~ Rapport de ZHPDiag v2013.10.5.15 - Nicolas Coolman  (05/10/2013)
~ Lancé par ninie lolo (06/10/2013 13:56:36)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Traduit par Nicolas Coolman
~ Etat de la version : 
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by program


---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16686
MFIE: Mozilla Firefox 24.0 (Defaut)

---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK

---\\ Logiciels de protection du système
avast! Free Antivirus v8.0.1497.0
Malwarebytes Anti-Malware version 1.75.0.1300
Spybot - Search & Destroy v1.6.2
Windows Defender W7

---\\ Logiciels d'optimisation du système
CCleaner v3.00 =>Piriform Ltd

---\\ Logiciels de partage PeerToPeer
µTorrent v3.3.0.29420 =>P2P.µTorrent

---\\ Surveillance de Logiciels
Adobe Flash Player 11 Plugin
Adobe Reader XI
Java 7 Update 40
Java 7 Update 25

---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 23 Stepping 10, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 4095 MB (64% free)
System Restore: Activé (Enable)
System drive C: has 88 GB (19%) free of 458 GB

---\\ Mode de connexion au système
~ Computer Name: NINIELOLO-PC
~ User Name: ninie lolo
~ All Users Names: ninie lolo, HomeGroupUser$, Administrateur, 
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\ninie lolo\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\ninie lolo\AppData\Roaming\
~ %Desktop% : C:\Users\ninie lolo\Desktop\
~ %Favorites% : C:\Users\ninie lolo\Favorites\
~ %LocalAppData% : C:\Users\ninie lolo\AppData\Local\
~ %StartMenu% : C:\Users\ninie lolo\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 88 Go of 458 Go)
D: Hard drive, Flash drive, Thumb drive (Free 458 Go of 458 Go)
E: CD-ROM drive (Not Inserted)
G: Floppy drive, Flash card reader, USB Key (Not Inserted)
H: Floppy drive, Flash card reader, USB Key (Not Inserted)
I: Floppy drive, Flash card reader, USB Key (Not Inserted)
J: Floppy drive, Flash card reader, USB Key (Not Inserted)



---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 31 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.AAFA952E774DDDB0956D3BDFAE5B5B99] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.10/08/2013 - 06:22:18.) -- C:\Windows\System32\wininet.dll [2241024]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.1C7857B62DE5994A75B054A9FD4C3825] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/12/2011 - 04:59:24.) -- C:\Windows\system32\Drivers\AFD.sys [498688]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes:  Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 3/98
~ Mes musiques (My Musics) : 2/197
~ Mes Videos (My Videos) : 2/5
~ Mes Favoris (My Favorites) : 1/51
~ Mes Documents (My Documents) : 2/404
~ Mon Bureau (My Desktop) : 2/1529
~ Menu demarrer (Programs) : 1/106
~ Hidden Files:  Scanned in 00mn 00s



---\\ Processus lancés
[MD5.CBC7D8E5416AD30CF16DC2FD4A6AA399] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe   [4858968] [PID.3196]
[MD5.A63DC5C2EA944E6657203E0C8EDEAF61] - (.Microsoft Corporation - COM Surrogate.) -- C:\Windows\SysWOW64\DllHost.exe   [7168] [PID.2148]
[MD5.0572A34D8A8EA8166DFE27AB9703E1E0] - (.Nicolas Coolman - ZHPFix.) -- C:\Program Files (x86)\ZHPFix\ZHPFix.exe   [2726912] [PID.4868]
[MD5.A9182CE59CFC56F9C1DDE8B3C0AE8378] - (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe   [274840] [PID.3720]
[MD5.12FD4EF8F2CBBF98E0A5CED88258DDF3] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe   [17816] [PID.4564]
[MD5.18F20138A715E0677A24A0986BC9AEA2] - (.Adobe Systems, Inc. - Adobe Flash Player 11.8 r800.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe   [1862024] [PID.4676]
[MD5.DF4ECCA12FEB1586A02F1964569AC15B] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe   [8049664] [PID.2228]
~ Processes Running:  Scanned in 00mn 00s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions  (P2,M0,M1,M2,M3)
C:\Users\ninie lolo\AppData\Roaming\Mozilla\Firefox\Profiles\ep8ti82w.default\prefs.js
C:\Users\ninie lolo\AppData\Roaming\Mozilla\Firefox\Profiles\ep8ti82w.default\user.js
P2 - FPN: [HKCU] [@facebook.com/FBPlugin,version=1.0.3] - (.Pas de propriétaire - Provides additional functionality on Facebook. See <a href="http://www.) -- C:\Users\ninie lolo\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll  =>.Facebook
~ Firefox Browser: 37 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management:  Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys:  Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File:  Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: (no name) [64Bits] - [HKLM]{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) [64Bits] - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
~ Toolbar:  Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Azada In Libro.lnk . (...)  -- C:\Program Files (x86)\BoontyGames\Azada In Libro\Azada_In_Libro.exe (.not file.)
O4 - GS\Desktop [Public]: Canon MG5200 series Manuel en ligne.lnk . (.CANON INC. - Easy Guide Viewer.)  -- C:\Program Files (x86)\Canon\IJ Manual\Easy Guide Viewer\cmview.exe 
O4 - GS\Desktop [Public]: Detective Stories - Hollywood.lnk . (...)  -- C:\Program Files (x86)\BoontyGames\Detective Stories - Hollywood\ds-hollywood.exe (.not file.)
O4 - GS\Desktop [Public]: Dream Chronicles The Chosen Child.lnk . (...)  -- C:\Program Files (x86)\BoontyGames\Dream Chronicles The Chosen Child\dc_chosen_child.exe (.not file.)
O4 - GS\Desktop [Public]: Encore plus de jeux.lnk - Clé orpheline
O4 - GS\Desktop [Public]: Jouer à Natural Threat - L'Ile Aux Plantes.lnk . (...)  -- C:\Program Files (x86)\Natural Threat - L'Ile Aux Plantes\LaunchGame.bfg 
O4 - GS\Desktop [Public]: The Lost Cases of Sherlock Holmes 2.lnk . (...)  -- C:\Program Files (x86)\BoontyGames\The Lost Cases of Sherlock Holmes 2\The Lost Cases of Sherlock Holmes 2.exe (.not file.)
O4 - GS\Desktop [Public]: User's Guide (Packard Bell InfoCentre).lnk . (.Acer Incorporated - InfoCentre Web Browser.)  -- C:\Program Files (x86)\Packard Bell\InfoCentre\InfoCtr.exe 
O4 - GS\Program [Public]: Encore plus de jeux.lnk - Clé orpheline
O4 - GS\Program [Public]: Photorécit 3 pour Windows.lnk . (.Microsoft Corp. - Photo Story 3 for Windows.)  -- C:\Program Files (x86)\Photo Story 3 for Windows\PhotoStory3.exe 
O4 - GS\QuickLaunch [ninie lolo]: Spybot - Search & Destroy.lnk . (.Safer Networking Limited - Spybot - Search & Destroy.)  -- C:\Program Files (x86)\Spybot - Search & Destroy\SpybotSD.exe 
O4 - GS\Program [ninie lolo]: Photo to Cartoon.lnk . (...)  -- C:\Users\ninie lolo\AppData\Roaming\Microsoft\Installer\{3A6A34D3-37EE-40F3-BF81-EC7A4BF7F24D}\_CFAB5842CE4CA8EE43C154.exe
O4 - GS\Desktop [ninie lolo]: 2 Tasty Too.lnk . (...)  -- C:\Zylom Games\2 Tasty Too\ZY-2TastyToo.exe
O4 - GS\Desktop [ninie lolo]: AD-R.lnk . (...)  -- C:\Program Files (x86)\Ad-Remover\main.exe
O4 - GS\Desktop [ninie lolo]: Ancient Secrets - Mystery of the Vanishing Bride.lnk . (...)  -- C:\Zylom Games\Ancient Secrets - Mystery of the Vanishing Bride\ZY-AncientSecrets2.exe
O4 - GS\Desktop [ninie lolo]: AnmanieSMP.lnk . (...)  -- C:\Program Files (x86)\AnmSMP\AnmanieSMP.exe
O4 - GS\Desktop [ninie lolo]: Assistance Livebox.lnk . (.Orange - Assistance Livebox.)  -- C:\Program Files (x86)\Orange\Assistance Livebox\AssistanceLivebox.exe 
O4 - GS\Desktop [ninie lolo]: Bigfoot - Chasing Shadows.lnk . (...)  -- C:\Zylom Games\Bigfoot - Chasing Shadows\ZY-Bigfoot.exe
O4 - GS\Desktop [ninie lolo]: Book of Legends Deluxe.lnk . (...)  -- C:\Users\ninie lolo\AppData\Local\Zylom Games\Book of Legends Deluxe\bookoflegends.exe (.not file.)
O4 - GS\Desktop [ninie lolo]: Chronicles of Albian - The Magic Convention.lnk . (...)  -- C:\Zylom Games\Chronicles of Albian - The Magic Convention\ZY-chroniclesofalbian.exe
O4 - GS\Desktop [ninie lolo]: Empress of the Deep 2 - Song of the Blue Whale.lnk . (...)  -- C:\Zylom Games\Empress of the Deep 2 - Song of the Blue Whale\empressofthedeep2.exe
O4 - GS\Desktop [ninie lolo]: Enlightenus.lnk . (...)  -- C:\Zylom Games\Enlightenus\ZY-Enlightenus.exe
O4 - GS\Desktop [ninie lolo]: films.lnk . (...)  -- C:\Users\ninie lolo\Downloads\temporaire 
O4 - GS\Desktop [ninie lolo]: Gardenscapes Deluxe.lnk . (...)  -- C:\Users\ninie lolo\AppData\Local\Zylom Games\Gardenscapes Deluxe\Gardenscapes.exe
O4 - GS\Desktop [ninie lolo]: Hodgepodge Hollow - A Potions Primer.lnk . (.Jolly Bear Games - Hodgepodge Hollow - A Potions Primer.)  -- C:\Zylom Games\Hodgepodge Hollow - A Potions Primer\ZY-HodgepodgeHollow.exe 
O4 - GS\Desktop [ninie lolo]: Hollywood - The Director's Cut Deluxe.lnk . (...)  -- C:\Users\ninie lolo\AppData\Local\Zylom Games\Hollywood - The Director's Cut Deluxe\hollywoodthedirectorscut.exe
O4 - GS\Desktop [ninie lolo]: Letters from Nowhere.lnk . (...)  -- C:\Zylom Games\Letters from Nowhere\LettersFromNowhere.exe
O4 - GS\Desktop [ninie lolo]: Light Image Resizer 4.lnk . (.ObviousIdea SARL - ImageResizer.)  -- C:\Program Files (x86)\ObviousIdea\Image Resizer 4\Resize.exe 
O4 - GS\Desktop [ninie lolo]: Mirror Mysteries Deluxe.lnk . (...)  -- C:\Users\ninie lolo\AppData\Local\Zylom Games\Mirror Mysteries Deluxe\mirrormysteries.exe (.not file.)
O4 - GS\Desktop [ninie lolo]: Mystery Legends - The Phantom of the Opera.lnk . (.pixelStorm entertainment studios Inc. - Mystery Legends™ Phantom of the Opera.)  -- C:\Zylom Games\Mystery Legends - The Phantom of the Opera\ZY-mysterylegendsthephantomoftheopera.exe 
O4 - GS\Desktop [ninie lolo]: Mystery P.I.(TM) - The Curious Case of Counterfeit Cove.lnk . (.SpinTop Games - Mystery P.I. - The Curious Case of Counterf.)  -- C:\Zylom Games\Mystery P.I.(TM) - The Curious Case of Counterfeit Cove\ZY-MysteryPINewEngland.exe 
O4 - GS\Desktop [ninie lolo]: Paige Harper and the Tome of Mystery.lnk . (...)  -- C:\Zylom Games\Paige Harper and the Tome of Mystery\paige_harper.exe
O4 - GS\Desktop [ninie lolo]: PC Wizard 2010.lnk . (.CPUID - System Information Analyzer.)  -- C:\Program Files (x86)\CPUID\PC Wizard 2010\PC Wizard.exe  =>.CPUID
O4 - GS\Desktop [ninie lolo]: Photo Flash Maker Free.lnk . (.AnvSoft Inc. - Photo Slideshow Maker Free Version.)  -- C:\Program Files (x86)\AnvSoft\Photo Flash Maker Free Version\pfmfree.exe 
O4 - GS\Desktop [ninie lolo]: Photo Slideshow Maker Free.lnk . (.AnvSoft Inc. - Photo Slideshow Maker Free Version.)  -- C:\Program Files (x86)\AnvSoft\Photo Flash Maker Free Version\pfmfree.exe 
O4 - GS\Desktop [ninie lolo]: Photo to Cartoon.lnk . (...)  -- C:\Users\ninie lolo\AppData\Roaming\Microsoft\Installer\{3A6A34D3-37EE-40F3-BF81-EC7A4BF7F24D}\_FE06834DA7988E6849D002.exe
O4 - GS\Desktop [ninie lolo]: Pirateville Deluxe.lnk . (...)  -- C:\Users\ninie lolo\AppData\Local\Zylom Games\Pirateville Deluxe\pirateville.exe (.not file.)
O4 - GS\Desktop [ninie lolo]: Portrait Professional 9 Trial.lnk . (.Anthropics Technology Ltd. - Portrait Professional.)  -- C:\Program Files (x86)\Portrait Professional 9 Trial\PortraitProfessionalTrial.exe 
O4 - GS\Desktop [ninie lolo]: Poster Forge.lnk . (.RonyaSoft - Poster Forge - poster generator..)  -- C:\Program Files (x86)\Poster Forge\Poster Forge.exe 
O4 - GS\Desktop [ninie lolo]: Rita James and the Race to Shangri La.lnk . (...)  -- C:\Zylom Games\Rita James and the Race to Shangri La\ZY-Shangri La.exe
O4 - GS\Desktop [ninie lolo]: Spirit of Wandering Deluxe.lnk . (...)  -- C:\Users\ninie lolo\AppData\Local\Zylom Games\Spirit of Wandering Deluxe\spiritofwandering.exe (.not file.)
O4 - GS\Desktop [ninie lolo]: The Enchanting Islands.lnk . (...)  -- C:\Program Files (x86)\MyPlayCity.com\The Enchanting Islands\The Enchanting Islands.exe
O4 - GS\Desktop [ninie lolo]: The Tiny Bang Story.lnk . (...)  -- C:\Zylom Games\The Tiny Bang Story\ZY-game.exe
O4 - GS\Desktop [ninie lolo]: Vacation Quest(TM) - The Hawaiian Islands.lnk . (.SpinTop Games - Vacation Quest - The Hawaiian Islands.)  -- C:\Zylom Games\Vacation Quest(TM) - The Hawaiian Islands\VacationQuest.exe 
O4 - GS\Desktop [ninie lolo]: ZHPFix.lnk . (.Nicolas Coolman - ZHPDiag Setup.)  -- C:\Program Files (x86)\ZHPDiag\ZHPFix\ZHPhep.exe  =>.Nicolas Coolman
~ Global Startup: 122 Legitimates Filtered in 00mn 00s



---\\ Applications lancées au démarrage du sytème (O4)
O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\ninie lolo\AppData\Local\Google\Update\GoogleUpdate.exe  =>.Google Inc
O4 - HKCU\..\Run: [SpybotSD TeaTimer] . (.Safer Networking Limited - System settings protector.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe 
O4 - HKLM\..\Wow6432Node\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe 
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe  =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [BCSSync] . (.Microsoft Corporation - Microsoft Office 2010 component.) -- C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe  =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe  =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe  =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe  =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe  =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-3251470970-1943291794-2502108607-1000\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\ninie lolo\AppData\Local\Google\Update\GoogleUpdate.exe  =>.Google Inc
O4 - HKUS\S-1-5-21-3251470970-1943291794-2502108607-1000\..\Run: [SpybotSD TeaTimer] . (.Safer Networking Limited - System settings protector.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe 
~ Application:  Scanned in 00mn 00s



---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: &Envoyer à OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} -- C:\Program Files (x86)\MICROS~2\Office14\ONBttnIE.dll (.not file.)
O9 - Extra button: Notes &liées OneNote [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} -- C:\Program Files (x86)\MICROS~2\Office14\ONBTTN~1.dll (.not file.)
~ IE Extra Buttons:  Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{BE05B85D-9BF2-45EC-A27E-8A2B4957965A}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{BE05B85D-9BF2-45EC-A27E-8A2B4957965A}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{BE05B85D-9BF2-45EC-A27E-8A2B4957965A}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain:  Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) -- 
O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll  =>.Microsoft Corporation
~ Protocole Additionnel:  Scanned in 00mn 00s



---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: BrowserDefendert (BrowserDefendert) . (...) - C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe (.not file.) =>Hijacker.Eazel
O23 - Service: Updater Service (Updater Service) . (.Acer - Acer Update Service.) - C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
~ Services: 13 Legitimates Filtered in 00mn 05s



---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [{084056D5-3ADA-4CF7-ABD4-B6A9FC70241D}] (...) -- C:\Users\ninie lolo\Desktop\OOo_3.3.0_Win_x86_install-wJRE_fr.exe (.not file.)   [0]
[MD5.16DD45BC2674FC281E5115EB709998E3] [APT] [{102D5EF3-D1C9-4F5C-A832-2465CC731026}] (.Nullsoft, Inc..) -- C:\Program Files (x86)\Winamp\winamp.exe   [1595520]
[MD5.6B19EF12328CB4735410495D313FCB21] [APT] [{1F44C62C-6AEF-4710-88B3-F428FFE7305A}] (.pixelStorm entertainment studios Inc..) -- C:\Zylom Games\Mystery Legends - The Phantom of the Opera\ZY-mysterylegendsthephantomoftheopera.exe   [3641345]
[MD5.00000000000000000000000000000000] [APT] [{208F58C7-9AB3-4362-B1E5-71F222DB84D9}] (...) -- C:\Program Files (x86)\Creative\Shared Files\CamTray.exe (.not file.)   [0]
[MD5.16DD45BC2674FC281E5115EB709998E3] [APT] [{32E36B92-DB36-44C0-8F44-47D327601EF2}] (.Nullsoft, Inc..) -- C:\Program Files (x86)\Winamp\winamp.exe   [1595520]
[MD5.00000000000000000000000000000000] [APT] [{6158B185-6220-45C2-945D-744BF8652106}] (...) -- C:\Users\ninie lolo\Desktop\OOo_3.3.0_Win_x86_install-wJRE_fr.exe (.not file.)   [0]
[MD5.DB1C358D7E3AC52DA1877EBF2CBC455C] [APT] [{80950962-CB4E-453E-AFF0-CA01FF8B761B}] (...) -- C:\Zylom Games\Paige Harper and the Tome of Mystery\paige_harper.exe   [4084737]
[MD5.16DD45BC2674FC281E5115EB709998E3] [APT] [{AB638467-62C6-4AE2-85D3-79ACF6F26984}] (.Nullsoft, Inc..) -- C:\Program Files (x86)\Winamp\winamp.exe   [1595520]
[MD5.00000000000000000000000000000000] [APT] [{AC40F822-F302-4FF8-AF2E-B03358F0DA6A}] (...) -- C:\Program Files (x86)\Creative\Shared Files\CamTray.exe (.not file.)   [0]
[MD5.00000000000000000000000000000000] [APT] [{B9754366-586A-46E5-B27C-E2B0F3F7951E}] (...) -- C:\Program Files (x86)\Creative\Shared Files\CamTray.exe (.not file.)   [0]
[MD5.2E19857E9FFD395FAA6686959624297A] [APT] [{D70BA6B6-0CCC-4A3C-909B-4C483FF193AF}] (...) -- C:\Users\ninie lolo\Downloads\AmazonMP3Installer-fr_FR.exe   [1008760]
[MD5.00000000000000000000000000000000] [APT] [{E709B475-289C-4F16-B9EF-1C769213DFF6}] (...) -- C:\Program Files (x86)\Creative\Shared Files\CamTray.exe (.not file.)   [0]
~ Scheduled Task: 32 Legitimates Filtered in 00mn 01s



---\\ Logiciels installés (O42)
O42 - Logiciel: Akamai NetSession Interface - (...) [HKCU][64Bits] -- Akamai
O42 - Logiciel: Bigfoot - Chasing Shadows - (...) [HKLM][64Bits] -- b1f65ba6669c74ccfc041d0a33916095
O42 - Logiciel: Hodgepodge Hollow - A Potions Primer - (...) [HKLM][64Bits] -- 6541e23fa1482a67c05d48034fa94304
O42 - Logiciel: NewFreeScreensaver nfsBadWeather - (...) [HKLM][64Bits] -- nfsBadWeather New Free Screensaver_is1
O42 - Logiciel: Puzzles Collection 3 1.0 - (.Falco Software, Inc..) [HKLM][64Bits] -- Puzzles Collection 3_is1
O42 - Logiciel: Rita James and the Race to Shangri La - (...) [HKLM][64Bits] -- a0f2af2133ef9a161a3775139c6c14b4
O42 - Logiciel: The Tiny Bang Story - (...) [HKLM][64Bits] -- efb14509cb6a3ef54a4c5ced627d9d9e
~ Logic: 223 Legitimates Filtered in 00mn 01s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\5b558dd1e66deb48]
[HKCU\Software\AmeGami]
[HKCU\Software\BI]
[HKCU\Software\Delta]
[HKLM\Software\Wow6432Node\5b558dd1e66deb48]
[HKLM\Software\Wow6432Node\DataMngr] =>PUP.Datamngr
[HKLM\Software\Wow6432Node\Delta]
~ Key Software: 346 Legitimates Filtered in 00mn 01s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 27/07/2013 - 16:24:41 - [0] ----D C:\Program Files (x86)\Delta
O43 - CFD: 20/12/2009 - 22:22:33 - [4,786] ----D C:\Program Files (x86)\My Free Mahjong
O43 - CFD: 27/07/2013 - 16:24:10 - [0] ----D C:\ProgramData\Babylon =>Toolbar.Babylon
O43 - CFD: 13/01/2010 - 20:12:46 - [31,657] ----D C:\ProgramData\BC Soft Games
O43 - CFD: 01/09/2013 - 19:46:43 - [0] ----D C:\ProgramData\BrowserDefender =>Hijacker.Eazel
O43 - CFD: 19/04/2011 - 15:19:40 - [0,002] ----D C:\ProgramData\Terrafarmers
O43 - CFD: 25/08/2010 - 22:42:55 - [0,004] ----D C:\Users\ninie lolo\AppData\Roaming\IBAGroup
O43 - CFD: 07/01/2010 - 23:51:37 - [0,005] ----D C:\Users\ninie lolo\AppData\Roaming\Pharaohs Secret
O43 - CFD: 07/10/2012 - 19:07:08 - [0,652] ----D C:\Users\ninie lolo\AppData\Roaming\Phocus
~ 1831 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 2248 Legitimates Filtered in 00mn 27s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.57DAF660F51C91E3CEB28E0BE28E7BB4] - 06/10/2013 - 09:40:58 ---A- . (...) -- C:\Windows\ntbtlog.txt   [133806]
~ Files: 18 Legitimates Filtered in 00mn 02s



---\\ Opérations et fonctions au démarrage de Windows Explorer (O46)
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook [64Bits] - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
~ ShellExecuteHooks:  Scanned in 00mn 00s



---\\ Enumération des clés de registre StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\Akamai NetSession Interface  [Key] . (...) -- C:\Users\ninie lolo\AppData\Local\Akamai\netsession_win.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\Hiyo  [Key] . (.IncrediMail, Ltd. - HiYo.) -- C:\Program Files (x86)\HiYo\bin\HiYo.exe
~ SMSR Keys: 16 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.286193DC28CFB4CEB8D378E20A0850A9] - 30/08/2013 - 08:48:10 ---A- . (...) -- C:\Windows\System32\Drivers\aswRvrt.sys   [65336]
~ Drivers: 16 Legitimates Filtered in 00mn 00s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: Ad-Remover par C_XX - (.C_XX.) [HKLM] -- Ad-Remover
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1  =>.Nicolas Coolman
O63 - Logiciel: ZHPFix 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPFix_is1  =>.Nicolas Coolman
~ ADS:  Scanned in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\ninie lolo\AppData\Local\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: <Launcher.exe> <>[HKLM\..\Shell\open\Command] (.Not Key.)
~ Keys:  Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.admin", false); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.aflt", "babsst"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.dfltLng", "en"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.excTlbr", false); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.id", "0cc8ba79000000000000002511a8d2d2"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.instlDay", "15655"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.instlRef", "sst"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.prtnrId", "babylon"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.tlbrId", "base"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "http://search.babylon.com/?babsrc=TB_def&mntrId=0cc8ba79000000000000002511a8d2[...] =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.vrsn", "1.8.3.8"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.vrsni", "1.8.3.8"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar_i.smplGrp", "none"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.3.811:28:44"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.admin", false);
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.aflt", "babsst");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.autoRvrt", "false");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.bbDpng", "1");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.cntry", "FR");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.dfltLng", "fr");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.excTlbr", false);
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.ffxUnstlRst", true);
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.hdrMd5", "F0AEEA90A7269FEA57E1508026F66C58");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.id", "0cc8ba79000000000000002511a8d2d2");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.instlDay", "15913");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.instlRef", "sst");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.lastVrsnTs", "1.8.22.016:24:44");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.newTab", false);
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.prdct", "delta");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.prtnrId", "delta");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.rvrt", "false");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.sg", "azb");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.smplGrp", "none");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.tlbrId", "base");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.tlbrSrchUrl", "");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.vrsn", "1.8.22.0");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.vrsnTs", "1.8.22.016:24:44");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.vrsni", "1.8.22.0");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta_i.babExt", "");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta_i.babTrack", "affID=123884&tsp=4956");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta_i.srcExt", "ss");
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {67A2568C-7A0A-4EED-AECC-B5405DE63B64} - (Google) - http://www.google.com
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Google) - http://www.google.com
O69 - SBI: SearchScopes [HKCU] {814C76CB-2623-43F4-AAD0-58A0E5190A20} - (Orange) - http://r.orange.fr
~ Keys:  Scanned in 00mn 00s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.EF994903FCE2CE3E2D57579B419FF4FC] [SPRF][19/07/2010] (...) -- C:\ProgramData\ezsidmv.dat   [48]
[MD5.D94B86AD01A3CC323619D4FF512ED6FA] [SPRF][06/10/2013] (...) -- C:\Users\ninie lolo\AppData\Local\Temp\catchme.sys   [31744]
[MD5.610F73168D34158BD1FCDA0842957326] [SPRF][09/03/2011] (...) -- C:\Users\ninie lolo\AppData\Roaming\wklnhst.dat   [1082]
[MD5.5D04D875F415062F8BABD49656FF7D3A] [SPRF][26/09/2011] (.AbiSource Developers - Installer for AbiWord.) -- C:\Users\ninie lolo\Desktop\abiword-setup-2.8.6.exe   [8335349]
[MD5.2E19857E9FFD395FAA6686959624297A] [SPRF][24/07/2012] (...) -- C:\Users\ninie lolo\Desktop\AmazonMP3DownloaderInstall.exe   [1008760]
[MD5.DAF2D9AA422C3D065C6F4E8823644944] [SPRF][04/01/2013] (.Pas de propriétaire - Guiformat.) -- C:\Users\ninie lolo\Desktop\guiformat.exe   [73728]
~ Files: 12 Legitimates Filtered in 00mn 00s



---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{9DFC832F-3C29-430D-BEF0-6D062CCEF1A6}" |In - Private - P6 - FALSE | .(...) -- C:\Users\ninie lolo\AppData\Local\Temp\ImInstaller\HiYo_Installer.exe (.not file.)
O87 - FAEL: "{7E0E19A6-23CE-41D9-8779-09A6F54DFF30}" |In - Private - P17 - FALSE | .(...) -- C:\Users\ninie lolo\AppData\Local\Temp\ImInstaller\HiYo_Installer.exe (.not file.)
O87 - FAEL: "{CEAD7C73-B586-466F-ADCA-F9531ACBD0C0}" |In - Private - P6 - TRUE | .(...) -- C:\Users\ninie lolo\AppData\Local\Akamai\netsession_win.exe (.not file.)
O87 - FAEL: "{4A015BFE-B386-4300-B084-363CC2228101}" |In - Private - P17 - TRUE | .(...) -- C:\Users\ninie lolo\AppData\Local\Akamai\netsession_win.exe (.not file.)
O87 - FAEL: "TCP Query User{BEC8282A-5CF3-49C3-B56E-A03D5F42683D}C:\users\ninie lolo\appdata\local\akamai\netsession_win.exe" |In - Public - P6 - TRUE | .(...) -- C:\users\ninie lolo\appdata\local\akamai\netsession_win.exe (.not file.)
O87 - FAEL: "UDP Query User{30D5EC8B-2335-49B4-8FFA-7B3BE29223ED}C:\users\ninie lolo\appdata\local\akamai\netsession_win.exe" |In - Public - P17 - TRUE | .(...) -- C:\users\ninie lolo\appdata\local\akamai\netsession_win.exe (.not file.)
O87 - FAEL: "TCP Query User{CBF660E7-2B43-4DA8-AB15-C34CC3ADF135}E:\tl-wpa281\utility\powerline scan.exe" |In - Private - P6 - TRUE | .(...) -- E:\tl-wpa281\utility\powerline scan.exe (.not file.)
O87 - FAEL: "UDP Query User{8BA37806-A9A7-4308-9755-9D8754C7F25C}E:\tl-wpa281\utility\powerline scan.exe" |In - Private - P17 - TRUE | .(...) -- E:\tl-wpa281\utility\powerline scan.exe (.not file.)
~ Firewall: 260 Legitimates Filtered in 00mn 00s



---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "532E1E0054BA59641A6570138149E94D" . (.HiYo.) -- C:\Windows\Installer\{00E1E235-AB45-4695-A156-073118949ED4}\ARPPRODUCTICON.exe
~ Update Products: 161 Legitimates Filtered in 00mn 00s



---\\ Export de clés de registre aléatoires (O91)
[HKCU\Software\5b558dd1e66deb48\2.6.1519.190\upd]:="upd=1"
[HKCU\Software\5b558dd1e66deb48\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:dllName="BrowserDefender.dll" =>Hijacker.Eazel
[HKCU\Software\5b558dd1e66deb48\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:exeName="BrowserDefender.exe" =>Hijacker.Eazel
[HKCU\Software\5b558dd1e66deb48\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:folderName="BrowserDefender" =>Hijacker.Eazel
[HKCU\Software\5b558dd1e66deb48\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:guid="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}"
[HKCU\Software\5b558dd1e66deb48\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:serviceName="BrowserDefendert" =>Hijacker.Eazel
[HKCU\Software\5b558dd1e66deb48\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:version="2.6.1339.144"
[HKCU\Software\5b558dd1e66deb48]:version="2.6.1519.190"
[HKLM\Software\Wow6432Node\5b558dd1e66deb48]:version="2.6.1519.190"
~ Export Key Software:  Scanned in 00mn 00s



---\\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 08/12/2008 169312 |  (AdobeActiveFileMonitor7.0) . (.Adobe Systems Incorporated.) - c:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
SR - | Auto 11/05/2013 65640 |  (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 21/09/2013 257416 |  (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 30/08/2013 46808 |  (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SS - | Demand 10/07/1658 0 |  (Boonty Games) . (...) - C:\Program Files (x86)\Common Files\BOONTY Shared\Service\Boonty.exe
SS - | Auto 10/07/1658 0 |  (BrowserDefendert) . (...) - C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe =>Hijacker.Eazel
SS - | Demand 05/10/2009 651720 |  (FLEXnet Licensing Service) . (.Macrovision Europe Ltd..) - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
SR - | Auto 29/05/2009 625184 |  (ForceWare Intelligent Application Manager (IAM)) . (...) - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
SR - | Auto 04/06/2009 1150496 |  (Greg_Service) . (.Acer Incorporated.) - C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe
SS - | Auto 29/01/2010 135664 |  (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 29/01/2010 135664 |  (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 15/08/2009 182768 |  (gusvc) . (.Google.) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Demand 01/10/2013 118680 |  (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Demand 28/07/2009 935208 |  (Nero BackItUp Scheduler 4.0) . (.Nero AG.) - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
SR - | Auto 29/05/2009 207904 |  (nSvcIp) . (...) - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
SR - | Auto 03/04/2010 159336 |  (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe
SR - | Auto 08/08/2013 559552 |  (ogmservice) . (.RealNetworks, Inc..) - C:\Program Files (x86)\Online Games Manager\ogmservice.exe
SS - | Auto 29/08/2013 1073160 |  (Orange update Core Service) . (.Orange SA.) - C:\Program Files (x86)\Orange\OrangeUpdate\Service\OUCore.exe
SR - | Auto 14/07/2009 27136 | C:\Windows\system32\HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe
SR - | Auto 10/07/1658 0 |  (PnkBstrA) . (...) - C:\Windows\system32\PnkBstrA.exe
SS - | Auto 13/07/2012 160944 |  (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SR - | Auto 04/07/2009 240160 |  (Updater Service) . (.Acer.) - C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 10/07/1658 0 |  (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe  =>.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services:  Scanned in 00mn 04s



---\\ Scan Additionnel (O88)
Database Version : 12942 - (05/10/2013)
Clés trouvées (Keys found) : 27
Valeurs trouvées (Values found) : 0
Dossiers trouvés  (Folders found) : 2
Fichiers trouvés  (Files found) : 2

[HKLM\SYSTEM\CurrentControlSet\Services\BrowserDefendert]   =>Hijacker.Eazel^
[HKLM\Software\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}]   =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}]   =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]   =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]   =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}]   =>Toolbar.Ask
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A047FE02-C91C-41CB-898C-4ED21B86025A}]   =>Toolbar.Orange
[HKLM\Software\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}]   =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}]   =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}]   =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}]   =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\escort.dll]   =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\escortapp.dll]   =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\escorteng.dll]   =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\esrv.EXE]   =>Toolbar.Babylon
[HKLM\Software\Classes\SearchBar.Client]   =>Toolbar.Agent
[HKLM\Software\Wow6432Node\DataMngr]   =>Adware.Bandoo
[HKLM\Software\Classes\Prod.cap]   =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}]   =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}]   =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1D970ED5-3EDA-438D-BFFD-715931E2775B}]   =>Toolbar.Sorcim
[HKCU\Software\BI]   =>Adware.MegaSearch
[HKLM\Software\Classes\AppID\escorTlbr.DLL]   =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\escort.DLL]   =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\escortApp.DLL]   =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\escortEng.DLL]   =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\escorTlbr.DLL]   =>PUP.Funmoods
C:\ProgramData\Babylon   =>Toolbar.Babylon^
C:\ProgramData\BrowserDefender   =>Hijacker.Eazel^
[HKCU\Software\5b558dd1e66deb48\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:dllName="BrowserDefender.dll"   =>Hijacker.Eazel^
C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe   =>Hijacker.Eazel^
~ Additionnel Scan: 340281 Items scanned in 00mn 28s



---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com/apps/blog/show/27161672-hijacker-eazel   =>Hijacker.Eazel
~ http://nicolascoolman.webs.com/apps/blog/show/27583992-pup-datamngr   =>PUP.Datamngr
~ http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon  =>Toolbar.Babylon
~ http://nicolascoolman.webs.com/apps/blog/show/28927746-toolbar-ask   =>Toolbar.Ask
~ http://nicolascoolman.webs.com/apps/blog/show/26611092-adware-bandoo  =>Adware.Bandoo
~ http://nicolascoolman.webs.com/apps/blog/show/27875657-toolbar-deltasearch   =>Toolbar.DeltaSearch
~ http://nicolascoolman.webs.com/apps/blog/show/26919368-adware-megasearch   =>Adware.MegaSearch
~ http://nicolascoolman.webs.com/apps/blog/show/27630986-pup-funmoods   =>PUP.Funmoods
~ MSI: 8 link(s) detected in 00mn 28s



~ 3453 Legitimates filtered by white list
End of the scan (560 lines in 01mn 24s)(0)