~ Rapport de ZHPDiag v2014.2.17.15 - Nicolas Coolman (17/02/2014) ~ Lancé par marie-laure (19/02/2014 09:08:49) ~ Adresse du Site Web http://nicolascoolman.webs.com ~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/ ~ Traduit par Nicolas Coolman ~ Etat de la version : ~ Liste blanche : Activée par le programme ~ Elévation des Privilèges : OK ~ User Account Control (UAC): Activate by user ---\\ Navigateurs Internet MSIE: Internet Explorer v9.0.8112.16421 GCIE: Google Chrome v32.0.1700.107 (Defaut) ---\\ Informations sur les produits Windows ~ Langage: Français Windows Vista (TM) Home Basic, 32-bit Service Pack 2 (Build 6002) Windows Server License Manager Script : OK ~ Vista, OEM_SLP channel System Locked Preinstallation (OEM_SLP) : OK Windows ID Activation : OK ~ Windows Partial Key : 44MV3 Windows License : OK Windows Automatic Updates : OK ---\\ Logiciels de protection du système avast! Pro Antivirus v9.0.2011 Microsoft Security Client v4.4.0304.0 ---\\ Logiciels d'optimisation du système ---\\ Logiciels de partage PeerToPeer ---\\ Surveillance de Logiciels Adobe Flash Player ActiveX ---\\ Informations sur le système ~ Processor: x86 Family 6 Model 23 Stepping 10, GenuineIntel ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 1975 MB (22% free) System Restore: Activé (Enable) System drive C: has 71 GB (31%) free of 223 GB ---\\ Mode de connexion au système ~ Computer Name: PC-DE-MALOUE ~ User Name: marie-laure ~ All Users Names: McAfeeMVSUser, marie-laure, Administrateur, ~ Unselected Option: None Logged in as Administrator ---\\ Variables d'environnement ~ System Unit : C:\ ~ %AppZHP% : C:\Users\marie-laure\AppData\Roaming\ZHP\ ~ %AppData% : C:\Users\marie-laure\AppData\Roaming\ ~ %Desktop% : C:\Users\marie-laure\Desktop\ ~ %Favorites% : C:\Users\marie-laure\Favorites\ ~ %LocalAppData% : C:\Users\marie-laure\AppData\Local\ ~ %StartMenu% : C:\Users\marie-laure\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\\ Enumération des unités disques C: Hard drive, Flash drive, Thumb drive (Free 71 Go of 223 Go) D: Hard drive, Flash drive, Thumb drive (Free 2 Go of 9 Go) E: CD-ROM drive (Not Inserted) F: Hard drive, Flash drive, Thumb drive (Free 1 Go of 1 Go) ---\\ Etat du Centre de Sécurité Windows [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowMyMusic: Modified [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowMyPics: Modified ~ Security Center: 42 Legitimates Filtered in 00mn 00s ---\\ Recherche particulière de fichiers génériques [MD5.D07D4C3038F3578FFCE1C0237F2A1253] - (.Microsoft Corporation - Explorateur Windows.) (.11/04/2009 - 07:27:36.) -- C:\Windows\Explorer.exe [2926592] [MD5.101BA3EA053480BB5D957EF37C06B5ED] - (.Microsoft Corporation - Application de démarrage de Windows.) (.21/01/2008 - 03:33:13.) -- C:\Windows\System32\Wininit.exe [96768] [MD5.679EAED8E703235BA81AA2E58F4E2D16] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.05/02/2014 - 09:50:39.) -- C:\Windows\System32\wininet.dll [1129472] [MD5.898E7C06A350D4A1A64A9EA264D55452] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.11/04/2009 - 07:28:13.) -- C:\Windows\System32\Winlogon.exe [314368] [MD5.3911B972B55FEA0478476B2E777B29FA] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.21/04/2011 - 14:58:27.) -- C:\Windows\system32\Drivers\AFD.sys [273408] [MD5.2D9C903DC76A66813D350A562DE40ED9] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.21/01/2008 - 03:32:21.) -- C:\Windows\system32\Drivers\atapi.sys [21560] [MD5.7ADD03E75BEB9E6DD102C3081D29840A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.21/01/2008 - 03:33:23.) -- C:\Windows\system32\Drivers\Cdfs.sys [70144] [MD5.6B4BFFB9BECD728097024276430DB314] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.11/04/2009 - 05:39:17.) -- C:\Windows\system32\Drivers\Cdrom.sys [67072] [MD5.622C41A07CA7E6DD91770F50D532CB6C] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.14/04/2011 - 15:59:03.) -- C:\Windows\system32\Drivers\DfsC.sys [75264] [MD5.062452B7FFD68C8C042A6261FE8DFF4A] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.11/04/2009 - 05:42:42.) -- C:\Windows\system32\Drivers\HDAudBus.sys [561152] [MD5.22D56C8184586B7A1F6FA60BE5F5A2BD] - (.Microsoft Corporation - Pilote de port i8042.) (.21/01/2008 - 03:32:45.) -- C:\Windows\system32\Drivers\i8042prt.sys [54784] [MD5.8793643A67B42CEC66490B2A0CF92D68] - (.Microsoft Corporation - IP Network Address Translator.) (.21/01/2008 - 03:34:06.) -- C:\Windows\system32\Drivers\IpNat.sys [100864] [MD5.1E94971C4B446AB2290DEB71D01CF0C2] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.29/04/2011 - 14:24:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [106496] [MD5.ECD64230A59CBD93C85F1CD1CAB9F3F6] - (.Microsoft Corporation - MBT Transport driver.) (.11/04/2009 - 05:45:37.) -- C:\Windows\system32\Drivers\netBT.sys [185856] [MD5.2C1121F2B87E9A6B12485DF53CD848C7] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.03/03/2013 - 20:07:52.) -- C:\Windows\system32\Drivers\ntfs.sys [1082232] [MD5.8A79FDF04A73428597E2CAF9D0D67850] - (.Microsoft Corporation - Pilote de port parallèle.) (.21/01/2008 - 03:32:22.) -- C:\Windows\system32\Drivers\Parport.sys [79360] [MD5.A214ADBAF4CB47DD2728859EF31F26B0] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/01/2008 - 03:34:44.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [76288] [MD5.FBC0BACD9C3D7F6956853F64A66E252D] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.21/01/2008 - 03:32:22.) -- C:\Windows\system32\Drivers\rdpdr.sys [248832] [MD5.7B75299A4D201D6A6533603D6914AB04] - (.Microsoft Corporation - SMB Transport driver.) (.11/04/2009 - 05:45:22.) -- C:\Windows\system32\Drivers\smb.sys [66560] [MD5.76B06EB8A01FC8624D699E7045303E54] - (.Microsoft Corporation - TDI Translation Driver.) (.11/04/2009 - 05:45:56.) -- C:\Windows\system32\Drivers\tdx.sys [72192] [MD5.786DB5771F05EF300390399F626BF30A] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/08/2012 - 12:47:42.) -- C:\Windows\system32\Drivers\volsnap.sys [224640] ~ Generic Processes: Scanned in 00mn 01s ---\\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 1/2 ~ Mes musiques (My Musics) : 1/3 ~ Mes Videos (My Videos) : 1/2 ~ Mes Favoris (My Favorites) : 1/20 ~ Mes Documents (My Documents) : 4/15 ~ Mon Bureau (My Desktop) : 8/584 ~ Menu demarrer (Programs) : 1/25 ~ Hidden Files: Scanned in 00mn 02s ---\\ Processus lancés [MD5.AD90DDBF37F0735FE0D2E1F6FA623814] - (.McAfee, Inc. - myAgtTry Module.) -- C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtTry.exe [271680] [PID.4024] [MD5.7EAB127C64AAAA9134283C0FEA7177D1] - (.Bioscrypt Inc. - Global Virtual Card Host.) -- c:\Program Files\Hewlett-Packard\IAM\Bin\AsGHost.exe [65296] [PID.536] [MD5.66B24E2EB8F8A8340F238A346F231C79] - (.Intel Corporation - Event Monitor User Notification Tool.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [178712] [PID.5456] [MD5.85C1D3EE666A4A2B8071A570227A68A1] - (.ActivIdentity - ActivIdentity card event handler.) -- C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe [293168] [PID.4296] [MD5.5C6EB59CE1E494A46AA7B61BB0958432] - (.Hewlett-Packard Development Company, L.P. - HP ProtectTools Security Manager.) -- C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe [238984] [PID.2624] [MD5.8CB896C573FD15AE8B13180DA53E93D2] - (.Hewlett-Packard Development Company, L.P. - HPWAMain Module.) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [488752] [PID.1264] [MD5.8D07F0687318214A3CEF62EA1048D101] - (.Hewlett-Packard Development Company, L.P. - Module to process WiFi messages..) -- C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.exe [316720] [PID.5196] [MD5.2562EA6C84097C2529C4E0D1ABE6A2FB] - (...) -- C:\Program Files\SiteAdvisor\6173\SiteAdv.exe [36640] [PID.2832] [MD5.E32453D5293DC1CA34A81561C21782CA] - (.Hewlett-Packard - File Sanitizer for HP ProtectTools.) -- C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe [10244096] [PID.2960] [MD5.443ADA6FE624132C76D3CBF47F371D7C] - (. Hewlett-Packard Development Company, L.P. - Quick Launch Buttons.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe [177456] [PID.3420] [MD5.9F37F219528DD026DCB195F653469DF0] - (.Analog Devices, Inc. - SoundMAX Audio Settings (32-bit).) -- C:\Program Files\Analog Devices\SoundMAX\SoundMAX.exe [3842048] [PID.3544] [MD5.2620ABCC3ADC019520EFC131C82EA036] - (.Intel Corporation - igfxTray Module.) -- C:\Windows\System32\igfxtray.exe [150040] [PID.5204] [MD5.D3DD48B59263881BCE0344E503B379A5] - (.Intel Corporation - hkcmd Module.) -- C:\Windows\System32\hkcmd.exe [170520] [PID.5292] [MD5.3362CDE3C884A9F8D9626C632BA1A62F] - (.Intel Corporation - persistence Module.) -- C:\Windows\System32\igfxpers.exe [145944] [PID.4208] [MD5.1EDC4865C8003A0251956835273904B1] - (.Pas de propriétaire - HpqToaster Module.) -- C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe [685360] [PID.4116] [MD5.C637FC4638A96165256B28D38DE7B953] - (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files\HP\HP Software Update\hpwuschd2.exe [49208] [PID.1120] [MD5.B77081F8221968C7DAB794B0BA55C43E] - (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe [254896] [PID.460] [MD5.AFEBF9E0B223FF04709F747C172D3540] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024] [PID.5696] [MD5.6438FF6F59D64E97E862F90AB66B7996] - (.Analog Devices, Inc. - SMax4PNP.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe [1314816] [PID.4760] [MD5.58920E6A409046BA06548D9D139CE0F0] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe [20584608] [PID.5912] [MD5.A9D6FD155C4143242BA1FEAFE54129A7] - (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\System32\spool\drivers\w32x86\3\E_TATIIVE.exe [249440] [PID.4872] [MD5.22209643E16EB086B4E2D070E2C1789A] - (.Intel Corporation - igfxsrvc Module.) -- C:\windows\system32\igfxsrvc.exe [256536] [PID.4772] [MD5.E433210DD9F9EF43D4D170E52FFFF116] - (.Microsoft Corporation - Microsoft Word.) -- C:\Program Files\Microsoft Office\Office14\WINWORD.exe [1423008] [PID.4436] [MD5.FECB438F7ABEA262C9633616CBD8CFDF] - (.ActivIdentity - ActivIdentity Event Service.) -- c:\Program Files\ActivIdentity\ActivClient\acevents.exe [95024] [PID.2504] [MD5.91C7B7340109693219CE5BCDA1B8CCAC] - (. Hewlett-Packard Development Company, L.P. - Volume related element.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe [91440] [PID.2376] [MD5.A6430C0A0E1AAE273AA8F1BD1F341A36] - (.Sun Microsystems, Inc. - Java(TM) Update Checker.) -- C:\Program Files\Common Files\Java\Java Update\jucheck.exe [508336] [PID.6348] [MD5.4B96654025B28EEB1E5D8F001E5D1B8A] - (.APN - Ask Toolbar Notifier.) -- C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1758160] [PID.5484] =>Toolbar.Ask [MD5.5640B4C10682FBC39C86C8C7A8392B5E] - (.Google Inc. - Google Chrome.) -- C:\Users\marie-laure\AppData\Local\Google\Chrome\Application\chrome.exe [866632] [PID.1876] [MD5.AB44884BC129FC04D75A4649E0710203] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8338432] [PID.5724] [MD5.6080A176D09435FC8E6E800996656E18] - (.Microsoft Corporation - Console IME.) -- C:\windows\system32\conime.exe [69120] [PID.7116] [MD5.EF55CD76A05A0675FE930036B7773943] - (.Hewlett-Packard - File Sanitizer for HP ProtectTools.) -- C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe [77824] [PID.1024] [MD5.EB734EF9D7C4D02760F2D1342331BA41] - (.SafeBoot International - Drive Encryption for HP ProtectTools Servic.) -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [256512] [PID.1052] [MD5.B0F49DA36F30922F5DDC3B623B778FCE] - (.Microsoft Corporation - Antimalware Service Executable.) -- c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208] [PID.1132] [MD5.862BB4CBC05D80C5B45BE430E5EF872F] - (.Microsoft Corporation - Service de gestion des licences Microsoft.) -- C:\windows\system32\SLsvc.exe [3408896] [PID.1492] [MD5.3E940775A4970410F094E428BA94BBB7] - (.Hewlett-Packard Corporation - HpService.) -- C:\windows\system32\Hpservice.exe [24936] [PID.1664] [MD5.D74884939D53612FD84AC82C59CCFE27] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344] [PID.1920] [MD5.23C3A0680042C0D1DE1F360F8B62BC57] - (.Microsoft Corporation - Infrastructure d'extensibilité pour les ser.) -- C:\windows\system32\WLANExt.exe [74240] [PID.1928] [MD5.EC4A5D4E36A8E49261CD823450E0BA51] - (.ActivIdentity - ActivIdentity Cache Server.) -- c:\Program Files\ActivIdentity\ActivClient\accoca.exe [182576] [PID.2240] [MD5.585F5793BB5D79C8754EE63BCBAF2B3A] - (.Andrea Electronics Corporation - Andrea filters APO access service (32-bit).) -- C:\windows\system32\AEADISRV.exe [86016] [PID.2284] [MD5.8ED60797908FD394EEE0D6949F493224] - (.Agere Systems - Agere Soft Modem Call Progress Service.) -- C:\Windows\system32\agrsmsvc.exe [12800] [PID.2320] [MD5.EDC243EF33F8DA2A1A499331891D9472] - (.McAfee, Inc. - Common Shell3 - Scanners' interface to the.) -- C:\Program Files\McAfee\Managed VirusScan\VScan\EngineServer.exe [13632] [PID.0] [MD5.E9EFCB47B90FD5498695BB7FEFD36CAE] - (.Seiko Epson Corporation - Epson Scanner Service (32bit).) -- C:\windows\system32\EscSvc.exe [122000] [PID.2520] [MD5.07A85D6C053A0999FF450BBCA9825FB2] - (.Hewlett-Packard Development Company, L.P - PTChangeFilterService.) -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [34184] [PID.2552] [MD5.3AD7614C487C948ADD435662265750FB] - (.Intel Corporation - RAID Monitor.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [354840] [PID.2684] [MD5.213822072085B5BBAD9AF30AB577D817] - (.InterVideo - RegMgr Module.) -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe [112152] [PID.2712] [MD5.C215E09622118383B236DD56C2065183] - (.Hewlett-Packard Company - LightScribe Service.) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728] [PID.2740] [MD5.38BCCF016B694A745E1CDBC0B080A59C] - (.McAfee, Inc. - McAfee HackerWatch Service.) -- C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe [540776] [PID.2788] [MD5.7869AE9E3533D5A6F006E7B97F5FB991] - (.McAfee, Inc. - McAfee Personal Firewall Service.) -- C:\Program Files\McAfee\MPF\MPFSrv.exe [841256] [PID.2816] [MD5.9FC13942EDB6DCE2CCE765ADF1041D04] - (.McAfee, Inc. - Managed Services Agent.) -- C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [202048] [PID.2904] [MD5.ACD411DE0A23E5ECBE57FE051CB4CC6E] - (.PDF Complete Inc - Dispatcher.) -- C:\Program Files\PDF Complete\pdfsvc.exe [576024] [PID.3024] [MD5.675C575444AAFD56B4E8A99EF8A570CD] - (.Absolute Software Corp. - rpcnet.) -- C:\windows\system32\rpcnet.exe [69792] [PID.3116] [MD5.BB2FACF58F87C299E823110C7921619C] - (...) -- C:\Program Files\SiteAdvisor\6173\SAService.exe [341280] [PID.3200] [MD5.42D33042371BFB1A7D40834590CAFD30] - (.Microsoft Corporation - Microsoft Network Realtime Inspection Servi.) -- c:\Program Files\Microsoft Security Client\NisSrv.exe [280288] [PID.3720] [MD5.1665C7121A026DF10C903DB9BC5E9D43] - (.Hewlett-Packard Development Company, L.P. - hpqwmiex Module.) -- C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe [165192] [PID.3752] [MD5.7795F8CEBC284A426B53F541E538695F] - (.Hewlett-Packard Development Company, L.P. - Com for QLB application.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [193840] [PID.5444] [MD5.358A9CCA612C68EB2F07DDAD4CE1D8D7] - (.Microsoft Corporation - Microsoft Office Software Protection Platfo.) -- C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.exe [4640000] [PID.4204] [MD5.97D9D6A04E3AD9B6C626B9931DB78DBA] - (.Microsoft Corporation - Programme d’installation de modules Windows.) -- C:\windows\servicing\TrustedInstaller.exe [39424] [PID.6880] [MD5.C559672F31ABE6BA7277DD73C4502238] - (.Microsoft Corporation - Installateur Windows®.) -- C:\windows\system32\msiexec.exe [73216] [PID.6648] [MD5.B342CD9AA44E4AE99E2368EBDBC2E17A] - (.APN LLC. - APN Updater.) -- C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352] [PID.4704] =>Toolbar.Ask ~ Processes Running: Scanned in 00mn 21s ---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2) C:\Users\marie-laure\AppData\Local\Google\Chrome\User Data\Default\Preferences G2 - GCE: Preference [User Data\Default] [acjgmgmnpncajnhgckkempkobhlmolef] Quick Cite v.0.0.0.1 (Activé) G2 - GCE: Preference [User Data\Default] [algmakeomkafjglfhpomolfhjppoojff] Pricora v.1.26.179, (Activé) =>Adware.Pricora G2 - GCE: Preference [User Data\Default] [baaifhdfifpfjkpoliebdnkchanhmeil] Hot Hot Burger-HD v.2.3 (Activé) G2 - GCE: Preference [User Data\Default] [bklodekjdjjkfhlaffopemibfjckfime] Ce qui est pour le dner v.4.3 (Activé) G2 - GCE: Preference [User Data\Default] [ceeklmjonlihhnkincppdpimdhfhhdho] ESL, Order a Pizza v.1 (Activé) G2 - GCE: Preference [User Data\Default] [chemohaemmfhjpmlgkmkanfpfbkaihop] Plugins v.0.8.0 (Activé) G2 - GCE: Preference [User Data\Default] [ckmoikambnjgjnhaefiklkblfjoolnaf] Jeux classiques v.11 (Activé) G2 - GCE: Preference [User Data\Default] [eahpcpckmhaneflmhiegmedhiegncgnf] Webplayer v.10.26.0.540, (Désactivé) G2 - GCE: Preference [User Data\Default] [eekfgnblmeankckfddegeeokegfhnfkj] Basketball Theme v.1 (Activé) G2 - GCE: Preference [User Data\Default] [eooncjejnppfjjklapaamhcdmjbilmde] Delta Toolbar v.1.4 (Désactivé) =>Toolbar.DeltaSearch G2 - GCE: Preference [User Data\Default] [hnljegjnioppmpieleiegimongopeanj] UNO 3 3D v.1.0.0 (Activé) G2 - GCE: Preference [User Data\Default] [kjfehndjkdkakpofmpkkjddfniaplgdc] Leon de cuisine v.1.0 (Activé) G2 - GCE: Preference [User Data\Default] [klhfgnobmdkblmbdahcnpajbjnfmknpn] Briser le mur v.1.5 (Activé) G2 - GCE: Preference [User Data\Default] [mifnfdmjmiacjganljdegbhmomkdgfmp] Smoothie aux fruits : Cours de cuisine de Sara v.1 (Activé) G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé) G2 - GCE: Preference [User Data\Default] [oiomepakkenneiifjocbinkmmampfbdn] Origami Player v.2.4 (Activé) ~ Google Browser: 25 Legitimates Filtered in 00mn 16s ---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4) R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www1.delta-search.com =>Toolbar.DeltaSearch ~ IE Browser: 13 Legitimates Filtered in 00mn 00s ---\\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl" ~ Keys: Scanned in 00mn 00s ---\\ Hosts file redirection (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 00s ~ Nombre de lignes (Lines number): 20 ---\\ Browser Helper Objects de navigateur (O2) O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} . (...) -- C:\Program Files\SiteAdvisor\6173\SiteAdv.dll O2 - BHO: CrossriderApp0035329 - {11111111-1111-1111-1111-110311531129} . (.Corporate Inc - Pricora BHO.) -- C:\Program Files\Pricora\Pricora-bho.dll =>PUP.CrossRider ~ BHO: 22 Legitimates Filtered in 00mn 01s ---\\ Internet Explorer Toolbars (O3) O3 - Toolbar: McAfee SiteAdvisor - [HKLM]{0BF43445-2F28-4351-9252-17FE6E806AA0} . (...) -- C:\Program Files\SiteAdvisor\6173\SiteAdv.dll O3 - Toolbar: Ask Shopping Toolbar - [HKLM]{D4027C7F-154A-4066-A1AD-4243D8127440} . (.APN LLC. - Passport.) -- C:\Program Files\AskPartnerNetwork\Toolbar\ORJ\Passport.dll =>Toolbar.Ask O3 - Toolbar: avast! Online Security - [HKLM]{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} . (.AVAST Software - IE Webrep plugin.) -- C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll O3 - Toolbar\WebBrowser: (no name) - [HKCU]{D4027C7F-154A-4066-A1AD-4243D8127440} Clé orpheline O3 - Toolbar\WebBrowser: (no name) - [HKCU]{338C5D66-6B92-40A7-A216-9830D2E54103} Clé orpheline ~ Toolbar: Scanned in 00mn 00s ---\\ Autres liens utilisateurs (O4) O4 - GS\Desktop [Public]: EPSON Scan.lnk . (.SEIKO EPSON CORP. - EPSON Scan.) -- C:\Windows\twain_32\escndv\escndv.exe O4 - GS\Desktop [Public]: HP Help and Support.lnk . (.Hewlett-Packard - HPHS Launcher.) -- C:\Windows\Help\OEM\scripts\HPHS_Launcher.exe O4 - GS\Desktop [Public]: InterVideo WinDVD.lnk . (.InterVideo Inc. - WinDVD MFC Application.) -- C:\Program Files\InterVideo\WinDVD\WinDVD.exe O4 - GS\Program [Public]: HP ProtectTools Security Manager for Administrators.lnk . (.Hewlett-Packard Development Company, L.P. - HP ProtectTools Security manager.) -- C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTAdmin.exe O4 - GS\Program [Public]: HP ProtectTools Security Manager.lnk . (.Hewlett-Packard Development Company, L.P. - HP ProtectTools Security Manager.) -- C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHost.exe O4 - GS\Program [Public]: HP Software Setup.lnk . (.Hewlett-Packard Development Company, L.P. - Application Installer.) -- C:\Swsetup\AppInstl\Setup.exe =>.Hewlett-Packard Co O4 - GS\QuickLaunch [marie-laure]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\marie-laure\AppData\Local\Google\Chrome\Application\chrome.exe O4 - GS\QuickLaunch [marie-laure]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Program [marie-laure]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\SystemTools [marie-laure]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Desktop [marie-laure]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\marie-laure\AppData\Local\Google\Chrome\Application\chrome.exe ~ Global Startup: 52 Legitimates Filtered in 00mn 23s ---\\ Applications lancées au démarrage du sytème (O4) O4 - GS\Startup [Public]: DVD Check.lnk . (.InterVideo Inc. - DVDCheck Application.) -- C:\Program Files\InterVideo\DVD Check\DVDCheck.exe O4 - HKLM\..\Run: [Windows Defender] . (.Microsoft Corporation - Windows Defender User Interface.) -- C:\Program Files\Windows Defender\MSASCui.exe O4 - HKLM\..\Run: [IAAnotif] . (.Intel Corporation - Event Monitor User Notification Tool.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [accrdsub] . (.ActivIdentity - ActivIdentity card event handler.) -- c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe O4 - HKLM\..\Run: [PTHOSTTR] . (.Hewlett-Packard Development Company, L.P. - HP ProtectTools Security Manager.) -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.exe O4 - HKLM\..\Run: [CognizanceTS] . (.Bioscrypt Inc. - Terminal Services Virtual Channel Client.) -- C:\Program Files\Hewlett-Packard\IAM\Bin\ASTSVCC.dll O4 - HKLM\..\Run: [hpWirelessAssistant] . (.Hewlett-Packard Development Company, L.P. - HPWAMain Module.) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [HP Health Check Scheduler] . (.Hewlett-Packard - HP Health Check Scheduler.) -- c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe O4 - HKLM\..\Run: [MVS Splash] . (.McAfee, Inc. - Splash Module.) -- C:\Program Files\McAfee\Managed VirusScan\Agent\Splash.exe O4 - HKLM\..\Run: [McAfee Managed Services Tray] . (.McAfee, Inc. - StartmyAgtTry Module.) -- C:\Program Files\McAfee\Managed VirusScan\Agent\StartMyAgtTry.exe O4 - HKLM\..\Run: [SiteAdvisor] . (...) -- C:\Program Files\SiteAdvisor\6173\SiteAdv.exe O4 - HKLM\..\Run: [File Sanitizer] . (.Hewlett-Packard - File Sanitizer for HP ProtectTools.) -- C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe O4 - HKLM\..\Run: [QlbCtrl.exe] . (. Hewlett-Packard Development Company, L.P. - Quick Launch Buttons.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe O4 - HKLM\..\Run: [WatchDog] . (.InterVideo Inc. - DVDCheck Application.) -- C:\Program Files\InterVideo\DVD Check\DVDCheck.exe O4 - HKLM\..\Run: [SoundMAX] . (.Analog Devices, Inc. - SoundMAX Audio Settings (32-bit).) -- C:\Program Files\Analog Devices\SoundMAX\soundmax.exe O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\windows\system32\igfxpers.exe O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe O4 - HKLM\..\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe =>.Hewlett-Packard Co O4 - HKLM\..\Run: [BCSSync] . (.Microsoft Corporation - Microsoft Office 2010 component.) -- C:\Program Files\Microsoft Office\Office14\BCSSync.exe =>.Microsoft Corporation O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation O4 - HKLM\..\Run: [PDF Complete] . (.PDF Complete Inc - Sentry for PDF.) -- C:\Program Files\PDF Complete\pdfsty.exe =>.PDF Complete Inc O4 - HKLM\..\Run: [AvastUI.exe] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe O4 - HKLM\..\Run: [SoundMAXPnP] . (.Analog Devices, Inc. - SMax4PNP.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [ApnTBMon] . (.APN - Ask Toolbar Notifier.) -- C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe =>Toolbar.Ask O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation O4 - HKCU\..\Run: [WindowsWelcomeCenter] Clé orpheline O4 - HKCU\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\marie-laure\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe =>.Skype Technologies S.A. O4 - HKCU\..\Run: [EPLTarget\P0000000000000001] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\windows\system32\spool\DRIVERS\W32X86\3\E_TATIIVE.exe =>.Epson Seiko Corporation O4 - HKCU\..\Run: [WMPNSCFG] . (.Microsoft Corporation - Application de configuration du service Par.) -- C:\Program Files\Windows Media Player\WMPNSCFG.exe =>.Microsoft Corporation O4 - HKCU\..\Run: [EPLTarget\P0000000000000002] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\windows\system32\spool\DRIVERS\W32X86\3\E_TATIIVE.exe =>.Epson Seiko Corporation O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] . (.Adobe Systems, Inc. - Adobe Flash Player Helper 9.0 r124.) -- C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe =>.Adobe Systems Incorporated O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] Clé orpheline O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] Clé orpheline O4 - HKUS\S-1-5-21-1038042192-3592090317-4097671706-1004\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-21-1038042192-3592090317-4097671706-1004\..\Run: [WindowsWelcomeCenter] Clé orpheline O4 - HKUS\S-1-5-21-1038042192-3592090317-4097671706-1004\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe O4 - HKUS\S-1-5-21-1038042192-3592090317-4097671706-1004\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\marie-laure\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc O4 - HKUS\S-1-5-21-1038042192-3592090317-4097671706-1004\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe =>.Skype Technologies S.A. O4 - HKUS\S-1-5-21-1038042192-3592090317-4097671706-1004\..\Run: [EPLTarget\P0000000000000001] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\windows\system32\spool\DRIVERS\W32X86\3\E_TATIIVE.exe =>.Epson Seiko Corporation O4 - HKUS\S-1-5-21-1038042192-3592090317-4097671706-1004\..\Run: [WMPNSCFG] . (.Microsoft Corporation - Application de configuration du service Par.) -- C:\Program Files\Windows Media Player\WMPNSCFG.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-21-1038042192-3592090317-4097671706-1004\..\Run: [EPLTarget\P0000000000000002] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\windows\system32\spool\DRIVERS\W32X86\3\E_TATIIVE.exe =>.Epson Seiko Corporation O4 - HKUS\S-1-5-21-1038042192-3592090317-4097671706-1004\..\RunOnce: [FlashPlayerUpdate] . (.Adobe Systems, Inc. - Adobe Flash Player Helper 9.0 r124.) -- C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe =>.Adobe Systems Incorporated ~ Application: Scanned in 00mn 00s ---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office14\ONBttnIE.dll =>.Microsoft Corporation O9 - Extra button: Notes &liées OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office14\ONBTTN~1.dll =>.Microsoft Corporation ~ IE Extra Buttons: Scanned in 00mn 00s ---\\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{1884168C-FA6A-4289-98F6-F8A2F17B2814}: DhcpNameServer = 88.86.225.214 88.86.225.218 O17 - HKLM\System\CS1\Services\Tcpip\..\{1884168C-FA6A-4289-98F6-F8A2F17B2814}: DhcpNameServer = 88.86.225.214 88.86.225.218 O17 - HKLM\System\CS2\Services\Tcpip\..\{1884168C-FA6A-4289-98F6-F8A2F17B2814}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CS3\Services\Tcpip\..\{1884168C-FA6A-4289-98F6-F8A2F17B2814}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 88.86.225.214 88.86.225.218 ~ Domain: Scanned in 00mn 00s ---\\ Protocole additionnel (O18) O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\system32\mshtml.dll =>.Microsoft Corporation O18 - Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation ~ Protocole Additionnel: Scanned in 00mn 00s ---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll ~ Winlogon: Scanned in 00mn 00s ---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - AppInit_DLLs: . (.Bioscrypt Inc. - Application Protection Hook.) - C:\Windows\System32\apshook.dll ~ AppInit DLL: Scanned in 00mn 00s ---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22) O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\Windows\System32\browseui.dll ~ STS/SSO: Scanned in 00mn 00s ---\\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: Service de mise à jour Ask (APNMCP) . (.APN LLC. - APN Updater.) - C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe =>Toolbar.Ask O23 - Service: SiteAdvisor Service (SiteAdvisor Service) . (...) - C:\Program Files\SiteAdvisor\6173\SAService.exe O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files\Skype\Updater\Updater.exe ~ Services: 22 Legitimates Filtered in 00mn 11s ---\\ Tâches planifiées en automatique (O39) O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-chromeinstaller.job [1860] =>Adware.Pricora O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-codedownloader.job [1174] =>Adware.Pricora O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Pricora-enabler.job [1074] =>Adware.Pricora [MD5.59BE5C8AD4758A4405E13BCE1D3BE665] [APT] [Pricora-chromeinstaller] (.Corporate Inc.) -- C:\Program Files\Pricora\Pricora-chromeinstaller.exe [460800] =>Adware.Pricora [MD5.DAA7EAAEEB67125192A16FCCE7EEDD9D] [APT] [Pricora-codedownloader] (.Corporate Inc.) -- C:\Program Files\Pricora\Pricora-codedownloader.exe [476672] =>Adware.Pricora [MD5.1696645FDB0519682C3D79DACA321A71] [APT] [Pricora-enabler] (.Corporate Inc.) -- C:\Program Files\Pricora\Pricora-enabler.exe [342528] =>Adware.Pricora ~ Scheduled Task: 26 Legitimates Filtered in 00mn 05s ---\\ Pilotes lancés au démarrage du système (O41) O41 - Driver: (dpjrchhi) . (. - .) - C:\windows\system32\drivers\dpjrchhi.sys (.not file.) O41 - Driver: (oxndmuwd) . (. - .) - C:\windows\system32\drivers\oxndmuwd.sys (.not file.) O41 - Driver: (rhijvavs) . (. - .) - C:\windows\system32\drivers\rhijvavs.sys (.not file.) O41 - Driver: (vilgwyzq) . (. - .) - C:\windows\system32\drivers\vilgwyzq.sys (.not file.) ~ Drivers: 112 Legitimates Filtered in 00mn 51s ---\\ Logiciels installés (O42) O42 - Logiciel: Ask Shopping Toolbar - (.APN, LLC.) [HKLM] -- {4F524A00-6A76-A76A-76A7-A758B70C0A03} O42 - Logiciel: Pricora - (.Corporate Inc.) [HKLM] -- Pricora =>Adware.Pricora ~ Logic: 19 Legitimates Filtered in 00mn 01s ---\\ HKCU & HKLM Software Keys [HKCU\Software\AskPartnerNetwork] [HKCU\Software\BabSolution] =>Hijacker.BabSolution [HKCU\Software\Conduit] =>Toolbar.Conduit [HKCU\Software\DataMngr] =>PUP.Datamngr [HKCU\Software\DataMngr_Toolbar] =>PUP.Datamngr [HKCU\Software\Delta] [HKCU\Software\InstalledBrowserExtensions] =>Adware.VidSaver [HKCU\Software\Softonic] =>Toolbar.Conduit [HKCU\Software\d538cdab238e946] =>Hijacker.Hijacker.Eazel [HKLM\Software\ActivCard] [HKLM\Software\AskPartnerNetwork] [HKLM\Software\Babylon] =>PUP.Babylon [HKLM\Software\Conduit] =>Toolbar.Conduit [HKLM\Software\DataMngr] =>PUP.Datamngr [HKLM\Software\Delta] [HKLM\Software\GSC] [HKLM\Software\d538cdab238e946] =>Hijacker.Hijacker.Eazel ~ Key Software: 231 Legitimates Filtered in 00mn 01s ---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 19/02/2014 - 09:07:49 - [10,289] ----D C:\Program Files\AskPartnerNetwork O43 - CFD: 12/05/2012 - 00:10:50 - [0,609] ----D C:\Program Files\Conduit O43 - CFD: 12/01/2014 - 12:25:31 - [5,440] ----D C:\Program Files\Pricora =>Adware.Pricora O43 - CFD: 19/02/2014 - 09:07:10 - [0] ----D C:\ProgramData\APN O43 - CFD: 07/05/2012 - 20:49:31 - [0] ----D C:\ProgramData\Ask O43 - CFD: 19/02/2014 - 09:07:49 - [0,682] ----D C:\ProgramData\AskPartnerNetwork O43 - CFD: 12/05/2012 - 00:07:24 - [0] ----D C:\ProgramData\Babylon =>PUP.Babylon O43 - CFD: 12/05/2012 - 00:07:24 - [0,010] ----D C:\Users\marie-laure\AppData\Roaming\Babylon =>PUP.Babylon O43 - CFD: 10/01/2014 - 15:50:04 - [0,060] ----D C:\Users\marie-laure\AppData\Roaming\File Scout =>PUP.FileScout O43 - CFD: 07/08/2013 - 22:42:17 - [0] ----D C:\Users\marie-laure\AppData\Local\Conduit O43 - CFD: 25/09/2013 - 16:31:29 - [0,001] ----D C:\Users\marie-laure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard =>PUP.BitGuard ~ Program Folder: 144 Legitimates Filtered in 00mn 38s ---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.DE6576CD8B9C6A49E4E8D8D314A82D98] - 14/02/2014 - 16:53:51 ---A- . (...) -- C:\Windows\win.ini [219] O44 - LFC:[MD5.C14731D94AF1EF0CAB3DA53BDF8710E1] - 19/02/2014 - 08:31:40 ---A- . (...) -- C:\Windows\System32\rpcnetp.exe [17408] ~ Files: 25 Legitimates Filtered in 00mn 25s ---\\ Derniers fichiers créés dans Windows Prefetcher (O45) O45 - LFCP:[MD5.16AF3D71E16E7CBDCD0811860D2DF5AD] - 17/02/2014 - 09:40:25 ---A- - C:\Windows\Prefetch\HTMLDLG.EXE-B0FB3D2C.pf O45 - LFCP:[MD5.32C5C2B8226516500995E227029120B3] - 17/02/2014 - 11:58:50 ---A- - C:\Windows\Prefetch\VOLCTRL.EXE-9FD8FEC6.pf O45 - LFCP:[MD5.9CCF70D19CF6E14A4E3EE3FE852CD0FC] - 17/02/2014 - 11:58:57 ---A- - C:\Windows\Prefetch\QLBPRESOV.EXE-E019976E.pf O45 - LFCP:[MD5.F245D736DFFBA3B1B66A5EC294277A64] - 17/02/2014 - 11:59:29 ---A- - C:\Windows\Prefetch\ACEVENTS.EXE-F0DD1715.pf O45 - LFCP:[MD5.4F25C51AB108C5DACDC5758B5926188F] - 17/02/2014 - 12:00:43 ---A- - C:\Windows\Prefetch\MYAGTTRY.EXE-2E033F35.pf O45 - LFCP:[MD5.ED6467573D350AC5D10A18970F28459A] - 19/02/2014 - 08:37:50 ---A- - C:\Windows\Prefetch\PRICORA-ENABLER.EXE-B515EA7F.pf =>Adware.Pricora O45 - LFCP:[MD5.712C696DBD3F176D2303AB460F65FF89] - 19/02/2014 - 08:37:57 ---A- - C:\Windows\Prefetch\INSTUP.EXE-20062FAA.pf O45 - LFCP:[MD5.804F648BE5CF09342BEA400754DC56F0] - 19/02/2014 - 08:38:20 ---A- - C:\Windows\Prefetch\EPSDNAVI.EXE-62F0A00E.pf O45 - LFCP:[MD5.632E10F7280D38AF168CDEA7FBB81FBD] - 19/02/2014 - 08:57:25 ---A- - C:\Windows\Prefetch\PRICORA-BG.EXE-6C355A67.pf =>Adware.Pricora O45 - LFCP:[MD5.D0E5CE0C2CBA4BCD5AA5A347585B86BF] - 19/02/2014 - 09:08:05 ---A- - C:\Windows\Prefetch\APNMCP.EXE-E6A53660.pf O45 - LFCP:[MD5.A64143055FA938F3839A20ED8BE29D5E] - 19/02/2014 - 09:08:07 ---A- - C:\Windows\Prefetch\TBNOTIFIER.EXE-71D9D038.pf ~ Prefetcher: 140 Legitimates Filtered in 00mn 03s ---\\ Opérations et fonctions au démarrage de Windows Explorer (O46) O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL ~ ShellExecuteHooks: Scanned in 00mn 00s ---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55) O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 ~ MWPS: 16 Legitimates Filtered in 00mn 00s ---\\ Liste des pilotes du système (SDL) (O58) O58 - SDL:[MD5.364A903711E84EB1386FA04106681B7A] - 11/04/2008 - 15:38:44 ---A- . (.Analog Devices, Inc. - High Definition Audio Function Driver.) -- C:\Windows\System32\Drivers\ADIHdAud.sys [382464] O58 - SDL:[MD5.F385467DF95D0A73775CB3B076B8B969] - 10/01/2014 - 11:01:04 ---A- . (...) -- C:\Windows\System32\Drivers\aswRvrt.sys [49944] O58 - SDL:[MD5.1B0662514A68C3A42E60D240C5ABEF28] - 10/01/2014 - 11:01:05 ---A- . (...) -- C:\Windows\System32\Drivers\aswVmm.sys [180248] O58 - SDL:[MD5.23B62471681A124889978F6295B3F4C6] - 21/01/2008 - 03:32:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [342584] O58 - SDL:[MD5.BCED60D16156E428F8DF8CF27B0DF150] - 02/11/2006 - 10:50:07 ---A- . (.Integrated Technology Express, Inc. - ITE IT8211 ATA/ATAPI SCSI miniport.) -- C:\Windows\System32\Drivers\iteatapi.sys [35944] O58 - SDL:[MD5.06FA654504A498C30ADCA8BEC4E87E7E] - 02/11/2006 - 10:50:09 ---A- . (.Integrated Technology Express, Inc. - ITE IT8212 ATA RAID SCSI miniport.) -- C:\Windows\System32\Drivers\iteraid.sys [35944] O58 - SDL:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 02/01/1601 - 23:00:00 ---A- . (...) -- C:\Windows\System32\Drivers\SafeBoot.sys [108752] O58 - SDL:[MD5.52DCDE2D1787217E15FFDCA1CBF8CCE9] - 14/05/2008 - 01:36:26 ---A- . (.SafeBoot N.V. - SafeBoot FIPS AES Algorithm (256 bit).) -- C:\Windows\System32\Drivers\SbAlg.sys [51376] O58 - SDL:[MD5.0057F29323C393A35903B4C5DAF9A144] - 10/05/2007 - 05:16:40 ---A- . (.Pas de propriétaire - USBCAMD for Sonix UVC.) -- C:\Windows\System32\Drivers\sncduvc.sys [28160] O58 - SDL:[MD5.CF9CDE12FBC19DBA8DE528B7511A2F4F] - 10/04/2008 - 16:27:34 ---A- . (.Pas de propriétaire - UVC Camera Streaming Driver.) -- C:\Windows\System32\Drivers\snp2uvc.sys [1804160] O58 - SDL:[MD5.9224BB254F591DE4CA8D572A5F0D635C] - 21/01/2008 - 03:32:45 ---A- . (.ULi Electronics Inc. - ULi SATA Controller Driver.) -- C:\Windows\System32\Drivers\uliahci.sys [238648] O58 - SDL:[MD5.8514D0E5CD0534467C5FC61BE94A569F] - 02/11/2006 - 10:50:35 ---A- . (.Promise Technology, Inc. - Promise Ultra/Sata Series Driver for Win2003.) -- C:\Windows\System32\Drivers\ulsata.sys [98408] O58 - SDL:[MD5.38C3C6E62B157A6BC46594FADA45C62B] - 21/01/2008 - 03:32:49 ---A- . (.Promise Technology, Inc. - Promise SATAII150 Series Windows Drivers.) -- C:\Windows\System32\Drivers\ulsata2.sys [115816] O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 02/11/2006 - 08:09:42 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029] O58 - SDL:[MD5.0FE9F16075C9ACB941C957B7C649176E] - 02/11/2006 - 08:09:45 ---A- . (...) -- C:\Windows\System32\country.sys [27097] O58 - SDL:[MD5.E6BC0F98FECEF245A0010D350C1A0B9B] - 02/11/2006 - 08:09:41 ---A- . (...) -- C:\Windows\System32\HIMEM.SYS [4768] O58 - SDL:[MD5.492090267B9608C62B956CD29BE3AFB7] - 02/11/2006 - 08:09:44 ---A- . (...) -- C:\Windows\System32\KEY01.SYS [42809] O58 - SDL:[MD5.FBBCFEC1379C5C02D88A361993EDF1B8] - 02/11/2006 - 08:09:44 ---A- . (...) -- C:\Windows\System32\KEYBOARD.SYS [42537] O58 - SDL:[MD5.FFFF296A08DBF2AC0126C62E3778AC0D] - 02/11/2006 - 08:09:29 ---A- . (...) -- C:\Windows\System32\NTDOS.SYS [27866] O58 - SDL:[MD5.CF9ED169FF86D935E47999E82359E898] - 02/11/2006 - 08:09:35 ---A- . (...) -- C:\Windows\System32\NTDOS404.SYS [29146] O58 - SDL:[MD5.03B945AC0481CD8BB161C3569D8ED1C3] - 02/11/2006 - 08:09:38 ---A- . (...) -- C:\Windows\System32\NTDOS411.SYS [29370] O58 - SDL:[MD5.BBC957DC18C17CC027EB80B7C77F2AEA] - 02/11/2006 - 08:09:40 ---A- . (...) -- C:\Windows\System32\NTDOS412.SYS [29274] O58 - SDL:[MD5.3CFFAEFFF23B0D208214A6D3061A5B1B] - 02/11/2006 - 08:09:31 ---A- . (...) -- C:\Windows\System32\NTDOS804.SYS [29146] O58 - SDL:[MD5.2E4112FB7D1B76E11ADFD7487B5D0E95] - 02/11/2006 - 08:09:20 ---A- . (...) -- C:\Windows\System32\NTIO.SYS [33952] O58 - SDL:[MD5.A98EBD4C2DF983665BF2D1AF49949974] - 02/11/2006 - 08:09:23 ---A- . (...) -- C:\Windows\System32\NTIO404.SYS [34672] O58 - SDL:[MD5.3F7E6406EDEF197C5CAAB2240EEF6F48] - 02/11/2006 - 08:09:24 ---A- . (...) -- C:\Windows\System32\NTIO411.SYS [35776] O58 - SDL:[MD5.3E64D681B776CC57BDC38A46D881F85B] - 02/11/2006 - 08:09:26 ---A- . (...) -- C:\Windows\System32\NTIO412.SYS [35536] O58 - SDL:[MD5.D86B6435729231C171432B4E77801BDB] - 02/11/2006 - 08:09:22 ---A- . (...) -- C:\Windows\System32\NTIO804.SYS [34672] ~ Drivers: 16 Legitimates Filtered in 00mn 05s ---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61) O61 - LFC: 19/02/2014 - 09:13:18 ---A- . (...) -- C:\Users\marie-laure\AppData\Local\Google\Chrome\User Data\Certificate Revocation Lists [269014] O61 - LFC: 19/02/2014 - 09:14:18 ---A- . (...) -- C:\Users\marie-laure\AppData\Local\Google\Chrome\User Data\Local State [60078] O61 - LFC: 19/02/2014 - 09:18:10 ---A- . (...) -- C:\Users\marie-laure\AppData\Roaming\ZHP\Log.txt [21998] =>.Nicolas Coolman O61 - LFC: 19/02/2014 - 09:18:10 ---A- . (...) -- C:\Users\marie-laure\AppData\Roaming\ZHP\TestsZHPDiag.txt [2973] =>.Nicolas Coolman ~ 21 Fichiers temporaires (Temporary files) ~ Files: 207 Legitimates Filtered in 05mn 44s ---\\ Liste des outils de désinfection (LATC) (O63) O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman ~ ADS: Scanned in 00mn 00s ---\\ Associations Shell Spawning (O67) O67 - Shell Spawning: <.com> <>[HKU\..\open\Command] (.Not Key.) O67 - Shell Spawning: <.exe> <>[HKU\..\open\Command] (.Not Key.) ~ FASS Keys: 13 Legitimates Filtered in 00mn 00s ---\\ Menu de démarrage Internet (SMI) (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\marie-laure\AppData\Local\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69) O69 - SBI: SearchScopes [HKCU] {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} - (Delta Search) - http://www1.delta-search.com =>Toolbar.DeltaSearch O69 - SBI: SearchScopes [HKCU] {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} - (Ask Search) - http://www.search.ask.com O69 - SBI: SearchScopes [HKCU] {6F715D10-8717-4CC7-A580-5A752578FD45} - (AOL Recherche) - http://slirsredirect.search.aol.com O69 - SBI: SearchScopes [HKCU] {afdbddaa-5d3f-42ee-b79c-185a7020515b} - (Webplayer Customized Web Search) - http://search.conduit.com ~ Keys: Scanned in 00mn 00s ---\\ Recherche particulière à la racine du système (SPRF) (O84) [MD5.8A3397E3292508FC2B30CDB5437BC98A] [SPRF][03/05/2012] (.SWFBOX - Pas de description.) -- C:\Users\marie-laure\Desktop\80-in-1-best-flash-games_80_in_1_best_flash_games_anglais_253530.exe [31731261] [MD5.4428B8424E14A03769E6419E82D5EA80] [SPRF][20/05/2012] (.Media Player - Codec Pack.) -- C:\Users\marie-laure\Desktop\media.player.codec.pack.v3.9.6.setup.exe [23873711] ~ Files: 2 Legitimates Filtered in 00mn 03s ---\\ Enumère les codes produits des logiciels (PUC) (O90) O90 - PUC: "00A425F467A6A67A677A7A857BC0A030" . (.Ask Shopping Toolbar.) -- C:\windows\Installer\{4F524A00-6A76-A76A-76A7-A758B70C0A03}\ToolbarIcon.exe O90 - PUC: "558491CACA7F40D44B9C70AB64CF6B79" . (.ActivClient 6.1 x86.) -- c:\Windows\Installer\{AC194855-F7AC-4D04-B4C9-07BA46FCB697}\ARPPRODUCTICON.exe O90 - PUC: "9B803B3A69EB433418F6D3281BA9D72E" . (.Software Updater.) -- C:\windows\Installer\{A3B308B9-BE96-4334-816F-3D82B19A7DE2}\icon.ico ~ Update Products: 85 Legitimates Filtered in 00mn 00s ---\\ Export de clés de registre aléatoires (O91) [HKCU\Software\d538cdab238e946\2.6.1673.238\upd]:="upd=1" =>Hijacker.Hijacker.Eazel [HKCU\Software\d538cdab238e946\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:dllName="BrowserDefender.dll" =>Hijacker.Hijacker.Eazel [HKCU\Software\d538cdab238e946\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:exeName="BrowserDefender.exe" =>Hijacker.Hijacker.Eazel [HKCU\Software\d538cdab238e946\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:folderName="BrowserDefender" =>Hijacker.Hijacker.Eazel [HKCU\Software\d538cdab238e946\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:guid="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}" =>Hijacker.Hijacker.Eazel [HKCU\Software\d538cdab238e946\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:serviceName="BrowserDefendert" =>PUA.BrowserDefendert [HKCU\Software\d538cdab238e946\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:version="2.6.1519.190" =>Hijacker.Hijacker.Eazel [HKCU\Software\d538cdab238e946]:version="2.6.1673.238" =>Hijacker.Hijacker.Eazel [HKLM\Software\d538cdab238e946]:version="2.6.1673.238" =>Hijacker.Hijacker.Eazel ~ Export Key Software: Scanned in 00mn 00s ---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS) [MD5.4352657B55319ADD68A38E4E2B256C93] [WIS][10/01/2014] (.Google, Inc. - Google Drive.) -- C:\Windows\Installer\3a6eb9d9.msi [123392] [MD5.2E35A65BECC46B6F1FDC34B6282FE4C4] [WIS][19/02/2014] (.APN, LLC - Ask Shopping Toolbar.) -- C:\Windows\Installer\65b5374.msi [595456] ~ WIS: 86 Legitimates Filtered in 00mn 12s ---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Auto 07/05/2012 136176 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 07/05/2012 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - | Demand 22/10/2004 73728 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe SS - | Demand 29/04/2008 144704 | (McShield) . (.McAfee, Inc..) - C:\Program Files\McAfee\Managed VirusScan\VScan\McShield.exe SS - | Auto 21/01/2008 21504 | C:\windows\system32\HPZinw12.dll (Net Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe SS - | Auto 21/01/2008 21504 | C:\windows\system32\HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe SS - | Demand 08/04/2008 1112560 | (RoxMediaDB10) . (.Sonic Solutions.) - c:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe SS - | Auto 23/10/2013 172192 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe SS - | Demand 24/03/2008 74384 | (stllssvr) . (.MicroVision Development, Inc..) - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe SS - | Auto 21/01/2008 21504 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 16/05/2007 182576 | (accoca) . (.ActivIdentity.) - c:\Program Files\ActivIdentity\ActivClient\accoca.exe SR - | Auto 19/10/2007 86016 | (AEADIFilters) . (.Andrea Electronics Corporation.) - C:\Windows\System32\AEADISRV.exe SR - | Auto 11/12/2007 12800 | (AgereModemAudio) . (.Agere Systems.) - C:\Windows\system32\agrsmsvc.exe SR - | Auto 14/02/2014 166352 | (APNMCP) . (.APN LLC..) - C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe =>Toolbar.Ask SR - | Auto 21/01/2008 21504 | c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll (ASBroker) . (.Bioscrypt Inc..) - C:\Windows\System32\svchost.exe SR - | Auto 21/01/2008 21504 | c:\Program Files\Hewlett-Packard\IAM\Bin\AsChnl.dll (ASChannel) . (.Bioscrypt Inc..) - C:\Windows\System32\svchost.exe SR - | Auto 10/01/2014 50344 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe SR - | Demand 03/04/2008 193840 | (Com4QLBEx) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe SR - | Auto 29/04/2008 13632 | (EngineServer) . (.McAfee, Inc..) - C:\Program Files\McAfee\Managed VirusScan\VScan\EngineServer.exe SR - | Auto 12/12/2011 122000 | (EpsonScanSvc) . (.Seiko Epson Corporation.) - C:\windows\system32\EscSvc.exe SR - | Auto 14/05/2008 34184 | (HP ProtectTools Service) . (.Hewlett-Packard Development Company, L.P.) - c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe SR - | Auto 14/05/2008 256512 | (HpFkCryptService) . (.SafeBoot International.) - c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe SR - | Auto 02/05/2008 77824 | (HPFSService) . (.Hewlett-Packard.) - C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe SR - | Demand 16/04/2008 165192 | (hpqwmiex) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe SR - | Auto 07/04/2008 24936 | (hpsrv) . (.Hewlett-Packard Corporation.) - C:\Windows\System32\Hpservice.exe SR - | Auto 18/04/2008 354840 | (IAANTMON) . (.Intel Corporation.) - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe SR - | Auto 05/01/2007 112152 | (IviRegMgr) . (.InterVideo.) - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe SR - | Auto 18/03/2008 73728 | (LightScribeService) . (.Hewlett-Packard Company.) - C:\Program Files\Common Files\LightScribe\LSSrvc.exe SR - | Auto 13/02/2007 540776 | (McAfee HackerWatch Service) . (.McAfee, Inc..) - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe SR - | Auto 23/05/2007 841256 | (MpfService) . (.McAfee, Inc..) - C:\Program Files\McAfee\MPF\MPFSrv.exe SR - | Auto 23/10/2013 22208 | (MsMpSvc) . (.Microsoft Corporation.) - c:\Program Files\Microsoft Security Client\MsMpEng.exe SR - | Auto 05/05/2008 202048 | (myAgtSvc) . (.McAfee, Inc..) - C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe SR - | Auto 12/05/2008 576024 | (pdfcDispatcher) . (.PDF Complete Inc.) - C:\Program Files\PDF Complete\pdfsvc.exe SR - | Auto 22/04/2013 69792 | (rpcnet) . (.Absolute Software Corp..) - C:\windows\system32\rpcnet.exe SR - | Auto 12/07/2008 341280 | (SiteAdvisor Service) . (...) - C:\Program Files\SiteAdvisor\6173\SAService.exe SR - | Auto 21/01/2008 21504 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe ~ Services: Scanned in 00mn 15s ---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80) Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net ~ MBR: 1 Legitimates Filtered in 00mn 02s ---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80) Written by ad13, http://ad13.geekstog Run by marie-laure at 19/02/2014 09:20:06 ********* Dump file Name ********* C:\PhysicalDisk0_MBR.bin ~ MBR: Scanned in 00mn 04s ---\\ Scan Additionnel (O88) Database Version : 13031 - (17/02/2014) Clés trouvées (Keys found) : 52 Valeurs trouvées (Values found) : 4 Dossiers trouvés (Folders found) : 14 Fichiers trouvés (Files found) : 22 [HKLM\Software\Google\Chrome\Extensions\algmakeomkafjglfhpomolfhjppoojff] =>Adware.Pricora^ [HKLM\Software\Google\Chrome\Extensions\eooncjejnppfjjklapaamhcdmjbilmde] =>Toolbar.DeltaSearch^ [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311531129}] =>PUP.CrossRider^ [HKLM\SYSTEM\CurrentControlSet\Services\APNMCP] =>Toolbar.Ask^ [HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pricora] =>Adware.Pricora^ [HKLM\Software\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}] =>Toolbar.AskTBar [HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9}] =>PUP.Babylon [HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}] =>Toolbar.Ask [HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}] =>Toolbar.Ask [HKLM\Software\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}] =>Adware.iWinArcade [HKLM\Software\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}] =>Toolbar.Ask [HKLM\Software\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}] =>Toolbar.Ask [HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}] =>Toolbar.Ask [HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}] =>Toolbar.Ask [HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}] =>Toolbar.Ask [HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}] =>Toolbar.Ask [HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}] =>Toolbar.Conduit [HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}] =>Toolbar.Conduit [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}] =>Toolbar.Avira [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}] =>Toolbar.Avira [HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}] =>Toolbar.Avira [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}] =>Toolbar.Avira [HKLM\Software\Classes\AppID\GenericAskToolbar.DLL] =>Toolbar.Ask [HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd] =>Toolbar.Ask [HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd.1] =>Toolbar.Ask [HKLM\Software\Classes\S] =>Toolbar.Agent [HKCU\Software\AppDataLow\Software\ConduitSearchScopes] =>Toolbar.Conduit [HKCU\Software\DataMngr] =>Adware.Bandoo [HKLM\Software\DataMngr] =>Adware.Bandoo [HKCU\Software\AppDataLow\Software\PriceGong] =>Adware.PriceGong [HKCU\Software\Softonic] =>Toolbar.Conduit [HKLM\Software\Classes\Prod.cap] =>PUP.Babylon [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings] =>PUP.BProtector [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{338C5D66-6B92-40A7-A216-9830D2E54103}] =>Toolbar.Conduit [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5491DED0-882E-4D5F-A1C8-F1684BFE90E5}] =>Toolbar.Conduit [HKLM\Software\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}] =>Toolbar.DeltaSearch [HKCU\Software\AppDataLow\Software\Crossrider] =>PUP.CrossRider [HKCU\Software\InstalledBrowserExtensions\] =>PUP.CrossRider [HKCU\Software\AskPartnerNetwork] =>Toolbar.Ask [HKLM\Software\AskPartnerNetwork] =>Toolbar.Ask [HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}] =>Adware.SimilarSites [HKLM\Software\Google\Chrome\Extensions\eahpcpckmhaneflmhiegmedhiegncgnf] =>Toolbar.Conduit [HKCU\Software\InstalledBrowserExtensions] =>PUP.CrossRider [HKLM\Software\Classes\CrossriderApp0035329.BHO] =>PUP.CrossRider [HKLM\Software\Classes\CrossriderApp0035329.BHO.1] =>PUP.CrossRider [HKLM\Software\Classes\CrossriderApp0035329.Sandbox] =>PUP.CrossRider [HKLM\Software\Classes\CrossriderApp0035329.Sandbox.1] =>PUP.CrossRider [HKLM\Software\Classes\Toolbar.CT3201760] =>Toolbar.Conduit [HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311531129}] =>PUP.CrossRider [HKLM\Software\Classes\CLSID\{11111111-1111-1111-1111-110311531129}] =>PUP.CrossRider [HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220322532229}] =>PUP.CrossRider [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311531129}] =>PUP.CrossRider [HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{D4027C7F-154A-4066-A1AD-4243D8127440} =>Toolbar.Ask^ [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:ApnTBMon =>Toolbar.Ask^ [HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks]:{00000000-6E41-4FD3-8538-502F5495E5FC} =>Adware.ShopperReports [HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]:{D4027C7F-154A-4066-A1AD-4243D8127440} =>Toolbar.Avira C:\Users\marie-laure\AppData\Local\Google\Chrome\User Data\Default\Extensions\algmakeomkafjglfhpomolfhjppoojff =>Adware.Pricora^ C:\Users\marie-laure\AppData\Local\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde =>Toolbar.DeltaSearch^ C:\Program Files\Pricora =>Adware.Pricora^ C:\ProgramData\Babylon =>PUP.Babylon^ C:\Users\marie-laure\AppData\Roaming\Babylon =>PUP.Babylon^ C:\Users\marie-laure\AppData\Roaming\File Scout =>PUP.FileScout^ C:\Users\marie-laure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard =>PUP.BitGuard^ C:\Program Files\Conduit =>Toolbar.Conduit C:\Program Files\AskPartnerNetwork =>Toolbar.Ask C:\ProgramData\AskPartnerNetwork =>Toolbar.Ask C:\Users\marie-laure\AppData\Roaming\WebPlayerBdd =>Adware.SocialSkinz C:\Users\marie-laure\AppData\Local\Conduit =>Toolbar.Conduit C:\Users\marie-laure\AppData\LocalLow\Conduit =>Toolbar.Conduit C:\Users\marie-laure\AppData\LocalLow\PriceGong =>Adware.PriceGong C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe =>Toolbar.Ask^ C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe =>Toolbar.Ask^ C:\Windows\Tasks\Pricora-chromeinstaller.job =>Adware.Pricora^ C:\Windows\Tasks\Pricora-codedownloader.job =>Adware.Pricora^ C:\Windows\Tasks\Pricora-enabler.job =>Adware.Pricora^ C:\Program Files\Pricora\Pricora-chromeinstaller.exe =>Adware.Pricora^ C:\Program Files\Pricora\Pricora-codedownloader.exe =>Adware.Pricora^ C:\Program Files\Pricora\Pricora-enabler.exe =>Adware.Pricora^ [HKCU\Software\BabSolution] =>Hijacker.BabSolution^ [HKCU\Software\Conduit] =>Toolbar.Conduit^ [HKCU\Software\DataMngr_Toolbar] =>PUP.Datamngr^ [HKLM\Software\Babylon] =>PUP.Babylon^ [HKLM\Software\Conduit] =>Toolbar.Conduit^ [HKCU\Software\d538cdab238e946\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:dllName="BrowserDefender.dll" =>Hijacker.Hijacker.Eazel^ C:\Users\marie-laure\AppData\Local\Temp\uninst1.exe =>PUP.Babylon C:\Users\marie-laure\AppData\Local\Temp\MyBabylonTB.exe =>PUP.SweetIM C:\Users\marie-laure\AppData\Local\Temp\conduitinstaller.exe =>Toolbar.Conduit C:\Users\marie-laure\AppData\Local\Temp\tbWeb0.dll =>Toolbar.Conduit ~ Additionnel Scan: 309888 Items scanned in 01mn 09s ---\\ Récapitulatif des détections trouvées sur votre station ~ http://nicolascoolman.webs.com/apps/blog/show/28927746-toolbar-ask =>Toolbar.Ask ~ http://nicolascoolman.webs.com/apps/blog/show/29294184-adware-pricora =>Adware.Pricora ~ http://nicolascoolman.webs.com/apps/blog/show/27875657-toolbar-deltasearch =>Toolbar.DeltaSearch ~ http://nicolascoolman.webs.com/apps/blog/show/27583526-pup-crossrider =>PUP.CrossRider ~ http://nicolascoolman.webs.com/apps/blog/show/26678994-hijacker-babsolution =>Hijacker.BabSolution ~ http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit ~ http://nicolascoolman.webs.com/apps/blog/show/27583992-pup-datamngr =>PUP.Datamngr ~ http://nicolascoolman.webs.com/apps/blog/show/27557062-adware-vidsaver =>Adware.VidSaver ~ http://nicolascoolman.webs.com/apps/blog/show/27161672-hijacker-eazel =>Hijacker.Eazel ~ http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon =>PUP.Babylon ~ http://nicolascoolman.webs.com/apps/blog/show/34311830-pup-filescout =>PUP.FileScout ~ http://nicolascoolman.webs.com/apps/blog/show/32979753-pup-bitguard =>PUP.BitGuard ~ http://nicolascoolman.webs.com/apps/blog/show/35127313-pua-browserdefendert =>PUA.BrowserDefendert ~ http://nicolascoolman.webs.com/apps/blog/show/28766471-adware-iwinarcade =>Adware.iWinArcade ~ http://nicolascoolman.webs.com/apps/blog/show/26611092-adware-bandoo =>Adware.Bandoo ~ http://nicolascoolman.webs.com/apps/blog/show/26666995-adware-pricegong =>Adware.PriceGong ~ http://nicolascoolman.webs.com/apps/blog/show/28133096-pup-bprotector =>PUP.BProtector ~ http://nicolascoolman.webs.com/apps/blog/show/29344956-adware-similarsites =>Adware.SimilarSites ~ http://nicolascoolman.webs.com/apps/blog/show/27480243-adware-socialskinz =>Adware.SocialSkinz ~ http://nicolascoolman.webs.com/apps/blog/show/29216159-pup-sweetim =>PUP.SweetIM ~ MSI: 20 link(s) detected in 01mn 10s ~ 1453 Legitimates filtered by white list End of the scan (764 lines in 12mn 29s)(0)