWS.0\Prefetch\MOBOGENIEP2SP.EXE-2A9D7FEC.pf =>PUP.Mobogenie
O45 - LFCP:[MD5.DA726FD2A5044297083425F01A3BA827] - 19-03-2015 - 22:46:57 ---A- - C:\WINDOWS.0\Prefetch\MOBOGENIESERVICE.EXE-0015CD59.pf =>PUP.Mobogenie
O45 - LFCP:[MD5.7A13068DFF9FB611672E7DBE88BD4813] - 20-03-2015 - 1:22:27 ---A- - C:\WINDOWS.0\Prefetch\UTORRENT.EXE-34633E77.pf =>P2P.µTorrent
~ Prefetcher: 6 Scanned in 00mn 00s



---\\ Operations and functions at Windows Explorer startup (O46)
O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll
~ ShellExecuteHooks: Scanned in 00mn 00s



---\\ Export authorized application key (O47)
O47 - AAKE:Key Export SP - "\??\C:\WINDOWS.0\system32\winlogon.exe" [Enabled] .(.Microsoft Corporation.) -- C:\WINDOWS.0\system32\winlogon.exe
O47 - AAKE:Key Export SP - "C:\WINDOWS.0\system32\services.exe" [Disabled] .(.Microsoft Corporation.) -- C:\WINDOWS.0\system32\services.exe
O47 - AAKE:Key Export SP - "C:\WINDOWS.0\system32\sessmgr.exe" [Disabled] .(.Microsoft Corporation.) -- C:\WINDOWS.0\system32\sessmgr.exe
O47 - AAKE:Key Export SP - "C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe" [Disabled] .(.Microsoft Corporation.) -- C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O47 - AAKE:Key Export SP - "C:\Program Files\Google\Chrome\Application\chrome.exe" [Disabled] .(.Google Inc..) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O47 - AAKE:Key Export SP - "C:\Program Files\Opera\opera.exe" [Disabled] .(.Opera Software.) -- C:\Program Files\Opera\opera.exe
O47 - AAKE:Key Export SP - "D:\Pro Evolution Soccer 2013\pes2013.exe" [Enabled] .(.Konami Digital Entertainment Co., Ltd..) -- D:\Pro Evolution Soccer 2013\pes2013.exe
O47 - AAKE:Key Export SP - "C:\Program Files\Mobogenie3\mobogenieP2sp.exe" [Enabled] .(.mobogenie.com.) -- C:\Program Files\Mobogenie3\mobogenieP2sp.exe =>PUP.Mobogenie
O47 - AAKE:Key Export DP - "%windir%\Network Diagnostic\xpnetdiag.exe" [Enabled] .(.Microsoft Corporation.) -- C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O47 - AAKE:Key Export DP - "%windir%\system32\sessmgr.exe" [Enabled] .(.Microsoft Corporation.) -- C:\WINDOWS.0\system32\sessmgr.exe
~ Keys Export: 10 Scanned in 00mn 00s



---\\ Local Security Authority-LSA Deny (O48)
O48 - LSA:Local Security Authority Authentication Packages . (.Microsoft Corporation - Microsoft Authentication Package v1.0.) -- C:\WINDOWS.0\system32\msv1_0.dll
O48 - LSA:Local Security Authority Notification Packages . (.Microsoft Corporation - Moteur du client de l'Éditeur de configuration de sécurité Windows.) -- C:\WINDOWS.0\system32\scecli.dll
O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Kerberos Security Package.) -- C:\WINDOWS.0\system32\kerberos.dll
O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Microsoft Authentication Package v1.0.) -- C:\WINDOWS.0\system32\msv1_0.dll
O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\WINDOWS.0\system32\schannel.dll
O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Microsoft Digest Access.) -- C:\WINDOWS.0\system32\wdigest.dll
~ LSA: 6 Scanned in 00mn 00s



---\\ Safe Boot Control (O49)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmboot.sys . (.Microsoft Corp., Veritas Software - Pilote de démarrage du gestionnaire de disque NT.) -- C:\WINDOWS.0\system32\Drivers\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmio.sys . (.Microsoft Corp., Veritas Software - Pilote E/S du Gestionnaire de disques NT.) -- C:\WINDOWS.0\system32\Drivers\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dmload.sys . (.Microsoft Corp., Veritas Software. - NT Disk Manager Startup Driver.) -- C:\WINDOWS.0\system32\Drivers\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sermouse.sys . (...) -- C:\WINDOWS.0\system32\Drivers\sermouse.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sr.sys . (.Microsoft Corporation - Pilote de filtre de système de fichiers pour la restauration du système.) -- C:\WINDOWS.0\system32\Drivers\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vga.sys . (.Microsoft Corporation - VGA/Super VGA Video Driver.) -- C:\WINDOWS.0\system32\Drivers\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vgasave.sys . (...) -- C:\WINDOWS.0\system32\Drivers\vgasave.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\Wdf01000.sys . (.Microsoft Corporation - Kernel Mode Driver Framework Runtime.) -- C:\WINDOWS.0\system32\Drivers\Wdf01000.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmboot.sys . (.Microsoft Corp., Veritas Software - Pilote de démarrage du gestionnaire de disque NT.) -- C:\WINDOWS.0\system32\Drivers\dmboot.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmio.sys . (.Microsoft Corp., Veritas Software - Pilote E/S du Gestionnaire de disques NT.) -- C:\WINDOWS.0\system32\Drivers\dmio.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dmload.sys . (.Microsoft Corp., Veritas Software. - NT Disk Manager Startup Driver.) -- C:\WINDOWS.0\system32\Drivers\dmload.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ip6fw.sys . (.Microsoft Corporation - IPv6 Windows Firewall Driver.) -- C:\WINDOWS.0\system32\Drivers\ip6fw.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ipnat.sys . (.Microsoft Corporation - IP Network Address Translator.) -- C:\WINDOWS.0\system32\Drivers\ipnat.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpcdd.sys . (.Microsoft Corporation - RDP Miniport.) -- C:\WINDOWS.0\system32\Drivers\rdpcdd.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpdd.sys . (...) -- C:\WINDOWS.0\system32\Drivers\rdpdd.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpwd.sys . (.Microsoft Corporation - RDP Terminal Stack Driver (US/Canada Only, Not for Export).) -- C:\WINDOWS.0\system32\Drivers\rdpwd.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sermouse.sys . (...) -- C:\WINDOWS.0\system32\Drivers\sermouse.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sr.sys . (.Microsoft Corporation - Pilote de filtre de système de fichiers pour la restauration du système.) -- C:\WINDOWS.0\system32\Drivers\sr.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\tdpipe.sys . (.Microsoft Corporation - Named Pipe Transport Driver.) -- C:\WINDOWS.0\system32\Drivers\tdpipe.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\tdtcp.sys . (.Microsoft Corporation - TCP Transport Driver.) -- C:\WINDOWS.0\system32\Drivers\tdtcp.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vga.sys . (.Microsoft Corporation - VGA/Super VGA Video Driver.) -- C:\WINDOWS.0\system32\Drivers\vga.sys
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vgasave.sys . (...) -- C:\WINDOWS.0\system32\Drivers\vgasave.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\Wdf01000.sys . (.Microsoft Corporation - Kernel Mode Driver Framework Runtime.) -- C:\WINDOWS.0\system32\Drivers\Wdf01000.sys
~ CSB: 23 Scanned in 00mn 00s



---\\ Image File Execution Options (IFEO) (O50)
O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d
~ IFEO: Scanned in 00mn 00s



---\\ MountPoints2 Shell Key (MPSK) (O51)
O51 - MPSK:{4e62597b-618c-11dc-b096-0008c9e1f153}\AutoRun\command. (...) -- G:\autorun.exe (.not file.)
O51 - MPSK:{7236bb2f-ad6d-11e4-b060-0008c9e1f153}\AutoRun\command. (...) -- H:\AutoRun.exe (.not file.)
O51 - MPSK:{a41c4256-933c-11e4-8757-0008c9e1f153}\AutoRun\command. (...) -- I:\autorun.exe (.not file.)
O51 - MPSK:{a5ee31b8-9da8-11e4-b025-0008c9e1f153}\AutoRun\command. (...) -- H:\autorun.exe (.not file.)
O51 - MPSK:{ab685d7a-7e23-11e4-86fb-0008c9e1f153}\AutoRun\command. (...) -- G:\autorun.exe (.not file.)
O51 - MPSK:{ab685d7c-7e23-11e4-86fb-0008c9e1f153}\AutoRun\command. (...) -- H:\autorun.exe (.not file.)
O51 - MPSK:{ab685d7e-7e23-11e4-86fb-0008c9e1f153}\AutoRun\command. (...) -- H:\autorun.exe (.not file.)
O51 - MPSK:{e76478ec-6272-11dc-874e-0008c9e1f153}\AutoRun\command. (...) -- H:\autorun.exe (.not file.)
~ Keys: Scanned in 00mn 00s



---\\ Trojan Driver Search Data (HKLM)(TDSD) (O52)
O52 - TDSD: \Drivers32\"msacm.trspch"="tssoft32.acm" . (.DSP GROUP, INC. - Codec audio TrueSpeech(TM) DSP Group pour MSACM V3.50.) -- C:\WINDOWS.0\system32\tssoft32.acm
O52 - TDSD: \Drivers32\"vidc.cvid"="iccvid.dll" . (.Radius Inc. - Cinepak® Codec.) -- C:\WINDOWS.0\system32\iccvid.dll
O52 - TDSD: \Drivers32\"vidc.iv31"="ir32_32.dll" . (...) -- C:\WINDOWS.0\system32\ir32_32.dll
O52 - TDSD: \Drivers32\"vidc.iv32"="ir32_32.dll" . (...) -- C:\WINDOWS.0\system32\ir32_32.dll
O52 - TDSD: \Drivers32\"vidc.iv41"="ir41_32.ax" . (.Intel Corporation - Intel Indeo® Video 4.5.) -- C:\WINDOWS.0\system32\ir41_32.ax
O52 - TDSD: \Drivers32\"msacm.sl_anet"="sl_anet.acm" . (.Sipro Lab Telecom Inc. - Audio codec for MS ACM.) -- C:\WINDOWS.0\system32\sl_anet.acm
O52 - TDSD: \Drivers32\"vidc.iv50"="ir50_32.dll" . (.Intel Corporation - Intel Indeo® video 5.10.) -- C:\WINDOWS.0\system32\ir50_32.dll
O52 - TDSD: \drivers.desc\"sl_anet.acm"="Sipro Lab Telecom Audio Codec" . (.Sipro Lab Telecom Inc. - Audio codec for MS ACM.) -- C:\WINDOWS.0\system32\sl_anet.acm
~ TDSD: 8 Scanned in 00mn 00s



---\\ ShareTools MSconfig StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\AntiUsbWorm [Key] . (.Microsoft Corporation - Interpréteur de commandes Windows.) -- C:\WINDOWS.0\system32\cmd.exe =>.Microsoft Corporation
O53 - SMSR:HKLM\...\startupreg\AntiWormUpdate [Key] . (...) -- C:\Google\AutoIt3.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\CTFMON.EXE [Key] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS.0\system32\ctfmon.exe
O53 - SMSR:HKLM\...\startupreg\HSPALauncher [Key] . (.No owner - HSDPALauncher MFC Application.) -- C:\Program Files\HSPA USB Modem\HSPALauncher.exe
O53 - SMSR:HKLM\...\startupreg\IDMan [Key] . (...) -- C:\Documents and Settings\ali\Local Settings\Temp\Rar$EXa0.324\IDMan.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\S3Trayp [Key] . (.S3 Graphics Co., Ltd. - s3contrl (32-bit).) -- C:\WINDOWS.0\system32\S3trayp.exe
O53 - SMSR:HKLM\...\startupreg\VTTimer [Key] . (.S3 Graphics, Inc. - No Comment.) -- C:\WINDOWS.0\system32\VTTimer.exe
~ SMSR Keys: 7 Scanned in 00mn 00s



---\\ Microsoft Control Security Providers (MCSP) (O54)
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Client DPA pour plate-forme 32 bit.) -- C:\WINDOWS.0\system32\msapsspc.dll
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\WINDOWS.0\system32\schannel.dll
O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Package d'authentification Digest SSPI.) -- C:\WINDOWS.0\system32\digest.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Client DPA pour plate-forme 32 bit.) -- C:\WINDOWS.0\system32\msapsspc.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\WINDOWS.0\system32\schannel.dll
O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Package d'authentification Digest SSPI.) -- C:\WINDOWS.0\system32\digest.dll
~ MSCP: 6 Scanned in 00mn 00s



---\\ Microsoft Windows Policies System (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticecaption"=0
O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticetext"=0
O55 - MWPS:[HKLM\...\Policies\System] - "shutdownwithoutlogon"=1
O55 - MWPS:[HKLM\...\Policies\System] - "undockwithoutlogon"=1
~ MWPS: 5 Scanned in 00mn 00s



---\\ Microsoft Windows Policies Explorer (MWPE) (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoDriveTypeAutoRun"=145
~ MWPE Keys: 1 Scanned in 00mn 00s



---\\ Search Drivers Rootkit (SDR) (O57)
O57 - SDR:Search Drivers Rootkit - ( - .) --
O57 - SDR:Search Drivers Rootkit - ( - .) --
~ Keys: Scanned in 00mn 03s



---\\ System Drivers List (SDL) (O58)
O58 - SDL:23-12-2013 - 9:33:56 ---A- . (.ATI Technologies Inc. - ATI Radeon WindowsNT Miniport Driver.) -- C:\WINDOWS.0\system32\Drivers\ati2mtag.sys [6852096]
O58 - SDL:14-05-2012 - 7:12:12 R--A- . (.Advanced Micro Devices - AMD High Definition Audio Function Driver.) -- C:\WINDOWS.0\system32\Drivers\AtihdXP3.sys [103040]
O58 - SDL:02-10-2001 - 19:17:52 ---A- . (.RAVISENT Technologies Inc. - Pilote principal CineMaster C 1.2 WDM.) -- C:\WINDOWS.0\system32\Drivers\cinemst2.sys [262528]
O58 - SDL:02-10-2001 - 19:17:52 ---A- . (.Compaq Computer Corporation - Compaq PA-1 Player Driver.) -- C:\WINDOWS.0\system32\Drivers\cpqdap01.sys [11776]
O58 - SDL:14-04-2008 - 3:05:08 ---A- . (.Microsoft Corp., Veritas Software - Pilote de démarrage du gestionnaire de disque NT.) -- C:\WINDOWS.0\system32\Drivers\dmboot.sys [800256]
O58 - SDL:14-04-2008 - 3:05:14 ---A- . (.Microsoft Corp., Veritas Software - Pilote E/S du Gestionnaire de disques NT.) -- C:\WINDOWS.0\system32\Drivers\dmio.sys [154496]
O58 - SDL:02-10-2001 - 19:17:30 ---A- . (.Microsoft Corp., Veritas Software. - NT Disk Manager Startup Driver.) -- C:\WINDOWS.0\system32\Drivers\dmload.sys [5888]
O58 - SDL:17-08-2001 - 21:13:08 ---A- . (.VIA Technologies, Inc. - NDIS 5.0 miniport driver.) -- C:\WINDOWS.0\system32\Drivers\fetnd5.sys [27165]
O58 - SDL:13-04-2008 - 17:36:06 ---A- . (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) -- C:\WINDOWS.0\system32\Drivers\hdaudbus.sys [144384]
O58 - SDL:29-11-2014 - 1:37:06 ---A- . (.Tonec Inc. - Internet Download Manager TDI Driver.) -- C:\WINDOWS.0\system32\Drivers\idmtdi.sys [123360]
O58 - SDL:02-10-2001 - 19:17:52 ---A- . (.S3/Diamond Multimedia Systems - NikeDrv Usb Driver.) -- C:\WINDOWS.0\system32\Drivers\nikedrv.sys [12032]
O58 - SDL:04-02-2005 - 16:12:50 ---A- . (.Padus, Inc. - Padus(R) ASPI Shell.) -- C:\WINDOWS.0\system32\Drivers\pfc.sys [10368]
O58 - SDL:28-02-2015 - 21:09:10 ---A- . (.microOLAP Technologies LTD - PSSDK Driver Protocol v4.2 32bit.) -- C:\WINDOWS.0\system32\Drivers\pssdk42.sys [38976]
O58 - SDL:02-10-2001 - 19:18:56 ---A- . (.Parallel Technologies, Inc. - Parallel Technologies DirectParallel IO Library.) -- C:\WINDOWS.0\system32\Drivers\ptilink.sys [17792]
O58 - SDL:02-10-2001 - 19:17:52 ---A- . (.S3/Diamond Multimedia Systems - Rio8Drv.sys Usb Driver.) -- C:\WINDOWS.0\system32\Drivers\rio8drv.sys [12032]
O58 - SDL:02-10-2001 - 19:17:52 ---A- . (.S3/Diamond Multimedia Systems - RioDrv Usb Driver.) -- C:\WINDOWS.0\system32\Drivers\riodrv.sys [12032]
O58 - SDL:11-07-2007 - 13:08:46 ---A- . (.S3 Graphics Co., Ltd. - S3 Graphics 86c700-series Miniport.) -- C:\WINDOWS.0\system32\Drivers\S3gIGPm.sys [714240]
O58 - SDL:13-04-2008 - 17:39:16 ---A- . (.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) -- C:\WINDOWS.0\system32\Drivers\secdrv.sys [20480]
O58 - SDL:13-04-2011 - 13:51:52 R--A- . (.TechniSat Digital, S.A. - TechniSat SkyStar 2 eXpress HD BDA Driver.) -- C:\WINDOWS.0\system32\Drivers\SkyNetNXPBDA.sys [1742424]
O58 - SDL:13-04-2011 - 13:51:54 R--A- . (.TechniSat Digital, S.A. - NDIS 5.0 driver.) -- C:\WINDOWS.0\system32\Drivers\SkyNetVirtualNetwork.sys [159320]
O58 - SDL:13-10-2014 - 6:57:48 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG USB Composite Device Driver (MSS Ver.3).) -- C:\WINDOWS.0\system32\Drivers\ssudbus.sys [89856]
O58 - SDL:13-10-2014 - 6:57:48 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG Android Modem Device Driver (MSS Ver.3).) -- C:\WINDOWS.0\system32\Drivers\ssudmdm.sys [184192]
O58 - SDL:13-10-2014 - 6:57:48 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG USB Mobile OBEX Device Driver (MSS Ver.3).) -- C:\WINDOWS.0\system32\Drivers\ssudobex.sys [184192]
O58 - SDL:02-10-2001 - 19:17:52 ---A- . (.Toshiba Corporation - WDM Toshiba Tecra Video Capture Driver.) -- C:\WINDOWS.0\system32\Drivers\tsbvcap.sys [21376]
O58 - SDL:02-10-2001 - 19:17:52 ---A- . (.RAVISENT Technologies Inc. - CineMaster C WDM DVD Minidriver.) -- C:\WINDOWS.0\system32\Drivers\vdmindvd.sys [58112]
O58 - SDL:16-10-2007 - 11:00:04 R--A- . (.VIA Technologies, Inc. - VIA High Definition Audio Function Driver.) -- C:\WINDOWS.0\system32\Drivers\viahduaa.sys [208384]
O58 - SDL:13-09-2007 - 1:50:30 ---A- . (...) -- C:\WINDOWS.0\system32\Drivers\VSPE.sys [25984]
O58 - SDL:02-10-2001 - 19:17:16 ---A- . (...) -- C:\WINDOWS.0\system32\ansi.sys [9037]
O58 - SDL:02-10-2001 - 19:17:26 ---A- . (...) -- C:\WINDOWS.0\system32\country.sys [27097]
O58 - SDL:02-10-2001 - 19:18:02 ---A- . (...) -- C:\WINDOWS.0\system32\himem.sys [4912]
O58 - SDL:02-10-2001 - 19:18:12 ---A- . (...) -- C:\WINDOWS.0\system32\key01.sys [42809]
O58 - SDL:13-04-2008 - 17:50:56 ---A- . (...) -- C:\WINDOWS.0\system32\keyboard.sys [42537]
O58 - SDL:02-10-2001 - 19:18:38 ---A- . (...) -- C:\WINDOWS.0\system32\ntdos.sys [27916]
O58 - SDL:02-10-2001 - 19:18:38 ---A- . (...) -- C:\WINDOWS.0\system32\ntdos404.sys [29146]
O58 - SDL:02-10-2001 - 19:18:38 ---A- . (...) -- C:\WINDOWS.0\system32\ntdos411.sys [29370]
O58 - SDL:02-10-2001 - 19:18:38 ---A- . (...) -- C:\WINDOWS.0\system32\ntdos412.sys [29274]
O58 - SDL:02-10-2001 - 19:18:38 ---A- . (...) -- C:\WINDOWS.0\system32\ntdos804.sys [29146]
O58 - SDL:13-04-2008 - 17:49:52 ---A- . (...) -- C:\WINDOWS.0\system32\ntio.sys [34000]
O58 - SDL:13-04-2008 - 17:49:44 ---A- . (...) -- C:\WINDOWS.0\system32\ntio404.sys [34560]
O58 - SDL:13-04-2008 - 17:49:40 ---A- . (...) -- C:\WINDOWS.0\system32\ntio411.sys [35648]
O58 - SDL:13-04-2008 - 17:49:44 ---A- . (...) -- C:\WINDOWS.0\system32\ntio412.sys [35424]
O58 - SDL:13-04-2008 - 17:49:42 ---A- . (...) -- C:\WINDOWS.0\system32\ntio804.sys [34560]
~ Drivers: 42 Scanned in 00mn 00s



---\\ Last modified or created user files (O61)
O61 - LFC: 13-03-2015 - 4:37:17 ---A- . (...) -- C:\Documents and Settings\ali\Bureau\camstia\camtasia.exe [259540280]
O61 - LFC: 13-03-2015 - 4:37:17 ---A- . (...) -- C:\Documents and Settings\ali\Mes documents\Downloads\Programs\camtasia.exe [259540280]
O61 - LFC: 13-03-2015 - 4:37:17 ---A- . (.Google Inc..) -- C:\Documents and Settings\ali\Local Settings\Application Data\Google\Chrome\User Data\WidevineCDM\1.4.7.771\_platform_specific\win_x86\widevinecdm.dll [7959880]
O61 - LFC: 15-03-2015 - 4:37:17 ---A- . (...) -- C:\Documents and Settings\ali\Mes documents\Downloads\Programs\fnt.exe [3265640]
O61 - LFC: 17-03-2015 - 4:37:17 ---A- . (.SWiSHzone.com.) -- C:\Documents and Settings\ali\Mes documents\Downloads\Programs\SetupSwishmax4.exe [56654648]
O61 - LFC: 19-03-2015 - 4:37:17 ---A- . (...) -- C:\Documents and Settings\ali\Application Data\appdataFr3.bin [20]
O61 - LFC: 19-03-2015 - 4:37:17 ---A- . (...) -- C:\Documents and Settings\ali\Bureau\Adobe Photoshop CS3 Extended Portable\CSDATA\%AppData%\Adobe\Plugins\Adobe Filter Gallery CS3\Photoshop\Topaz Adjust 5\uninst.exe [56502] =>.Adobe Systems Incorporated
O61 - LFC: 19-03-2015 - 4:37:17 ---A- . (...) -- C:\Documents and Settings\ali\Bureau\Adobe Photoshop CS3 Extended Portable\CSDATA\10000001200002i\verclsid.exe [8704] =>.Adobe Systems Incorporated
O61 - LFC: 19-03-2015 - 4:37:17 ---A- . (...) -- C:\Documents and Settings\ali\Local Settings\Temp\nsx89E.tmp\System.dll [11264]
O61 - LFC: 19-03-2015 - 4:37:17 ---A- . (...) -- C:\Documents and Settings\ali\Mes documents\Downloads\Programs\topazadjust5_setup.exe [65398928]
O61 - LFC: 19-03-2015 - 4:37:17 ---A- . (...) -- C:\Documents and Settings\ali\Mes documents\KONAMI\PesEdit 2013 - my-PES.Com\Euro\CL01.bin [5243688]
O61 - LFC: 19-03-2015 - 4:37:17 ---A- . (...) -- C:\Documents and Settings\ali\Mes documents\KONAMI\PesEdit 2013 - my-PES.Com\Euro\OPTION.bin [402008]
O61 - LFC: 19-03-2015 - 4:37:17 ---A- . (.Google.) -- C:\Documents and Settings\ali\Local Settings\Application Data\Google\Chrome\User Data\SwReporter\2.15.6\software_reporter_tool.exe [561992]
O61 - LFC: 19-03-2015 - 4:37:17 ---A- . (.oppoos.com.) -- C:\Documents and Settings\ali\Local Settings\Temp\nsx89E.tmp\PackageInstaller.dll [403096]
O61 - LFC: 20-03-2015 - 4:37:17 ---A- . (...) -- C:\Documents and Settings\ali\Local Settings\Application Data\Google\Chrome\User Data\ev_hashes_whitelist.bin [1113849]
O61 - LFC: 20-03-2015 - 4:37:17 ---A- . (.ESET.) -- C:\Documents and Settings\ali\Local Settings\Temp\InstHelper.exe [307400]
O61 - LFC: 20-03-2015 - 4:37:17 ---A- . (.Nicolas Coolman.) -- C:\Documents and Settings\ali\Mes documents\Downloads\Programs\ZHPDiag2.exe [6876452] =>.Nicolas Coolman
O61 - LFC: 20-03-2015 - 4:37:17 ---A- . (.Tonec Inc..) -- C:\Documents and Settings\ali\Application Data\IDM\idmmzcc5\components11\idmmzcc.dll [26136]
O61 - LFC: 20-03-2015 - 4:37:17 ---A- . (.Tonec Inc..) -- C:\Documents and Settings\ali\Application Data\IDM\idmmzcc5\components11\idmmzcc64.dll [31256]
O61 - LFC: 20-03-2015 - 4:37:17 ---A- . (.Tonec Inc..) -- C:\Documents and Settings\ali\Application Data\IDM\idmmzcc5\components2\idmcchandler2.dll [326168]
O61 - LFC: 20-03-2015 - 4:37:17 ---A- . (.Tonec Inc..) -- C:\Documents and Settings\ali\Application Data\IDM\idmmzcc5\components2\idmcchandler2_64.dll [452632]
O61 - LFC: 20-03-2015 - 4:37:17 ---A- . (.Tonec Inc..) -- C:\Documents and Settings\ali\Application Data\IDM\idmmzcc5\components2\idmmzcc.dll [34216]
O61 - LFC: 20-03-2015 - 4:37:17 ---A- . (.Tonec Inc..) -- C:\Documents and Settings\ali\Application Data\IDM\idmmzcc5\components2\idmmzcc64.dll [28512]
O61 - LFC: 20-03-2015 - 4:37:17 ---A- . (.Tonec Inc..) -- C:\Documents and Settings\ali\Application Data\IDM\idmmzcc5\components\idmmzcc.dll [34216]
~ 1483 Fichiers temporaires (Temporary files)
~ 63 Fichiers cookies (Cookies files)
~ Files: 24 Scanned in 00mn 00s



---\\ List all tools cleaner (LATC) (O63)
O63 - Logiciel: ZHPDiag 2015 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
O63 - Logiciel: HiJackThis - (.Trend Micro.) [HKLM] -- {45A66726-69BC-466B-A7A4-12FCBA4883D7}
~ ADS: Scanned in 00mn 00s



---\\ List all legacy services(LALS) (O64)
O64 - Services: CurCS - 04-03-2015 - c:\Program Files\SegmentEnhancer\SegmentEnhancer.dll (21a6d46d) .(...) - LEGACY_21A6D46D
O64 - Services: CurCS - 23-12-2013 - C:\WINDOWS.0\system32\Ati2evxx.exe (Ati HotKey Poller) .(.ATI Technologies Inc. - ATI External Event Utility EXE Module.) - LEGACY_ATI_HOTKEY_POLLER
O64 - Services: CurCS - 03-12-2012 - C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe (CodeMeter.exe) .(.WIBU-SYSTEMS AG - CodeMeter Runtime Server.) - LEGACY_CODEMETER.EXE
O64 - Services: CurCS - 02-10-2001 - C:\WINDOWS.0\system32\drivers\dmload.sys (dmload) .(.Microsoft Corp., Veritas Software. - NT Disk Manager Startup Driver.) - LEGACY_DMLOAD
O64 - Services: CurCS - 06-02-2015 - C:\Program Files\Genie Soft\Genie Cleaner\GenieCleanService.exe (GenieCleanService) .(.Oppoos.com - GenieCleanService.exe.) - LEGACY_GENIECLEANSERVICE
O64 - Services: CurCS - 29-11-2014 - C:\WINDOWS.0\system32\DRIVERS\idmtdi.sys (IDMTDI) .(.Tonec Inc. - Internet Download Manager TDI Driver.) - LEGACY_IDMTDI
O64 - Services: CurCS - 03-02-2015 - C:\Program Files\Mobogenie3\MobogenieService.exe (MobogenieService) .(.Mobogenie.com - MobogenieService.exe.) - LEGACY_MOBOGENIESERVICE =>PUP.Mobogenie
O64 - Services: CurCS - 13-10-2014 - C:\Program Files\SAMSUNG\USB Drivers\25_escape\conn\ss_conn_service.exe (ss_conn_service) .(.DEVGURU Co., LTD. - MSS CS Connectivity Service.) - LEGACY_SS_CONN_SERVICE
~ Legacy: 122 Scanned in 00mn 00s



---\\ File Associations Shell Spawning (O67)
O67 - Shell Spawning: <.bat> [HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.cpl> [HKLM\..\cplopen\Command] (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\WINDOWS.0\system32\shell32.dll
O67 - Shell Spawning: <.cmd> [HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.com> [HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.exe> [HKLM\..\open\Command] (...) -- "%1" %*
O67 - Shell Spawning: <.html> [HKLM\..\open\Command] (.Opera Software - Opera Internet Browser.) -- C:\Program Files\Opera\Opera.exe
O67 - Shell Spawning: <.js> [HKLM\..\open\Command] (.Microsoft Corporation - Microsoft (R) Windows Based Script Host.) -- C:\WINDOWS.0\system32\WScript.exe
O67 - Shell Spawning: <.reg> [HKLM\..\open\Command] (.Microsoft Corporation - Éditeur du Registre.) -- C:\WINDOWS.0\regedit.exe
O67 - Shell Spawning: <.scr> [HKLM\..\open\Command] (...) -- "%1" /S
O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 10 Scanned in 00mn 00s



---\\ Start Menu Internet (SMI) (O68)
O68 - StartMenuInternet: <>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Opera Software - Opera Internet Browser.) -- C:\Program Files\Opera\Opera.exe
~ Keys: Scanned in 00mn 00s



---\\ Crack & Keygen Files (CKF) (O82)
C:\Program Files\GetData\Recover My Files v5\Cracked By ALSAFA7.exe =>.Crack,Keygen
C:\Program Files\GetData\Recover My Files v5\Cracked By ALSAFA7.exe =>.Crack,Keygen
~ Files: Scanned in 00mn 12s



---\\ Search Svchost Services (SSS) (O83)
O83 - Search Svchost Services: AppMgmt (AppMgmt) . (.Microsoft Corporation - Service Installation de logiciels.) -- C:\WINDOWS.0\system32\appmgmts.dll [176640]
O83 - Search Svchost Services: AudioSrv (AudioSrv) . (.Microsoft Corporation - Windows Audio Service.) -- C:\WINDOWS.0\system32\audiosrv.dll [42496]
O83 - Search Svchost Services: Browser (Browser) . (.Microsoft Corporation - Computer Browser Service DLL.) -- C:\WINDOWS.0\system32\browser.dll [77824]
O83 - Search Svchost Services: CryptSvc (CryptSvc) . (.Microsoft Corporation - Cryptographic Services.) -- C:\WINDOWS.0\system32\cryptsvc.dll [62464]
O83 - Search Svchost Services: DMServer (DMServer) . (.Microsoft Corp. - DLL Service gestionnaire de disque logique.) -- C:\WINDOWS.0\system32\dmserver.dll [24576]
O83 - Search Svchost Services: DHCP (DHCP) . (.Microsoft Corporation - Service client DHCP.) -- C:\WINDOWS.0\system32\dhcpcsvc.dll [127488]
O83 - Search Svchost Services: ERSvc (ERSvc) . (.Microsoft Corporation - Windows Error Reporting Service.) -- C:\WINDOWS.0\system32\ersvc.dll [23040]
O83 - Search Svchost Services: EventSystem (EventSystem) . (.Microsoft Corporation - No Comment.) -- C:\WINDOWS.0\system32\es.dll [246272]
O83 - Search Svchost Services: FastUserSwitchingCompatibility (FastUserSwitchingCompatibility) . (.Microsoft Corporation - Dll des services Windows Shell.) -- C:\WINDOWS.0\system32\shsvcs.dll [135680]
O83 - Search Svchost Services: HidServ (HidServ) . (.Microsoft Corporation - HID Audio Service.) -- C:\WINDOWS.0\system32\hidserv.dll [21504]
O83 - Search Svchost Services: LanmanServer (LanmanServer) . (.Microsoft Corporation - Server Service DLL.) -- C:\WINDOWS.0\system32\srvsvc.dll [96768]
O83 - Search Svchost Services: LanmanWorkstation (LanmanWorkstation) . (.Microsoft Corporation - Workstation Service DLL.) -- C:\WINDOWS.0\system32\wkssvc.dll [132096]
O83 - Search Svchost Services: Messenger (Messenger) . (.Microsoft Corporation - NT Messenger Service.) -- C:\WINDOWS.0\system32\msgsvc.dll [33792]
O83 - Search Svchost Services: Netman (Netman) . (.Microsoft Corporation - Gestionnaire de connexions réseau.) -- C:\WINDOWS.0\system32\netman.dll [198144]
O83 - Search Svchost Services: Nla (Nla) . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\WINDOWS.0\system32\mswsock.dll [247808] =>.Microsoft Corporation
O83 - Search Svchost Services: Ntmssvc (Ntmssvc) . (.Microsoft Corporation - Gestionnaire de stockage amovible.) -- C:\WINDOWS.0\system32\ntmssvc.dll [438272]
O83 - Search Svchost Services: Rasauto (Rasauto) . (.Microsoft Corporation - Remote Access AutoDial Manager.) -- C:\WINDOWS.0\system32\rasauto.dll [88576]
O83 - Search Svchost Services: Rasman (Rasman) . (.Microsoft Corporation - Remote Access Connection Manager.) -- C:\WINDOWS.0\system32\rasmans.dll [186368]
O83 - Search Svchost Services: Remoteaccess (Remoteaccess) . (.Microsoft Corporation - Dynamic Interface Manager.) -- C:\WINDOWS.0\system32\mprdim.dll [53248]
O83 - Search Svchost Services: Schedule (Schedule) . (.Microsoft Corporation - Moteur du Planificateur de tâches.) -- C:\WINDOWS.0\system32\schedsvc.dll [194560]
O83 - Search Svchost Services: Seclogon (Seclogon) . (.Microsoft Corporation - DLL de service d'ouverture de session secondaire.) -- C:\WINDOWS.0\system32\seclogon.dll [18944]
O83 - Search Svchost Services: SENS (SENS) . (.Microsoft Corporation - System Event Notification Service (SENS).) -- C:\WINDOWS.0\system32\sens.dll [39424]
O83 - Search Svchost Services: Sharedaccess (Sharedaccess) . (.Microsoft Corporation - Composants de l'application d'assistance à Microsoft NAT.) -- C:\WINDOWS.0\system32\ipnathlp.dll [332800]
O83 - Search Svchost Services: SRService (SRService) . (.Microsoft Corporation - Service de restauration du système.) -- C:\WINDOWS.0\system32\srsvc.dll [171520]
O83 - Search Svchost Services: Tapisrv (Tapisrv) . (.Microsoft Corporation - Serveur de téléphonie Microsoft® Windows(TM).) -- C:\WINDOWS.0\system32\tapisrv.dll [249856]
O83 - Search Svchost Services: Themes (Themes) . (.Microsoft Corporation - Dll des services Windows Shell.) -- C:\WINDOWS.0\system32\shsvcs.dll [135680]
O83 - Search Svchost Services: TrkWks (TrkWks) . (.Microsoft Corporation - Distributed Link Tracking Client.) -- C:\WINDOWS.0\system32\trkwks.dll [90112]
O83 - Search Svchost Services: W32Time (W32Time) . (.Microsoft Corporation - Service de temps Windows.) -- C:\WINDOWS.0\system32\w32time.dll [178176]
O83 - Search Svchost Services: WZCSVC (WZCSVC) . (.Microsoft Corporation - Service configuration automatique sans fil.) -- C:\WINDOWS.0\system32\wzcsvc.dll [483840]
O83 - Search Svchost Services: Wmi (Wmi) . (.Microsoft Corporation - API avancées Windows 32.) -- C:\WINDOWS.0\system32\advapi32.dll [685568]
O83 - Search Svchost Services: winmgmt (winmgmt) . (.Microsoft Corporation - WMI.) -- C:\WINDOWS.0\system32\wbem\WMIsvc.dll [145408]
O83 - Search Svchost Services: wscsvc (wscsvc) . (.Microsoft Corporation - Windows Security Center Service.) -- C:\WINDOWS.0\system32\wscsvc.dll [80896]
O83 - Search Svchost Services: xmlprov (xmlprov) . (.Microsoft Corporation - Network Provisioning Service.) -- C:\WINDOWS.0\system32\xmlprov.dll [129024]
O83 - Search Svchost Services: napagent (napagent) . (.Microsoft Corporation - Exécution du service Agent de quarantaine.) -- C:\WINDOWS.0\system32\qagentrt.dll [293376]
O83 - Search Svchost Services: hkmsvc (hkmsvc) . (.Microsoft Corporation - Service Gestion des clés.) -- C:\WINDOWS.0\system32\kmsvc.dll [61440]
O83 - Search Svchost Services: BITS (BITS) . (.Microsoft Corporation - Service de transfert intelligent en arrière-plan.) -- C:\WINDOWS.0\system32\qmgr.dll [409088]
O83 - Search Svchost Services: wuauserv (wuauserv) . (.Microsoft Corporation - Windows Update AutoUpdate Service.) -- C:\WINDOWS.0\system32\wuauserv.dll [6656]
O83 - Search Svchost Services: ShellHWDetection (ShellHWDetection) . (.Microsoft Corporation - Dll des services Windows Shell.) -- C:\WINDOWS.0\system32\shsvcs.dll [135680]
O83 - Search Svchost Services: helpsvc (helpsvc) . (.Microsoft Corporation - Microsoft PCHealth Service Holder.) -- C:\WINDOWS.0\PCHealth\HelpCtr\Binaries\pchsvc.dll [38400]
O83 - Search Svchost Services: WmdmPmSN (WmdmPmSN) . (.Microsoft Corporation - Microsoft Media Device Service Provider.) -- C:\WINDOWS.0\system32\MsPMSNSv.dll [52224]
~ Services: 40 Scanned in 00mn 00s



---\\ Search Particular Root Folder (SPRF) (O84)
[MD5.E326E4E6368D5632B262ABA899F0ACAC] [SPRF][19-03-2015] (...) -- C:\Documents and Settings\ali\Application Data\appdataFr3.bin [20]
[MD5.D41B0BF7FB0F4EFBC221FFD446C6081A] [SPRF][28-10-2009] (...) -- C:\Documents and Settings\ali\Bureau\fnt.exe [3249934]
[MD5.50C2E62660C7C1D26C60D320CC61F8A6] [SPRF][29-11-2013] (.Tonec Inc. - Download with IDM IE menu handler.) -- C:\Program Files\downlWithIDM.dll [97816]
[MD5.B06190AF451B2037FF075AEB5D21E26F] [SPRF][29-11-2013] (.Tonec Inc. - Download with IDM IE menu handler.) -- C:\Program Files\downlWithIDM64.dll [150552]
[MD5.02106A846C69468DB29F2137203857E0] [SPRF][25-11-2013] (...) -- C:\Program Files\IDM.v6.xx.release.3-patch.exe [637440]
[MD5.2A1BFA17B6C5F60F6150A9FA4EDB312F] [SPRF][05-02-2014] (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\IDMan.exe [3825232]
[MD5.DEA89988CCD91C60692FA3DE14F53CAE] [SPRF][06-12-2014] (.Tonec Inc. - Internet Download Manager Button.) -- C:\Program Files\idmbrbtn.dll [86352]
[MD5.C103E0BBE07F2582A9F8142C5A3D6A87] [SPRF][06-12-2014] (.Tonec Inc. - Internet Download Manager Button.) -- C:\Program Files\idmbrbtn64.dll [98736]
[MD5.566F5A07C950D52ECB5CEBDAE39DDEC0] [SPRF][08-08-2014] (.Internet Download Manager, Tonec Inc. - Broker for reading of IDM settings.) -- C:\Program Files\idmBroker.exe [69144]
[MD5.DDA1CAA32C71CCD51384844319B0C4D4] [SPRF][20-03-2015] (.Tonec Inc. - Internet Download Manager click catcher for browsers.) -- C:\Program Files\idmcchandler2.dll [326168]
[MD5.1C4A26E53CFE2178505682574ECEFF40] [SPRF][20-03-2015] (.Tonec Inc. - Internet Download Manager click catcher for browsers.) -- C:\Program Files\idmcchandler2_64.dll [452632]
[MD5.8733245B8D7A0038F46F65F945584E6F] [SPRF][17-06-2014] (.Tonec Inc. - Internet Download Manager assistant.) -- C:\Program Files\idmfsa.dll [85528]
[MD5.5B4B1C3DAC327832C49985D497EBAEB3] [SPRF][21-03-2013] (...) -- C:\Program Files\IDMFType.dat [184167]
[MD5.48DB4BFCE6F3476DFA6602546F5FB5D4] [SPRF][21-03-2013] (.Tonec Inc. - Internet Download Manager module.) -- C:\Program Files\idmftype.dll [43976]
[MD5.C976CEB4BE1DAF3A848C11A4ADF224BA] [SPRF][21-03-2013] (.Tonec Inc. - Internet Download Manager module.) -- C:\Program Files\IDMFType64.dll [52240]
[MD5.8C6AF35602856595601F3CFFC70317D8] [SPRF][29-11-2013] (.Tonec Inc. - Internet Download Manager Module.) -- C:\Program Files\IDMGetAll.dll [56856]
[MD5.AC822BE8FFB08E7EA2AD573B9F87EA71] [SPRF][29-11-2013] (.Tonec Inc. - Internet Download Manager Module.) -- C:\Program Files\IDMGetAll64.dll [90648]
[MD5.12F5582EEEF2464F90F37D288FE8A159] [SPRF][07-11-2013] (.Tonec Inc. - Internet Download Manager module.) -- C:\Program Files\IDMGrHlp.exe [513048]
[MD5.8E8E7F67729B250E242BD217E0541F5C] [SPRF][05-12-2014] (.Internet Download Manager, Tonec Inc. - IDM Browser Helper Object.) -- C:\Program Files\IDMIECC.dll [418328]
[MD5.5DC864C02B410EFF2934230101EE2EC8] [SPRF][05-12-2014] (.Internet Download Manager, Tonec Inc. - IDM Browser Helper Object.) -- C:\Program Files\IDMIECC64.dll [477720]
[MD5.CE284454C16CD202961BD4A7F1FF105D] [SPRF][08-10-2013] (.Tonec Inc. - Internet Download Manager module.) -- C:\Program Files\idmindex.dll [397336]
[MD5.DC5B6F395F4C9C52A568CE395609579E] [SPRF][25-08-2014] (.Internet Download Manager, Tonec Inc. - IDM Integration module.) -- C:\Program Files\IDMIntegrator64.exe [67608]
[MD5.3B2574A4BCAAB325288DB198E4B9CAE6] [SPRF][15-05-2014] (.Tonec Inc. - Internet Download Manager module.) -- C:\Program Files\idmmkb.dll [36440]
[MD5.A4DFD052A0B21DDEE2B0D861DCFDE470] [SPRF][29-11-2014] (.Tonec Inc. - Internet Download Manager module.) -- C:\Program Files\IDMNetMon.dll [189888]
[MD5.686A76B1445D07CE408B66D2468C02C3] [SPRF][29-11-2014] (.Tonec Inc. - Internet Download Manager module.) -- C:\Program Files\IDMNetMon64.dll [253224]
[MD5.019AB25686601F42444208FEFC86BC59] [SPRF][21-04-2014] (.Tonec Inc. - Internet Download Manager module.) -- C:\Program Files\IDMShellExt.dll [23008]
[MD5.22ECE0BC222B54CA73AE37D7A65EA93F] [SPRF][21-04-2014] (.Tonec Inc. - Internet Download Manager module.) -- C:\Program Files\IDMShellExt64.dll [25112]
[MD5.E27AF2DB1ECC042F1E3DBD8774E44819] [SPRF][29-11-2014] (.Tonec Inc. - Internet Download Manager TDI Driver.) -- C:\Program Files\idmtdi32.sys [123360]
[MD5.C1223D7CD849EA35C7CD27DC6220949B] [SPRF][29-11-2014] (.Tonec Inc. - Internet Download Manager TDI Driver.) -- C:\Program Files\idmtdi64.sys [201736]
[MD5.599327266BC2F7D2D6553912CC3528A1] [SPRF][07-11-2014] (.Internet Download Manager, Tonec Inc. - IDM Module.) -- C:\Program Files\idmvconv.dll [528408]
[MD5.B4EFEEFBAC0F0C633146534FEF393DDF] [SPRF][15-10-2014] (.Tonec Inc. - Internet Download Manager version module.) -- C:\Program Files\idmvs.dll [32280]
[MD5.4A77CBD9D0B1CA9C810F946DCC0771C4] [SPRF][29-11-2014] (.Tonec Inc. - Internet Download Manager WFP Driver.) -- C:\Program Files\idmwfp32.sys [115752]
[MD5.3F2013A2880FE503B1B3BC8212764923] [SPRF][29-11-2014] (.Tonec Inc. - Internet Download Manager WFP Driver.) -- C:\Program Files\idmwfp64.sys [180648]
[MD5.BD95E822E7A958BBCA842D078426A151] [SPRF][07-11-2013] (.Tonec Inc. - Internet Download Manager agent for click monitoring in IE-based browsers.) -- C:\Program Files\IEMonitor.exe [269848]
[MD5.50542C90567698CB0C0C02F71EEBEA60] [SPRF][07-11-2013] (.Internet Download Manager, Tonec Inc. - IDM module.) -- C:\Program Files\MediumILStart.exe [16920]
[MD5.7D781067EA86D7DE12B9744EDB39460B] [SPRF][24-04-2012] (...) -- C:\Program Files\Patch IDM 6.xx.exe [589824]
[MD5.95DC303033DC07FE499F50E5FB4DC167] [SPRF][25-08-2014] (.Tonec Inc. - Internet Download Manager installer.) -- C:\Program Files\Uninstall.exe [179736]
~ Files: 37 Scanned in 00mn 00s



---\\ Random Export Key (REK) (O91)
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:060df2cd="c/Au/XV/H/Ap/X2/GP/j/Xt/axAv/X6////%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:0c230bcb="///%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:0dc3ee96="/P////%%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:0e93c3f3="///%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:1520c6f1="V/////%%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:1c311243="GlAk/X6/G/Ap/YV/UxAk/YZ/Gl////%%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:27ddcf6f="///%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:2d71d5ab="V/////%%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:2e22d94e="///%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:340d3099="/P////%%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:37b7a6d8="UlAr/XJ/c//k////"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:38583bc3="Ml/2/CF/M//g/CZ////%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:3c09c42b="///%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:414bc593="///%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:48bd1aff="V/////%%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:51d2f2ea="J/Af/X6/a/Ak/X2/GlAu/YZ////%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:587b5709="V/////%%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:6185d035="Vx/2/Cx/V//l////"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:65114b36="Vl/l////"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:72758a5d="///%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:7367429f="///%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:7f69fa1f="///%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:8b9e4cbc="V/////%%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:a0743acc="N/////%%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:a1dcff5b="V/////%%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:a2e3b941="///%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:bbf88800="///%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:c24899a6="VP/g/CV/Vl/2/Cx////%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:c5705860="Vx////%%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:c6c5dd44="V/////%%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:c99a5f5c="///%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:d1abcdb6="///%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:d94388d2="GlAk/X6/G/Ap/YV/UxAk/YZ/Gl////%%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:e46c271e="///%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:e8f9dcc7="UlAr/XJ/c//k////"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:f0bf0bde="///%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:f1f24e29="Vl/l/C/////%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:f2c53c49="UlAr/XJ/c//k////"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:f6ad6fa6="V/////%%"
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc\10035749238599175\eae10f9d]:fe94ce1e="V/////%%"
~ Export Key Software: Scanned in 00mn 00s



---\\ MyComputer Name Space (MNS) (O92)
O92 - MNS: Web Folders - {BDEADF00-C265-11D0-BCED-00A0C90AB50F}
~ MNS: 1 Scanned in 00mn 00s



---\\ General States of Services not Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 07-03-2015 267440 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\WINDOWS.0\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Auto 22-07-1658 0 | (BstHdAndroidSvc) . (...) - C:\Program Files\BlueStacks\HD-Service.exe
SS - | Auto 22-07-1658 0 | (BstHdLogRotatorSvc) . (...) - C:\Program Files\BlueStacks\HD-LogRotatorService.exe
SS - | Auto 22-07-1658 0 | (BstHdUpdaterSvc) . (...) - C:\Program Files\BlueStacks\HD-UpdaterService.exe
SS - | Demand 14-04-2008 225280 | (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS.0\system32\dmadmin.exe
SS - | Auto 18-12-2014 107912 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 18-12-2014 107912 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 09-12-2014 114800 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Auto 22-07-1658 0 | (SkypeUpdate) . (...) - C:\Program Files\Skype\Updater\Updater.exe
SR - | Auto 04-03-2015 1561088 | (21a6d46d) . (...) - c:\Program Files\SegmentEnhancer\SegmentEnhancer.dll
SR - | Auto 23-12-2013 643072 | (Ati HotKey Poller) . (.ATI Technologies Inc..) - C:\WINDOWS.0\system32\Ati2evxx.exe
SR - | Auto 03-12-2012 2571704 | (CodeMeter.exe) . (.WIBU-SYSTEMS AG.) - C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe
SR - | Auto 06-02-2015 53400 | (GenieCleanService) . (.Oppoos.com.) - C:\Program Files\Genie Soft\Genie Cleaner\GenieCleanService.exe
SR - | Auto 03-02-2015 127168 | (MobogenieService) . (.Mobogenie.com.) - C:\Program Files\Mobogenie3\MobogenieService.exe =>PUP.Mobogenie
SR - | Auto 13-10-2014 743688 | (ss_conn_service) . (.DEVGURU Co., LTD..) - C:\Program Files\SAMSUNG\USB Drivers\25_escape\conn\ss_conn_service.exe
~ Services: Scanned in 00mn 12s



---\\ Search Master Boot Record Infection (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by ali at 20-03-2015 4:37:51
device: opened successfully
user: MBR read successfully
Disk trace:
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys viaide.sys
1 nt!IofCallDriver[0x804E1397] >> \Device\Harddisk0\DR0[0x89C1DAB8]
3 CLASSPNP[0xF74C7FD7] >> nt!IofCallDriver[0x804E1397] >> \Device\00000070[0x89C1E9E8]
5 ACPI[0xF743D620] >> nt!IofCallDriver[0x804E1397] >> \Device\Ide\IdeDeviceP2T0L0-8[0x89BA9940]
kernel: MBR read successfully
user & kernel MBR OK
~ MBR: 13 Scanned in 00mn 02s



---\\ Search Master Boot Record Infection (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by ali at 20-03-2015 4:37:53
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 04s



---\\ Scan Additionnel (O88)
Database Version : 13008 - (19-03-2015)
Clés trouvées (Keys found) : 9
Valeurs trouvées (Values found) : 1
Dossiers trouvés (Folders found) : 15
Fichiers trouvés (Files found) : 10

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1D323CF5-AF3B-4C93-BA7E-B5356B98749A}] =>PUP.TakeTheCoupon^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF73607B-7088-477C-8D17-6622F63C85D2}] =>PUP.DealExpress^
[HKLM\SYSTEM\CurrentControlSet\Services\MobogenieService] =>PUP.Mobogenie^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{25F259ED-12F6-429F-5783-527C3E2F8586}] =>PUP.DealExpress^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{9D9BEFAE-9499-F52B-6CC4-94818CCC2AB5}] =>PUP.Fun2Save^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Mobogenie3] =>PUP.Mobogenie^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{21a6d46d}] =>Adware.Graftor^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{53B21E29-3967-C332-57EB-C02631658584}] =>PUP.TakeTheCoupon^
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent] =>P2P.BitTorrent^
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:uTorrent =>P2P.BitTorrent^
C:\Documents and Settings\ali\Application Data\Mozilla\Firefox\Profiles\yuj1hr66.default-1421946452526\extensions\31@k.com =>PUP.UniDeals^
C:\Documents and Settings\ali\Application Data\Mozilla\Firefox\Profiles\yuj1hr66.default-1421946452526\extensions\E5@Lj.com =>PUP.Fun2Save^
C:\Program Files\DeAlExpresis =>PUP.DealExpress^
C:\Program Files\Feun2Save =>PUP.Fun2Save^
C:\Program Files\MiniLyrics =>Adware.AddLyrics^
C:\Program Files\Mobogenie3 =>PUP.Mobogenie^
C:\Program Files\TTaKeTheCoaupon =>PUP.TakeTheCoupon^
C:\Program Files\UniDeals =>PUP.UniDeals^
C:\Program Files\UniDeAlsse =>PUP.UniDeals^
C:\Documents and Settings\All Users.WINDOWS.0\Menu Démarrer\Programmes\Mobogenie3 =>PUP.Mobogenie^
C:\Documents and Settings\ali\Application Data\MiniLyrics =>Adware.AddLyrics^
C:\Documents and Settings\ali\Application Data\Mobogenie =>PUP.Mobogenie^
C:\Documents and Settings\ali\Application Data\OpenCandy =>Adware.OpenCandy^
C:\Documents and Settings\ali\Application Data\RHEng =>PUP.Conduit^
C:\Documents and Settings\ali\Application Data\uTorrent =>P2P.µTorrent^
C:\Program Files\Mobogenie3\MobogenieService.exe =>PUP.Mobogenie^
C:\Program Files\Mobogenie3\MoboGenieHelper.exe =>PUP.Mobogenie^
[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}] =>Adware.Graftor^
[HKCU\Software\BitTorrent] =>P2P.BitTorrent^
[HKCU\Software\Linkey] =>PUP.LinkeySearch^
[HKCU\Software\MiniLyrics] =>Adware.AddLyrics^
[HKCU\Software\Mobogenie3] =>PUP.Mobogenie^
[HKCU\Software\Mobogenie] =>PUP.Mobogenie^
[HKLM\Software\SmdmF] =>PUP.SystemK^
[HKLM\Software\f3e445e5-a2c3-b1bf-6f04-68601e53ebdc] =>PUP.CrossRider^
~ Additionnel Scan: 137099 Items scanned in 00mn 17s



---\\ Additional information about modules
~ http://nicolascoolman.fr/r5-internet-explorer-proxy-management-iepm/ =>.Internet Explorer, Proxy Management (R5)
~ http://nicolascoolman.fr/o2-browser-helper-objects-de-navigateur/ =>.Browser Helper Objects (O2)
~ http://nicolascoolman.fr/o3-internet-explorer-toolbars/ =>.Internet Explorer toolbars (O3)
~ http://nicolascoolman.fr/o4-applications-demarrees-par-le-registre/ =>.Auto loading programs from Registry and folders (O4)
~ http://nicolascoolman.fr/o50-image-file-execution-options-zhpdiag/ =>.Image File Execution Options (IFEO) (O50)
~ http://nicolascoolman.fr/o51-mountpoints2-shell-key-mpsk/ =>.MountPoints2 Shell Key (MPSK) (O51)
~ AMI: 6 Scanned in 00mn 00s



---\\ Summary of the detections found on your workstation
http://nicolascoolman.fr/pup-mobogenie =>PUP.Mobogenie
http://nicolascoolman.fr/hijacker-browsers =>Hijacker.Browsers
http://www.nicolascoolman.fr/blog/ =>PUP.UniDeals
http://www.nicolascoolman.fr/blog/ =>PUP.Fun2Save
http://www.nicolascoolman.fr/blog/ =>PUP.TakeTheCoupon
http://www.nicolascoolman.fr/blog/ =>PUP.DealExpress
http://nicolascoolman.fr/pup-systemk =>PUP.SystemK
http://www.nicolascoolman.fr/blog/ =>Adware.Graftor
http://nicolascoolman.fr/pup-linkeysearch =>PUP.LinkeySearch
http://nicolascoolman.fr/adware-addlyrics =>Adware.AddLyrics
http://nicolascoolman.fr/pup-crossrider =>PUP.CrossRider
http://nicolascoolman.fr/adware-opencandy =>Adware.OpenCandy
http://www.nicolascoolman.fr/blog/ =>PUP.Conduit
~ MSI: 13 link(s) detected in 00mn 00s



End of the scan (1352 lines in 01mn 29s)(2.4)

Publicité


Signaler le contenu de ce document

Publicité