cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

~ Rapport de ZHPDiag v2015.6.4.54 - Nicolas Coolman (31/05/2015)
~ Lancé par doowee (11/08/2015 09:36:05)
~ Facebook : https://www.facebook.com/nicolascoolman1
~ Adresse du Forum http://forum.nicolascoolman.fr
~ Traduit par Nicolas Coolman
~ Etat de la version : Nouvelle version disponible
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by program


---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.17905
GCIE: Google Chrome v44.0.2403.130 (Defaut)

---\\ Informations sur les produits Windows
~ Langage: Français
Windows Server License Manager Script : OK
~ Windows(R) Operating System, OEM_DM channel
Windows ID Activation : OK
~ Windows Partial Key : CWD6R
Windows License : OK
~ Windows Remaining Initializations Number : 998
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
Windows 8.1 Connected, 64-bit (Build 9600)

---\\ Logiciels de protection du système
Malwarebytes Anti-Malware version 2.1.8.1057
Windows Defender W8 (Activate)

---\\ Logiciels d'optimisation du système
CCleaner v5.08

---\\ Logiciels de partage PeerToPeer

---\\ Surveillance de Logiciels
Adobe Flash Player 18 NPAPI
Adobe Reader 7.0.8

---\\ Informations sur le système
~ Processor: AMD64 Family 22 Model 48 Stepping 1, AuthenticAMD
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3544 MB (37% free)
System Restore: Activé (Enable)
System drive C: has 350 GB (82%) free of 426 GB

---\\ Mode de connexion au système
~ Computer Name: PITCHOUNETTE
~ User Name: doowee
~ All Users Names: doowee, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\doowee\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\doowee\AppData\Roaming\
~ %Desktop% : C:\Users\doowee\Desktop\
~ %Favorites% : C:\Users\doowee\Favorites\
~ %LocalAppData% : C:\Users\doowee\AppData\Local\
~ %StartMenu% : C:\Users\doowee\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 350 Go of 426 Go)
D: Hard drive, Flash drive, Thumb drive (Free 23 Go of 25 Go)
E: CD-ROM drive (Not Inserted)
F: CD-ROM drive (Free 0 Go of 1 Go)
G: CD-ROM drive (Free 0 Go of 1 Go)
I: CD-ROM drive (Free 0 Go of 2 Go)



---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 41 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.C10A66189DC8C090E7C84873EDCEBC88] - (.Microsoft Corporation - Explorateur Windows.) (.28/01/2015 - 00:47:12.) -- C:\Windows\Explorer.exe [2501368]
[MD5.A570A64292214C43E0BA50E6A72A6380] - (.Microsoft Corporation - Application de démarrage de Windows.) (.29/10/2014 - 02:25:54.) -- C:\Windows\System32\Wininit.exe [145920]
[MD5.98C6A46E9E2822BF83196C2EAE43DBD4] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.15/06/2015 - 22:16:12.) -- C:\Windows\System32\wininet.dll [2427392]
[MD5.EC498BAE1F0D3E0E401C963F8D76C437] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.29/10/2014 - 02:22:52.) -- C:\Windows\System32\Winlogon.exe [572416]
[MD5.AFCAB4DC692CCE37E283B00E2D7B438F] - (.Microsoft Corporation - Bibliothèque de licences.) (.18/03/2014 - 10:54:52.) -- C:\Windows\System32\sppcomapi.dll [447488]
[MD5.374E27295F0A9DCAA8FC96370F9BEEA5] - (.Microsoft Corporation - Pilote de fonction connexe pour WinSock.) (.02/09/2014 - 14:08:26.) -- C:\Windows\system32\Drivers\AFD.sys [563200]
[MD5.74B14192CF79A72F7536B27CB8814FBD] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.22/08/2013 - 13:43:41.) -- C:\Windows\system32\Drivers\atapi.sys [26464]
[MD5.2FA6510E33F7DEFEC03658B74101A9B9] - (.Microsoft Corporation - CD-ROM File System Driver.) (.22/08/2013 - 12:40:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [88576]
[MD5.C6796EA22B513E3457514D92DCDB1A3D] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.22/08/2013 - 09:46:35.) -- C:\Windows\system32\Drivers\Cdrom.sys [164352]
[MD5.A03F362C5557E238CBFA914689C77248] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.06/03/2014 - 10:22:50.) -- C:\Windows\system32\Drivers\DfsC.sys [134144]
[MD5.D4B7ED39C7900384D9E5C1283F1E7926] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.24/07/2014 - 12:45:39.) -- C:\Windows\system32\Drivers\HDAudBus.sys [76800]
[MD5.49EE0AE9E5B64FFBBD06D55C4984B598] - (.Microsoft Corporation - Pilote de port i8042.) (.04/11/2014 - 07:54:54.) -- C:\Windows\system32\Drivers\i8042prt.sys [108544]
[MD5.B7342B3C58E91107F6E946A93D9D4EFD] - (.Microsoft Corporation - IP Network Address Translator.) (.18/03/2014 - 10:54:55.) -- C:\Windows\system32\Drivers\IpNat.sys [142848]
[MD5.6FBDF2B1B025A8E6E069234362FFFFB7] - (.Microsoft Corporation - Minirdr SMB Windows NT.) (.27/06/2015 - 04:12:25.) -- C:\Windows\system32\Drivers\MRxSmb.sys [401408]
[MD5.0217532E19A748F0E5D569307363D5FD] - (.Microsoft Corporation - MBT Transport driver.) (.22/08/2013 - 12:37:02.) -- C:\Windows\system32\Drivers\netBT.sys [282624]
[MD5.7F68063A5A0461E02BC860CE0E6BFDDC] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.15/10/2014 - 09:32:37.) -- C:\Windows\system32\Drivers\ntfs.sys [2025792]
[MD5.764B1121867B2D9B31C491668AC72B2B] - (.Microsoft Corporation - Pilote de port parallèle.) (.22/08/2013 - 12:40:02.) -- C:\Windows\system32\Drivers\Parport.sys [94208]
[MD5.1BD3022FD6E450B00DE560265638FD2A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.08/11/2014 - 04:58:31.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [112640]
[MD5.680C1DAE268B6FB67FA21B389A8B79EF] - (.Microsoft Corporation - Redirecteur de périphérique de Microsoft RDP.) (.18/03/2014 - 10:37:57.) -- C:\Windows\system32\Drivers\rdpdr.sys [195584]
[MD5.FFF28F9F6823EB1756C60F1649560BBF] - (.Microsoft Corporation - TDI Translation Driver.) (.22/08/2013 - 14:25:35.) -- C:\Windows\system32\Drivers\tdx.sys [107520]
[MD5.64CA2B4A49A8EAF495E435623ECCE7DB] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.19/06/2014 - 03:13:36.) -- C:\Windows\system32\Drivers\volsnap.sys [310080]
~ Generic Processes: Scanned in 00mn 01s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/314
~ Mes musiques (My Musics) : 3/1190
~ Mes Favoris (My Favorites) : 1/7
~ Mes Documents (My Documents) : 1/192
~ Mon Bureau (My Desktop) : 1/219
~ Menu demarrer (Programs) : 1/32
~ Hidden Files: Scanned in 00mn 04s



---\\ Processus lancés
[MD5.ABFF2B3A80AA5348BE5E43EFD6B415D1] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe [6554424] [PID.5452]
[MD5.FE6F00C77F7ACA130E7BC5B9B9BD4445] - (.Pokki - Host App Service.) -- C:\Users\doowee\AppData\Local\Pokki\Engine\HostAppService.exe [7867904] [PID.3148]
[MD5.DFAE85572A4565A0B04B34F872EC58DB] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [813896] [PID.2868]
[MD5.12E2FC1F74265881402DE856D01EFFFE] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8214016] [PID.3952]
~ Processes Running: Scanned in 00mn 09s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\doowee\AppData\Local\Google\Chrome\User Data\Default\Preferences

---\\ Liste des dossiers d'extension Google Chrome
~ Google Lines Browser: 8 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (21)
~ Hosts File: Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Dll-Files Fixer.lnk . (.Dll-FIles.Com - DLL-Files Fixer.) -- C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe =>PUP.DllFilesFixer
O4 - GS\QuickLaunch [doowee]: Dll-Files Fixer.lnk . (.Dll-FIles.Com - DLL-Files Fixer.) -- C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe =>PUP.DllFilesFixer
O4 - GS\QuickLaunch [doowee]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\doowee\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\Desktop [doowee]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\doowee\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
~ Global Startup: 5 Legitimates Filtered in 00mn 07s



---\\ Applications lancées au démarrage du système (O4)
O4 - GS\Startup [doowee]: ubisoft register.lnk . (...) -- C:\Program Files (x86)\Ubisoft\Rayman 3\Register\schedule.exe (.not file.)
O4 - HKLM\..\Run: [ForteConfig] . (.Pas de propriétaire - FMAPP Application.) -- C:\Program Files\Conexant\ForteConfig\fmapp.exe
O4 - HKLM\..\Run: [SmartAudio] . (.Conexant Systems, Inc. - SmartAudio CPL (32bit).) -- C:\Program Files\CONEXANT\SAII\SACpl.exe
O4 - HKLM\..\Run: [cAudioFilterAgent] . (.Conexant Systems, Inc. - Conexant High Definition Audio Filter Agent.) -- C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe (.not file.)
O4 - HKLM\..\Run: [RtsFT] . (.Realtek semiconductor - RTFTrack.) -- C:\Windows\RTFTrack.exe
O4 - HKLM\..\Run: [PhoneCompanion] . (.Lenovo - Lenovo Phone Companion.) -- C:\Program Files\Lenovo PhoneCompanion\Phone Companion.exe
O4 - HKCU\..\Run: [CCleaner Monitoring] . (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner64.exe =>.Piriform Ltd
O4 - HKCU\..\Run: [DAEMON Tools Lite Automount] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files\DAEMON Tools Lite\DTAgent.exe =>.DT Soft Ltd
O4 - HKCU\..\RunOnce: [Application Restart #2] . (.Pokki - Host App Service.) -- C:\Users\doowee\AppData\Local\Pokki\Engine\HostAppService.exe
O4 - HKCU\..\RunOnce: [Application Restart #1] . (.Pokki - Host App Service.) -- C:\Users\doowee\AppData\Local\Pokki\Engine\HostAppService.exe
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe =>.Advanced Micro Devices, Inc
O4 - HKLM\..\Wow6432Node\Run: [CLMLServer_For_P2G8] . (.CyberLink - CyberLink MediaLibrary Service.) -- C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc_P2G8.exe
O4 - HKLM\..\Wow6432Node\Run: [CLVirtualDrive] . (.CyberLink Corp. - CyberLink Virtual Drive.) -- C:\Program Files (x86)\Lenovo\Power2Go\VirtualDrive.exe
O4 - HKLM\..\policies\Explorer\Run: [BtvStack] . (.Qualcomm®Atheros® - Extension Core.) -- C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
O4 - HKUS\S-1-5-21-1226368971-3115154784-3979300067-1002\..\Run: [CCleaner Monitoring] . (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner64.exe =>.Piriform Ltd
O4 - HKUS\S-1-5-21-1226368971-3115154784-3979300067-1002\..\Run: [DAEMON Tools Lite Automount] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files\DAEMON Tools Lite\DTAgent.exe =>.DT Soft Ltd
O4 - HKUS\S-1-5-21-1226368971-3115154784-3979300067-1002\..\RunOnce: [Application Restart #2] . (.Pokki - Host App Service.) -- C:\Users\doowee\AppData\Local\Pokki\Engine\HostAppService.exe
O4 - HKUS\S-1-5-21-1226368971-3115154784-3979300067-1002\..\RunOnce: [Application Restart #1] . (.Pokki - Host App Service.) -- C:\Users\doowee\AppData\Local\Pokki\Engine\HostAppService.exe
~ Application: Scanned in 00mn 06s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{03D99F00-76E1-4430-BDD4-19C939BA4A6D}: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{B3572136-EAAE-4D91-9E41-0481135C5766}: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{03D99F00-76E1-4430-BDD4-19C939BA4A6D}: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{B3572136-EAAE-4D91-9E41-0481135C5766}: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.254
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: AtherosSvc (AtherosSvc) . (.Windows (R) Win 7 DDK provider - Windows Setup API.) - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
O23 - Service: CCSDK (CCSDK) . (...) - C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe
~ Services: 15 Legitimates Filtered in 00mn 24s



---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [{4949B4B1-3B53-4A9E-831A-E9EB55DCF560}] (...) -- F:\EASetup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{F69CF26A-12F0-4F07-B400-24A9914FA92D}] (...) -- G:\FileRgn.exe (.not file.) [0]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater [1002]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\DLL-Files.Com Fixer_MONTHLY [304] =>PUP.DllFilesFixer
O39 - APT: - (..) -- C:\Windows\System32\Tasks\DLL-Files.Com Fixer_Updates [320] =>PUP.DllFilesFixer
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore [1090]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA [1094]
~ Scheduled Task: 16 Legitimates Filtered in 00mn 18s



---\\ Logiciels installés (O42)
O42 - Logiciel: Host App Service - (.Pokki.) [HKCU][64Bits] -- Pokki
O42 - Logiciel: OEM Application Profile - (.Nom de votre société.) [HKLM][64Bits] -- {8F92E0CF-620B-5C20-F292-59C93567B06D}
~ Logic: 27 Legitimates Filtered in 00mn 01s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\CoreJpeg]
[HKLM\Software\CNXT_UIU_MUTEX]
[HKLM\Software\Wow6432Node\VisualDiscovery] =>PUP.VisualDiscovery
~ Key Software: 189 Legitimates Filtered in 00mn 01s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 15/12/2014 - 17:04:49 - [0] ----D C:\Program Files (x86)\New Folder
O43 - CFD: 03/08/2015 - 02:39:44 - [0] ----D C:\ProgramData\Energy Manager
O43 - CFD: 03/08/2015 - 01:48:07 - [0] ----D C:\ProgramData\Office2013
O43 - CFD: 15/12/2014 - 16:01:25 - [] ----D C:\ProgramData\{EB5F5A55-037A-4E47-806B-2C8AA9374701}
O43 - CFD: 18/03/2014 - 11:38:02 - [0] R-H-D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC
O43 - CFD: 08/08/2015 - 11:16:50 - [] ----D C:\Users\doowee\AppData\Local\Disc_Soft_Ltd
O43 - CFD: 02/08/2015 - 12:30:54 - [] ----D C:\Users\doowee\AppData\Local\GWX
~ Program Folder: 148 Legitimates Filtered in 00mn 01s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.F0E857AA9EFCC374C1931F7E9978C480] - 02/08/2015 - 09:12:30 ---A- . (...) -- C:\Windows\diagerr.xml [24768]
O44 - LFC:[MD5.F0E857AA9EFCC374C1931F7E9978C480] - 02/08/2015 - 09:12:30 ---A- . (...) -- C:\Windows\diagwrn.xml [24768]
O44 - LFC:[MD5.2CBD6D22499EB13A2666F62EF33D00E2] - 02/08/2015 - 10:09:10 ---A- . (...) -- C:\Windows\System32\ieuinit.inf [16303]
O44 - LFC:[MD5.3DCE7705F6770C90A616B149C261E8EE] - 02/08/2015 - 21:46:15 ---A- . (...) -- C:\Windows\System32\ApnDatabase.xml [411133]
O44 - LFC:[MD5.459AEE6534F08322ECA4E9359C0CDABE] - 03/08/2015 - 00:12:03 ---A- . (.Pas de propriétaire - Application ContextH.) -- C:\Windows\System32\BWContextHandler.dll [53248]
O44 - LFC:[MD5.A5F320FFE96F6939D2FF39360ADA9B5A] - 03/08/2015 - 00:12:34 ---A- . (.Pas de propriétaire - Gestionnaire de contexte pour réseau person.) -- C:\Windows\System32\BthpanContextHandler.dll [96256]
O44 - LFC:[MD5.97F55D94100BA13A9C0647A4F193700A] - 03/08/2015 - 00:13:43 ---A- . (.Windows (R) Win 7 DDK provider - DSC.) -- C:\Windows\System32\DscCoreConfProv.dll [200192]
O44 - LFC:[MD5.44F608DE62582C93D7111D2CC8183FAE] - 03/08/2015 - 01:13:28 ---A- . (...) -- C:\Windows\System32\VfService.trf [2560]
O44 - LFC:[MD5.08750A50CF027F93070C8BB78E27C3B7] - 03/08/2015 - 13:31:59 -SH-- . (...) -- C:\Windows\System32\desktop.ini [75]
~ Files: 2461 Legitimates Filtered in 01mn 46s



---\\ Déni du service (Local Security Authority) (O48)
~ LSA: 3 Legitimates Filtered in 00mn 00s



---\\ Clé de registre Shell MountPoints2 (MPSK) (O51)
O51 - MPSK:{b587aba6-3c5c-11e5-8271-68f72849b14e}\AutoRun\command. (...) -- F:\autorun.exe
O51 - MPSK:{b587ac52-3c5c-11e5-8271-68f72849b14e}\AutoRun\command. (...) -- G:\Autorun.exe
O51 - MPSK:{f975ac86-3ceb-11e5-8272-68f72849b14e}\AutoRun\command. (.Pas de propriétaire - Age of Mythology: Extended Edition (c) Microsoft Studios Set.) -- I:\setup.exe
~ Keys: Scanned in 00mn 02s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKLM\...\Policies\System] - "DisableCAD"=1
~ MWPS: 18 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:11/03/2014 - 15:19:46 ---A- . (.Windows (R) Win 7 DDK provider - KSL Kernel-Mode Dll.) -- C:\Windows\System32\Drivers\amdacpksl.sys [142848]
O58 - SDL:13/08/2013 - 00:25:46 ---A- . (.Windows (R) Win 7 DDK provider - BCM Function 2 Device Driver.) -- C:\Windows\System32\Drivers\bcmfn2.sys [17624]
O58 - SDL:22/08/2013 - 13:43:32 ---A- . (.Promise Technology, Inc. - Promise SuperTrak EX Series Driver for Windows x64.) -- C:\Windows\System32\Drivers\stexstor.sys [31072]
~ Drivers: 63 Legitimates Filtered in 00mn 06s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2015 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {EB99CAC9-0D20-461A-9359-B4BC432B4C97} [DefaultScope] - (Bing) - http://www.bing.com
~ Keys: Scanned in 00mn 00s



---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{C14A0328-66EB-4B18-BE97-C99D91EAB9D2}" | In - None - P6 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\doowee\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O87 - FAEL: "{40C0241A-4793-48EF-825E-503BC2721405}" | In - None - P17 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\doowee\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O87 - FAEL: "{305EC172-E812-475F-AC5A-3538D4B48F34}" | Out - Private - P6 - TRUE | .(.Dll-FIles.Com - DLL-Files Fixer.) -- C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe =>PUP.DllFilesFixer
O87 - FAEL: "{784235CE-3157-4721-A06B-9482457E2647}" | Out - Private - P6 - TRUE | .(.Dll-FIles.Com - DLL-Files Fixer.) -- C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe =>PUP.DllFilesFixer
O87 - FAEL: "{2629EA52-50CC-4840-A686-000A67A49FBE}" | Out - Private - P6 - TRUE | .(.Dll-FIles.Com - DLL-Files Fixer.) -- C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe =>PUP.DllFilesFixer
O87 - FAEL: "{91A658C6-E001-4255-8942-870EEE8D238C}" | Out - Private - P6 - TRUE | .(.Dll-FIles.Com - DLL-Files Fixer.) -- C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe =>PUP.DllFilesFixer
O87 - FAEL: "{D86939BB-DB02-48B7-AF35-66514FB8988C}" | Out - Private - P6 - TRUE | .(.Dll-FIles.Com - DLL-Files Fixer.) -- C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe =>PUP.DllFilesFixer
O87 - FAEL: "{D150A648-A5B8-4202-AC6C-9E8A00F2413B}" | Out - Private - P6 - TRUE | .(.Dll-FIles.Com - DLL-Files Fixer.) -- C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe =>PUP.DllFilesFixer
O87 - FAEL: "{04292848-C28C-47ED-A874-F5EA759FAE1C}" | Out - Private - P6 - TRUE | .(.Dll-FIles.Com - DLL-Files Fixer.) -- C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe =>PUP.DllFilesFixer
O87 - FAEL: "{907D43EB-CB31-4CC7-A7D8-3763B3473304}" | Out - Private - P6 - TRUE | .(.Dll-FIles.Com - DLL-Files Fixer.) -- C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe =>PUP.DllFilesFixer
O87 - FAEL: "{137CD5BA-20EC-45C0-8DC6-82FDA6F1D02D}" | Out - Private - P6 - TRUE | .(.Dll-FIles.Com - DLL-Files Fixer.) -- C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe =>PUP.DllFilesFixer
O87 - FAEL: "{9D3A3E7F-BB06-443A-98EA-21C484F9679A}" | Out - Private - P6 - TRUE | .(.Dll-FIles.Com - DLL-Files Fixer.) -- C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe =>PUP.DllFilesFixer
O87 - FAEL: "{791C6B79-9165-4748-A830-4FA9184B6CFD}" | Out - Private - P6 - TRUE | .(.Dll-FIles.Com - DLL-Files Fixer.) -- C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe =>PUP.DllFilesFixer
O87 - FAEL: "{D1CBCF9A-2435-4D01-828C-FD39D98C8413}" | Out - Private - P6 - TRUE | .(.Dll-FIles.Com - DLL-Files Fixer.) -- C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe =>PUP.DllFilesFixer
O87 - FAEL: "{65CD1D24-51B6-49DE-8155-BF7C664B092C}" | Out - Private - P6 - TRUE | .(.Dll-FIles.Com - DLL-Files Fixer.) -- C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe =>PUP.DllFilesFixer
~ Firewall: 15 Legitimates Filtered in 00mn 06s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 10/08/2015 268976 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Auto 02/08/2015 144200 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 02/08/2015 144200 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 03/04/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
SS - | Demand 15/12/2014 308720 | (PhoneCompanionVap) . (.Lenovo.) - C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionVap.exe
SS - | Demand 22/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 19/04/2014 239616 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 18/04/2014 344064 | (AMD FUEL Service) . (.Advanced Micro Devices, Inc..) - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
SR - | Auto 25/02/2014 319104 | (AtherosSvc) . (.Windows (R) Win 7 DDK provider.) - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
SR - | Auto 09/07/2014 592880 | (CCSDK) . (...) - C:\Program Files (x86)\Lenovo\CCSDK\CCSDK.exe
SR - | Auto 25/07/2013 206552 | (CxAudMsg) . (.Conexant Systems Inc..) - C:\WINDOWS\system32\CxAudMsg64.exe
SR - | Demand 18/06/2015 1268568 | (Disc Soft Lite Bus Service) . (.Disc Soft Ltd.) - C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe =>.DT Soft Ltd
SR - | Auto 15/12/2014 198192 | (LenovoWiFiHotspotSvr) . (.Lenovo(beijing) Limited.) - C:\Windows\System32\LenovoWiFiHotspotSvr.exe
SR - | Auto 18/06/2015 1871160 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
SR - | Auto 18/06/2015 1133880 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
SR - | Auto 15/12/2014 288240 | (PhoneCompanionPusher) . (.Lenovo.) - C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe
SR - | Auto 24/04/2012 390632 | (RichVideo64) . (...) - C:\Program Files\CyberLink\Shared files\RichVideo64.exe
SR - | Auto 22/07/1658 0 | (SAService) . (.Conexant Systems, Inc..) - C:\Windows\System32\SAsrv.exe
SR - | Auto 24/06/2014 190704 | (SynTPEnhService) . (.Synaptics Incorporated.) - C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
SR - | Auto 24/02/2014 51712 | (tbaseprovisioning) . (.Advanced Micro Devices, Inc..) - C:\Windows\SysWOW64\tbaseprovisioning.exe
SR - | Demand 22/07/1658 0 | (WdNisSvc) . (...) - C:\Program Files (x86)\Windows Defender\NisSrv.exe
SR - | Auto 22/07/1658 0 | (WinDefend) . (...) - C:\Program Files (x86)\Windows Defender\MsMpEng.exe
SR - | Demand 29/10/2014 38792 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 25/02/2014 323584 | (ZAtheros Bt and Wlan Coex Agent) . (.Atheros.) - C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
~ Services: Scanned in 00mn 46s



---\\ Scan Additionnel (O88)
Database Version : 13008 - (31/05/2015)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 4
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 3

C:\Windows\System32\Tasks\DLL-Files.Com Fixer_MONTHLY =>PUP.DllFilesFixer^
C:\Windows\System32\Tasks\DLL-Files.Com Fixer_Updates =>PUP.DllFilesFixer^
[HKLM\Software\Wow6432Node\VisualDiscovery] =>PUP.VisualDiscovery^
~ Additionnel Scan: 161394 Items scanned in 01mn 02s



---\\ Informations complémentaires sur les modules
~ http://nicolascoolman.fr/r5-internet-explorer-proxy-management-iepm/ =>.Internet Explorer, Proxy Management (R5)
~ http://nicolascoolman.fr/o4-applications-demarrees-par-le-registre/ =>.Applications lancées au démarrage du système (O4)
~ http://nicolascoolman.fr/o51-mountpoints2-shell-key-mpsk/ =>.Clé de registre Shell MountPoints2 (MPSK) (O51)
~ AMI: 3 Legitimates Filtered in 00mn 00s



---\\ Récapitulatif des détections trouvées sur votre station
http://www.nicolascoolman.fr/blog/ =>PUP.DllFilesFixer
http://www.nicolascoolman.fr/blog/ =>PUP.VisualDiscovery
~ MSI: 2 link(s) detected in 00mn 00s



~ 3011 Legitimates filtered by white list
End of the scan (410 lines in 06mn 02s)(0.10)

Publicité


Signaler le contenu de ce document

Publicité