~ Rapport de ZHPDiag v2014.1.25.26 - Nicolas Coolman  (25/01/2014)
~ Lancé par djam-sisi (29/01/2014 18:27:06)
~ Adresse du Site Web  http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version : 
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by user


---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16736 (Defaut)
GCIE: Google Chrome v21.0.1180.89

---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 9YQTR
Windows License : OK
~ Windows Remaining Initializations Number : 2
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ Logiciels de protection du système
avast! Free Antivirus v9.0.2013
Windows Defender W7

---\\ Logiciels d'optimisation du système
CCleaner v4.10 =>Piriform Ltd

---\\ Logiciels de partage PeerToPeer

---\\ Surveillance de Logiciels
Adobe Flash Player 11 Plugin

---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 37 Stepping 5, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3948 MB (36% free)
System Restore: Activé (Enable)
System drive C: has 141 GB (71%) free of 198 GB

---\\ Mode de connexion au système
~ Computer Name: DJAM-SISI-PC
~ User Name: djam-sisi
~ All Users Names: __vmware_user__, HomeGroupUser$, djam-sisi, Administrateur, 
~ Unselected Option: O45,O61
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\djam-sisi\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\djam-sisi\AppData\Roaming\
~ %Desktop% : C:\Users\djam-sisi\Desktop\
~ %Favorites% : C:\Users\djam-sisi\Favorites\
~ %LocalAppData% : C:\Users\djam-sisi\AppData\Local\
~ %StartMenu% : C:\Users\djam-sisi\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 141 Go of 198 Go)
D: Hard drive, Flash drive, Thumb drive (Free 228 Go of 243 Go)
E: CD-ROM drive (Not Inserted)
G: CD-ROM drive (Not Inserted)



---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: 49 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.9706C99DAEBE3FEAC811B239617E98C4] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.12/10/2013 - 09:45:20.) -- C:\Windows\System32\wininet.dll [2241536]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/09/2013 - 02:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes:  Scanned in 00mn 03s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/15
~ Mes musiques (My Musics) : 1/10
~ Mes Favoris (My Favorites) : 0/3
~ Mes Documents (My Documents) : 1/54
~ Mon Bureau (My Desktop) : 0/42
~ Menu demarrer (Programs) : 1/56
~ Hidden Files:  Scanned in 00mn 01s



---\\ Processus lancés
[MD5.F4DCD4912B185C3AAEB92A7040832AD1] - (.Pas de propriétaire - ALU.) -- C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe   [51768] [PID.3528]
[MD5.5BB1F77C8AF725A15EC9366498D275BB] - (.ASUS - ATKOSD2.) -- C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe   [5732992] [PID.2064]
[MD5.58920E6A409046BA06548D9D139CE0F0] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe   [20584608] [PID.4132]
[MD5.90D787A2DF45B1E82C276DFD1A91AE61] - (...) -- C:\Users\djam-sisi\AppData\Roaming\cacaoweb\cacaoweb.exe   [471552] [PID.4160]  =>PUP.CacaoWeb
[MD5.E78FA80D4D7FD757A53781E17A3B7402] - (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files (x86)\Internet Download Manager\IDMan.exe   [3487128] [PID.4584]
[MD5.FB7680DC6B75024E74DC4876A184638C] - (.Pas de propriétaire - HP SimpleSave Backup.) -- C:\Users\djam-sisi\AppData\Roaming\HP SimpleSave Application\StartHelper.exe   [477080] [PID.5040]
[MD5.D98BC64645C2DAEDC1E79B4CCCCBBC8E] - (.ASUS - ATK Media.) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe   [170624] [PID.5200]
[MD5.BD95E822E7A958BBCA842D078426A151] - (.Tonec Inc. - Internet Download Manager agent for click m.) -- C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe   [269848] [PID.5220]
[MD5.5AEBF6FA9805C9101220AA4FB4FA17E7] - (.ASUS - HControlUser.) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe   [105016] [PID.5316]
[MD5.F477F57732AFFC5460FCC5302DC08394] - (.Pas de propriétaire - Wireless Console 3.) -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe   [1597440] [PID.5340]
[MD5.0D5419C8508FCB40C4255EFDD050958D] - (.PC Tools - SSDMonit Application.) -- C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe   [103896] [PID.5436]
[MD5.81800928E0F713DF31F3393CC26F4013] - (.Pas de propriétaire - DivX Update.) -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe   [1263952] [PID.5616]
[MD5.57B4D34232852BFE4453BE571DF90D21] - (.CyberLink - CyberLink MediaLibray Service.) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe   [103720] [PID.5664]
[MD5.5C396DDE6AAFFB64ABC0E0FD88F53553] - (.ASUS - AsScrPro.) -- C:\Windows\AsScrPro.exe   [3054136] [PID.5788]
[MD5.0BC997873F856AE1A23393B155FE8E69] - (.VMware, Inc. - VMware Tray Process.) -- C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe   [96816] [PID.5868]
[MD5.1FC71A719B45A6A90BAFE2387EA07984] - (.Pas de propriétaire - HSDPALauncher MFC Application.) -- C:\Program Files (x86)\HSPA USB Modem\HSPALauncher.exe   [233472] [PID.5900]
[MD5.A2E9FE64D1EC22F2B0BF6DB122739802] - (.BlueStack Systems, Inc. - BlueStacks Agent.) -- C:\Program Files (x86)\BlueStacks\HD-Agent.exe   [807696] [PID.5964]
[MD5.A78AAB0D2D70EF7DD56B7328AC502059] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe   [3767096] [PID.6008]
[MD5.CE42DFE915F78246364D464902E47360] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe   [152392] [PID.6040]
[MD5.BEE83619A26F90A6C8273F9CA9680397] - (.asus - ControlDeck.) -- C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe   [1080448] [PID.2260]
[MD5.B0BF698030DB6561393AE753C6D3F936] - (.Google Inc. - Google Chrome.) -- C:\Users\djam-sisi\AppData\Local\Google\Chrome\Application\chrome.exe   [1312720] [PID.3532]
[MD5.CA25CAEEBDBE25D85565877219F684F8] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe   [8339968] [PID.6868]
[MD5.18E5C2F937F9DEB8C282DF66A3761925] - (.ASUS - ASLDR Service.) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe   [84536] [PID.1452]
[MD5.7910158929571214A959D5A6D16DD9C0] - (.ASUS - GFNEXSrv.) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe   [96896] [PID.1492]
[MD5.CC42F104172B4A62793083D380867317] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe   [50344] [PID.1524]
[MD5.4FE5C6D40664AE07BE5105874357D2ED] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe   [57008] [PID.1952]
[MD5.68B86DD9D455A6A8DE6D13C84FB5CE31] - (.ArcSoft, Inc. - UACTokenSvc.) -- C:\Users\djam-sisi\AppData\Roaming\HP SimpleSave Application\uUACTokenSvc.exe   [83512] [PID.1988]
[MD5.1DC18C9E1B4984389783E4F9DFC61AB1] - (.BlueStack Systems, Inc. - BlueStacks Log Rotator Service.) -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe   [385808] [PID.1064]
[MD5.A1C148801B4AF64847AEB9F3AD9594EF] - (.Intel Corporation - Local Manageability Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe   [262144] [PID.1928]
[MD5.0AEA7303E97C02DAD9245EBDFBD4D253] - (.PC Tools - StartMan Application.) -- C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe   [793048] [PID.2068]
[MD5.BBFCAC1C23B867AE5D7EF96DF40680C5] - (.Realtek - RtlService MFC Application.) -- C:\Program Files (x86)\REALTEK\RTL8187 Wireless LAN Utility\RtlService.exe   [40960] [PID.2140]
[MD5.66F39EB030F69731FD2731D83D6A3DBD] - (.Realtek Semiconductor Corp. - RtWLan ( For Vista / Win7) Application(Exte.) -- C:\Program Files (x86)\REALTEK\RTL8187 Wireless LAN Utility\RtWlan.exe   [1118208] [PID.2200]
[MD5.68D6B9F5C7F265DA5EC671C32C6F1294] - (.VMware, Inc. - VMware NAT Service.) -- C:\Windows\SysWOW64\vmnat.exe   [399920] [PID.2292]
[MD5.3B6429C5B11408EF11EFEEE8C0F0682A] - (.BlueStack Systems, Inc. - BlueStacks Service.) -- C:\Program Files (x86)\BlueStacks\HD-Service.exe   [402192] [PID.2336]
[MD5.730F8608A3B02F46EB448852FC033F20] - (.VMware, Inc. - VMware Authorization Service.) -- C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe   [113200] [PID.2452]
[MD5.713C85F0C1A95C25EE28D4B024A0EA33] - (.BlueStack Systems - BlueStacks Network Helper Process.) -- C:\Program Files (x86)\BlueStacks\HD-Network.exe   [377616] [PID.2740]
[MD5.85EA81C24D402E064E24D1347011DB41] - (.VMware, Inc. - VMware VMnet DHCP service.) -- C:\Windows\SysWOW64\vmnetdhcp.exe   [326192] [PID.3024]
[MD5.FEAB27A624ADA932A2F8E831DE668A38] - (.BlueStack Systems - BlueStacks Block Device Helper Process.) -- C:\Program Files (x86)\BlueStacks\HD-BlockDevice.exe   [261392] [PID.2744]
[MD5.CDB95B8CC08E6F727496D8F19A27EFEE] - (.BlueStack Systems - BlueStacks Shared Folder Helper Process.) -- C:\Program Files (x86)\BlueStacks\HD-SharedFolder.exe   [367376] [PID.3584]
[MD5.41118D920B2B268C0ADC36421248CDCF] - (.Intel Corporation - User Notification Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe   [2314240] [PID.5652]
~ Processes Running:  Scanned in 00mn 17s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\djam-sisi\AppData\Local\Google\Chrome\User Data\Default\Preferences
G1 - GCS: Preference [User Data\Default] http://www.google.com
G2 - GCE: Preference [User Data\Default] [gebbadcnkcgcfgpbmcdleckpejgopimf] cacaoweb v.1.18 (Activé) =>PUP.CacaoWeb
G2 - GCE: Preference [User Data\Default] [iahagolkpaghhinaljhjihagjgomdokb] Ouedkniss Toolbar v.1.3, (Désactivé)
G2 - GCE: Preference [User Data\Default] [leahdjjpjmnamomgpojikeapflgbmjab] cacaoweb v.1.16 (Désactivé) =>PUP.CacaoWeb
G2 - GCE: Preference [User Data\Default] [lkgikdljlijdigcpknpecodlmihmdmij] DivX Browser Bar FR v.10.16.2.6, (Désactivé)
~ Google Browser: 18 Legitimates Filtered in 00mn 21s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions  (P2,M0,M1,M2,M3)
M3 - MFPP: Plugins - [djam-sisi] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\babylon.xml =>PUP.Babylon
~ Firefox Browser: 16 Legitimates Filtered in 00mn 01s



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs,Tabs = http://webplayersearch.com =>Adware.SocialSkinz
R3 - URLSearchHook: DivX Browser Bar FR Toolbar [64Bits] - {834acc44-e0fc-4f17-8e6b-f1029b3bc0de} . (.Conduit Ltd. - Conduit Toolbar.) (6.12.0.11) -- C:\Program Files (x86)\DivX_Browser_Bar_FR\prxtbDivX.dll =>Toolbar.Conduit
~ IE Browser: 16 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local>;*.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management:  Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys:  Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
O1 - Hosts: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
O1 - Hosts: <html lang='en'>
O1 - Hosts: <head>
O1 - Hosts: <meta name="description" content="Yahoo! GeoCities offers you a free web site and all the tools you need to build a dynamic site. Features include easy-to-use site building tools, online help, web site statistics, secure and reliable hosting, and an intuitive control panel.">
O1 - Hosts: <title>Yahoo! GeoCities: Get a web site with easy-to-use site building tools.</title>
O1 - Hosts: <link rel="stylesheet" type="text/css" media="all" href="http://l.yimg.com/a/combo?yui/2.5.2/build/reset-fonts-grids/reset-fonts-grids.css&smbiz/css/headfoot_6.css&smbiz/css/ysbs_glossary_1.css"> 
O1 - Hosts: <link rel="stylesheet" type="text/css" media="all" href="http://l.yimg.com/a/lib/smbiz/css/geocities_84954.css"> 
O1 - Hosts: <style>
O1 - Hosts: h1 { line-height:30px;height:30px; padding-left:15px; font-weight:bold;font-size:1.6em;color:#1f296a;}
O1 - Hosts: .services li { margin-left:1.0em; padding-left:0.5em; background:url("http://l.yimg.com/a/lib/smbiz/i/geo_bullet_3x3_1.gif") no-repeat 0 0.5em; margin-bottom:0.5em;margin-left:1.5em;margin-right:0.5em;width:6em}
O1 - Hosts: .services li {float:left; width:17em; font-size:116%;margin-top:0.8em}
O1 - Hosts: .services {  font-size:116%; padding-bottom:20px }
O1 - Hosts: .learnmore a {color:#2882DE;font-size:16px}
O1 - Hosts: .image_web  {float:right; margin:15px 0 0 15px}
O1 - Hosts: p {margin:20px;font-size:1em;}
O1 - Hosts: h2 {margin:20px 0 0 20px;color:#1F296;font-weight:bold;font-size:1.25em;color:#1f296a;}
O1 - Hosts: h3 {margin:20px;color:#1F296;font-weight:bold;font-size:1.15em;color:#1f296a;}
O1 - Hosts: li.rule {border-top:solid 1px #DBE1E6;}
O1 - Hosts: </style>
O1 - Hosts: </head>
O1 - Hosts: <body>
O1 - Hosts: <!-- following code added by server. PLEASE REMOVE -->
O1 - Hosts: <!-- preceding code added by server. PLEASE REMOVE -->
O1 - Hosts: <div class="ez-mw" style ="height:900px;width:905px">
O1 - Hosts: <div class="ez-wri ez-oh" style="width:900px">
O1 - Hosts: <div class="ez-box">
O1 - Hosts: <link type="text/css" rel="stylesheet" href="http://l.yimg.com/a/lib/uh/15/css/uh-1.0.28.css">
O1 - Hosts: <style type="text/css">
O1 - Hosts: div#headerblock div{font-family:arial;}
O1 - Hosts: </style>
O1 - Hosts: <div id="ygma"><div id="ygmaheader"><div class="bd sp"><div id="ymenu" class="ygmaclr"><div id="mepanel"><ul id="mepanel-nav"><li class="me1"><em>New User? <a class="ygmasignup" title="Sign Up" href="http://us.ard.yahoo.com/SIG=15u88cce2/M=650008.13654023.13693397.13153904/D=smallbiz/S=2023010636:HEAD/Y=YAHOO/EXP=1252098940/L=HzY9i9j8aIuVH8pzSp2qoCoWz37hF0qhZ1wABADc/B=RCQ9Atj8a20-/J=1252091740846210/K=88LB2KvJxEkW95HaZ4xf4Q/A=5836007/R=2/SIG=13j8rdsqp/*https://edit.yahoo.com/config/eval_register?.done=http://smallbusiness.yahoo.com%2findex.html&.src=smbiz&.intl=us">Sign Up</a></em></li><li class="me2"><a title="Sign In" href="http://us.ard.yahoo.com/SIG=15u88cce2/M=650008.13654023.13693397.13153904/D=smallbiz/S=2023010636:HEAD/Y=YAHOO/EXP=1252098940/L=HzY9i9j8aIuVH8pzSp2qoCoWz37hF0qhZ1wABADc/B=RCQ9Atj8a20-/J=1252091740846210/K=88LB2KvJxEkW95HaZ4xf4Q/A=5836007/R=3/SIG=13cm6p12o/*https://login.yahoo.com/config/login?.done=http://geocities.yahoo.com&.src=smbiz&.intl=us">Sign In</a></li>
O1 - Hosts: <li class="me3"><a href="http://us.ard.yahoo.com/SIG=15uqalioe/M=650008.13654021.13693393.13153902/D=smallbiz/S=2023010636:HEAD/Y=YAHOO/EXP=1252098025/L=j.Ah_9j8aIuVH8pzSp2qoCg9z37hF0qhY8gACN48/B=zgw4Atj8a20-/J=1252090825225621/K=pmFpaSqI9UgVSmAu3nNNgw/A=5836006/R=7/SIG=11hjute28/*http://help.yahoo.com/l/us/yahoo/geocities/" target="_top" title="Yahoo! Help Central">Help</a></li>
O1 - Hosts: </ul></div><div id="ygmapromo"><a style="font-weight:bold;" id="ygmaie8" href="http://us.ard.yahoo.com/SIG=15vud5jbf/M=650008.13445975.13532322.12832737/D=smallbiz/S=2023010636:HPRM2/Y=YAHOO/EXP=1252098025/L=j.Ah_9j8aIuVH8pzSp2qoCg9z37hF0qhY8gACN48/B=0Qw4Atj8a20-/J=1252090825225621/K=pmFpaSqI9UgVSmAu3nNNgw/A=5706923/R=0/SIG=117bakia1/*http://toolbar.yahoo.com/?.cpdl=ushdl" target="_top">Get Yahoo! Toolbar<abbr title="Yahoo! Toolbar"></abbr></a>
O1 - Hosts: <script language=javascript>
O1 - Hosts: if(window.yzq_d==null)window.yzq_d=new Object();
O1 - Hosts: window.yzq_d['0Qw4Atj8a20-']='&U=13hn349r9%2fN%3d0Qw4Atj8a20-%2fC%3d650008.13445975.13532322.12832737%2fD%3dHPRM2%2fB%3d5706923%2fV%3d1';
O1 - Hosts: </script>
O1 - Hosts: <noscript><img width=1 height=1 alt="" src="http://us.bc.yahoo.com/b?P=j.Ah_9j8aIuVH8pzSp2qoCg9z37hF0qhY8gACN48&T=144j596l3%2fX%3d1252090825%2fE%3d2023010636%2fR%3dsmallbiz%2fK%3d5%2fV%3d2.1%2fW%3dH%2fY%3dYAHOO%2fF%3d1861688409%2fQ%3d-1%2fS%3d1%2fJ%3d8B68FCD8&U=13hn349r9%2fN%3d0Qw4Atj8a20-%2fC%3d650008.13445975.13532322.12832737%2fD%3dHPRM2%2fB%3d5706923%2fV%3d1"></noscript></div>
O1 - Hosts: <div id="pa"><div id="pa-wrapper"><ul id="pa2-nav" class="sp"><li class="pa1 sp"><a class="sp" href="http://us.ard.yahoo.com/SIG=15uqalioe/M=650008.13654021.13693393.13153902/D=smallbiz/S=2023010636:HEAD/Y=YAHOO/EXP=1252098025/L=j.Ah_9j8aIuVH8pzSp2qoCg9z37hF0qhY8gACN48/B=zgw4Atj8a20-/J=1252090825225621/K=pmFpaSqI9UgVSmAu3nNNgw/A=5836006/R=8/SIG=10jmd0d5u/*http://yahoo.com/" title="Yahoo!" target="_top">Yahoo!</a></li><li class="pa2 sp"><a class="sp" href="http://us.ard.yahoo.com/SIG=15uqalioe/M=650008.13654021.13693393.13153902/D=smallbiz/S=2023010636:HEAD/Y=YAHOO/EXP=1252098025/L=j.Ah_9j8aIuVH8pzSp2qoCg9z37hF0qhY8gACN48/B=zgw4Atj8a20-/J=1252090825225621/K=pmFpaSqI9UgVSmAu3nNNgw/A=5836006/R=9/SIG=10n3m6b64/*http://mail.yahoo.com" title="Yahoo! Mail" target="_top">Mail</a></li></ul><div id="pa-left" class="sp"></div><ul id="pa-nav" class="sp"><li class="pa3 sp"><a class="sp" href="http://us.ard.yahoo.com/SIG=15uqalioe/M=650008.13654021.13693393.13153902/D=smallbiz/S=2023010636:HEAD/Y=YAHOO/EXP=1252098025/L
O1 - Hosts: =j.Ah_9j8aIuVH8pzSp2qoCg9z37hF0qhY8gACN48/B=zgw4Atj8a20-/J=1252090825225621/K=pmFpaSqI9UgVSmAu3nNNgw/A=5836006/R=10/SIG=10l2nj3k8/*http://my.yahoo.com" title="My Yahoo!" target="_top">My Yahoo!</a></li><li class="pa4 sp"><a class="sp" href="http://us.ard.yahoo.com/SIG=15uqalioe/M=650008.13654021.13693393.13153902/D=smallbiz/S=2023010636:HEAD/Y=YAHOO/EXP=1252098025/L=j.Ah_9j8aIuVH8pzSp2qoCg9z37hF0qhY8gACN48/B=zgw4Atj8a20-/J=1252090825225621/K=pmFpaSqI9UgVSmAu3nNNgw/A=5836006/R=11/SIG=10niob72s/*http://news.yahoo.com" title="Yahoo! News" target="_top">News</a></li><li class="pa5 sp"><a class="sp" href="http://us.ard.yahoo.com/SIG=15uqalioe/M=650008.13654021.13693393.13153902/D=smallbiz/S=2023010636:HEAD/Y=YAHOO/EXP=1252098025/L=j.Ah_9j8aIuVH8pzSp2qoCg9z37hF0qhY8gACN48/B=zgw4Atj8a20-/J=1252090825225621/K=pmFpaSqI9UgVSmAu3nNNgw/A=5836006/R=12/SIG=10q40gpus/*http://finance.yahoo.com" title="Yahoo! Finance" target="_top">Finance</a></li><li class="pa6 sp"><a class="sp" href="http://us.ard.yahoo.com/SIG=15uqalioe/M=
O1 - Hosts: 650008.13654021.13693393.13153902/D=smallbiz/S=2023010636:HEAD/Y=YAHOO/EXP=1252098025/L=j.Ah_9j8aIuVH8pzSp2qoCg9z37hF0qhY8gACN48/B=zgw4Atj8a20-/J=1252090825225621/K=pmFpaSqI9UgVSmAu3nNNgw/A=5836006/R=13/SIG=10pcalhda/*http://sports.yahoo.com" title="Yahoo! Sports" target="_top">Sports</a></li></ul><div id="pa-right" class="sp"></div></div></div></div><div id="yahoo" class="ygmaclr"><div id="ygmabot"><a id="ygmalogo" href="http://us.ard.yahoo.com/SIG=15uqalioe/M=650008.13654021.13693393.13153902/D=smallbiz/S=2023010636:HEAD/Y=YAHOO/EXP=1252098025/L=j.Ah_9j8aIuVH8pzSp2qoCg9z37hF0qhY8gACN48/B=zgw4Atj8a20-/J=1252090825225621/K=pmFpaSqI9UgVSmAu3nNNgw/A=5836006/R=14/SIG=110k0lq1s/*http://smallbusiness.yahoo.com" target="_top"><img id="ygmalogoimg" width="265" height="33" src="http://l.yimg.com/a/i/us/geo/b/geo_ma_p_us_1.gif" alt="Yahoo! Small Business"></a></div><div id="ygma-search"><form class="ygmaclr" id="sf" action="http://search.yahoo.com/search" method="GET"><fieldset><span class="ygma-search-wrapper" role="
O1 - Hosts: application"><input class="sp" type="text" id="ygmasearchInput" name="p" value="Search" onblur="if (this.value == ''){this.value='Search';this.style.color='#999';this.style.fontWeight='normal';}" onfocus="if (this.value == 'Search'){this.value='';this.style.color='#000';this.style.fontWeight='bold';}" maxlength="100" autocomplete="off" /><input type="hidden" id="fr" name="fr" value="ush-smbizc" /><div id="sat"></div></span><span class="ygma-search-wrapper"><span class="btn sp"><span class="first-child"><button name="ygmasrchbtn" id="ygmasrchbtn" value="Web Search" type="submit">Web Search </button></span></span></span></fieldset></form></div></div></div></div></div><script charset="utf-8" type="text/javascript" src="http://l.yimg.com/a/lib/uh/15/js/uh-1.0.20.js"></script>
O1 - Hosts: <script language=javascript>
O1 - Hosts: if(window.yzq_d==null)window.yzq_d=new Object();
O1 - Hosts: window.yzq_d['zgw4Atj8a20-']='&U=13gmetml2%2fN%3dzgw4Atj8a20-%2fC%3d650008.13654021.13693393.13153902%2fD%3dHEAD%2fB%3d5836006%2fV%3d1';
O1 - Hosts: </script>
O1 - Hosts: </div>
O1 - Hosts: </div>
O1 - Hosts: <div class="ez-wr" style="width:898px;margin-top:1.5em">
O1 - Hosts: <Div class="ez-l2a" id="wrapper">
O1 - Hosts: <div class="ez-l2a-1 " style="width:898px">
O1 - Hosts: <div class="ez-box">    
O1 - Hosts: <div class="ez-wr" >
O1 - Hosts: <div class="ez-box" style="width:898px">
O1 - Hosts: <h1>Sorry, the GeoCities web site you were trying to reach is no longer available.</h1>
O1 - Hosts: </div>
O1 - Hosts: </div>
O1 - Hosts: <div class="ez-wr">
O1 - Hosts: <div class="ez-box" id="boxyahoourls">    
O1 - Hosts: <p> GeoCities has closed, but there's a lot more to explore on Yahoo!</p>
O1 - Hosts: <h2>Visit one of these popular Yahoo! sites:</h2>
O1 - Hosts: <ul class= "services">
O1 - Hosts: <li><a href="http://mail.yahoo.com">Yahoo! Mail</a></li>
O1 - Hosts: <li><a href="http://smallbusiness.yahoo.com/webhosting">Web Hosting</a></li>
O1 - Hosts: <li><a href="http://news.yahoo.com">News</a></li>
O1 - Hosts: <li><a href="http://games.yahoo.com">Games</a></li>
O1 - Hosts: <li><a href="http://sports.yahoo.com/">Sports</a>   </li>
O1 - Hosts: <li><a href="http://movies.yahoo.com">Movies</a></li>
O1 - Hosts: <li><a href="http://finance.yahoo.com">Finance</a></li>
O1 - Hosts: <li><a href="http://maps.yahoo.com">Maps</a></li>
O1 - Hosts: </ul>
O1 - Hosts: </div>
O1 - Hosts: <li class="rule"><!----></li> 
O1 - Hosts: <p>The GeoCities site you were looking for may have been preserved in the Internet Archive's Wayback Machine. To find out, <a href="http://www.archive.org/web/web.php" target="_blank">visit Archive.org</a> and enter the site's web address in the field provided.</p>
O1 - Hosts: <li class="rule"><!----></li> 
O1 - Hosts: </div>
O1 - Hosts: </div>
O1 - Hosts: </div>
O1 - Hosts: </div>
O1 - Hosts: <div class="ez-wr">
O1 - Hosts: <div class="ez-box" style="text-align:center; margin-top:25px;"> 
O1 - Hosts: <font size="-2" face="verdana">Copyright &copy; 2009 <a href="http://yahoo.com/">Yahoo!</a> Inc. All rights reserved.
O1 - Hosts: <ul>
O1 - Hosts: <li style="display:inline;"><a target="_top" href="http://privacy.yahoo.com/privacy/us/geo/">Privacy Policy</a></li> -
O1 - Hosts: <li style="display:inline;"><a target="_top" href="http://docs.yahoo.com/info/copyright/copyright.html">Copyright Policy</a></li> -
O1 - Hosts: <li style="display:inline;"><a target="_top" href="http://docs.yahoo.com/info/guidelines/community.html">Guidelines</a
O1 - Hosts: ></li> -
O1 - Hosts: <li style="display:inline;"><a target="_top" href="http://smallbusiness.yahoo.com/tos/tos.php">Terms of Service
O1 - Hosts: </a></li> -
O1 - Hosts: <li style="display:inline;"><a target="_top" href="http://help.yahoo.com/help/us/geo/">Help</a></li>
O1 - Hosts: </ul>
O1 - Hosts: </font> 
O1 - Hosts: </div> 
O1 - Hosts: </div>
O1 - Hosts: </div>
O1 - Hosts: </body>
O1 - Hosts: </html> 
O1 - Hosts: <!-- text below generated by server. PLEASE REMOVE --></object></layer></div></span></style></noscript></table></script></applet>
O1 - Hosts: <IMG SRC="http://geo.yahoo.com/serv?s=19190039&t=1390301312&f=us-w4" ALT=1 WIDTH=1 HEIGHT=1>
[...]
~ Hosts File:  Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 125



---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: Wincore Mediabar [64Bits] - {28387537-e3f9-4ed7-860c-11e69af4a8a0} . (.Pas de propriétaire - dtx Dynamic Link Library.) -- C:\Program Files (x86)\iMesh Applications\MediaBar\Datamngr\ToolBar\wincoreimdtx.dll =>PUP.iMesh
O2 - BHO: DivX Browser Bar FR [64Bits] - {834acc44-e0fc-4f17-8e6b-f1029b3bc0de} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files (x86)\DivX_Browser_Bar_FR\prxtbDivX.dll =>Toolbar.Conduit
~ BHO: 12 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: avast! Online Security - [HKLM]{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} . (.AVAST Software - IE Webrep plugin.) -- C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
~ Toolbar:  Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: ALFA Wireless LAN Utility.lnk . (.Realtek - ReStart MFC Application.)  -- C:\Program Files (x86)\REALTEK\RTL8187 Wireless LAN Utility\ReStart.exe 
O4 - GS\Desktop [Public]: Apps.lnk . (...)  -- C:\Users\Public\Libraries\Apps.library-ms 
O4 - GS\Desktop [Public]: Call of Duty Black Ops.lnk . (...)  -- F:\Program Files\c of d b ops\Call of Duty Black Ops\BlackOps.exe (.not file.)
O4 - GS\Desktop [Public]: Nedjma Easynet.lnk . (.Acresso Software Inc. - InstallShield.)  -- C:\Windows\Installer\{06ADE2A0-E46A-4A84-A211-64CF50520185}\HSPA_USB_Modem.exe_71C63DCD99CA46F398D474CE762A91C7.exe 
O4 - GS\Desktop [Public]: New Super Mario Forever.lnk . (.Game created by Michal Gdaniec, for Softend - This is a fangame created for fans! Have a.)  -- C:\Program Files (x86)\New Super Mario Bros 2012\New Super Mario Forever 2012.exe 
O4 - GS\Desktop [Public]: SDFormatter.lnk . (.TRENDY Corporation - Format Tool for SD Card [Normal Area Only].)  -- C:\Program Files (x86)\SDA\SD Formatter\SDFormatter.exe 
O4 - GS\Desktop [Public]: Section 8.lnk . (...)  -- G:\Program Files\Section 8\S8.exe 
O4 - GS\Desktop [Public]: Start BlueStacks.lnk . (.BlueStack Systems, Inc. - BlueStacks StartLauncher.)  -- C:\Program Files (x86)\BlueStacks\HD-StartLauncher.exe 
O4 - GS\Desktop [Public]: UltraISO.lnk . (.EZB Systems, Inc. - UltraISO Premium.)  -- C:\Program Files (x86)\UltraISO\UltraISO.exe 
O4 - GS\Desktop [Public]: VMware Workstation.lnk . (.VMware, Inc. - VMware Workstation.)  -- C:\Program Files (x86)\VMware\VMware Workstation\vmware.exe  =>.VMware, Inc
O4 - GS\QuickLaunch [djam-sisi]: Google Chrome.lnk . (.Google Inc. - Google Chrome.)  -- C:\Users\djam-sisi\AppData\Local\Google\Chrome\Application\chrome.exe 
O4 - GS\QuickLaunch [djam-sisi]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files (x86)\Internet Explorer\iexplore.exe 
O4 - GS\QuickLaunch [djam-sisi]: VMware Workstation.lnk . (.VMware, Inc. - VMware Workstation.)  -- C:\Program Files (x86)\VMware\VMware Workstation\vmware.exe  =>.VMware, Inc
O4 - GS\QuickLaunch [djam-sisi]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.)  -- C:\Users\djam-sisi\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\TaskBar [djam-sisi]: BitTorrent.lnk . (...)  -- C:\Users\djam-sisi\AppData\Roaming\BitTorrent\BitTorrent.exe (.not file.) =>P2P.BitTorrent
O4 - GS\TaskBar [djam-sisi]: Google Chrome.lnk . (.Google Inc. - Google Chrome.)  -- C:\Users\djam-sisi\AppData\Local\Google\Chrome\Application\chrome.exe 
O4 - GS\Program [djam-sisi]: Internet Explorer (64-bit).lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files (x86)\Internet Explorer\iexplore.exe 
O4 - GS\Program [djam-sisi]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files (x86)\Internet Explorer\iexplore.exe 
O4 - GS\SystemTools [djam-sisi]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files\Internet Explorer\iexplore.exe 
O4 - GS\Desktop [djam-sisi]: Battlefield 3.lnk . (...)  -- F:\Program Files\battlefield\Battlefield 3\bf3.exe (.not file.)
O4 - GS\Desktop [djam-sisi]: Big City Adventure - San Francisco.lnk . (.Jolly Bear Games - Big City Adventure: San Francisco.)  -- C:\Program Files (x86)\Jeux Rico\Big City Adventure - San Francisco\bigcityadventuresf.exe 
O4 - GS\Desktop [djam-sisi]: Outil de téléchargement USB DVD Windows 7.lnk . (.Microsoft Corporation - Microsoft Store ISO Backup Tool.)  -- C:\Users\djam-sisi\AppData\Local\Apps\Outil de téléchargement USB DVD Windows 7\Windows7-USB-DVD-Download-Tool.exe 
O4 - GS\Desktop [djam-sisi]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.)  -- C:\Users\djam-sisi\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
~ Global Startup: 83 Legitimates Filtered in 00mn 08s



---\\ Applications lancées au démarrage du sytème (O4)
O4 - GS\Startup [Public]: Microsoft Office.lnk . (.Microsoft Corporation - Microsoft Office 2000 component.)  -- C:\Program Files (x86)\Microsoft Office\Office\OSA9.exe 
O4 - GS\Startup [Public]: SRS Premium Sound.lnk . (.Acresso Software Inc. - InstallShield.)  -- C:\Windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe 
O4 - GS\Startup [djam-sisi]: HP SimpleSave Monitor.lnk . (...)  -- C:\Users\djam-sisi\AppData\Roaming\HP SimpleSave Application\StartHelper.exe
O4 - HKLM\..\Run: [ASUS WebStorage] . (...) -- C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe 
O4 - HKLM\..\Run: [SmartAudio] . (.Conexant systems, Inc. - SmartAudio Control Panel application.) -- C:\Program Files\CONEXANT\SAII\SAIICpl.exe 
O4 - HKLM\..\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd (.not file.) 
O4 - HKLM\..\Run: [System] . (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\Windows\System32\wscript.exe 
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe  =>.Microsoft Corporation
O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Users\djam-sisi\AppData\Local\Facebook\Update\FacebookUpdate.exe 
O4 - HKCU\..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (.not file.) 
O4 - HKCU\..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (.not file.) 
O4 - HKCU\..\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (.not file.) 
O4 - HKCU\..\Run: [com.apple.dav.bookmarks.daemon] C:\Program Files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe (.not file.) 
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe  =>.Skype Technologies S.A.
O4 - HKCU\..\Run: [iFunBox Price Watch] C:\Program Files (x86)\iFunbox 2013\iFunBox2013.exe (.not file.) 
O4 - HKCU\..\Run: [cacaoweb] . (...) -- C:\Users\djam-sisi\AppData\Roaming\cacaoweb\cacaoweb.exe =>PUP.CacaoWeb
O4 - HKCU\..\Run: [System] . (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\Windows\System32\wscript.exe 
O4 - HKCU\..\Run: [Tok-Cirrhatus] C:\Users\djam-sisi\AppData\Local\smss.exe (.not file.) 
O4 - HKCU\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files (x86)\Internet Download Manager\IDMan.exe 
O4 - HKLM\..\Wow6432Node\Run: [UpdateLBPShortCut] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe 
O4 - HKLM\..\Wow6432Node\Run: [UpdateP2GoShortCut] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe 
O4 - HKLM\..\Wow6432Node\Run: [Nuance PDF Reader-reminder] . (.Nuance Communications, Inc. - Ereg.) -- C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe 
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe  =>.Advanced Micro Devices, Inc
O4 - HKLM\..\Wow6432Node\Run: [ATKMEDIA] . (.ASUS - ATK Media.) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe 
O4 - HKLM\..\Wow6432Node\Run: [HControlUser] . (.ASUS - HControlUser.) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe 
O4 - HKLM\..\Wow6432Node\Run: [Wireless Console 3] . (.Pas de propriétaire - Wireless Console 3.) -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe 
O4 - HKLM\..\Wow6432Node\Run: [Syncables] C:\Program Files (x86)\syncables\syncables desktop\Syncables.exe (.not file.) 
O4 - HKLM\..\Wow6432Node\Run: [DATAMNGR] C:\Program Files (x86)\IMESHA~1\MediaBar\Datamngr\DATAMN~1.exe (.not file.) =>PUP.Datamngr
O4 - HKLM\..\Wow6432Node\Run: [SSDMonitor] . (.PC Tools - SSDMonit Application.) -- C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe 
O4 - HKLM\..\Wow6432Node\Run: [RMAlert] C:\Program Files (x86)\PC Tools Registry Mechanic\Alert.exe (.not file.) 
O4 - HKLM\..\Wow6432Node\Run: [DivXMediaServer] . (.DivX, LLC - DivX DLNA Media Server.) -- C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe 
O4 - HKLM\..\Wow6432Node\Run: [DivXUpdate] . (.Pas de propriétaire - DivX Update.) -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe 
O4 - HKLM\..\Wow6432Node\Run: [CLMLServer] . (.CyberLink - CyberLink MediaLibray Service.) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe 
O4 - HKLM\..\Wow6432Node\Run: [ASUS Screen Saver Protector] . (.ASUS - AsScrPro.) -- C:\Windows\AsScrPro.exe 
O4 - HKLM\..\Wow6432Node\Run: [vmware-tray] . (.VMware, Inc. - VMware Tray Process.) -- C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe  =>.VMware, Inc
O4 - HKLM\..\Wow6432Node\Run: [HSPALauncher] . (.Pas de propriétaire - HSDPALauncher MFC Application.) -- C:\Program Files (x86)\HSPA USB Modem\HSPALauncher.exe 
O4 - HKLM\..\Wow6432Node\Run: [BlueStacks Agent] . (.BlueStack Systems, Inc. - BlueStacks Agent.) -- C:\Program Files (x86)\BlueStacks\HD-Agent.exe 
O4 - HKLM\..\Wow6432Node\Run: [AvastUI.exe] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe 
O4 - HKLM\..\Wow6432Node\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe 
O4 - HKLM\..\Wow6432Node\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe 
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe  =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe  =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe  =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe  =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-4034133399-3538902260-959006464-1001\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe  =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-4034133399-3538902260-959006464-1001\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Users\djam-sisi\AppData\Local\Facebook\Update\FacebookUpdate.exe 
O4 - HKUS\S-1-5-21-4034133399-3538902260-959006464-1001\..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe (.not file.) 
O4 - HKUS\S-1-5-21-4034133399-3538902260-959006464-1001\..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (.not file.) 
O4 - HKUS\S-1-5-21-4034133399-3538902260-959006464-1001\..\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (.not file.) 
O4 - HKUS\S-1-5-21-4034133399-3538902260-959006464-1001\..\Run: [com.apple.dav.bookmarks.daemon] C:\Program Files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe (.not file.) 
O4 - HKUS\S-1-5-21-4034133399-3538902260-959006464-1001\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe  =>.Skype Technologies S.A.
O4 - HKUS\S-1-5-21-4034133399-3538902260-959006464-1001\..\Run: [iFunBox Price Watch] C:\Program Files (x86)\iFunbox 2013\iFunBox2013.exe (.not file.) 
O4 - HKUS\S-1-5-21-4034133399-3538902260-959006464-1001\..\Run: [cacaoweb] . (...) -- C:\Users\djam-sisi\AppData\Roaming\cacaoweb\cacaoweb.exe =>PUP.CacaoWeb
O4 - HKUS\S-1-5-21-4034133399-3538902260-959006464-1001\..\Run: [System] . (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\Windows\System32\wscript.exe 
O4 - HKUS\S-1-5-21-4034133399-3538902260-959006464-1001\..\Run: [Tok-Cirrhatus] C:\Users\djam-sisi\AppData\Local\smss.exe (.not file.) 
O4 - HKUS\S-1-5-21-4034133399-3538902260-959006464-1001\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files (x86)\Internet Download Manager\IDMan.exe 
~ Application:  Scanned in 00mn 01s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{22233746-4173-4B38-815D-968AF7D7962C}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{C66E55B5-2CFF-4EC5-8007-D1A95135B79D}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{22233746-4173-4B38-815D-968AF7D7962C}: DhcpDomain = mshome.net
O17 - HKLM\System\CS1\Services\Tcpip\..\{22233746-4173-4B38-815D-968AF7D7962C}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{C66E55B5-2CFF-4EC5-8007-D1A95135B79D}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{22233746-4173-4B38-815D-968AF7D7962C}: DhcpDomain = mshome.net
O17 - HKLM\System\CS2\Services\Tcpip\..\{22233746-4173-4B38-815D-968AF7D7962C}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{C66E55B5-2CFF-4EC5-8007-D1A95135B79D}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{22233746-4173-4B38-815D-968AF7D7962C}: DhcpDomain = mshome.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain:  Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll  =>.Microsoft Corporation
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll  =>.Microsoft Corporation
~ Protocole Additionnel:  Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - AppInit_DLLs: . (.iMesh, Inc - Data Manager.) - C:\Program Files (x86)\IMESHA~1\MediaBar\Datamngr\x64\datamngr.dll =>PUP.Datamngr
~ AppInit DLL:  Scanned in 00mn 00s



---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [Norton Security Scan for djam-sisi] (...) -- C:\Program Files (x86)\NORTON~2\Engine\351~1.10\Nss.exe (.not file.)   [0]
[MD5.00000000000000000000000000000000] [APT] [RMAutoUpdate] (...) -- C:\Program Files (x86)\PC Tools Registry Mechanic\SULauncher.exe (.not file.)   [0]
[MD5.00000000000000000000000000000000] [APT] [RMSchedule] (...) -- C:\Program Files (x86)\PC Tools Registry Mechanic\RegMech.exe (.not file.)   [0]
[MD5.00000000000000000000000000000000] [APT] [{3086C1C8-1A52-4102-ABE0-9F3B7282A8EA}] (...) -- H:\photo\siham resto\siham restao.exe (.not file.)   [0]
[MD5.00000000000000000000000000000000] [APT] [{6308AFEB-2BE6-4B33-B3B2-07ECA3EA2E58}] (...) -- C:\Program Files (x86)\syncables\syncables desktop\syncablesHost.exe (.not file.)   [0]
[MD5.00000000000000000000000000000000] [APT] [{AF835E76-A835-4D9A-B6AE-89D06FB72ED1}] (...) -- C:\Program Files (x86)\syncables\syncables desktop\syncablesHost.exe (.not file.)   [0]
~ Scheduled Task: 35 Legitimates Filtered in 00mn 14s



---\\ Logiciels installés (O42)
O42 - Logiciel: Facetheme - (.facetheme.com.) [HKLM][64Bits] -- facetheme-apl =>PUP.FCTPlugin
~ Logic: 25 Legitimates Filtered in 00mn 01s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\1ClickDownload] =>PUP.1ClickDownloader
[HKCU\Software\49034InstEnd]
[HKCU\Software\Conduit] =>Toolbar.Conduit
[HKCU\Software\PCTools]
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKCU\Software\SweetIM] =>PUP.SweetIM
[HKCU\Software\cacaoweb] =>PUP.CacaoWeb
[HKLM\Software\DataMngr] =>PUP.Datamngr
[HKLM\Software\Wow6432Node\PCTools]
[HKLM\Software\Wow6432Node\SimplyGen] =>Adware.PredictAd
[HKLM\Software\Wow6432Node\SweetIM] =>PUP.SweetIM
[HKLM\Software\Wow6432Node\VooMuu]
~ Key Software: 283 Legitimates Filtered in 00mn 01s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 21/01/2012 - 21:00:51 - [0,632] ----D C:\Program Files (x86)\Babylon =>PUP.Babylon
O43 - CFD: 29/04/2012 - 09:51:23 - [0,077] ----D C:\Program Files (x86)\BasicScan =>Adware.BasicScan
O43 - CFD: 23/05/2012 - 23:38:10 - [0,609] ----D C:\Program Files (x86)\Conduit
O43 - CFD: 21/09/2012 - 22:13:12 - [0,022] ----D C:\Program Files (x86)\DealPly =>PUP.DealPly
O43 - CFD: 21/09/2012 - 22:31:20 - [0,005] ----D C:\Program Files (x86)\Iminent =>Adware.IMBooster
O43 - CFD: 21/01/2014 - 13:20:50 - [22,380] ----D C:\Program Files (x86)\Jeux Rico
O43 - CFD: 24/01/2014 - 23:56:21 - [0,063] ----D C:\Program Files (x86)\Object
O43 - CFD: 22/01/2012 - 00:20:50 - [0,063] ----D C:\Program Files (x86)\OfferBox =>PUP.OfferBox
O43 - CFD: 30/01/2012 - 20:09:20 - [0,057] ----D C:\Program Files (x86)\PriceGong =>Adware.PriceGong
O43 - CFD: 04/06/2013 - 21:59:18 - [3,651] ----D C:\Program Files (x86)\searchweb =>Adware.SocialSkinz
O43 - CFD: 23/09/2013 - 19:02:04 - [0] ----D C:\Program Files (x86)\SweetIM =>PUP.SweetIM
O43 - CFD: 05/12/2012 - 21:35:08 - [0,005] ----D C:\Program Files (x86)\VooMuu
O43 - CFD: 25/02/2012 - 23:29:50 - [0] ----D C:\ProgramData\100
O43 - CFD: 02/09/2012 - 19:24:19 - [0,004] ----D C:\ProgramData\13EA
O43 - CFD: 24/11/2012 - 17:40:32 - [0,004] ----D C:\ProgramData\20D7
O43 - CFD: 18/04/2012 - 21:04:58 - [0] ----D C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
O43 - CFD: 09/01/2013 - 20:41:43 - [0,004] ----D C:\ProgramData\2BCB
O43 - CFD: 29/01/2012 - 21:53:46 - [0,004] ----D C:\ProgramData\2E9B
O43 - CFD: 04/07/2012 - 14:39:44 - [0] ----D C:\ProgramData\Ask
O43 - CFD: 20/09/2012 - 23:37:04 - [93,551] ----D C:\ProgramData\Babylon =>PUP.Babylon
O43 - CFD: 07/01/2012 - 22:42:12 - [0] ----D C:\ProgramData\boost_interprocess
O43 - CFD: 22/05/2013 - 11:18:58 - [0,057] ----D C:\ProgramData\Conduit
O43 - CFD: 25/02/2012 - 23:29:51 - [1,143] ----D C:\ProgramData\InstallMate =>PUP.Tarma
O43 - CFD: 25/01/2014 - 23:49:36 - [0] ----D C:\ProgramData\metier2000Apps
O43 - CFD: 12/01/2011 - 16:50:29 - [1,447] ----D C:\ProgramData\Partner
O43 - CFD: 19/04/2012 - 12:40:38 - [0,841] ----D C:\ProgramData\VooMuuSA
O43 - CFD: 04/11/2012 - 16:53:48 - [34,642] ----D C:\ProgramData\~Browser Manager
O43 - CFD: 21/01/2012 - 21:16:46 - [1,248] ----D C:\Users\djam-sisi\AppData\Roaming\Babylon =>PUP.Babylon
O43 - CFD: 29/01/2014 - 14:45:50 - [0,465] ----D C:\Users\djam-sisi\AppData\Roaming\cacaoweb =>PUP.CacaoWeb
O43 - CFD: 17/04/2012 - 22:46:04 - [0] ----D C:\Users\djam-sisi\AppData\Roaming\eType
O43 - CFD: 22/01/2012 - 00:20:47 - [0,269] ----D C:\Users\djam-sisi\AppData\Roaming\OfferBox =>PUP.OfferBox
O43 - CFD: 06/01/2014 - 10:25:38 - [0,357] ----D C:\Users\djam-sisi\AppData\Local\Alexa
O43 - CFD: 21/09/2012 - 22:13:14 - [19,027] ----D C:\Users\djam-sisi\AppData\Local\Babylon =>PUP.Babylon
O43 - CFD: 05/12/2012 - 21:35:12 - [1,263] ----D C:\Users\djam-sisi\AppData\Local\BrightBreezeSA =>Adware.SPointer
O43 - CFD: 01/02/2012 - 00:00:00 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-1 =>Worm.Brontok
O43 - CFD: 10/02/2012 - 21:55:53 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-10 =>Worm.Brontok
O43 - CFD: 11/02/2012 - 13:39:47 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-11 =>Worm.Brontok
O43 - CFD: 12/02/2012 - 22:04:12 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-12 =>Worm.Brontok
O43 - CFD: 13/02/2012 - 10:31:47 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-13 =>Worm.Brontok
O43 - CFD: 14/02/2012 - 14:55:50 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-14 =>Worm.Brontok
O43 - CFD: 15/02/2012 - 00:00:00 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-15 =>Worm.Brontok
O43 - CFD: 16/12/2011 - 21:07:21 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-16 =>Worm.Brontok
O43 - CFD: 17/12/2011 - 00:00:00 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-17 =>Worm.Brontok
O43 - CFD: 18/12/2011 - 00:00:01 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-18 =>Worm.Brontok
O43 - CFD: 19/01/2012 - 00:00:00 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-19 =>Worm.Brontok
O43 - CFD: 02/02/2012 - 00:00:00 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-2 =>Worm.Brontok
O43 - CFD: 20/01/2012 - 13:14:14 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-20 =>Worm.Brontok
O43 - CFD: 21/01/2012 - 00:00:01 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-21 =>Worm.Brontok
O43 - CFD: 22/01/2012 - 00:00:01 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-22 =>Worm.Brontok
O43 - CFD: 23/01/2012 - 00:00:01 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-23 =>Worm.Brontok
O43 - CFD: 24/01/2012 - 00:00:00 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-24 =>Worm.Brontok
O43 - CFD: 25/01/2012 - 00:00:01 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-25 =>Worm.Brontok
O43 - CFD: 26/01/2012 - 00:00:01 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-26 =>Worm.Brontok
O43 - CFD: 27/01/2012 - 00:00:01 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-27 =>Worm.Brontok
O43 - CFD: 28/01/2012 - 00:00:01 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-28 =>Worm.Brontok
O43 - CFD: 29/01/2012 - 00:16:49 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-29 =>Worm.Brontok
O43 - CFD: 03/02/2012 - 00:00:00 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-3 =>Worm.Brontok
O43 - CFD: 30/01/2012 - 00:00:00 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-30 =>Worm.Brontok
O43 - CFD: 31/01/2012 - 00:00:01 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-31 =>Worm.Brontok
O43 - CFD: 04/02/2012 - 14:44:44 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-4 =>Worm.Brontok
O43 - CFD: 05/02/2012 - 10:01:11 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-5 =>Worm.Brontok
O43 - CFD: 06/02/2012 - 21:40:42 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-6 =>Worm.Brontok
O43 - CFD: 07/02/2012 - 14:43:23 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-7 =>Worm.Brontok
O43 - CFD: 08/02/2012 - 12:48:36 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-8 =>Worm.Brontok
O43 - CFD: 09/02/2012 - 01:00:58 - [0] ----D C:\Users\djam-sisi\AppData\Local\Bron.tok-12-9 =>Worm.Brontok
O43 - CFD: 22/05/2013 - 11:23:35 - [0,083] ----D C:\Users\djam-sisi\AppData\Local\Conduit
O43 - CFD: 18/01/2014 - 19:12:53 - [0,007] ----D C:\Users\djam-sisi\AppData\Local\Loc.Mail.Bron.Tok =>Worm.Brontok
O43 - CFD: 21/09/2012 - 22:13:11 - [0,352] ----D C:\Users\djam-sisi\AppData\Local\Lollipop =>Adware.Lollipop
O43 - CFD: 25/01/2014 - 23:49:42 - [0,055] ----D C:\Users\djam-sisi\AppData\Local\metier2000Apps
O43 - CFD: 16/12/2011 - 21:12:50 - [0] ----D C:\Users\djam-sisi\AppData\Local\Ok-SendMail-Bron-tok
O43 - CFD: 03/07/2012 - 23:02:58 - [0] ----D C:\Users\djam-sisi\AppData\Local\roulettechat
~ 47 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 337 Legitimates Filtered in 01mn 41s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.678C7EA24776534FF6DDF491A4F86005] - 23/01/2014 - 19:02:46 ---A- . (...) -- C:\Windows\RtlUI2.exe.manifest   [901]
~ Files: 26 Legitimates Filtered in 00mn 15s



---\\ Clé de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{39fb806d-2761-11e1-a3cf-f46d04860cf9}\AutoRun\command. (...) -- F:\LaunchU3.exe (.not file.)
O51 - MPSK:{d2b214b6-6ca0-11e3-8c9f-005056c00008}\AutoRun\command. (...) -- F:\autorun.exe (.not file.)
O51 - MPSK:{d2b214c4-6ca0-11e3-8c9f-005056c00008}\AutoRun\command. (...) -- G:\autorun.exe (.not file.)
~ Keys:  Scanned in 00mn 00s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 17 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 4 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.C04F7B373881009D7994D9BF55D24AB4] - 24/01/2014 - 23:05:24 ---A- . (...) -- C:\Windows\System32\Drivers\aswRvrt.sys   [65776]
O58 - SDL:[MD5.90399625F341AB76BA4B85A5E860EB1F] - 24/01/2014 - 23:05:24 ---A- . (...) -- C:\Windows\System32\Drivers\aswVmm.sys   [207904]
O58 - SDL:[MD5.779F499D7791F65F6A5BA97C5D2627C8] - 29/08/2008 - 17:54:30 ---A- . (.Mobile Connector - USB/Serial Device Driver.) -- C:\Windows\System32\Drivers\cmusbser.sys   [118144]
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys   [530496]
O58 - SDL:[MD5.0975BF32399A24117E317B5BF1D5D0AA] - 13/04/2010 - 11:15:04 ---A- . (.ELAN Microelectronic Corp. - ETD Control Center.) -- C:\Windows\System32\Drivers\ETD.sys   [135560]
O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys   [31232]
O58 - SDL:[MD5.929DF302F15BFE24AC66EF45D858C413] - 28/11/2013 - 01:24:18 ---A- . (.Tonec Inc. - Internet Download Manager WFP Driver.) -- C:\Windows\System32\Drivers\idmwfp.sys   [175480]
O58 - SDL:[MD5.E63EF8C3271D014F14E2469CE75FECB4] - 20/07/2009 - 10:29:40 ---A- . (.Pas de propriétaire - Keyboard Filter Driver.) -- C:\Windows\System32\Drivers\kbfiltr.sys   [15416]
O58 - SDL:[MD5.19D8F6FF8344C47872BA351D04A190DD] - 05/06/2009 - 11:15:56 ---A- . (.Pas de propriétaire - USBCAMD for Sonix UVC.) -- C:\Windows\System32\Drivers\sncduvc.sys   [42176]
O58 - SDL:[MD5.1D8474722CDFFBB8FCA5FA12C50A05A2] - 05/06/2009 - 11:15:58 ---A- . (.Pas de propriétaire - UVC Camera Streaming Driver.) -- C:\Windows\System32\Drivers\snp2uvc.sys   [1806400]
O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise  SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys   [24656]
O58 - SDL:[MD5.C45A3E051C65106A28982CAED125F855] - 06/08/2009 - 22:17:34 ---A- . (...) -- C:\Windows\System32\Drivers\TurboB.sys   [13784]
O58 - SDL:[MD5.C9E9D59C0099A9FF51697E9306A44240] - 13/12/2012 - 12:50:36 ---A- . (.Apple, Inc. - Apple Mobile Device USB Driver.) -- C:\Windows\System32\Drivers\usbaapl64.sys   [54784]
O58 - SDL:[MD5.DDEE99DC54EFA20BD5A442CD733C4462] - 20/03/2013 - 09:07:16 ---A- . (...) -- C:\Windows\SysWOW64\FsUsbExDisk.Sys   [37344]
~ Drivers: 17 Legitimates Filtered in 02mn 17s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1  =>.Nicolas Coolman
~ ADS:  Scanned in 00mn 00s



---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 03/08/2007 - C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys (ghaio) .(...) - LEGACY_GHAIO
~ Legacy: 93 Legitimates Filtered in 00mn 03s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <Google Chrome.OJD4S3N6Q4XWJ76M7VVOSFJVQY> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\djam-sisi\AppData\Local\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys:  Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKUS\.DEFAULT] {33524C00-63FB-43DB-A6BF-0A4E14B24649} - (BasicScan) - http://www.basicscan.com =>Adware.BasicScan
O69 - SBI: SearchScopes [HKUS\S-1-5-18] {33524C00-63FB-43DB-A6BF-0A4E14B24649} - (BasicScan) - http://www.basicscan.com =>Adware.BasicScan
~ Keys:  Scanned in 00mn 00s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.90E1D86D979B92738A47D7072CB22DA8] [SPRF][07/07/2010] (...) -- C:\ProgramData\FullRemove.exe   [131472]
[MD5.A4896566BC71C597E285340691A4B2D9] [SPRF][24/01/2014] (...) -- C:\Users\djam-sisi\AppData\Local\Bron.tok.A12.em.bin   [12393]  =>Worm.Brontok
[MD5.EEBF00DDC231303483BCD47CE9A6DBE6] [SPRF][24/01/2014] (...) -- C:\Users\djam-sisi\AppData\Local\Update.12.Bron.Tok.bin   [12393]  =>Worm.Brontok
[MD5.90D787A2DF45B1E82C276DFD1A91AE61] [SPRF][29/01/2014] (...) -- C:\Users\djam-sisi\Desktop\cacaoweb.exe   [471552]  =>PUP.CacaoWeb
[MD5.307771C61D8DB417E1A89A25BF3E3F43] [SPRF][03/01/2014] (.BitTorrent Inc. - µTorrent.) -- C:\Users\djam-sisi\Desktop\utorrent-1-.exe   [1142864]  =>P2P.BitTorrent
~ Files: 5 Legitimates Filtered in 00mn 00s



---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{8814CB78-7E79-45F8-AF92-7C1B4FB4D956}" |In - Domain - P6 - TRUE | .(...) -- C:\Program Files (x86)\iMesh Applications\iMesh\iMesh.exe (.not file.) =>PUP.iMesh
O87 - FAEL: "{DCDF3EBE-1CB7-4C2E-BBAF-B45B28FFD113}" |In - Domain - P17 - TRUE | .(...) -- C:\Program Files (x86)\iMesh Applications\iMesh\iMesh.exe (.not file.) =>PUP.iMesh
O87 - FAEL: "TCP Query User{C62E67B6-BD09-499B-B4DC-F30DEC7357B5}C:\program files (x86)\imesh applications\imesh\imesh.exe" |In - Private - P6 - TRUE | .(...) -- C:\program files (x86)\imesh applications\imesh\imesh.exe (.not file.) =>PUP.iMesh
O87 - FAEL: "UDP Query User{1915EFAC-9B50-4CB8-8CC6-F8D6EE726A8C}C:\program files (x86)\imesh applications\imesh\imesh.exe" |In - Private - P17 - TRUE | .(...) -- C:\program files (x86)\imesh applications\imesh\imesh.exe (.not file.) =>PUP.iMesh
O87 - FAEL: "{B37EFA00-2A38-449D-BBD3-5F84F83C7FD7}" | In - Private - P6 - TRUE | .(.Visicom Media Inc. - DTX broker.) -- C:\Program Files (x86)\iMesh Applications\MediaBar\Datamngr\ToolBar\dtUser.exe =>PUP.Datamngr
O87 - FAEL: "{D441C964-965B-4E77-A63A-15FF255C3030}" | In - Private - P17 - TRUE | .(.Visicom Media Inc. - DTX broker.) -- C:\Program Files (x86)\iMesh Applications\MediaBar\Datamngr\ToolBar\dtUser.exe =>PUP.Datamngr
O87 - FAEL: "TCP Query User{61B7902E-F74A-486E-BE93-3443FE9095B4}C:\users\djam-sisi\appdata\roaming\cacaoweb\cacaoweb.exe" | In - Private - P6 - TRUE | .(...) -- C:\users\djam-sisi\appdata\roaming\cacaoweb\cacaoweb.exe =>PUP.CacaoWeb
O87 - FAEL: "UDP Query User{1BD69413-C126-428B-AF48-014DC87BA5F8}C:\users\djam-sisi\appdata\roaming\cacaoweb\cacaoweb.exe" | In - Private - P17 - TRUE | .(...) -- C:\users\djam-sisi\appdata\roaming\cacaoweb\cacaoweb.exe =>PUP.CacaoWeb
O87 - FAEL: "{AC55CC7B-4CD3-444D-A1CE-FA3C921FFC6D}" | In - Public - P17 - TRUE | .(...) -- C:\users\djam-sisi\appdata\roaming\cacaoweb\cacaoweb.exe =>PUP.CacaoWeb
O87 - FAEL: "{815B1D83-12B8-4B79-B832-456E639F337D}" | In - Public - P6 - TRUE | .(...) -- C:\users\djam-sisi\appdata\roaming\cacaoweb\cacaoweb.exe =>PUP.CacaoWeb
~ Firewall: 242 Legitimates Filtered in 00mn 03s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 15/08/2012 250056 |  (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 10/07/1658 0 |  (ADSMService) . (...) - C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe
SS - | Auto 12/01/2011 135664 |  (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 12/01/2011 135664 |  (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 12/01/2011 182768 |  (gusvc) . (.Google.) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Auto 23/10/2013 172192 |  (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Demand 03/08/2007 125496 |  (spmgr) . (...) - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
SS - | Demand 02/10/2008 191024 |  (ufad-ws60) . (.VMware, Inc..) - C:\Program Files (x86)\VMware\VMware Workstation\vmware-ufad.exe  =>.VMware, Inc

SR - | Auto 11/08/2010 203264 |  (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 21/12/2012 57008 |  (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 16/06/2009 84536 |  (ASLDRService) . (.ASUS.) - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
SR - | Auto 15/12/2009 96896 |  (ATKGFNEXSrv) . (.ASUS.) - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
SR - | Auto 24/01/2014 50344 |  (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SR - | Auto 01/07/2010 83512 |  (BackupService) . (.ArcSoft, Inc..) - C:\Users\djam-sisi\AppData\Roaming\HP SimpleSave Application\uUACTokenSvc.exe
SR - | Auto 30/08/2011 462184 |  (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Auto 20/12/2013 402192 |  (BstHdAndroidSvc) . (.BlueStack Systems, Inc..) - C:\Program Files (x86)\BlueStacks\HD-Service.exe
SR - | Auto 20/12/2013 385808 |  (BstHdLogRotatorSvc) . (.BlueStack Systems, Inc..) - C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
SR - | Demand 16/08/2013 641352 |  (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SR - | Auto 01/10/2009 262144 |  (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
SR - | Auto 21/03/2012 793048 |  (PCToolsSSDMonitorSvc) . (.PC Tools.) - C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe
SR - | Auto 07/12/2009 40960 |  (Realtek87B) . (.Realtek.) - C:\Program Files (x86)\REALTEK\RTL8187 Wireless LAN Utility\RtlService.exe
SR - | Auto 01/10/2009 2314240 |  (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
SR - | Auto 28/10/2008 113200 |  (VMAuthdService) . (.VMware, Inc..) - C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe  =>.VMware, Inc
SR - | Auto 10/07/1658 0 |  (VMnetDHCP) . (.VMware, Inc..) - C:\Windows\system32\vmnetdhcp.exe
SR - | Auto 10/07/1658 0 |  (VMware NAT Service) . (.VMware, Inc..) - C:\Windows\system32\vmnat.exe
SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 10/07/1658 0 |  (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe  =>.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

~ Services:  Scanned in 02mn 23s



---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Run by djam-sisi at 29/01/2014 18:37:01
~ OS 64 not supported by MBR tool

~ MBR: 0 Legitimates Filtered in 00mn 00s



---\\ Scan Additionnel (O88)
Database Version : 13030 - (25/01/2014)
Clés trouvées (Keys found) : 157
Valeurs trouvées (Values found) : 3
Dossiers trouvés  (Folders found) : 66
Fichiers trouvés  (Files found) : 6

[HKLM\Software\Google\Chrome\Extensions\gebbadcnkcgcfgpbmcdleckpejgopimf]   =>PUP.CacaoWeb^
[HKLM\Software\Google\Chrome\Extensions\leahdjjpjmnamomgpojikeapflgbmjab]   =>PUP.CacaoWeb^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28387537-E3F9-4ED7-860C-11E69AF4A8A0}]   =>PUP.iMesh^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{834ACC44-E0FC-4F17-8E6B-F1029B3BC0DE}]   =>Toolbar.Conduit^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\facetheme-apl]   =>PUP.FCTPlugin^
[HKLM\Software\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}]   =>Adware.IMBooster
[HKLM\Software\Wow6432Node\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}]   =>Adware.IMBooster
[HKLM\Software\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}]   =>Adware.IMBooster
[HKLM\Software\Wow6432Node\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}]   =>Adware.IMBooster
[HKLM\Software\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}]   =>Adware.IMBooster
[HKLM\Software\Wow6432Node\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}]   =>Adware.IMBooster
[HKLM\Software\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}]   =>PUP.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}]   =>PUP.Babylon
[HKLM\Software\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}]   =>Adware.IMBooster
[HKLM\Software\Wow6432Node\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}]   =>Adware.IMBooster
[HKLM\Software\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}]   =>PUP.RewardsArcade
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{28387537-E3F9-4ED7-860C-11E69AF4A8A0}]   =>Toolbar.Agent
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{28387537-E3F9-4ED7-860C-11E69AF4A8A0}]   =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28387537-E3F9-4ED7-860C-11E69AF4A8A0}]   =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28387537-E3F9-4ED7-860C-11E69AF4A8A0}]   =>Toolbar.Agent
[HKLM\Software\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\CLSID\{474597C5-AB09-49d6-A4D5-2E8D7341384E}]   =>PUP.iMesh
[HKLM\Software\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}]   =>Adware.SocialSkinz
[HKLM\Software\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65bcd620-07dd-012f-819f-073cf1b8f7c6}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}]   =>Adware.IMBooster
[HKLM\Software\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\TypeLib\{A147AA03-820F-4A0F-9F34-D6CB4004A2F9}]   =>PUP.iMesh
[HKLM\Software\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\AppID\{AC662AF2-4601-4A68-84DF-A3FE83F1A5F9}]   =>Adware.Bandoo
[HKLM\Software\Wow6432Node\Classes\AppID\{AC662AF2-4601-4A68-84DF-A3FE83F1A5F9}]   =>Adware.Bandoo
[HKLM\Software\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}]   =>Adware.CDNHelper
[HKLM\Software\Wow6432Node\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}]   =>Adware.CDNHelper
[HKLM\Software\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}]   =>Toolbar.Wajam
[HKLM\Software\Wow6432Node\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}]   =>Toolbar.Wajam
[HKLM\Software\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}]   =>Adware.Bandoo
[HKLM\Software\Wow6432Node\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}]   =>Adware.Bandoo
[HKLM\Software\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08}]   =>Adware.IMBooster
[HKLM\Software\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}]   =>PUP.RewardsArcade
[HKLM\Software\Wow6432Node\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}]   =>PUP.RewardsArcade
[HKLM\Software\Classes\AppID\BrowserConnection.dll]   =>Adware.Bandoo
[HKLM\Software\Classes\AppID\DNSBHO.dll]   =>Adware.Bandoo
[HKLM\Software\Classes\AppID\escort.dll]   =>PUP.Babylon
[HKLM\Software\Classes\BrowserConnection.Loader]   =>Adware.Bandoo
[HKLM\Software\Classes\BrowserConnection.Loader.1]   =>Adware.Bandoo
[HKLM\Software\Classes\DnsBHO.BHO]   =>Adware.Bandoo
[HKLM\Software\Classes\DnsBHO.BHO.1]   =>Adware.Bandoo
[HKCU\Software\1ClickDownload]   =>PUP.1ClickDownloader
[HKCU\Software\cacaoweb]   =>PUP.CacaoWeb
[HKLM\Software\DataMngr]   =>Adware.Bandoo
[HKCU\Software\Softonic]   =>Toolbar.Conduit
[HKCU\Software\SweetIM]   =>PUP.SweetIM
[HKLM\Software\Wow6432Node\SweetIM]   =>PUP.SweetIM
[HKLM\Software\Wow6432Node\SimplyGen]   =>Adware.PredictAd
[HKLM\Software\Wow6432Node\Microsoft\Tracing\Iminent_RASAPI32]   =>Adware.Bandoo
[HKLM\Software\Wow6432Node\Microsoft\Tracing\Iminent_RASMANCS]   =>Adware.Bandoo
[HKLM\Software\Wow6432Node\Microsoft\Tracing\MyBabylontb_RASAPI32]   =>PUP.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Tracing\MyBabylontb_RASMANCS]   =>PUP.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP]   =>Adware.IMBooster
[HKLM\Software\Classes\Prod.cap]   =>PUP.Babylon
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375]   =>PUP.Tarma
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5]   =>PUP.Tarma
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BE7A24F5-69CB-4708-B77B-B1EDA6043B95}]   =>PUP.iMesh
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BE7A24F5-69CB-4708-B77B-B1EDA6043B95}]   =>PUP.iMesh
[HKLM\Software\Classes\CLSID\{BE7A24F5-69CB-4708-B77B-B1EDA6043B95}]   =>PUP.iMesh
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BE7A24F5-69CB-4708-B77B-B1EDA6043B95}]   =>PUP.iMesh
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BE7A24F5-69CB-4708-B77B-B1EDA6043B95}]   =>PUP.iMesh
[HKLM\Software\Classes\CLSID\{950F80EF-32C2-47DD-9C35-9576E21EE66E}]   =>PUP.Datamngr
[HKLM\Software\Wow6432Node\Microsoft\Tracing\I Want This_RASAPI32]   =>Adware.GamePlayLabs
[HKLM\Software\Wow6432Node\Microsoft\Tracing\I Want This_RASMANCS]   =>Adware.GamePlayLabs
[HKCU\Software\AppDataLow\Software\Crossrider]   =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Microsoft\Tracing\ConduitInstaller_RASAPI32]   =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Microsoft\Tracing\ConduitInstaller_RASMANCS]   =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\facetheme-apl]   =>PUP.FCTPlugin
[HKLM\Software\Classes\Toolbar.CT3128284]   =>Toolbar.Conduit
[HKLM\Software\Classes\Toolbar.CT3297124]   =>Toolbar.Conduit
[HKLM\Software\Classes\AppID\wajam.DLL]   =>PUP.Wajam
[HKLM\Software\Wow6432Node\Classes\Toolbar.CT3128284]   =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Toolbar.CT3297124]   =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011221158}]   =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Classes\AppID\escort.DLL]   =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\wajam.DLL]   =>PUP.Wajam
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}]   =>Adware.Bandoo^
[HKLM\Software\Wow6432Node\Classes\CLSID\{3c471948-f874-49f5-b338-4f214a2ee0b1}]   =>Toolbar.Conduit^
[HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks]:{834acc44-e0fc-4f17-8e6b-f1029b3bc0de}   =>Toolbar.Conduit^
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:cacaoweb   =>PUP.CacaoWeb^
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:DATAMNGR   =>PUP.Datamngr^
C:\Users\djam-sisi\AppData\Local\Google\Chrome\User Data\Default\Extensions\gebbadcnkcgcfgpbmcdleckpejgopimf   =>PUP.CacaoWeb^
C:\Users\djam-sisi\AppData\Local\Google\Chrome\User Data\Default\Extensions\leahdjjpjmnamomgpojikeapflgbmjab   =>PUP.CacaoWeb^
C:\Program Files (x86)\Babylon   =>PUP.Babylon^
C:\Program Files (x86)\BasicScan   =>Adware.BasicScan^
C:\Program Files (x86)\DealPly   =>PUP.DealPly^
C:\Program Files (x86)\Iminent   =>Adware.IMBooster^
C:\Program Files (x86)\OfferBox   =>PUP.OfferBox^
C:\Program Files (x86)\PriceGong   =>Adware.PriceGong^
C:\Program Files (x86)\searchweb   =>Adware.SocialSkinz^
C:\Program Files (x86)\SweetIM   =>PUP.SweetIM^
C:\ProgramData\Babylon   =>PUP.Babylon^
C:\ProgramData\InstallMate   =>PUP.Tarma^
C:\Users\djam-sisi\AppData\Roaming\Babylon   =>PUP.Babylon^
C:\Users\djam-sisi\AppData\Roaming\cacaoweb   =>PUP.CacaoWeb^
C:\Users\djam-sisi\AppData\Roaming\OfferBox   =>PUP.OfferBox^
C:\Users\djam-sisi\AppData\Local\Babylon   =>PUP.Babylon^
C:\Users\djam-sisi\AppData\Local\BrightBreezeSA   =>Adware.SPointer^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-1   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-10   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-11   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-12   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-13   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-14   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-15   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-16   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-17   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-18   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-19   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-2   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-20   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-21   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-22   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-23   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-24   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-25   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-26   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-27   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-28   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-29   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-3   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-30   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-31   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-4   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-5   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-6   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-7   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-8   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Bron.tok-12-9   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Loc.Mail.Bron.Tok   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Lollipop   =>Adware.Lollipop^
C:\Program Files (x86)\Conduit   =>Toolbar.Conduit
C:\Program Files (x86)\iMesh Applications   =>PUP.iMesh
C:\Program Files (x86)\object   =>PUP.FCTPlugin
C:\Program Files (x86)\VooMuu   =>Adware.Hotbar
C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65   =>Adware.Seekmo
C:\ProgramData\Conduit   =>Toolbar.Conduit
C:\ProgramData\Partner   =>Spyware.Partner
C:\ProgramData\VooMuuSA   =>Adware.Hotbar
C:\Users\djam-sisi\AppData\Roaming\eType   =>Adware.Zugo
C:\Users\djam-sisi\AppData\Local\Conduit   =>Toolbar.Conduit
C:\Users\djam-sisi\AppData\Local\Ok-SendMail-Bron-tok   =>Worm.Brontock
C:\Users\djam-sisi\AppData\LocalLow\BabylonToolbar   =>PUP.Babylon
C:\Users\djam-sisi\AppData\LocalLow\Conduit   =>Toolbar.Conduit
C:\Users\djam-sisi\AppData\LocalLow\Incredibar.com   =>Adware.IncrediBar
C:\Users\djam-sisi\AppData\LocalLow\mediabarim   =>PUP.iMesh
C:\Users\djam-sisi\AppData\LocalLow\wincoreimband   =>PUP.iMesh
C:\Users\djam-sisi\AppData\Roaming\cacaoweb\cacaoweb.exe   =>PUP.CacaoWeb^
[HKCU\Software\Conduit]   =>Toolbar.Conduit^
C:\Users\djam-sisi\AppData\Local\Bron.tok.A12.em.bin   =>Worm.Brontok^
C:\Users\djam-sisi\AppData\Local\Update.12.Bron.Tok.bin   =>Worm.Brontok^
C:\Users\djam-sisi\Desktop\cacaoweb.exe   =>PUP.CacaoWeb^
C:\Users\djam-sisi\Desktop\utorrent-1-.exe   =>P2P.BitTorrent^
~ Additionnel Scan: 283211 Items scanned in 01mn 35s



---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com/apps/blog/show/27566847-pup-cacaoweb   =>PUP.CacaoWeb
~ http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon  =>PUP.Babylon
~ http://nicolascoolman.webs.com/apps/blog/show/27480243-adware-socialskinz   =>Adware.SocialSkinz
~ http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit   =>Toolbar.Conduit
~ http://nicolascoolman.webs.com/apps/blog/show/28441146-pup-imesh   =>PUP.iMesh
~ http://nicolascoolman.webs.com/apps/blog/show/27583992-pup-datamngr   =>PUP.Datamngr
~ http://nicolascoolman.webs.com/apps/blog/show/30049678-pup-fctplugin   =>PUP.FCTPlugin
~ http://nicolascoolman.webs.com/apps/blog/show/26607014-pup-1clickdownloader   =>PUP.1ClickDownloader
~ http://nicolascoolman.webs.com/apps/blog/show/29216159-pup-sweetim   =>PUP.SweetIM
~ http://nicolascoolman.webs.com/apps/blog/show/27229962-adware-predictad   =>Adware.PredictAd
~ http://nicolascoolman.webs.com/apps/blog/show/26712089-adware-basicscan  =>Adware.BasicScan
~ http://nicolascoolman.webs.com/apps/blog/show/28060597-pup-dealply   =>PUP.DealPly
~ http://nicolascoolman.webs.com/apps/blog/show/26684723-adware-imbooster  =>Adware.IMBooster
~ http://nicolascoolman.webs.com/apps/blog/show/28606910-pup-offerbox   =>PUP.OfferBox
~ http://nicolascoolman.webs.com/apps/blog/show/26666995-adware-pricegong   =>Adware.PriceGong
~ http://nicolascoolman.webs.com/apps/blog/show/29637859-toolbar-tarma   =>PUP.Tarma
~ http://nicolascoolman.webs.com/apps/blog/show/27556476-adware-spointer   =>Adware.SPointer
~ http://nicolascoolman.webs.com/apps/blog/show/29023816-worm-brontok   =>Worm.Brontok
~ http://nicolascoolman.webs.com/apps/blog/show/26630902-adware-lollipop   =>Adware.Lollipop
~ http://nicolascoolman.webs.com/apps/blog/show/28000037-pup-rewardsarcade    =>PUP.RewardsArcade
~ http://nicolascoolman.webs.com/apps/blog/show/26611092-adware-bandoo  =>Adware.Bandoo
~ http://nicolascoolman.webs.com/apps/blog/show/26820943-adware-gameplaylabs  =>Adware.GamePlayLabs
~ http://nicolascoolman.webs.com/apps/blog/show/27583526-pup-crossrider   =>PUP.CrossRider
~ http://nicolascoolman.webs.com/apps/blog/show/27379491-toolbar-wajam   =>PUP.Wajam
~ http://nicolascoolman.webs.com/apps/blog/show/27630986-pup-funmoods   =>PUP.Funmoods
~ http://nicolascoolman.webs.com/apps/blog/show/26834113-adware-hotbar  =>Adware.Hotbar
~ http://nicolascoolman.webs.com/apps/blog/show/28193283-spyware-partner   =>Spyware.Partner
~ http://nicolascoolman.webs.com/apps/blog/show/26828293-adware-zugo   =>Adware.Zugo
~ http://nicolascoolman.webs.com/apps/blog/show/26898222-adware-incredibar  =>Adware.Incredibar
~ MSI: 29 link(s) detected in 01mn 36s



~ 1314 Legitimates filtered by white list
End of the scan (976 lines in 11mn 35s)(0)