cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

Rapport de ZHPDiag v2013.7.7.10 par Nicolas Coolman, Update du 07/07/2013
Run by Julien at 09/07/2013 15:35:47
WebSite: http://nicolascoolman.webs.com
State : Version à jour.
WhiteList : Enable
High Elevated Privileges : OK
UAC : Deactivate by program


---\\ Web Browser
MSIE: Internet Explorer v7.0.6001.18000
MFIE: Mozilla Firefox 22.0 (Defaut)

---\\ Windows Product Information
~ Langage: Français
Windows Vista Home Basic Edition, 32-bit Service Pack 1 (Build 6001)
Windows Server License Manager Script : OK
~ Vista, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : P92J4
Windows License : OK
Windows Automatic Updates : OK

---\\ System Protection
Bitdefender Total Security 2012 v15.0.41
Malwarebytes Anti-Malware version 1.75.0.1300
McAfee Security Scan Plus v3.0.318.3

---\\ System Optimizer

---\\ Peer To Peer (P2P)
µTorrent v3.3.0.29625 =>P2P.µTorrent

---\\ Software Update
Adobe Flash Player 11 Plugin
Adobe Reader X

---\\ System Information
~ Processor: x86 Family 6 Model 15 Stepping 13, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1976 MB (55% free)
System Restore: Activé (Enable)
System drive C: has 22 GB (31%) free of 70 GB

---\\ Logged in mode
~ Computer Name: PC-DE-JULIEN
~ User Name: Julien
~ All Users Names: Julien, Administrateur,
~ Unselected Option: None
Logged in as Administrator

---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Users\Julien\AppData\Roaming\
~ %Desktop% : C:\Users\Julien\Desktop\
~ %Favorites% : C:\Users\Julien\Favorites\
~ %LocalAppData% : C:\Users\Julien\AppData\Local\
~ %StartMenu% : C:\Users\Julien\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 22 Go of 70 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 17 Go of 70 Go)
E:\ CD-ROM drive (Not Inserted)



---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: 29 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.4F554999D7D5F05DAAEBBA7B5BA1089D] - (.Microsoft Corporation - Explorateur Windows.) (.29/10/2008 - 07:29:41.) -- C:\Windows\Explorer.exe [2927104]
[MD5.101BA3EA053480BB5D957EF37C06B5ED] - (.Microsoft Corporation - Application de démarrage de Windows.) (.21/01/2008 - 03:33:13.) -- C:\Windows\System32\Wininit.exe [96768]
[MD5.DA5A72211661C7F162B332FEA4F09A69] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.21/04/2011 - 16:00:34.) -- C:\Windows\System32\wininet.dll [833024]
[MD5.C2610B6BDBEFC053BBDAB4F1B965CB24] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.21/01/2008 - 03:34:38.) -- C:\Windows\System32\Winlogon.exe [314880]
[MD5.48EB99503533C27AC6135648E5474457] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.21/04/2011 - 14:16:42.) -- C:\Windows\system32\Drivers\AFD.sys [273408]
[MD5.2D9C903DC76A66813D350A562DE40ED9] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.21/01/2008 - 03:32:21.) -- C:\Windows\system32\Drivers\atapi.sys [21560]
[MD5.7ADD03E75BEB9E6DD102C3081D29840A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.21/01/2008 - 03:33:23.) -- C:\Windows\system32\Drivers\Cdfs.sys [70144]
[MD5.1EC25CEA0DE6AC4718BF89F9E1778B57] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/01/2008 - 03:32:23.) -- C:\Windows\system32\Drivers\Cdrom.sys [67072]
[MD5.A3E9FA213F443AC77C7746119D13FEEC] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.14/04/2011 - 15:24:14.) -- C:\Windows\system32\Drivers\DfsC.sys [75264]
[MD5.C87B1EE051C0464491C1A7B03FA0BC99] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/01/2008 - 03:32:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [53760]
[MD5.22D56C8184586B7A1F6FA60BE5F5A2BD] - (.Microsoft Corporation - Pilote de port i8042.) (.21/01/2008 - 03:32:45.) -- C:\Windows\system32\Drivers\i8042prt.sys [54784]
[MD5.8793643A67B42CEC66490B2A0CF92D68] - (.Microsoft Corporation - IP Network Address Translator.) (.21/01/2008 - 03:34:06.) -- C:\Windows\system32\Drivers\IpNat.sys [100864]
[MD5.5734A0F2BE7E495F7D3ED6EFD4B9F5A1] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.29/04/2011 - 13:49:35.) -- C:\Windows\system32\Drivers\MRxSmb.sys [105984]
[MD5.7C5FEE5B1C5728507CD96FB4A13E7A02] - (.Microsoft Corporation - MBT Transport driver.) (.21/01/2008 - 03:34:49.) -- C:\Windows\system32\Drivers\netBT.sys [184320]
[MD5.B4EFFE29EB4F15538FD8A9681108492D] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.21/01/2008 - 03:33:23.) -- C:\Windows\system32\Drivers\ntfs.sys [1081912]
[MD5.0FA9B5055484649D63C303FE404E5F4D] - (.Microsoft Corporation - Pilote de port parallèle.) (.02/11/2006 - 09:51:30.) -- C:\Windows\system32\Drivers\Parport.sys [79360]
[MD5.A214ADBAF4CB47DD2728859EF31F26B0] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/01/2008 - 03:34:44.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [76288]
[MD5.FBC0BACD9C3D7F6956853F64A66E252D] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.21/01/2008 - 03:32:22.) -- C:\Windows\system32\Drivers\rdpdr.sys [248832]
[MD5.031E6BCD53C9B2B9ACE111EAFEC347B6] - (.Microsoft Corporation - SMB Transport driver.) (.21/01/2008 - 03:34:49.) -- C:\Windows\system32\Drivers\smb.sys [66560]
[MD5.D09276B1FAB033CE1D40DCBDF303D10F] - (.Microsoft Corporation - TDI Translation Driver.) (.21/01/2008 - 03:34:42.) -- C:\Windows\system32\Drivers\tdx.sys [71680]
[MD5.D8B4A53DD2769F226B3EB374374987C9] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/01/2008 - 03:32:47.) -- C:\Windows\system32\Drivers\volsnap.sys [227896]
~ Generic Processes: Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/2
~ Mes musiques (My Musics) : 1/40
~ Mes Videos (My Videos) : 1/4
~ Mes Favoris (My Favorites) : 1/21
~ Mes Documents (My Documents) : 1/168
~ Mon Bureau (My Desktop) : 1/106
~ Menu demarrer (Programs) : 1/77
~ Hidden Files: Scanned in 00mn 01s



---\\ Processus lancés
[MD5.6B778E95130FE940736F2A5C7D78F545] - (.Bitdefender - Bitdefender Agent.) -- C:\Program Files\Bitdefender\Bitdefender 2012\bdagent.exe [1199344] [PID.520]
[MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.2724]
[MD5.D3804513FC9C11A4637392B4F0F43BC5] - (.Intel Corporation - Event Monitor User Notification Tool.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [182808] [PID.3064]
[MD5.C459786D07FEAD5717DD1AC287BB2519] - (.Realtek Semiconductor - HD Audio Control Panel.) -- C:\Windows\RtHDVCpl.exe [6265376] [PID.3076]
[MD5.19D93154C82FE39A99B269CED1056A92] - (.Synaptics, Inc. - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1033512] [PID.3088]
[MD5.6882D187F65ECA79110848A68FDEB2BF] - (.Pas de propriétaire - NTI Backup Now 5 Tray Module.) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe [34040] [PID.3096]
[MD5.F6474B8FC4744A7E467370C3B66EF9FC] - (.Intel Corporation - igfxTray Module.) -- C:\Windows\System32\igfxtray.exe [150040] [PID.3104]
[MD5.2DEF9EEA8F37FB2770359DA35C609142] - (.Intel Corporation - hkcmd Module.) -- C:\Windows\System32\hkcmd.exe [170520] [PID.3112]
[MD5.5EA38E789957EF8386C8458438BFF90B] - (.Intel Corporation - persistence Module.) -- C:\Windows\System32\igfxpers.exe [145944] [PID.3120]
[MD5.17ED0AE8DDEF1ABF12C106BBC245DC76] - (.Dritek System Inc. - Launch Manager.) -- C:\Program Files\Launch Manager\QtZyEmachine.exe [817672] [PID.3724]
[MD5.3CB07566302BCEEB898DE270A0BEC175] - (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352] [PID.3756]
[MD5.278A1F51C56B06436C4227A85A0914ED] - (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\System32\spool\drivers\w32x86\3\E_FATIEDE.exe [188928] [PID.3784]
[MD5.BD713579A87D698E1F2158CE10E48130] - (.McAfee, Inc. - McAfee Security Scanner Scheduler.) -- C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe [272248] [PID.3792]
[MD5.9FEE8D10461760D2B0644B2D76BB9DE4] - (.Intel Corporation - igfxsrvc Module.) -- C:\Windows\system32\igfxsrvc.exe [256536] [PID.2120]
[MD5.ACE58599BDD6051CBE3D78353E7D21F0] - (.Intel Corporation - igfxext Module.) -- C:\Windows\system32\igfxext.exe [174616] [PID.1912]
[MD5.892699A6AEB910C58B726BD70BEA4F4B] - (.Synaptics, Inc. - Synaptics Pointing Device Helper.) -- C:\Program Files\Synaptics\SynTP\SynTPHelper.exe [95528] [PID.2300]
[MD5.F96EBC5A624349D81DCC7600A3C5DC43] - (.Microsoft Corporation - Console IME.) -- C:\Windows\system32\conime.exe [69120] [PID.1752]
[MD5.639B783F5BC546D8D9662881730AFF9B] - (.Adobe Systems Incorporated - AAM Updates Notifier Application.) -- C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe [310224] [PID.3292]
[MD5.7E9AA22FC48A43223C7154E810EC7F68] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7684096] [PID.1396]
[MD5.634DDFC788E1EC0A045E9969529FFCB3] - (.Bitdefender - Bitdefender Security Service.) -- C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe [1554176] [PID.944]
[MD5.0BA91E1358AD25236863039BB2609A2E] - (.Microsoft Corporation - Service de gestion des licences Microsoft.) -- C:\Windows\system32\SLsvc.exe [2623488] [PID.1572]
[MD5.3927397AC60D943DAF8808AFFED582B7] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [65192] [PID.2060]
[MD5.09E6AFFAE6C0E9158BF05C7D08D0107A] - (.NewTech Infosystems, Inc. - NTI Backup Now 5 Agent service..) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [16384] [PID.2108]
[MD5.4D06D9A26227AC485305133916888DF1] - (.Pas de propriétaire - Acer Empowering Technology Framework Servic.) -- C:\Program Files\EMACHINES\eMachines Recovery Management\Service\ETService.exe [24576] [PID.2140]
[MD5.793FF718477345CD5D232C50BED1E452] - (.Hewlett-Packard Company - Pas de description.) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440] [PID.2360]
[MD5.65085456FD9A74D7F1A999520C299ECB] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376] [PID.2496]
[MD5.E0D7732F2D2E24B2DB3F67B6750295B8] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512] [PID.2560]
[MD5.CB76F68BA0D57C5D25B538981B1C611C] - (.NewTech InfoSystems, Inc. - NTI Backup Now 5 BackupSvc Application.) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [50424] [PID.2588]
[MD5.DF1C10A75DF7E50195FC417F88A33227] - (...) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [131072] [PID.2644]
[MD5.03579BEC2E930B92EFD6D4E7F899CFF5] - (.Bitdefender - Bitdefender Update Service.) -- C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe [55032] [PID.2740]
[MD5.3E42C4691AAD4B1E8D0466F9CBF05CBE] - (.Intel Corporation - RAID Monitor.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [354840] [PID.2860]
~ Processes Running: Scanned in 00mn 01s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Julien\AppData\Roaming\Mozilla\Firefox\Profiles\uhwmpvwu.default\prefs.js
M3 - MFPP: Plugins - [Julien] -- C:\Users\Julien\AppData\Roaming\Mozilla\Firefox\Profiles\uhwmpvwu.default\searchplugins\EcoStartPage.xml
~ Firefox Browser: 7 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R4 - HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,Enabled = 1
~ IE Browser: 10 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Keys: Scanned in 00mn 00s



---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 20



---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [IAAnotif] . (.Intel Corporation - Event Monitor User Notification Tool.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - HD Audio Control Panel.) -- C:\Windows\RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] . (.Synaptics, Inc. - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BkupTray] . (.Pas de propriétaire - NTI Backup Now 5 Tray Module.) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [WarReg_PopUp] . (.eMachines - WR_PopUp.) -- C:\Program Files\eMachines\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [LManager] . (.Dritek System Inc. - Launch Manager.) -- C:\Program Files\Launch Manager\QtZyEmachine.exe
O4 - HKLM\..\Run: [eRecoveryService] Clé orpheline
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] . (.Adobe Systems Incorporated - Adobe Updater Startup Utility.) -- C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe
O4 - HKLM\..\Run: [SwitchBoard] . (.Adobe Systems Incorporated - SwitchBoard Server (32 bit).) -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] . (.Adobe Systems Incorporated - Adobe CS5 Service Manager.) -- C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
O4 - HKLM\..\Run: [BDAgent] . (.Bitdefender - Bitdefender Agent.) -- C:\Program Files\Bitdefender\Bitdefender 2012\bdagent.exe
O4 - HKCU\..\Run: [WindowsWelcomeCenter] oobefldr.dll
O4 - HKCU\..\Run: [AdobeBridge] Clé orpheline
O4 - HKCU\..\Run: [EPSON SX100 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIEDE.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] oobefldr.dll
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] oobefldr.dll
O4 - HKUS\S-1-5-21-1924100809-2360900263-2351898234-1000\..\Run: [WindowsWelcomeCenter] oobefldr.dll
O4 - HKUS\S-1-5-21-1924100809-2360900263-2351898234-1000\..\Run: [AdobeBridge] Clé orpheline
O4 - HKUS\S-1-5-21-1924100809-2360900263-2351898234-1000\..\Run: [EPSON SX100 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIEDE.exe
~ Application: Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Programs: Windows Mail.lnk . (.Microsoft Corporation - Windows Mail.) -- C:\Program Files\Windows Mail\WinMail.exe
O4 - GS\Programs: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe
O4 - GS\QuickLaunch: Guitar Pro 6.lnk . (...) -- C:\Program Files\Guitar Pro 6\GuitarPro.exe
O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O4 - GS\QuickLaunch: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe
O4 - GS\QuickLaunch: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Program Files\uTorrent\uTorrent.exe =>P2P.µTorrent
O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop: Adobe Photoshop CS5.lnk . (.Adobe Systems, Incorporated - Adobe Photoshop CS5.) -- C:\Program Files\Adobe\Adobe Photoshop CS5\Photoshop.exe
O4 - GS\Desktop: Cubase 5.lnk . (.Steinberg Media Technologies - Cubase.) -- C:\Program Files\Steinberg\Cubase 5\Cubase5.exe
O4 - GS\Desktop: Guitar Pro 5.lnk . (.Arobas Music - Pas de description.) -- C:\Program Files\Guitar Pro 5\GP5.exe
O4 - GS\Desktop: Internet - Raccourci.lnk - Clé orpheline
O4 - GS\Desktop: Wordpad.lnk . (.Microsoft Corporation - Application Windows Wordpad.) -- C:\Program Files\Windows NT\Accessories\wordpad.exe
~ Global Startup: Scanned in 00mn 00s



---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft Office OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Winsock hijacker (Layered Service Provider) (O10)
O10 - Broken Internet access because of LSP provider (.not file.) -- mswsock.dll
~ Winsock: 6 Legitimates Filtered in 00mn 00s



---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} ((no name)) - http://quickscan.bitdefender.com/qsax/qsax.cab
~ Objets ActiveX: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{AA975B17-4863-40F5-A33E-7412273C0706}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CS1\Services\Tcpip\..\{AA975B17-4863-40F5-A33E-7412273C0706}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CS2\Services\Tcpip\..\{AA975B17-4863-40F5-A33E-7412273C0706}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.240 212.27.40.241
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\system32\mshtml.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.dll
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s



---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\Windows\System32\browseui.dll
~ STS/SSO: Scanned in 00mn 00s



---\\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Desktop General: BackupWallPaper - .(...) - C:\Windows\Web\Wallpaper\eM3_Wide.bmp
O24 - Desktop General: WallPaper - .(...) - C:\Windows\Web\Wallpaper\eM3_Wide.bmp
~ Desktop Component: 4 Legitimates Filtered in 00mn 00s



---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [Go for FilesUpdate] (...) -- C:\Program Files\GoforFiles\GFFUpdater.exe (.not file.) [0] =>P2P.GoforFiles
[MD5.00000000000000000000000000000000] [APT] [{CD63C85D-24D8-476C-A432-8EBDE8F8615D}] (...) -- D:\Guitar Pro 5.2 + RSE\RSE Bass Pack.exe (.not file.) [0]
~ Scheduled Task: 6 Legitimates Filtered in 00mn 02s



---\\ Logiciels installés (O42)
O42 - Logiciel: Chronotron Pro - (.Chronotron.com.) [HKLM] -- {4CCE77B1-36E1-4A25-91BD-350A0B7C11DE}
O42 - Logiciel: Power Tab Editor 1.7 - (.Power Tab Software.) [HKLM] -- {6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}
~ Logic: 63 Legitimates Filtered in 00mn 00s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\Chronotron.com]
[HKCU\Software\RiffMastertrialtime]
~ Key Software: 136 Legitimates Filtered in 00mn 00s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 23/07/2012 - 22:33:05 - [3,101] ----D C:\Program Files\Chronotron.com
O43 - CFD: 01/07/2013 - 23:56:10 - [0] ----D C:\ProgramData\RiffMasterPro
O43 - CFD: 13/07/2012 - 17:53:14 - [1,294] ----D C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
O43 - CFD: 28/02/2013 - 16:08:26 - [0] ----D C:\ProgramData\????0
O43 - CFD: 28/02/2013 - 00:10:34 - [0] ----D C:\ProgramData\?Æ?Æ0
O43 - CFD: 27/02/2013 - 22:51:42 - [0] ----D C:\ProgramData\?Ð?Ð0
O43 - CFD: 28/02/2013 - 12:48:12 - [0] ----D C:\ProgramData\?ý?ý0
O43 - CFD: 26/02/2013 - 19:18:37 - [0] ----D C:\ProgramData\?U?U0
~ Program Folder: 152 Legitimates Filtered in 00mn 46s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 09/07/2013 - 14:21:35 ---A- . (...) -- C:\Windows\System32\LogConfigTemp.xml [0]
O44 - LFC:[MD5.CEAF98D916D2B75B8704BEE7680EE0B5] - 09/07/2013 - 14:21:33 ---A- . (...) -- C:\Windows\System32\agent.log [147]
O44 - LFC:[MD5.AB0E759B08A49D91B43097412712CDC3] - 09/07/2013 - 14:20:11 ---A- . (...) -- C:\bdlog.txt [11132]
O44 - LFC:[MD5.4E8F2BB3A5A87E75C35533723B50E685] - 02/07/2013 - 13:31:09 ---A- . (...) -- C:\Windows\System32\user_gensett.xml [385]
~ Files: 28 Legitimates Filtered in 00mn 02s



---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.26E8097769A5BBE059C65739BF1833CA] - 01/07/2013 - 20:00:08 ---A- - C:\Windows\Prefetch\SOUNDRECORDER.EXE-9865DC1B.pf
O45 - LFCP:[MD5.EC09379E67D31EE9FA52E60C5806C840] - 01/07/2013 - 20:23:57 ---A- - C:\Windows\Prefetch\28AE.TMP-F8434817.pf
O45 - LFCP:[MD5.1A66FFF1B76C70062FB441E085523AE6] - 01/07/2013 - 20:35:31 ---A- - C:\Windows\Prefetch\3241.TMP-1F686CC9.pf
O45 - LFCP:[MD5.DFDEA02E09C8B37C428353A697F04B78] - 01/07/2013 - 22:53:34 ---A- - C:\Windows\Prefetch\HELPERSERVICE.EXE-31F39CB0.pf
O45 - LFCP:[MD5.A02D494F57BD98CB38659419F8E6B4BB] - 01/07/2013 - 22:53:36 ---A- - C:\Windows\Prefetch\PDFSERVERENGINE.EXE-40138676.pf
O45 - LFCP:[MD5.01F4304C05BA40F089A3B41B430D6C31] - 01/07/2013 - 22:53:37 ---A- - C:\Windows\Prefetch\PREVIEWERSURROGATE.EXE-54AACE7C.pf
O45 - LFCP:[MD5.0A88E30C6494F58B0D5E94E1AC479AFB] - 01/07/2013 - 22:53:38 ---A- - C:\Windows\Prefetch\CONVERSIONSERVICE.EXE-898FB6E6.pf
O45 - LFCP:[MD5.9F0A466CF2D0E51E26B53723BE331430] - 08/07/2013 - 12:40:53 ---A- - C:\Windows\Prefetch\TEMPOPERFECT.EXE-0E2FB141.pf
O45 - LFCP:[MD5.7C5C7A6B8EC5CBDF6B9402DBC95D95C8] - 08/07/2013 - 14:03:03 ---A- - C:\Windows\Prefetch\CUBASE5.EXE-1A83F909.pf
O45 - LFCP:[MD5.731616BC458CA76D1713D23025B32EFA] - 08/07/2013 - 21:45:25 ---A- - C:\Windows\Prefetch\GP5.EXE-8EEA8054.pf
O45 - LFCP:[MD5.CB90AA99BB79E8D3BC20C1DE04BC07B9] - 30/06/2013 - 13:20:11 ---A- - C:\Windows\Prefetch\CRYPTED.EXE-DC2EA5F7.pf
O45 - LFCP:[MD5.CD6DEEFF17B3B77795DE430ACCBA24D6] - 30/06/2013 - 13:20:11 ---A- - C:\Windows\Prefetch\KEYGEN.EXE-A4EA1020.pf
O45 - LFCP:[MD5.D1DEB9A91F36CF76D77C7C296EFE8583] - 30/06/2013 - 13:20:11 ---A- - C:\Windows\Prefetch\RIFFMA~1.TMP-73CFB07B.pf
O45 - LFCP:[MD5.1EAD07AEC7CFE6321CB35D50A7F55E16] - 30/06/2013 - 13:20:23 ---A- - C:\Windows\Prefetch\RIFFMA~1.EXE-E2D25704.pf
O45 - LFCP:[MD5.25FD61A45C6971F059DB2981CFBB2E0D] - 30/06/2013 - 13:20:23 ---A- - C:\Windows\Prefetch\RIFFMA~1.TMP-50110872.pf
O45 - LFCP:[MD5.2ED618FB1BBEB9F5A23BA2E44A6A8691] - 30/06/2013 - 13:21:21 ---A- - C:\Windows\Prefetch\3F06.TMP-FE427C92.pf
O45 - LFCP:[MD5.90D4C7D889CC11BF50E9AF9592A6E7C6] - 30/06/2013 - 13:28:34 ---A- - C:\Windows\Prefetch\DOTNETFX45_FULL_SETUP(1).EXE-79D1E6E4.pf
O45 - LFCP:[MD5.392C6B9E68A1E39EDE6A7759FED8730C] - 30/06/2013 - 13:32:37 ---A- - C:\Windows\Prefetch\TMP7647.TMP.EXE-8F799D6B.pf
O45 - LFCP:[MD5.858309FF143973B38FBC362EC8802F05] - 30/06/2013 - 13:42:09 ---A- - C:\Windows\Prefetch\DOTNETFX45LP_FULL_X86FR.EXE-B9F7A043.pf
O45 - LFCP:[MD5.130C433DDBE7258DF71A9DC49DD32A61] - 30/06/2013 - 13:54:00 ---A- - C:\Windows\Prefetch\RIFFMASTER.EXE-60036EA9.pf
O45 - LFCP:[MD5.55CD38D8757477B95AD4CF5B7A96CC3E] - 30/06/2013 - 13:58:21 ---A- - C:\Windows\Prefetch\RIFFSTATION PRO. V2.3TRIAL.EX-A209D868.pf
O45 - LFCP:[MD5.6A8B633C7F2BB4125420DB3C48C0C5ED] - 30/06/2013 - 13:58:22 ---A- - C:\Windows\Prefetch\RIFFMA~1.EXE-57500261.pf
O45 - LFCP:[MD5.8D31FEEFCC2E27DD88B7430FF7E0D65C] - 30/06/2013 - 13:58:22 ---A- - C:\Windows\Prefetch\RIFFMA~1.TMP-2A10A364.pf
O45 - LFCP:[MD5.BF4264EBBBF185BFD38E7727E87FC24C] - 30/06/2013 - 13:58:22 ---A- - C:\Windows\Prefetch\RIFFMA~1.TMP-8852055F.pf
O45 - LFCP:[MD5.98BED0C20C1AA2140D7C535D2C6D6C5A] - 30/06/2013 - 13:58:25 ---A- - C:\Windows\Prefetch\CRYPTED.EXE-B64E879C.pf
O45 - LFCP:[MD5.7E0522D30640D8E1422E7D193797F07B] - 30/06/2013 - 14:54:07 ---A- - C:\Windows\Prefetch\RIFFSTATION TRIAL.EXE-EA16D168.pf
~ Prefetcher: 138 Legitimates Filtered in 00mn 00s



---\\ Microsoft Windows Policies System (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
~ MWPS: 18 Legitimates Filtered in 00mn 00s



---\\ Liste des Drivers Système (O58)
O58 - SDL:[MD5.04F0FCAC69C7C71A3AC4EB97FAFC8303] - 21/01/2008 - 03:32:46 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [422968]
O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 02/11/2006 - 08:09:42 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029]
~ Drivers: Scanned in 00mn 00s



---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 07/07/2013 - 18:32:10 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\logs\2013-07-07--16-41-35.klg [85742]
O61 - LFC: 08/07/2013 - 13:14:34 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\logs\2013-07-08--13-46-47.klg [86338]
O61 - LFC: 08/07/2013 - 13:26:14 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\logs\2013-07-08--14-15-46.klg [86035]
O61 - LFC: 08/07/2013 - 13:27:26 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\logs\2013-07-08--14-27-25.klg [389]
O61 - LFC: 08/07/2013 - 13:32:11 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\logs\2013-07-08--14-28-13.klg [86440]
O61 - LFC: 08/07/2013 - 13:33:20 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\logs\2013-07-08--14-33-19.klg [389]
O61 - LFC: 08/07/2013 - 14:01:23 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\logs\2013-07-08--14-36-43.klg [8663]
O61 - LFC: 08/07/2013 - 14:02:56 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\logs\2013-07-08--15-02-09.klg [85836]
O61 - LFC: 08/07/2013 - 14:04:10 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\mediabay.db [1949696]
O61 - LFC: 08/07/2013 - 15:29:11 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\Db\kontaktdb [936444]
O61 - LFC: 08/07/2013 - 15:29:11 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\Db\kontaktdbLock [240]
O61 - LFC: 08/07/2013 - 15:29:12 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\logs\2013-07-08--15-04-26.klg [86440]
O61 - LFC: 08/07/2013 - 15:29:13 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\External Plugins.xml [79]
O61 - LFC: 08/07/2013 - 15:29:13 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Midi Devices.bin [13710]
O61 - LFC: 08/07/2013 - 15:29:14 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\MediaDefaults.xml [22874]
O61 - LFC: 08/07/2013 - 15:29:14 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Port Setup.xml [5003]
O61 - LFC: 08/07/2013 - 15:29:14 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Quick Controls MIDI.xml [1074]
O61 - LFC: 08/07/2013 - 15:29:14 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Vst2xBlacklist.xml [2937]
O61 - LFC: 08/07/2013 - 15:29:14 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Vst2xPlugins.xml [164115]
O61 - LFC: 08/07/2013 - 15:29:15 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Edit Modifiers.xml [2627]
O61 - LFC: 08/07/2013 - 15:29:15 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\FileSysObserver.xml [1090]
O61 - LFC: 08/07/2013 - 15:29:15 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\GuitarLib.xml [67095]
O61 - LFC: 08/07/2013 - 15:29:15 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Key Commands.xml [148143]
O61 - LFC: 08/07/2013 - 15:29:15 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Presets\RAMPresets.xml [52011]
O61 - LFC: 08/07/2013 - 15:29:15 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Score Custom Palettes.xml [3075]
O61 - LFC: 08/07/2013 - 15:29:15 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Score Default Font.xml [253]
O61 - LFC: 08/07/2013 - 15:29:15 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Score Setting Window.xml [158]
O61 - LFC: 08/07/2013 - 15:29:18 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Presets\Chord Symbols.pxml [3414]
O61 - LFC: 08/07/2013 - 15:29:18 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Presets\InsertsFolderPresets.pxml [3359066]
O61 - LFC: 08/07/2013 - 15:29:18 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Presets\VstEqPreset.pxml [157019]
O61 - LFC: 08/07/2013 - 15:29:18 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Window Layouts.xml [194]
O61 - LFC: 08/07/2013 - 15:29:19 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Defaults.xml [735586]
O61 - LFC: 08/07/2013 - 15:29:23 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\ContentManager.xml [5138]
O61 - LFC: 08/07/2013 - 15:29:23 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\scannedFolders.bin [13624]
O61 - LFC: 08/07/2013 - 15:29:24 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Frame.xml [273]
O61 - LFC: 08/07/2013 - 15:29:24 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\VstPlugInfo.xml [51076]
~ 4 Fichiers temporaires (Temporary files)
~ Files: 42 Legitimates Filtered in 00mn 06s



---\\ Liste des outils de nettoyage (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
~ ADS: Scanned in 00mn 00s



---\\ Start Menu Internet (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s



---\\ Search Browser Infection (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (@ieframe.dll,-12512) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {67A2568C-7A0A-4EED-AECC-B5405DE63B64} - (Google) - http://www.google.com
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - http://www.bing.com
~ Keys: Scanned in 00mn 00s



---\\ Internet Feature Controls (O81)
O81 - IFC: Internet Feature Controls [HKUS\.DEFAULT] [FEATURE_BROWSER_EMULATION] -- svchost.exe =>Rootkit.TDSS
O81 - IFC: Internet Feature Controls [HKUS\S-1-5-18] [FEATURE_BROWSER_EMULATION] -- svchost.exe =>Rootkit.TDSS
~ Keys: Scanned in 00mn 00s



---\\ Recherche particuliere à la racine de certains dossiers (O84)
[MD5.AAC9C787EE0F38625FFBC8E34FCE961C] [SPRF][02/07/2013] (...) -- C:\ProgramData\1372723922.bdinstall.bin [169469]
[MD5.F3CC9DF2129412EE70C0B04CE65B5AE1] [SPRF][02/07/2013] (...) -- C:\ProgramData\1372759702.bdinstall.bin [557238]
[MD5.FE2EC4726DB325BDD11B9485565F5EBA] [SPRF][01/07/2013] (...) -- C:\Users\Julien\AppData\Local\Temp\bitdefender_isecurity_[quickscan].exe [2436368]
[MD5.3C0A436B68E1FF41BE35C5C7CC9A9211] [SPRF][01/04/2013] (.NCH Software - Express Burn.) -- C:\Users\Julien\AppData\Local\Temp\burnsetup.exe [777880]
[MD5.3D7CDC3E67A97110321BF7453C649B1F] [SPRF][26/02/2013] (...) -- C:\Users\Julien\AppData\Local\Temp\DeltaTB.exe [775664] =>Toolbar.DeltaSearch
[MD5.A55B82103A202C20717F45C201EC4553] [SPRF][13/01/2013] (.Terra Informatica Software, Inc., British C - HTMLayout - embeddable HTML rendering and layout component.) -- C:\Users\Julien\AppData\Local\Temp\htmlayout.dll [936960]
[MD5.2FF9B590342C62748885D459D082295F] [SPRF][30/06/2013] (.Adobe Systems, Inc. - Adobe® Flash® Player Installer/Uninstaller 11.0 r1.) -- C:\Users\Julien\AppData\Local\Temp\InstallFlashPlayer.exe [89248]
[MD5.AC3129819FAA20A776239F48E57D2B35] [SPRF][26/02/2013] (.Babylon Ltd. - Babylon Client Setup.) -- C:\Users\Julien\AppData\Local\Temp\MyBabylonTB.exe [786584] =>Toolbar.Babylon
[MD5.C969BCFA5CB2A54411FB075D067B71AC] [SPRF][26/02/2013] (.PC Utilities Pro - Fix, clean, optimize your PC!.) -- C:\Users\Julien\AppData\Local\Temp\OptimizerPro.exe [4159008] =>PUP.OptimizerPro
[MD5.D88D453C3DDBE7CD0056B36FFA115573] [SPRF][26/02/2013] (.QuickShare - QuickShare.) -- C:\Users\Julien\AppData\Local\Temp\QuickShare1.exe [7900944] =>PUP.QuickShare
[MD5.5CB17097A5752337977A9A7FED3A06E5] [SPRF][19/06/2013] (.Spotify Ltd - Spotify.) -- C:\Users\Julien\AppData\Local\Temp\SpotifyUninstall.exe [4643328]
[MD5.F9D5E3DE90D94D5B0B2C09963A442A20] [SPRF][13/07/2012] (...) -- C:\Users\Julien\AppData\Local\Temp\srtspse.dat [588]
[MD5.EC8A1FA9641545E16B3B7C9E6D9FD02E] [SPRF][18/07/2012] (...) -- C:\Users\Julien\AppData\Local\Temp\srtspso.dat [2692]
[MD5.861405D1F7AC1B58177392F7401FCD76] [SPRF][29/05/2008] (...) -- C:\Users\Julien\AppData\Local\Temp\srtspsp.dat [524]
[MD5.57BC8F4F1201610668773875A4484C1E] [SPRF][31/01/2013] (.Babylon Ltd. - Uninstaller Application.) -- C:\Users\Julien\AppData\Local\Temp\uninst1.exe [392784] =>Toolbar.Babylon
[MD5.909B1A67B2AFB5CFD77D88FFF8983BBC] [SPRF][08/01/2013] (.http://goforfiles.com/ - GoforFiles Application.) -- C:\Users\Julien\AppData\Local\Temp\uninstall3507432.exe [899728] =>P2P.GoforFiles
[MD5.A55B82103A202C20717F45C201EC4553] [SPRF][08/01/2013] (.Terra Informatica Software, Inc., British C - HTMLayout - embeddable HTML rendering and layout component.) -- C:\Users\Julien\AppData\Local\Temp\uninstall3507479.exe [936960]
[MD5.7810AB1CF04E012469C141ABC693D3A7] [SPRF][26/02/2013] (.Somoto Ltd. - FilesFrog Update Checker.) -- C:\Users\Julien\AppData\Local\Temp\UpdateCheckerSetup.exe [295440] =>Adware.MegaSearch
[MD5.1CBF54A0FF546754683FC314FFC80623] [SPRF][10/05/2013] (...) -- C:\Users\Julien\AppData\Local\Temp\uttBBD4.tmp.bat [96]
[MD5.1CBF54A0FF546754683FC314FFC80623] [SPRF][10/05/2013] (...) -- C:\Users\Julien\AppData\Local\Temp\uttBC1E.tmp.bat [96]
[MD5.8197D807A8D81F3FF3D19D0902E2FEB2] [SPRF][22/12/2012] (...) -- C:\Users\Julien\AppData\Local\Temp\uttC50.tmp.bat [96]
[MD5.8197D807A8D81F3FF3D19D0902E2FEB2] [SPRF][22/12/2012] (...) -- C:\Users\Julien\AppData\Local\Temp\uttCBD.tmp.bat [96]
[MD5.6F818F88CD2498A4D522BA138B2AE816] [SPRF][16/06/2013] (...) -- C:\Users\Julien\AppData\Roaming\wklnhst.dat [1624]
[MD5.1078C8BD8C62CF4DEE6FE1058C3D56A7] [SPRF][08/07/2013] (...) -- C:\Users\Julien\Desktop\adwcleaner.exe [650027]
[MD5.94247F2C722FE9FE2DA9EB7FD5BED9B0] [SPRF][08/07/2013] (.Oleg N. Scherbakov - 7z Setup SFX.) -- C:\Users\Julien\Desktop\JRT.exe [547139]
[MD5.F57DCAA101AEF91CA302EA2E26EE61EB] [SPRF][08/07/2013] (.Nicolas Coolman - ZHPDiag.) -- C:\Users\Julien\Desktop\ZHPDiag2.exe [5703563]
[MD5.42BCB2ABD0474745C615641D033F1AF4] [SPRF][08/07/2013] (.Nicolas Coolman - ZHPFix.) -- C:\Users\Julien\Desktop\ZHPFix.exe [3436678]
[MD5.56940B50AB0E5923822F47B0E4463885] [SPRF][26/06/2012] (.Bitdefender LLC - Bitdefender QuickScan.) -- C:\Windows\Downloaded Program Files\qsax.dll [731688]
~ Files: Scanned in 00mn 02s



---\\ Scan Additionnel (O88)
Database Version : v2.12703 - (07/07/2013)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 6

C:\Users\Julien\AppData\Local\Temp\uninst1.exe =>Toolbar.Babylon
C:\Users\Julien\AppData\Local\Temp\MyBabylonTB.exe =>PUP.SweetIM
C:\Users\Julien\AppData\Local\Temp\UpdateCheckerSetup.exe =>Adware.MegaSearch
~ Additionnel Scan: 283551 Items scanned in 00mn 34s



---\\ Product Upgrade Codes (O90)
O90 - PUC: "2F0F48BCB729D854D95C7838E2D36C35" . (.GearDrvs.) -- C:\Windows\Installer\{CB84F0F2-927B-458D-9DC5-87832E3DC653}\ARPPRODUCTICON.exe
~ Update Products: 45 Legitimates Filtered in 00mn 00s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 18/12/2012 65192 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 30/06/2013 256904 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 03/03/2008 16384 | (BUNAgentSvc) . (.NewTech Infosystems, Inc..) - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
SR - | Auto 24576 | (ETService) . (...) - C:\Program Files\EMACHINES\eMachines Recovery Management\Service\ETService.exe
SR - | Auto 20/07/2008 354840 | (IAANTMON) . (.Intel Corporation.) - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
SR - | Auto 17/01/2007 61440 | (LightScribeService) . (.Hewlett-Packard Company.) - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
SS - | Demand 05/02/2013 235216 | (McComponentHostService) . (.McAfee, Inc..) - C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe
SS - | Demand 03/07/2013 117144 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
SR - | Auto 06/04/2008 50424 | (NTIBackupSvc) . (.NewTech InfoSystems, Inc..) - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
SR - | Auto 131072 | (NTISchedulerSvc) . (...) - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
SS - | Demand 02/04/2012 67120 | (SafeBox) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe
SS - | Demand 19/02/2010 517096 | (SwitchBoard) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
SS - | Demand 14/10/2011 307544 | (Update Server) . (.BitDefender.) - C:\Program Files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe
SR - | Auto 28/05/2012 55032 | (UPDATESRV) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe
SR - | Auto 21/11/2012 1554176 | (vsserv) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe
~ Services: Scanned in 00mn 01s



---\\ Recherche Master Boot Record Infection (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by Julien at 09/07/2013 15:40:09

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x86DB9698]<<
1 ntkrnlpa!IofCallDriver[0x81ED7FEF] >> \Device\Harddisk0\DR0[0x85BCA8E0]
\Driver\00000756[0x86BEFD50] >> IRP_MJ_CREATE >> 0x86DB9698
kernel: MBR read successfully
user & kernel MBR OK
~ MBR: 13 Legitimates Filtered in 00mn 02s



---\\ Recherche Master Boot Record Infection (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Julien at 09/07/2013 15:40:11

********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 04s



---\\ Malicius Software Information
~ http://nicolascoolman.webs.com/apps/blog/show/26611908-rootkit-tdss =>Rootkit.TDSS
~ http://nicolascoolman.webs.com/apps/blog/show/27875657-toolbar-deltasearch =>Toolbar.DeltaSearch
~ http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon =>Toolbar.Babylon
~ http://nicolascoolman.webs.com/apps/blog/show/28204239-pup-optimizerpro =>PUP.OptimizerPro
~ http://nicolascoolman.webs.com/apps/blog/show/28577022-pup-quickshare =>PUP.QuickShare
~ http://nicolascoolman.webs.com/apps/blog/show/26919368-adware-megasearch =>Adware.MegaSearch
~ http://nicolascoolman.webs.com/apps/blog/show/29216159-pup-sweetim =>PUP.SweetIM
~ MSI: 7 link(s) detected in 00mn 04s



~ 871 Legitimates filtered by white list
End of the scan (564 lines in 04mn 24s)(0)

Publicité


Signaler le contenu de ce document

Publicité