~ Rapport de ZHPDiag v2014.7.9.103 - Nicolas Coolman (09/07/2014) ~ Lancé par jo (12/07/2014 08:41:19) ~ Adresse du Site Web http://nicolascoolman.fr ~ Adresse du Forum http://forum.nicolascoolman.fr ~ Traduit par Nicolas Coolman ~ Etat de la version : Version à jour. ~ Liste blanche : Activée par le programme ~ Elévation des Privilèges : OK ~ User Account Control (UAC): Activate by user ---\\ Navigateurs Internet MSIE: Internet Explorer v10.0.9200.17028 MFIE: Mozilla Firefox 30.0 (Defaut) ---\\ Informations sur les produits Windows ~ Langage: Français Windows 8 Pro, 64-bit (Build 9200) Windows Server License Manager Script : OK ~ Windows(R) Operating System, VOLUME_KMSCLIENT channel Windows ID Activation : OK ~ Windows Partial Key : J8CK4 Windows License : OK ~ Windows Remaining Initializations Number : 1000 Software Protection Service (Protection logicielle) : OK Windows Automatic Updates : OK Windows Activation Technologies : OK ---\\ Logiciels de protection du système Bitdefender Internet Security v17.25.0.1074 Malwarebytes Anti-Malware version 2.0.2.1012 Windows Defender W8 (Deactivate) ---\\ Logiciels d'optimisation du système CCleaner v4.15 ---\\ Logiciels de partage PeerToPeer ---\\ Surveillance de Logiciels Adobe Flash Player 14 Plugin Adobe Reader XI Java 7 Update 55 ---\\ Informations sur le système ~ Processor: Intel64 Family 6 Model 23 Stepping 10, GenuineIntel ~ Operating System: 64 Bits Boot mode: Normal (Normal boot) Total RAM: 4095 MB (47% free) System Restore: Activé (Enable) System drive C: has 80 GB (54%) free of 147 GB ---\\ Mode de connexion au système ~ Computer Name: JOBUREAU ~ User Name: jo ~ All Users Names: jo, Administrateur, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\\ Variables d'environnement ~ System Unit : C:\ ~ %AppZHP% : C:\Users\jo\AppData\Roaming\ZHP\ ~ %AppData% : C:\Users\jo\AppData\Roaming\ ~ %Desktop% : C:\Users\jo\Desktop\ ~ %Favorites% : C:\Users\jo\Favorites\ ~ %LocalAppData% : C:\Users\jo\AppData\Local\ ~ %StartMenu% : C:\Users\jo\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\\ Enumération des unités disques C: Hard drive, Flash drive, Thumb drive (Free 80 Go of 147 Go) D: Hard drive, Flash drive, Thumb drive (Free 180 Go of 318 Go) E: CD-ROM drive (Not Inserted) G: Floppy drive, Flash card reader, USB Key (Not Inserted) H: Floppy drive, Flash card reader, USB Key (Not Inserted) I: Floppy drive, Flash card reader, USB Key (Not Inserted) J: Floppy drive, Flash card reader, USB Key (Not Inserted) ---\\ Etat du Centre de Sécurité Windows [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified ~ Security Center: 50 Legitimates Filtered in 00mn 00s ---\\ Recherche particulière de fichiers génériques [MD5.0E8E6463F81C80AFBED533E0F1F8895D] - (.Microsoft Corporation - Explorateur Windows.) (.01/06/2013 - 12:34:21.) -- C:\Windows\Explorer.exe [2391280] [MD5.FE9AB232B56A12224E8A3F3F9878C9A3] - (.Microsoft Corporation - Application de démarrage de Windows.) (.26/07/2012 - 04:08:50.) -- C:\Windows\System32\Wininit.exe [132608] [MD5.27E552632E6394DE0FA555EFDBA29A49] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.19/06/2014 - 03:12:11.) -- C:\Windows\System32\wininet.dll [2239488] [MD5.75DD70A14145499C9F7D903CF9A8C91B] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.12/04/2014 - 10:10:31.) -- C:\Windows\System32\Winlogon.exe [578048] [MD5.9448F5740A037EC0C18F0E9177232DD0] - (.Microsoft Corporation - Bibliothèque de licences.) (.26/07/2012 - 04:07:20.) -- C:\Windows\System32\sppcomapi.dll [273408] [MD5.FE7FB9612D354EB41DF4F0FF5D6FB259] - (.Microsoft Corporation - Pilote de fonction connexe pour WinSock.) (.29/05/2014 - 23:24:46.) -- C:\Windows\system32\Drivers\AFD.sys [576512] [MD5.A721FF570C2387E383BDDEA9632863C9] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.26/07/2012 - 06:00:48.) -- C:\Windows\system32\Drivers\atapi.sys [25840] [MD5.990B1BABE6E81FB18E65A87EBEFB1772] - (.Microsoft Corporation - CD-ROM File System Driver.) (.26/07/2012 - 03:30:10.) -- C:\Windows\system32\Drivers\Cdfs.sys [108544] [MD5.339BFF85D788268752DA8C9644B188EE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.26/07/2012 - 03:26:36.) -- C:\Windows\system32\Drivers\Cdrom.sys [174080] [MD5.431141C6859990824D17F71C30A78728] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.17/03/2014 - 09:09:32.) -- C:\Windows\system32\Drivers\DfsC.sys [118784] [MD5.7D87B5B6C7188D553E11B59DC7F0B111] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/09/2012 - 07:08:44.) -- C:\Windows\system32\Drivers\HDAudBus.sys [71168] [MD5.C9E9CBF73AFFBFE3E801EFB516787BA3] - (.Microsoft Corporation - Pilote de port i8042.) (.26/07/2012 - 03:28:51.) -- C:\Windows\system32\Drivers\i8042prt.sys [112640] [MD5.3969B9C218DD3FAA9F4ED2FFC3651C02] - (.Microsoft Corporation - IP Network Address Translator.) (.26/07/2012 - 03:23:01.) -- C:\Windows\system32\Drivers\IpNat.sys [145920] [MD5.7A761AEE58658378BBA45D360F874CB0] - (.Microsoft Corporation - Minirdr SMB Windows NT.) (.09/04/2014 - 19:58:18.) -- C:\Windows\system32\Drivers\MRxSmb.sys [370688] [MD5.7CEC25C682D319D484630B3952C31A11] - (.Microsoft Corporation - MBT Transport driver.) (.26/07/2012 - 03:24:28.) -- C:\Windows\system32\Drivers\netBT.sys [331776] [MD5.7BE3EDFFA3216F989A6BDCB14795DD08] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.17/03/2014 - 09:09:32.) -- C:\Windows\system32\Drivers\ntfs.sys [1939288] [MD5.4563DAF8C6A740AD7F501E219BD10766] - (.Microsoft Corporation - Pilote de port parallèle.) (.26/07/2012 - 03:29:53.) -- C:\Windows\system32\Drivers\Parport.sys [105984] [MD5.A14D625C5AEE5FFE0F47D1A1D419FAAE] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.26/07/2012 - 03:23:17.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [124928] [MD5.B2A3AD74FF2E2FFA73AF2567108231B3] - (.Microsoft Corporation - Redirecteur de périphérique de Microsoft RDP.) (.26/07/2012 - 03:25:18.) -- C:\Windows\system32\Drivers\rdpdr.sys [179712] [MD5.73DC722CE5DF26D7638CE2446F2655C7] - (.Microsoft Corporation - TDI Translation Driver.) (.26/07/2012 - 06:26:47.) -- C:\Windows\system32\Drivers\tdx.sys [117248] [MD5.78A5BBA3819FFFC62FFEC3E2220D102D] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.01/06/2013 - 12:26:33.) -- C:\Windows\system32\Drivers\volsnap.sys [327936] ~ Generic Processes: Scanned in 00mn 00s ---\\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 1/17 ~ Mes musiques (My Musics) : 0/0 ~ Mes Videos (My Videos) : 0/0 ~ Mes Favoris (My Favorites) : 1/3 ~ Mes Documents (My Documents) : 1/212 ~ Mon Bureau (My Desktop) : 1/136 ~ Menu demarrer (Programs) : 1/32 ~ Hidden Files: Scanned in 00mn 00s ---\\ Processus lancés [MD5.B8E7750C4629C0B4B2EC5E9444F29CF4] - (.IObit - Pas de description.) -- C:\Program Files (x86)\IObit\Start Menu 8\StartMenu8.exe [1718560] [PID.868] [MD5.4FBC630768570E6AC35C3DE8F6EC79F5] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe [6970168] [PID.5520] [MD5.8E13CA0B48A1298F46F8739B95DBE4BF] - (.IObit - Advanced SystemCare 7 Monitor.) -- C:\Program Files (x86)\IObit\Advanced SystemCare 7\Monitor.exe [781600] [PID.5600] [MD5.05C5CBE5C0C26EFF48AF60639F30F4F5] - (.NVIDIA Corporation - NVIDIA GeForce Experience Backend.) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712] [PID.5248] [MD5.4720D71C31B2C602AF5AB5C093C24709] - (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe [614744] [PID.4420] [MD5.AA80B164B7A6CF6CBC378A0EC681EBE1] - (.Siber Systems - RoboForm TaskBar Icon.) -- C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [109784] [PID.420] [MD5.B1E01D636350983E94171E229C759468] - (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [275568] [PID.3660] [MD5.736F14A085B0CD73291A1C83B5551A7E] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8074752] [PID.2512] ~ Processes Running: Scanned in 00mn 00s ---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) M2 - MFEP: prefs.js [jo - 3mbk6wdw.default\ascsurfingprotection@iobit.com] [] Advanced SystemCare Surfing Protection v1.0 (..) M2 - MFEP: prefs.js [jo - 3mbk6wdw.default\keefox@chris.tomlinson] [] KeeFox v1.4.2 (..) ~ Firefox Browser: 12 Legitimates Filtered in 00mn 00s ---\\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe ~ Keys: Scanned in 00mn 00s ---\\ Hosts file redirection (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 00s ~ Nombre de lignes (Lines number): 21 ---\\ Internet Explorer Toolbars (O3) O3 - Toolbar: &RoboForm Toolbar - [HKLM]{724d43a0-0d85-11d4-9908-00400523e39a} . (.Siber Systems Inc. - RoboForm Main Module.) -- C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll O3 - Toolbar\WebBrowser: (no name) - [HKCU]{724D43A0-0D85-11D4-9908-00400523E39A} Clé orpheline ~ Toolbar: Scanned in 00mn 00s ---\\ Autres liens utilisateurs (O4) O4 - GS\Desktop [jo]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\jo\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent ~ Global Startup: 1 Legitimates Filtered in 00mn 02s ---\\ Applications lancées au démarrage du système (O4) O4 - HKLM\..\Run: [Acronis Scheduler2 Service] . (.Acronis - Acronis Scheduler Helper.) -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe O4 - HKLM\..\Run: [Nvtmru] . (.NVIDIA Corporation - NVIDIA NvTmru Application.) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe O4 - HKLM\..\Run: [ShadowPlay] . (.NVIDIA Corporation - NVIDIA Capture Server Proxy.) -- C:\Windows\system32\nvspcap64.dll O4 - HKLM\..\Run: [NvBackend] . (.NVIDIA Corporation - NVIDIA GeForce Experience Backend.) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =>.Realtek Semiconductor Corp O4 - HKLM\..\Run: [Bdagent] . (.Bitdefender - Bitdefender Agent.) -- C:\Program Files\Bitdefender\Bitdefender\bdagent.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe =>.DT Soft Ltd O4 - HKCU\..\Run: [KiesPreload] . (.Samsung - Kies.) -- C:\Program Files (x86)\Samsung\Kies\Kies.exe O4 - HKCU\..\Run: [Bitdefender Wallet Agent] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe O4 - HKCU\..\Run: [Bitdefender Wallet] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe O4 - HKCU\..\Run: [Bitdefender Agent de l'application Wallet] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe O4 - HKCU\..\Run: [RoboForm] . (.Siber Systems - RoboForm TaskBar Icon.) -- C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated O4 - HKLM\..\Wow6432Node\Run: [TrueImageMonitor.exe] . (.Acronis - Acronis True Image Monitor.) -- C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe O4 - HKLM\..\Wow6432Node\Run: [AcronisTibMounterMonitor] . (.Acronis - Acronis TIB Monitor.) -- C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe O4 - HKLM\..\Wow6432Node\Run: [Aimersoft Helper Compact.exe] . (.AimerSoft - AimerSoft Studio.) -- C:\Program Files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe O4 - HKLM\..\Wow6432Node\Run: [KeePass 2 PreLoad] . (.Dominik Reichl - KeePass.) -- C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe O4 - HKLM\..\Wow6432Node\Run: [KiesTrayAgent] . (.Samsung Electronics Co., Ltd. - Kies TrayAgent Application.) -- C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe =>.Samsung Electronics Co O4 - HKLM\..\Wow6432Node\Run: [UVS11 Preload] . (.InterVideo Digital Technology Corporation - Ulead VideoStudio.) -- C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\uvPL.exe O4 - HKLM\..\Wow6432Node\Run: [UVS10 Preload] . (.Ulead Systems, Inc. - Ulead VideoStudio.) -- C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 10\uvPL.exe O4 - HKLM\..\Wow6432Node\Run: [Wondershare Helper Compact.exe] . (.Wondershare - Wondershare Studio.) -- C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe O4 - HKUS\.DEFAULT\..\Run: [Bitdefender Wallet Agent] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe O4 - HKUS\.DEFAULT\..\Run: [Bitdefender Wallet] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe O4 - HKUS\.DEFAULT\..\Run: [Bitdefender Agent de l'application Wallet] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe O4 - HKUS\S-1-5-18\..\Run: [Bitdefender Wallet Agent] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe O4 - HKUS\S-1-5-18\..\Run: [Bitdefender Wallet] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe O4 - HKUS\S-1-5-18\..\Run: [Bitdefender Agent de l'application Wallet] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe O4 - HKUS\S-1-5-21-1042456299-3079880857-3127715329-1001\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe =>.DT Soft Ltd O4 - HKUS\S-1-5-21-1042456299-3079880857-3127715329-1001\..\Run: [KiesPreload] . (.Samsung - Kies.) -- C:\Program Files (x86)\Samsung\Kies\Kies.exe O4 - HKUS\S-1-5-21-1042456299-3079880857-3127715329-1001\..\Run: [Bitdefender Wallet Agent] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe O4 - HKUS\S-1-5-21-1042456299-3079880857-3127715329-1001\..\Run: [Bitdefender Wallet] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe O4 - HKUS\S-1-5-21-1042456299-3079880857-3127715329-1001\..\Run: [Bitdefender Agent de l'application Wallet] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe O4 - HKUS\S-1-5-21-1042456299-3079880857-3127715329-1001\..\Run: [RoboForm] . (.Siber Systems - RoboForm TaskBar Icon.) -- C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe ~ Application: Scanned in 00mn 01s ---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: Remplir les formulaires [64Bits] - {320AF880-6646-11D3-ABEE-C5DBF3571F46} . (.Siber Systems Inc. - RoboForm Main Module.) -- C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll O9 - Extra button: Enregistrer les formulaires [64Bits] - {320AF880-6646-11D3-ABEE-C5DBF3571F49} . (.Siber Systems Inc. - RoboForm Main Module.) -- C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll O9 - Extra button: Barre RoboForm [64Bits] - {724d43aa-0d85-11d4-9908-00400523e39a} . (.Siber Systems Inc. - RoboForm Main Module.) -- C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll ~ IE Extra Buttons: Scanned in 00mn 00s ---\\ Site dans la Zone de confiance d'Internet Explorer (O15) O15 - Trusted Zone: [HKCU\...\Domains] http.ma-config.com O15 - Trusted Zone: [HKCU\...\Domains] http.touslesdrivers.com ~ IE Zone Confiance: Scanned in 00mn 00s ---\\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{13CFD926-242B-4D9F-8FCF-18A6C40A98FF}: DhcpNameServer = 212.27.40.241 212.27.40.240 O17 - HKLM\System\CS1\Services\Tcpip\..\{13CFD926-242B-4D9F-8FCF-18A6C40A98FF}: DhcpNameServer = 212.27.40.241 212.27.40.240 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.241 212.27.40.240 ~ Domain: Scanned in 00mn 00s ---\\ Protocole additionnel (O18) O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) -- O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation ~ Protocole Additionnel: Scanned in 00mn 00s ---\\ Tâches planifiées en automatique (O39) [MD5.4E8C983215115036C46841FFB51562A1] [APT] [AutoKMSCustom] (...) -- C:\Windows\AutoKMS\AutoKMS.exe [2820608] =>Trojan.AutoKMS [MD5.D6261B27901ED3875B42EFB360E0B0CB] [APT] [AutoRearm] (...) -- C:\Windows\AutoRearm\AutoRearm.exe [2753536] [MD5.00000000000000000000000000000000] [APT] [{633C1F38-3D9E-4FF1-A5E8-443BA19B4359}] (...) -- C:\Program Files (x86)\Date Cracker 2000\dc2000.exe (.not file.) [0] O39 - APT: - (..) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater [1002] O39 - APT: - (..) -- C:\Windows\Tasks\ASC7_SkipUac_jo.job [254] O39 - APT: - (..) -- C:\Windows\System32\Tasks\ASC7_SkipUac_jo [254] O39 - APT: - (..) -- C:\Windows\Tasks\Driver Booster SkipUAC (jo).job [260] O39 - APT: - (..) -- C:\Windows\System32\Tasks\Driver Booster SkipUAC (jo) [260] O39 - APT: - (..) -- C:\Windows\Tasks\Uninstaller_SkipUac_Administrator.job [290] O39 - APT: - (..) -- C:\Windows\System32\Tasks\Uninstaller_SkipUac_Administrator [290] ~ Scheduled Task: 18 Legitimates Filtered in 00mn 05s ---\\ Logiciels installés (O42) O42 - Logiciel: PC Sleep - (.www.pc-sleep.com.) [HKLM][64Bits] -- {11BD0F20-27DC-4584-AD10-9E99F32F8501} O42 - Logiciel: The Golden Years: Way Out West - (...) [HKLM][64Bits] -- BFG-The Golden Years - Way Out West ~ Logic: 8 Legitimates Filtered in 00mn 00s ---\\ HKCU & HKLM Software Keys [HKCU\Software\QLandkarteGT] [HKLM\Software\Wow6432Node\www.pc-sleep.com] ~ Key Software: 290 Legitimates Filtered in 00mn 00s ---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 09/11/2013 - 12:29:51 - [0] ----D C:\Program Files (x86)\AVSVideoConverter O43 - CFD: 23/04/2014 - 08:33:28 - [] ----D C:\Program Files (x86)\Driver Booster O43 - CFD: 04/02/2014 - 14:00:51 - [0] ----D C:\Program Files (x86)\MKV Converter Studio O43 - CFD: 09/12/2013 - 10:38:46 - [] ----D C:\Program Files (x86)\PC Sleep O43 - CFD: 09/10/2013 - 09:35:18 - [0] ----D C:\Program Files (x86)\PDFToWordConverter O43 - CFD: 31/12/2013 - 14:59:20 - [] ----D C:\Program Files (x86)\The Golden Years - Way Out West O43 - CFD: 04/02/2014 - 14:03:47 - [0] ----D C:\Program Files (x86)\Ultra RM Converter O43 - CFD: 25/01/2014 - 14:10:02 - [0] ----D C:\Program Files (x86)\Video Editor O43 - CFD: 09/07/2014 - 20:58:27 - [] ----D C:\ProgramData\ProductData O43 - CFD: 02/12/2013 - 18:07:37 - [0] ----D C:\ProgramData\{3C5CBD7B-3D1D-411E-96C2-513FFCA84D2D} O43 - CFD: 26/06/2014 - 16:13:25 - [] ----D C:\Users\jo\AppData\Roaming\ProductData O43 - CFD: 31/12/2013 - 14:58:49 - [] ----D C:\Users\jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The Golden Years - Way Out West ~ Program Folder: 223 Legitimates Filtered in 00mn 00s ---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.730AC2A2406262038A06DC6AAB295A46] - 01/07/2014 - 17:46:56 --HA- . (...) -- C:\bdr-im01.gz [46879860] O44 - LFC:[MD5.C7FD70F69C7792256EED17FBDD83484F] - 01/07/2014 - 17:46:57 --HA- . (...) -- C:\bdr-bz01 [3271472] O44 - LFC:[MD5.C63FBEF32A20AADEC611FF2959ED40BC] - 01/07/2014 - 17:47:41 --HA- . (...) -- C:\bdr-cf01 [684] O44 - LFC:[MD5.8E83A0EAB3AD8599EA4CC21F18564B2D] - 01/07/2014 - 17:47:41 --HA- . (...) -- C:\bdr-ld01 [253404] O44 - LFC:[MD5.0F6AA65A6E1037C915DD38A8109ACAFE] - 01/07/2014 - 17:47:41 --HA- . (...) -- C:\bdr-ld01.mbr [9216] O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 10/07/2014 - 20:42:42 ---A- . (...) -- C:\asc_rdflag [0] O44 - LFC:[MD5.41589775EA88EED1B6F4022470791E24] - 11/07/2014 - 07:56:25 ---A- . (...) -- C:\bdlog.txt [50659] ~ Files: 59 Legitimates Filtered in 00mn 11s ---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55) O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0 O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 O55 - MWPS:[HKLM\...\Policies\System] - "EnableLinkedConnections"=1 ~ MWPS: 18 Legitimates Filtered in 00mn 00s ---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56) O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1 ~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s ---\\ Liste des pilotes du système (SDL) (O58) O58 - SDL:23/01/2014 - 04:21:06 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG USB Composite Device Driver (MSS Ver.3).) -- C:\Windows\System32\Drivers\ssudbus.sys [108800] O58 - SDL:23/01/2014 - 04:21:06 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG Android Modem Device Driver (MSS Ver.3).) -- C:\Windows\System32\Drivers\ssudmdm.sys [206080] O58 - SDL:23/01/2014 - 04:21:06 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG USB Mobile Logging Device Driver (MSS Ver.3).) -- C:\Windows\System32\Drivers\ssudserd.sys [206080] O58 - SDL:26/07/2012 - 06:00:55 ---A- . (.Promise Technology, Inc. - Promise SuperTrak EX Series Driver for Windows x64.) -- C:\Windows\System32\Drivers\stexstor.sys [30960] ~ Drivers: 64 Legitimates Filtered in 00mn 03s ---\\ Liste des outils de désinfection (LATC) (O63) O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman ~ ADS: Scanned in 00mn 00s ---\\ Menu de démarrage Internet (SMI) (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69) O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com O69 - SBI: SearchScopes [HKCU] {CDBAA2F8-0478-4AAB-AFF1-120105BD5721} [DefaultScope] - (Bing) - http://www.bing.com ~ Keys: Scanned in 00mn 00s ---\\ Recherche particulière à la racine du système (SPRF) (O84) [MD5.969009FA52AE8AD069E887A56354B690] [SPRF][21/02/2014] (...) -- C:\ProgramData\1392978435.bdinstall.bin [433194] [MD5.490A2477A3C782BA9AFD12F0BE51F62E] [SPRF][01/07/2014] (...) -- C:\ProgramData\1404232449.bdinstall.bin [251250] [MD5.E949D38A43064BA2DA8C5341F7DAA422] [SPRF][01/07/2014] (...) -- C:\ProgramData\1404232962.bdinstall.bin [435594] [MD5.16E53BFC96CE14021C0E07EB1C198478] [SPRF][02/01/2014] (...) -- C:\Users\jo\AppData\Roaming\inst.exe [99384] ~ Files: 8 Legitimates Filtered in 00mn 00s ---\\ Liste des exceptions du parefeu (FirewallRules) (O87) O87 - FAEL: "{B0D049AB-74C0-4711-A89D-E138222D850D}" | In - None - P6 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\jo\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent O87 - FAEL: "{EE1A119A-4E5E-4318-9EEA-5C8FB8DA584C}" | In - None - P17 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\jo\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent ~ Firewall: 2 Legitimates Filtered in 00mn 01s ---\\ Enumère les codes produits des logiciels (PUC) (O90) O90 - PUC: "D525A3B7D3D98164EA253AD19EC8A83C" . (.Software Updater.) -- C:\Windows\Installer\{7B3A525D-9D3D-4618-AE52-A31DE98C8AC3}\icon.ico =>PUP.Eorezo ~ Update Products: 1 Legitimates Filtered in 00mn 00s ---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Demand 08/07/2014 262320 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe SS - | Disabled 21/11/2013 77632 | (BdDesktopParental) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender\bdparentalservice.exe SS - | Auto 04/05/2014 2152736 | (LiveUpdateSvc) . (.IObit.) - C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe SS - | Demand 19/06/2014 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe SS - | Auto 30/05/2014 1631008 | (NvNetworkService) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe SS - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation SS - | Auto 20/09/2012 29696 | C:\Windows\system32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 23/08/2012 1127392 | (AcrSch2Svc) . (.Acronis.) - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe SR - | Auto 21/12/2013 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe SR - | Auto 14/01/2014 881952 | (AdvancedSystemCareService7) . (.IObit.) - C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCService.exe SR - | Auto 28/09/2013 3717112 | (afcdpsrv) . (.Acronis.) - C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe SR - | Auto 06/03/2007 198168 | (Capture Device Service) . (.InterVideo Inc..) - C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe SR - | Auto 11/12/2011 135824 | (EpsonScanSvc) . (.Seiko Epson Corporation.) - C:\Windows\system32\EscSvc64.exe SR - | Auto 12/05/2014 1809720 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe SR - | Auto 12/05/2014 860472 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe SR - | Auto 10/12/2013 15129376 | (NvStreamSvc) . (.NVIDIA Corporation.) - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe SR - | Auto 04/03/2014 922968 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe SR - | Auto 06/06/2014 72992 | (StartMenuService) . (.IObit.) - C:\Program Files (x86)\IObit\Start Menu 8\StartMenuServices.exe SR - | Auto 04/03/2014 411936 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe SR - | Auto 18/08/2012 7026408 | (syncagentsrv) . (.Acronis.) - C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe SR - | Auto 02/04/2014 4972864 | (TeamViewer9) . (.TeamViewer GmbH.) - C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe SR - | Auto 05/06/2014 93040 | (TomTomHOMEService) . (.TomTom.) - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe SR - | Auto 28/09/2006 49152 | (UleadBurningHelper) . (.Ulead Systems, Inc..) - C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe SR - | Auto 07/10/2013 67320 | (UPDATESRV) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender\updatesrv.exe SR - | Auto 01/07/2014 1526800 | (VSSERV) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender\vsserv.exe SR - | Demand 10/07/1658 0 | (WinDefend) . (...) - C:\Program Files (x86)\Windows Defender\MsMpEng.exe ~ Services: Scanned in 00mn 10s ---\\ Scan Additionnel (O88) Database Version : 13026 - (09/07/2014) Clés trouvées (Keys found) : 0 Valeurs trouvées (Values found) : 1 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 1 C:\Windows\AutoKMS\AutoKMS.exe =>Trojan.AutoKMS^ ~ Additionnel Scan: 236777 Items scanned in 00mn 27s ---\\ Informations complémentaires sur les modules ~ http://nicolascoolman.fr/r5-internet-explorer-proxy-management-iepm/ =>.Internet Explorer, Proxy Management (R5) ~ http://nicolascoolman.fr/o3-internet-explorer-toolbars/ =>.Internet Explorer Toolbars (O3) ~ http://nicolascoolman.fr/o4-applications-demarrees-par-le-registre/ =>.Applications lancées au démarrage du système (O4) ~ AMI: 3 Legitimates Filtered in 00mn 00s ---\\ Récapitulatif des détections trouvées sur votre station http://nicolascoolman.fr/trojan-autokms =>Trojan.AutoKMS http://nicolascoolman.fr/pup-eorezo =>PUP.Eorezo ~ MSI: 2 link(s) detected in 00mn 00s ~ 776 Legitimates filtered by white list End of the scan (433 lines in 01mn 38s)(0)