Publicité
Publicité
Format du document : text/plain
Prévisualisation
~ Rapport de ZHPDiag v2015.4.17.39 - Nicolas Coolman (17/04/2015)
~ Lancé par splendid univers (19/04/2015 18:30:54)
~ Facebook : https://www.facebook.com/nicolascoolman1
~ Adresse du Forum http://forum.nicolascoolman.fr
~ Traduit par Nicolas Coolman
~ Etat de la version : Version à jour.
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by user
---\\ Navigateurs Internet
MSIE: Internet Explorer v9.0.8112.16421
MFIE: Mozilla Firefox 37.0.1 (Defaut)
GCIE: Google Chrome v42.0.2311.90
---\\ Informations sur les produits Windows
~ Langage: Français
Windows Server License Manager Script : OK
---\\ Logiciels de protection du système
Windows Defender W7 (Activate)
---\\ Logiciels d'optimisation du système
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 17 NPAPI
---\\ Informations sur le système
~ Processor: x86 Family 6 Model 37 Stepping 5, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1906 MB (13% free)
System Restore: Activé (Enable)
System drive C: has 33 GB (31%) free of 103 GB
---\\ Mode de connexion au système
~ Computer Name: SPLENDIDUNIVERS
~ User Name: splendid univers
~ All Users Names: splendid univers, Administrateur,
~ Unselected Option: None
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\splendid univers\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\splendid univers\AppData\Roaming\
~ %Desktop% : C:\Users\splendid univers\Desktop\
~ %Favorites% : C:\Users\splendid univers\Favorites\
~ %LocalAppData% : C:\Users\splendid univers\AppData\Local\
~ %StartMenu% : C:\Users\splendid univers\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 33 Go of 103 Go)
D: Hard drive, Flash drive, Thumb drive (Free 42 Go of 195 Go)
E: CD-ROM drive (Not Inserted)
F: Floppy drive, Flash card reader, USB Key (Not Inserted)
---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] UacDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowMyGames: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowPrinters: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSetProgramAccessAndDefaults: Modified =>PUA.StartShow
~ Security Center: 42 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.3A827FCB4682700CF199B78DEADFE0F0] - (.Microsoft Corporation - Explorateur Windows.) (.16/03/2010 - 08:17:20.) -- C:\Windows\Explorer.exe [2614272]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:14:45.) -- C:\Windows\System32\Wininit.exe [96256]
[MD5.C8ADAA6948993D839D14524847EA5B75] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.10/11/2013 - 21:02:07.) -- C:\Windows\System32\wininet.dll [1129472]
[MD5.37CDB7E72EB66BA85A87CBE37E7F03FD] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.16/03/2010 - 08:17:20.) -- C:\Windows\System32\Winlogon.exe [285696]
[MD5.58C94EAE54BF0C5E2B80B2E5E7744D4C] - (.Microsoft Corporation - Bibliothèque de licences.) (.14/07/2009 - 02:16:15.) -- C:\Windows\System32\sppcomapi.dll [193024]
[MD5.DDC040FDB01EF1712A6B13E52AFB104C] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.14/07/2009 - 00:12:38.) -- C:\Windows\system32\Drivers\AFD.sys [338944]
[MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:26:15.) -- C:\Windows\system32\Drivers\atapi.sys [21584]
[MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:11:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656]
[MD5.BA6E70AA0E6091BC39DE29477D866A77] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.14/07/2009 - 00:11:26.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544]
[MD5.8E09E52EE2E3CEB199EF3DD99CF9E3FB] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.14/07/2009 - 00:14:17.) -- C:\Windows\system32\Drivers\DfsC.sys [78336]
[MD5.717A2207FD6F13AD3E664C7D5A43C7BF] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.14/07/2009 - 00:50:56.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544]
[MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:11:24.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896]
[MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 00:54:29.) -- C:\Windows\system32\Drivers\IpNat.sys [101888]
[MD5.F1B6AA08497EA86CA6EF6F7A08B0BFB8] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.14/04/2010 - 14:04:07.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123392]
[MD5.DD52A733BF4CA5AF84562A5E2F963B91] - (.Microsoft Corporation - MBT Transport driver.) (.14/07/2009 - 00:12:21.) -- C:\Windows\system32\Drivers\netBT.sys [187904]
[MD5.3795DCD21F740EE799FB7223234215AF] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.14/07/2009 - 02:20:44.) -- C:\Windows\system32\Drivers\ntfs.sys [1210432]
[MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 00:45:35.) -- C:\Windows\system32\Drivers\Parport.sys [79360]
[MD5.D9F91EAFEC2815365CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.14/07/2009 - 00:54:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848]
[MD5.C5FF95883FFEF704D50C40D21CFB3AB5] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.14/07/2009 - 01:02:58.) -- C:\Windows\system32\Drivers\rdpdr.sys [133120]
[MD5.3E21C083B8A01CB70BA1F09303010FCE] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 00:53:41.) -- C:\Windows\system32\Drivers\smb.sys [71168]
[MD5.CB39E896A2A83702D1737BFD402B3542] - (.Microsoft Corporation - TDI Translation Driver.) (.14/07/2009 - 00:12:11.) -- C:\Windows\system32\Drivers\tdx.sys [74240]
[MD5.58DF9D2481A56EDDE167E51B334D44FD] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.14/07/2009 - 02:19:10.) -- C:\Windows\system32\Drivers\volsnap.sys [245328]
~ Generic Processes: Scanned in 00mn 01s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes Favoris (My Favorites) : 0/11
~ Mes Documents (My Documents) : 1/2
~ Mon Bureau (My Desktop) : 2/40
~ Menu demarrer (Programs) : 0/32
~ Hidden Files: Scanned in 00mn 00s
---\\ Processus lancés
[MD5.7139E7EEA74966995148B16B8559819D] - (.Intel Corporation - igfxTray Module.) -- C:\Windows\System32\igfxtray.exe [138008] [PID.352]
[MD5.356A26CB1A7FA81BE22CDDBE77067B76] - (.Intel Corporation - hkcmd Module.) -- C:\Windows\System32\hkcmd.exe [171288] [PID.396]
[MD5.57EE515BD3E9C76EDD7D4414C95104A5] - (.Intel Corporation - persistence Module.) -- C:\Windows\System32\igfxpers.exe [172824] [PID.528]
[MD5.E7FF908CAC792A6DB16F2D4BB775FC95] - (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10082920] [PID.1060]
[MD5.DE32A4D2B4CB6ADD8FFE74856B64946C] - (.Realtek Semiconductor - HD Audio Background Process.) -- C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [1546856] [PID.1924]
[MD5.77590CE0CDEB6BBEE8DC056FEA0B107C] - (.SearchProtect - CmdShell.exe.) -- C:\Program Files\XTab\cmdshell.exe [48304] [PID.2280] =>PUP.SearchProtect
[MD5.1606CBD0193E93952CD4EACDC9229651] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe [271744] [PID.2992]
[MD5.C44031488DED58FCE58E5D94BC345D30] - (.Nero AG - Nero Home.) -- C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1840424] [PID.3212]
[MD5.475A2BC64E0FF011C8C9AFC418E8E40D] - (.ultracopier.first-world.info - Supercopier under GPL3.) -- C:\Program Files\Supercopier\supercopier.exe [178688] [PID.3232]
[MD5.16F1D5CF6465FCA139FA289648B349EE] - (.Nokia - Nokia PC Internet Access.) -- C:\Program Files\Nokia\PC Internet Access\NPCIA.exe [663552] [PID.3464]
[MD5.10AA923C7622D57C3D4B1D9A4EAF14BC] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe [31344744] [PID.3476]
[MD5.2481529EC3A9A030481545B70B119CCB] - (.Nokia - Nokia Suite.) -- C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe [1092448] [PID.3496]
[MD5.58FBD16C4BB84D9F69C25F30DAA4CE31] - (.Nokia - Microsoft Bluetooth Media Server.) -- C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe [158032] [PID.3124]
[MD5.C04D8BC933470B3913E4E3E6C3115793] - (.XTab system - SupHPNot.exe.) -- C:\Program Files\XTab\HPNotify.exe [673968] [PID.4208]
[MD5.C830F4E9E1C93EDDADB6929D2CFEDC85] - (.Oracle Corporation - Java(TM) Update Checker.) -- C:\Program Files\Common Files\Java\Java Update\jucheck.exe [530816] [PID.4336]
[MD5.7CFD590987D2BB33D5D56D98093D2E76] - (.Adobe Systems Incorporated - Adobe Updater.) -- C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe [2521464] [PID.1628]
[MD5.BB69268B5F4277A1CFC36A237E27FD87] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe [376944] [PID.5692]
[MD5.831F8FAE0BFFCF8BA05082E5C5DB8CB3] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files\Mozilla Firefox\plugin-container.exe [267888] [PID.5304]
[MD5.66F6B3894132CC3D347CB85FBAE48D57] - (.Adobe Systems, Inc. - Adobe Flash Player 17.0 r0.) -- C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe [1892528] [PID.3716]
[MD5.62A3B7A12578B3B595253342B982BDA7] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8198144] [PID.4380]
~ Processes Running: Scanned in 00mn 02s
---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\splendid univers\AppData\Local\Google\Chrome\User Data\Default\Preferences
---\\ Liste des dossiers d'extension Google Chrome
~ Google Lines Browser: 7 Legitimates Filtered in 00mn 01s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\splendid univers\AppData\Roaming\Mozilla\Firefox\Profiles\azynzyii.default\prefs.js
C:\Users\splendid univers\AppData\Roaming\Mozilla\Firefox\Profiles\azynzyii.default\user.js
M3 - MFPP: Plugins - [splendid univers] -- C:\Users\splendid univers\AppData\Roaming\Mozilla\Firefox\Profiles\azynzyii.default\searchplugins\ask-web-search.xml
M3 - MFPP: Plugins - [splendid univers] -- C:\Users\splendid univers\AppData\Roaming\Mozilla\Firefox\Profiles\azynzyii.default\searchplugins\key-find.xml =>Hijacker.Hijacker.KeyFind
M2 - MFEP: prefs.js [splendid univers - azynzyii.default\abs@avira.com] [] Segurança do navegador Avira v1.4.6 (..)
M2 - MFEP: prefs.js [splendid univers - azynzyii.default\faststartff@gmail.com] [] Fast Start v1.4.6 (..) =>PUP.FastStart
M2 - MFEP: prefs.js [splendid univers - azynzyii.default\fftoolbar2014@etech.com] [] FF Toolbar v1.0.0.1025 (..) =>Adware.FFToolBar
M2 - MFEP: prefs.js [splendid univers - azynzyii.default\searchengine@gmail.com] [] Search Enginer v1.0.0.1027 (..) =>PUP.SearchEngine
P2 - FPN: [HKLM] [@nokia.com/EnablerPlugin] - (.Pas de propriétaire - Nokia Suite Enabler Plugin.) -- C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll
P2 - FPN: [HKLM] [@t-immersion.com/DFusionHomeWebPlugIn] - (.Total Immersion - D'Fusion @Home Web Plug-In (3.10.17859.0).) -- C:\Program Files\Total Immersion\DFusionHomeWebPlugIn\NPDFusionWebFirefox.dll
~ Firefox Browser: 25 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.key-find.com =>Hijacker.Hijacker.KeyFind
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.key-find.com =>Hijacker.Hijacker.KeyFind
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.key-find.com =>Hijacker.Hijacker.KeyFind
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.key-find.com =>Hijacker.Hijacker.KeyFind
~ IE Browser: 13 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\System32\Userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (21)
~ Hosts File: Scanned in 00mn 00s
---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} . (.Thinknice Co. Limited - SupTab setup package.) -- C:\Program Files\XTab\SupTab.dll =>PUP.SupTab
~ BHO: 14 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{5347542D-5637-006A-76A7-7A786E7484D7} Clé orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: YTD Video Downloader.lnk . (.GreenTree Applications SRL - YTD Video Downloader.) -- C:\Program Files\GreenTree Applications\YTD Video Downloader\ytd.exe =>PUP.GreenTreeApp
~ Global Startup: 1 Legitimates Filtered in 00mn 01s
---\\ Applications lancées au démarrage du système (O4)
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe =>.Realtek Semiconductor Corp
O4 - HKLM\..\Run: [RtHDVBg] . (.Realtek Semiconductor - HD Audio Background Process.) -- C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
O4 - HKLM\..\Run: [NBKeyScan] . (.Nero AG - Nero BackItUp.) -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
O4 - HKLM\..\Run: [tdzmnrhfku] \B C:\ProgramData\tdzmnrhfku..vbs (.not file.)
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKCU\..\Run: [WebcamMaxAutoRun] . (.CoolwareMax - WebcamMax.) -- C:\Program Files\WebcamMax\WebcamMax.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] . (.Nero AG - Nero Home.) -- C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
O4 - HKCU\..\Run: [ultracopier] . (.ultracopier.first-world.info - Supercopier under GPL3.) -- C:\Program Files\Supercopier\supercopier.exe
O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Users\splendid univers\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\splendid univers\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc
O4 - HKCU\..\Run: [NokiaPCInternetAccess] . (.Nokia - Nokia PC Internet Access.) -- C:\Program Files\Nokia\PC Internet Access\NPCIA.exe
O4 - HKCU\..\Run: [iLivid] C:\Users\splendid univers\AppData\Local\iLivid\iLivid.exe (.not file.) =>Adware.Bandoo
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe =>.Skype Technologies S.A.
O4 - HKCU\..\Run: [tdzmnrhfku] \B C:\ProgramData\tdzmnrhfku..vbs (.not file.)
O4 - HKCU\..\Run: [NokiaSuite.exe] . (.Nokia - Nokia Suite.) -- C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe
O4 - HKCU\..\Run: [Viber] C:\Users\splendid univers\AppData\Local\Viber\Viber.exe (.not file.)
O4 - HKUS\.DEFAULT\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-18\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [WebcamMaxAutoRun] . (.CoolwareMax - WebcamMax.) -- C:\Program Files\WebcamMax\WebcamMax.exe
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] . (.Nero AG - Nero Home.) -- C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [ultracopier] . (.ultracopier.first-world.info - Supercopier under GPL3.) -- C:\Program Files\Supercopier\supercopier.exe
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Users\splendid univers\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\splendid univers\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [NokiaPCInternetAccess] . (.Nokia - Nokia PC Internet Access.) -- C:\Program Files\Nokia\PC Internet Access\NPCIA.exe
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [iLivid] C:\Users\splendid univers\AppData\Local\iLivid\iLivid.exe (.not file.) =>Adware.Bandoo
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe =>.Skype Technologies S.A.
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [tdzmnrhfku] \B C:\ProgramData\tdzmnrhfku..vbs (.not file.)
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [NokiaSuite.exe] . (.Nokia - Nokia Suite.) -- C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [Viber] C:\Users\splendid univers\AppData\Local\Viber\Viber.exe (.not file.)
~ Application: Scanned in 00mn 02s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- C:\Program Files\Skype\Toolbars\Internet Explorer\icon.ico
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{ED8488CC-19DC-40FE-B4D4-AC26B1D3EE80}: DhcpNameServer = 192.168.1.1 0.0.0.0
O17 - HKLM\System\CS1\Services\Tcpip\..\{ED8488CC-19DC-40FE-B4D4-AC26B1D3EE80}: DhcpNameServer = 192.168.1.1 0.0.0.0
O17 - HKLM\System\CS2\Services\Tcpip\..\{ED8488CC-19DC-40FE-B4D4-AC26B1D3EE80}: DhcpNameServer = 192.168.1.1 0.0.0.0
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 0.0.0.0
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: DefaultTabUpdate (DefaultTabUpdate) . (...) - C:\Users\splendid univers\AppData\Roaming\defaulttab\defaulttab\dtupdate.exe =>Adware.Bandoo
O23 - Service: Flexlm Service 1 (Flexlm Service 1) . (.Acresso Software Inc. - Pas de description.) - C:\SIMULIA\License\lmgrd.exe
O23 - Service: IHProtect Service (IHProtect Service) . (.XTab system - ProtectSvc.exe.) - C:\Program Files\XTab\ProtectService.exe =>Adware.AgentODR
O23 - Service: SettingsGuard (SettingsGuard) . (...) - C:\Users\splendid univers\AppData\Roaming\SettingsGuard\updater.exe
~ Services: 8 Legitimates Filtered in 00mn 03s
---\\ Clés Session Manager (AppCertDlls,KnownDLLs) (O36)
O36 - AppCertDlls: (x64) . (...) -- c:\program files\movies toolbar\datamngr\x64\apcrtldr.dll (Not file) =>PUP.MoviesToolbar
~ Keys: Scanned in 00mn 00s
---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [251724b4-67d8-4ba7-bddc-fb697152dd97-1] (...) -- C:\Program Files\SuperPlusRadio v2.1\SuperPlusRadio v2.1-codedownloader.exe (.not file.) [0] =>PUP.SuperPlusRadio
[MD5.00000000000000000000000000000000] [APT] [251724b4-67d8-4ba7-bddc-fb697152dd97-4] (...) -- C:\Program Files\SuperPlusRadio v2.1\251724b4-67d8-4ba7-bddc-fb697152dd97-4.exe (.not file.) [0] =>PUP.SuperPlusRadio
[MD5.00000000000000000000000000000000] [APT] [251724b4-67d8-4ba7-bddc-fb697152dd97-6] (...) -- C:\Program Files\SuperPlusRadio v2.1\251724b4-67d8-4ba7-bddc-fb697152dd97-6.exe (.not file.) [0] =>PUP.SuperPlusRadio
[MD5.00000000000000000000000000000000] [APT] [251724b4-67d8-4ba7-bddc-fb697152dd97-7] (...) -- C:\Program Files\SuperPlusRadio v2.1\251724b4-67d8-4ba7-bddc-fb697152dd97-7.exe (.not file.) [0] =>PUP.SuperPlusRadio
[MD5.00000000000000000000000000000000] [APT] [DTReg] (...) -- C:\Users\splendid univers\AppData\Roaming\defaulttab\defaulttab\DTReg.exe (.not file.) [0] =>Adware.Bandoo
[MD5.00000000000000000000000000000000] [APT] [PC Performer Daily Check] (...) -- C:\Program Files\PC Performer\PSCheckUp.exe (.not file.) [0] =>PUP.PCPerformer
[MD5.00000000000000000000000000000000] [APT] [PC Performer Logon Scan] (...) -- C:\Program Files\PC Performer\PCPerformer.exe (.not file.) [0] =>PUP.PCPerformer
[MD5.00000000000000000000000000000000] [APT] [PC Performer Scheduled Scan] (...) -- C:\Program Files\PC Performer\PCPerformer.exe (.not file.) [0] =>PUP.PCPerformer
[MD5.00000000000000000000000000000000] [APT] [{1775BE24-361D-40CC-8757-D599DC0A9386}] (...) -- H:\SetupOviPlayer.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{6C76EADA-7E1D-4414-BF16-84B2993D3DEC}] (...) -- C:\Users\splendid univers\Desktop\Nokia_PC_Suite_ALL.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{876B662C-5DA7-44B8-B673-93736D495437}] (...) -- C:\Program Files\Avira\AntiVir Desktop\setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{D4DFC8DE-D0E7-43C5-85A4-30A04A97F528}] (...) -- C:\Users\splendid univers\Desktop\sonelgaz\avast\vpsupd4.exe (.not file.) [0]
O39 - APT: 251724b4-67d8-4ba7-bddc-fb697152dd97-1 - (...) -- C:\Windows\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-1.job [3132] =>PUP.CrossRider
O39 - APT: 251724b4-67d8-4ba7-bddc-fb697152dd97-1 - (...) -- C:\Windows\System32\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-1 [3132] =>PUP.CrossRider
O39 - APT: 251724b4-67d8-4ba7-bddc-fb697152dd97-4 - (...) -- C:\Windows\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-4.job [4500] =>PUP.CrossRider
O39 - APT: 251724b4-67d8-4ba7-bddc-fb697152dd97-4 - (...) -- C:\Windows\System32\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-4 [4500] =>PUP.CrossRider
O39 - APT: 251724b4-67d8-4ba7-bddc-fb697152dd97-6 - (...) -- C:\Windows\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-6.job [5524] =>PUP.CrossRider
O39 - APT: 251724b4-67d8-4ba7-bddc-fb697152dd97-6 - (...) -- C:\Windows\System32\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-6 [5524] =>PUP.CrossRider
O39 - APT: 251724b4-67d8-4ba7-bddc-fb697152dd97-7 - (...) -- C:\Windows\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-7.job [5188] =>PUP.CrossRider
O39 - APT: 251724b4-67d8-4ba7-bddc-fb697152dd97-7 - (...) -- C:\Windows\System32\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-7 [5188] =>PUP.CrossRider
O39 - APT: - (..) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater [1002]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-849525796-146659326-278252309-1000Core [950]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-849525796-146659326-278252309-1000UA [972]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-849525796-146659326-278252309-1000Core [1070]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-849525796-146659326-278252309-1000UA [1122]
~ Scheduled Task: 39 Legitimates Filtered in 00mn 07s
---\\ Logiciels installés (O42)
O42 - Logiciel: SettingsGuard - (.SmartCyberTechnology.) [HKLM] -- SettingsGuardService
~ Logic: 2 Legitimates Filtered in 00mn 00s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\APN PIP]
[HKCU\Software\Default Tab] =>Adware.Bandoo
[HKCU\Software\DefaultTab] =>Adware.Bandoo
[HKCU\Software\InstallCore] =>Adware.InstallCore
[HKCU\Software\InstalledBrowserExtensions] =>PUP.BrowserExtensions
[HKCU\Software\Popajar] =>Toolbar.Conduit
[HKCU\Software\ProductSetup] =>Adware.InstallCore
[HKCU\Software\SmileysWeLove] =>Adware.SmileyBar
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKCU\Software\SuperPlusRadio v2.1-nv] =>PUP.SuperPlusRadio
[HKCU\Software\SuperPlusRadio v2.1] =>PUP.SuperPlusRadio
[HKCU\Software\iLivid] =>Adware.Bandoo
[HKLM\Software\Default Tab] =>Adware.Bandoo
[HKLM\Software\DefaultTab] =>Adware.Bandoo
[HKLM\Software\InstalledBrowserExtensions] =>PUP.BrowserExtensions
[HKLM\Software\SiteFinder] =>Adware.ShoppingReport
[HKLM\Software\SupDp] =>PUP.SupTab
[HKLM\Software\SuperPlusRadio v2.1-nv] =>PUP.SuperPlusRadio
[HKLM\Software\SuperPlusRadio v2.1] =>PUP.SuperPlusRadio
[HKLM\Software\Tarma Installer] =>PUP.Tarma
[HKLM\Software\WanDrv]
[HKLM\Software\supTab] =>PUP.SupTab
[HKLM\Software\tdzmnrhfku]
~ Key Software: 157 Legitimates Filtered in 00mn 00s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 27/01/2015 - 17:56:21 - [0] ----D C:\Program Files\ccbb3e89-3a64-46b3-b29b-48d9bd2e46c5
O43 - CFD: 18/04/2015 - 14:02:39 - [] ----D C:\Program Files\CMAK
O43 - CFD: 17/04/2015 - 13:02:29 - [] ----D C:\Program Files\dlsecuretb
O43 - CFD: 03/08/2013 - 14:54:51 - [] ----D C:\Program Files\MyPC Backup =>PUP.MyPCBackup
O43 - CFD: 22/02/2015 - 17:37:05 - [] ----D C:\Program Files\RelevantKnowledge =>Adware.RelevantKnowledge
O43 - CFD: 02/06/2014 - 21:40:01 - [0] ----D C:\Program Files\SiteLookup =>PUP.SiteLookup
O43 - CFD: 22/02/2015 - 17:37:04 - [] ----D C:\Program Files\SuperPlusRadio v2.1 =>PUP.SuperPlusRadio
O43 - CFD: 31/07/2013 - 11:35:59 - [] ----D C:\Program Files\Windows GT
O43 - CFD: 25/02/2015 - 21:33:56 - [] ----D C:\Program Files\XTab
O43 - CFD: 20/08/2013 - 22:01:08 - [] ----D C:\ProgramData\APN
O43 - CFD: 26/09/2013 - 20:10:14 - [] ----D C:\ProgramData\Tarma Installer =>PUP.Tarma
O43 - CFD: 27/01/2015 - 17:49:35 - [] -SH-D C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
O43 - CFD: 27/03/2010 - 13:18:48 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibilité
O43 - CFD: 27/03/2010 - 13:18:48 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dépannage
O43 - CFD: 27/03/2010 - 13:18:48 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Menu de connexion
O43 - CFD: 27/03/2010 - 13:18:48 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Programmes Windows
O43 - CFD: 15/08/2014 - 16:07:27 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge =>Adware.RelevantKnowledge
O43 - CFD: 27/03/2010 - 13:18:48 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Réseau
O43 - CFD: 14/07/2009 - 09:46:52 - [] R-H-D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC
O43 - CFD: 31/07/2013 - 11:36:02 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tools_GT
O43 - CFD: 31/07/2013 - 11:36:03 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows GT
O43 - CFD: 22/11/2013 - 21:49:07 - [] ----D C:\Users\splendid univers\AppData\Roaming\DamnVid
O43 - CFD: 22/11/2013 - 21:26:51 - [] ----D C:\Users\splendid univers\AppData\Roaming\defaulttab =>Adware.Bandoo
O43 - CFD: 25/02/2015 - 21:26:29 - [] ----D C:\Users\splendid univers\AppData\Roaming\key-find =>Hijacker.Hijacker.KeyFind
O43 - CFD: 01/02/2014 - 22:44:23 - [] ----D C:\Users\splendid univers\AppData\Roaming\Movdap =>Adware.WebCake
O43 - CFD: 12/03/2015 - 21:49:02 - [] ----D C:\Users\splendid univers\AppData\Roaming\OpenCandy =>Adware.OpenCandy
O43 - CFD: 29/10/2014 - 12:29:35 - [] ----D C:\Users\splendid univers\AppData\Roaming\RHEng =>PUP.Conduit
O43 - CFD: 03/04/2015 - 13:01:04 - [] ----D C:\Users\splendid univers\AppData\Roaming\SettingsGuard
O43 - CFD: 02/06/2014 - 21:39:40 - [0] ----D C:\Users\splendid univers\AppData\Roaming\SimilarSites
O43 - CFD: 03/04/2015 - 13:03:40 - [] ----D C:\Users\splendid univers\AppData\Roaming\UnknownFile
O43 - CFD: 03/04/2015 - 13:06:08 - [] ----D C:\Users\splendid univers\AppData\Local\CodecPerformer =>PUP.CodecPerformer
~ Program Folder: 217 Legitimates Filtered in 00mn 01s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.C7BC96C3711C0D269DA26D1F0ECEC547] - 05/04/2015 - 21:37:58 ---A- . (...) -- C:\Windows\NeroDigital.ini [69]
O44 - LFC:[MD5.72AA643C526DDB882B7DA9394947DF16] - 18/04/2015 - 14:02:31 ---A- . (...) -- C:\Windows\System32\termcap [862]
O44 - LFC:[MD5.5B8CF8F0C336068D2C118FD94BE6C30E] - 18/04/2015 - 14:03:33 ---A- . (...) -- C:\Windows\iis7.log [40616]
~ Files: 13 Legitimates Filtered in 00mn 04s
---\\ Export de clé d'application autorisée (O47)
O47 - AAKE:Key Export DP - "C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpid.exe" [Enabled] .(.Pas de propriétaire.) -- C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpid.exe
O47 - AAKE:Key Export DP - "C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpirun.exe" [Enabled] .(.Pas de propriétaire.) -- C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpirun.exe
O47 - AAKE:Key Export DP - "C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpidiag.exe" [Enabled] .(...) -- C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpidiag.exe (.not file.)
O47 - AAKE:Key Export DP - "C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpisrvutil.exe" [Enabled] .(...) -- C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpisrvutil.exe (.not file.)
~ Keys Export: 4 Legitimates Filtered in 00mn 00s
---\\ Image File Execution Options (IFEO) (O50)
O50 - IFEO:Image File Execution Options - bitguard.exe - tasklist.exe =>PUP.BitGuard
O50 - IFEO:Image File Execution Options - bprotect.exe - tasklist.exe
O50 - IFEO:Image File Execution Options - bpsvc.exe - tasklist.exe
O50 - IFEO:Image File Execution Options - browserdefender.exe - tasklist.exe =>Hijacker.Eazel
O50 - IFEO:Image File Execution Options - browserprotect.exe - tasklist.exe =>Hijacker.Eazel
O50 - IFEO:Image File Execution Options - browsersafeguard.exe - tasklist.exe =>PUP.BrowserSafeguard
O50 - IFEO:Image File Execution Options - dprotectsvc.exe - tasklist.exe =>Trojan.Staser
O50 - IFEO:Image File Execution Options - protectedsearch.exe - tasklist.exe =>Spyware.ProtectedSearch
O50 - IFEO:Image File Execution Options - searchprotection.exe - tasklist.exe =>Toolbar.Conduit
O50 - IFEO:Image File Execution Options - searchprotector.exe - tasklist.exe =>PUP.SearchProtect
O50 - IFEO:Image File Execution Options - searchsettings.exe - tasklist.exe =>Adware.SearchSettings
O50 - IFEO:Image File Execution Options - searchsettings64.exe - tasklist.exe =>Adware.SearchSettings
O50 - IFEO:Image File Execution Options - snapdo.exe - tasklist.exe =>Hijacker.SmartBar
O50 - IFEO:Image File Execution Options - stinst32.exe - tasklist.exe
O50 - IFEO:Image File Execution Options - stinst64.exe - tasklist.exe
O50 - IFEO:Image File Execution Options - utiljumpflip.exe - tasklist.exe =>PUP.JumpFlip
~ IFEO: Scanned in 00mn 00s
---\\ Clé de registre Shell MountPoints2 (MPSK) (O51)
O51 - MPSK:{54a1cd2a-5209-11e3-9ae2-4cedde702382}\AutoRun\command. (...) -- G:\NokiaPCIA_Autorun.exe (.not file.)
~ Keys: Scanned in 00mn 00s
---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 18 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoRecentDocsHistory"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoSMHelp"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:14/07/2009 - 02:20:28 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [453712]
O58 - SDL:13/07/2009 - 23:54:14 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [26624]
O58 - SDL:02/01/1601 - 23:00:00 ---A- . (...) -- C:\Windows\System32\Drivers\sptd.sys [691696]
O58 - SDL:14/07/2009 - 02:19:04 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [21072]
O58 - SDL:13/07/2009 - 22:40:41 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029]
O58 - SDL:13/07/2009 - 22:40:44 ---A- . (...) -- C:\Windows\System32\country.sys [27097]
O58 - SDL:13/07/2009 - 22:40:40 ---A- . (...) -- C:\Windows\System32\HIMEM.SYS [4768]
O58 - SDL:13/07/2009 - 22:40:43 ---A- . (...) -- C:\Windows\System32\KEY01.SYS [42809]
O58 - SDL:13/07/2009 - 22:40:43 ---A- . (...) -- C:\Windows\System32\KEYBOARD.SYS [42537]
O58 - SDL:13/07/2009 - 22:40:23 ---A- . (...) -- C:\Windows\System32\NTDOS.SYS [27866]
O58 - SDL:13/07/2009 - 22:40:31 ---A- . (...) -- C:\Windows\System32\NTDOS404.SYS [29146]
O58 - SDL:13/07/2009 - 22:40:35 ---A- . (...) -- C:\Windows\System32\NTDOS411.SYS [29370]
O58 - SDL:13/07/2009 - 22:40:39 ---A- . (...) -- C:\Windows\System32\NTDOS412.SYS [29274]
O58 - SDL:13/07/2009 - 22:40:27 ---A- . (...) -- C:\Windows\System32\NTDOS804.SYS [29146]
O58 - SDL:13/07/2009 - 22:40:11 ---A- . (...) -- C:\Windows\System32\NTIO.SYS [33952]
O58 - SDL:13/07/2009 - 22:40:15 ---A- . (...) -- C:\Windows\System32\NTIO404.SYS [34672]
O58 - SDL:13/07/2009 - 22:40:17 ---A- . (...) -- C:\Windows\System32\NTIO411.SYS [35776]
O58 - SDL:13/07/2009 - 22:40:19 ---A- . (...) -- C:\Windows\System32\NTIO412.SYS [35536]
O58 - SDL:13/07/2009 - 22:40:13 ---A- . (...) -- C:\Windows\System32\NTIO804.SYS [34672]
~ Drivers: 70 Legitimates Filtered in 00mn 12s
---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 14/04/2015 - 18:31:47 ---A- . (...) -- C:\Users\splendid univers\AppData\Local\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\42.0.2311.90\42.0.2311.90_41.0.2272.118_chrome_updater.exe [11017296]
O61 - LFC: 14/04/2015 - 18:31:48 ---A- . (...) -- C:\Users\splendid univers\AppData\Local\Google\Update\Install\{F41FCCB1-C470-43D5-8EA3-A7F2B9332210}\42.0.2311.90_41.0.2272.118_chrome_updater.exe [11017296]
O61 - LFC: 19/04/2015 - 18:31:47 ---A- . (...) -- C:\Users\splendid univers\AppData\Local\Google\Chrome\User Data\ev_hashes_whitelist.bin [1113849]
O61 - LFC: 19/04/2015 - 18:31:55 ---A- . (.Search Results, LLC.) -- C:\Users\splendid univers\AppData\Roaming\defaulttab\defaulttab\update.exe [1139288] =>PUP.SearchResults
~ 2271 Fichiers temporaires (Temporary files)
~ 253 Fichiers cookies (Cookies files)
~ Files: 26 Legitimates Filtered in 00mn 19s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2015 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 13/07/2009 - C:\Windows\System32\Drivers\secdrv.sys (secdrv) .(.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) - LEGACY_SECDRV
O64 - Services: CurCS - 13/12/1745 - C:\Windows\System32\Drivers\sptd.sys (sptd) .(...) - LEGACY_SPTD
~ Legacy: 136 Legitimates Filtered in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\splendid univers\AppData\Local\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- C:\Program Files\Opera\Opera.exe (.not file.)
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.key-find.com =>Hijacker.Hijacker.KeyFind
O69 - SBI: SearchScopes [HKCU] {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} - (e) - http://www.key-find.com =>Hijacker.Hijacker.KeyFind
O69 - SBI: SearchScopes [HKCU] {33BB0A4E-99AF-4226-BDF6-49120163DE86} [DefaultScope] - (key-find) - http://www.key-find.com =>Hijacker.Hijacker.KeyFind
O69 - SBI: SearchScopes [HKCU] {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} - (Search The Web) - http://www.key-find.com =>Adware.IMBooster
O69 - SBI: SearchScopes [HKCU] {A7ED8872-6AE9-41A6-B229-E2052E85C8A4} - (Search Here) - http://www.key-find.com =>Hijacker.Hijacker.KeyFind
O69 - SBI: SearchScopes [HKCU] {E733165D-CBCF-4FDA-883E-ADEF965B476C} - (Google) - http://www.key-find.com =>Hijacker.Hijacker.KeyFind
~ Keys: Scanned in 00mn 00s
---\\ Enumère les fichiers Crack & Keygen (CKF) (O82)
C:\Windows.old\Program Files\Internet Download Manager\Keygenerator.exe =>.Crack,Keygen
C:\Windows.old\Program Files\Internet Download Manager\Keygenerator.exe =>.Crack,Keygen
~ Files: Scanned in 10mn 54s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.C25A17D3E58F3C9309C224C63C7041AC] [SPRF][19/08/2014] (...) -- C:\ProgramData\ntuser.dat [262144]
[MD5.FEE1D58C6AD73F25EB0DAD4F690560AD] [SPRF][09/11/2013] (.Facebook Inc. - Setup.) -- C:\Users\splendid univers\Desktop\FacebookVideoCallSetup_v1.2.205.0.exe [501248]
[MD5.0F3E1965DDD14DADB4E72F1F53D71203] [SPRF][05/08/2010] (.Pas de propriétaire - TuDomino Solitario.) -- C:\Users\splendid univers\Desktop\tudomino_solitario.exe [4620520]
~ Files: 3 Legitimates Filtered in 00mn 00s
---\\ Recherche de clés de registre Tracing (O100)
HKLM\SOFTWARE\Microsoft\Tracing\ApnStub1_RASAPI32 =>Toolbar.Ask
HKLM\SOFTWARE\Microsoft\Tracing\ApnStub1_RASMANCS =>Toolbar.Ask
HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASAPI32 =>Toolbar.Ask
HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASMANCS =>Toolbar.Ask
HKLM\SOFTWARE\Microsoft\Tracing\DefaultTabSearch_RASAPI32 =>Adware.Bandoo
HKLM\SOFTWARE\Microsoft\Tracing\DefaultTabSearch_RASMANCS =>Adware.Bandoo
HKLM\SOFTWARE\Microsoft\Tracing\Feb16_cor_key-find_RASAPI32 =>Hijacker.Hijacker.KeyFind
HKLM\SOFTWARE\Microsoft\Tracing\Feb16_cor_key-find_RASMANCS =>Hijacker.Hijacker.KeyFind
HKLM\SOFTWARE\Microsoft\Tracing\iLividMediaBar_RASAPI32 =>Adware.Bandoo
HKLM\SOFTWARE\Microsoft\Tracing\iLividMediaBar_RASMANCS =>Adware.Bandoo
HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup-r2235-n-bf_RASAPI32 =>Adware.Bandoo
HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup-r2235-n-bf_RASMANCS =>Adware.Bandoo
HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup-r362-n-bf_RASAPI32 =>Adware.Bandoo
HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup-r362-n-bf_RASMANCS =>Adware.Bandoo
HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASAPI32 =>Adware.OpenCandy
HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASMANCS =>Adware.OpenCandy
HKLM\SOFTWARE\Microsoft\Tracing\Offercast2802_SGT__RASAPI32 =>Toolbar.Ask
HKLM\SOFTWARE\Microsoft\Tracing\Offercast2802_SGT__RASMANCS =>Toolbar.Ask
HKLM\SOFTWARE\Microsoft\Tracing\Offercast29_SGT__RASAPI32 =>Toolbar.Ask
HKLM\SOFTWARE\Microsoft\Tracing\Offercast29_SGT__RASMANCS =>Toolbar.Ask
HKLM\SOFTWARE\Microsoft\Tracing\PCPerformer_RASAPI32 =>PUP.PerformerSoft
HKLM\SOFTWARE\Microsoft\Tracing\PCPerformer_RASMANCS =>PUP.PerformerSoft
HKLM\SOFTWARE\Microsoft\Tracing\SearchProtectionStub_RASAPI32 =>Toolbar.Conduit
HKLM\SOFTWARE\Microsoft\Tracing\SearchProtectionStub_RASMANCS =>Toolbar.Conduit
HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_iLivid_RASAPI32 =>PUP.Datamngr
HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_iLivid_RASMANCS =>PUP.Datamngr
HKLM\SOFTWARE\Microsoft\Tracing\smileyswelove_RASAPI32 =>Adware.SmileyBar
HKLM\SOFTWARE\Microsoft\Tracing\smileyswelove_RASMANCS =>Adware.SmileyBar
HKLM\SOFTWARE\Microsoft\Tracing\SmileysWeLove_SetupS_cdn_RASAPI32 =>Adware.SmileyBar
HKLM\SOFTWARE\Microsoft\Tracing\SmileysWeLove_SetupS_cdn_RASMANCS =>Adware.SmileyBar
HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_pour_damnvid_RASAPI32 =>Toolbar.Conduit
HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_pour_damnvid_RASMANCS =>Toolbar.Conduit
HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_pour_nokia-suite_RASAPI32 =>Toolbar.Conduit
HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_pour_nokia-suite_RASMANCS =>Toolbar.Conduit
HKLM\SOFTWARE\Microsoft\Tracing\webcake0710-0E58_RASAPI32 =>Adware.WebCake
HKLM\SOFTWARE\Microsoft\Tracing\webcake0710-0E58_RASMANCS =>Adware.WebCake
HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32 =>Adware.WebCake
HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS =>Adware.WebCake
~ BTK: 398 Legitimates Filtered in 00mn 00s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 15/04/2015 268464 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 12/04/2015 148080 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Auto 31/03/2015 868352 | (SettingsGuard) . (...) - C:\Users\splendid univers\AppData\Roaming\SettingsGuard\updater.exe
SS - | Auto 02/01/2015 315488 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe
SS - | Disabled 14/07/2009 20992 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 22/11/2013 107520 | (DefaultTabUpdate) . (...) - C:\Users\splendid univers\AppData\Roaming\defaulttab\defaulttab\dtupdate.exe =>Adware.Bandoo
SR - | Auto 10/04/2008 1392016 | (Flexlm Service 1) . (.Acresso Software Inc..) - C:\SIMULIA\License\lmgrd.exe
SR - | Auto 16/01/2015 158896 | (IHProtect Service) . (.XTab system.) - C:\Program Files\XTab\ProtectService.exe =>Adware.AgentODR
SR - | Auto 08/06/2008 877864 | (Nero BackItUp Scheduler 3) . (.Nero AG.) - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
SR - | Demand 24/06/2008 537896 | (NMIndexingService) . (.Nero AG.) - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
SR - | Auto 19/12/2006 81920 | (PLFlash DeviceIoControl Service) . (.Prolific Technology Inc..) - C:\Windows\system32\IoctlSvc.exe
SR - | Demand 18/04/2013 737616 | (ServiceLayer) . (.Nokia.) - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
SR - | Auto 05/05/2008 4493312 | (Texis Monitor) . (.Expansion Programs International, Inc..) - C:\SIMULIA\Documentation\monitor.exe
SR - | Auto 14/07/2009 20992 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 17s
---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by splendid univers at 19/04/2015 18:43:27
device: opened successfully
user: MBR read successfully
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys spjb.sys halmacpi.dll >>UNKNOWN [0x84F60938]<<
C:\Windows\system32\DRIVERS\iaStor.sys Intel Corporation Intel Rapid Storage Technology driver
System32\Drivers\spjb.sys
1 ntkrnlpa!IofCallDriver[0x82E5A458] >> \Device\Harddisk0\DR0[0x87C49530]
kernel: MBR read successfully
user & kernel MBR OK
~ MBR: 14 Legitimates Filtered in 00mn 02s
---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by splendid univers at 19/04/2015 18:43:29
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 04s
---\\ Liste des émulateurs de CD/DVD (MBR Hook)
O58 - SDL:02/01/1601 - 23:00:00 ---A- . (...) -- C:\Windows\System32\Drivers\sptd.sys [691696]
~ Emulateurs: Scanned in 00mn 04s
---\\ Scan Additionnel (O88)
Database Version : 13008 - (17/04/2015)
Clés trouvées (Keys found) : 28
Valeurs trouvées (Values found) : 2
Dossiers trouvés (Folders found) : 17
Fichiers trouvés (Files found) : 25
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}] =>PUP.SupTab^
[HKLM\SYSTEM\CurrentControlSet\Services\DefaultTabUpdate] =>Adware.Bandoo^
[HKLM\SYSTEM\CurrentControlSet\Services\IHProtect Service] =>Adware.AgentODR^
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}] =>PUP.V9Software
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}] =>PUP.V9Software
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}] =>PUP.ToolbarCleaner
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F6AFBF1-E065-4627-A2FD-810366367D01}] =>Toolbar.Agent
[HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F6AFBF1-E065-4627-A2FD-810366367D01}] =>Toolbar.Agent
[HKLM\Software\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}] =>Spyware.Soft2PC
[HKCU\Software\APN PIP] =>Toolbar.Ask
[HKLM\Software\DataMngr] =>Adware.Bandoo
[HKCU\Software\default tab] =>Adware.IMBooster
[HKLM\Software\default tab] =>Adware.IMBooster
[HKCU\Software\defaulttab] =>Adware.IMBooster
[HKCU\Software\AppDataLow\Software\defaulttab] =>Adware.IMBooster
[HKLM\Software\defaulttab] =>Adware.IMBooster
[HKCU\Software\ilivid] =>Adware.Bandoo
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKLM\Software\Tarma Installer] =>PUP.Tarma
[HKCU\Software\InstallCore] =>Adware.InstallCore
[HKCU\Software\AppDataLow\Software\Crossrider] =>PUP.CrossRider
[HKCU\Software\InstalledBrowserExtensions\] =>PUP.CrossRider
[HKLM\Software\Microsoft\Tracing\WebCakeDesktop_RASAPI32] =>Adware.WebCake
[HKLM\Software\Microsoft\Tracing\WebCakeDesktop_RASMANCS] =>Adware.WebCake
[HKCU\Software\InstalledBrowserExtensions] =>PUP.CrossRider
[HKLM\Software\InstalledBrowserExtensions] =>PUP.CrossRider
[HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220622792277}] =>PUP.CrossRider
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611791177}] =>PUP.CrossRider
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:iLivid =>Adware.Bandoo^
C:\Users\splendid univers\AppData\Roaming\Mozilla\Firefox\Profiles\azynzyii.default\extensions\faststartff@gmail.com =>PUP.FastStart^
C:\Users\splendid univers\AppData\Roaming\Mozilla\Firefox\Profiles\azynzyii.default\extensions\fftoolbar2014@etech.com =>Adware.FFToolBar^
C:\Users\splendid univers\AppData\Roaming\Mozilla\Firefox\Profiles\azynzyii.default\extensions\searchengine@gmail.com =>PUP.SearchEngine^
C:\Program Files\MyPC Backup =>PUP.MyPCBackup^
C:\Program Files\RelevantKnowledge =>Adware.RelevantKnowledge^
C:\Program Files\SiteLookup =>PUP.SiteLookup^
C:\Program Files\SuperPlusRadio v2.1 =>PUP.SuperPlusRadio^
C:\ProgramData\Tarma Installer =>PUP.Tarma^
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge =>Adware.RelevantKnowledge^
C:\Users\splendid univers\AppData\Roaming\defaulttab =>Adware.Bandoo^
C:\Users\splendid univers\AppData\Roaming\key-find =>Hijacker.Hijacker.KeyFind^
C:\Users\splendid univers\AppData\Roaming\Movdap =>Adware.WebCake^
C:\Users\splendid univers\AppData\Roaming\OpenCandy =>Adware.OpenCandy^
C:\Users\splendid univers\AppData\Roaming\RHEng =>PUP.Conduit^
C:\Users\splendid univers\AppData\Local\CodecPerformer =>PUP.CodecPerformer^
C:\Program Files\GamingWonderlandEI =>Adware.MyWebSearch
C:\Users\splendid univers\AppData\Roaming\SimilarSites =>Adware.SimilarSites
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSetProgramAccessAndDefaults: Modified =>PUA.StartShow^
C:\Program Files\XTab\cmdshell.exe =>PUP.SearchProtect^
C:\Windows\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-1.job =>PUP.CrossRider^
C:\Windows\System32\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-1 =>PUP.CrossRider^
C:\Windows\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-4.job =>PUP.CrossRider^
C:\Windows\System32\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-4 =>PUP.CrossRider^
C:\Windows\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-6.job =>PUP.CrossRider^
C:\Windows\System32\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-6 =>PUP.CrossRider^
C:\Windows\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-7.job =>PUP.CrossRider^
C:\Windows\System32\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-7 =>PUP.CrossRider^
[HKCU\Software\Default Tab] =>Adware.Bandoo^
[HKCU\Software\DefaultTab] =>Adware.Bandoo^
[HKCU\Software\Popajar] =>Toolbar.Conduit^
[HKCU\Software\ProductSetup] =>Adware.InstallCore^
[HKCU\Software\SmileysWeLove] =>Adware.SmileyBar^
[HKCU\Software\SuperPlusRadio v2.1-nv] =>PUP.SuperPlusRadio^
[HKCU\Software\SuperPlusRadio v2.1] =>PUP.SuperPlusRadio^
[HKCU\Software\iLivid] =>Adware.Bandoo^
[HKLM\Software\Default Tab] =>Adware.Bandoo^
[HKLM\Software\DefaultTab] =>Adware.Bandoo^
[HKLM\Software\SiteFinder] =>Adware.ShoppingReport^
[HKLM\Software\SupDp] =>PUP.SupTab^
[HKLM\Software\SuperPlusRadio v2.1-nv] =>PUP.SuperPlusRadio^
[HKLM\Software\SuperPlusRadio v2.1] =>PUP.SuperPlusRadio^
[HKLM\Software\supTab] =>PUP.SupTab^
~ Additionnel Scan: 266690 Items scanned in 00mn 37s
---\\ Informations complémentaires sur les modules
~ http://nicolascoolman.fr/r5-internet-explorer-proxy-management-iepm/ =>.Internet Explorer, Proxy Management (R5)
~ http://nicolascoolman.fr/o2-browser-helper-objects-de-navigateur/ =>.Browser Helper Objects de navigateur (O2)
~ http://nicolascoolman.fr/o3-internet-explorer-toolbars/ =>.Internet Explorer Toolbars (O3)
~ http://nicolascoolman.fr/o4-applications-demarrees-par-le-registre/ =>.Applications lancées au démarrage du système (O4)
~ http://nicolascoolman.fr/o50-image-file-execution-options-zhpdiag/ =>.Image File Execution Options (IFEO) (O50)
~ http://nicolascoolman.fr/o51-mountpoints2-shell-key-mpsk/ =>.Clé de registre Shell MountPoints2 (MPSK) (O51)
~ AMI: 6 Legitimates Filtered in 00mn 00s
---\\ Récapitulatif des détections trouvées sur votre station
http://nicolascoolman.fr/pua-startshow =>PUA.StartShow
http://nicolascoolman.fr/pup-searchprotect =>PUP.SearchProtect
http://www.nicolascoolman.fr/blog/ =>Hijacker.Hijacker.KeyFind
http://www.nicolascoolman.fr/blog/ =>PUP.FastStart
http://www.nicolascoolman.fr/blog/ =>Adware.FFToolBar
http://www.nicolascoolman.fr/blog/ =>PUP.SearchEngine
http://nicolascoolman.fr/pup-suptab =>PUP.SupTab
http://www.nicolascoolman.fr/blog/ =>PUP.GreenTreeApp
http://nicolascoolman.fr/adware-bandoo =>Adware.Bandoo
http://www.nicolascoolman.fr/blog/ =>Adware.AgentODR
http://nicolascoolman.fr/pup-moviestoolbar =>PUP.MoviesToolbar
http://www.nicolascoolman.fr/blog/ =>PUP.SuperPlusRadio
http://www.nicolascoolman.fr/blog/ =>PUP.PCPerformer
http://nicolascoolman.fr/pup-crossrider =>PUP.CrossRider
http://nicolascoolman.fr/adware-installcore =>Adware.InstallCore
http://www.nicolascoolman.fr/blog/ =>PUP.BrowserExtensions
http://nicolascoolman.fr/toolbar-conduit =>Toolbar.Conduit
http://nicolascoolman.fr/adware-smileybar =>Adware.SmileyBar
http://nicolascoolman.fr/adware-shoppingreport =>Adware.ShoppingReport
http://nicolascoolman.fr/pup-tarma =>PUP.Tarma
http://nicolascoolman.fr/pup-mypcbackup =>PUP.MyPCBackup
http://nicolascoolman.fr/adware-relevantknowledge =>Adware.RelevantKnowledge
http://www.nicolascoolman.fr/blog/ =>PUP.SiteLookup
http://nicolascoolman.fr/adware-webcake =>Adware.WebCake
http://nicolascoolman.fr/adware-opencandy =>Adware.OpenCandy
http://www.nicolascoolman.fr/blog/ =>PUP.Conduit
http://www.nicolascoolman.fr/blog/ =>PUP.CodecPerformer
http://nicolascoolman.fr/pup-bitguard =>PUP.BitGuard
http://nicolascoolman.fr/hijacker-eazel =>Hijacker.Eazel
http://nicolascoolman.fr/pup-browsersafeguard =>PUP.BrowserSafeguard
http://nicolascoolman.fr/trojan-staser =>Trojan.Staser
http://nicolascoolman.fr/spyware-protectedsearch =>Spyware.ProtectedSearch
http://nicolascoolman.fr/adware-searchsettings =>Adware.SearchSettings
http://nicolascoolman.fr/hijacker-smartbar =>Hijacker.SmartBar
http://nicolascoolman.fr/pup-jumpflip =>PUP.JumpFlip
http://nicolascoolman.fr/pup-searchresults =>PUP.SearchResults
http://nicolascoolman.fr/adware-imbooster =>Adware.IMBooster
http://nicolascoolman.fr/toolbar-ask =>Toolbar.Ask
http://www.nicolascoolman.fr/blog/ =>PUP.PerformerSoft
http://nicolascoolman.fr/pup-datamngr =>PUP.Datamngr
http://nicolascoolman.fr/pup-v9software =>PUP.V9Software
http://nicolascoolman.fr/pup-toolbarcleaner =>PUP.ToolbarCleaner
http://www.nicolascoolman.fr/blog/ =>Toolbar.Agent
http://nicolascoolman.fr/spyware-soft2pc =>Spyware.Soft2PC
http://nicolascoolman.fr/adware-mywebsearch =>Adware.MyWebSearch
http://nicolascoolman.fr/adware-similarsites =>Adware.SimilarSites
~ MSI: 46 link(s) detected in 00mn 00s
~ 887 Legitimates filtered by white list
End of the scan (778 lines in 13mn 13s)(2.2)
~ Lancé par splendid univers (19/04/2015 18:30:54)
~ Facebook : https://www.facebook.com/nicolascoolman1
~ Adresse du Forum http://forum.nicolascoolman.fr
~ Traduit par Nicolas Coolman
~ Etat de la version : Version à jour.
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by user
---\\ Navigateurs Internet
MSIE: Internet Explorer v9.0.8112.16421
MFIE: Mozilla Firefox 37.0.1 (Defaut)
GCIE: Google Chrome v42.0.2311.90
---\\ Informations sur les produits Windows
~ Langage: Français
Windows Server License Manager Script : OK
---\\ Logiciels de protection du système
Windows Defender W7 (Activate)
---\\ Logiciels d'optimisation du système
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 17 NPAPI
---\\ Informations sur le système
~ Processor: x86 Family 6 Model 37 Stepping 5, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1906 MB (13% free)
System Restore: Activé (Enable)
System drive C: has 33 GB (31%) free of 103 GB
---\\ Mode de connexion au système
~ Computer Name: SPLENDIDUNIVERS
~ User Name: splendid univers
~ All Users Names: splendid univers, Administrateur,
~ Unselected Option: None
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\splendid univers\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\splendid univers\AppData\Roaming\
~ %Desktop% : C:\Users\splendid univers\Desktop\
~ %Favorites% : C:\Users\splendid univers\Favorites\
~ %LocalAppData% : C:\Users\splendid univers\AppData\Local\
~ %StartMenu% : C:\Users\splendid univers\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 33 Go of 103 Go)
D: Hard drive, Flash drive, Thumb drive (Free 42 Go of 195 Go)
E: CD-ROM drive (Not Inserted)
F: Floppy drive, Flash card reader, USB Key (Not Inserted)
---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] UacDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowMyGames: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowPrinters: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSetProgramAccessAndDefaults: Modified =>PUA.StartShow
~ Security Center: 42 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.3A827FCB4682700CF199B78DEADFE0F0] - (.Microsoft Corporation - Explorateur Windows.) (.16/03/2010 - 08:17:20.) -- C:\Windows\Explorer.exe [2614272]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:14:45.) -- C:\Windows\System32\Wininit.exe [96256]
[MD5.C8ADAA6948993D839D14524847EA5B75] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.10/11/2013 - 21:02:07.) -- C:\Windows\System32\wininet.dll [1129472]
[MD5.37CDB7E72EB66BA85A87CBE37E7F03FD] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.16/03/2010 - 08:17:20.) -- C:\Windows\System32\Winlogon.exe [285696]
[MD5.58C94EAE54BF0C5E2B80B2E5E7744D4C] - (.Microsoft Corporation - Bibliothèque de licences.) (.14/07/2009 - 02:16:15.) -- C:\Windows\System32\sppcomapi.dll [193024]
[MD5.DDC040FDB01EF1712A6B13E52AFB104C] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.14/07/2009 - 00:12:38.) -- C:\Windows\system32\Drivers\AFD.sys [338944]
[MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:26:15.) -- C:\Windows\system32\Drivers\atapi.sys [21584]
[MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:11:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656]
[MD5.BA6E70AA0E6091BC39DE29477D866A77] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.14/07/2009 - 00:11:26.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544]
[MD5.8E09E52EE2E3CEB199EF3DD99CF9E3FB] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.14/07/2009 - 00:14:17.) -- C:\Windows\system32\Drivers\DfsC.sys [78336]
[MD5.717A2207FD6F13AD3E664C7D5A43C7BF] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.14/07/2009 - 00:50:56.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544]
[MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:11:24.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896]
[MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 00:54:29.) -- C:\Windows\system32\Drivers\IpNat.sys [101888]
[MD5.F1B6AA08497EA86CA6EF6F7A08B0BFB8] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.14/04/2010 - 14:04:07.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123392]
[MD5.DD52A733BF4CA5AF84562A5E2F963B91] - (.Microsoft Corporation - MBT Transport driver.) (.14/07/2009 - 00:12:21.) -- C:\Windows\system32\Drivers\netBT.sys [187904]
[MD5.3795DCD21F740EE799FB7223234215AF] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.14/07/2009 - 02:20:44.) -- C:\Windows\system32\Drivers\ntfs.sys [1210432]
[MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 00:45:35.) -- C:\Windows\system32\Drivers\Parport.sys [79360]
[MD5.D9F91EAFEC2815365CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.14/07/2009 - 00:54:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848]
[MD5.C5FF95883FFEF704D50C40D21CFB3AB5] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.14/07/2009 - 01:02:58.) -- C:\Windows\system32\Drivers\rdpdr.sys [133120]
[MD5.3E21C083B8A01CB70BA1F09303010FCE] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 00:53:41.) -- C:\Windows\system32\Drivers\smb.sys [71168]
[MD5.CB39E896A2A83702D1737BFD402B3542] - (.Microsoft Corporation - TDI Translation Driver.) (.14/07/2009 - 00:12:11.) -- C:\Windows\system32\Drivers\tdx.sys [74240]
[MD5.58DF9D2481A56EDDE167E51B334D44FD] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.14/07/2009 - 02:19:10.) -- C:\Windows\system32\Drivers\volsnap.sys [245328]
~ Generic Processes: Scanned in 00mn 01s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes Favoris (My Favorites) : 0/11
~ Mes Documents (My Documents) : 1/2
~ Mon Bureau (My Desktop) : 2/40
~ Menu demarrer (Programs) : 0/32
~ Hidden Files: Scanned in 00mn 00s
---\\ Processus lancés
[MD5.7139E7EEA74966995148B16B8559819D] - (.Intel Corporation - igfxTray Module.) -- C:\Windows\System32\igfxtray.exe [138008] [PID.352]
[MD5.356A26CB1A7FA81BE22CDDBE77067B76] - (.Intel Corporation - hkcmd Module.) -- C:\Windows\System32\hkcmd.exe [171288] [PID.396]
[MD5.57EE515BD3E9C76EDD7D4414C95104A5] - (.Intel Corporation - persistence Module.) -- C:\Windows\System32\igfxpers.exe [172824] [PID.528]
[MD5.E7FF908CAC792A6DB16F2D4BB775FC95] - (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10082920] [PID.1060]
[MD5.DE32A4D2B4CB6ADD8FFE74856B64946C] - (.Realtek Semiconductor - HD Audio Background Process.) -- C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [1546856] [PID.1924]
[MD5.77590CE0CDEB6BBEE8DC056FEA0B107C] - (.SearchProtect - CmdShell.exe.) -- C:\Program Files\XTab\cmdshell.exe [48304] [PID.2280] =>PUP.SearchProtect
[MD5.1606CBD0193E93952CD4EACDC9229651] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe [271744] [PID.2992]
[MD5.C44031488DED58FCE58E5D94BC345D30] - (.Nero AG - Nero Home.) -- C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1840424] [PID.3212]
[MD5.475A2BC64E0FF011C8C9AFC418E8E40D] - (.ultracopier.first-world.info - Supercopier under GPL3.) -- C:\Program Files\Supercopier\supercopier.exe [178688] [PID.3232]
[MD5.16F1D5CF6465FCA139FA289648B349EE] - (.Nokia - Nokia PC Internet Access.) -- C:\Program Files\Nokia\PC Internet Access\NPCIA.exe [663552] [PID.3464]
[MD5.10AA923C7622D57C3D4B1D9A4EAF14BC] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe [31344744] [PID.3476]
[MD5.2481529EC3A9A030481545B70B119CCB] - (.Nokia - Nokia Suite.) -- C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe [1092448] [PID.3496]
[MD5.58FBD16C4BB84D9F69C25F30DAA4CE31] - (.Nokia - Microsoft Bluetooth Media Server.) -- C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe [158032] [PID.3124]
[MD5.C04D8BC933470B3913E4E3E6C3115793] - (.XTab system - SupHPNot.exe.) -- C:\Program Files\XTab\HPNotify.exe [673968] [PID.4208]
[MD5.C830F4E9E1C93EDDADB6929D2CFEDC85] - (.Oracle Corporation - Java(TM) Update Checker.) -- C:\Program Files\Common Files\Java\Java Update\jucheck.exe [530816] [PID.4336]
[MD5.7CFD590987D2BB33D5D56D98093D2E76] - (.Adobe Systems Incorporated - Adobe Updater.) -- C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe [2521464] [PID.1628]
[MD5.BB69268B5F4277A1CFC36A237E27FD87] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe [376944] [PID.5692]
[MD5.831F8FAE0BFFCF8BA05082E5C5DB8CB3] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files\Mozilla Firefox\plugin-container.exe [267888] [PID.5304]
[MD5.66F6B3894132CC3D347CB85FBAE48D57] - (.Adobe Systems, Inc. - Adobe Flash Player 17.0 r0.) -- C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe [1892528] [PID.3716]
[MD5.62A3B7A12578B3B595253342B982BDA7] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8198144] [PID.4380]
~ Processes Running: Scanned in 00mn 02s
---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\splendid univers\AppData\Local\Google\Chrome\User Data\Default\Preferences
---\\ Liste des dossiers d'extension Google Chrome
~ Google Lines Browser: 7 Legitimates Filtered in 00mn 01s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\splendid univers\AppData\Roaming\Mozilla\Firefox\Profiles\azynzyii.default\prefs.js
C:\Users\splendid univers\AppData\Roaming\Mozilla\Firefox\Profiles\azynzyii.default\user.js
M3 - MFPP: Plugins - [splendid univers] -- C:\Users\splendid univers\AppData\Roaming\Mozilla\Firefox\Profiles\azynzyii.default\searchplugins\ask-web-search.xml
M3 - MFPP: Plugins - [splendid univers] -- C:\Users\splendid univers\AppData\Roaming\Mozilla\Firefox\Profiles\azynzyii.default\searchplugins\key-find.xml =>Hijacker.Hijacker.KeyFind
M2 - MFEP: prefs.js [splendid univers - azynzyii.default\abs@avira.com] [] Segurança do navegador Avira v1.4.6 (..)
M2 - MFEP: prefs.js [splendid univers - azynzyii.default\faststartff@gmail.com] [] Fast Start v1.4.6 (..) =>PUP.FastStart
M2 - MFEP: prefs.js [splendid univers - azynzyii.default\fftoolbar2014@etech.com] [] FF Toolbar v1.0.0.1025 (..) =>Adware.FFToolBar
M2 - MFEP: prefs.js [splendid univers - azynzyii.default\searchengine@gmail.com] [] Search Enginer v1.0.0.1027 (..) =>PUP.SearchEngine
P2 - FPN: [HKLM] [@nokia.com/EnablerPlugin] - (.Pas de propriétaire - Nokia Suite Enabler Plugin.) -- C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll
P2 - FPN: [HKLM] [@t-immersion.com/DFusionHomeWebPlugIn] - (.Total Immersion - D'Fusion @Home Web Plug-In (3.10.17859.0).) -- C:\Program Files\Total Immersion\DFusionHomeWebPlugIn\NPDFusionWebFirefox.dll
~ Firefox Browser: 25 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.key-find.com =>Hijacker.Hijacker.KeyFind
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.key-find.com =>Hijacker.Hijacker.KeyFind
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.key-find.com =>Hijacker.Hijacker.KeyFind
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.key-find.com =>Hijacker.Hijacker.KeyFind
~ IE Browser: 13 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\System32\Userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (21)
~ Hosts File: Scanned in 00mn 00s
---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} . (.Thinknice Co. Limited - SupTab setup package.) -- C:\Program Files\XTab\SupTab.dll =>PUP.SupTab
~ BHO: 14 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{5347542D-5637-006A-76A7-7A786E7484D7} Clé orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: YTD Video Downloader.lnk . (.GreenTree Applications SRL - YTD Video Downloader.) -- C:\Program Files\GreenTree Applications\YTD Video Downloader\ytd.exe =>PUP.GreenTreeApp
~ Global Startup: 1 Legitimates Filtered in 00mn 01s
---\\ Applications lancées au démarrage du système (O4)
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe =>.Realtek Semiconductor Corp
O4 - HKLM\..\Run: [RtHDVBg] . (.Realtek Semiconductor - HD Audio Background Process.) -- C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
O4 - HKLM\..\Run: [NBKeyScan] . (.Nero AG - Nero BackItUp.) -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
O4 - HKLM\..\Run: [tdzmnrhfku] \B C:\ProgramData\tdzmnrhfku..vbs (.not file.)
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKCU\..\Run: [WebcamMaxAutoRun] . (.CoolwareMax - WebcamMax.) -- C:\Program Files\WebcamMax\WebcamMax.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] . (.Nero AG - Nero Home.) -- C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
O4 - HKCU\..\Run: [ultracopier] . (.ultracopier.first-world.info - Supercopier under GPL3.) -- C:\Program Files\Supercopier\supercopier.exe
O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Users\splendid univers\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\splendid univers\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc
O4 - HKCU\..\Run: [NokiaPCInternetAccess] . (.Nokia - Nokia PC Internet Access.) -- C:\Program Files\Nokia\PC Internet Access\NPCIA.exe
O4 - HKCU\..\Run: [iLivid] C:\Users\splendid univers\AppData\Local\iLivid\iLivid.exe (.not file.) =>Adware.Bandoo
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe =>.Skype Technologies S.A.
O4 - HKCU\..\Run: [tdzmnrhfku] \B C:\ProgramData\tdzmnrhfku..vbs (.not file.)
O4 - HKCU\..\Run: [NokiaSuite.exe] . (.Nokia - Nokia Suite.) -- C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe
O4 - HKCU\..\Run: [Viber] C:\Users\splendid univers\AppData\Local\Viber\Viber.exe (.not file.)
O4 - HKUS\.DEFAULT\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-18\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [WebcamMaxAutoRun] . (.CoolwareMax - WebcamMax.) -- C:\Program Files\WebcamMax\WebcamMax.exe
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] . (.Nero AG - Nero Home.) -- C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [ultracopier] . (.ultracopier.first-world.info - Supercopier under GPL3.) -- C:\Program Files\Supercopier\supercopier.exe
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Users\splendid univers\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\splendid univers\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [NokiaPCInternetAccess] . (.Nokia - Nokia PC Internet Access.) -- C:\Program Files\Nokia\PC Internet Access\NPCIA.exe
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [iLivid] C:\Users\splendid univers\AppData\Local\iLivid\iLivid.exe (.not file.) =>Adware.Bandoo
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe =>.Skype Technologies S.A.
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [tdzmnrhfku] \B C:\ProgramData\tdzmnrhfku..vbs (.not file.)
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [NokiaSuite.exe] . (.Nokia - Nokia Suite.) -- C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe
O4 - HKUS\S-1-5-21-849525796-146659326-278252309-1000\..\Run: [Viber] C:\Users\splendid univers\AppData\Local\Viber\Viber.exe (.not file.)
~ Application: Scanned in 00mn 02s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- C:\Program Files\Skype\Toolbars\Internet Explorer\icon.ico
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{ED8488CC-19DC-40FE-B4D4-AC26B1D3EE80}: DhcpNameServer = 192.168.1.1 0.0.0.0
O17 - HKLM\System\CS1\Services\Tcpip\..\{ED8488CC-19DC-40FE-B4D4-AC26B1D3EE80}: DhcpNameServer = 192.168.1.1 0.0.0.0
O17 - HKLM\System\CS2\Services\Tcpip\..\{ED8488CC-19DC-40FE-B4D4-AC26B1D3EE80}: DhcpNameServer = 192.168.1.1 0.0.0.0
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 0.0.0.0
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: DefaultTabUpdate (DefaultTabUpdate) . (...) - C:\Users\splendid univers\AppData\Roaming\defaulttab\defaulttab\dtupdate.exe =>Adware.Bandoo
O23 - Service: Flexlm Service 1 (Flexlm Service 1) . (.Acresso Software Inc. - Pas de description.) - C:\SIMULIA\License\lmgrd.exe
O23 - Service: IHProtect Service (IHProtect Service) . (.XTab system - ProtectSvc.exe.) - C:\Program Files\XTab\ProtectService.exe =>Adware.AgentODR
O23 - Service: SettingsGuard (SettingsGuard) . (...) - C:\Users\splendid univers\AppData\Roaming\SettingsGuard\updater.exe
~ Services: 8 Legitimates Filtered in 00mn 03s
---\\ Clés Session Manager (AppCertDlls,KnownDLLs) (O36)
O36 - AppCertDlls: (x64) . (...) -- c:\program files\movies toolbar\datamngr\x64\apcrtldr.dll (Not file) =>PUP.MoviesToolbar
~ Keys: Scanned in 00mn 00s
---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [251724b4-67d8-4ba7-bddc-fb697152dd97-1] (...) -- C:\Program Files\SuperPlusRadio v2.1\SuperPlusRadio v2.1-codedownloader.exe (.not file.) [0] =>PUP.SuperPlusRadio
[MD5.00000000000000000000000000000000] [APT] [251724b4-67d8-4ba7-bddc-fb697152dd97-4] (...) -- C:\Program Files\SuperPlusRadio v2.1\251724b4-67d8-4ba7-bddc-fb697152dd97-4.exe (.not file.) [0] =>PUP.SuperPlusRadio
[MD5.00000000000000000000000000000000] [APT] [251724b4-67d8-4ba7-bddc-fb697152dd97-6] (...) -- C:\Program Files\SuperPlusRadio v2.1\251724b4-67d8-4ba7-bddc-fb697152dd97-6.exe (.not file.) [0] =>PUP.SuperPlusRadio
[MD5.00000000000000000000000000000000] [APT] [251724b4-67d8-4ba7-bddc-fb697152dd97-7] (...) -- C:\Program Files\SuperPlusRadio v2.1\251724b4-67d8-4ba7-bddc-fb697152dd97-7.exe (.not file.) [0] =>PUP.SuperPlusRadio
[MD5.00000000000000000000000000000000] [APT] [DTReg] (...) -- C:\Users\splendid univers\AppData\Roaming\defaulttab\defaulttab\DTReg.exe (.not file.) [0] =>Adware.Bandoo
[MD5.00000000000000000000000000000000] [APT] [PC Performer Daily Check] (...) -- C:\Program Files\PC Performer\PSCheckUp.exe (.not file.) [0] =>PUP.PCPerformer
[MD5.00000000000000000000000000000000] [APT] [PC Performer Logon Scan] (...) -- C:\Program Files\PC Performer\PCPerformer.exe (.not file.) [0] =>PUP.PCPerformer
[MD5.00000000000000000000000000000000] [APT] [PC Performer Scheduled Scan] (...) -- C:\Program Files\PC Performer\PCPerformer.exe (.not file.) [0] =>PUP.PCPerformer
[MD5.00000000000000000000000000000000] [APT] [{1775BE24-361D-40CC-8757-D599DC0A9386}] (...) -- H:\SetupOviPlayer.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{6C76EADA-7E1D-4414-BF16-84B2993D3DEC}] (...) -- C:\Users\splendid univers\Desktop\Nokia_PC_Suite_ALL.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{876B662C-5DA7-44B8-B673-93736D495437}] (...) -- C:\Program Files\Avira\AntiVir Desktop\setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{D4DFC8DE-D0E7-43C5-85A4-30A04A97F528}] (...) -- C:\Users\splendid univers\Desktop\sonelgaz\avast\vpsupd4.exe (.not file.) [0]
O39 - APT: 251724b4-67d8-4ba7-bddc-fb697152dd97-1 - (...) -- C:\Windows\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-1.job [3132] =>PUP.CrossRider
O39 - APT: 251724b4-67d8-4ba7-bddc-fb697152dd97-1 - (...) -- C:\Windows\System32\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-1 [3132] =>PUP.CrossRider
O39 - APT: 251724b4-67d8-4ba7-bddc-fb697152dd97-4 - (...) -- C:\Windows\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-4.job [4500] =>PUP.CrossRider
O39 - APT: 251724b4-67d8-4ba7-bddc-fb697152dd97-4 - (...) -- C:\Windows\System32\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-4 [4500] =>PUP.CrossRider
O39 - APT: 251724b4-67d8-4ba7-bddc-fb697152dd97-6 - (...) -- C:\Windows\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-6.job [5524] =>PUP.CrossRider
O39 - APT: 251724b4-67d8-4ba7-bddc-fb697152dd97-6 - (...) -- C:\Windows\System32\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-6 [5524] =>PUP.CrossRider
O39 - APT: 251724b4-67d8-4ba7-bddc-fb697152dd97-7 - (...) -- C:\Windows\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-7.job [5188] =>PUP.CrossRider
O39 - APT: 251724b4-67d8-4ba7-bddc-fb697152dd97-7 - (...) -- C:\Windows\System32\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-7 [5188] =>PUP.CrossRider
O39 - APT: - (..) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater [1002]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-849525796-146659326-278252309-1000Core [950]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-849525796-146659326-278252309-1000UA [972]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-849525796-146659326-278252309-1000Core [1070]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-849525796-146659326-278252309-1000UA [1122]
~ Scheduled Task: 39 Legitimates Filtered in 00mn 07s
---\\ Logiciels installés (O42)
O42 - Logiciel: SettingsGuard - (.SmartCyberTechnology.) [HKLM] -- SettingsGuardService
~ Logic: 2 Legitimates Filtered in 00mn 00s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\APN PIP]
[HKCU\Software\Default Tab] =>Adware.Bandoo
[HKCU\Software\DefaultTab] =>Adware.Bandoo
[HKCU\Software\InstallCore] =>Adware.InstallCore
[HKCU\Software\InstalledBrowserExtensions] =>PUP.BrowserExtensions
[HKCU\Software\Popajar] =>Toolbar.Conduit
[HKCU\Software\ProductSetup] =>Adware.InstallCore
[HKCU\Software\SmileysWeLove] =>Adware.SmileyBar
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKCU\Software\SuperPlusRadio v2.1-nv] =>PUP.SuperPlusRadio
[HKCU\Software\SuperPlusRadio v2.1] =>PUP.SuperPlusRadio
[HKCU\Software\iLivid] =>Adware.Bandoo
[HKLM\Software\Default Tab] =>Adware.Bandoo
[HKLM\Software\DefaultTab] =>Adware.Bandoo
[HKLM\Software\InstalledBrowserExtensions] =>PUP.BrowserExtensions
[HKLM\Software\SiteFinder] =>Adware.ShoppingReport
[HKLM\Software\SupDp] =>PUP.SupTab
[HKLM\Software\SuperPlusRadio v2.1-nv] =>PUP.SuperPlusRadio
[HKLM\Software\SuperPlusRadio v2.1] =>PUP.SuperPlusRadio
[HKLM\Software\Tarma Installer] =>PUP.Tarma
[HKLM\Software\WanDrv]
[HKLM\Software\supTab] =>PUP.SupTab
[HKLM\Software\tdzmnrhfku]
~ Key Software: 157 Legitimates Filtered in 00mn 00s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 27/01/2015 - 17:56:21 - [0] ----D C:\Program Files\ccbb3e89-3a64-46b3-b29b-48d9bd2e46c5
O43 - CFD: 18/04/2015 - 14:02:39 - [] ----D C:\Program Files\CMAK
O43 - CFD: 17/04/2015 - 13:02:29 - [] ----D C:\Program Files\dlsecuretb
O43 - CFD: 03/08/2013 - 14:54:51 - [] ----D C:\Program Files\MyPC Backup =>PUP.MyPCBackup
O43 - CFD: 22/02/2015 - 17:37:05 - [] ----D C:\Program Files\RelevantKnowledge =>Adware.RelevantKnowledge
O43 - CFD: 02/06/2014 - 21:40:01 - [0] ----D C:\Program Files\SiteLookup =>PUP.SiteLookup
O43 - CFD: 22/02/2015 - 17:37:04 - [] ----D C:\Program Files\SuperPlusRadio v2.1 =>PUP.SuperPlusRadio
O43 - CFD: 31/07/2013 - 11:35:59 - [] ----D C:\Program Files\Windows GT
O43 - CFD: 25/02/2015 - 21:33:56 - [] ----D C:\Program Files\XTab
O43 - CFD: 20/08/2013 - 22:01:08 - [] ----D C:\ProgramData\APN
O43 - CFD: 26/09/2013 - 20:10:14 - [] ----D C:\ProgramData\Tarma Installer =>PUP.Tarma
O43 - CFD: 27/01/2015 - 17:49:35 - [] -SH-D C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
O43 - CFD: 27/03/2010 - 13:18:48 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibilité
O43 - CFD: 27/03/2010 - 13:18:48 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dépannage
O43 - CFD: 27/03/2010 - 13:18:48 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Menu de connexion
O43 - CFD: 27/03/2010 - 13:18:48 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Programmes Windows
O43 - CFD: 15/08/2014 - 16:07:27 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge =>Adware.RelevantKnowledge
O43 - CFD: 27/03/2010 - 13:18:48 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Réseau
O43 - CFD: 14/07/2009 - 09:46:52 - [] R-H-D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC
O43 - CFD: 31/07/2013 - 11:36:02 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tools_GT
O43 - CFD: 31/07/2013 - 11:36:03 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows GT
O43 - CFD: 22/11/2013 - 21:49:07 - [] ----D C:\Users\splendid univers\AppData\Roaming\DamnVid
O43 - CFD: 22/11/2013 - 21:26:51 - [] ----D C:\Users\splendid univers\AppData\Roaming\defaulttab =>Adware.Bandoo
O43 - CFD: 25/02/2015 - 21:26:29 - [] ----D C:\Users\splendid univers\AppData\Roaming\key-find =>Hijacker.Hijacker.KeyFind
O43 - CFD: 01/02/2014 - 22:44:23 - [] ----D C:\Users\splendid univers\AppData\Roaming\Movdap =>Adware.WebCake
O43 - CFD: 12/03/2015 - 21:49:02 - [] ----D C:\Users\splendid univers\AppData\Roaming\OpenCandy =>Adware.OpenCandy
O43 - CFD: 29/10/2014 - 12:29:35 - [] ----D C:\Users\splendid univers\AppData\Roaming\RHEng =>PUP.Conduit
O43 - CFD: 03/04/2015 - 13:01:04 - [] ----D C:\Users\splendid univers\AppData\Roaming\SettingsGuard
O43 - CFD: 02/06/2014 - 21:39:40 - [0] ----D C:\Users\splendid univers\AppData\Roaming\SimilarSites
O43 - CFD: 03/04/2015 - 13:03:40 - [] ----D C:\Users\splendid univers\AppData\Roaming\UnknownFile
O43 - CFD: 03/04/2015 - 13:06:08 - [] ----D C:\Users\splendid univers\AppData\Local\CodecPerformer =>PUP.CodecPerformer
~ Program Folder: 217 Legitimates Filtered in 00mn 01s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.C7BC96C3711C0D269DA26D1F0ECEC547] - 05/04/2015 - 21:37:58 ---A- . (...) -- C:\Windows\NeroDigital.ini [69]
O44 - LFC:[MD5.72AA643C526DDB882B7DA9394947DF16] - 18/04/2015 - 14:02:31 ---A- . (...) -- C:\Windows\System32\termcap [862]
O44 - LFC:[MD5.5B8CF8F0C336068D2C118FD94BE6C30E] - 18/04/2015 - 14:03:33 ---A- . (...) -- C:\Windows\iis7.log [40616]
~ Files: 13 Legitimates Filtered in 00mn 04s
---\\ Export de clé d'application autorisée (O47)
O47 - AAKE:Key Export DP - "C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpid.exe" [Enabled] .(.Pas de propriétaire.) -- C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpid.exe
O47 - AAKE:Key Export DP - "C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpirun.exe" [Enabled] .(.Pas de propriétaire.) -- C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpirun.exe
O47 - AAKE:Key Export DP - "C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpidiag.exe" [Enabled] .(...) -- C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpidiag.exe (.not file.)
O47 - AAKE:Key Export DP - "C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpisrvutil.exe" [Enabled] .(...) -- C:\Program Files\Hewlett-Packard\HP-MPI\bin\mpisrvutil.exe (.not file.)
~ Keys Export: 4 Legitimates Filtered in 00mn 00s
---\\ Image File Execution Options (IFEO) (O50)
O50 - IFEO:Image File Execution Options - bitguard.exe - tasklist.exe =>PUP.BitGuard
O50 - IFEO:Image File Execution Options - bprotect.exe - tasklist.exe
O50 - IFEO:Image File Execution Options - bpsvc.exe - tasklist.exe
O50 - IFEO:Image File Execution Options - browserdefender.exe - tasklist.exe =>Hijacker.Eazel
O50 - IFEO:Image File Execution Options - browserprotect.exe - tasklist.exe =>Hijacker.Eazel
O50 - IFEO:Image File Execution Options - browsersafeguard.exe - tasklist.exe =>PUP.BrowserSafeguard
O50 - IFEO:Image File Execution Options - dprotectsvc.exe - tasklist.exe =>Trojan.Staser
O50 - IFEO:Image File Execution Options - protectedsearch.exe - tasklist.exe =>Spyware.ProtectedSearch
O50 - IFEO:Image File Execution Options - searchprotection.exe - tasklist.exe =>Toolbar.Conduit
O50 - IFEO:Image File Execution Options - searchprotector.exe - tasklist.exe =>PUP.SearchProtect
O50 - IFEO:Image File Execution Options - searchsettings.exe - tasklist.exe =>Adware.SearchSettings
O50 - IFEO:Image File Execution Options - searchsettings64.exe - tasklist.exe =>Adware.SearchSettings
O50 - IFEO:Image File Execution Options - snapdo.exe - tasklist.exe =>Hijacker.SmartBar
O50 - IFEO:Image File Execution Options - stinst32.exe - tasklist.exe
O50 - IFEO:Image File Execution Options - stinst64.exe - tasklist.exe
O50 - IFEO:Image File Execution Options - utiljumpflip.exe - tasklist.exe =>PUP.JumpFlip
~ IFEO: Scanned in 00mn 00s
---\\ Clé de registre Shell MountPoints2 (MPSK) (O51)
O51 - MPSK:{54a1cd2a-5209-11e3-9ae2-4cedde702382}\AutoRun\command. (...) -- G:\NokiaPCIA_Autorun.exe (.not file.)
~ Keys: Scanned in 00mn 00s
---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 18 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoRecentDocsHistory"=1
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoSMHelp"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:14/07/2009 - 02:20:28 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [453712]
O58 - SDL:13/07/2009 - 23:54:14 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [26624]
O58 - SDL:02/01/1601 - 23:00:00 ---A- . (...) -- C:\Windows\System32\Drivers\sptd.sys [691696]
O58 - SDL:14/07/2009 - 02:19:04 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [21072]
O58 - SDL:13/07/2009 - 22:40:41 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029]
O58 - SDL:13/07/2009 - 22:40:44 ---A- . (...) -- C:\Windows\System32\country.sys [27097]
O58 - SDL:13/07/2009 - 22:40:40 ---A- . (...) -- C:\Windows\System32\HIMEM.SYS [4768]
O58 - SDL:13/07/2009 - 22:40:43 ---A- . (...) -- C:\Windows\System32\KEY01.SYS [42809]
O58 - SDL:13/07/2009 - 22:40:43 ---A- . (...) -- C:\Windows\System32\KEYBOARD.SYS [42537]
O58 - SDL:13/07/2009 - 22:40:23 ---A- . (...) -- C:\Windows\System32\NTDOS.SYS [27866]
O58 - SDL:13/07/2009 - 22:40:31 ---A- . (...) -- C:\Windows\System32\NTDOS404.SYS [29146]
O58 - SDL:13/07/2009 - 22:40:35 ---A- . (...) -- C:\Windows\System32\NTDOS411.SYS [29370]
O58 - SDL:13/07/2009 - 22:40:39 ---A- . (...) -- C:\Windows\System32\NTDOS412.SYS [29274]
O58 - SDL:13/07/2009 - 22:40:27 ---A- . (...) -- C:\Windows\System32\NTDOS804.SYS [29146]
O58 - SDL:13/07/2009 - 22:40:11 ---A- . (...) -- C:\Windows\System32\NTIO.SYS [33952]
O58 - SDL:13/07/2009 - 22:40:15 ---A- . (...) -- C:\Windows\System32\NTIO404.SYS [34672]
O58 - SDL:13/07/2009 - 22:40:17 ---A- . (...) -- C:\Windows\System32\NTIO411.SYS [35776]
O58 - SDL:13/07/2009 - 22:40:19 ---A- . (...) -- C:\Windows\System32\NTIO412.SYS [35536]
O58 - SDL:13/07/2009 - 22:40:13 ---A- . (...) -- C:\Windows\System32\NTIO804.SYS [34672]
~ Drivers: 70 Legitimates Filtered in 00mn 12s
---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 14/04/2015 - 18:31:47 ---A- . (...) -- C:\Users\splendid univers\AppData\Local\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\42.0.2311.90\42.0.2311.90_41.0.2272.118_chrome_updater.exe [11017296]
O61 - LFC: 14/04/2015 - 18:31:48 ---A- . (...) -- C:\Users\splendid univers\AppData\Local\Google\Update\Install\{F41FCCB1-C470-43D5-8EA3-A7F2B9332210}\42.0.2311.90_41.0.2272.118_chrome_updater.exe [11017296]
O61 - LFC: 19/04/2015 - 18:31:47 ---A- . (...) -- C:\Users\splendid univers\AppData\Local\Google\Chrome\User Data\ev_hashes_whitelist.bin [1113849]
O61 - LFC: 19/04/2015 - 18:31:55 ---A- . (.Search Results, LLC.) -- C:\Users\splendid univers\AppData\Roaming\defaulttab\defaulttab\update.exe [1139288] =>PUP.SearchResults
~ 2271 Fichiers temporaires (Temporary files)
~ 253 Fichiers cookies (Cookies files)
~ Files: 26 Legitimates Filtered in 00mn 19s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2015 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 13/07/2009 - C:\Windows\System32\Drivers\secdrv.sys (secdrv) .(.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) - LEGACY_SECDRV
O64 - Services: CurCS - 13/12/1745 - C:\Windows\System32\Drivers\sptd.sys (sptd) .(...) - LEGACY_SPTD
~ Legacy: 136 Legitimates Filtered in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet:
O68 - StartMenuInternet:
O68 - StartMenuInternet:
O68 - StartMenuInternet:
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.key-find.com =>Hijacker.Hijacker.KeyFind
O69 - SBI: SearchScopes [HKCU] {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} - (e) - http://www.key-find.com =>Hijacker.Hijacker.KeyFind
O69 - SBI: SearchScopes [HKCU] {33BB0A4E-99AF-4226-BDF6-49120163DE86} [DefaultScope] - (key-find) - http://www.key-find.com =>Hijacker.Hijacker.KeyFind
O69 - SBI: SearchScopes [HKCU] {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} - (Search The Web) - http://www.key-find.com =>Adware.IMBooster
O69 - SBI: SearchScopes [HKCU] {A7ED8872-6AE9-41A6-B229-E2052E85C8A4} - (Search Here) - http://www.key-find.com =>Hijacker.Hijacker.KeyFind
O69 - SBI: SearchScopes [HKCU] {E733165D-CBCF-4FDA-883E-ADEF965B476C} - (Google) - http://www.key-find.com =>Hijacker.Hijacker.KeyFind
~ Keys: Scanned in 00mn 00s
---\\ Enumère les fichiers Crack & Keygen (CKF) (O82)
C:\Windows.old\Program Files\Internet Download Manager\Keygenerator.exe =>.Crack,Keygen
C:\Windows.old\Program Files\Internet Download Manager\Keygenerator.exe =>.Crack,Keygen
~ Files: Scanned in 10mn 54s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.C25A17D3E58F3C9309C224C63C7041AC] [SPRF][19/08/2014] (...) -- C:\ProgramData\ntuser.dat [262144]
[MD5.FEE1D58C6AD73F25EB0DAD4F690560AD] [SPRF][09/11/2013] (.Facebook Inc. - Setup.) -- C:\Users\splendid univers\Desktop\FacebookVideoCallSetup_v1.2.205.0.exe [501248]
[MD5.0F3E1965DDD14DADB4E72F1F53D71203] [SPRF][05/08/2010] (.Pas de propriétaire - TuDomino Solitario.) -- C:\Users\splendid univers\Desktop\tudomino_solitario.exe [4620520]
~ Files: 3 Legitimates Filtered in 00mn 00s
---\\ Recherche de clés de registre Tracing (O100)
HKLM\SOFTWARE\Microsoft\Tracing\ApnStub1_RASAPI32 =>Toolbar.Ask
HKLM\SOFTWARE\Microsoft\Tracing\ApnStub1_RASMANCS =>Toolbar.Ask
HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASAPI32 =>Toolbar.Ask
HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASMANCS =>Toolbar.Ask
HKLM\SOFTWARE\Microsoft\Tracing\DefaultTabSearch_RASAPI32 =>Adware.Bandoo
HKLM\SOFTWARE\Microsoft\Tracing\DefaultTabSearch_RASMANCS =>Adware.Bandoo
HKLM\SOFTWARE\Microsoft\Tracing\Feb16_cor_key-find_RASAPI32 =>Hijacker.Hijacker.KeyFind
HKLM\SOFTWARE\Microsoft\Tracing\Feb16_cor_key-find_RASMANCS =>Hijacker.Hijacker.KeyFind
HKLM\SOFTWARE\Microsoft\Tracing\iLividMediaBar_RASAPI32 =>Adware.Bandoo
HKLM\SOFTWARE\Microsoft\Tracing\iLividMediaBar_RASMANCS =>Adware.Bandoo
HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup-r2235-n-bf_RASAPI32 =>Adware.Bandoo
HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup-r2235-n-bf_RASMANCS =>Adware.Bandoo
HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup-r362-n-bf_RASAPI32 =>Adware.Bandoo
HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup-r362-n-bf_RASMANCS =>Adware.Bandoo
HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASAPI32 =>Adware.OpenCandy
HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASMANCS =>Adware.OpenCandy
HKLM\SOFTWARE\Microsoft\Tracing\Offercast2802_SGT__RASAPI32 =>Toolbar.Ask
HKLM\SOFTWARE\Microsoft\Tracing\Offercast2802_SGT__RASMANCS =>Toolbar.Ask
HKLM\SOFTWARE\Microsoft\Tracing\Offercast29_SGT__RASAPI32 =>Toolbar.Ask
HKLM\SOFTWARE\Microsoft\Tracing\Offercast29_SGT__RASMANCS =>Toolbar.Ask
HKLM\SOFTWARE\Microsoft\Tracing\PCPerformer_RASAPI32 =>PUP.PerformerSoft
HKLM\SOFTWARE\Microsoft\Tracing\PCPerformer_RASMANCS =>PUP.PerformerSoft
HKLM\SOFTWARE\Microsoft\Tracing\SearchProtectionStub_RASAPI32 =>Toolbar.Conduit
HKLM\SOFTWARE\Microsoft\Tracing\SearchProtectionStub_RASMANCS =>Toolbar.Conduit
HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_iLivid_RASAPI32 =>PUP.Datamngr
HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_iLivid_RASMANCS =>PUP.Datamngr
HKLM\SOFTWARE\Microsoft\Tracing\smileyswelove_RASAPI32 =>Adware.SmileyBar
HKLM\SOFTWARE\Microsoft\Tracing\smileyswelove_RASMANCS =>Adware.SmileyBar
HKLM\SOFTWARE\Microsoft\Tracing\SmileysWeLove_SetupS_cdn_RASAPI32 =>Adware.SmileyBar
HKLM\SOFTWARE\Microsoft\Tracing\SmileysWeLove_SetupS_cdn_RASMANCS =>Adware.SmileyBar
HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_pour_damnvid_RASAPI32 =>Toolbar.Conduit
HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_pour_damnvid_RASMANCS =>Toolbar.Conduit
HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_pour_nokia-suite_RASAPI32 =>Toolbar.Conduit
HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_pour_nokia-suite_RASMANCS =>Toolbar.Conduit
HKLM\SOFTWARE\Microsoft\Tracing\webcake0710-0E58_RASAPI32 =>Adware.WebCake
HKLM\SOFTWARE\Microsoft\Tracing\webcake0710-0E58_RASMANCS =>Adware.WebCake
HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32 =>Adware.WebCake
HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS =>Adware.WebCake
~ BTK: 398 Legitimates Filtered in 00mn 00s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 15/04/2015 268464 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 12/04/2015 148080 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Auto 31/03/2015 868352 | (SettingsGuard) . (...) - C:\Users\splendid univers\AppData\Roaming\SettingsGuard\updater.exe
SS - | Auto 02/01/2015 315488 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe
SS - | Disabled 14/07/2009 20992 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 22/11/2013 107520 | (DefaultTabUpdate) . (...) - C:\Users\splendid univers\AppData\Roaming\defaulttab\defaulttab\dtupdate.exe =>Adware.Bandoo
SR - | Auto 10/04/2008 1392016 | (Flexlm Service 1) . (.Acresso Software Inc..) - C:\SIMULIA\License\lmgrd.exe
SR - | Auto 16/01/2015 158896 | (IHProtect Service) . (.XTab system.) - C:\Program Files\XTab\ProtectService.exe =>Adware.AgentODR
SR - | Auto 08/06/2008 877864 | (Nero BackItUp Scheduler 3) . (.Nero AG.) - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
SR - | Demand 24/06/2008 537896 | (NMIndexingService) . (.Nero AG.) - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
SR - | Auto 19/12/2006 81920 | (PLFlash DeviceIoControl Service) . (.Prolific Technology Inc..) - C:\Windows\system32\IoctlSvc.exe
SR - | Demand 18/04/2013 737616 | (ServiceLayer) . (.Nokia.) - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
SR - | Auto 05/05/2008 4493312 | (Texis Monitor) . (.Expansion Programs International, Inc..) - C:\SIMULIA\Documentation\monitor.exe
SR - | Auto 14/07/2009 20992 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 17s
---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by splendid univers at 19/04/2015 18:43:27
device: opened successfully
user: MBR read successfully
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys spjb.sys halmacpi.dll >>UNKNOWN [0x84F60938]<<
C:\Windows\system32\DRIVERS\iaStor.sys Intel Corporation Intel Rapid Storage Technology driver
System32\Drivers\spjb.sys
1 ntkrnlpa!IofCallDriver[0x82E5A458] >> \Device\Harddisk0\DR0[0x87C49530]
kernel: MBR read successfully
user & kernel MBR OK
~ MBR: 14 Legitimates Filtered in 00mn 02s
---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by splendid univers at 19/04/2015 18:43:29
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 04s
---\\ Liste des émulateurs de CD/DVD (MBR Hook)
O58 - SDL:02/01/1601 - 23:00:00 ---A- . (...) -- C:\Windows\System32\Drivers\sptd.sys [691696]
~ Emulateurs: Scanned in 00mn 04s
---\\ Scan Additionnel (O88)
Database Version : 13008 - (17/04/2015)
Clés trouvées (Keys found) : 28
Valeurs trouvées (Values found) : 2
Dossiers trouvés (Folders found) : 17
Fichiers trouvés (Files found) : 25
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}] =>PUP.SupTab^
[HKLM\SYSTEM\CurrentControlSet\Services\DefaultTabUpdate] =>Adware.Bandoo^
[HKLM\SYSTEM\CurrentControlSet\Services\IHProtect Service] =>Adware.AgentODR^
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}] =>PUP.V9Software
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}] =>PUP.V9Software
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}] =>PUP.ToolbarCleaner
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F6AFBF1-E065-4627-A2FD-810366367D01}] =>Toolbar.Agent
[HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F6AFBF1-E065-4627-A2FD-810366367D01}] =>Toolbar.Agent
[HKLM\Software\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}] =>Spyware.Soft2PC
[HKCU\Software\APN PIP] =>Toolbar.Ask
[HKLM\Software\DataMngr] =>Adware.Bandoo
[HKCU\Software\default tab] =>Adware.IMBooster
[HKLM\Software\default tab] =>Adware.IMBooster
[HKCU\Software\defaulttab] =>Adware.IMBooster
[HKCU\Software\AppDataLow\Software\defaulttab] =>Adware.IMBooster
[HKLM\Software\defaulttab] =>Adware.IMBooster
[HKCU\Software\ilivid] =>Adware.Bandoo
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKLM\Software\Tarma Installer] =>PUP.Tarma
[HKCU\Software\InstallCore] =>Adware.InstallCore
[HKCU\Software\AppDataLow\Software\Crossrider] =>PUP.CrossRider
[HKCU\Software\InstalledBrowserExtensions\] =>PUP.CrossRider
[HKLM\Software\Microsoft\Tracing\WebCakeDesktop_RASAPI32] =>Adware.WebCake
[HKLM\Software\Microsoft\Tracing\WebCakeDesktop_RASMANCS] =>Adware.WebCake
[HKCU\Software\InstalledBrowserExtensions] =>PUP.CrossRider
[HKLM\Software\InstalledBrowserExtensions] =>PUP.CrossRider
[HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220622792277}] =>PUP.CrossRider
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611791177}] =>PUP.CrossRider
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:iLivid =>Adware.Bandoo^
C:\Users\splendid univers\AppData\Roaming\Mozilla\Firefox\Profiles\azynzyii.default\extensions\faststartff@gmail.com =>PUP.FastStart^
C:\Users\splendid univers\AppData\Roaming\Mozilla\Firefox\Profiles\azynzyii.default\extensions\fftoolbar2014@etech.com =>Adware.FFToolBar^
C:\Users\splendid univers\AppData\Roaming\Mozilla\Firefox\Profiles\azynzyii.default\extensions\searchengine@gmail.com =>PUP.SearchEngine^
C:\Program Files\MyPC Backup =>PUP.MyPCBackup^
C:\Program Files\RelevantKnowledge =>Adware.RelevantKnowledge^
C:\Program Files\SiteLookup =>PUP.SiteLookup^
C:\Program Files\SuperPlusRadio v2.1 =>PUP.SuperPlusRadio^
C:\ProgramData\Tarma Installer =>PUP.Tarma^
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge =>Adware.RelevantKnowledge^
C:\Users\splendid univers\AppData\Roaming\defaulttab =>Adware.Bandoo^
C:\Users\splendid univers\AppData\Roaming\key-find =>Hijacker.Hijacker.KeyFind^
C:\Users\splendid univers\AppData\Roaming\Movdap =>Adware.WebCake^
C:\Users\splendid univers\AppData\Roaming\OpenCandy =>Adware.OpenCandy^
C:\Users\splendid univers\AppData\Roaming\RHEng =>PUP.Conduit^
C:\Users\splendid univers\AppData\Local\CodecPerformer =>PUP.CodecPerformer^
C:\Program Files\GamingWonderlandEI =>Adware.MyWebSearch
C:\Users\splendid univers\AppData\Roaming\SimilarSites =>Adware.SimilarSites
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSetProgramAccessAndDefaults: Modified =>PUA.StartShow^
C:\Program Files\XTab\cmdshell.exe =>PUP.SearchProtect^
C:\Windows\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-1.job =>PUP.CrossRider^
C:\Windows\System32\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-1 =>PUP.CrossRider^
C:\Windows\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-4.job =>PUP.CrossRider^
C:\Windows\System32\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-4 =>PUP.CrossRider^
C:\Windows\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-6.job =>PUP.CrossRider^
C:\Windows\System32\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-6 =>PUP.CrossRider^
C:\Windows\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-7.job =>PUP.CrossRider^
C:\Windows\System32\Tasks\251724b4-67d8-4ba7-bddc-fb697152dd97-7 =>PUP.CrossRider^
[HKCU\Software\Default Tab] =>Adware.Bandoo^
[HKCU\Software\DefaultTab] =>Adware.Bandoo^
[HKCU\Software\Popajar] =>Toolbar.Conduit^
[HKCU\Software\ProductSetup] =>Adware.InstallCore^
[HKCU\Software\SmileysWeLove] =>Adware.SmileyBar^
[HKCU\Software\SuperPlusRadio v2.1-nv] =>PUP.SuperPlusRadio^
[HKCU\Software\SuperPlusRadio v2.1] =>PUP.SuperPlusRadio^
[HKCU\Software\iLivid] =>Adware.Bandoo^
[HKLM\Software\Default Tab] =>Adware.Bandoo^
[HKLM\Software\DefaultTab] =>Adware.Bandoo^
[HKLM\Software\SiteFinder] =>Adware.ShoppingReport^
[HKLM\Software\SupDp] =>PUP.SupTab^
[HKLM\Software\SuperPlusRadio v2.1-nv] =>PUP.SuperPlusRadio^
[HKLM\Software\SuperPlusRadio v2.1] =>PUP.SuperPlusRadio^
[HKLM\Software\supTab] =>PUP.SupTab^
~ Additionnel Scan: 266690 Items scanned in 00mn 37s
---\\ Informations complémentaires sur les modules
~ http://nicolascoolman.fr/r5-internet-explorer-proxy-management-iepm/ =>.Internet Explorer, Proxy Management (R5)
~ http://nicolascoolman.fr/o2-browser-helper-objects-de-navigateur/ =>.Browser Helper Objects de navigateur (O2)
~ http://nicolascoolman.fr/o3-internet-explorer-toolbars/ =>.Internet Explorer Toolbars (O3)
~ http://nicolascoolman.fr/o4-applications-demarrees-par-le-registre/ =>.Applications lancées au démarrage du système (O4)
~ http://nicolascoolman.fr/o50-image-file-execution-options-zhpdiag/ =>.Image File Execution Options (IFEO) (O50)
~ http://nicolascoolman.fr/o51-mountpoints2-shell-key-mpsk/ =>.Clé de registre Shell MountPoints2 (MPSK) (O51)
~ AMI: 6 Legitimates Filtered in 00mn 00s
---\\ Récapitulatif des détections trouvées sur votre station
http://nicolascoolman.fr/pua-startshow =>PUA.StartShow
http://nicolascoolman.fr/pup-searchprotect =>PUP.SearchProtect
http://www.nicolascoolman.fr/blog/ =>Hijacker.Hijacker.KeyFind
http://www.nicolascoolman.fr/blog/ =>PUP.FastStart
http://www.nicolascoolman.fr/blog/ =>Adware.FFToolBar
http://www.nicolascoolman.fr/blog/ =>PUP.SearchEngine
http://nicolascoolman.fr/pup-suptab =>PUP.SupTab
http://www.nicolascoolman.fr/blog/ =>PUP.GreenTreeApp
http://nicolascoolman.fr/adware-bandoo =>Adware.Bandoo
http://www.nicolascoolman.fr/blog/ =>Adware.AgentODR
http://nicolascoolman.fr/pup-moviestoolbar =>PUP.MoviesToolbar
http://www.nicolascoolman.fr/blog/ =>PUP.SuperPlusRadio
http://www.nicolascoolman.fr/blog/ =>PUP.PCPerformer
http://nicolascoolman.fr/pup-crossrider =>PUP.CrossRider
http://nicolascoolman.fr/adware-installcore =>Adware.InstallCore
http://www.nicolascoolman.fr/blog/ =>PUP.BrowserExtensions
http://nicolascoolman.fr/toolbar-conduit =>Toolbar.Conduit
http://nicolascoolman.fr/adware-smileybar =>Adware.SmileyBar
http://nicolascoolman.fr/adware-shoppingreport =>Adware.ShoppingReport
http://nicolascoolman.fr/pup-tarma =>PUP.Tarma
http://nicolascoolman.fr/pup-mypcbackup =>PUP.MyPCBackup
http://nicolascoolman.fr/adware-relevantknowledge =>Adware.RelevantKnowledge
http://www.nicolascoolman.fr/blog/ =>PUP.SiteLookup
http://nicolascoolman.fr/adware-webcake =>Adware.WebCake
http://nicolascoolman.fr/adware-opencandy =>Adware.OpenCandy
http://www.nicolascoolman.fr/blog/ =>PUP.Conduit
http://www.nicolascoolman.fr/blog/ =>PUP.CodecPerformer
http://nicolascoolman.fr/pup-bitguard =>PUP.BitGuard
http://nicolascoolman.fr/hijacker-eazel =>Hijacker.Eazel
http://nicolascoolman.fr/pup-browsersafeguard =>PUP.BrowserSafeguard
http://nicolascoolman.fr/trojan-staser =>Trojan.Staser
http://nicolascoolman.fr/spyware-protectedsearch =>Spyware.ProtectedSearch
http://nicolascoolman.fr/adware-searchsettings =>Adware.SearchSettings
http://nicolascoolman.fr/hijacker-smartbar =>Hijacker.SmartBar
http://nicolascoolman.fr/pup-jumpflip =>PUP.JumpFlip
http://nicolascoolman.fr/pup-searchresults =>PUP.SearchResults
http://nicolascoolman.fr/adware-imbooster =>Adware.IMBooster
http://nicolascoolman.fr/toolbar-ask =>Toolbar.Ask
http://www.nicolascoolman.fr/blog/ =>PUP.PerformerSoft
http://nicolascoolman.fr/pup-datamngr =>PUP.Datamngr
http://nicolascoolman.fr/pup-v9software =>PUP.V9Software
http://nicolascoolman.fr/pup-toolbarcleaner =>PUP.ToolbarCleaner
http://www.nicolascoolman.fr/blog/ =>Toolbar.Agent
http://nicolascoolman.fr/spyware-soft2pc =>Spyware.Soft2PC
http://nicolascoolman.fr/adware-mywebsearch =>Adware.MyWebSearch
http://nicolascoolman.fr/adware-similarsites =>Adware.SimilarSites
~ MSI: 46 link(s) detected in 00mn 00s
~ 887 Legitimates filtered by white list
End of the scan (778 lines in 13mn 13s)(2.2)