~ Rapport de ZHPDiag v2014.1.24.22 - Nicolas Coolman (24/01/2014) ~ Lancé par ironluffy (26/01/2014 15:30:20) ~ Adresse du Site Web http://nicolascoolman.webs.com ~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/ ~ Traduit par Nicolas Coolman ~ Etat de la version : ~ Liste blanche : Activée par le programme ~ Elévation des Privilèges : OK ~ User Account Control (UAC): Deactivate by program ---\\ Navigateurs Internet MSIE: Internet Explorer v11.0.9600.16476 MFIE: Mozilla Firefox 26.0 (Defaut) ---\\ Informations sur les produits Windows ~ Langage: Français Windows Vista (TM) Ultimate, 64-bit Service Pack 1 (Build 6000) Windows Server License Manager Script : OK ~ Windows(R) 7, OEM_COA_NSLP channel Windows ID Activation : OK ~ Windows Partial Key : XYQ8B Windows License : OK ~ Windows Remaining Initializations Number : 3 Software Protection Service (Protection logicielle) : OK Windows Automatic Updates : OK ---\\ Logiciels de protection du système Malwarebytes Anti-Malware version 1.75.0.1300 Microsoft Security Client v4.4.0304.0 ---\\ Logiciels d'optimisation du système CCleaner v3.21 =>Piriform Ltd ---\\ Logiciels de partage PeerToPeer ---\\ Surveillance de Logiciels Adobe Flash Player 12 Plugin ---\\ Informations sur le système ~ Processor: AMD64 Family 21 Model 2 Stepping 0, AuthenticAMD ~ Operating System: 64 Bits Boot mode: Normal (Normal boot) Total RAM: 8189 MB (82% free) System Restore: Désactivé (Disabled) System drive C: has 68 GB (60%) free of 112 GB ---\\ Mode de connexion au système ~ Computer Name: IRONLUFFY-PC ~ User Name: ironluffy ~ All Users Names: ironluffy, Administrateur, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\\ Variables d'environnement ~ System Unit : C:\ ~ %AppZHP% : C:\Users\ironluffy\AppData\Roaming\ZHP\ ~ %AppData% : C:\Users\ironluffy\AppData\Roaming\ ~ %Desktop% : C:\Users\ironluffy\Desktop\ ~ %Favorites% : C:\Users\ironluffy\Favorites\ ~ %LocalAppData% : C:\Users\ironluffy\AppData\Local\ ~ %StartMenu% : C:\Users\ironluffy\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\\ Enumération des unités disques C: Hard drive, Flash drive, Thumb drive (Free 68 Go of 112 Go) D: Hard drive, Flash drive, Thumb drive (Free 0 Go of 0 Go) E: Hard drive, Flash drive, Thumb drive (Free 22 Go of 56 Go) F: Hard drive, Flash drive, Thumb drive (Free 213 Go of 466 Go) G: CD-ROM drive (Free 0 Go of 2 Go) H: Floppy drive, Flash card reader, USB Key (Free 2 Go of 4 Go) ---\\ Etat du Centre de Sécurité Windows [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified ~ Security Center: 46 Legitimates Filtered in 00mn 00s ---\\ Recherche particulière de fichiers génériques [MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808] [MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024] [MD5.9B6678DB9C6A232C5A84D2FDFFF8B0E1] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.26/11/2013 - 08:07:57.) -- C:\Windows\System32\wininet.dll [2334208] [MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.21/11/2010 - 04:24:29.) -- C:\Windows\System32\Winlogon.exe [390656] [MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.21/11/2010 - 04:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448] [MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/09/2013 - 02:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152] [MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128] [MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160] [MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456] [MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400] [MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368] [MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472] [MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224] [MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208] [MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 04:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632] [MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680] [MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280] [MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 04:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536] [MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184] [MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296] [MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808] ~ Generic Processes: Scanned in 00mn 00s ---\\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 1/10 ~ Mes musiques (My Musics) : 1/2 ~ Mes Favoris (My Favorites) : 1/28 ~ Mes Documents (My Documents) : 2/3904 ~ Mon Bureau (My Desktop) : 1/9 ~ Menu demarrer (Programs) : 1/59 ~ Hidden Files: Scanned in 00mn 00s ---\\ Processus lancés [MD5.5F30686DC1E9950F0C62AD7BAB4A2F3C] - (.Pas de propriétaire - Netgear.) -- C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe [8364288] [PID.3616] [MD5.665CE80D2173C774EE80FEAC4B20C860] - (.Ralink Technology, Corp. - RaUI MFC Application.) -- C:\Program Files (x86)\Ralink\Common\RaUI.exe [1560576] [PID.3644] [MD5.5913D12D86D43FD4D3C1A67A8E081770] - (.Razer Inc. - Razer Synapse.) -- C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [442712] [PID.3844] [MD5.8B60C338C7919351E53375447FC68507] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8338432] [PID.1360] [MD5.51138BEEA3E2C21EC44D0932C71762A8] - (...) -- ysWOW64\rundll32.exe [0] [PID.1712] [MD5.65085456FD9A74D7F1A999520C299ECB] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376] [PID.1996] [MD5.3A2E85F7D90D15460C337CE80C2E3B29] - (...) -- C:\Windows\SysWOW64\PnkBstrA.exe [76888] [PID.1928] [MD5.E155E09229624C69A1A6609C0CB3641F] - (.Ralink Technology, Corp. - RalinkRegistryWriter.) -- C:\Program Files (x86)\Ralink\Common\RaRegistry.exe [185632] [PID.2072] [MD5.E7C84A8A763C460FE182F4DCBC17B9DC] - (.Pas de propriétaire - Wifi Service.) -- C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe [303360] [PID.2248] [MD5.1D283DD3AE2312EEE624E8B8C46F6ADB] - (...) -- c:\programdata\house of soft\gs.enabler\GS.Enabler.exe [729600] [PID.3264] ~ Processes Running: Scanned in 00mn 00s ---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2) C:\Users\ironluffy\AppData\Local\Google\Chrome\User Data\Default\Preferences ~ Google Browser: 1 Legitimates Filtered in 00mn 00s ---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) C:\Users\ironluffy\AppData\Roaming\Mozilla\Firefox\Profiles\inogwt8j.default\prefs.js ~ Firefox Browser: 5 Legitimates Filtered in 00mn 00s ---\\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe ~ Keys: Scanned in 00mn 00s ---\\ Hosts file redirection (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 02s ~ Nombre de lignes (Lines number): 16115 ---\\ Autres liens utilisateurs (O4) O4 - GS\Desktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O4 - GS\QuickLaunch [ironluffy]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\TaskBar [ironluffy]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O4 - GS\Program [ironluffy]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\SystemTools [ironluffy]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\Desktop [ironluffy]: Farming Simulator 2013 .lnk . (.GIANTS Software GmbH - GIANTS Launcher.) -- C:\Program Files (x86)\Farming Simulator 2013\FarmingSimulator2013.exe O4 - GS\Desktop [ironluffy]: Ordinateur - Raccourci.lnk - Clé orpheline O4 - GS\Desktop [ironluffy]: Téléchargements - Raccourci.lnk . (...) -- C:\Users\ironluffy\Downloads ~ Global Startup: 53 Legitimates Filtered in 00mn 02s ---\\ Applications lancées au démarrage du sytème (O4) O4 - GS\Startup [Public]: NETGEAR WNA3100 Genie.lnk . (...) -- C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe O4 - GS\Startup [Public]: Ralink Wireless Utility.lnk . (.Ralink Technology, Corp. - RaUI MFC Application.) -- C:\Program Files (x86)\Ralink\Common\RaUI.exe O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- C:\Program Files\Microsoft Security Client\msseces.exe O4 - HKLM\..\Run: [XboxStat] . (.Microsoft Corporation - XBoxStat.exe.) -- C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe O4 - HKLM\..\Run: [SaiVolume] . (.Saitek - Saitek Volume Monitor.) -- C:\Program Files\Saitek\VolumeTracker\SaiVolume.exe O4 - HKLM\..\Run: [ProfilerU] . (.Saitek - Saitek SST Profile Launcher.) -- C:\Program Files\SmartTechnology\Software\ProfilerU.exe O4 - HKLM\..\Run: [SaiMfd] . (.Saitek - Saitek MFD File System Driver.) -- C:\Program Files\SmartTechnology\Software\SaiMfd.exe O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =>.Realtek Semiconductor Corp O4 - HKLM\..\Run: [RtHDVBg_Dolby] . (.Realtek Semiconductor - HD Audio Background Process.) -- C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe O4 - HKLM\..\Wow6432Node\Run: [JMB36X IDE Setup] . (...) -- C:\Windows\RaidTool\xInsIDE.exe O4 - HKLM\..\Wow6432Node\Run: [Razer Synapse] . (.Razer Inc. - Razer Synapse.) -- C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe =>.Advanced Micro Devices, Inc O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation ~ Application: Scanned in 00mn 00s ---\\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{3CCCE970-D5A0-49A1-AA7B-599C6528875E}: DhcpNameServer = 192.168.137.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{3D8E3C3D-5221-4AB3-88D2-6C6C31BA3C29}: DhcpNameServer = 81.23.32.131 8.8.8.8 O17 - HKLM\System\CCS\Services\Tcpip\..\{5091F737-F8F8-4B50-B0C1-D5C7D36C0472}: DhcpNameServer = 81.23.32.131 8.8.8.8 O17 - HKLM\System\CCS\Services\Tcpip\..\{5381FDC8-3D6A-45E4-A4FB-820253A62244}: DhcpNameServer = 192.168.1.254 O17 - HKLM\System\CCS\Services\Tcpip\..\{C4CEF0D2-BEF7-4CED-B0F9-553E04579080}: DhcpNameServer = 192.168.1.254 O17 - HKLM\System\CCS\Services\Tcpip\..\{CB879A50-252A-4CF9-B3C7-6A68AB3E93EC}: DhcpNameServer = 192.168.137.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{DCDB89DD-33EF-41D3-8920-3C15F4658BDA}: DhcpNameServer = 81.23.32.131 8.8.8.8 O17 - HKLM\System\CCS\Services\Tcpip\..\{3CCCE970-D5A0-49A1-AA7B-599C6528875E}: DhcpDomain = mshome.net O17 - HKLM\System\CCS\Services\Tcpip\..\{3D8E3C3D-5221-4AB3-88D2-6C6C31BA3C29}: DhcpDomain = wizeo.com O17 - HKLM\System\CCS\Services\Tcpip\..\{5091F737-F8F8-4B50-B0C1-D5C7D36C0472}: DhcpDomain = wizeo.com O17 - HKLM\System\CCS\Services\Tcpip\..\{5381FDC8-3D6A-45E4-A4FB-820253A62244}: DhcpDomain = lan O17 - HKLM\System\CCS\Services\Tcpip\..\{C4CEF0D2-BEF7-4CED-B0F9-553E04579080}: DhcpDomain = lan O17 - HKLM\System\CCS\Services\Tcpip\..\{CB879A50-252A-4CF9-B3C7-6A68AB3E93EC}: DhcpDomain = mshome.net O17 - HKLM\System\CCS\Services\Tcpip\..\{DCDB89DD-33EF-41D3-8920-3C15F4658BDA}: DhcpDomain = wizeo.com O17 - HKLM\System\CS1\Services\Tcpip\..\{3CCCE970-D5A0-49A1-AA7B-599C6528875E}: DhcpNameServer = 192.168.137.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{3D8E3C3D-5221-4AB3-88D2-6C6C31BA3C29}: DhcpNameServer = 81.23.32.131 8.8.8.8 O17 - HKLM\System\CS1\Services\Tcpip\..\{5091F737-F8F8-4B50-B0C1-D5C7D36C0472}: DhcpNameServer = 81.23.32.131 8.8.8.8 O17 - HKLM\System\CS1\Services\Tcpip\..\{5381FDC8-3D6A-45E4-A4FB-820253A62244}: DhcpNameServer = 192.168.1.254 O17 - HKLM\System\CS1\Services\Tcpip\..\{C4CEF0D2-BEF7-4CED-B0F9-553E04579080}: DhcpNameServer = 192.168.1.254 O17 - HKLM\System\CS1\Services\Tcpip\..\{CB879A50-252A-4CF9-B3C7-6A68AB3E93EC}: DhcpNameServer = 192.168.137.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{DCDB89DD-33EF-41D3-8920-3C15F4658BDA}: DhcpNameServer = 81.23.32.131 8.8.8.8 O17 - HKLM\System\CS1\Services\Tcpip\..\{3CCCE970-D5A0-49A1-AA7B-599C6528875E}: DhcpDomain = mshome.net O17 - HKLM\System\CS1\Services\Tcpip\..\{3D8E3C3D-5221-4AB3-88D2-6C6C31BA3C29}: DhcpDomain = wizeo.com O17 - HKLM\System\CS1\Services\Tcpip\..\{5091F737-F8F8-4B50-B0C1-D5C7D36C0472}: DhcpDomain = wizeo.com O17 - HKLM\System\CS1\Services\Tcpip\..\{5381FDC8-3D6A-45E4-A4FB-820253A62244}: DhcpDomain = lan O17 - HKLM\System\CS1\Services\Tcpip\..\{C4CEF0D2-BEF7-4CED-B0F9-553E04579080}: DhcpDomain = lan O17 - HKLM\System\CS1\Services\Tcpip\..\{CB879A50-252A-4CF9-B3C7-6A68AB3E93EC}: DhcpDomain = mshome.net O17 - HKLM\System\CS1\Services\Tcpip\..\{DCDB89DD-33EF-41D3-8920-3C15F4658BDA}: DhcpDomain = wizeo.com O17 - HKLM\System\CS2\Services\Tcpip\..\{3CCCE970-D5A0-49A1-AA7B-599C6528875E}: DhcpNameServer = 192.168.137.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{3D8E3C3D-5221-4AB3-88D2-6C6C31BA3C29}: DhcpNameServer = 81.23.32.131 8.8.8.8 O17 - HKLM\System\CS2\Services\Tcpip\..\{5091F737-F8F8-4B50-B0C1-D5C7D36C0472}: DhcpNameServer = 81.23.32.131 8.8.8.8 O17 - HKLM\System\CS2\Services\Tcpip\..\{5381FDC8-3D6A-45E4-A4FB-820253A62244}: DhcpNameServer = 192.168.1.254 O17 - HKLM\System\CS2\Services\Tcpip\..\{C4CEF0D2-BEF7-4CED-B0F9-553E04579080}: DhcpNameServer = 192.168.1.254 O17 - HKLM\System\CS2\Services\Tcpip\..\{CB879A50-252A-4CF9-B3C7-6A68AB3E93EC}: DhcpNameServer = 192.168.137.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{DCDB89DD-33EF-41D3-8920-3C15F4658BDA}: DhcpNameServer = 81.23.32.131 8.8.8.8 O17 - HKLM\System\CS2\Services\Tcpip\..\{3CCCE970-D5A0-49A1-AA7B-599C6528875E}: DhcpDomain = mshome.net O17 - HKLM\System\CS2\Services\Tcpip\..\{3D8E3C3D-5221-4AB3-88D2-6C6C31BA3C29}: DhcpDomain = wizeo.com O17 - HKLM\System\CS2\Services\Tcpip\..\{5091F737-F8F8-4B50-B0C1-D5C7D36C0472}: DhcpDomain = wizeo.com O17 - HKLM\System\CS2\Services\Tcpip\..\{5381FDC8-3D6A-45E4-A4FB-820253A62244}: DhcpDomain = lan O17 - HKLM\System\CS2\Services\Tcpip\..\{C4CEF0D2-BEF7-4CED-B0F9-553E04579080}: DhcpDomain = lan O17 - HKLM\System\CS2\Services\Tcpip\..\{CB879A50-252A-4CF9-B3C7-6A68AB3E93EC}: DhcpDomain = mshome.net O17 - HKLM\System\CS2\Services\Tcpip\..\{DCDB89DD-33EF-41D3-8920-3C15F4658BDA}: DhcpDomain = wizeo.com O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 81.23.32.131 8.8.8.8 ~ Domain: Scanned in 00mn 00s ---\\ Protocole additionnel (O18) O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation O18 - Filter: video/x-flv [64Bits] - {20C75730-7C25-476B-95DC-C65810F9E489} . (.Advanced Micro Devices - MIME Video Detector for IE.) -- C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll ~ Protocole Additionnel: Scanned in 00mn 00s ---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - AppInit_DLLs: . (...) - C:\Program Files (x86)\GS_X64~1.ENA (.not file.) ~ AppInit DLL: Scanned in 00mn 00s ---\\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: GS.Supporter (1a34a8e0) . (...) - C:\Program Files (x86)\GSSvc.dll O23 - Service: WSWNA3100 (WSWNA3100) . (.Pas de propriétaire - Wifi Service.) - C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe ~ Services: 10 Legitimates Filtered in 00mn 07s ---\\ Tâches planifiées en automatique (O39) O39 - APT:Automatic Planified Task - C:\Windows\Tasks\GS.Enabler-S-1824435291.job [472] [MD5.D41D8CD98F00B204E9800998ECF8427E] [APT] [CleanTemps] (...) -- C:\MaConfig\Process\CleanTemps.cmd" [198] [MD5.1D283DD3AE2312EEE624E8B8C46F6ADB] [APT] [GS.Enabler-S-1824435291] (...) -- c:\programdata\house of soft\gs.enabler\GS.Enabler.exe [729600] [MD5.00000000000000000000000000000000] [APT] [{4256D57C-D8B1-4102-99F9-7E561025C6AE}] (...) -- C:\Users\ironluffy\Downloads\JMB36X_WinDrv_R1.17.65_WHQL_eSATA\R1.17.65.11_eSATA\setup.exe (.not file.) [0] ~ Scheduled Task: 11 Legitimates Filtered in 00mn 02s ---\\ Logiciels installés (O42) O42 - Logiciel: DuckTales Remastered - (.WayForward.) [HKLM][64Bits] -- Steam App 237630 O42 - Logiciel: GS.Enabler - (.PremiumSoft.) [HKLM][64Bits] -- S-1824435291 O42 - Logiciel: GS.Supporter 1.80 - (.Verified Publisher.) [HKLM][64Bits] -- {5F189DF5-2D05-472B-9091-84D9848AE48B}{1a34a8e0} O42 - Logiciel: Next Car Game - (.Bugbear.) [HKLM][64Bits] -- Steam App 228380 O42 - Logiciel: Next Car Game Sneak Peek 2.0 - (.Bugbear.) [HKLM][64Bits] -- Steam App 272860 O42 - Logiciel: Rust - (.Facepunch Studios.) [HKLM][64Bits] -- Steam App 252490 O42 - Logiciel: Starbound - (...) [HKLM][64Bits] -- Steam App 211820 ~ Logic: 3 Legitimates Filtered in 00mn 00s ---\\ HKCU & HKLM Software Keys [HKLM\Software\Wow6432Node\GS.Enabler] ~ Key Software: 281 Legitimates Filtered in 00mn 00s ---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 26/01/2014 - 15:20:33 - [0,085] ----D C:\ProgramData\483803af6169f79e O43 - CFD: 25/01/2014 - 14:22:14 - [0,701] ----D C:\ProgramData\House Of Soft O43 - CFD: 12/05/2013 - 20:03:03 - [0] ----D C:\ProgramData\STORE O43 - CFD: 24/01/2014 - 11:10:02 - [0] -SH-D C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} O43 - CFD: 13/08/2013 - 20:25:37 - [0] ----D C:\Users\ironluffy\AppData\Roaming\Wayforward Technologies O43 - CFD: 20/01/2014 - 17:58:31 - [2,202] ----D C:\Users\ironluffy\AppData\Local\DayZ O43 - CFD: 20/01/2014 - 12:37:20 - [0] ----D C:\Users\ironluffy\AppData\Local\next car game technology sneak peek ~ Program Folder: 189 Legitimates Filtered in 00mn 03s ---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.C8C7EAD8098EA7468D651F3459657240] - 14/01/2014 - 16:04:55 ---A- . (...) -- C:\Windows\System32\Drivers\RTAIODAT.DAT [681905] O44 - LFC:[MD5.1EF2A77F3F4951CC25EEEA882376A769] - 14/01/2014 - 16:04:57 ---A- . (...) -- C:\Windows\System32\Drivers\rtvienna.dat [5681192] O44 - LFC:[MD5.8126331FBD4ED29EB3B356F9C905064D] - 24/01/2014 - 17:49:14 ---A- . (...) -- C:\Windows\GVTDrv64.sys [30528] O44 - LFC:[MD5.0A34066D56D57C0DA73BFFC1E4169FF2] - 26/01/2014 - 09:19:29 ---A- . (...) -- C:\Windows\wininit.ini [85] ~ Files: 92 Legitimates Filtered in 00mn 01s ---\\ Clé de registre Shell MountPoints2 (MPKS) (O51) O51 - MPSK:{4ec1cbd6-d738-11e2-b027-806e6f6e6963}\AutoRun\command. (.GIANTS Software GmbH - Autorun.) -- G:\cdstart.exe O51 - MPSK:{c9bc1e88-7825-11e2-86ca-806e6f6e6963}\AutoRun\command. (.GIANTS Software GmbH - Autorun.) -- G:\cdstart.exe ~ Keys: Scanned in 00mn 00s ---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55) O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 ~ MWPS: 16 Legitimates Filtered in 00mn 00s ---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56) O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1 ~ MWPE Keys: 4 Legitimates Filtered in 00mn 00s ---\\ Liste des pilotes du système (SDL) (O58) O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496] O58 - SDL:[MD5.FD291A75ECAF197F07BD2040C2A7322A] - 17/07/2013 - 14:23:50 ---A- . (.Etron Technology Inc - Etron eXtensible Hub Driver..) -- C:\Windows\System32\Drivers\EtronHub3.sys [65408] O58 - SDL:[MD5.DDE9068F9BAC0210195F217AA39B9276] - 17/07/2013 - 14:23:46 ---A- . (.Etron Technology Inc - Etron eXtensible Host Controller Driver..) -- C:\Windows\System32\Drivers\EtronXHCI.sys [94208] O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232] O58 - SDL:[MD5.06B60A20C7843DA78F28CD77A58548C9] - 26/03/2012 - 10:46:46 ---A- . (.Hauppauge, Inc. - Hauppauge, Inc. HcwHDPvr WDM Driver.) -- C:\Windows\System32\Drivers\hcwhdpvr.sys [192072] O58 - SDL:[MD5.2A50BE713FAF033420466C25979C028E] - 22/07/2011 - 09:33:48 ---A- . (.Windows (R) Win 7 DDK provider - SerComm NDIS User mode I/O Driver.) -- C:\Windows\System32\Drivers\SCMNdisP.sys [25056] O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656] ~ Drivers: 16 Legitimates Filtered in 00mn 00s ---\\ Liste des outils de désinfection (LATC) (O63) O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman ~ ADS: Scanned in 00mn 00s ---\\ Menu de démarrage Internet (SMI) (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69) O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com ~ Keys: Scanned in 00mn 00s ---\\ Recherche particulière à la racine du système (SPRF) (O84) [MD5.12D28E92657AADDEEBBF938B89C490D7] [SPRF][25/01/2014] (...) -- C:\Program Files (x86)\GSSvc.dll [183632] ~ Files: 1 Legitimates Filtered in 00mn 00s ---\\ Liste des exceptions du parefeu (FirewallRules) (O87) O87 - FAEL: "TCP Query User{34FF7241-8AFE-464E-BD50-7B59EC232896}C:\users\ironluffy\documents\arma 2\expansion\beta\arma2oa.exe" |In - Public - P6 - TRUE | .(...) -- C:\users\ironluffy\documents\arma 2\expansion\beta\arma2oa.exe (.not file.) O87 - FAEL: "UDP Query User{8CED4D95-6036-4F86-8BC8-133E72BD4CAC}C:\users\ironluffy\documents\arma 2\expansion\beta\arma2oa.exe" |In - Public - P17 - TRUE | .(...) -- C:\users\ironluffy\documents\arma 2\expansion\beta\arma2oa.exe (.not file.) O87 - FAEL: "TCP Query User{9C6AB733-ACEA-464A-8A86-4D87AFD369ED}C:\users\ironluffy\documents\arma 2\expansion\beta\arma2oa.exe" |In - Private - P6 - TRUE | .(...) -- C:\users\ironluffy\documents\arma 2\expansion\beta\arma2oa.exe (.not file.) O87 - FAEL: "UDP Query User{9BFBE7D3-8915-484B-A85D-5978EEADC756}C:\users\ironluffy\documents\arma 2\expansion\beta\arma2oa.exe" |In - Private - P17 - TRUE | .(...) -- C:\users\ironluffy\documents\arma 2\expansion\beta\arma2oa.exe (.not file.) O87 - FAEL: "TCP Query User{C1D34ACF-60C7-4025-A6B9-8ACA1ABCD749}C:\program files (x86)\six networks\play withsix\withsix-play.exe" |In - Public - P6 - TRUE | .(...) -- C:\program files (x86)\six networks\play withsix\withsix-play.exe (.not file.) O87 - FAEL: "UDP Query User{9F1B2440-A8B3-4943-819D-73151F2AB097}C:\program files (x86)\six networks\play withsix\withsix-play.exe" |In - Public - P17 - TRUE | .(...) -- C:\program files (x86)\six networks\play withsix\withsix-play.exe (.not file.) O87 - FAEL: "TCP Query User{C71DA54A-B751-4CFC-868E-EE682401838B}C:\users\ironluffy\documents\arma 2\beta_oa\arma2oa.exe" |In - Private - P6 - TRUE | .(...) -- C:\users\ironluffy\documents\arma 2\beta_oa\arma2oa.exe (.not file.) O87 - FAEL: "UDP Query User{B3BB2C3C-A679-4628-8D59-A38150CF6EFC}C:\users\ironluffy\documents\arma 2\beta_oa\arma2oa.exe" |In - Private - P17 - TRUE | .(...) -- C:\users\ironluffy\documents\arma 2\beta_oa\arma2oa.exe (.not file.) O87 - FAEL: "{DD3E9AB7-354D-464F-AB34-96A9F816E250}" |In - Public - P17 - TRUE | .(...) -- C:\users\ironluffy\documents\arma 2\beta_oa\arma2oa.exe (.not file.) O87 - FAEL: "{0EA23FD7-F6C0-4204-8F4E-E1F30EC9CBD7}" |In - Public - P6 - TRUE | .(...) -- C:\users\ironluffy\documents\arma 2\beta_oa\arma2oa.exe (.not file.) ~ Firewall: 283 Legitimates Filtered in 00mn 18s ---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Demand 22/01/2014 257928 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe SS - | Demand 20/07/2013 49152 | (BEService) . (...) - C:\Program Files (x86)\Common Files\BattlEye\BEService.exe SS - | Demand 30/08/2011 160256 | (ICCS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe SS - | Demand 03/04/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe SS - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe SS - | Demand 21/12/2013 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe SS - | Demand 07/01/2014 569768 | (Steam Client Service) . (.Valve Corporation.) - C:\Program Files (x86)\Common Files\Steam\SteamService.exe SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 25/01/2014 183632 | (1a34a8e0) . (...) - C:\Program Files (x86)\GSSvc.dll SR - | Auto 06/12/2013 239616 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe SR - | Auto 06/12/2013 344064 | (AMD FUEL Service) . (.Advanced Micro Devices, Inc..) - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe SR - | Auto 08/01/2014 2768720 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe SR - | Auto 23/10/2013 23808 | (MsMpSvc) . (.Microsoft Corporation.) - C:\Program Files\Microsoft Security Client\MsMpEng.exe SR - | Auto 10/07/1658 0 | (PnkBstrA) . (...) - C:\Windows\system32\PnkBstrA.exe SR - | Auto 14/07/2009 185632 | (RalinkRegistryWriter) . (.Ralink Technology, Corp..) - C:\Program Files (x86)\Ralink\Common\RaRegistry.exe SR - | Auto 14/07/2009 211232 | (RalinkRegistryWriter64) . (.Ralink Technology, Corp..) - C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe SR - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation SR - | Auto 07/12/2011 303360 | (WSWNA3100) . (...) - C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe SR - | Auto 14/07/2009 27136 | C:\Windows\system32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe ~ Services: Scanned in 00mn 02s ---\\ Scan Additionnel (O88) Database Version : 13027 - (24/01/2014) Clés trouvées (Keys found) : 0 Valeurs trouvées (Values found) : 0 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 0 ~ Additionnel Scan: 252720 Items scanned in 00mn 26s ~ 1198 Legitimates filtered by white list End of the scan (432 lines in 01mn 17s)(0)