cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

~ Rapport de ZHPDiag v2015.5.2.45 - Nicolas Coolman (02/05/2015)
~ Lancé par alain (03/05/2015 11:53:56)
~ Facebook : https://www.facebook.com/nicolascoolman1
~ Adresse du Forum http://forum.nicolascoolman.fr
~ Traduit par Nicolas Coolman
~ Etat de la version : Version à jour.
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by program


---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.17728 (Defaut)

---\\ Informations sur les produits Windows
~ Langage: Français
Windows Server License Manager Script : OK
~ Windows(R) Operating System, OEM_DM channel
Windows ID Activation : OK
~ Windows Partial Key : 8QJP4
Windows License : OK
~ Windows Remaining Initializations Number : 998
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
Windows 8.1 Connected, 64-bit (Build 9600)

---\\ Logiciels de protection du système
Ad-Aware Web Companion v1.1.980.2014
Windows Defender W8 (Activate)

---\\ Logiciels d'optimisation du système

---\\ Logiciels de partage PeerToPeer
qBittorrent 3.1.12 v3.1.12 =>P2P.BitTorrent

---\\ Surveillance de Logiciels
Adobe Flash Player 17 NPAPI
Adobe Reader XI

---\\ Informations sur le système
~ Processor: AMD64 Family 22 Model 0 Stepping 1, AuthenticAMD
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3538 MB (45% free)
System Restore: Activé (Enable)
System drive C: has 330 GB (75%) free of 440 GB

---\\ Mode de connexion au système
~ Computer Name: LENOVO-PC
~ User Name: alain
~ All Users Names: HomeGroupUser$, alain, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\alain\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\alain\AppData\Roaming\
~ %Desktop% : C:\Users\alain\Desktop\
~ %Favorites% : C:\Users\alain\Favorites\
~ %LocalAppData% : C:\Users\alain\AppData\Local\
~ %StartMenu% : C:\Users\alain\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 330 Go of 440 Go)
D: CD-ROM drive (Not Inserted)
E: CD-ROM drive (Not Inserted)



---\\ Etat du Centre de Sécurité Windows
~ Security Center: 41 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.C10A66189DC8C090E7C84873EDCEBC88] - (.Microsoft Corporation - Explorateur Windows.) (.28/01/2015 - 00:47:12.) -- C:\Windows\Explorer.exe [2501368]
[MD5.A570A64292214C43E0BA50E6A72A6380] - (.Microsoft Corporation - Application de démarrage de Windows.) (.29/10/2014 - 02:25:54.) -- C:\Windows\System32\Wininit.exe [145920]
[MD5.77B35D0FC22A2D2EAC8D07C3F9784DBF] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.13/03/2015 - 03:45:57.) -- C:\Windows\System32\wininet.dll [2358784]
[MD5.EC498BAE1F0D3E0E401C963F8D76C437] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.29/10/2014 - 02:22:52.) -- C:\Windows\System32\Winlogon.exe [572416]
[MD5.AFCAB4DC692CCE37E283B00E2D7B438F] - (.Microsoft Corporation - Bibliothèque de licences.) (.18/03/2014 - 10:54:52.) -- C:\Windows\System32\sppcomapi.dll [447488]
[MD5.374E27295F0A9DCAA8FC96370F9BEEA5] - (.Microsoft Corporation - Pilote de fonction connexe pour WinSock.) (.30/05/2014 - 04:03:03.) -- C:\Windows\system32\Drivers\AFD.sys [563200]
[MD5.74B14192CF79A72F7536B27CB8814FBD] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.22/08/2013 - 13:43:41.) -- C:\Windows\system32\Drivers\atapi.sys [26464]
[MD5.2FA6510E33F7DEFEC03658B74101A9B9] - (.Microsoft Corporation - CD-ROM File System Driver.) (.22/08/2013 - 12:40:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [88576]
[MD5.C6796EA22B513E3457514D92DCDB1A3D] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.22/08/2013 - 09:46:35.) -- C:\Windows\system32\Drivers\Cdrom.sys [164352]
[MD5.A03F362C5557E238CBFA914689C77248] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.06/03/2014 - 10:22:50.) -- C:\Windows\system32\Drivers\DfsC.sys [134144]
[MD5.D4B7ED39C7900384D9E5C1283F1E7926] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.24/07/2014 - 12:45:39.) -- C:\Windows\system32\Drivers\HDAudBus.sys [76800]
[MD5.D887446F3F6051C60C26F4FD1FC8D43F] - (.Microsoft Corporation - Pilote de port i8042.) (.07/10/2014 - 04:29:50.) -- C:\Windows\system32\Drivers\i8042prt.sys [107520]
[MD5.B7342B3C58E91107F6E946A93D9D4EFD] - (.Microsoft Corporation - IP Network Address Translator.) (.18/03/2014 - 10:54:55.) -- C:\Windows\system32\Drivers\IpNat.sys [142848]
[MD5.31233271EDE50D1BBB220F78AFA60486] - (.Microsoft Corporation - Minirdr SMB Windows NT.) (.08/10/2014 - 08:32:10.) -- C:\Windows\system32\Drivers\MRxSmb.sys [405504]
[MD5.0217532E19A748F0E5D569307363D5FD] - (.Microsoft Corporation - MBT Transport driver.) (.22/08/2013 - 12:37:02.) -- C:\Windows\system32\Drivers\netBT.sys [282624]
[MD5.7F68063A5A0461E02BC860CE0E6BFDDC] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.15/10/2014 - 09:32:37.) -- C:\Windows\system32\Drivers\ntfs.sys [2025792]
[MD5.764B1121867B2D9B31C491668AC72B2B] - (.Microsoft Corporation - Pilote de port parallèle.) (.22/08/2013 - 12:40:02.) -- C:\Windows\system32\Drivers\Parport.sys [94208]
[MD5.BBB6272B7F46C4640A8CDB8A70C3450F] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.22/08/2013 - 12:35:51.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [120832]
[MD5.680C1DAE268B6FB67FA21B389A8B79EF] - (.Microsoft Corporation - Redirecteur de périphérique de Microsoft RDP.) (.18/03/2014 - 10:37:57.) -- C:\Windows\system32\Drivers\rdpdr.sys [195584]
[MD5.FFF28F9F6823EB1756C60F1649560BBF] - (.Microsoft Corporation - TDI Translation Driver.) (.22/08/2013 - 14:25:35.) -- C:\Windows\system32\Drivers\tdx.sys [107520]
[MD5.64CA2B4A49A8EAF495E435623ECCE7DB] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.19/06/2014 - 03:13:36.) -- C:\Windows\system32\Drivers\volsnap.sys [310080]
~ Generic Processes: Scanned in 00mn 01s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 2/11
~ Mes musiques (My Musics) : 1/8794
~ Mes Videos (My Videos) : 2/4
~ Mes Favoris (My Favorites) : 1/34
~ Mes Documents (My Documents) : 2/339
~ Mon Bureau (My Desktop) : 1/6
~ Menu demarrer (Programs) : 1/35
~ Hidden Files: Scanned in 00mn 10s



---\\ Processus lancés
[MD5.5C0B03290C133F5E13E7FBD21115B6A5] - (.Acronis - Acronis Scheduler Helper.) -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [384016] [PID.1776]
[MD5.8955BE530FF60C080FF5525EC6BE5D8F] - (.BitTorrent Inc. - µTorrent.) -- C:\Users\alain\AppData\Roaming\uTorrent\uTorrent.exe [1699920] [PID.4780] =>P2P.BitTorrent
[MD5.F2FB49CDA37568B09B7A0814E775C48C] - (.Lavasoft - Web Companion.) -- C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [1371456] [PID.4436]
[MD5.17716C3DD52BF815291D80FAAF329AC7] - (.Lenovo - Lenovo Black Silk USB Keyboard.) -- C:\Windows\jmesoft\hotkey.exe [118784] [PID.5232]
[MD5.C049C40CAEE8900130BD5F80B594CC7B] - (.CyberLink Corp. - PowerDVD RC Service.) -- C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [95192] [PID.5488]
[MD5.511094F4CA43ED5D98B6BCFA7EE01554] - (.CHENGDU YIWO Tech Development Co., Ltd - EaseUS Partition Master Free Edition Applic.) -- C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.1\bin\EpmNews.exe [2086568] [PID.5636]
[MD5.08B438A5A06CD877F19B92F6868C031D] - (.NEC Electronics Corporation - USB 3.0 Monitor.) -- C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496] [PID.5652]
[MD5.9153F2335BCDB87F41559CF066223BF9] - (.Oracle Corporation - Java Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800] [PID.5692]
[MD5.8683F606E8ED253820C8D5D599883F45] - (.Oracle Corporation - Java Update Checker.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe [1241472] [PID.1072]
[MD5.5F1B1148C830C0F149A476A58CE0D09D] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\IEXPLORE.exe [815248] [PID.1172]
[MD5.C06C9EC74A0971A31A40723432201C86] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8206336] [PID.1928]
[MD5.52C8B9FD016E6317FDB151296FF90877] - (.Oracle Corporation - Java(TM) Web Start Launcher.) -- C:\Program Files (x86)\Java\jre1.8.0_31\bin\javaws.exe [272296] [PID.6512]
[MD5.5DAF7081A4BB112FA3F1915819330A3E] - (...) -- C:\Program Files (x86)\ZHPDiag\pv.exe [61440] [PID.0]
~ Processes Running: Scanned in 00mn 02s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\alain\AppData\Roaming\Mozilla\Firefox\Profiles\4ft3z3vy.default\prefs.js
C:\Users\alain\AppData\Roaming\Mozilla\Firefox\Profiles\flqntxmq.default-1409603565609\prefs.js
M3 - MFPP: Plugins - [alain] -- C:\Users\alain\AppData\Roaming\Mozilla\Firefox\Profiles\4ft3z3vy.default\searchplugins\onlysearchkms.xml =>PUP.OnlySearch
M3 - MFPP: Plugins - [alain] -- C:\Users\alain\AppData\Roaming\Mozilla\Firefox\Profiles\flqntxmq.default-1409603565609\searchplugins\securesearch.xml
M0 - MFSP: prefs.js [alain - flqntxmq.default-1409603565609] http://securedsearch.lavasoft.com
~ Firefox Browser: 6 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://skynet.be
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://google.com
~ IE Browser: 22 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (21)
~ Hosts File: Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\QuickLaunch [alain]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\alain\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\TaskBar [alain]: qBittorrent.lnk . (...) -- C:\Program Files (x86)\qBittorrent\qbittorrent.exe =>P2P.BitTorrent
O4 - GS\Desktop [alain]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\alain\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
~ Global Startup: 3 Legitimates Filtered in 00mn 19s



---\\ Applications lancées au démarrage du système (O4)
O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =>.Realtek Semiconductor Corp
O4 - HKLM\..\Run: [Service Planificateur2 Acronis] . (.Acronis - Acronis Scheduler Helper.) -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
O4 - HKCU\..\Run: [uTorrent] . (.BitTorrent Inc. - µTorrent.) -- C:\Users\alain\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe =>.DT Soft Ltd
O4 - HKCU\..\Run: [Web Companion] . (.Lavasoft - Web Companion.) -- C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe =>.Advanced Micro Devices, Inc
O4 - HKLM\..\Wow6432Node\Run: [jmekey] . (.Lenovo - Lenovo Black Silk USB Keyboard.) -- C:\WINDOWS\jmesoft\hotkey.exe
O4 - HKLM\..\Wow6432Node\Run: [jmesoft] . (...) -- C:\Windows\jmesoft\ServiceLoader.exe
O4 - HKLM\..\Wow6432Node\Run: [LVT] . (.Lenovo - Lenovo.) -- C:\Program Files\Lenovo\LVT\LJYZ.exe
O4 - HKLM\..\Wow6432Node\Run: [RemoteControl10] . (.CyberLink Corp. - PowerDVD RC Service.) -- C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
O4 - HKLM\..\Wow6432Node\Run: [CLMLServer] . (.CyberLink - CyberLink MediaLibray Service.) -- C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
O4 - HKLM\..\Wow6432Node\Run: [UpdateP2GoShortCut] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Wow6432Node\Run: [F-Secure Hoster (51896)] . (.F-Secure Corporation - F-Secure Host Process.) -- C:\Program Files (x86)\VOO Internet Security\fshoster32.exe
O4 - HKLM\..\Wow6432Node\Run: [BrStsWnd] . (.brother - brstswnd.) -- C:\Program Files (x86)\Brownie\BrstsW64.exe
O4 - HKLM\..\Wow6432Node\Run: [EaseUS EPM tray] . (.CHENGDU YIWO Tech Development Co., Ltd - EaseUS Partition Master Free Edition Applic.) -- C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.1\bin\EpmNews.exe
O4 - HKLM\..\Wow6432Node\Run: [NUSB3MON] . (.NEC Electronics Corporation - USB 3.0 Monitor.) -- C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
O4 - HKLM\..\Wow6432Node\Run: [fst_be_80] Clé orpheline =>Adware.FreeSoftToday
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKUS\S-1-5-21-4121061424-3843962108-1209761369-1002\..\Run: [uTorrent] . (.BitTorrent Inc. - µTorrent.) -- C:\Users\alain\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - HKUS\S-1-5-21-4121061424-3843962108-1209761369-1002\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe =>.DT Soft Ltd
O4 - HKUS\S-1-5-21-4121061424-3843962108-1209761369-1002\..\Run: [Web Companion] . (.Lavasoft - Web Companion.) -- C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
~ Application: Scanned in 00mn 01s



---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Se&nd to OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\ONBttnIE.dll =>.Microsoft Corporation
O9 - Extra button: Skype for Business Click to Call [64Bits] - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -- C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\lync.exe (.not file.)
O9 - Extra button: OneNote Lin&ked Notes [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\ONBttnIELinkedNotes.dll =>.Microsoft Corporation
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Site dans la Zone de confiance d'Internet Explorer (O15)
O15 - Trusted Zone: [HKCU\...\Domains] http.paradise-gangster.com
~ IE Zone Confiance: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{3F7FFAEA-AA58-47C1-A4E8-CDDE66139BE1}: DhcpNameServer = 109.88.203.3 62.197.111.140
O17 - HKLM\System\CCS\Services\Tcpip\..\{E626E3AD-F889-43F8-A065-AC8C09629559}: DhcpNameServer = 109.88.203.3 62.197.111.140
O17 - HKLM\System\CS1\Services\Tcpip\..\{3F7FFAEA-AA58-47C1-A4E8-CDDE66139BE1}: DhcpNameServer = 109.88.203.3 62.197.111.140
O17 - HKLM\System\CS1\Services\Tcpip\..\{E626E3AD-F889-43F8-A065-AC8C09629559}: DhcpNameServer = 109.88.203.3 62.197.111.140
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 109.88.203.3 62.197.111.140
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: JME Keyboard Driver (JME Keyboard) . (...) - C:\Windows\jmesoft\Service.exe
O23 - Service: JMRAIDManager (JMRAIDManager) . (...) - C:\Program Files (x86)\JMRAIDManager\XSrvSetup.exe
O23 - Service: McAfee AP Service (McAPExe) . (...) - C:\Program Files\McAfee\MSC\McAPexe.exe (.not file.)
O23 - Service: IE Search Set (SearchProtectionService) . (.Pas de propriétaire - SPWindowsService.) - C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe
~ Services: 15 Legitimates Filtered in 00mn 24s



---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [{0AE5BE63-F91D-432C-BFE5-5B8CE7BDFFF8}] (...) -- D:\external storage\EX-503\Software AP\windows\Application\HWRaidManager.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{503700CB-96A8-420D-96D6-F69BFA9E1622}] (...) -- C:\Users\alain\AppData\Local\Softonic\Uninstall.exe (.not file.) [0] =>Toolbar.Conduit
[MD5.00000000000000000000000000000000] [APT] [{7178375A-E54C-4AD1-A992-29B81DDA085B}] (...) -- D:\PCI-E Card\IB-01\Software AP\windows\Application\HWRaidManager.exe (.not file.) [0]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater [1002]
~ Scheduled Task: 12 Legitimates Filtered in 00mn 21s



---\\ Logiciels installés (O42)
O42 - Logiciel: Shopping Helper Smartbar Engine - (.ReSoft Ltd..) [HKCU][64Bits] -- {056b8dd8-de6a-4274-af26-5618aee3dbaa} =>Hijacker.SmartBar
~ Logic: 22 Legitimates Filtered in 00mn 01s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\Smartbar] =>Hijacker.SmartBar
[HKCU\Software\test]
[HKLM\Software\Wow6432Node\MaxPower]
[HKLM\Software\Wow6432Node\WinPj]
~ Key Software: 256 Legitimates Filtered in 00mn 01s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 02/05/2015 - 09:47:37 - [] ----D C:\Program Files (x86)\Crazy Score
O43 - CFD: 30/08/2014 - 13:32:19 - [] ----D C:\Program Files (x86)\JMRAIDManager
O43 - CFD: 03/12/2014 - 17:10:33 - [] ----D C:\Program Files (x86)\ProtectedBrowsing =>PUP.ProtectedBrowsing
O43 - CFD: 02/05/2015 - 16:38:25 - [] ----D C:\Program Files (x86)\SearchSnacks_1.10.0.5 =>PUP.SearchSnacks
O43 - CFD: 02/05/2015 - 16:38:25 - [] ----D C:\Program Files (x86)\VOO Internet Security
O43 - CFD: 02/05/2015 - 09:50:17 - [] ----D C:\Program Files (x86)\Common Files\68f7eaff-0da4-47f4-8262-425ca2a087dd
O43 - CFD: 02/05/2015 - 09:50:17 - [] ----D C:\ProgramData\68f7eaff-0da4-47f4-8262-425ca2a087dd
O43 - CFD: 18/03/2015 - 15:20:50 - [] ----D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
O43 - CFD: 30/08/2014 - 06:53:06 - [] -SH-D C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
O43 - CFD: 18/03/2014 - 11:38:02 - [0] R-H-D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC
O43 - CFD: 26/08/2014 - 14:55:46 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VOO Internet Security
O43 - CFD: 03/12/2014 - 14:34:00 - [0] ----D C:\Users\alain\AppData\Roaming\18732
O43 - CFD: 13/03/2015 - 19:34:26 - [] ----D C:\Users\alain\AppData\Roaming\Soldiers939
O43 - CFD: 10/11/2014 - 18:48:00 - [0] ----D C:\Users\alain\AppData\Roaming\{950EB46C-6AC7-4ACC-AB36-9A6A77C08B6A}
O43 - CFD: 03/05/2015 - 10:41:42 - [] ----D C:\Users\alain\AppData\Local\19723
O43 - CFD: 01/09/2014 - 11:56:12 - [] ----D C:\Users\alain\AppData\Local\com
O43 - CFD: 19/11/2014 - 22:20:02 - [] -SH-D C:\Users\alain\AppData\Local\EmieBrowserModeList
O43 - CFD: 26/08/2014 - 13:35:07 - [] ----D C:\Users\alain\AppData\Local\Films
O43 - CFD: 03/12/2014 - 17:10:27 - [] ----D C:\Users\alain\AppData\Local\ProtectedBrowsing =>PUP.ProtectedBrowsing
O43 - CFD: 13/03/2015 - 19:34:24 - [0] ----D C:\Users\alain\AppData\Local\Soldiers
O43 - CFD: 03/12/2014 - 17:10:27 - [] ----D C:\Users\alain\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ProtectedBrowsing =>PUP.ProtectedBrowsing
O43 - CFD: 13/03/2015 - 20:07:39 - [] ----D C:\Users\alain\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Soldiers
~ Program Folder: 249 Legitimates Filtered in 00mn 03s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.52262FA858EC9FFF069992E47C931E32] - 01/05/2015 - 15:22:24 --H-- . (...) -- C:\AMTAG.BIN [1024]
O44 - LFC:[MD5.39CCB43D7E99C51E8D79F9802098FC9D] - 02/05/2015 - 13:42:44 ---A- . (...) -- C:\PhysicalMBR.bin [512]
O44 - LFC:[MD5.E585CA2967C45464D97F48764F9260F4] - 21/04/2015 - 11:51:55 ---A- . (...) -- C:\Windows\BRWMARK.INI [441]
~ Files: 16 Legitimates Filtered in 01mn 06s



---\\ Déni du service (Local Security Authority) (O48)
~ LSA: 3 Legitimates Filtered in 00mn 00s



---\\ Contrôle du Safe Boot (CSB) (O49)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\19795325.sys . (...) -- C:\Windows\System32\Drivers\19795325.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\19795325.sys . (...) -- C:\Windows\System32\Drivers\19795325.sys (.not file.)
~ CSB: 21 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 17 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:13/08/2013 - 00:25:46 ---A- . (.Windows (R) Win 7 DDK provider - BCM Function 2 Device Driver.) -- C:\Windows\System32\Drivers\bcmfn2.sys [17624]
O58 - SDL:13/08/2014 - 23:52:08 ---A- . (.CHENGDU YIWO Tech Development Co., Ltd - Disk Backup Driver.) -- C:\Windows\System32\Drivers\eubakup.sys [61000]
O58 - SDL:13/08/2014 - 23:52:08 ---A- . (...) -- C:\Windows\System32\Drivers\EUBKMON.sys [48200]
O58 - SDL:13/08/2014 - 23:52:08 ---A- . (.CHENGDU YIWO Tech Development Co., Ltd - Disk Access Driver.) -- C:\Windows\System32\Drivers\eudskacs.sys [18504]
O58 - SDL:13/08/2014 - 23:52:08 ---A- . (.CHENGDU YIWO Tech Development Co., Ltd - Disk Backup Image Preview Driver.) -- C:\Windows\System32\Drivers\EuFdDisk.sys [189000]
O58 - SDL:22/01/2014 - 08:52:10 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG USB Composite Device Driver (MSS Ver.3).) -- C:\Windows\System32\Drivers\ssudbus.sys [108800]
O58 - SDL:22/01/2014 - 08:52:10 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG Android Modem Device Driver (MSS Ver.3).) -- C:\Windows\System32\Drivers\ssudmdm.sys [206080]
O58 - SDL:22/08/2013 - 13:43:32 ---A- . (.Promise Technology, Inc. - Promise SuperTrak EX Series Driver for Windows x64.) -- C:\Windows\System32\Drivers\stexstor.sys [31072]
O58 - SDL:15/08/2014 - 22:35:00 ---A- . (.Apple, Inc. - Apple Mobile Device USB Driver.) -- C:\Windows\System32\Drivers\usbaapl64.sys [54784]
O58 - SDL:07/03/2013 - 08:49:18 ---A- . (...) -- C:\Windows\System32\epmntdrv.sys [17480]
O58 - SDL:07/03/2013 - 08:49:18 ---A- . (...) -- C:\Windows\System32\EuGdiDrv.sys [9800]
O58 - SDL:07/03/2013 - 08:49:20 ---A- . (...) -- C:\Windows\SysWOW64\epmntdrv.sys [13896]
O58 - SDL:07/03/2013 - 08:49:20 ---A- . (...) -- C:\Windows\SysWOW64\EuGdiDrv.sys [9160]
~ Drivers: 60 Legitimates Filtered in 00mn 07s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2015 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {BDF61FAE-9D19-40F0-8F34-688DEB334CA9} [DefaultScope] - (Ad-Aware SecureSearch) - http://securedsearch.lavasoft.com
~ Keys: Scanned in 00mn 00s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.F3FC2E94E2A21055D7FD7B3D326D4332] [SPRF][21/04/2015] (...) -- C:\Users\alain\AppData\Roaming\wklnhst.dat [696]
~ Files: 1 Legitimates Filtered in 00mn 00s



---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "TCP Query User{C963673A-BFFF-4829-8BF6-5414A0BCC45D}C:\users\alain\appdata\local\microsoft\windows\inetcache\ie\g3bdtbsg\torrent_3-4-2-build-32691_fr_18245.exe" | In - Private - P6 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\users\alain\appdata\local\microsoft\windows\inetcache\ie\g3bdtbsg\torrent_3-4-2-build-32691_fr_18245.exe =>P2P.BitTorrent
O87 - FAEL: "UDP Query User{D38D4D19-5246-45D9-9244-85ADE0B1C375}C:\users\alain\appdata\local\microsoft\windows\inetcache\ie\g3bdtbsg\torrent_3-4-2-build-32691_fr_18245.exe" | In - Private - P17 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\users\alain\appdata\local\microsoft\windows\inetcache\ie\g3bdtbsg\torrent_3-4-2-build-32691_fr_18245.exe =>P2P.BitTorrent
O87 - FAEL: "TCP Query User{23758B23-041C-4122-B963-A61C0DC3EFB8}C:\users\alain\appdata\local\microsoft\windows\inetcache\ie\g3bdtbsg\torrent_3-4-2-build-32691_fr_18245.exe" | In - Public - P6 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\users\alain\appdata\local\microsoft\windows\inetcache\ie\g3bdtbsg\torrent_3-4-2-build-32691_fr_18245.exe =>P2P.BitTorrent
O87 - FAEL: "UDP Query User{9CCC4EAC-2A4B-4E30-995C-EF7181C2E1A4}C:\users\alain\appdata\local\microsoft\windows\inetcache\ie\g3bdtbsg\torrent_3-4-2-build-32691_fr_18245.exe" | In - Public - P17 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\users\alain\appdata\local\microsoft\windows\inetcache\ie\g3bdtbsg\torrent_3-4-2-build-32691_fr_18245.exe =>P2P.BitTorrent
O87 - FAEL: "{3FB1E2DE-C142-475F-9F4E-3EFA5D1D2A36}" | In - None - P6 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\alain\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O87 - FAEL: "{7220C338-2F73-46FA-9159-B592E43DA961}" | In - None - P17 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\alain\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
~ Firewall: 6 Legitimates Filtered in 00mn 11s



---\\ Enumère les données de la clé NameSpace (MNS) (O92)
O92 - MNS: - {1CF1260C-4DD0-4ebb-811F-33C572699FDE}
O92 - MNS: - {374DE290-123F-4565-9164-39C4925E467B}
O92 - MNS: - {3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}
O92 - MNS: - {A0953C92-50DC-43bf-BE83-3742FED03C9C}
O92 - MNS: - {A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}
O92 - MNS: - {B4BFCC3A-DB2C-424C-B029-7FE99A87C641}
~ MNS: 6 Legitimates Filtered in 00mn 00s



---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.17128F74795AC1631B057A80B633E3BF] [WIS][12/09/2014] (.ReSoft Ltd. - Shopping Helper Smartbar.) -- C:\Windows\Installer\3401ba0.msi [10874880] =>Hijacker.SmartBar
~ WIS: 1 Legitimates Filtered in 00mn 08s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 14/04/2015 268464 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Auto 22/07/1658 0 | (McAPExe) . (...) - C:\Program Files\McAfee\MSC\McAPexe.exe
SS - | Demand 02/04/2015 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Demand 29/10/2014 38792 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 30/05/2014 943160 | (AcrSch2Svc) . (.Acronis.) - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
SR - | Auto 19/12/2014 81088 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 10/09/2013 239616 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 10/09/2013 344064 | (AMD FUEL Service) . (.Advanced Micro Devices, Inc..) - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
SR - | Auto 19/01/2015 60744 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 30/08/2011 462184 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Auto 13/08/2014 37448 | (EaseUS Agent) . (.CHENGDU YIWO Tech Development Co., Ltd.) - C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe
SR - | Auto 19/02/2014 187432 | (fshoster) . (.F-Secure Corporation.) - C:\Program Files (x86)\VOO Internet Security\fshoster32.exe
SR - | Auto 16/08/2011 32768 | (JME Keyboard) . (...) - C:\Windows\jmesoft\Service.exe
SR - | Auto 22/01/2009 69632 | (JMRAIDManager) . (...) - C:\Program Files (x86)\JMRAIDManager\XSrvSetup.exe
SR - | Auto 27/04/2015 833888 | (LavasoftTcpService) . (.Lavasoft Limited.) - C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe
SR - | Disabled 22/07/1658 0 | (McMPFSvc) . (...) - C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
SR - | Auto 12/12/2013 230920 | (NitroDriverReadSpool9) . (.Nitro PDF Software.) - C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
SR - | Auto 12/12/2013 69640 | (nlsX86cc) . (.Nalpeiron Ltd..) - C:\WINDOWS\SysWOW64\NLSSRV32.exe
SR - | Auto 14/05/2013 390632 | (RichVideo64) . (...) - C:\Program Files\CyberLink\Shared files\RichVideo64.exe
SR - | Auto 27/04/2015 17768 | (SearchProtectionService) . (...) - C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe
SR - | Demand 22/07/1658 0 | (WdNisSvc) . (...) - C:\Program Files (x86)\Windows Defender\NisSrv.exe
SR - | Auto 22/07/1658 0 | (WinDefend) . (...) - C:\Program Files (x86)\Windows Defender\MsMpEng.exe
SR - | Auto 22/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
~ Services: Scanned in 01mn 01s



---\\ Scan Additionnel (O88)
Database Version : 13008 - (02/05/2015)
Clés trouvées (Keys found) : 1
Valeurs trouvées (Values found) : 5
Dossiers trouvés (Folders found) : 4
Fichiers trouvés (Files found) : 3

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{056b8dd8-de6a-4274-af26-5618aee3dbaa}] =>Hijacker.SmartBar^
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:uTorrent =>P2P.BitTorrent^
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:fst_be_80 =>Adware.FreeSoftToday^
C:\Program Files (x86)\ProtectedBrowsing =>PUP.ProtectedBrowsing^
C:\Program Files (x86)\SearchSnacks_1.10.0.5 =>PUP.SearchSnacks^
C:\Users\alain\AppData\Local\ProtectedBrowsing =>PUP.ProtectedBrowsing^
C:\Users\alain\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ProtectedBrowsing =>PUP.ProtectedBrowsing^
C:\Users\alain\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent^
[HKCU\Software\Smartbar] =>Hijacker.SmartBar^
C:\Windows\Installer\3401ba0.msi =>Hijacker.SmartBar^
~ Additionnel Scan: 264011 Items scanned in 02mn 23s



---\\ Informations complémentaires sur les modules
~ http://nicolascoolman.fr/r5-internet-explorer-proxy-management-iepm/ =>.Internet Explorer, Proxy Management (R5)
~ http://nicolascoolman.fr/o4-applications-demarrees-par-le-registre/ =>.Applications lancées au démarrage du système (O4)
~ AMI: 2 Legitimates Filtered in 00mn 00s



---\\ Récapitulatif des détections trouvées sur votre station
http://www.nicolascoolman.fr/blog/ =>PUP.OnlySearch
http://nicolascoolman.fr/adware-freesofttoday =>Adware.FreeSoftToday
http://nicolascoolman.fr/toolbar-conduit =>Toolbar.Conduit
http://nicolascoolman.fr/hijacker-smartbar =>Hijacker.SmartBar
http://www.nicolascoolman.fr/blog/ =>PUP.ProtectedBrowsing
http://www.nicolascoolman.fr/blog/ =>PUP.SearchSnacks
~ MSI: 6 link(s) detected in 00mn 00s



~ 727 Legitimates filtered by white list
End of the scan (468 lines in 07mn 21s)(0.10)

Publicité


Signaler le contenu de ce document

Publicité