cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

~ Rapport de ZHPDiag v2015.4.1.34 - Nicolas Coolman (29/03/2015)
~ Lancé par Namane (03/04/2015 01:47:13)
~ Facebook : https://www.facebook.com/nicolascoolman1
~ Adresse du Forum http://forum.nicolascoolman.fr
~ Traduit par Nicolas Coolman
~ Etat de la version : Version à jour.
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user


---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.16384
MFIE: Mozilla Firefox 37.0 (Defaut)
GCIE: Google Chrome v41.0.2272.101
OBIE: Safari v5.34.57.2

---\\ Informations sur les produits Windows
~ Langage: Français
Windows Server License Manager Script : OK
~ Windows(R) Operating System, VOLUME_KMSCLIENT channel
Windows ID Activation : OK
~ Windows Partial Key : MKKG7
Windows License : OK
Expiration Licence Windows : 241572 minute(s) (168 jour(s))
~ Windows Remaining Initializations Number : 1000
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
Windows 8.1 Enterprise, 64-bit (Build 9600)

---\\ Logiciels de protection du système
Kaspersky Total Security v15.0.1.415
Windows Defender W8 (Deactivate)

---\\ Logiciels d'optimisation du système
CCleaner v5.03

---\\ Logiciels de partage PeerToPeer

---\\ Surveillance de Logiciels
Adobe Flash Player 17 NPAPI

---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 4002 MB (27% free)
System Restore: Activé (Enable)
System drive C: has 113 GB (64%) free of 176 GB

---\\ Mode de connexion au système
~ Computer Name: HAMID
~ User Name: Namane
~ All Users Names: Namane, Administrateur,
~ Unselected Option: O45,O61
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Namane\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Namane\AppData\Roaming\
~ %Desktop% : C:\Users\Namane\Desktop\
~ %Favorites% : C:\Users\Namane\Favorites\
~ %LocalAppData% : C:\Users\Namane\AppData\Local\
~ %StartMenu% : C:\Users\Namane\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 113 Go of 176 Go)
E: Hard drive, Flash drive, Thumb drive (Free 291 Go of 523 Go)
F: CD-ROM drive (Not Inserted)
G: Floppy drive, Flash card reader, USB Key (Not Inserted)



---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 45 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.8479DC46E9A09015C0777A16BC22A15D] - (.Microsoft Corporation - Explorateur Windows.) (.22/08/2013 - 13:39:51.) -- C:\Windows\Explorer.exe [2328880]
[MD5.48CFA7BE561A7BE144C29BB912055016] - (.Microsoft Corporation - Application de démarrage de Windows.) (.22/08/2013 - 10:58:29.) -- C:\Windows\System32\Wininit.exe [144384]
[MD5.CE76481B886D891F1ECF11939DF16938] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.22/08/2013 - 10:29:03.) -- C:\Windows\System32\wininet.dll [2328064]
[MD5.7C94FDA3809015B8F2208D2E1C221F17] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.22/08/2013 - 10:55:08.) -- C:\Windows\System32\Winlogon.exe [564736]
[MD5.2F18065618E39AA2E656EE737B71E791] - (.Microsoft Corporation - Bibliothèque de licences.) (.22/08/2013 - 11:39:40.) -- C:\Windows\System32\sppcomapi.dll [447488]
[MD5.239268BAB58EAE9A3FF4E08334C00451] - (.Microsoft Corporation - Pilote de fonction connexe pour WinSock.) (.22/08/2013 - 14:25:35.) -- C:\Windows\system32\Drivers\AFD.sys [567296]
[MD5.74B14192CF79A72F7536B27CB8814FBD] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.22/08/2013 - 13:43:41.) -- C:\Windows\system32\Drivers\atapi.sys [26464]
[MD5.2FA6510E33F7DEFEC03658B74101A9B9] - (.Microsoft Corporation - CD-ROM File System Driver.) (.22/08/2013 - 12:40:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [88576]
[MD5.C6796EA22B513E3457514D92DCDB1A3D] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.22/08/2013 - 09:46:35.) -- C:\Windows\system32\Drivers\Cdrom.sys [164352]
[MD5.5DB26D7E0216D0BF364A81D3829AD7B9] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.22/08/2013 - 12:38:00.) -- C:\Windows\system32\Drivers\DfsC.sys [134656]
[MD5.03909BDBFF0DCACCABF2B2D4ADEE44DC] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.22/08/2013 - 12:38:38.) -- C:\Windows\system32\Drivers\HDAudBus.sys [78336]
[MD5.84CFC5EFA97D0C965EDE1D56F116A541] - (.Microsoft Corporation - Pilote de port i8042.) (.22/08/2013 - 12:39:15.) -- C:\Windows\system32\Drivers\i8042prt.sys [107520]
[MD5.0063040EFD7C5B81D67CF985BA35388A] - (.Microsoft Corporation - IP Network Address Translator.) (.22/08/2013 - 12:35:33.) -- C:\Windows\system32\Drivers\IpNat.sys [141824]
[MD5.405A2E5754DF76663CF0522B87D7929F] - (.Microsoft Corporation - Minirdr SMB Windows NT.) (.22/08/2013 - 12:36:11.) -- C:\Windows\system32\Drivers\MRxSmb.sys [402432]
[MD5.0217532E19A748F0E5D569307363D5FD] - (.Microsoft Corporation - MBT Transport driver.) (.22/08/2013 - 12:37:02.) -- C:\Windows\system32\Drivers\netBT.sys [282624]
[MD5.4412D565C0278C401575E11072C7DCE3] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.22/08/2013 - 14:25:41.) -- C:\Windows\system32\Drivers\ntfs.sys [2011488]
[MD5.764B1121867B2D9B31C491668AC72B2B] - (.Microsoft Corporation - Pilote de port parallèle.) (.22/08/2013 - 12:40:02.) -- C:\Windows\system32\Drivers\Parport.sys [94208]
[MD5.BBB6272B7F46C4640A8CDB8A70C3450F] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.22/08/2013 - 12:35:51.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [120832]
[MD5.680C1DAE268B6FB67FA21B389A8B79EF] - (.Microsoft Corporation - Redirecteur de périphérique de Microsoft RDP.) (.22/08/2013 - 23:33:08.) -- C:\Windows\system32\Drivers\rdpdr.sys [195584]
[MD5.FFF28F9F6823EB1756C60F1649560BBF] - (.Microsoft Corporation - TDI Translation Driver.) (.22/08/2013 - 14:25:35.) -- C:\Windows\system32\Drivers\tdx.sys [107520]
[MD5.9F9CE33B50611A1C61A46B8911E0B30B] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.22/08/2013 - 13:39:15.) -- C:\Windows\system32\Drivers\volsnap.sys [312160]
~ Generic Processes: Scanned in 00mn 01s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes musiques (My Musics) : 1/2
~ Mes Favoris (My Favorites) : 1/3
~ Mes Documents (My Documents) : 1/110
~ Mon Bureau (My Desktop) : 1/508
~ Menu demarrer (Programs) : 1/30
~ Hidden Files: Scanned in 00mn 01s



---\\ Processus lancés
[MD5.3D2496BCA132B08D9B23856D65F30513] - (.Kaspersky Lab ZAO - Kaspersky Anti-Virus.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.1\avpui.exe [193128] [PID.3652]
[MD5.70903CD03F9B0A23826C4F9A35185EE6] - (...) -- C:\ProgramData\ZDSupport\ZDServ\CancelAutoPlay_Server.exe [426752] [PID.1824]
[MD5.059E588FDF6B7E83227D45D026D21874] - (.NVIDIA Corporation - NVIDIA Backend.) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2585744] [PID.4392]
[MD5.A766FD42679CB8FB805E4E9263A55F2E] - (...) -- C:\Program Files (x86)\Between Lines\bin\BetweenLines.BrowserAdapter.exe [105720] [PID.4704] =>PUP.BetweenLines
[MD5.76D8997887476AA83D72BC23AF6A326F] - (...) -- C:\Program Files (x86)\Between Lines\bin\BetweenLines.BOASHelper.exe [1649912] [PID.4728] =>PUP.BetweenLines
[MD5.E31C4721F78ED0AEAE32745809E7512C] - (...) -- C:\Program Files (x86)\Between Lines\bin\BetweenLines.expext.exe [101624] [PID.4744] =>PUP.BetweenLines
[MD5.F217EF2EA31D8F73504B1CD2F9787D9D] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [809288] [PID.4980]
[MD5.F9517D8523BD59C95D015053DBFA5168] - (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files (x86)\Internet Download Manager\IDMan.exe [3890768] [PID.448]
[MD5.E9C6EF9437ECB30911488F9313AD821A] - (.Tonec Inc. - Internet Download Manager agent for click m.) -- C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe [269848] [PID.4968]
[MD5.8CE041874A9F60979CD0C3C455DBB1D7] - (.Pas de propriétaire - BetweenLines.BOASPRT.exe.) -- C:\Program Files (x86)\Between Lines\bin\BetweenLines.BOASPRT.exe [1786616] [PID.1704] =>PUP.BetweenLines
[MD5.5B0A864D737CBC365DB1BE1A67418027] - (.Pas de propriétaire - BetweenLines.BOAS.exe.) -- C:\Program Files (x86)\Between Lines\bin\BetweenLines.BOAS.exe [1791224] [PID.4772] =>PUP.BetweenLines
[MD5.338B3A65F24FD9728C289A626246A0E0] - (.Kaspersky Lab ZAO - Kaspersky Native Messaging Server for plugi.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.1\plugin-nm-server.exe [827688] [PID.5388]
[MD5.BE1DAE43DFBCA94FB6B4157C1B16923E] - (...) -- ysWOW64\RunDll32.exe [0] [PID.2124]
[MD5.7175C3425FC9AB6ABAEAF56863303DD7] - (.Microsoft Corporation - Lecteur Windows Media.) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe [164864] [PID.2872]
[MD5.6076B562F7848DED4CDB128B485B6132] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8195072] [PID.5376]
[MD5.49B1E5AF3AA400752A20BE169CB73DFA] - (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [410952] [PID.996]
[MD5.3817558D8D5BBC8B0F190CF0D7C4720F] - (.Autodesk, Inc. - Content Service.) -- C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [12288] [PID.1664]
[MD5.AB1AF0BA03DCB6A879BC22F472EACEEA] - (.Kaspersky Lab ZAO - Kaspersky Anti-Virus.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.1\avp.exe [234520] [PID.1760]
[MD5.93C82F365F9C0A2058A211E305A5CCFA] - (.NVIDIA Corporation - NVIDIA Network Service.) -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1706128] [PID.1972]
[MD5.ACD3A48975FB4DF760AA76AE4916DDB9] - (...) -- C:\Program Files (x86)\Between Lines\bin\utilBetweenLines.exe [412920] [PID.2068] =>PUP.BetweenLines
[MD5.177BA0F6744354379D79F66CD7AE33EE] - (.Pas de propriétaire - ZDServ Application.) -- C:\ProgramData\ZDSupport\ZDServ\ZDServ.exe [427264] [PID.2172]
[MD5.83FF82FE209E7997067B375DAD6CF23D] - (.Intel Corporation - Intel(R) Integrated Clock Controller Servic.) -- C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [169752] [PID.5104]
[MD5.DBA3BC9C377A867350099D693E8A3413] - (.Intel Corporation - Intel(R) Local Management Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [409376] [PID.4668]
[MD5.ACD3A48975FB4DF760AA76AE4916DDB9] - (...) -- C:\Program Files (x86)\Between Lines\updateBetweenLines.exe [412920] [PID.5252] =>PUP.BetweenLines
~ Processes Running: Scanned in 00mn 02s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Namane\AppData\Local\Google\Chrome\User Data\Default\Preferences

---\\ Liste des dossiers d'extension Google Chrome
~ Google Lines Browser: 13 Legitimates Filtered in 00mn 03s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
M2 - MFEP: prefs.js [Namane - 7hbgs0sb.default\{3d7eb24f-2740-49df-8937-200b1cc08f8a}] [] Flashblock v1.5.18 (..)
M2 - MFEP: Extension [Namane - 7hbgs0sb.default] {06146dd6-a059-4c4d-9840-35b694aad4ae}.xpi
M2 - MFEP: Extension [Namane - 7hbgs0sb.default] {fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi
~ Firefox Browser: 6 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (21)
~ Hosts File: Scanned in 00mn 00s



---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: Between Lines 1.0.0.7 [64Bits] - {ed66005b-3c60-469c-a11b-211b53e83d9e} . (.Between Lines - Between Lines.) -- C:\Program Files (x86)\Between Lines\BetweenLinesbho.dll =>PUP.BetweenLines
~ BHO: 12 Legitimates Filtered in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: MOBICONNECT.lnk . (...) -- C:\Program Files (x86)\Hostless Modem\MOBICONNECT\LaunchWebUI.exe
~ Global Startup: 1 Legitimates Filtered in 00mn 04s



---\\ Applications lancées au démarrage du système (O4)
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [NvBackend] . (.NVIDIA Corporation - NVIDIA Backend.) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
O4 - HKLM\..\Run: [ShadowPlay] . (.NVIDIA Corporation - NVIDIA Capture Server Proxy.) -- C:\WINDOWS\system32\nvspcap64.dll
O4 - HKCU\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files (x86)\Internet Download Manager\IDMan.exe
O4 - HKCU\..\Run: [Autodesk Sync] . (.Autodesk, Inc. - Autodesk 360.) -- C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe
O4 - HKCU\..\Run: [CCleaner Monitoring] . (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner64.exe =>.Piriform Ltd
O4 - HKUS\.DEFAULT\..\Run: [Autodesk Sync] . (.Autodesk, Inc. - Autodesk 360.) -- C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe
O4 - HKUS\S-1-5-18\..\Run: [Autodesk Sync] . (.Autodesk, Inc. - Autodesk 360.) -- C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe
O4 - HKUS\S-1-5-21-249966982-2475279780-2191922987-1001\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files (x86)\Internet Download Manager\IDMan.exe
O4 - HKUS\S-1-5-21-249966982-2475279780-2191922987-1001\..\Run: [Autodesk Sync] . (.Autodesk, Inc. - Autodesk 360.) -- C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe
O4 - HKUS\S-1-5-21-249966982-2475279780-2191922987-1001\..\Run: [CCleaner Monitoring] . (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner64.exe =>.Piriform Ltd
~ Application: Scanned in 00mn 00s



---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Clavier virtuel [64Bits] - {09A10376-994C-4BBF-9121-F50CF7BA237E} . (...) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.1\kbrd.ico
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Site dans la Zone de confiance d'Internet Explorer (O15)
O15 - Trusted Zone: [HKCU\...\Domains] http.ma-config.com
O15 - Trusted Zone: [HKCU\...\Domains] http.touslesdrivers.com
~ IE Zone Confiance: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C8390EA-A972-4A99-9814-D2EA4E0E7D42}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{A15FC99C-7C96-4B43-9FC5-70207573D10A}: DhcpNameServer = 192.168.0.1 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{EE285C6F-D37B-4491-8DDC-9189A963EAC4}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C8390EA-A972-4A99-9814-D2EA4E0E7D42}: DhcpDomain = domain.name
O17 - HKLM\System\CCS\Services\Tcpip\..\{EE285C6F-D37B-4491-8DDC-9189A963EAC4}: DhcpDomain = domain.name
O17 - HKLM\System\CS1\Services\Tcpip\..\{1C8390EA-A972-4A99-9814-D2EA4E0E7D42}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{A15FC99C-7C96-4B43-9FC5-70207573D10A}: DhcpNameServer = 192.168.0.1 192.168.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{EE285C6F-D37B-4491-8DDC-9189A963EAC4}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{1C8390EA-A972-4A99-9814-D2EA4E0E7D42}: DhcpDomain = domain.name
O17 - HKLM\System\CS1\Services\Tcpip\..\{EE285C6F-D37B-4491-8DDC-9189A963EAC4}: DhcpDomain = domain.name
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation
O18 - Filter: text/xml [64Bits] - {807583E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - AppInit_DLLs: . (.NVIDIA Corporation - NVIDIA shim initialization dll, Version 347.) - C:\WINDOWS\system32\nvinitx.dll
~ AppInit DLL: Scanned in 00mn 00s



---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Update Between Lines (Update Between Lines) . (...) - C:\Program Files (x86)\Between Lines\updateBetweenLines.exe =>PUP.BetweenLines
O23 - Service: Util Between Lines (Util Between Lines) . (...) - C:\Program Files (x86)\Between Lines\bin\utilBetweenLines.exe =>PUP.BetweenLines
O23 - Service: ZDServ (ZDServ) . (.Pas de propriétaire - ZDServ Application.) - C:\ProgramData\ZDSupport\ZDServ\ZDServ.exe
~ Services: 15 Legitimates Filtered in 00mn 20s



---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [LaunchApp] (...) -- C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (.not file.) [0] =>PUP.MyPCBackup
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore [1084]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA [1088]
~ Scheduled Task: 7 Legitimates Filtered in 00mn 13s



---\\ Pilotes lancés au démarrage du système (O41)
O41 - Driver: ({06146dd6-a059-4c4d-9840-35b694aad4ae}Gw64) . (.StdLib - StdLib.) - C:\Windows\System32\drivers\{06146dd6-a059-4c4d-9840-35b694aad4ae}Gw64.sys =>PUP.LinkiDoo
O41 - Driver: ({13e8d46d-09b8-4fd6-b75a-25c04a0db747}Gw64) . (.StdLib - StdLib.) - C:\Windows\System32\drivers\{13e8d46d-09b8-4fd6-b75a-25c04a0db747}Gw64.sys =>PUP.LinkiDoo
~ Drivers: 54 Legitimates Filtered in 00mn 01s



---\\ Logiciels installés (O42)
O42 - Logiciel: Between Lines - (.Between Lines.) [HKLM][64Bits] -- Between Lines
O42 - Logiciel: Buzzdock - (.Alactro LLC.) [HKLM][64Bits] -- {ac225167-00fc-452d-94c5-bb93600e7d9a} =>PUP.BuzzDock
~ Logic: 23 Legitimates Filtered in 00mn 02s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\Between Lines]
[HKCU\Software\Clubic]
[HKCU\Software\ProductSetup] =>Adware.InstallCore
[HKLM\Software\Wow6432Node\Between Lines]
[HKLM\Software\Wow6432Node\Computers and Structures, Inc.]
~ Key Software: 205 Legitimates Filtered in 00mn 02s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 03/04/2015 - 01:23:44 - [] ----D C:\Program Files (x86)\Between Lines
O43 - CFD: 28/03/2015 - 00:33:58 - [] ----D C:\Program Files (x86)\Computers and Structures
O43 - CFD: 25/03/2015 - 23:22:07 - [] ----D C:\Program Files (x86)\Hostless Modem
O43 - CFD: 24/03/2015 - 13:25:43 - [] ----D C:\ProgramData\FARO
O43 - CFD: 25/03/2015 - 23:22:27 - [] ----D C:\ProgramData\ZDSupport
O43 - CFD: 22/03/2015 - 12:33:16 - [] ----D C:\ProgramData\{A157B72E-AF38-4705-AA1B-9BC0C56F8428}
O43 - CFD: 28/03/2015 - 00:34:37 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Computers and Structures
O43 - CFD: 22/08/2013 - 23:33:27 - [0] R-H-D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC
O43 - CFD: 24/03/2015 - 16:47:47 - [] ----D C:\Users\Namane\AppData\Local\Computers and Structures
~ Program Folder: 141 Legitimates Filtered in 00mn 02s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.8B138ED363128BFF2C2E1E7FEA9793B4] - 01/04/2015 - 01:16:29 ---A- . (...) -- C:\Windows\avisplitter.ini [38]
O44 - LFC:[MD5.AE496B22CEB3DC0FD1C1ADA559F884A7] - 03/04/2015 - 01:23:45 ---A- . (...) -- C:\Windows\win.ini [194]
O44 - LFC:[MD5.799714952D58FDF375A1D744B41FEC95] - 21/03/2015 - 15:35:12 ---A- . (.StdLib - StdLib.) -- C:\Windows\System32\Drivers\{06146dd6-a059-4c4d-9840-35b694aad4ae}Gw64.sys [48784] =>PUP.LinkiDoo
O44 - LFC:[MD5.70757BB715401D58378CEFA1164902C8] - 22/03/2015 - 00:52:52 ---A- . (...) -- C:\Windows\diagerr.xml [13338]
O44 - LFC:[MD5.70757BB715401D58378CEFA1164902C8] - 22/03/2015 - 00:52:52 ---A- . (...) -- C:\Windows\diagwrn.xml [13338]
O44 - LFC:[MD5.F7FF52F5C6DFDE1E6F5B324D6EE33DA0] - 22/03/2015 - 02:39:03 ---A- . (...) -- C:\Windows\System32\nvinfo.pb [27441]
O44 - LFC:[MD5.FD740172B08E21E3364B208B2B8080EF] - 22/03/2015 - 02:41:12 ---A- . (...) -- C:\Windows\System32\nvcoproc.bin [4236870]
O44 - LFC:[MD5.D7BA216CBF3A6BE2A743BCEA83335E5B] - 22/03/2015 - 12:02:22 ---A- . (...) -- C:\Windows\System32\results.xml [15876]
O44 - LFC:[MD5.EC3076891B6A1E1D6A9EE8A2300048CB] - 24/03/2015 - 08:13:44 ---A- . (.StdLib - StdLib.) -- C:\Windows\System32\Drivers\{13e8d46d-09b8-4fd6-b75a-25c04a0db747}Gw64.sys [48784] =>PUP.LinkiDoo
~ Files: 164 Legitimates Filtered in 02mn 36s



---\\ Déni du service (Local Security Authority) (O48)
~ LSA: 3 Legitimates Filtered in 00mn 00s



---\\ Clé de registre Shell MountPoints2 (MPSK) (O51)
O51 - MPSK:{b7f7a7d3-c106-11e4-827d-9439e5e98c9e}\AutoRun\command. (...) -- D:\AutoRun.exe (.not file.)
O51 - MPSK:{b7f7a813-c106-11e4-827d-9439e5e98c9e}\AutoRun\command. (...) -- D:\AutoRun.exe (.not file.)
~ Keys: Scanned in 00mn 00s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 17 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 4 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:13/08/2013 - 00:25:46 ---A- . (.Windows (R) Win 7 DDK provider - BCM Function 2 Device Driver.) -- C:\Windows\System32\Drivers\bcmfn2.sys [17624]
O58 - SDL:19/03/2015 - 03:27:06 ---A- . (.Tonec Inc. - Internet Download Manager WFP Driver.) -- C:\Windows\System32\Drivers\idmwfp.sys [191960]
O58 - SDL:22/08/2013 - 13:43:32 ---A- . (.Promise Technology, Inc. - Promise SuperTrak EX Series Driver for Windows x64.) -- C:\Windows\System32\Drivers\stexstor.sys [31072]
O58 - SDL:21/03/2015 - 15:35:12 ---A- . (.StdLib - StdLib.) -- C:\Windows\System32\Drivers\{06146dd6-a059-4c4d-9840-35b694aad4ae}Gw64.sys [48784] =>PUP.LinkiDoo
O58 - SDL:24/03/2015 - 08:13:44 ---A- . (.StdLib - StdLib.) -- C:\Windows\System32\Drivers\{13e8d46d-09b8-4fd6-b75a-25c04a0db747}Gw64.sys [48784] =>PUP.LinkiDoo
~ Drivers: 64 Legitimates Filtered in 00mn 08s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2015 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Apple Inc. - Safari.) -- C:\Program Files (x86)\Safari\Safari.exe
~ Keys: Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com
~ Keys: Scanned in 00mn 00s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.3A2C8F4C1B214A50828131564360ED7C] [SPRF][22/03/2015] (...) -- C:\ProgramData\ntuser.dat [262144]
~ Files: 3 Legitimates Filtered in 00mn 00s



---\\ Recherche de clés de registre Tracing (O100)
HKLM\SOFTWARE\Microsoft\Tracing\BackupStack_RASAPI32 =>PUP.MyPCBackup
HKLM\SOFTWARE\Microsoft\Tracing\BackupStack_RASMANCS =>PUP.MyPCBackup
HKLM\SOFTWARE\Microsoft\Tracing\MyPC Backup_RASAPI32 =>PUP.MyPCBackup
HKLM\SOFTWARE\Microsoft\Tracing\MyPC Backup_RASMANCS =>PUP.MyPCBackup
HKLM\SOFTWARE\Microsoft\Tracing\Signup Wizard_RASAPI32 =>PUP.MyPCBackup
HKLM\SOFTWARE\Microsoft\Tracing\Signup Wizard_RASMANCS =>PUP.MyPCBackup
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\updateBetweenLines_RASAPI32 =>PUP.BetweenLines
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\updateBetweenLines_RASMANCS =>PUP.BetweenLines
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\utilBetweenLines_RASAPI32 =>PUP.BetweenLines
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\utilBetweenLines_RASMANCS =>PUP.BetweenLines
~ BTK: 30 Legitimates Filtered in 00mn 00s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Auto 30/08/2014 234520 | (AVP15.0.1) . (.Kaspersky Lab ZAO.) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.1\avp.exe
SS - | Demand 04/02/2015 280680 | (cphs) . (.Intel Corporation.) - C:\Windows\SysWow64\IntelCpHeciSvc.exe
SS - | Demand 24/03/2015 1471352 | (FlexNet Licensing Service 64) . (.Flexera Software LLC.) - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
SS - | Auto 22/03/2015 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 22/03/2015 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 13/05/2014 887256 | (Intel(R) Capability Licensing Service TCP IP Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
SS - | Demand 02/04/2015 148080 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Demand 22/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SS - | Demand 22/08/2013 37768 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 13/12/2012 12288 | (Autodesk Content Service) . (.Autodesk, Inc..) - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
SR - | Auto 22/03/2015 2255064 | (BcmBtRSupport) . (.Broadcom Corporation..) - C:\Windows\System32\BtwRSupportService.exe
SR - | Auto 10/09/2014 977664 | (btwdins) . (.Broadcom Corporation..) - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
SR - | Auto 05/02/2015 1148560 | (GfExperienceService) . (.NVIDIA Corporation.) - C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
SR - | Demand 24/04/2012 169752 | (ICCS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
SR - | Auto 06/01/2015 409376 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
SR - | Auto 15/10/2014 2820424 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe
SR - | Auto 05/02/2015 1706128 | (NvNetworkService) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
SR - | Auto 05/02/2015 21833360 | (NvStreamSvc) . (.NVIDIA Corporation.) - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
SR - | Auto 05/02/2015 935056 | (nvsvc) . (.NVIDIA Corporation.) - C:\WINDOWS\system32\nvvsvc.exe
SR - | Auto 05/02/2015 410952 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
SR - | Auto 03/04/2015 412920 | (Update Between Lines) . (...) - C:\Program Files (x86)\Between Lines\updateBetweenLines.exe =>PUP.BetweenLines
SR - | Auto 02/04/2015 412920 | (Util Between Lines) . (...) - C:\Program Files (x86)\Between Lines\bin\utilBetweenLines.exe =>PUP.BetweenLines
SR - | Demand 22/07/1658 0 | (WdNisSvc) . (...) - C:\Program Files (x86)\Windows Defender\NisSrv.exe
SR - | Demand 22/07/1658 0 | (WinDefend) . (...) - C:\Program Files (x86)\Windows Defender\MsMpEng.exe
SR - | Auto 06/11/2013 427264 | (ZDServ) . (...) - C:\ProgramData\ZDSupport\ZDServ\ZDServ.exe
~ Services: Scanned in 00mn 58s



---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Run by Namane at 03/04/2015 01:56:53
~ OS 64 not supported by MBR tool
~ MBR: 0 Legitimates Filtered in 00mn 00s



---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Namane at 03/04/2015 01:56:55
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 02s



---\\ Scan Additionnel (O88)
Database Version : 13008 - (29/03/2015)
Clés trouvées (Keys found) : 4
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 8

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ED66005B-3C60-469C-A11B-211B53E83D9E}] =>PUP.BetweenLines^
[HKLM\SYSTEM\CurrentControlSet\Services\Update Between Lines] =>PUP.BetweenLines^
[HKLM\SYSTEM\CurrentControlSet\Services\Util Between Lines] =>PUP.BetweenLines^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{ac225167-00fc-452d-94c5-bb93600e7d9a}] =>PUP.BuzzDock^
C:\Program Files (x86)\Between Lines\bin\BetweenLines.BrowserAdapter.exe =>PUP.BetweenLines^
C:\Program Files (x86)\Between Lines\bin\BetweenLines.BOASHelper.exe =>PUP.BetweenLines^
C:\Program Files (x86)\Between Lines\bin\BetweenLines.expext.exe =>PUP.BetweenLines^
C:\Program Files (x86)\Between Lines\bin\BetweenLines.BOASPRT.exe =>PUP.BetweenLines^
C:\Program Files (x86)\Between Lines\bin\BetweenLines.BOAS.exe =>PUP.BetweenLines^
C:\Program Files (x86)\Between Lines\bin\utilBetweenLines.exe =>PUP.BetweenLines^
C:\Program Files (x86)\Between Lines\updateBetweenLines.exe =>PUP.BetweenLines^
[HKCU\Software\ProductSetup] =>Adware.InstallCore^
~ Additionnel Scan: 340554 Items scanned in 01mn 40s



---\\ Informations complémentaires sur les modules
~ http://nicolascoolman.fr/r5-internet-explorer-proxy-management-iepm/ =>.Internet Explorer, Proxy Management (R5)
~ http://nicolascoolman.fr/o2-browser-helper-objects-de-navigateur/ =>.Browser Helper Objects de navigateur (O2)
~ http://nicolascoolman.fr/o4-applications-demarrees-par-le-registre/ =>.Applications lancées au démarrage du système (O4)
~ http://nicolascoolman.fr/o51-mountpoints2-shell-key-mpsk/ =>.Clé de registre Shell MountPoints2 (MPSK) (O51)
~ AMI: 4 Legitimates Filtered in 00mn 00s



---\\ Récapitulatif des détections trouvées sur votre station
http://www.nicolascoolman.fr/blog/ =>PUP.BetweenLines
http://nicolascoolman.fr/pup-mypcbackup =>PUP.MyPCBackup
http://nicolascoolman.fr/pup-linkidoo =>PUP.LinkiDoo
http://www.nicolascoolman.fr/blog/ =>PUP.BuzzDock
http://nicolascoolman.fr/adware-installcore =>Adware.InstallCore
~ MSI: 5 link(s) detected in 00mn 00s



~ 723 Legitimates filtered by white list
End of the scan (501 lines in 11mn 26s)(0.11)

Publicité


Signaler le contenu de ce document

Publicité