Rapport de ZHPDiag v2013.5.4.29 par Nicolas Coolman, Update du 04/05/2013 Run by Chai at 05/05/2013 20:30:02 State : Version à jour. WhiteList : Enable High Elevated Privileges : OK UAC : Deactivate by user ---\\ Web Browser MSIE: Internet Explorer v9.0.8112.16421 GCIE: Google Chrome v26.0.1410.64 (Defaut) ---\\ Windows Product Information ~ Langage: Français Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601) Windows Server License Manager Script : OK ~ Windows(R) 7, OEM_SLP channel System Locked Preinstallation (OEM_SLP) : OK Windows ID Activation : OK ~ Windows Partial Key : BWX77 Windows License : OK ~ Windows Remaining Initializations Number : 3 Software Protection Service (Protection logicielle) : OK Windows Automatic Updates : OK Windows Activation Technologies : OK ---\\ System Protection avast! Free Antivirus v8.0.1483.0 Windows Defender W7 ---\\ System Optimizer ---\\ Peer To Peer (P2P) µTorrent v3.3.0.29342 ---\\ Software Update Adobe Flash Player 10 ActiveX Adobe Reader X MUI Java 7 Update 17 ---\\ System Information ~ Processor: Intel64 Family 6 Model 42 Stepping 7, GenuineIntel ~ Operating System: 64 Bits Boot mode: Normal (Normal boot) Total RAM: 6125 MB (63% free) System Restore: Activé (Enable) System drive C: has 281 GB (80%) free of 349 GB ---\\ Logged in mode ~ Computer Name: CHAI-TOSH ~ User Name: Chai ~ All Users Names: HomeGroupUser$, Chai, Administrateur, ~ Unselected Option: None Logged in as Administrator ---\\ Environnement Variables ~ System Unit : C:\ ~ %AppData% : C:\Users\Chai\AppData\Roaming\ ~ %Desktop% : C:\Users\Chai\Desktop\ ~ %Favorites% : C:\Users\Chai\Favorites\ ~ %LocalAppData% : C:\Users\Chai\AppData\Local\ ~ %StartMenu% : C:\Users\Chai\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\\ DOS/Devices C:\ Hard drive, Flash drive, Thumb drive (Free 281 Go of 349 Go) D:\ Hard drive, Flash drive, Thumb drive (Free 44 Go of 350 Go) E:\ CD-ROM drive (Not Inserted) ---\\ Security Center & Tools Informations [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date ~ Security Center: 27 Legitimates Filtered in 00mn 00s ---\\ Recherche particulière de fichiers génériques [MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808] [MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024] [MD5.A4F6142CABA82FB7293ECE5FF864B440] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.22/02/2013 - 07:20:51.) -- C:\Windows\System32\wininet.dll [1392128] [MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.21/11/2010 - 04:24:29.) -- C:\Windows\System32\Winlogon.exe [390656] [MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.21/11/2010 - 04:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448] [MD5.1C7857B62DE5994A75B054A9FD4C3825] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/12/2011 - 04:59:24.) -- C:\Windows\system32\Drivers\AFD.sys [498688] [MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128] [MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160] [MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456] [MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400] [MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368] [MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472] [MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224] [MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208] [MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 04:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632] [MD5.E453ACF4E7D44E5530B5D5F2B9CA8563] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.31/08/2012 - 19:19:35.) -- C:\Windows\system32\Drivers\ntfs.sys [1659760] [MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280] [MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 04:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536] [MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184] [MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296] [MD5.DF8126BD41180351A093A3AD2FC8903B] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.25/02/2011 - 07:25:38.) -- C:\Windows\system32\Drivers\volsnap.sys [296320] ~ Generic Processes: Scanned in 00mn 00s ---\\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 1/17 ~ Mes musiques (My Musics) : 1/7 ~ Mes Favoris (My Favorites) : 1/17 ~ Mes Documents (My Documents) : 1/321 ~ Mon Bureau (My Desktop) : 1/219 ~ Menu demarrer (Programs) : 1/37 ~ Hidden Files: Scanned in 00mn 01s ---\\ Processus lancés [MD5.41735B82DB57E4EBE9504EC400FD120E] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [45248] [PID.1324] [MD5.4FE5C6D40664AE07BE5105874357D2ED] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [57008] [PID.1428] [MD5.A74AC411798DA32CFC655A9A9F2EB74A] - (...) -- C:\ProgramData\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [2569168] [PID.848] =>Toolbar.Babylon [MD5.0D2D8D5FA0137C7FC2663D32DED56374] - (.Uniblue Systems Ltd - Uniblue Powersuite Monitor.) -- C:\Program Files (x86)\Uniblue\Powersuite\powersuite_monitor.exe [324376] [PID.2100] [MD5.69E2CFCEC396E8A73F4DEB69E1C822CC] - (.Dropbox, Inc. - Dropbox.) -- C:\Users\Chai\AppData\Roaming\Dropbox\bin\Dropbox.exe [25863280] [PID.2856] [MD5.148C545849C1379A3D4448F5DE768E86] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe [4767304] [PID.2868] [MD5.BB752714D14CB1F13969D721F1A3A60F] - (.TOSHIBA - TOSHIBA Sleep Service.) -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe [252792] [PID.2892] [MD5.0A61A3ACE26CA4FC637BC8AF8C05CC00] - (.SweetIM Technologies Ltd. - SweetIM Instant Messenger Enhancer.) -- C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe [115032] [PID.2952] =>PUP.SweetIM [MD5.1B34BB332729A9B288DA14CE5EA5149F] - (.Bandoo Media, inc - Data Manager.) -- C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe [1890744] [PID.2084] =>PUP.Datamngr [MD5.97A1AFD42B8016D132C7BF38C955C6E1] - (.TOSHIBA CORPORATION - ConfigFree Task Tray Menu.) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [304560] [PID.3204] [MD5.7C8DD5576695B3362202EF09B20C425E] - (.TeamViewer GmbH - TeamViewer 8.) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [3574624] [PID.3268] [MD5.8A07221789D46B2EA7DFCA2BC807572A] - (.TOSHIBA CORPORATION - ConfigFree Switch Manager Process.) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe [62848] [PID.4832] [MD5.1EE73794162E380E7497C55D86B6A579] - (.Uniblue Systems Limited - Uniblue Powersuite.) -- C:\Program Files (x86)\Uniblue\Powersuite\powersuite.exe [323864] [PID.5744] [MD5.3CB07566302BCEEB898DE270A0BEC175] - (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352] [PID.4100] [MD5.CAB0EEAF5295FC96DDD3E19DCE27E131] - (.TOSHIBA CORPORATION - ConfigFree Service Process.) -- C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [46448] [PID.2272] [MD5.2ED1786B7542CDA261029F6B526EDF44] - (.Intel Corporation - Local Manageability Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [325656] [PID.3108] [MD5.7E5E1603D0FF2D240AE70295C5C3FEFC] - (.Intel Corporation - User Notification Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2656280] [PID.5332] [MD5.4E9592BB2C100E571F82640E59E9ECD5] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1312720] [PID.5436] [MD5.9C1B12210B979DA735361823A536F7ED] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [7190528] [PID.1136] ~ Processes Running: Scanned in 00mn 01s ---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2) C:\Users\Chai\AppData\Local\Google\Chrome\User Data\Default\Preferences G0 - GCSP: Preference [User Data\Default][HomePage] http://www.searchnu.com G2 - GCE: Preference [User Data\Default] [eooncjejnppfjjklapaamhcdmjbilmde] Delta Toolbar v.1.1 (Désactivé) G2 - GCE: Preference [User Data\Default] [loljledaigphbcpfhfmgopdkppkifgno] Lazarus: Form Recovery v.3.0.5 (Activé) ~ Google Browser: 21 Legitimates Filtered in 00mn 12s ---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) C:\Users\Chai\AppData\Roaming\Mozilla\Firefox\Profiles\0\prefs.js (.not file.) ~ Firefox Browser: 3 Legitimates Filtered in 00mn 00s ---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4) R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchnu.com R3 - URLSearchHook: (no name) [64Bits] - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} . (.Microsoft Corporation - Navigateur Internet.) (No version) -- (.not file.) ~ IE Browser: 16 Legitimates Filtered in 00mn 00s ---\\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe ~ Keys: Scanned in 00mn 00s ---\\ Redirection du fichier Hosts (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 00s ~ Nombre de lignes (Lines number): 23 ---\\ Browser Helper Objects de navigateur (O2) O2 - BHO: Searchqu Toolbar [64Bits] - {99079a25-328f-4bd4-be04-00955acaa0a7} . (.Pas de propriétaire - dtx Dynamic Link Library.) -- C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll =>PUP.Datamngr O2 - BHO: DataMngr [64Bits] - {9D717F81-9148-4f12-8568-69135F087DB0} . (.Bandoo Media, inc - Url Helper.) -- C:\Program Files (x86)\Searchqu Toolbar\Datamngr\BrowserConnection.dll =>PUP.Datamngr O2 - BHO: delta Helper Object [64Bits] - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} . (.Delta-search.com - Pas de description.) -- C:\Program Files (x86)\Delta\delta\1.8.10.0\bh\delta.dll =>Toolbar.DeltaSearch O2 - BHO: Hotspot Shield Class [64Bits] - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} . (.AnchorFree Inc. - Pas de description.) -- C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll ~ BHO: 9 Legitimates Filtered in 00mn 00s ---\\ Internet Explorer Toolbars (O3) O3 - Toolbar: (no name) [64Bits] - [HKLM]{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} Clé orpheline ~ Toolbar: Scanned in 00mn 00s ---\\ Applications démarrées par registre & par dossier (O4) O4 - HKLM\..\Run: [Toshiba TEMPRO] . (.Toshiba Europe GmbH - Toshiba TEMPRO.) -- C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe O4 - HKLM\..\Run: [TosNC] C:\Program Files (x86)\Toshiba\BulletinBoard\TosNcCore.exe (.not file.) O4 - HKLM\..\Run: [TosReelTimeMonitor] C:\Program Files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (.not file.) O4 - HKLM\..\Run: [TPwrMain] . (.TOSHIBA Corporation - TOSHIBA Power Saver.) -- C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe O4 - HKLM\..\Run: [HSON] . (.TOSHIBA Corporation - HotStartOn.) -- C:\Program Files\TOSHIBA\TBS\HSON.exe O4 - HKLM\..\Run: [TCrdMain] . (.TOSHIBA Corporation - TOSHIBA Flash Cards Main Module.) -- C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe O4 - HKLM\..\Run: [SmartAudio] . (.Conexant systems, Inc. - SmartAudio Control Panel application.) -- C:\Program Files\CONEXANT\SAII\SAIICpl.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe (.not file.) O4 - HKLM\..\Run: [Teco] . (.TOSHIBA Corporation - TOSHIBA eco Utility.) -- C:\Program Files\TOSHIBA\TECO\Teco.exe O4 - HKLM\..\Run: [TosSENotify] . (.TOSHIBA Corporation - Pas de description.) -- C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe O4 - HKLM\..\Run: [TosWaitSrv] . (.TOSHIBA Corporation - Pas de description.) -- C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe O4 - HKLM\..\Run: [TosVolRegulator] . (.TOSHIBA Corporation - Toshiba Volume Regulator.) -- C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe O4 - HKLM\..\Run: [Toshiba Registration] . (.Toshiba Europe GmbH - Toshiba Notebook Registration Reminder.) -- C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe O4 - HKCU\..\Run: [TOPI.EXE] . (.TOSHIBA - TOSHIBA Online Product Information.) -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe O4 - HKLM\..\Wow6432Node\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe O4 - HKLM\..\Wow6432Node\Run: [TSleepSrv] . (.TOSHIBA - TOSHIBA Sleep Service.) -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe O4 - HKLM\..\Wow6432Node\Run: [ToshibaServiceStation] . (.TOSHIBA Corporation - TOSHIBA Service Station.) -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe O4 - HKLM\..\Wow6432Node\Run: [SweetIM] . (.SweetIM Technologies Ltd. - SweetIM Instant Messenger Enhancer.) -- C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe =>PUP.SweetIM O4 - HKLM\..\Wow6432Node\Run: [NBAgent] . (.Nero AG - Nero BackItUp.) -- c:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe O4 - HKLM\..\Wow6432Node\Run: [DATAMNGR] . (.Bandoo Media, inc - Data Manager.) -- C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe =>PUP.Datamngr O4 - HKLM\..\Wow6432Node\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe O4 - HKLM\..\Wow6432Node\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe O4 - HKUS\S-1-5-18\..\Run: [TOPI.EXE] . (.TOSHIBA - TOSHIBA Online Product Information.) -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe O4 - HKUS\S-1-5-19\..\Run: [TOPI.EXE] . (.TOSHIBA - TOSHIBA Online Product Information.) -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe O4 - HKUS\S-1-5-20\..\Run: [TOPI.EXE] . (.TOSHIBA - TOSHIBA Online Product Information.) -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe O4 - HKUS\S-1-5-21-4014089462-3522904072-1182255026-1001\..\Run: [TOPI.EXE] . (.TOSHIBA - TOSHIBA Online Product Information.) -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe O4 - HKUS\S-1-5-21-4014089462-3522904072-1182255026-1001\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe ~ Application: Scanned in 00mn 00s ---\\ Autres liens utilisateurs (O4) O4 - GS\TaskBar: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\QuickLaunch: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\QuickLaunch: Powersuite.lnk . (.Uniblue Systems Limited - Uniblue Launcher.) -- C:\Program Files (x86)\Uniblue\Powersuite\launcher.exe O4 - GS\QuickLaunch: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Chai\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.µTorrent O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\Accessories: Private Character Editor.lnk . (.Microsoft Corporation - Éditeur de caractères privés.) -- C:\Windows\system32\eudcedit.exe O4 - GS\SendTo: Dropbox.lnk . (...) -- C:\Users\Chai\Dropbox O4 - GS\SendTo: Fax Recipient.lnk . (.Microsoft Corporation - Microsoft Windows Fax and Scan.) -- C:\Windows\system32\WFS.exe O4 - GS\SendTo: Skype.lnk . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe O4 - GS\SendTo: TOSHIBA Bulletin Board.lnk . (...) -- C:\Program Files (x86)\TOSHIBA\BulletinBoard\TosBulletinBoard.exe (.not file.) O4 - GS\SendTo: TOSHIBA Disc Creator(Audio).lnk . (.TOSHIBA Corporation - Pas de description.) -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Disc Creator\ToDisc.exe O4 - GS\SendTo: TOSHIBA Disc Creator(Data).lnk . (.TOSHIBA Corporation - Pas de description.) -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Disc Creator\ToDisc.exe O4 - GS\SendTo: TOSHIBA Disc Creator(Image).lnk . (.TOSHIBA Corporation - Pas de description.) -- C:\Program Files (x86)\TOSHIBA\TOSHIBA Disc Creator\ToDisc.exe O4 - GS\Desktop: Adobe Photoshop CS6.lnk . (.PainteR - Adobe Photoshop CS6 Pre-Release Portable.) -- C:\Program Files\Adobe\Adobe Photoshop CS6\Adobe Photoshop CS6.exe O4 - Global Startup: C:\Users\Chai\Desktop\Arma 3 Alpha.url . (.PainteR - Adobe Photoshop CS6 Pre-Release Portable.) -- C:\Users\Chai\Desktop\Arma 3 Alpha.url O4 - GS\Desktop: I Play WarZ.lnk . (.Arktos Entertainment Group - WarZ Launcher.) -- C:\Users\Chai\Desktop\I Play WarZ\WarZlauncher.exe O4 - GS\Desktop: Microsoft Visual Basic 2010 Express.lnk . (.Microsoft Corporation - Microsoft Visual Basic 2010 Express.) -- C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\vbexpress.exe O4 - GS\Desktop: The WarZ.lnk . (.Arktos Entertainment Group - WarZ Launcher.) -- D:\SteamLibrary\SteamApps\common\The War Z\WarZlauncher.exe ~ Global Startup: Scanned in 00mn 00s ---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-228 [64Bits] - {97F922BD-8563-4184-87EE-8C4ACA438823} . (...) -- C:\Program Files\TOSHIBA\BulletinBoard\images\pin.ico ~ IE Extra Buttons: Scanned in 00mn 00s ---\\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{F9FE7769-4925-46A5-A0AC-C3EFB21D7F19}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{F9FE7769-4925-46A5-A0AC-C3EFB21D7F19}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{F9FE7769-4925-46A5-A0AC-C3EFB21D7F19}: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1 ~ Domain: Scanned in 00mn 00s ---\\ Protocole additionnel (O18) O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) -- O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll ~ Protocole Additionnel: Scanned in 00mn 00s ---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - AppInit_DLLs: . (.Bandoo Media, inc - Data Manager.) - C:\Program Files (x86)\SEARCH~1\Datamngr\x64\datamngr.dll =>Adware.Bandoo ~ AppInit DLL: Scanned in 00mn 00s ---\\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: BrowserProtect (BrowserProtect) . (...) - C:\ProgramData\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe =>Toolbar.Babylon O23 - Service: Intel(R) Management and Security Applica (UNS) . (.Intel Corporation - User Notification Service.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe ~ Services: 15 Legitimates Filtered in 00mn 12s ---\\ Tâches planifiées en automatique (O39) O39 - APT:Automatic Planified Task - C:\Windows\Tasks\powersuite_monitor.job [350] [MD5.0D2D8D5FA0137C7FC2663D32DED56374] [APT] [powersuite_monitor] (.Uniblue Systems Ltd.) -- C:\Program Files (x86)\Uniblue\Powersuite\powersuite_monitor.exe [324376] ~ Scheduled Task: 13 Legitimates Filtered in 00mn 01s ---\\ Logiciels installés (O42) O42 - Logiciel: BrowserProtect - (...) [HKLM][64Bits] -- {15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693} =>Toolbar.Babylon O42 - Logiciel: Delta toolbar - (.Delta.) [HKLM][64Bits] -- delta O42 - Logiciel: Searchqu Toolbar - (.Bandoo Media Inc.) [HKLM][64Bits] -- Searchqu Toolbar =>PUP.Datamngr O42 - Logiciel: SweetIM Bundle by SweetPacks - (.SweetPacks LTD.) [HKLM][64Bits] -- SweetIM Bundle by SweetPacks =>PUP.SweetIM O42 - Logiciel: SweetIM for Messenger 3.7 - (.SweetIM Technologies Ltd..) [HKLM][64Bits] -- {A0C9DF2B-89B5-4483-8983-18A68200F1B4} =>PUP.SweetIM ~ Logic: 226 Legitimates Filtered in 00mn 00s ---\\ HKCU & HKLM Software Keys [HKCU\Software\5d578cdfb234ee40] [HKCU\Software\BI] [HKCU\Software\BabylonToolbar] =>Toolbar.Babylon [HKCU\Software\DataMngr] =>PUP.Datamngr [HKCU\Software\DataMngr_Toolbar] =>PUP.Datamngr [HKCU\Software\Delta] [HKCU\Software\Drivers] [HKCU\Software\ImInstaller] [HKCU\Software\InfectedZ] [HKCU\Software\Softonic] [HKCU\Software\SweetIM] =>PUP.SweetIM [HKCU\Software\System32] [HKCU\Software\Win] [HKLM\Software\DataMngr] =>PUP.Datamngr [HKLM\Software\Wow6432Node\5d578cdfb234ee40] [HKLM\Software\Wow6432Node\Babylon] =>Toolbar.Babylon [HKLM\Software\Wow6432Node\DataMngr] =>PUP.Datamngr [HKLM\Software\Wow6432Node\Delta] [HKLM\Software\Wow6432Node\SearchquMediabarTb] =>PUP.Datamngr [HKLM\Software\Wow6432Node\SweetIM] =>PUP.SweetIM ~ Key Software: 233 Legitimates Filtered in 00mn 00s ---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 17/03/2013 - 11:40:56 - [2,769] ----D C:\Program Files (x86)\Delta O43 - CFD: 20/03/2013 - 23:47:42 - [15,961] ----D C:\Program Files (x86)\Searchqu Toolbar =>PUP.Datamngr O43 - CFD: 17/03/2013 - 04:11:51 - [4,943] ----D C:\Program Files (x86)\SweetIM =>PUP.SweetIM O43 - CFD: 17/03/2013 - 04:11:17 - [0,359] ----D C:\Program Files (x86)\sweetpacks bundle uninstaller =>PUP.SweetIM O43 - CFD: 17/03/2013 - 11:40:34 - [0] ----D C:\ProgramData\Babylon =>Toolbar.Babylon O43 - CFD: 05/04/2013 - 01:58:37 - [0,000] ----D C:\ProgramData\boost_interprocess O43 - CFD: 30/04/2013 - 20:57:12 - [7,079] ----D C:\ProgramData\BrowserProtect =>Toolbar.Babylon O43 - CFD: 17/03/2013 - 23:50:22 - [0] ----D C:\ProgramData\Reflection O43 - CFD: 17/03/2013 - 04:11:30 - [0,245] ----D C:\ProgramData\SweetIM =>PUP.SweetIM O43 - CFD: 17/03/2013 - 11:41:00 - [1,943] ----D C:\Users\Chai\AppData\Roaming\BabSolution =>Hijacker.BabSolution O43 - CFD: 17/03/2013 - 11:40:34 - [0,010] ----D C:\Users\Chai\AppData\Roaming\Babylon =>Toolbar.Babylon O43 - CFD: 17/03/2013 - 11:40:55 - [0,259] ----D C:\Users\Chai\AppData\Roaming\Delta O43 - CFD: 21/03/2013 - 18:50:25 - [0,000] ----D C:\Users\Chai\AppData\Roaming\IPChangeEasy O43 - CFD: 19/03/2013 - 00:51:40 - [0,000] ----D C:\Users\Chai\AppData\Roaming\VirusMaker O43 - CFD: 24/04/2013 - 06:19:08 - [0] ----D C:\Users\Chai\AppData\Local\InfectedZ O43 - CFD: 17/03/2013 - 23:50:22 - [0,001] ----D C:\Users\Chai\AppData\Local\Reflection O43 - CFD: 19/03/2013 - 00:51:58 - [0,001] ----D C:\Users\Chai\AppData\Local\Virus_Maker ~ 1 Dossiers CLSID vides (CLSID Empty Folders) ~ Program Folder: 242 Legitimates Filtered in 00mn 59s ---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.FB2BB251D1AA59EC7EA97EF6FF1E4140] - 05/05/2013 - 19:14:13 ---A- . (...) -- C:\folder.ini [34] O44 - LFC:[MD5.EE6C1E5601670D3B43D0F10BD02F1CFF] - 05/05/2013 - 10:02:34 ---A- . (...) -- C:\Windows\ntbtlog.txt [394886] O44 - LFC:[MD5.94872171BF6B95F65E4792F044725567] - 27/04/2013 - 14:31:17 ---A- . (...) -- C:\Windows\r3dlog.txt [2578] O44 - LFC:[MD5.595251C70ACA2189FD28139F04B9D000] - 27/04/2013 - 14:23:01 ---A- . (...) -- C:\Windows\WZ_00.bin [306981] O44 - LFC:[MD5.52538282F69546C9CA28C7ED0860A401] - 27/04/2013 - 14:23:01 ---A- . (...) -- C:\Windows\WZ_02.bin [441511864] O44 - LFC:[MD5.C653DF263A88DCF8CFC5930C39C32E58] - 27/04/2013 - 14:18:29 ---A- . (...) -- C:\Windows\VMProtectSDK32.dll [55808] O44 - LFC:[MD5.FC565F9144FE242BB33D464AE544C23D] - 27/04/2013 - 14:09:22 ---A- . (.The ICU Project - ICU Data DLL.) -- C:\Windows\icudt46.dll [9070080] O44 - LFC:[MD5.F1C50A5B42EFB35F996FFCCA35DB5444] - 27/04/2013 - 14:08:56 ---A- . (.Firelight Technologies - FMOD Event System.) -- C:\Windows\fmod_event.dll [418304] O44 - LFC:[MD5.A1842F24F0500988FB0C2489F05CEC44] - 27/04/2013 - 14:08:51 ---A- . (.Firelight Technologies - FMOD Net Event System.) -- C:\Windows\fmod_event_net.dll [821760] O44 - LFC:[MD5.F66D0C12120EB573DD3A1578BFFE6860] - 27/04/2013 - 14:08:46 ---A- . (.Firelight Technologies - FMOD Ex Sound System.) -- C:\Windows\fmodex.dll [1253888] O44 - LFC:[MD5.5B8FFE78B727C288FAE4C19975BA0A6F] - 27/04/2013 - 12:28:37 ---A- . (...) -- C:\Windows\WZ_01.bin [1073741806] O44 - LFC:[MD5.8D991D08C3DEB2FD23458DFE87C801A4] - 26/04/2013 - 21:26:35 ---A- . (.Pas de propriétaire - Berkelium DLL.) -- C:\Windows\berkelium.dll [33072128] O44 - LFC:[MD5.8F20D30BBD23A616061CB82495F193F8] - 26/04/2013 - 21:23:00 ---A- . (.Pas de propriétaire - Crash Report Delivery Module.) -- C:\Windows\CrashSender1301.exe [726528] O44 - LFC:[MD5.3BE1F13A7A5C5490D4669F3051CC5572] - 26/04/2013 - 21:22:23 ---A- . (...) -- C:\Windows\crashrpt_lang.ini [7480] O44 - LFC:[MD5.9EF6AF643B94F642ED1AC9F8C37238A1] - 26/04/2013 - 21:22:22 ---A- . (...) -- C:\Windows\WarZ.exe [9038848] O44 - LFC:[MD5.DC7C83C761F5B7830AD2A5327E6190F3] - 26/04/2013 - 21:22:22 ---A- . (.Pas de propriétaire - Crash Handling Module.) -- C:\Windows\CrashRpt1301.dll [76800] O44 - LFC:[MD5.46D1683DDBCE115366583F8308CF9546] - 26/04/2013 - 21:22:12 ---A- . (.The Chromium Authors - Chromium.) -- C:\Windows\berkelium.exe [632320] O44 - LFC:[MD5.6B3BAF70FEF49C95D3A7079007A0701C] - 26/04/2013 - 21:21:37 ---A- . (...) -- C:\Windows\avformat-52.dll [160782] O44 - LFC:[MD5.143138359EBB00297D5388D5EF1DB5E0] - 26/04/2013 - 21:21:37 ---A- . (...) -- C:\Windows\avutil-50.dll [96782] O44 - LFC:[MD5.1BC0B81097FB1C265CDE34EDF398CAB8] - 26/04/2013 - 21:21:21 ---A- . (...) -- C:\Windows\avcodec-52.dll [1305102] O44 - LFC:[MD5.E7EEC6410399B41E009B5A45B2C6651B] - 26/04/2013 - 21:20:35 ---A- . (.Pas de propriétaire - DarKGuard.) -- C:\Windows\DarKGuard.exe [189952] O44 - LFC:[MD5.CB492B7DF9B5C170D7C87527940EFF3B] - 26/04/2013 - 21:14:08 ---A- . (...) -- C:\Windows\survey.info [4] O44 - LFC:[MD5.C3999EFC536E9C7975C18E3EDE085038] - 20/04/2013 - 23:25:40 ---A- . (...) -- C:\Windows\DirectX.log [92175] O44 - LFC:[MD5.324D81542BFC257BC1055AD823CB279D] - 20/04/2013 - 22:58:02 ---A- . (...) -- C:\Windows\UpdateWindows.logs [26] O44 - LFC:[MD5.27379672B8D68D30DFECAEFDE89E949C] - 20/04/2013 - 22:05:13 ---A- . (...) -- C:\Windows\EC_List.txt.bak [20] O44 - LFC:[MD5.43DC738008865A4E70BBEA4791D3D322] - 20/04/2013 - 22:05:13 ---A- . (...) -- C:\Windows\sad.txt [18118] ~ Files: 51 Legitimates Filtered in 00mn 46s ---\\ Derniers fichiers créés dans Windows Prefetcher (O45) O45 - LFCP:[MD5.4FD103314F46CC70559982280F4629AE] - 01/05/2013 - 18:22:44 ---A- - C:\Windows\Prefetch\CHEATENGINE-X86_64.EXE-635F6459.pf O45 - LFCP:[MD5.9B325186F29A3520B45026377DF3E069] - 01/05/2013 - 18:43:44 ---A- - C:\Windows\Prefetch\CRASHSENDER1301.EXE-88386A06.pf O45 - LFCP:[MD5.CD59771F6507C230C754580E6513FAEC] - 01/05/2013 - 18:43:45 ---A- - C:\Windows\Prefetch\WARZ.EXE-C0B467E7.pf O45 - LFCP:[MD5.DD1F247BC1E67983CFDD8C9DC2EDB261] - 01/05/2013 - 18:43:54 ---A- - C:\Windows\Prefetch\DARKGUARD.EXE-44413AA4.pf O45 - LFCP:[MD5.120E8429879FCBC827411D153418EF9A] - 01/05/2013 - 19:00:20 ---A- - C:\Windows\Prefetch\5F69.TMP-ADB389B7.pf O45 - LFCP:[MD5.24F9279A30E62F56F70F56024846EC88] - 02/05/2013 - 16:31:15 ---A- - C:\Windows\Prefetch\CAMTASIA STUDIO V8.0.2.918 + -9946AF03.pf O45 - LFCP:[MD5.B9499666FE0098EF348C0552D185D41B] - 02/05/2013 - 16:31:33 ---A- - C:\Windows\Prefetch\AUTORUN.EXE-DD7ED977.pf O45 - LFCP:[MD5.D96C7D02DBE7F14AB70842382568E085] - 02/05/2013 - 16:31:36 ---A- - C:\Windows\Prefetch\GLB9177.TMP-901ACB0E.pf O45 - LFCP:[MD5.DA29BA0D389E2A68D00412184EE5F33D] - 02/05/2013 - 16:31:43 ---A- - C:\Windows\Prefetch\CAMTASIA.EXE-069FDA00.pf O45 - LFCP:[MD5.AA9E1A48F47ECEC193BD6312B1DAF899] - 02/05/2013 - 16:34:25 ---A- - C:\Windows\Prefetch\WISECUSTOMCALLA1.EXE-8A688CB4.pf =>Crapware.SpyHunter O45 - LFCP:[MD5.10009E9869503BF4A2AA132EEA723245] - 02/05/2013 - 20:00:41 ---A- - C:\Windows\Prefetch\547.TMP-B055A72D.pf O45 - LFCP:[MD5.A18C5FA11948329266A4E66BE8178D2F] - 02/05/2013 - 20:54:25 ---A- - C:\Windows\Prefetch\CAMRECORDER.EXE-D3C280EC.pf O45 - LFCP:[MD5.F8A3F133F622B0D8BF3ADE48B3019C1E] - 02/05/2013 - 21:17:15 ---A- - C:\Windows\Prefetch\LANDINGPAGE.EXE-D77AD478.pf O45 - LFCP:[MD5.C4E3BD2B4CB1EC66FFD7A70F60EE0A80] - 02/05/2013 - 21:30:48 ---A- - C:\Windows\Prefetch\IMJPPDMG.EXE-C1CBEA51.pf O45 - LFCP:[MD5.B7626E27F35EC8296F36A84203768752] - 02/05/2013 - 21:31:05 ---A- - C:\Windows\Prefetch\VBEXPRESS.EXE-FB88C90A.pf O45 - LFCP:[MD5.83AA53C627ECA846B6E4BC6E56C40A56] - 02/05/2013 - 21:31:17 ---A- - C:\Windows\Prefetch\CONSOLEAPPLICATION1.VSHOST.EX-8EE197CA.pf O45 - LFCP:[MD5.39E4103E82548093F239C059CF94F0A5] - 02/05/2013 - 21:41:36 ---A- - C:\Windows\Prefetch\WINDOWSAPPLICATION1.VSHOST.EX-1A88A7BA.pf O45 - LFCP:[MD5.A63305F05523341C316F76D5E3616838] - 02/05/2013 - 21:52:37 ---A- - C:\Windows\Prefetch\RTF-MANAGER.EXE-8AF0814C.pf O45 - LFCP:[MD5.5DBC01FC43314A2FE62B959B30CC04A3] - 02/05/2013 - 21:57:08 ---A- - C:\Windows\Prefetch\ADOBE PHOTOSHOP CS6.EXE-E6EEE867.pf O45 - LFCP:[MD5.381EBB4A7C99D54F8C57AABEF6C18441] - 02/05/2013 - 21:57:29 ---A- - C:\Windows\Prefetch\PDAPP.EXE-0CD424B4.pf O45 - LFCP:[MD5.279E6523C32C250DC48AD46E01A197A1] - 02/05/2013 - 22:55:48 ---A- - C:\Windows\Prefetch\CAMTASIASTUDIO.EXE-A2EF8B3B.pf O45 - LFCP:[MD5.4F780154EC957A4062631B5AF6097502] - 02/05/2013 - 23:10:50 ---A- - C:\Windows\Prefetch\CAMTASIASTUDIO.EXE-A92915C8.pf O45 - LFCP:[MD5.598546E987934BC800578AAB3719B758] - 02/05/2013 - 23:46:15 ---A- - C:\Windows\Prefetch\LOGTRANSPORT2.EXE-4217363A.pf O45 - LFCP:[MD5.CDF1F1CD4BB48A598A00AA48E1067FFC] - 03/05/2013 - 21:08:17 ---A- - C:\Windows\Prefetch\40DE.TMP-355F584E.pf O45 - LFCP:[MD5.3BC3DE719F7C1C15C822C34A3B42FFB1] - 04/05/2013 - 14:41:31 ---A- - C:\Windows\Prefetch\CAMRECORDER.EXE-F9A29F47.pf O45 - LFCP:[MD5.025D786BB1CB5592EA074423B83E7071] - 04/05/2013 - 21:28:53 ---A- - C:\Windows\Prefetch\7860.TMP-9EFFCAFE.pf O45 - LFCP:[MD5.EC1F94FC3C3758FFEFC1FE56C5620143] - 05/05/2013 - 18:51:00 ---A- - C:\Windows\Prefetch\BROWSERPROTECT.EXE-EAF067F3.pf =>Toolbar.Babylon O45 - LFCP:[MD5.060C297D3B5F52465BF3D9F60A8CAA5A] - 05/05/2013 - 19:14:17 ---A- - C:\Windows\Prefetch\CRASHSENDER1301.EXE-A5424A5E.pf O45 - LFCP:[MD5.4978F11EE73B7FB5802919568598E63D] - 05/05/2013 - 19:14:21 ---A- - C:\Windows\Prefetch\WARZ.EXE-5423FF7F.pf O45 - LFCP:[MD5.0CC89A347F981513A9F075C813B4162C] - 05/05/2013 - 19:14:22 ---A- - C:\Windows\Prefetch\11936343-52.EXE-9A42D52A.pf ~ Prefetcher: 146 Legitimates Filtered in 00mn 00s ---\\ Image File Execution Options (IFEO) (O50) O50 - IFEO:Image File Execution Options - excel.exe - "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe" O50 - IFEO:Image File Execution Options - infopath.exe - "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe" O50 - IFEO:Image File Execution Options - msaccess.exe - "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe" O50 - IFEO:Image File Execution Options - msoo.exe - "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe" O50 - IFEO:Image File Execution Options - msoxmled.exe - "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe" O50 - IFEO:Image File Execution Options - mspub.exe - "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe" O50 - IFEO:Image File Execution Options - mstore.exe - "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe" O50 - IFEO:Image File Execution Options - offdiag.exe - "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe" O50 - IFEO:Image File Execution Options - ois.exe - "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe" O50 - IFEO:Image File Execution Options - openmuihelp.exe - "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe" O50 - IFEO:Image File Execution Options - openvpntray.exe - "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe" O50 - IFEO:Image File Execution Options - outlook.exe - "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe" O50 - IFEO:Image File Execution Options - powerpnt.exe - "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe" O50 - IFEO:Image File Execution Options - todisc.exe - "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe" O50 - IFEO:Image File Execution Options - tosramutil.exe - "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe" O50 - IFEO:Image File Execution Options - uninstall.exe - "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe" O50 - IFEO:Image File Execution Options - winword.exe - "C:\Program Files (x86)\TuneUp Utilities 2013\TUAutoReactivator64.exe" ~ IFEO: Scanned in 00mn 00s ---\\ Trojan Driver Search Data (HKLM) (O52) O52 - TDSD: \Drivers32\"VIDC.FICV"="ficvdec_x64.dll" . (...) -- C:\Windows\System32\ficvdec_x64.dll ~ TDSD: 5 Legitimates Filtered in 00mn 00s ---\\ Microsoft Windows Policies System (O55) O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0 O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0 O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 O55 - MWPS:[HKLM\...\Policies\System] - "EnableLinkedConnections"=1 ~ MWPS: 17 Legitimates Filtered in 00mn 00s ---\\ Microsoft Windows Policies Explorer (O56) O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1 ~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s ---\\ Liste des Drivers Système (O58) O58 - SDL:[MD5.2F6B34B83843F0C5118B63AC634F5BF4] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [491088] ~ Drivers: Scanned in 00mn 00s ---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61) O61 - LFC: 02/05/2013 - 01:03:58 R--A- C:\Users\Chai\Downloads\[www.Cpasbien.me] The.Impossible.2012.FRENCH.BRRip.XviD-TMB\[www.Cpasbien.me] The.Impossible.2012.FRENCH.BRRip.XviD-TMB.avi [733986816] O61 - LFC: 02/05/2013 - 20:52:23 ---A- C:\Users\Chai\AppData\Roaming\Microsoft\Speech\Files\UserShortcuts\SP_707E8ED2A9B84F8496186CDF0D4C615E.dat [940] O61 - LFC: 02/05/2013 - 21:17:03 ---A- C:\Users\Chai\AppData\Roaming\Microsoft\MMC\SQLServerManager10 [27598] O61 - LFC: 02/05/2013 - 21:30:48 ---A- C:\Users\Chai\AppData\Roaming\Microsoft\IMJP10\imjp10u.dic [32768] O61 - LFC: 02/05/2013 - 21:31:55 ---A- C:\Users\Chai\AppData\Roaming\Microsoft\Access\System.mdw [126976] O61 - LFC: 02/05/2013 - 21:33:43 ---A- C:\Users\Chai\Documents\testbdd.accdb [344064] O61 - LFC: 02/05/2013 - 21:41:26 ---A- C:\Users\Chai\AppData\Roaming\Microsoft\VBExpress\10.0\Debug_3ser0yql.stu.winprf [12525] O61 - LFC: 02/05/2013 - 21:42:20 ---A- C:\Users\Chai\AppData\Roaming\Microsoft\VBExpress\10.0\Design_bikzmnsg.j41.winprf [16308] O61 - LFC: 02/05/2013 - 21:42:21 ---A- C:\Users\Chai\AppData\Roaming\Microsoft\VBExpress\10.0\ObjBrowEx.dat [2560] O61 - LFC: 02/05/2013 - 21:42:21 ---A- C:\Users\Chai\AppData\Roaming\Microsoft\VBExpress\10.0\ServerExplorer\DefaultView.SEView [1869] O61 - LFC: 02/05/2013 - 21:42:21 ---A- C:\Users\Chai\AppData\Roaming\Microsoft\VBExpress\10.0\VBMRU.dat [3062] O61 - LFC: 03/05/2013 - 12:50:50 ---A- C:\Users\Chai\Documents\TMStreamer\dumps\20130503-135049619-1584-6480.dmp [768138] O61 - LFC: 03/05/2013 - 12:50:51 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\cf78a44f-a57c-49bf-945a-dc297dde9366\GPU.txt [540] O61 - LFC: 03/05/2013 - 12:50:51 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\cf78a44f-a57c-49bf-945a-dc297dde9366\crashdump.dmp [158373] O61 - LFC: 03/05/2013 - 12:50:51 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\cf78a44f-a57c-49bf-945a-dc297dde9366\crashrpt.xml [1404] O61 - LFC: 03/05/2013 - 12:50:51 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\cf78a44f-a57c-49bf-945a-dc297dde9366\r3dlog.txt [18470] O61 - LFC: 03/05/2013 - 13:01:09 ---A- C:\Users\Chai\Documents\TMStreamer\dumps\20130503-140108758-4012-3656.dmp [467326] O61 - LFC: 03/05/2013 - 19:09:50 ---A- C:\Users\Chai\Documents\TMStreamer\dumps\20130503-200950770-7044-4428.dmp [709738] O61 - LFC: 03/05/2013 - 19:09:51 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\ee0eff7d-2246-402c-a973-0cfd609152c7\GPU.txt [540] O61 - LFC: 03/05/2013 - 19:09:51 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\ee0eff7d-2246-402c-a973-0cfd609152c7\crashdump.dmp [114305] O61 - LFC: 03/05/2013 - 19:09:51 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\ee0eff7d-2246-402c-a973-0cfd609152c7\crashrpt.xml [1388] O61 - LFC: 03/05/2013 - 19:09:51 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\ee0eff7d-2246-402c-a973-0cfd609152c7\r3dlog.txt [8369] O61 - LFC: 03/05/2013 - 19:26:21 ---A- C:\Users\Chai\Documents\TMStreamer\dumps\20130503-202621768-6048-1960.dmp [770058] O61 - LFC: 03/05/2013 - 19:26:22 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\307cf99c-c08a-4052-9ea1-3396adad3490\GPU.txt [540] O61 - LFC: 03/05/2013 - 19:26:22 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\307cf99c-c08a-4052-9ea1-3396adad3490\crashdump.dmp [148093] O61 - LFC: 03/05/2013 - 19:26:22 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\307cf99c-c08a-4052-9ea1-3396adad3490\crashrpt.xml [1404] O61 - LFC: 03/05/2013 - 19:26:22 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\307cf99c-c08a-4052-9ea1-3396adad3490\r3dlog.txt [12402] O61 - LFC: 03/05/2013 - 19:28:42 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\caa10d1e-8c36-439d-8dff-e81c465ec35c\GPU.txt [540] O61 - LFC: 03/05/2013 - 19:28:42 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\caa10d1e-8c36-439d-8dff-e81c465ec35c\crashdump.dmp [110173] O61 - LFC: 03/05/2013 - 19:28:42 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\caa10d1e-8c36-439d-8dff-e81c465ec35c\crashrpt.xml [1376] O61 - LFC: 03/05/2013 - 19:28:42 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\caa10d1e-8c36-439d-8dff-e81c465ec35c\r3dlog.txt [5139] O61 - LFC: 03/05/2013 - 19:28:42 ---A- C:\Users\Chai\Documents\TMStreamer\dumps\20130503-202841975-6284-5260.dmp [410683] O61 - LFC: 04/05/2013 - 21:20:44 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\a208ae44-9156-4d27-b9b7-8d5b3ce32251\GPU.txt [540] O61 - LFC: 04/05/2013 - 21:20:44 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\a208ae44-9156-4d27-b9b7-8d5b3ce32251\crashdump.dmp [124367] O61 - LFC: 04/05/2013 - 21:20:44 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\a208ae44-9156-4d27-b9b7-8d5b3ce32251\crashrpt.xml [1386] O61 - LFC: 04/05/2013 - 21:20:44 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\a208ae44-9156-4d27-b9b7-8d5b3ce32251\r3dlog.txt [4384] O61 - LFC: 04/05/2013 - 21:20:44 ---A- C:\Users\Chai\Documents\TMStreamer\dumps\20130504-22204498-1988-6908.dmp [504696] O61 - LFC: 04/05/2013 - 21:22:56 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\f1baaaf3-3e41-4869-b70b-f80d0eacbfea\GPU.txt [540] O61 - LFC: 04/05/2013 - 21:22:56 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\f1baaaf3-3e41-4869-b70b-f80d0eacbfea\crashdump.dmp [109197] O61 - LFC: 04/05/2013 - 21:22:56 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\f1baaaf3-3e41-4869-b70b-f80d0eacbfea\crashrpt.xml [1376] O61 - LFC: 04/05/2013 - 21:22:56 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\f1baaaf3-3e41-4869-b70b-f80d0eacbfea\r3dlog.txt [5174] O61 - LFC: 04/05/2013 - 21:22:56 ---A- C:\Users\Chai\Documents\TMStreamer\dumps\20130504-222256372-2696-6044.dmp [479236] O61 - LFC: 04/05/2013 - 21:41:52 ---A- C:\Users\Chai\AppData\Local\Resmon.ResmonCfg [7670] O61 - LFC: 04/05/2013 - 22:26:13 ---A- C:\Users\Chai\Documents\TMStreamer\dumps\20130504-232613672-5632-1040.dmp [536708] O61 - LFC: 04/05/2013 - 22:34:48 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\4ccb49c1-a40c-48dd-a466-03abf8717db5\GPU.txt [540] O61 - LFC: 04/05/2013 - 22:34:48 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\4ccb49c1-a40c-48dd-a466-03abf8717db5\crashdump.dmp [180533] O61 - LFC: 04/05/2013 - 22:34:48 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\4ccb49c1-a40c-48dd-a466-03abf8717db5\crashrpt.xml [1404] O61 - LFC: 04/05/2013 - 22:34:48 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\4ccb49c1-a40c-48dd-a466-03abf8717db5\r3dlog.txt [28358] O61 - LFC: 04/05/2013 - 22:34:48 ---A- C:\Users\Chai\Documents\TMStreamer\dumps\20130504-233448292-5632-1436.dmp [853629] O61 - LFC: 05/05/2013 - 01:02:53 ---A- C:\Users\Chai\Documents\TMStreamer\dumps\20130505-020253607-2252-5216.dmp [751654] O61 - LFC: 05/05/2013 - 01:02:54 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\47e1cbb1-d809-4f9e-a502-c448986eeeb5\GPU.txt [540] O61 - LFC: 05/05/2013 - 01:02:54 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\47e1cbb1-d809-4f9e-a502-c448986eeeb5\crashdump.dmp [185681] O61 - LFC: 05/05/2013 - 01:02:54 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\47e1cbb1-d809-4f9e-a502-c448986eeeb5\crashrpt.xml [1389] O61 - LFC: 05/05/2013 - 01:02:54 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\47e1cbb1-d809-4f9e-a502-c448986eeeb5\r3dlog.txt [58625] O61 - LFC: 05/05/2013 - 01:10:11 ---A- C:\Users\Chai\Documents\TMStreamer\dumps\20130505-021011666-6048-5748.dmp [532976] O61 - LFC: 05/05/2013 - 10:12:29 ---A- C:\Users\Chai\AppData\Local\Google\Chrome\User Data\Certificate Revocation Lists [268727] O61 - LFC: 05/05/2013 - 14:48:18 ---A- C:\Users\Chai\Documents\TMStreamer\dumps\20130505-154817886-4620-7096.dmp [664321] O61 - LFC: 05/05/2013 - 14:49:24 ---A- C:\Users\Chai\Documents\TMStreamer\dumps\20130505-154924579-4620-7148.dmp [886094] O61 - LFC: 05/05/2013 - 14:49:25 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\5bfd110b-db23-4df5-9f86-0d359bbb1075\GPU.txt [540] O61 - LFC: 05/05/2013 - 14:49:25 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\5bfd110b-db23-4df5-9f86-0d359bbb1075\crashdump.dmp [220325] O61 - LFC: 05/05/2013 - 14:49:25 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\5bfd110b-db23-4df5-9f86-0d359bbb1075\crashrpt.xml [1405] O61 - LFC: 05/05/2013 - 14:49:25 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\5bfd110b-db23-4df5-9f86-0d359bbb1075\r3dlog.txt [80086] O61 - LFC: 05/05/2013 - 15:10:42 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\39f40223-e272-4110-8ee2-3a58dd47ea18\GPU.txt [540] O61 - LFC: 05/05/2013 - 15:10:42 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\39f40223-e272-4110-8ee2-3a58dd47ea18\crashdump.dmp [128669] O61 - LFC: 05/05/2013 - 15:10:42 ---A- C:\Users\Chai\Documents\TMStreamer\dumps\20130505-161042479-7012-6772.dmp [626005] O61 - LFC: 05/05/2013 - 15:10:43 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\39f40223-e272-4110-8ee2-3a58dd47ea18\crashrpt.xml [1404] O61 - LFC: 05/05/2013 - 15:10:43 ---A- C:\Users\Chai\AppData\Local\CrashRpt\UnsentCrashReports\WarZ_1.0\39f40223-e272-4110-8ee2-3a58dd47ea18\r3dlog.txt [18266] O61 - LFC: 05/05/2013 - 17:04:14 ---A- C:\Users\Chai\Documents\TMStreamer\dumps\20130505-180413963-2212-6420.dmp [476167] O61 - LFC: 05/05/2013 - 17:31:51 ---A- C:\Users\Chai\Documents\TMStreamer\settings_warz.tmc [3383] O61 - LFC: 05/05/2013 - 19:32:16 ---A- C:\Users\Chai\AppData\Local\Google\Chrome\User Data\Local State [30512] ~ 12 Fichiers temporaires (Temporary files) ~ Files: 681 Legitimates Filtered in 00mn 52s ---\\ Liste des outils de nettoyage (O63) O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 ~ ADS: Scanned in 00mn 00s ---\\ File Associations Shell Spawning (O67) O67 - Shell Spawning: <.exe> [HKCU\..\open\Command] (.Not Key.) O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.Not Key.) ~ FASS Keys: 20 Legitimates Filtered in 00mn 00s ---\\ Start Menu Internet (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\\ Search Browser Infection (O69) O69 - SBI: SearchScopes [HKCU] {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} - (Delta Search) - http://www.delta-search.com =>Toolbar.DeltaSearch O69 - SBI: SearchScopes [HKCU] {6400ADAA-CDA3-48C4-9B7A-2EA7A66C52D2} - (eBay) - http://rover.ebay.com O69 - SBI: SearchScopes [HKCU] {9BB47C17-9C68-4BB3-B188-DD9AF0FD2414} [DefaultScope] - (Search Results) - http://dts.search-results.com O69 - SBI: SearchScopes [HKCU] {EE5DFE7D-CA6C-4CF2-9F57-CFE7B39F50F4} - (Bing) - http://www.bing.com ~ Keys: Scanned in 00mn 00s ---\\ Recherche particuliere à la racine de certains dossiers (O84) [MD5.BB64E42DA0D524F68C7B4F4239D1F00B] [SPRF][16/03/2013] (...) -- C:\ProgramData\ezsidmv.dat [56] [MD5.027D92D13BE5EE99889E2849BCF256F6] [SPRF][30/04/2013] (.Nosibay - Bubble Dock installer.) -- C:\Users\Chai\AppData\Local\Temp\Install_BubbleDock.exe [372856] [MD5.84D48901C1325DD72C8160DD29669B3F] [SPRF][26/04/2013] (...) -- C:\Users\Chai\Desktop\Ayanami.dll [14848] [MD5.DBC83EEA12A1DB32BE7F79760704C0FF] [SPRF][11/11/2012] (.Pas de propriétaire - Darky KeyChanger for ARMA2:OA.) -- C:\Users\Chai\Desktop\Darky KeyChanger.exe [390144] [MD5.3427AC9790F6D66C36B18B44ADAF8B8C] [SPRF][15/04/2013] (.Pas de propriétaire - [Xtreme13Hack] Minecraft GiftCodes Generator.) -- C:\Users\Chai\Desktop\Minecraft GiftCodes Generator 3.0.exe [127488] [MD5.B63CCB43F2779CBEA5D8D3CE2E3D90FB] [SPRF][16/03/2013] (...) -- C:\Users\Chai\Desktop\Minecraft.exe [263186] [MD5.1D928FB8A755D7FD0745BB5CBFEFD8E3] [SPRF][26/04/2013] (...) -- C:\Users\Chai\Desktop\Rei.exe [297472] ~ Files: Scanned in 00mn 00s ---\\ Firewall Active Exception List (FirewallRules) (O87) O87 - FAEL: "TCP Query User{B5508121-A295-486C-9BC9-B3E2414AC05E}C:\users\chai\desktop\i play warz\warz.exe" | In - Private - P6 - TRUE | .(...) -- C:\users\chai\desktop\i play warz\warz.exe O87 - FAEL: "UDP Query User{F72EFE4F-BEE1-44A5-A0C6-43EFB8E18A21}C:\users\chai\desktop\i play warz\warz.exe" | In - Private - P17 - TRUE | .(...) -- C:\users\chai\desktop\i play warz\warz.exe ~ Firewall: 226 Legitimates Filtered in 00mn 01s ---\\ Scan Additionnel (O88) Database Version : v2.11898 - (04/05/2013) Clés trouvées (Keys found) : 193 Valeurs trouvées (Values found) : 2 Dossiers trouvés (Folders found) : 9 Fichiers trouvés (Files found) : 0 [HKLM\Software\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}] =>Toolbar.Babylon [HKLM\Software\Wow6432Node\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}] =>Toolbar.Babylon [HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9}] =>Toolbar.Babylon [HKLM\Software\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}] =>Adware.Bandoo [HKLM\Software\Wow6432Node\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}] =>Adware.Bandoo [HKLM\Software\Classes\Interface\{44B619BC-3D2B-4990-AA4F-9AA366921792}] =>Adware.Bandoo [HKLM\Software\Wow6432Node\Classes\Interface\{44B619BC-3D2B-4990-AA4F-9AA366921792}] =>Adware.Bandoo [HKLM\Software\Classes\TypeLib\{4d3b167e-5fd8-4276-8fd7-9df19c1e4d19}] =>PUP.SweetIM [HKLM\Software\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}] =>Toolbar.Babylon [HKLM\Software\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}] =>Toolbar.Babylon [HKLM\Software\Wow6432Node\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}] =>Toolbar.Babylon [HKLM\Software\Classes\TypeLib\{5B4144E1-B61D-495A-9A50-CD1A95D86D15}] =>Adware.Bandoo [HKLM\Software\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}] =>Adware.Bandoo [HKLM\Software\Classes\TypeLib\{841D5A49-E48D-413C-9C28-EB3D9081D705}] =>Adware.Bandoo [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7}] =>Adware.Bandoo [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7}] =>Adware.Bandoo [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079A25-328F-4BD4-BE04-00955ACAA0A7}] =>Adware.Bandoo [HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{99079A25-328F-4BD4-BE04-00955ACAA0A7}] =>Adware.Bandoo [HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2414}] =>Adware.Bandoo [HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2414}] =>Adware.Bandoo [HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2414}] =>Adware.Bandoo [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}] =>Adware.Bandoo [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D717F81-9148-4F12-8568-69135F087DB0}] =>Adware.Bandoo [HKLM\Software\Classes\CLSID\{9D717F81-9148-4F12-8568-69135F087DB0}] =>Adware.Bandoo [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4F12-8568-69135F087DB0}] =>Adware.Bandoo [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4F12-8568-69135F087DB0}] =>Adware.Bandoo [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A0C9DF2B-89B5-4483-8983-18A68200F1B4}] =>PUP.SweetIM [HKLM\Software\Classes\CLSID\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}] =>Adware.Bandoo [HKLM\Software\Wow6432Node\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}] =>Toolbar.Babylon [HKLM\Software\Classes\AppID\{AC662AF2-4601-4A68-84DF-A3FE83F1A5F9}] =>Adware.Bandoo [HKLM\Software\Wow6432Node\Classes\AppID\{AC662AF2-4601-4A68-84DF-A3FE83F1A5F9}] =>Adware.Bandoo [HKLM\Software\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}] =>Toolbar.Babylon [HKLM\Software\Wow6432Node\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}] =>Toolbar.Babylon [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}] =>Toolbar.Agent [HKLM\Software\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}] =>Adware.Bandoo [HKLM\Software\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}] =>Toolbar.Babylon [HKLM\Software\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}] =>Toolbar.Babylon [HKLM\Software\Wow6432Node\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}] =>Toolbar.Babylon [HKLM\Software\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}] =>Adware.Bandoo [HKLM\Software\Wow6432Node\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}] =>Adware.Bandoo [HKLM\Software\Wow6432Node\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}] =>Toolbar.Babylon [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}] =>Trojan.Adclicker [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}] =>Trojan.Adclicker [HKLM\Software\Classes\CLSID\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}] =>Trojan.Adclicker [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}] =>Trojan.Adclicker [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}] =>Trojan.Adclicker [HKLM\Software\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}] =>Adware.Bandoo [HKLM\Software\Classes\AppID\BrowserConnection.dll] =>Adware.Bandoo [HKLM\Software\Classes\AppID\DNSBHO.dll] =>Adware.Bandoo [HKLM\Software\Classes\AppID\escort.dll] =>Toolbar.Babylon [HKLM\Software\Classes\AppID\escortapp.dll] =>Toolbar.Babylon [HKLM\Software\Classes\AppID\escorteng.dll] =>Toolbar.Babylon [HKLM\Software\Classes\AppID\esrv.EXE] =>Toolbar.Babylon [HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\sweetim.exe] =>PUP.SweetIM [HKLM\Software\Classes\BrowserConnection.Loader] =>Adware.Bandoo [HKLM\Software\Classes\BrowserConnection.Loader.1] =>Adware.Bandoo [HKLM\Software\Classes\DnsBHO.BHO] =>Adware.Bandoo [HKLM\Software\Classes\DnsBHO.BHO.1] =>Adware.Bandoo [HKLM\Software\Classes\escort.escortIEPane] =>PUP.Funmoods [HKLM\Software\Classes\escort.escortIEPane.1] =>PUP.Funmoods [HKLM\Software\Classes\SearchQUIEHelper.DNSGuard] =>Adware.Bandoo [HKLM\Software\Classes\SearchQUIEHelper.DNSGuard.1] =>Adware.Bandoo [HKLM\Software\Classes\sim-packages] =>Toolbar.Agent [HKLM\Software\Wow6432Node\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj] =>PUP.SweetIM [HKLM\SYSTEM\CurrentControlSet\Services\HssSrv] =>Toolbar.Agent [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\HssSrv] =>Toolbar.Agent [HKCU\Software\1ClickDownload] =>PUP.1ClickDownloader [HKCU\Software\BabylonToolbar] =>Toolbar.Babylon [HKCU\Software\DataMngr] =>Adware.Bandoo [HKLM\Software\DataMngr] =>Adware.Bandoo [HKLM\Software\Wow6432Node\DataMngr] =>Adware.Bandoo [HKLM\Software\Wow6432Node\SearchquMediabarTb] =>Adware.Bandoo [HKCU\Software\Softonic] =>Toolbar.Conduit [HKCU\Software\SweetIM] =>PUP.SweetIM [HKLM\Software\Wow6432Node\SweetIM] =>PUP.SweetIM [HKLM\Software\Wow6432Node\Microsoft\Tracing\MyBabylontb_RASAPI32] =>Toolbar.Babylon [HKLM\Software\Wow6432Node\Microsoft\Tracing\MyBabylontb_RASMANCS] =>Toolbar.Babylon [HKLM\Software\Wow6432Node\Microsoft\Tracing\SearchquMediaBar_RASAPI32] =>Adware.Bandoo [HKLM\Software\Wow6432Node\Microsoft\Tracing\SearchquMediaBar_RASMANCS] =>Adware.Bandoo [HKLM\Software\Wow6432Node\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32] =>Adware.Bandoo [HKLM\Software\Wow6432Node\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS] =>Adware.Bandoo [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}] =>Toolbar.Babylon [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}] =>Toolbar.Bing [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{FDE58148-57E7-43BF-879A-29CCE818C078}] =>Toolbar.eBay [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}] =>Toolbar.DeltaSearch [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}] =>Toolbar.DeltaSearch [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}] =>Toolbar.DeltaSearch [HKLM\Software\Classes\Prod.cap] =>Toolbar.Babylon [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings] =>PUP.BProtector [HKLM\Software\Classes\Installer\Features\B2FD9C0A5B9838449838816A28001F4B] =>PUP.SweetIM [HKLM\Software\Classes\Installer\Products\B2FD9C0A5B9838449838816A28001F4B] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B2FD9C0A5B9838449838816A28001F4B] =>PUP.SweetIM [HKLM\Software\Wow6432Node\Classes\Installer\Features\B2FD9C0A5B9838449838816A28001F4B] =>PUP.SweetIM [HKLM\Software\Wow6432Node\Classes\Installer\Products\B2FD9C0A5B9838449838816A28001F4B] =>PUP.SweetIM [HKLM\Software\Classes\Installer\Features\25BD30E1BC5D83343A835E62DDD4D41B] =>Toolbar.Agent [HKLM\Software\Classes\Installer\Products\25BD30E1BC5D83343A835E62DDD4D41B] =>Toolbar.Agent [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\25BD30E1BC5D83343A835E62DDD4D41B] =>Toolbar.Agent [HKLM\Software\Wow6432Node\Classes\Installer\Features\25BD30E1BC5D83343A835E62DDD4D41B] =>Toolbar.Agent [HKLM\Software\Wow6432Node\Classes\Installer\Products\25BD30E1BC5D83343A835E62DDD4D41B] =>Toolbar.Agent [HKLM\Software\Classes\Installer\Features\84185EDF7E75FB3478A992CC8E810C87] =>Toolbar.eBay [HKLM\Software\Classes\Installer\Products\84185EDF7E75FB3478A992CC8E810C87] =>Toolbar.eBay [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\84185EDF7E75FB3478A992CC8E810C87] =>Toolbar.eBay [HKLM\Software\Wow6432Node\Classes\Installer\Features\84185EDF7E75FB3478A992CC8E810C87] =>Toolbar.eBay [HKLM\Software\Wow6432Node\Classes\Installer\Products\84185EDF7E75FB3478A992CC8E810C87] =>Toolbar.eBay [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{82E1477C-B154-48D3-9891-33D83C26BCD3}] =>PUP.Funmoods [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{82E1477C-B154-48D3-9891-33D83C26BCD3}] =>PUP.Funmoods [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4318DF19719275242801CBE292063A4C] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\75D5168E5E176C24981B4E5DBD991078] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8724E58E6C7D00C48A0D4F3345EB2C26] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AB676B0E1B9EFA049B9F7DDDA9645734] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B31BBB0B825EDEF45AB0FE7099C68C81] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B471D8D7319336B4CA89374ED0D7B806] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BC30043663AA2CA4DA1DAA9CA5FDCC75] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FDC83385E6C239F4C876A77A37DF581D] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432] =>PUP.SweetIM [HKLM\Software\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}] =>PUP.SweetIM [HKLM\Software\Classes\MediaPlayer.GraphicsUtils] =>PUP.SweetIM [HKLM\Software\Classes\MediaPlayer.GraphicsUtils.1] =>PUP.SweetIM [HKLM\Software\Classes\MgMediaPlayer.GifAnimator] =>PUP.SweetIM [HKLM\Software\Classes\MgMediaPlayer.GifAnimator.1] =>PUP.SweetIM [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F754C503375A13344B22388E18DFE87E] =>PUP.SweetIM [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\bi_uninstaller] =>Adware.MegaSearch [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}] =>PUP.BProtector [HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85}] =>Toolbar.DeltaSearch [HKLM\Software\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}] =>Toolbar.DeltaSearch [HKLM\Software\Wow6432Node\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}] =>Toolbar.DeltaSearch [HKLM\Software\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}] =>Toolbar.DeltaSearch [HKLM\Software\Classes\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D}] =>Toolbar.DeltaSearch [HKLM\Software\Wow6432Node\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}] =>Toolbar.DeltaSearch [HKLM\Software\Classes\TypeLib\{4599D05A-D545-4069-BB42-5895B4EAE05B}] =>Toolbar.DeltaSearch [HKLM\Software\Classes\delta.deltaappCore] =>PUP.Funmoods [HKLM\Software\Classes\delta.deltaappCore.1] =>PUP.Funmoods [HKLM\Software\Classes\delta.deltadskBnd] =>PUP.Funmoods [HKLM\Software\Classes\delta.deltadskBnd.1] =>PUP.Funmoods [HKLM\Software\Classes\AppID\ESRV.EXE] =>Adware.Facemoods [HKLM\Software\Classes\delta.deltaHlpr] =>toolbar.DeltaSearch [HKLM\Software\Classes\delta.deltaHlpr.1] =>toolbar.DeltaSearch [HKLM\Software\Classes\esrv.deltaESrvc] =>toolbar.DeltaSearch [HKLM\Software\Classes\esrv.deltaESrvc.1] =>toolbar.DeltaSearch [HKLM\Software\Classes\AppID\escort.DLL] =>PUP.Funmoods [HKLM\Software\Classes\AppID\escortApp.DLL] =>PUP.Funmoods [HKLM\Software\Classes\AppID\escortEng.DLL] =>PUP.Funmoods [HKLM\Software\Classes\AppID\escorTlbr.DLL] =>PUP.Funmoods [HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe] =>PUP.SweetIM [HKLM\Software\Wow6432Node\Classes\delta.deltaappCore] =>toolbar.DeltaSearch [HKLM\Software\Wow6432Node\Classes\delta.deltaappCore.1] =>toolbar.DeltaSearch [HKLM\Software\Wow6432Node\Classes\delta.deltadskBnd] =>toolbar.DeltaSearch [HKLM\Software\Wow6432Node\Classes\delta.deltadskBnd.1] =>toolbar.DeltaSearch [HKLM\Software\Wow6432Node\Classes\delta.deltaHlpr] =>toolbar.DeltaSearch [HKLM\Software\Wow6432Node\Classes\delta.deltaHlpr.1] =>toolbar.DeltaSearch [HKLM\Software\Wow6432Node\Classes\esrv.deltaESrvc] =>toolbar.DeltaSearch [HKLM\Software\Wow6432Node\Classes\esrv.deltaESrvc.1] =>toolbar.DeltaSearch [HKLM\Software\Wow6432Node\Classes\escort.escortIEPane] =>PUP.Funmoods [HKLM\Software\Wow6432Node\Classes\escort.escortIEPane.1] =>PUP.Funmoods [HKLM\Software\Wow6432Node\Classes\SearchQUIEHelper.DNSGuard] =>Adware.Bandoo [HKLM\Software\Wow6432Node\Classes\SearchQUIEHelper.DNSGuard.1] =>Adware.Bandoo [HKLM\Software\Wow6432Node\Classes\AppID\escort.DLL] =>PUP.Funmoods [HKLM\Software\Wow6432Node\Classes\AppID\escortApp.DLL] =>PUP.Funmoods [HKLM\Software\Wow6432Node\Classes\AppID\escortEng.DLL] =>PUP.Funmoods [HKLM\Software\Wow6432Node\Classes\AppID\escorTlbr.DLL] =>PUP.Funmoods [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636] =>PUP.SweetIM^ [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094] =>PUP.SweetIM^ [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536] =>PUP.SweetIM^ [HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar]:{99079A25-328F-4BD4-BE04-00955ACAA0A7} =>Adware.Bandoo [HKCU\Software\Mozilla\Firefox\Extensions]:{0F827075-B026-42F3-885D-98981EE7B1AE} =>Toolbar.Babylon C:\Program Files (x86)\Searchqu Toolbar =>Adware.Bandoo C:\Program Files (x86)\SweetIM =>PUP.SweetIM C:\ProgramData\Babylon =>Toolbar.Babylon C:\ProgramData\SweetIM =>PUP.SweetIM C:\ProgramData\BrowserProtect =>Hijacker.Eazel C:\Users\Chai\AppData\Roaming\Babylon =>Toolbar.Babylon C:\Users\Chai\AppData\Roaming\BabSolution =>Hijacker.BabSolution C:\Users\Chai\AppData\Local\Bundled software uninstaller =>Adware.MegaSearch C:\Users\Chai\AppData\LocalLow\searchqutoolbar =>Adware.Bandoo ~ Additionnel Scan: 699176 Items scanned in 00mn 49s ---\\ Product Upgrade Codes (O90) O90 - PUC: "25BD30E1BC5D83343A835E62DDD4D41B" . (.Bing Bar.) -- C:\Windows\Installer\{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}\icon_installer_ico O90 - PUC: "35458C991A9507F44998C1A0FD68791C" . (..NET Reflector Desktop.) -- C:\Windows\Installer\{99C85453-59A1-4F70-9489-1C0ADF8697C1}\ProductIcon.ico ~ Update Products: 331 Legitimates Filtered in 00mn 00s ---\\ Random Export Key (O91) [HKCU\Software\5d578cdfb234ee40\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1095.52]:guid="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}" [HKCU\Software\5d578cdfb234ee40\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1095.52]:version="2.6.1095.52" [HKCU\Software\5d578cdfb234ee40] =>Toolbar.Babylon^ [HKCU\Software\5d578cdfb234ee40]:GUID="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}" [HKCU\Software\5d578cdfb234ee40]:version="2.6.1125.80" [HKLM\Software\Wow6432Node\5d578cdfb234ee40] =>Toolbar.Babylon^ [HKLM\Software\Wow6432Node\5d578cdfb234ee40]:GUID="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}" [HKLM\Software\Wow6432Node\5d578cdfb234ee40]:version="2.6.1125.80" ~ Export Key Software: Scanned in 00mn 00s ---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped) SR - | Auto 21/12/2012 57008 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe SR - | Auto 06/03/2013 45248 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe SS - | Disabled 01/03/2011 183560 | (BBSvc) . (.Microsoft Corporation..) - C:\Program Files (x86)\Microsoft\BingBar\BBSvc.exe SR - | Auto 30/08/2011 462184 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe SR - | Auto 2569168 | (BrowserProtect) . (...) - C:\ProgramData\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe =>Toolbar.Babylon SR - | Auto 28/01/2010 249200 | (cfWiMAXService) . (.TOSHIBA CORPORATION.) - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe SR - | Auto 10/03/2009 46448 | (ConfigFree Service) . (.TOSHIBA CORPORATION.) - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe SS - | Demand 12/10/2010 206072 | (GamesAppService) . (.WildTangent, Inc..) - C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe SS - | Auto 16/03/2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe SS - | Demand 16/03/2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe SS - | Disabled 23/02/2013 545576 | (hshld) . (.AnchorFree Inc..) - C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe SS - | Disabled 23/02/2013 453928 | (HssSrv) . (.AnchorFree Inc..) - C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe SS - | Disabled 78512 | (HssTrayService) . (...) - C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.exe SS - | Disabled 389928 | (HssWd) . (...) - C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe SS - | Demand 14/11/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe SS - | Demand 20/02/2013 641352 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe SR - | Auto 20/12/2010 325656 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe SS - | Disabled 14/01/2011 572712 | (NAUpdate) . (.Nero AG.) - c:\Program Files (x86)\Nero\Update\NASvc.exe SR - | Auto 15/03/2013 877856 | (NVSvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe SS - | Disabled 25/02/2011 249648 | (SeaPort) . (.Microsoft Corporation.) - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.exe SS - | Auto 28/02/2013 161384 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe SS - | Demand 29/03/2013 543656 | (Steam Client Service) . (.Valve Corporation.) - C:\Program Files (x86)\Common Files\Steam\SteamService.exe SR - | Auto 23/04/2013 3574624 | (TeamViewer8) . (.TeamViewer GmbH.) - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe SS - | Demand 10/02/2011 112080 | (TemproMonitoringService) . (.Toshiba Europe GmbH.) - C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe SR - | Demand 29/11/2010 54136 | (TMachInfo) . (.TOSHIBA Corporation.) - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe SS - | Disabled 20/10/2010 138656 | (TODDSrv) . (.TOSHIBA Corporation.) - C:\Windows\system32\TODDSrv.exe SR - | Auto 09/12/2010 489384 | (TosCoSrv) . (.TOSHIBA Corporation.) - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe SR - | Auto 02/03/2011 266680 | (TOSHIBA eco Utility Service) . (.TOSHIBA Corporation.) - C:\Program Files\TOSHIBA\TECO\TecoService.exe SR - | Demand 08/12/2010 137632 | (TOSHIBA HDD SSD Alert Service) . (.TOSHIBA Corporation.) - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe SR - | Demand 20/12/2010 822704 | (TPCHSrv) . (.TOSHIBA Corporation.) - C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe SR - | Auto 19/09/2012 2365792 | (TuneUp.UtilitiesSvc) . (.TuneUp Software.) - C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe SR - | Auto 20/12/2010 2656280 | (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe SS - | Demand 01/03/2011 27648 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe SR - | Auto 01/03/2011 27648 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe ~ Services: Scanned in 00mn 01s ---\\ Recherche Master Boot Record Infection (MBR)(O80) Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net ~ MBR: 1 Legitimates Filtered in 00mn 02s ---\\ Recherche Master Boot Record Infection (MBRCheck)(O80) Written by ad13, http://ad13.geekstog Run by Chai at 05/05/2013 20:35:41 ********* Dump file Name ********* C:\PhysicalDisk0_MBR.bin ~ MBR: Scanned in 00mn 04s ~ 2273 Legitimates filtered by white list End of the scan (899 lines in 05mn 39s)(0)