~ Rapport de ZHPDiag v2013.10.16.42 - Nicolas Coolman (16/10/2013) ~ Lancé par Bill Gates (15/01/2014 19:56:30) ~ Adresse du Site Web http://nicolascoolman.webs.com ~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/ ~ Traduit par Nicolas Coolman ~ Etat de la version : ~ Liste blanche : Activée par le programme ~ Elévation des Privilèges : OK ~ User Account Control (UAC): Deactivate by program ---\\ Navigateurs Internet MSIE: Internet Explorer v11.0.9600.16476 MFIE: Mozilla Firefox 26.0 GCIE: Google Chrome v31.0.1650.63 (Defaut) OBIE: Safari v5.34.57.2 ---\\ Informations sur les produits Windows ~ Langage: Français Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601) Windows Server License Manager Script : OK ---\\ Logiciels de protection du système Avira Free Antivirus v14.0.2.286 Malwarebytes Anti-Malware version 1.75.0.1300 Windows Defender W7 ---\\ Logiciels d'optimisation du système CCleaner v3.17 =>Piriform Ltd ---\\ Logiciels de partage PeerToPeer Pando Media Booster v2.6.0.8 ---\\ Surveillance de Logiciels Adobe Flash Player 11 Plugin Adobe Reader X Java 7 Update 45 ---\\ Informations sur le système ~ Processor: Intel64 Family 6 Model 42 Stepping 7, GenuineIntel ~ Operating System: 64 Bits Boot mode: Normal (Normal boot) Total RAM: 4043 MB (59% free) System Restore: Activé (Enable) System drive C: has 254 GB (44%) free of 571 GB ---\\ Mode de connexion au système ~ Computer Name: BILLGATES-HP ~ User Name: Bill Gates ~ All Users Names: OA, HomeGroupUser$, Bill Gates, Administrateur, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\\ Variables d'environnement ~ System Unit : C:\ ~ %AppZHP% : C:\Users\Bill Gates\AppData\Roaming\ZHP\ ~ %AppData% : C:\Users\Bill Gates\AppData\Roaming\ ~ %Desktop% : C:\Users\Bill Gates\Desktop\ ~ %Favorites% : C:\Users\Bill Gates\Favorites\ ~ %LocalAppData% : C:\Users\Bill Gates\AppData\Local\ ~ %StartMenu% : C:\Users\Bill Gates\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\\ Enumération des unités disques C: Hard drive, Flash drive, Thumb drive (Free 254 Go of 571 Go) D: Hard drive, Flash drive, Thumb drive (Free 2 Go of 21 Go) E: Hard drive, Flash drive, Thumb drive (Free 0 Go of 4 Go) F: CD-ROM drive (Not Inserted) G: CD-ROM drive (Not Inserted) ---\\ Etat du Centre de Sécurité Windows [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified ~ Security Center: 38 Legitimates Filtered in 00mn 00s ---\\ Recherche particulière de fichiers génériques [MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.04/11/2011 - 22:57:32.) -- C:\Windows\Explorer.exe [2871808] [MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024] [MD5.9B6678DB9C6A232C5A84D2FDFFF8B0E1] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.26/11/2013 - 08:07:57.) -- C:\Windows\System32\wininet.dll [2334208] [MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.21/11/2010 - 04:24:29.) -- C:\Windows\System32\Winlogon.exe [390656] [MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.21/11/2010 - 04:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448] [MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/09/2013 - 02:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152] [MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128] [MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160] [MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456] [MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400] [MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368] [MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472] [MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224] [MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.04/11/2011 - 22:59:54.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208] [MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 04:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632] [MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680] [MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280] [MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 04:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536] [MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184] [MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296] [MD5.DF8126BD41180351A093A3AD2FC8903B] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.04/11/2011 - 22:55:34.) -- C:\Windows\system32\Drivers\volsnap.sys [296320] ~ Generic Processes: Scanned in 00mn 01s ---\\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 2/244 ~ Mes musiques (My Musics) : 2/8 ~ Mes Videos (My Videos) : 2/251 ~ Mes Favoris (My Favorites) : 1/14 ~ Mes Documents (My Documents) : 3/34947 ~ Mon Bureau (My Desktop) : 3/43021 ~ Menu demarrer (Programs) : 1/52 ~ Hidden Files: Scanned in 02mn 04s ---\\ Processus lancés [MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.2940] [MD5.10E89F598469C60D8C87A8218089A87D] - (.Akamai Technologies, Inc. - Akamai NetSession Client.) -- C:\Users\Bill Gates\AppData\Local\Akamai\netsession_win.exe [4489472] [PID.3972] [MD5.C948AC73822CA662CF44185B909EA18B] - (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.exe [720064] [PID.1684] [MD5.D213F06AE294341F3503FD74E22E7DDA] - (.Microsoft Corporation - Microsoft SkyDrive.) -- C:\Users\Bill Gates\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [257136] [PID.3708] [MD5.6C3DBE1AB6E79D29C53A2242044DCC76] - (.Hewlett-Packard Company - HP QuickWeb Utilities.) -- C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [169528] [PID.3440] [MD5.8A3B69683E63808719D24E1C68C21CC7] - (.Hewlett-Packard Development Company, L.P. - HP On Screen Display.) -- C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960] [PID.3996] [MD5.D658AB1B55127D18DCFBCAC8CAAEA522] - (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208] [PID.1036] [MD5.DD231039B13EC2ABDE315D76E658EF0E] - (.Avira Operations GmbH & Co. KG - Antivirus System Tray Tool (Desktop).) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600] [PID.3968] [MD5.8192B2E274607D1D530F5C191698C544] - (.Hewlett-Packard Development Company, L.P. - HP Message Service.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944] [PID.3460] [MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336] [PID.4316] [MD5.36C727491F1F934EF3CAEE686C946DE5] - (.Adobe Systems Incorporated - AAM Updates Notifier Application.) -- C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe [296392] [PID.2704] [MD5.F6158734F1E24C6C510155CF0D363911] - (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [295512] [PID.11436] [MD5.376A9B411BF8B77D5BF84B24D0C7DACD] - (.Google Inc. - Google Chrome.) -- C:\Users\Bill Gates\AppData\Local\Google\Chrome\Application\chrome.exe [863184] [PID.7748] [MD5.281AA535DB9FA6C906656E04734CAC72] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8094720] [PID.12936] ~ Processes Running: Scanned in 00mn 01s ---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2) C:\Users\Bill Gates\AppData\Local\Google\Chrome\User Data\Default\Preferences G2 - GCE: Preference [User Data\Default] [gfdkimpbcpahaombhbimeihdjnejgicl] Feedback v.1.0 (Activé) G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Wallet v.0.0.6.0 (Activé) ~ Google Browser: 13 Legitimates Filtered in 00mn 01s ---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) C:\Users\Bill Gates\AppData\Roaming\Mozilla\Firefox\Profiles\biwm1wgv.default\prefs.js ~ Firefox Browser: 10 Legitimates Filtered in 00mn 00s ---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4) R0 - HKCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page = http://allssearch.com =>Adware.SocialSkinz ~ IE Browser: 12 Legitimates Filtered in 00mn 00s ---\\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe ~ Keys: Scanned in 00mn 00s ---\\ Hosts file redirection (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 00s ~ Nombre de lignes (Lines number): 21 ---\\ Internet Explorer Toolbars (O3) O3 - Toolbar: (no name) [64Bits] - [HKLM]{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} Clé orpheline ~ Toolbar: Scanned in 00mn 00s ---\\ Autres liens utilisateurs (O4) O4 - GS\Desktop [Public]: FL Studio 11.lnk . (.Image-Line - FL Studio launcher.) -- C:\Users\Bill Gates\Desktop\FL Studio 11\FL.exe O4 - GS\Desktop [Public]: Game Booster 3.lnk . (.IObit - Game Booster.) -- C:\Program Files (x86)\IObit\Game Booster 3\GameBooster.exe O4 - GS\Desktop [Public]: Garena Plus.lnk . (...) -- C:\Program Files (x86)\Garena Plus\GarenaMessenger.exe O4 - GS\Desktop [Public]: HP Support Assistant.lnk . (.Hewlett-Packard Company - HP Support Assistant.) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe =>.Hewlett-Packard Co O4 - GS\Desktop [Public]: HP+.lnk . (...) -- C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe O4 - GS\Desktop [Public]: Inkscape.lnk . (.inkscape.org - Inkscape.) -- C:\Program Files (x86)\Inkscape\inkscape.exe O4 - GS\Desktop [Public]: Magic Control.lnk . (.Easybits Software - Parental Control for Magic Desktop.) -- C:\Program Files (x86)\EasyBits For Kids\ezParentalControlMD.exe O4 - GS\Desktop [Public]: Magic Desktop.lnk . (.EasyBits Software - Magic Desktop Launcher.) -- C:\Program Files (x86)\EasyBits For Kids\ezMDLauncher.exe O4 - GS\Desktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O4 - GS\Desktop [Public]: OpenOffice 4.0.0.lnk . (.Apache Software Foundation - OpenOffice 4.0.0.) -- C:\Program Files (x86)\OpenOffice 4\program\soffice.exe O4 - GS\Desktop [Public]: PDFill PDF Editor.lnk . (.PlotSoft L.L.C. - PDFill PDF Editor 11.0.) -- C:\Program Files (x86)\PlotSoft\PDFill\PDFill.exe O4 - GS\Desktop [Public]: PDFill PDF Tools (Free).lnk . (.PlotSoft L.L.C. - PDFill PDF Tools 11.0.) -- C:\Program Files (x86)\PlotSoft\PDFill\PDFill_PDF_Tools.exe O4 - GS\Desktop [Public]: PDFill PDF Writer (Free).lnk . (.PlotSoft LLC - PDFill FREE PDF and Image Writer.) -- C:\Program Files (x86)\PlotSoft\PDFill\WriterSave.exe O4 - GS\Desktop [Public]: RaRa Music.lnk . (...) -- C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe O4 - GS\Desktop [Public]: Switch to Gaming Mode.lnk . (.IObit - Game Booster.) -- C:\Program Files (x86)\IObit\Game Booster 3\GameBooster.exe O4 - GS\Desktop [Public]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Bill Gates\Documents\Vinoth Dossiers\µTorrent\uTorrent.exe =>P2P.BitTorrent O4 - GS\Program [Public]: DMC Devi May Cry.lnk . (...) -- C:\Program Files (x86)\DMC Devi May Cry\Binaries\Win32\DMC-DevilMayCry.exe O4 - GS\Program [Public]: FL Studio 11.lnk . (.Image-Line - FL Studio launcher.) -- C:\Users\Bill Gates\Desktop\FL Studio 11\FL.exe O4 - GS\Program [Public]: Inkscape.lnk . (.inkscape.org - Inkscape.) -- C:\Program Files (x86)\Inkscape\inkscape.exe O4 - GS\Program [Public]: Magic Control.lnk . (.Easybits Software - Parental Control for Magic Desktop.) -- C:\Program Files (x86)\EasyBits For Kids\ezParentalControlMD.exe O4 - GS\Program [Public]: Magic Desktop.lnk . (.EasyBits Software - Magic Desktop Launcher.) -- C:\Program Files (x86)\EasyBits For Kids\ezMDLauncher.exe O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O4 - GS\Program [Public]: Safari.lnk . (...) -- C:\Windows\Installer\{C779648B-410E-4BBA-B75B-5815BCEFE71D}\SafariIco.exe O4 - GS\QuickLaunch [OA]: CodeBlocks.lnk . (...) -- C:\Program Files (x86)\CodeBlocks\codeblocks.exe O4 - GS\QuickLaunch [OA]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\QuickLaunch [OA]: µTorrent.lnk . (...) -- C:\Users\Bill Gates\Desktop\µTorrent\uTorrent.exe (.not file.) =>P2P.µTorrent O4 - GS\TaskBar [OA]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\Bill Gates\AppData\Local\Google\Chrome\Application\chrome.exe O4 - GS\TaskBar [OA]: HP Recommended.LNK . (...) -- C:\Program Files (x86)\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe (.not file.) O4 - GS\TaskBar [OA]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\TaskBar [OA]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O4 - GS\Program [OA]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\SystemTools [OA]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\Desktop [OA]: Algobox.lnk . (...) -- C:\Program Files (x86)\Algobox\algobox.exe O4 - GS\Desktop [OA]: Altered Beast.lnk . (...) -- C:\Program Files (x86)\Altered Beast\Fusion.exe O4 - GS\Desktop [OA]: Artisteer 3.lnk . (.ExtenSoft - Artisteer.) -- C:\Program Files (x86)\Artisteer 3\bin\Artisteer.exe O4 - GS\Desktop [OA]: Assassin's Creed Brotherhood.lnk - Clé orpheline O4 - GS\Desktop [OA]: CodeBlocks.lnk . (...) -- C:\Program Files (x86)\CodeBlocks\codeblocks.exe O4 - GS\Desktop [OA]: Continue Key Generator Setup.lnk . (...) -- C:\Users\Bill Gates\AppData\Local\Temp\DownloadManager.exe (.not file.) O4 - GS\Desktop [OA]: Dreamweaver.lnk . (.Adobe Systems, Inc. - Adobe Dreamweaver CS5.) -- C:\Users\Bill Gates\Downloads\Adobe Dreamweaver CS5 Portable\Dreamweaver.exe O4 - GS\Desktop [OA]: FL Studio 10.lnk . (.Image-Line - FL Studio engine launcher.) -- C:\Users\Bill Gates\Documents\FL Studio by Vinoth Venedittan\FL.exe O4 - GS\Desktop [OA]: FL Studio 11 - Raccourci.lnk . (...) -- C:\Users\Bill Gates\Desktop\FL Studio 11 O4 - GS\Desktop [OA]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\Bill Gates\AppData\Local\Google\Chrome\Application\chrome.exe O4 - GS\Desktop [OA]: pes2012.lnk . (.Konami Digital Entertainment Co., Ltd. - Pro Evolution Soccer 2012.) -- C:\Users\Bill Gates\Documents\PES 2012\program files\KONAMI\Pro Evolution Soccer 2012\pes2012.exe O4 - GS\Desktop [OA]: Pes2013.lnk . (.Konami Digital Entertainment Co., Ltd. - Pro Evolution Soccer 2013.) -- C:\Program Files (x86)\KONAMI\Pro Evolution Soccer 2013\pes2013.exe O4 - GS\Desktop [OA]: Pro Evolution Soccer 6 DEMO.lnk . (.KONAMI - pes6.exe.) -- C:\Program Files (x86)\KONAMI\PES6 DEMO\pes6.exe O4 - GS\Desktop [OA]: Remember Me.lnk . (.CAPCOM U.S.A, INC http://www.capcom.com/us - Remember Me.) -- C:\Program Files (x86)\Remember Me\Binaries\Win32\RememberMe.exe O4 - GS\QuickLaunch [Bill Gates]: Artisteer 3.lnk . (.ExtenSoft - Artisteer.) -- C:\Program Files (x86)\Artisteer 3\bin\Artisteer.exe O4 - GS\QuickLaunch [Bill Gates]: CodeBlocks.lnk . (...) -- C:\Program Files (x86)\CodeBlocks\codeblocks.exe O4 - GS\QuickLaunch [Bill Gates]: D-Jix Media LE.lnk . (.D-Jix - D-Jix Media LE.) -- C:\Users\Bill Gates\AppData\Roaming\D-Jix\D-Jix Media LE\D-Jix Media LE.exe O4 - GS\QuickLaunch [Bill Gates]: Inkscape.lnk . (.inkscape.org - Inkscape.) -- C:\Program Files (x86)\Inkscape\inkscape.exe O4 - GS\QuickLaunch [Bill Gates]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\QuickLaunch [Bill Gates]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Bill Gates\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent O4 - GS\TaskBar [Bill Gates]: FL Studio 11.lnk . (.Image-Line - FL Studio launcher.) -- C:\Users\Bill Gates\Desktop\FL Studio 11\FL.exe O4 - GS\TaskBar [Bill Gates]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\Bill Gates\AppData\Local\Google\Chrome\Application\chrome.exe O4 - GS\TaskBar [Bill Gates]: HP Recommended.LNK . (...) -- C:\Program Files (x86)\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe (.not file.) O4 - GS\TaskBar [Bill Gates]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O4 - GS\Program [Bill Gates]: DC Universe Online Live.lnk . (...) -- C:\Users\Public\Sony Online Entertainment\Installed Games\DC Universe Online Live\LaunchPad.exe (.not file.) O4 - GS\Program [Bill Gates]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\Program [Bill Gates]: Norton Product Installer.lnk . (...) -- C:\Users\OA\AppData\Local\Temp\SymInstallStub.exe (.not file.) O4 - GS\SystemTools [Bill Gates]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\Desktop [Bill Gates]: Algobox.lnk . (...) -- C:\Program Files (x86)\Algobox\algobox.exe O4 - GS\Desktop [Bill Gates]: Altered Beast.lnk . (...) -- C:\Program Files (x86)\Altered Beast\Fusion.exe O4 - GS\Desktop [Bill Gates]: Artisteer 3.lnk . (.ExtenSoft - Artisteer.) -- C:\Program Files (x86)\Artisteer 3\bin\Artisteer.exe O4 - GS\Desktop [Bill Gates]: Assassin's Creed Brotherhood.lnk - Clé orpheline O4 - GS\Desktop [Bill Gates]: D-Jix Media LE.lnk . (.D-Jix - D-Jix Media LE.) -- C:\Users\Bill Gates\AppData\Roaming\D-Jix\D-Jix Media LE\D-Jix Media LE.exe O4 - GS\Desktop [Bill Gates]: Dreamweaver.lnk . (.Adobe Systems, Inc. - Adobe Dreamweaver CS5.) -- C:\Users\Bill Gates\Downloads\Adobe Dreamweaver CS5 Portable\Dreamweaver.exe O4 - GS\Desktop [Bill Gates]: pes2012.lnk . (.Konami Digital Entertainment Co., Ltd. - Pro Evolution Soccer 2012.) -- C:\Users\Bill Gates\Documents\PES 2012\program files\KONAMI\Pro Evolution Soccer 2012\pes2012.exe O4 - GS\Desktop [Bill Gates]: Pes2013.lnk . (.Konami Digital Entertainment Co., Ltd. - Pro Evolution Soccer 2013.) -- C:\Program Files (x86)\KONAMI\Pro Evolution Soccer 2013\pes2013.exe O4 - GS\Desktop [Bill Gates]: Pro Evolution Soccer 6 DEMO.lnk . (.KONAMI - pes6.exe.) -- C:\Program Files (x86)\KONAMI\PES6 DEMO\pes6.exe O4 - GS\Desktop [Bill Gates]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Bill Gates\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent ~ Global Startup: 151 Legitimates Filtered in 00mn 12s ---\\ Applications lancées au démarrage du sytème (O4) O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe (.not file.) O4 - HKLM\..\Run: [SysTrayApp] . (.IDT, Inc. - IDT PC Audio.) -- C:\Program Files\IDT\WDM\sttray64.exe O4 - HKLM\..\Run: [SetDefault] . (.Hewlett-Packard Development Company, L.P. - SetDefault.) -- C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe O4 - HKLM\..\Run: [Zune Launcher] . (.Microsoft Corporation - Zune Auto-Launcher.) -- C:\Program Files\Zune\ZuneLauncher.exe O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] . (.Adobe Systems Incorporated - Adobe Updater Startup Utility.) -- C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe =>.Adobe Systems Incorporated O4 - HKLM\..\RunOnce: [NCPluginUpdater] . (.Hewlett-Packard - NCPluginUpdater.) -- C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe O4 - HKCU\..\Run: [Akamai NetSession Interface] . (.Akamai Technologies, Inc. - Akamai NetSession Client.) -- C:\Users\Bill Gates\AppData\Local\Akamai\netsession_win.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Users\Bill Gates\Documents\DT\DTLite.exe =>.DT Soft Ltd O4 - HKCU\..\Run: [Pando Media Booster] . (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe O4 - HKCU\..\Run: [OfficeSyncProcess] . (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.exe O4 - HKCU\..\Run: [GrooveMonitor] . (.Microsoft Corporation - Microsoft SharePoint Workspace Monitor.) -- C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.exe O4 - HKCU\..\Run: [SkyDrive] . (.Microsoft Corporation - Microsoft SkyDrive.) -- C:\Users\Bill Gates\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe =>.Microsoft Corporation O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\Bill Gates\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe =>.Advanced Micro Devices, Inc O4 - HKLM\..\Wow6432Node\Run: [HPQuickWebProxy] . (.Hewlett-Packard Company - HP QuickWeb Utilities.) -- C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated O4 - HKLM\..\Wow6432Node\Run: [HPOSD] . (.Hewlett-Packard Development Company, L.P. - HP On Screen Display.) -- C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe O4 - HKLM\..\Wow6432Node\Run: [Easybits Recovery] . (.EasyBits Software AS - Power off recovery for Magic Desktop.) -- C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe =>.EasyBits Software AS O4 - HKLM\..\Wow6432Node\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe =>.Hewlett-Packard Co O4 - HKLM\..\Wow6432Node\Run: [avgnt] . (.Avira Operations GmbH & Co. KG - Antivirus System Tray Tool (Desktop).) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe O4 - HKLM\..\Wow6432Node\Run: [AdobeCS6ServiceManager] . (.Adobe Systems Incorporated - Adobe CS6 Service Manager.) -- C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe O4 - HKLM\..\Wow6432Node\Run: [HP Quick Launch] . (.Hewlett-Packard Development Company, L.P. - HP Message Service.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe O4 - HKLM\..\Wow6432Node\Run: [TkBellExe] . (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe =>.RealNetworks, Inc O4 - HKLM\..\Wow6432Node\Run: [BCSSync] . (.Microsoft Corporation - Microsoft Office 2010 component.) -- C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe =>.Microsoft Corporation O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-21-2068963316-1541744968-104418768-1000\..\Run: [Akamai NetSession Interface] . (.Akamai Technologies, Inc. - Akamai NetSession Client.) -- C:\Users\Bill Gates\AppData\Local\Akamai\netsession_win.exe O4 - HKUS\S-1-5-21-2068963316-1541744968-104418768-1000\..\Run: [DAEMON Tools Lite] . (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Users\Bill Gates\Documents\DT\DTLite.exe =>.DT Soft Ltd O4 - HKUS\S-1-5-21-2068963316-1541744968-104418768-1000\..\Run: [Pando Media Booster] . (.Pas de propriétaire - Pando Media Booster.) -- C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe O4 - HKUS\S-1-5-21-2068963316-1541744968-104418768-1000\..\Run: [OfficeSyncProcess] . (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.exe O4 - HKUS\S-1-5-21-2068963316-1541744968-104418768-1000\..\Run: [GrooveMonitor] . (.Microsoft Corporation - Microsoft SharePoint Workspace Monitor.) -- C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.exe O4 - HKUS\S-1-5-21-2068963316-1541744968-104418768-1000\..\Run: [SkyDrive] . (.Microsoft Corporation - Microsoft SkyDrive.) -- C:\Users\Bill Gates\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-21-2068963316-1541744968-104418768-1000\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\Bill Gates\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc ~ Application: Scanned in 00mn 01s ---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll,-102 [64Bits] - {25510184-5A38-4A99-B273-DCA8EEF6CD08} . (...) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\Resources\Icons\HP.ico O9 - Extra button: Se&nd to OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} -- C:\Program Files (x86)\MICROS~2\Office14\ONBttnIE.dll (.not file.) O9 - Extra button: OneNote Lin&ked Notes [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} -- C:\Program Files (x86)\MICROS~2\Office14\ONBTTN~1.dll (.not file.) ~ IE Extra Buttons: Scanned in 00mn 00s ---\\ Site dans la Zone de confiance d'Internet Explorer (O15) O15 - Trusted Zone: [HKCU\...\Domains] *.clonewarsadventures.com O15 - Trusted Zone: [HKCU\...\Domains] *.freerealms.com O15 - Trusted Zone: [HKCU\...\Domains] *.soe.com O15 - Trusted Zone: [HKCU\...\Domains] *.sony.com ~ IE Zone Confiance: Scanned in 00mn 00s ---\\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{A0B10EA4-A50D-4549-843C-47D61398A473}: DhcpNameServer = 192.168.0.254 O17 - HKLM\System\CS1\Services\Tcpip\..\{A0B10EA4-A50D-4549-843C-47D61398A473}: DhcpNameServer = 192.168.0.254 O17 - HKLM\System\CS2\Services\Tcpip\..\{A0B10EA4-A50D-4549-843C-47D61398A473}: DhcpNameServer = 192.168.0.254 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.254 ~ Domain: Scanned in 00mn 00s ---\\ Protocole additionnel (O18) O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) -- O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation ~ Protocole Additionnel: Scanned in 00mn 00s ---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll ~ Winlogon: Scanned in 00mn 00s ---\\ Tâches planifiées en automatique (O39) [MD5.3AADCF0B983E96111F1610613973411C] [APT] [AutoKMS] (...) -- C:\Windows\AutoKMS\AutoKMS.exe [3152384] =>Trojan.Keygen [MD5.00000000000000000000000000000000] [APT] [{36DBC82D-8FF0-4D83-86AD-92E6CB4B0D86}] (...) -- C:\Users\Bill Gates\DownlBill Gatesds\UDKInstall-2012-05-BETA.exe (.not file.) [0] [MD5.C25D1BCC8AE3FE057E731E11192AF2F7] [APT] [{7800B4EF-54E5-4AC0-A07F-A94659B62507}] (...) -- C:\Users\Bill Gates\Desktop\CodeBlocks-EP\codeblocks.exe [294414] [MD5.00000000000000000000000000000000] [APT] [{B8A840EC-EEC0-4356-892C-DEA8D7988F1E}] (...) -- C:\Users\Bill Gates\Downloads\pro_evolution_soccer_6_demo.exe (.not file.) [0] ~ Scheduled Task: 55 Legitimates Filtered in 00mn 06s ---\\ Logiciels installés (O42) O42 - Logiciel: Akamai NetSession Interface Service - (...) [HKLM][64Bits] -- Akamai O42 - Logiciel: SecretSauce - (.SecretSauce.) [HKLM][64Bits] -- SecretSauce O42 - Logiciel: Zone4 - (...) [HKCU][64Bits] -- Zone4 ~ Logic: 230 Legitimates Filtered in 00mn 02s ---\\ HKCU & HKLM Software Keys [HKCU\Software\IncrediMail] [HKCU\Software\OGPlanet] [HKCU\Software\OldSchoolInject] [HKCU\Software\Pando Networks] [HKLM\Software\Wow6432Node\IncrediMail] [HKLM\Software\Wow6432Node\PCTools] [HKLM\Software\Wow6432Node\Pando Networks] ~ Key Software: 339 Legitimates Filtered in 00mn 02s ---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 01/07/2013 - 14:31:29 - [3,950] ----D C:\Program Files (x86)\Altered Beast O43 - CFD: 13/04/2013 - 19:42:45 - [-1435,722] ----D C:\Program Files (x86)\OGPlanet O43 - CFD: 29/03/2012 - 17:41:50 - [7,234] ----D C:\Program Files (x86)\Pando Networks O43 - CFD: 03/05/2013 - 23:40:58 - [0] --H-D C:\ProgramData\{E26B3878-7CEC-469C-B449-5CAA336DF8CD} O43 - CFD: 23/07/2013 - 23:59:10 - [0,002] ----D C:\Users\Bill Gates\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OGPlanet O43 - CFD: 13/04/2013 - 19:42:45 - [0,003] ----D C:\Users\Bill Gates\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Zone4 - Fight District ~ 2 Dossiers CLSID vides (CLSID Empty Folders) ~ Program Folder: 277 Legitimates Filtered in 01mn 46s ---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.E13F489F0B1E52319A86BDD996263F4B] - 08/01/2014 - 03:04:40 ---A- . (...) -- C:\Windows\win.ini [478] O44 - LFC:[MD5.782CF40748F13F6FDE02348D4267319E] - 10/01/2014 - 19:43:25 ---A- . (...) -- C:\log2.txt [115] O44 - LFC:[MD5.4D9B13A2CCB5385DBA1E3A014C29F469] - 15/01/2014 - 20:01:40 --HA- . (...) -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [32064] O44 - LFC:[MD5.4D9B13A2CCB5385DBA1E3A014C29F469] - 15/01/2014 - 20:01:40 --HA- . (...) -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [32064] O44 - LFC:[MD5.4D9B13A2CCB5385DBA1E3A014C29F469] - 15/01/2014 - 20:01:40 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [32064] O44 - LFC:[MD5.4D9B13A2CCB5385DBA1E3A014C29F469] - 15/01/2014 - 20:01:40 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [32064] ~ Files: 23 Legitimates Filtered in 01mn 25s ---\\ Opérations et fonctions au démarrage de Windows Explorer (O46) O46 - SEH:ShellExecuteHooks - EasyBits Security Shield Hook - prevents launching insecure programs by kids [64Bits] - {E54729E8-643D-4270-9D49-7389EA579090} - Clé orpheline ~ ShellExecuteHooks: Scanned in 00mn 00s ---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55) O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0 O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 ~ MWPS: 19 Legitimates Filtered in 00mn 00s ---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56) O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1 ~ MWPE Keys: 5 Legitimates Filtered in 00mn 00s ---\\ Liste des pilotes du système (SDL) (O58) O58 - SDL:[MD5.46571ED73AE84469DCA53081D33CF3C8] - 26/12/2012 - 22:52:50 ---A- . (.DT Soft Ltd - DAEMON Tools Virtual Bus Driver.) -- C:\Windows\System32\Drivers\dtsoftbus01.sys [283200] ~ Drivers: 19 Legitimates Filtered in 00mn 00s ---\\ Liste des outils de désinfection (LATC) (O63) O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman ~ ADS: Scanned in 00mn 00s ---\\ Liste les services legacy du registre (LALS) (O64) O64 - Services: CurCS - 15/01/2014 - C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys (esgiguard) .(...) - LEGACY_ESGIGUARD =>Crapware.SpyHunter O64 - Services: CurCS - 01/11/2010 - C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys (WinRing0_1_2_0) .(.OpenLibSys.org - WinRing0.) - LEGACY_WINRING0_1_2_0 O64 - Services: CurCS - 15/01/2014 - C:\Users\BILLGA~1\AppData\Local\Temp\005B19E.tmp (X6va005) .(...) - LEGACY_X6VA005 ~ Legacy: 95 Legitimates Filtered in 00mn 18s ---\\ Menu de démarrage Internet (SMI) (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\Bill Gates\AppData\Local\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\OA\AppData\Local\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Apple Inc. - Safari.) -- C:\Program Files (x86)\Safari\Safari.exe ~ Keys: Scanned in 00mn 00s ---\\ Liste des exceptions du parefeu (FirewallRules) (O87) O87 - FAEL: "TCP Query User{DA550944-9B5D-4A4B-9738-975C118B3C82}C:\program files (x86)\ogplanet\zone4\zone4_na.exe" | In - Private - P6 - TRUE | .(.Infovine - Zone4.) -- C:\program files (x86)\ogplanet\zone4\zone4_na.exe O87 - FAEL: "UDP Query User{958D7F9A-6211-4E3C-A39E-99235F20A8DD}C:\program files (x86)\ogplanet\zone4\zone4_na.exe" | In - Private - P17 - TRUE | .(.Infovine - Zone4.) -- C:\program files (x86)\ogplanet\zone4\zone4_na.exe O87 - FAEL: "TCP Query User{0BA650F3-15AB-48A0-9E46-92CFDF38BEC7}C:\users\bill gates\documents\client moustikk\dkmt2 lenceur.exe" | In - Private - P6 - TRUE | .(...) -- C:\users\bill gates\documents\client moustikk\dkmt2 lenceur.exe O87 - FAEL: "UDP Query User{26D128FB-0E23-4F1B-AD1D-15B22CC74574}C:\users\bill gates\documents\client moustikk\dkmt2 lenceur.exe" | In - Private - P17 - TRUE | .(...) -- C:\users\bill gates\documents\client moustikk\dkmt2 lenceur.exe O87 - FAEL: "TCP Query User{197DD8D4-45B8-4F12-9E4E-8F2A2170AD17}C:\users\bill gates\documents\darknessmt2 renaissance\darknessmt2.exe" | In - Private - P6 - TRUE | .(...) -- C:\users\bill gates\documents\darknessmt2 renaissance\darknessmt2.exe O87 - FAEL: "UDP Query User{0DBD452A-191E-45DB-903E-2E881A210A45}C:\users\bill gates\documents\darknessmt2 renaissance\darknessmt2.exe" | In - Private - P17 - TRUE | .(...) -- C:\users\bill gates\documents\darknessmt2 renaissance\darknessmt2.exe O87 - FAEL: "{C2B8EC36-ECCC-4FD0-9829-F08B0C369851}" |In - Private - P6 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.) O87 - FAEL: "{60770037-E356-46E9-AF55-B00539306FA7}" |In - Private - P17 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.) O87 - FAEL: "{474061A6-0CF5-48F5-9303-809C974AFBF2}" |In - Public - P6 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.) O87 - FAEL: "{3AAE5BCA-78ED-4B6F-BB90-039ECC38803C}" |In - Public - P17 - TRUE | .(...) -- C:\Windows\System32\dmwu.exe (.not file.) O87 - FAEL: "TCP Query User{EEFA3BEA-E634-4C09-B134-CCE4A37313B5}C:\users\bill gates\downloads\ultra\ultima-online.exe" | In - Private - P6 - TRUE | .(...) -- C:\users\bill gates\downloads\ultra\ultima-online.exe O87 - FAEL: "UDP Query User{F750A17D-2EE6-4140-9578-1D2EDA7B5F4C}C:\users\bill gates\downloads\ultra\ultima-online.exe" | In - Private - P17 - TRUE | .(...) -- C:\users\bill gates\downloads\ultra\ultima-online.exe O87 - FAEL: "TCP Query User{DA89ACED-2C16-4203-9F3B-379C620C397E}H:\microsoft toolkit.exe" |In - Private - P6 - TRUE | .(...) -- H:\microsoft toolkit.exe (.not file.) O87 - FAEL: "UDP Query User{47E72881-D8E6-46BC-A83F-C7B9D7839DB9}H:\microsoft toolkit.exe" |In - Private - P17 - TRUE | .(...) -- H:\microsoft toolkit.exe (.not file.) ~ Firewall: 297 Legitimates Filtered in 00mn 05s ---\\ Enumère les codes produits des logiciels (PUC) (O90) O90 - PUC: "95731AF9B2C57714D9CD00838F5BEBDF" . (.Bing Bar.) -- C:\Windows\Installer\{9FA13759-5C2B-4177-9DDC-0038F8B5BEFD}\icon_installer_ico =>Toolbar.Bing ~ Update Products: 208 Legitimates Filtered in 00mn 00s ---\\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped) SR - | Auto 09/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe SS - | Demand 11/12/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe SR - | Auto 14/07/2009 27136 | c:\program files (x86)\common files\akamai\netsession_win_8fa3539.dll (Akamai) . (.Akamai Technologies, Inc..) - C:\Windows\System32\svchost.exe SR - | Auto 18/08/2011 204288 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe SR - | Auto 19/12/2013 440376 | (AntiVirSchedulerService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe SR - | Auto 13/12/2013 440376 | (AntiVirService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe SS - | Demand 01/08/2011 195320 | (BBSvc) . (.Microsoft Corporation..) - C:\Program Files (x86)\Microsoft\BingBar\BBSvc.exe SR - | Auto 20/07/2011 249648 | (BBUpdate) . (.Microsoft Corporation.) - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.exe SR - | Auto 10/07/1658 0 | (ezSharedSvc) . (.EasyBits Software AS.) - C:\Windows\System32\ezSharedSvcHost.exe =>.EasyBits Software AS SS - | Demand 09/11/2013 227936 | (GamesAppIntegrationService) . (.WildTangent.) - C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe SS - | Demand 12/10/2010 206072 | (GamesAppService) . (.WildTangent, Inc..) - C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe SS - | Auto 05/07/2012 136176 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe SS - | Demand 05/07/2012 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe SR - | Auto 27/09/2012 86528 | (HP Support Assistant Service) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe =>.Hewlett-Packard Co SR - | Auto 16/02/2011 682040 | (HPAuto) . (.Hewlett-Packard.) - C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe SR - | Auto 11/10/2010 346168 | (HPClientSvc) . (.Hewlett-Packard Company.) - C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe SR - | Auto 06/09/2012 197536 | (HPDrvMntSvc.exe) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe SR - | Demand 06/09/2012 1001376 | (hpqwmiex) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe SR - | Auto 05/03/2012 35200 | (HPWMISVC) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe SR - | Auto 30/04/2011 13592 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe SS - | Auto 01/09/2011 2425960 | (IconMan_R) . (.Realsil Microelectronics Inc..) - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe SS - | Demand 14/11/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe SR - | Auto 06/06/2012 149872 | (InstallClick) . (...) - C:\Program Files (x86)\RIFT Technologies\InstallClick Connector\installclick.exe SR - | Auto 01/02/2011 326168 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe SS - | Demand 02/01/2014 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe SR - | Auto 10/07/1658 0 | (PnkBstrA) . (...) - C:\Windows\system32\PnkBstrA.exe SR - | Auto 14/08/2013 39056 | (RealNetworks Downloader Resolver Service) . (...) - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe SS - | Auto 01/03/2013 161384 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe SR - | Auto 08/09/2011 305152 | (STacSV) . (.IDT, Inc..) - C:\Program Files\IDT\WDM\STacSV64.exe SR - | Auto 01/02/2011 2656280 | (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SS - | Demand 10/07/1658 0 | (X6va005) . (...) - C:\Users\BILLGA~1\AppData\Local\Temp\005B19E.tmp ~ Services: Scanned in 00mn 41s ---\\ Scan Additionnel (O88) Database Version : 12948 - (16/10/2013) Clés trouvées (Keys found) : 1 Valeurs trouvées (Values found) : 0 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 1 [HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASAPI32] =>Toolbar.Bing C:\Windows\AutoKMS\AutoKMS.exe =>Trojan.Keygen^ ~ Additionnel Scan: 404177 Items scanned in 00mn 47s ---\\ Récapitulatif des détections trouvées sur votre station ~ http://nicolascoolman.webs.com/apps/blog/show/27480243-adware-socialskinz =>Adware.SocialSkinz ~ http://nicolascoolman.webs.com/apps/blog/show/26609241-crapware-spyhunter =>Crapware.SpyHunter ~ http://nicolascoolman.webs.com/apps/blog/show/31536787-toolbar-bing =>Toolbar.Bing ~ MSI: 3 link(s) detected in 00mn 47s ~ 1592 Legitimates filtered by white list End of the scan (536 lines in 08mn 44s)(0)