cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

~ Rapport de ZHPDiag v2015.4.20.40 - Nicolas Coolman (20/04/2015)
~ Lancé par Utilisateur (23/04/2015 19:13:29)
~ Facebook : https://www.facebook.com/nicolascoolman1
~ Adresse du Forum http://forum.nicolascoolman.fr
~ Traduit par Nicolas Coolman
~ Etat de la version : Version à jour.
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by user


---\\ Navigateurs Internet
MSIE: Internet Explorer v9.0.8112.16421
MFIE: Mozilla Firefox 37.0.2 (Defaut)
GCIE: Google Chrome v38.0.2125.111

---\\ Informations sur les produits Windows
~ Langage: Français
Windows Server License Manager Script : OK
Software Protection Service (Protection logicielle) : KO
Windows Automatic Updates : OK
Windows Activation Technologies : OK
Windows 7 Professional, 64-bit Service Pack 1 (Build 7601)

---\\ Logiciels de protection du système
Malwarebytes Anti-Malware version 1.70.0.1100
Microsoft Security Client FR-FR Language Pack v2.1.1116.0
Windows Defender W7 (Deactivate)

---\\ Logiciels d'optimisation du système
CCleaner v5.05

---\\ Logiciels de partage PeerToPeer

---\\ Surveillance de Logiciels
Adobe Flash Player 17 NPAPI
Adobe Reader X

---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 23 Stepping 10, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1944 MB (17% free)
System Restore: Activé (Enable)
System drive C: has 158 GB (67%) free of 233 GB

---\\ Mode de connexion au système
~ Computer Name: BONNIVARD-PC
~ User Name: Utilisateur
~ All Users Names: Utilisateur, HomeGroupUser$, Administrateur,
~ Unselected Option: None
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Utilisateur\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Utilisateur\AppData\Roaming\
~ %Desktop% : C:\Users\Utilisateur\Desktop\
~ %Favorites% : C:\Users\Utilisateur\Favorites\
~ %LocalAppData% : C:\Users\Utilisateur\AppData\Local\
~ %StartMenu% : C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 158 Go of 233 Go)
D: CD-ROM drive (Not Inserted)



---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowMyGames: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: 41 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.228443FF3A1FB0B974D278F7C6403FAD] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.28/02/2012 - 07:49:56.) -- C:\Windows\System32\wininet.dll [1390080]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.21/11/2010 - 04:24:29.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.21/11/2010 - 04:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.1C7857B62DE5994A75B054A9FD4C3825] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/12/2011 - 04:59:24.) -- C:\Windows\system32\Drivers\AFD.sys [498688]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 04:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.A2F74975097F52A00745F9637451FDD8] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.11/03/2011 - 07:41:34.) -- C:\Windows\system32\Drivers\ntfs.sys [1659776]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 04:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.1B6163C503398B23FF8B939C67747683] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.21/11/2010 - 04:25:07.) -- C:\Windows\system32\Drivers\rdpdr.sys [165888]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 2/502
~ Mes musiques (My Musics) : 1/93
~ Mes Videos (My Videos) : 2/96
~ Mes Favoris (My Favorites) : 1/46
~ Mes Documents (My Documents) : 118/3380
~ Mon Bureau (My Desktop) : 1/3420
~ Menu demarrer (Programs) : 1/64
~ Hidden Files: Scanned in 00mn 00s



---\\ Processus lancés
[MD5.5183322D039A66569D27FD00987390E6] - (.Lenovo Group Limited - On screen display message generator for Thi.) -- C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe [69568] [PID.3384]
[MD5.E07CF32207C7BD95AA04A982755CDFA8] - (.Lenovo Group Limited - On screen display drawer.) -- C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe [330304] [PID.3616]
[MD5.B88CAE2C2D5EE79FE6A061A7F2111791] - (.Lenovo Group Limited - ThinkPad UltraZoom.) -- C:\Program Files\Lenovo\Zoom\TpScrex.exe [138680] [PID.3648]
[MD5.FD334D8C75FA3AD04B0211E4F99BDDFD] - (.Lenovo Group Limited - Microphone volume control module.) -- C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [62312] [PID.3912]
[MD5.5D61BE7DB55B026A5D61A3EED09D0EAD] - (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408] [PID.2976]
[MD5.F03FFC962E18F36A922E61F96BE09925] - (.Avanquest Software - Digital Line Detection.) -- C:\Program Files (x86)\Digital Line Detect\DLG.exe [50688] [PID.3480]
[MD5.51138BEEA3E2C21EC44D0932C71762A8] - (...) -- ysWOW64\rundll32.exe [0] [PID.3540]
[MD5.47EA5F76FAB723C61AB4A0D79BAD512C] - (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176] [PID.3792]
[MD5.7A706DED68AB9AC140812D3DB02420B4] - (.Broadcom Corporation. - Bluetooth Headset Skype Proxy.) -- C:\Program Files\ThinkPad\Bluetooth Software\BluetoothHeadsetProxy.exe [13600] [PID.4324]
[MD5.3F74A316BCC31B62F469AE006859A13A] - (.Lenovo Group Limited - Power Manager Power Agenda.) -- C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe [128576] [PID.4460]
[MD5.345B45BE09381D2011EB7F9AC11D8AC4] - (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [376944] [PID.4900]
[MD5.2C009C50C0EE073EC0F993698CDB6C92] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8198656] [PID.3720]
[MD5.3927397AC60D943DAF8808AFFED582B7] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65192] [PID.1048]
[MD5.51508F0C2476177E50C31B0BBFBF1BDB] - (.Google Inc. - Programme d'installation de Google.) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [107912] [PID.3344]
[MD5.FABCB1EB1B0F2A204029837753694955] - (...) -- C:\Windows\SysWOW64\ClipboardMemoryUtility\ClipboardMemoryUtility.exe [69120] [PID.4520] =>Adware.Pirrit
[MD5.DA31DE87B38005356FCC78B038006EBE] - (.Pas de propriétaire - eDeal Setup.) -- C:\Windows\TEMP\UptUpdater.exe [6036981] [PID.3216]
[MD5.9303156631EE2436DB23827E27337BE4] - (.Pas de propriétaire - Setup/Uninstall.) -- C:\Users\Utilisateur\AppData\Local\Temp\is-G3H2B.tmp\UptUpdater.tmp [708096] [PID.5072]
[MD5.1F592A94811B5D61F0BB05EC7B5A981A] - (...) -- C:\Program Files (x86)\distribution-installer.exe [2750468] [PID.3580]
[MD5.9303156631EE2436DB23827E27337BE4] - (.Pas de propriétaire - Setup/Uninstall.) -- C:\Users\Utilisateur\AppData\Local\Temp\is-06R46.tmp\distribution-installer.tmp [708096] [PID.5100]
~ Processes Running: Scanned in 00mn 00s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Utilisateur\AppData\Roaming\Mozilla\Firefox\Profiles\26c5038a.default\prefs.js
~ Firefox Browser: 5 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (21)
~ Hosts File: Scanned in 00mn 00s



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
~ Toolbar: Scanned in 00mn 00s



---\\ Applications lancées au démarrage du système (O4)
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
~ Application: Scanned in 00mn 00s



---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-12650 [64Bits] - {CCA281CA-C863-46ef-9331-5C8D4460577F} . (...) -- C:\Program Files\ThinkPad\Bluetooth Software\bt_hot_icon.ico
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Winsock hijacker (Layered Service Provider) (O10)
O10 - Broken Internet access because of LSP provider (.not file.) -- mswsock.dll
~ Winsock: 9 Legitimates Filtered in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{58E34D9A-6DEF-44AA-9997-DFEDC643A68F}: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{ED1DC7C4-E997-4EC9-A090-71330896CD0B}: DhcpNameServer = 109.0.66.20 109.0.66.10
O17 - HKLM\System\CS1\Services\Tcpip\..\{58E34D9A-6DEF-44AA-9997-DFEDC643A68F}: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{ED1DC7C4-E997-4EC9-A090-71330896CD0B}: DhcpNameServer = 109.0.66.20 109.0.66.10
O17 - HKLM\System\CS2\Services\Tcpip\..\{503F7AA8-B6BD-4DF9-9D35-72D14F905252}: NameServer = 31.168.224.100,5.135.12.56
O17 - HKLM\System\CS2\Services\Tcpip\..\{58E34D9A-6DEF-44AA-9997-DFEDC643A68F}: NameServer = 31.168.224.100,5.135.12.56
O17 - HKLM\System\CS2\Services\Tcpip\..\{58E34D9A-6DEF-44AA-9997-DFEDC643A68F}: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{ED1DC7C4-E997-4EC9-A090-71330896CD0B}: DhcpNameServer = 109.0.66.20 109.0.66.10
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 109.0.66.20 109.0.66.10
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s



---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: ClipboardMemoryUtility (ClipboardMemoryUtility) . (...) - C:\Windows\SysWOW64\ClipboardMemoryUtility\ClipboardMemoryUtility.exe =>Adware.Pirrit
~ Services: 9 Legitimates Filtered in 00mn 12s



---\\ Tâches planifiées en automatique (O39)
O39 - APT: - (..) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater [1002]
~ Scheduled Task: 3 Legitimates Filtered in 00mn 10s



---\\ Pilotes lancés au démarrage du système (O41)
O41 - Driver: (cylqhgqg) . (. - .) - C:\Windows\system32\drivers\cylqhgqg.sys (.not file.)
~ Drivers: 72 Legitimates Filtered in 00mn 03s



---\\ Logiciels installés (O42)
O42 - Logiciel: DSE Configuration Suite - (.Deep Sea Electronics plc.) [HKLM][64Bits] -- DSE Configuration Suite
O42 - Logiciel: Gestionnaire d'alimentation - (...) [HKLM][64Bits] -- {DAC01CEE-5BAE-42D5-81FC-B687E84E8405}
~ Logic: 31 Legitimates Filtered in 00mn 01s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\Isagri]
[HKCU\Software\OB]
[HKCU\Software\Reg]
[HKCU\Software\Smartbar] =>Hijacker.SmartBar
[HKLM\Software\Wow6432Node\Deep Sea Electronics plc]
[HKLM\Software\Wow6432Node\DownloaderAssistant] =>PUP.Salus
[HKLM\Software\Wow6432Node\ErrorLists-crcodedownloader] =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Isagri]
[HKLM\Software\Wow6432Node\Reg]
~ Key Software: 241 Legitimates Filtered in 00mn 01s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 05/11/2014 - 15:39:15 - [] ----D C:\Program Files (x86)\Deep Sea Electronics plc
O43 - CFD: 23/04/2015 - 18:10:19 - [0] ----D C:\Program Files (x86)\fst_fr_384 =>Adware.FreeSoftToday
O43 - CFD: 23/04/2015 - 18:10:26 - [0] ----D C:\Program Files (x86)\fst_fr_397 =>Adware.FreeSoftToday
O43 - CFD: 23/04/2015 - 18:10:30 - [0] ----D C:\Program Files (x86)\fst_fr_398 =>Adware.FreeSoftToday
O43 - CFD: 23/04/2015 - 18:10:32 - [0] ----D C:\Program Files (x86)\fst_fr_405 =>Adware.FreeSoftToday
O43 - CFD: 23/04/2015 - 18:10:38 - [0] ----D C:\Program Files (x86)\fst_fr_406 =>Adware.FreeSoftToday
O43 - CFD: 23/04/2015 - 18:10:41 - [0] ----D C:\Program Files (x86)\fst_fr_407 =>Adware.FreeSoftToday
O43 - CFD: 09/07/2014 - 23:01:19 - [] ----D C:\Program Files (x86)\Groove-Stream
O43 - CFD: 23/04/2015 - 18:10:59 - [0] ----D C:\Program Files (x86)\Reimageplus.com =>Rogue.ReimageRepair
O43 - CFD: 05/11/2014 - 15:40:43 - [] ----D C:\Program Files (x86)\Common Files\DSE USB Driver
O43 - CFD: 09/11/2014 - 15:59:21 - [] ----D C:\ProgramData\2355320829
O43 - CFD: 15/02/2014 - 21:41:44 - [] ----D C:\ProgramData\2C35C
O43 - CFD: 09/04/2013 - 18:15:07 - [] ----D C:\ProgramData\71BA
O43 - CFD: 23/04/2015 - 17:24:53 - [] ----D C:\ProgramData\aatozthfesipmda
O43 - CFD: 04/11/2014 - 16:50:15 - [] ----D C:\ProgramData\Deep Sea Electronics plc
O43 - CFD: 23/04/2015 - 18:11:06 - [0] ----D C:\ProgramData\LizardSales =>PUP.LizardSales
O43 - CFD: 21/11/2014 - 14:55:53 - [] ----D C:\ProgramData\MepeYejk
O43 - CFD: 14/03/2013 - 22:25:33 - [] --H-D C:\ProgramData\{0419CFB1-1A0C-45EA-BA96-013307B12C54}
O43 - CFD: 05/11/2014 - 15:39:25 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deep Sea Electronics plc
O43 - CFD: 23/04/2015 - 18:41:22 - [0] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Groove-Stream
O43 - CFD: 12/03/2014 - 11:05:01 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Isagri
O43 - CFD: 12/04/2011 - 11:28:08 - [0] R-H-D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC
O43 - CFD: 05/05/2012 - 16:42:27 - [] ----D C:\Users\Utilisateur\AppData\Roaming\CachedFiles
O43 - CFD: 03/11/2014 - 14:26:48 - [] ----D C:\Users\Utilisateur\AppData\Roaming\Deep Sea Electronics plc
O43 - CFD: 27/09/2013 - 20:15:06 - [] ----D C:\Users\Utilisateur\AppData\Roaming\Isagri
O43 - CFD: 15/07/2012 - 13:13:34 - [0] ----D C:\Users\Utilisateur\AppData\Roaming\K-Pacs-Lite
O43 - CFD: 05/05/2012 - 17:13:17 - [] ----D C:\Users\Utilisateur\AppData\Roaming\PwrMgr
O43 - CFD: 05/11/2014 - 23:52:31 - [] ----D C:\Users\Utilisateur\AppData\Local\com
O43 - CFD: 05/11/2014 - 16:11:44 - [] ----D C:\Users\Utilisateur\AppData\Local\Deep_Sea_Electronics_PLC
O43 - CFD: 25/08/2014 - 13:47:03 - [] -SH-D C:\Users\Utilisateur\AppData\Local\{06454ef1-ef7c-5d53-2e96-1a47d70f43ba}
O43 - CFD: 28/09/2013 - 08:24:19 - [] ----D C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Isagri
~ Program Folder: 190 Legitimates Filtered in 00mn 01s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.9ABA8D758667B4208A5E63E2D0899215] - 23/04/2015 - 17:00:01 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [21312]
O44 - LFC:[MD5.9ABA8D758667B4208A5E63E2D0899215] - 23/04/2015 - 17:00:02 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [21312]
~ Files: 4 Legitimates Filtered in 00mn 17s



---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.3941CD67C4BACDF74757A368DD94AE52] - 29/11/2014 - 19:34:26 ---A- - C:\Windows\Prefetch\BOBROWSER.EXE-A3CC35DC.pf =>PUP.BoBrowser
O45 - LFCP:[MD5.CB0CBB32E6C7B7A47D748F56D161A6BF] - 07/12/2014 - 16:05:46 ---A- - C:\Windows\Prefetch\BUBBLE DOCK BSETUP.EXE-F3FECD0A.pf =>PUP.BubbleDock
O45 - LFCP:[MD5.7B16B81237C34BF71BC664597FC1BDDC] - 07/12/2014 - 16:05:24 ---A- - C:\Windows\Prefetch\BUBBLEDOCKSETUP.EXE-60E1CF14.pf =>PUP.BubbleDock
O45 - LFCP:[MD5.62F7F3736C75765458C3588B272BCEDF] - 05/12/2014 - 12:43:29 ---A- - C:\Windows\Prefetch\CINEMA GO PRO 2.3CV01.12-BG.E-41B778B3.pf =>PUP.CrossRider
O45 - LFCP:[MD5.5753D9FD123889568506E7A76015459F] - 07/12/2014 - 15:57:34 ---A- - C:\Windows\Prefetch\CINEMA GO PRO 2.3CV01.12-CODE-0CC784B8.pf =>PUP.CrossRider
O45 - LFCP:[MD5.EF6B6A39953C0DE7AB06FBB97CF384B7] - 05/12/2014 - 12:32:13 ---A- - C:\Windows\Prefetch\FST_FR_407.EXE-6DF53475.pf =>Adware.FreeSoftToday
O45 - LFCP:[MD5.B339E7CC95723DEC6B137DCC5ECB53E4] - 07/12/2014 - 16:05:51 ---A- - C:\Windows\Prefetch\REIMAGE.EXE-4681D307.pf =>Rogue.ReimageRepair
O45 - LFCP:[MD5.85290018AA48EE146FEF8503FE1C7DD9] - 07/12/2014 - 16:02:54 ---A- - C:\Windows\Prefetch\REIMAGEPACKAGE.EXE-5C6ECAA4.pf =>Rogue.ReimageRepair
O45 - LFCP:[MD5.16AF5C23CEB8E1A0C5A992633523E1CF] - 07/12/2014 - 16:13:42 ---A- - C:\Windows\Prefetch\REIMAGEREPAIR.EXE-E84AC8A9.pf =>Rogue.ReimageRepair
O45 - LFCP:[MD5.08ACA9A14755ECC8B780473DA77382BF] - 07/12/2014 - 16:06:40 ---A- - C:\Windows\Prefetch\SEARCHSNACKS-SETUP.EXE-99B53BF9.pf =>PUP.SearchSnacks
O45 - LFCP:[MD5.C3D90668A95D57D2B8B08AD86E684556] - 05/12/2014 - 12:32:04 ---A- - C:\Windows\Prefetch\SETUP_RECOVER_FST_FR_407.EXE-DC39CF81.pf =>Adware.FreeSoftToday
O45 - LFCP:[MD5.2B94C502F85F7B55CB9C4E6C3B5A8F35] - 05/12/2014 - 12:32:03 ---A- - C:\Windows\Prefetch\SETUP_RECOVER_FST_FR_407.TMP-C39229A5.pf =>Adware.FreeSoftToday
O45 - LFCP:[MD5.CDE5D154E98BF44E1C57F018C40A429E] - 23/04/2015 - 14:40:11 ---A- - C:\Windows\Prefetch\UPFST_FR_287.EXE-719F7313.pf =>Adware.FreeSoftToday
~ Prefetcher: 13 Legitimates Filtered in 00mn 00s



---\\ Opérations et fonctions au démarrage de Windows Explorer (O46)
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook [64Bits] - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
~ ShellExecuteHooks: Scanned in 00mn 00s



---\\ Clé de registre Shell MountPoints2 (MPSK) (O51)
O51 - MPSK:{32e4ecf0-5aae-11e4-bc07-002556cf6f77}\AutoRun\command. (...) -- E:\LGAutoRun.exe (.not file.)
~ Keys: Scanned in 00mn 00s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKLM\...\Policies\System] - "DisableCAD"=1
~ MWPS: 17 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:03/09/2009 - 18:37:02 ---A- . (.REDC - RICOH MMC Driver.) -- C:\Windows\System32\Drivers\rimmpx64.sys [67072]
O58 - SDL:03/09/2009 - 18:59:28 ---A- . (.REDC - RICOH MS Driver.) -- C:\Windows\System32\Drivers\rimspx64.sys [54784]
O58 - SDL:03/09/2009 - 19:14:30 ---A- . (.REDC - RICOH xD SM Driver.) -- C:\Windows\System32\Drivers\rixdpx64.sys [57856]
O58 - SDL:29/12/2008 - 16:14:28 ---A- . (.Pas de propriétaire - USBCAMD for Sonix UVC.) -- C:\Windows\System32\Drivers\sncduvc.sys [35456]
O58 - SDL:11/06/2009 - 16:04:54 ---A- . (.Pas de propriétaire - UVC Camera Streaming Driver.) -- C:\Windows\System32\Drivers\snp2uvc.sys [3531136]
O58 - SDL:14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
~ Drivers: 79 Legitimates Filtered in 00mn 21s



---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 23/04/2015 - 19:15:19 ---A- . (...) -- C:\Users\Utilisateur\AppData\Roaming\ZHP\ZHPCleaner.exe [1809920] =>.Nicolas Coolman
O61 - LFC: 23/04/2015 - 19:15:21 ---A- . (...) -- C:\Users\Utilisateur\Downloads\adwcleaner_4.201.exe [2217984]
O61 - LFC: 23/04/2015 - 19:22:10 ---A- . (...) -- C:\Users\Utilisateur\Downloads\ZHPCleaner(1).exe [1809920] =>.Nicolas Coolman
O61 - LFC: 23/04/2015 - 19:22:10 ---A- . (...) -- C:\Users\Utilisateur\Downloads\ZHPCleaner(2).exe [1809920] =>.Nicolas Coolman
O61 - LFC: 23/04/2015 - 19:22:14 ---A- . (...) -- C:\Users\Utilisateur\Downloads\ZHPCleaner.exe [1809920] =>.Nicolas Coolman
~ 93 Fichiers temporaires (Temporary files)
~ 2 Fichiers cookies (Cookies files)
~ Files: 19 Legitimates Filtered in 07mn 55s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2015 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 10/06/2009 - C:\Windows\System32\Drivers\secdrv.sys (secdrv) .(.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) - LEGACY_SECDRV
~ Legacy: 76 Legitimates Filtered in 00mn 01s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: <>[HKLM\..\Shell\open\Command] (.Not Key.) =>PUP.Torch
~ Keys: Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {B6557E5B-6233-48EE-AB90-2508183F432A} [DefaultScope] - (Google) - http://www.google.com
O69 - SBI: SearchScopes [HKCU] {C7681315-C64B-466A-B6A3-6A1A26BE2BC4} - ((www.google.com) Google) - http://www.google.com
~ Keys: Scanned in 00mn 00s



---\\ Recherche dans la clé de registre Feature Controls (IFC) (O81)
O81 - IFC: Internet Feature Controls [HKUS\.DEFAULT] [FEATURE_BROWSER_EMULATION] -- svchost.exe =>Rootkit.TDSS
O81 - IFC: Internet Feature Controls [HKUS\.DEFAULT] [FEATURE_DISABLE_NAVIGATION_SOUNDS] -- svchost.exe
O81 - IFC: Internet Feature Controls [HKUS\.DEFAULT] [FEATURE_DISABLE_TELNET_PROTOCOL] -- svchost.exe
O81 - IFC: Internet Feature Controls [HKUS\.DEFAULT] [FEATURE_GPU_RENDERING] -- svchost.exe
O81 - IFC: Internet Feature Controls [HKUS\.DEFAULT] [FEATURE_RESTRICT_ACTIVEXINSTALL] -- svchost.exe
O81 - IFC: Internet Feature Controls [HKUS\.DEFAULT] [FEATURE_RESTRICT_FILEDOWNLOAD] -- svchost.exe
O81 - IFC: Internet Feature Controls [HKUS\.DEFAULT] [FEATURE_RESTRICT_RES_TO_LMZ] -- svchost.exe
O81 - IFC: Internet Feature Controls [HKUS\.DEFAULT] [FEATURE_STATUS_BAR_THROTTLING] -- svchost.exe
O81 - IFC: Internet Feature Controls [HKUS\S-1-5-18] [FEATURE_BROWSER_EMULATION] -- svchost.exe =>Rootkit.TDSS
O81 - IFC: Internet Feature Controls [HKUS\S-1-5-18] [FEATURE_DISABLE_NAVIGATION_SOUNDS] -- svchost.exe
O81 - IFC: Internet Feature Controls [HKUS\S-1-5-18] [FEATURE_DISABLE_TELNET_PROTOCOL] -- svchost.exe
O81 - IFC: Internet Feature Controls [HKUS\S-1-5-18] [FEATURE_GPU_RENDERING] -- svchost.exe
O81 - IFC: Internet Feature Controls [HKUS\S-1-5-18] [FEATURE_RESTRICT_ACTIVEXINSTALL] -- svchost.exe
O81 - IFC: Internet Feature Controls [HKUS\S-1-5-18] [FEATURE_RESTRICT_FILEDOWNLOAD] -- svchost.exe
O81 - IFC: Internet Feature Controls [HKUS\S-1-5-18] [FEATURE_RESTRICT_RES_TO_LMZ] -- svchost.exe
O81 - IFC: Internet Feature Controls [HKUS\S-1-5-18] [FEATURE_STATUS_BAR_THROTTLING] -- svchost.exe
~ Keys: Scanned in 00mn 00s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][02/01/1601] (...) -- C:\ProgramData\3lemj.bat [55]
[MD5.DB9F4E8E41B52ADE4347EF02FB1DAC06] [SPRF][01/04/2013] (...) -- C:\ProgramData\3lemj.reg [151]
[MD5.42939B341F104AB5B65AC4B6A245439F] [SPRF][26/07/2013] (...) -- C:\ProgramData\7xIpTkD.dat [112]
[MD5.082C416E3956173FD902DFE062455FC1] [SPRF][03/11/2014] (.Cinema ProV01.11 - CinemaPro 1.5V01.11 exe.) -- C:\Users\Utilisateur\AppData\Roaming\CZL.exe [1551792]
[MD5.F28CA5045FAB39ADA0352C1B3881BF01] [SPRF][01/12/2014] (.Cinema ProV01.12 - Cinema Go Pro 2.3cV01.12 exe.) -- C:\Users\Utilisateur\AppData\Roaming\KODG.exe [1847256] =>PUP.CrossRider
[MD5.5414B8C5C0D3776BB9D43456008F86D6] [SPRF][05/11/2014] (.smart-saverplus - Sm23mS exe.) -- C:\Users\Utilisateur\AppData\Roaming\LLUMUYCI.exe [2052512] =>PUP.CrossRider
[MD5.D7187E3627F9975028CDC8DBA7428CAB] [SPRF][07/12/2014] (.end - ClickMovie1-Downloaderv10 exe.) -- C:\Users\Utilisateur\AppData\Roaming\OCYH.exe [2004448]
[MD5.FD2D568D798F75CF86C53E15D139EA3C] [SPRF][01/12/2014] (.Cinema ProV01.12 - Cinema Go Pro 2.3cV01.12 exe.) -- C:\Users\Utilisateur\AppData\Roaming\PSRAMG.exe [1519576] =>PUP.CrossRider
[MD5.AC0A80A351AA588D4EB2E057E47D8800] [SPRF][03/11/2014] (.Cinema ProV01.11 - CinemaPro 1.5V01.11 exe.) -- C:\Users\Utilisateur\AppData\Roaming\VXOYM.exe [2043824]
[MD5.42D7CBB5DACD52DA71B8C52A3F36605D] [SPRF][07/12/2014] (.end - ClickMovie1-Downloaderv10 exe.) -- C:\Users\Utilisateur\AppData\Roaming\YNRQBMN.exe [1520608]
[MD5.F17F88938C4CD333BF516D4A26C833A7] [SPRF][05/11/2014] (.smart-saverplus - Sm23mS exe.) -- C:\Users\Utilisateur\AppData\Roaming\YX.exe [1552288] =>PUP.CrossRider
[MD5.1F592A94811B5D61F0BB05EC7B5A981A] [SPRF][23/04/2015] (...) -- C:\Program Files (x86)\distribution-installer.exe [2750468]
[MD5.C9F56A3C4639AC00A30E094C1DEE25DA] [SPRF][23/04/2015] (.w - HelperApp Setup.) -- C:\Program Files (x86)\ExtensionsInstallerAsUpdate.exe [2664985]
[MD5.52C06F5A6F0AB275987740BB295B7E4F] [SPRF][26/02/2015] (.wauctla - wauctla Setup.) -- C:\Program Files (x86)\wauctla-setup.exe [1032603]
~ Files: 15 Legitimates Filtered in 00mn 07s



---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.A791F9A4662A1BA29AFE93F0D705A189] [WIS][14/03/2013] (.iMesh Inc. - iMesh.) -- C:\Windows\Installer\37e19fe0.msi [352256] =>PUP.iMesh
~ WIS: 1 Legitimates Filtered in 00mn 04s



---\\ Recherche de clés de registre CLSID (O101)
[HKCR\CLSID\{1E2782A3-78E2-9BC5-A9C0-AE6D969365D2}] (CostMin) =>PUP.CostMin
~ BCK: 4791 Legitimates Filtered in 00mn 14s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 23/04/2015 268464 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 15/03/2012 320576 | (DozeSvc) . (.Lenovo..) - C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.exe
SS - | Auto 09/11/2014 107912 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 09/11/2014 107912 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 16/11/2014 194032 | (gusvc) . (.Google.) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Demand 16/04/2015 148080 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Demand 15/03/2012 1662528 | (Power Manager DBC Service) . (.Lenovo.) - C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
SS - | Demand 15/03/2012 165440 | (PwmEWSvc) . (.Lenovo Group Limited.) - C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.exe
SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 18/12/2012 65192 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 24/01/2011 915232 | (btwdins) . (.Broadcom Corporation..) - C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
SR - | Auto 04/11/2014 69120 | (ClipboardMemoryUtility) . (...) - C:\Windows\SysWOW64\ClipboardMemoryUtility\ClipboardMemoryUtility.exe =>Adware.Pirrit
SR - | Auto 25/06/2007 567024 | (dlbk_device) . (...) - C:\Windows\system32\dlbkcoms.exe
SR - | Auto 01/11/2011 1518352 | (EvtEng) . (.Intel(R) Corporation.) - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
SR - | Auto 14/07/2009 27136 | C:\Windows\SysWOW64\XAudio64.dll (HsfXAudioService) . (.Conexant Systems, Inc..) - C:\Windows\System32\svchost.exe
SR - | Auto 01/06/2007 43568 | (IBMPMSVC) . (.Lenovo.) - C:\Windows\System32\ibmpmsvc.exe
SR - | Auto 12/07/2011 133992 | (Lenovo.VIRTSCRLSVC) . (.Lenovo Group Limited.) - C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
SR - | Auto 12/09/2012 22072 | (MsMpSvc) . (.Microsoft Corporation.) - c:\Program Files\Microsoft Security Client\MsMpEng.exe
SR - | Auto 01/11/2011 844560 | (RegSrvc) . (.Intel(R) Corporation.) - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
SR - | Auto 22/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 19s



---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Run by Utilisateur at 23/04/2015 19:24:28
~ OS 64 not supported by MBR tool
~ MBR: 0 Legitimates Filtered in 00mn 00s



---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Utilisateur at 23/04/2015 19:24:30
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 02s



---\\ Scan Additionnel (O88)
Database Version : 13008 - (20/04/2015)
Clés trouvées (Keys found) : 2
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 9
Fichiers trouvés (Files found) : 11

[HKLM\SYSTEM\CurrentControlSet\Services\ClipboardMemoryUtility] =>Adware.Pirrit^
[HKLM\Software\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}] =>Toolbar.Ask
C:\Program Files (x86)\fst_fr_384 =>Adware.FreeSoftToday^
C:\Program Files (x86)\fst_fr_397 =>Adware.FreeSoftToday^
C:\Program Files (x86)\fst_fr_398 =>Adware.FreeSoftToday^
C:\Program Files (x86)\fst_fr_405 =>Adware.FreeSoftToday^
C:\Program Files (x86)\fst_fr_406 =>Adware.FreeSoftToday^
C:\Program Files (x86)\fst_fr_407 =>Adware.FreeSoftToday^
C:\Program Files (x86)\Reimageplus.com =>Rogue.ReimageRepair^
C:\ProgramData\LizardSales =>PUP.LizardSales^
C:\Program Files (x86)\Software =>Adware.Boxore
C:\Windows\SysWOW64\ClipboardMemoryUtility\ClipboardMemoryUtility.exe =>Adware.Pirrit^
[HKCU\Software\Smartbar] =>Hijacker.SmartBar^
[HKLM\Software\Wow6432Node\DownloaderAssistant] =>PUP.Salus^
[HKLM\Software\Wow6432Node\ErrorLists-crcodedownloader] =>PUP.CrossRider^
O68 - StartMenuInternet: <>[HKLM\..\Shell\open\Command] (.Not Key.) =>PUP.Torch^
C:\Users\Utilisateur\AppData\Roaming\KODG.exe =>PUP.CrossRider^
C:\Users\Utilisateur\AppData\Roaming\LLUMUYCI.exe =>PUP.CrossRider^
C:\Users\Utilisateur\AppData\Roaming\PSRAMG.exe =>PUP.CrossRider^
C:\Users\Utilisateur\AppData\Roaming\YX.exe =>PUP.CrossRider^
C:\Windows\Installer\37e19fe0.msi =>PUP.iMesh^
[HKCR\CLSID\{1E2782A3-78E2-9BC5-A9C0-AE6D969365D2}] (CostMin) =>PUP.CostMin^
~ Additionnel Scan: 220164 Items scanned in 01mn 27s



---\\ Informations complémentaires sur les modules
~ http://nicolascoolman.fr/r5-internet-explorer-proxy-management-iepm/ =>.Internet Explorer, Proxy Management (R5)
~ http://nicolascoolman.fr/o3-internet-explorer-toolbars/ =>.Internet Explorer Toolbars (O3)
~ http://nicolascoolman.fr/o4-applications-demarrees-par-le-registre/ =>.Applications lancées au démarrage du système (O4)
~ http://nicolascoolman.fr/o51-mountpoints2-shell-key-mpsk/ =>.Clé de registre Shell MountPoints2 (MPSK) (O51)
~ AMI: 4 Legitimates Filtered in 00mn 00s



---\\ Récapitulatif des détections trouvées sur votre station
http://www.nicolascoolman.fr/blog/ =>Adware.Pirrit
http://nicolascoolman.fr/hijacker-smartbar =>Hijacker.SmartBar
http://www.nicolascoolman.fr/blog/ =>PUP.Salus
http://nicolascoolman.fr/pup-crossrider =>PUP.CrossRider
http://nicolascoolman.fr/adware-freesofttoday =>Adware.FreeSoftToday
http://nicolascoolman.fr/rogue-reimagerepair =>Rogue.ReimageRepair
http://www.nicolascoolman.fr/blog/ =>PUP.LizardSales
http://www.nicolascoolman.fr/blog/ =>PUP.BoBrowser
http://nicolascoolman.fr/pup-bubbledock =>PUP.BubbleDock
http://www.nicolascoolman.fr/blog/ =>PUP.SearchSnacks
http://www.nicolascoolman.fr/blog/ =>PUP.Torch
http://nicolascoolman.fr/rootkit-tdss =>Rootkit.TDSS
http://nicolascoolman.fr/pup-imesh =>PUP.iMesh
http://nicolascoolman.fr/pup-costmin =>PUP.CostMin
http://nicolascoolman.fr/toolbar-ask =>Toolbar.Ask
http://nicolascoolman.fr/adware-boxore =>Adware.Boxore
~ MSI: 16 link(s) detected in 00mn 00s



~ 765 Legitimates filtered by white list
End of the scan (568 lines in 12mn 30s)(0.6)

Publicité


Signaler le contenu de ce document

Publicité