cjoint

Publicité

Priorité au Logiciel Libre! Je soutiens l'April.

Publicité

Priorité au Logiciel Libre! Je soutiens l'April.

Format du document : text/plain

Prévisualisation

Rapport de ZHPDiag v2013.4.16.93 par Nicolas Coolman, Update du 16/04/2013
Run by Paguy at 17/04/2013 08:44:11
State : Version � jour.
WhiteList : Enable
High Elevated Privileges : OK
UAC : Not Found


---\\ Web Browser
MSIE: Internet Explorer v8.0.6001.18702 (Defaut)

---\\ Windows Product Information
~ Langage: Fran�ais
Windows XP Home Edition Service Pack 3 (Build 2600)
Windows Automatic Updates : OK
Windows Genuine Advantage : OK

---\\ System Protection
Malwarebytes Anti-Malware version 1.75.0.1300

---\\ System Optimizer
CCleaner v4.00

---\\ Software Update
Adobe Flash Player 11 ActiveX
Adobe Reader X

---\\ System Information
~ Processor: x86 Family 15 Model 2 Stepping 9, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 511 MB (3% free)
System Restore: Activ� (Enable)
System drive C: has 18 GB (31%) free of 56 GB

---\\ Logged in mode
~ Computer Name: JULES
~ User Name: Paguy
~ All Users Names: SUPPORT_388945a0, SUPPORT_0cbdf702, Paguy, Nann�ne, HelpAssistant, ASPNET, Administrateur,
~ Unselected Option: None
Logged in as Administrator

---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Documents and Settings\Paguy\Application Data\
~ %Desktop% : C:\Documents and Settings\Paguy\Bureau\
~ %Favorites% : C:\Documents and Settings\Paguy\Favoris\
~ %LocalAppData% : C:\Documents and Settings\Paguy\Local Settings\Application Data\
~ %StartMenu% : C:\Documents and Settings\Paguy\Menu D�marrer\
~ %Windir% : C:\WINDOWS\
~ %System% : C:\WINDOWS\system32\

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 18 Go of 56 Go)
D:\ CD-ROM drive (Not Inserted)



---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Intl: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] XMLLookup: OK
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK
[HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] Load: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : OK
~ Security Center: Scanned in 00mn 00s



---\\ Recherche particuli�re de fichiers g�n�riques
[MD5.F2317622D29F9FF0F88AEECD5F60F0DD] - (.Microsoft Corporation - Explorateur Windows.) (.14/04/2008 - 03:34:03.) -- C:\WINDOWS\Explorer.exe [1037824]
[MD5.48309E1F5ED8E72783EEFBA04898BDA1] - (.Microsoft Corporation - Internet Extensions for Win32.) (.02/03/2013 - 02:55:11.) -- C:\WINDOWS\system32\wininet.dll [916480]
[MD5.DD73D6B9F6B4CB630CF35B438B540174] - (.Microsoft Corporation - Application d'ouverture de session Windows NT.) (.14/04/2008 - 03:34:28.) -- C:\WINDOWS\system32\Winlogon.exe [512000]
[MD5.1E44BC1E83D8FD2305F8D452DB109CF9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.17/08/2011 - 14:49:54.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496]
[MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.13/04/2008 - 19:40:30.) -- C:\WINDOWS\system32\Drivers\atapi.sys [96512]
[MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/04/2008 - 20:14:21.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744]
[MD5.1F4260CC5B42272D71F79E570A27A4FE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.13/04/2008 - 19:40:46.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [62976]
[MD5.31F923EB2170FC172C81ABDA0045D18C] - (.Microsoft Corporation - Pilote de cryptographie FIPS.) (.14/04/2008 - 02:57:38.) -- C:\WINDOWS\system32\Drivers\Fips.sys [44672]
[MD5.573C7D0A32852B48F3058CFD8026F511] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.13/04/2008 - 17:36:05.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [144384]
[MD5.A09BDC4ED10E3B2E0EC27BB94AF32516] - (.Microsoft Corporation - Pilote de port i8042.) (.14/04/2008 - 03:00:52.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [54144]
[MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.13/04/2008 - 19:40:58.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [42112]
[MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.13/04/2008 - 19:57:15.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [152832]
[MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.13/04/2008 - 20:19:42.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [75264]
[MD5.7D304A5EB4344EBEEAB53A2FE3FFB9F0] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.15/07/2011 - 14:29:31.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [456320]
[MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.13/04/2008 - 20:21:00.) -- C:\WINDOWS\system32\Drivers\netBT.sys [162816]
[MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.13/04/2008 - 20:15:53.) -- C:\WINDOWS\system32\Drivers\ntfs.sys [574976]
[MD5.8FD0BDBEA875D06CCF6C945CA9ABAF75] - (.Microsoft Corporation - Pilote de port parall�le.) (.14/04/2008 - 03:09:40.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80384]
[MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13/04/2008 - 20:19:43.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328]
[MD5.15CABD0F7C00C47C70124907916AF3F1] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.13/04/2008 - 19:32:51.) -- C:\WINDOWS\system32\Drivers\rdpdr.sys [196224]
[MD5.D8EB2A7904DB6C916EB5361878DDCBAE] - (.Microsoft Corporation - Pilote de filtre audio Livre rouge.) (.14/04/2008 - 02:57:34.) -- C:\WINDOWS\system32\Drivers\redbook.sys [58752]
[MD5.46DE1126684369BACE4849E4FC8C43CA] - (.Microsoft Corporation - Pilote de clich� instantan� du volume.) (.14/04/2008 - 02:56:04.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [53376]
~ Generic Processes: Scanned in 00mn 01s



---\\ Etat des fichiers cach�s (Cach�/Total)
~ Mes images (My Pictures) : 2/5315
~ Mes musiques (My Musics) : 1/150
~ Mes Videos (My Videos) : 2/4
~ Mes Favoris (My Favorites) : 1/61
~ Mes Documents (My Documents) : 2/5603
~ Mon Bureau (My Desktop) : 0/27
~ Menu demarrer (Programs) : 1/28
~ Hidden Files: Scanned in 00mn 19s



---\\ Processus lanc�s
[MD5.92C27887787E637185FEC2EE43DA390F] - (.Symantec Corporation - Symantec Settings Manager Service.) -- C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe [169632] [PID.168]
[MD5.FF7DAA264887E850ABFDB8167A8685C9] - (.Symantec Corporation - Symantec Event Manager Service.) -- C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe [192160] [PID.484]
[MD5.C830007369E18A54AED23B5BB3AFA2BA] - (.Symantec Corporation - SPBBC Service.) -- C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe [1160848] [PID.748]
[MD5.793EF38A5FD086C3C8E48A8A861562ED] - (.Microsoft Corporation - Content Index service.) -- C:\WINDOWS\system32\cisvc.exe [5632] [PID.576]
[MD5.99A1F9AE9FD8EB496CA4CB54D422D18C] - (.Symantec Corporation - Virus Definition Daemon.) -- C:\Program Files\Symantec AntiVirus\DefWatch.exe [31888] [PID.712]
[MD5.A0D14B7538FA3AE9CB771B9E99CECF43] - (.Sun Microsystems, Inc. - Java(TM) Quick Starter Service.) -- C:\Program Files\Java\jre6\bin\jqs.exe [154032] [PID.1664]
[MD5.11F714F85530A2BD134074DC30E99FCA] - (.Microsoft Corporation - Machine Debug Manager.) -- C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.exe [322120] [PID.1996]
[MD5.B03E3F64B70F8031E65EB26DA23DE91A] - (.Microsoft Corporation - MsCamSvc.exe.) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe [135536] [PID.472]
[MD5.44287C44FDAC6131F320916422540189] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 54.05.) -- C:\WINDOWS\system32\nvsvc32.exe [81920] [PID.1400]
[MD5.2D091A99624FB9E7EEF0A86D872EC0C3] - (.HP - PML Driver.) -- C:\WINDOWS\system32\HPZipm12.exe [73728] [PID.1580]
[MD5.753D254205E0A62100A050BD8B458D06] - (.Skype Technologies S.A. - Skype C2C Service.) -- C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000] [PID.1016]
[MD5.253702E880D7167F706FC362BCE55BF4] - (.Symantec Corporation - Symantec AntiVirus.) -- C:\Program Files\Symantec AntiVirus\Rtvscan.exe [1827472] [PID.320]
[MD5.72999AA48322DA948CE50C08B414A0EC] - (.Microsoft Corporation - Indexing Service filter daemon.) -- C:\WINDOWS\system32\cidaemon.exe [8192] [PID.3220]
[MD5.DC79F4167BF4067CC0F2C72E4E6040B3] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [6808576] [PID.1436]
[MD5.5E9A6658A2A69AE7EB195113B7A2E7A9] - (.Microsoft Corporation - Application Layer Gateway Service.) -- C:\WINDOWS\System32\alg.exe [44544] [PID.1484]
~ Processes Running: Scanned in 00mn 08s



---\\ Google Chrome, D�marrage,Recherche,Extensions (G0,G1,G2)
C:\Documents and Settings\Paguy\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences
~ Google Browser: Scanned in 00mn 00s



---\\ Internet Explorer, D�marrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://r.orange.fr
R4 - HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,Enabled = 2
~ IE Browser: 13 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\WINDOWS\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Keys: Scanned in 00mn 00s



---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 09s
~ Nombre de lignes (Lines number): 15362



---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} Cl� orpheline
~ BHO: 15 Legitimates Filtered in 00mn 06s



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: (no name) - [HKCU]{1E796980-9CC5-11D1-A83F-00C04FC99D61} Cl� orpheline
~ Toolbar: Scanned in 00mn 00s



---\\ Applications d�marr�es par registre & par dossier (O4)
O4 - HKLM\..\Run: [NvCplDaemon] . (.NVIDIA Corporation - NVIDIA Display Properties Extension.) -- C:\WINDOWS\system32\NvCpl.dll
O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-21-2050404483-677177641-1429353510-1007\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
~ Application: Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Programs: Adobe Reader X.lnk . (...) -- C:\WINDOWS\Installer\{AC76BA86-7AD7-1036-7B44-AA1000000001}\SC_Reader.ico
O4 - GS\Programs: Apple Software Update.lnk . (...) -- C:\WINDOWS\Installer\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}\AppleSoftwareUpdateIco.exe
O4 - GS\Programs: Lanceur de t�ches Microsoft Works.lnk . (.Microsoft� Corporation - Lanceur de t�ches Microsoft Works.) -- C:\Program Files\Microsoft Works\msworks.exe
O4 - GS\Programs: Microsoft Office PowerPoint Viewer 2003.lnk . (...) -- C:\WINDOWS\Installer\{90AF040C-6000-11D3-8CFE-0150048383C9}\ppvwicon.exe
O4 - GS\Programs: Windows Messenger.lnk . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe
O4 - GS\Programs: Windows Movie Maker.lnk . (.Microsoft Corporation - Windows Movie Maker.) -- C:\Program Files\Movie Maker\moviemk.exe
O4 - GS\Programs: Assistance � distance.lnk . (.Microsoft Corporation - Assistance � distance Microsoft.) -- C:\WINDOWS\system32\rcimlby.exe
O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Programs: Outlook Express.lnk . (.Microsoft Corporation - Outlook Express.) -- C:\Program Files\Outlook Express\msimn.exe
O4 - GS\Programs: Software Setup.lnk . (.Hewlett-Packard - Application Installer.) -- C:\SWSetup\AppInstl\Setup.exe
O4 - GS\Programs: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe
~ Global Startup: Scanned in 00mn 02s



---\\ Boutons situ�s sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} . (.Microsoft Corporation - Windows Live Writer Blog This Extension.) -- C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- C:\Program Files\Skype\Toolbars\Internet Explorer\icon.ico
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\OFFICE11\REFBARH.ICO
O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -- Cl� orpheline
O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- C:\Program Files\Messenger\msmsgs.exe
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Piratage de l'Option 'R�tablir les param�tres Web' (O14)
O14 - IERESET.INF: START_PAGE_URL=START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_FR&c=Q304&bd=pavilion&pf=laptop
~ IE Param�tres WEB: Scanned in 00mn 00s



---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {5A779DC0-837B-4590-AC42-C7C0847478C5} ((no name)) - http://logicielsgratuits.orange.fr/download_service/Install/OrangeInstaller.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} ((no name)) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
~ Objets ActiveX: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{BD15A1D6-C100-4E04-A707-F0899C0DD63F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{BD15A1D6-C100-4E04-A707-F0899C0DD63F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{BD15A1D6-C100-4E04-A707-F0899C0DD63F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} . (.Microsoft Corporation - Windows Live Mail.) -- C:\Program Files\Windows Live\Mail\mailcomm.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE11\MSOXMLMF.dll
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-cl�s Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dll
O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dll
O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agent r�seau hors connexion.) -- C:\WINDOWS\system32\cscdll.dll
O20 - Winlogon Notify: ddccyxw . (...) -- ddccyxw.dll
O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\system32\dimsntfy.dll
O20 - Winlogon Notify: NavLogon . (.Symantec Corporation - Symantec AntiVirus Logon Notification.) -- C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL commune de r�ception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL commune de r�ception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL secondaire de notification de service d.) -- C:\WINDOWS\system32\sclgntfy.dll
O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL commune de r�ception des notifications.) -- C:\WINDOWS\system32\WlNotify.dll
O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL commune de r�ception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: WgaLogon . (.Microsoft Corporation - Notifications Windows Genuine Advantage.) -- C:\WINDOWS\system32\WgaLogon.dll
O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL commune de r�ception des notifications.) -- C:\WINDOWS\system32\wlnotify.dll
~ Winlogon: Scanned in 00mn 00s



---\\ Liste des services NT non Microsoft et non d�sactiv�s (O23)
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) . (.Symantec Corporation - Virus Definition Daemon.) - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Pml Driver HPZ12 (Pml Driver HPZ12) . (.HP - PML Driver.) - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SPBBCSvc (SPBBCSvc) . (.Symantec Corporation - SPBBC Service.) - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus (Symantec AntiVirus) . (.Symantec Corporation - Symantec AntiVirus.) - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
~ Services: 12 Legitimates Filtered in 00mn 10s



---\\ Enum�ration Active Desktop & MHTML Editor (O24)
O24 - Desktop General: BackupWallPaper - .(...) - C:\Documents and Settings\Paguy\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop General: WallPaper - .(...) - C:\Documents and Settings\Paguy\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
~ Desktop Component: 1 Legitimates Filtered in 00mn 00s



---\\ T�ches planifi�es en automatique (O39)
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_setup_exe.job [140]
~ Scheduled Task: 8 Legitimates Filtered in 00mn 00s



---\\ Pilotes lanc�s au d�marrage (O41)
O41 - Driver: (eabfiltr) . (.Hewlett-Packard Company - QLB PS/2 Keyboard filter driver.) - C:\WINDOWS\system32\drivers\EABFiltr.sys
~ Drivers: 75 Legitimates Filtered in 00mn 01s



---\\ Logiciels install�s (O42)
O42 - Logiciel: Java 2 Runtime Environment, SE v1.4.2_03 - (.Sun Microsystems, Inc..) [HKLM] -- {7148F0A8-6813-11D6-A77B-00B0D0142030}
O42 - Logiciel: ZNsoft Free 2007 - (.Douali Nassim.) [HKLM] -- {ADA6814F-4DB9-468A-A3F0-A41E68C459EB}_is1
O42 - Logiciel: ZNsoft Optimizer Xp - (.Douali Nassim.) [HKLM] -- {66450A49-F7A1-4BE8-A626-609B8005ADB6}_is1
O42 - Logiciel: overland - (.HP.) [HKLM] -- {766273C1-A39B-47EB-ACE8-DEBDD8094BCC}
~ Logic: 109 Legitimates Filtered in 00mn 01s



---\\ HKCU & HKLM Software Keys
[HKLM\Software\Voxmobili]
~ Key Software: 147 Legitimates Filtered in 00mn 01s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 16/02/2007 - 23:37:57 - [7,727] ----D C:\Program Files\Overland
O43 - CFD: 03/05/2003 - 05:56:23 - [16,899] ----D C:\Program Files\RecordNow!
O43 - CFD: 16/04/2013 - 09:06:38 - [2,467] ----D C:\Program Files\ZNsoft Corporation
O43 - CFD: 19/09/2006 - 16:52:07 - [0] ----D C:\Documents and Settings\Paguy\Application Data\eConf
O43 - CFD: 22/10/2007 - 09:22:10 - [0,002] ----D C:\Documents and Settings\Paguy\Application Data\Voxmobili
O43 - CFD: 16/04/2011 - 10:09:20 - [0,159] ----D C:\Documents and Settings\Paguy\Local Settings\Application Data\ISL
O43 - CFD: 18/09/2012 - 12:08:55 - [0,000] ----D C:\Documents and Settings\Paguy\Local Settings\Application Data\Proxure
~ Program Folder: 152 Legitimates Filtered in 00mn 48s



---\\ Derniers fichiers modifi�s ou cr�es sous Windows et System32 (O44)
O44 - LFC:[MD5.9F7A847E7FD18E6770C752172C13DBB2] - 17/04/2013 - 07:25:28 ---A- . (...) -- C:\WINDOWS\wiadebug.log [1146]
O44 - LFC:[MD5.A496A8A216954462F391743DA32AB8FF] - 17/04/2013 - 07:25:27 ---A- . (...) -- C:\WINDOWS\wiaservc.log [50]
O44 - LFC:[MD5.D259AE1740B00EC97E55ABE881E0F10C] - 17/04/2013 - 07:20:59 ---A- . (...) -- C:\AdwCleaner[S2].txt [1132]
O44 - LFC:[MD5.47D026C6716066FE0D1DBBF745CBA7AB] - 16/04/2013 - 08:06:38 ---A- . (.Jeff A. Miko - This file provides information regarding di.) -- C:\WINDOWS\system32\DrvFacts.ocx [57856]
O44 - LFC:[MD5.6040F8484642D1C2C42A5BF0E5FCE247] - 16/04/2013 - 07:08:18 ---A- . (.Innovasys - Innovasys ButtonPlus Control.) -- C:\WINDOWS\system32\BtnPlus1.ocx [606208]
O44 - LFC:[MD5.5BA7C680ECB4F2EED2978DA69A4D23BB] - 16/04/2013 - 07:08:18 ---A- . (.Innovasys - Innovasys FramePlus Control.) -- C:\WINDOWS\system32\FraPlus1.ocx [471040]
O44 - LFC:[MD5.0DC2D11E3F3E1436DF9A932AB5CD8008] - 16/04/2013 - 07:08:18 ---A- . (.ZNsoft Corporation - Pas de description.) -- C:\WINDOWS\system32\OfficeMenu2003.ocx [225280]
O44 - LFC:[MD5.F9FEC5A0700A6172D712D61739686727] - 15/04/2013 - 15:45:28 ---A- . (...) -- C:\WINDOWS\ntbtlog.txt [173808]
O44 - LFC:[MD5.547374907194A7A2ECA5E5DFA861193E] - 15/04/2013 - 14:06:04 ---A- . (...) -- C:\WINDOWS\comsetup.log [2017]
O44 - LFC:[MD5.9BE0F01B57C141D8249A2A0B09EC3C42] - 15/04/2013 - 14:06:04 ---A- . (...) -- C:\WINDOWS\iis6.log [979]
O44 - LFC:[MD5.48604D3DF0367D0087ADB33AE4639A36] - 15/04/2013 - 14:06:04 ---A- . (...) -- C:\WINDOWS\imsins.log [1374]
O44 - LFC:[MD5.900B38A2BC47599D443BF19F0F2796B9] - 15/04/2013 - 14:06:04 ---A- . (...) -- C:\WINDOWS\ntdtcsetup.log [1224]
O44 - LFC:[MD5.02A2B060B11632B4C45EB7479F541097] - 15/04/2013 - 14:06:04 ---A- . (...) -- C:\WINDOWS\ocmsn.log [342]
O44 - LFC:[MD5.11B1CE46427F8CCC051713D190D0AD72] - 15/04/2013 - 14:06:04 ---A- . (...) -- C:\WINDOWS\tsoc.log [2359]
O44 - LFC:[MD5.5791CBC9BEC7531467A1781E407F9636] - 15/04/2013 - 14:06:03 ---A- . (...) -- C:\WINDOWS\msgsocm.log [309]
O44 - LFC:[MD5.58E0B052976C4241AD9EC4DC20AE6741] - 15/04/2013 - 14:06:03 ---A- . (...) -- C:\WINDOWS\ocgen.log [2956]
O44 - LFC:[MD5.886936405CD65F47B779CB2C67D8C800] - 15/04/2013 - 14:06:01 ---A- . (...) -- C:\WINDOWS\FaxSetup.log [6184]
O44 - LFC:[MD5.A993D2039BB8E5CAFDD6D6289E796554] - 15/04/2013 - 12:11:46 ---A- . (...) -- C:\AdwCleaner[S1].txt [4108]
O44 - LFC:[MD5.8ABDBA6D45B98C662C18F59FA3CDC18D] - 13/04/2013 - 00:24:19 ---A- . (...) -- C:\WINDOWS\hpoins05.dat [68960]
~ Files: 41 Legitimates Filtered in 02mn 26s



---\\ Derniers fichiers cr��s dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.7B39555A36DA121C6C1FDC3B215ADB92] - 16/04/2013 - 08:34:34 ---A- - C:\WINDOWS\Prefetch\SPBBCSVC.EXE-0E3F2ACD.pf
O45 - LFCP:[MD5.D2DE85A442716A2C2C8C10C322BA5F95] - 16/04/2013 - 08:35:24 ---A- - C:\WINDOWS\Prefetch\CCSETMGR.EXE-0BD7C211.pf
O45 - LFCP:[MD5.ECE50EDA1C0B6D9780EF8F55CD89900F] - 16/04/2013 - 08:37:40 ---A- - C:\WINDOWS\Prefetch\CCEVTMGR.EXE-16E10D66.pf
O45 - LFCP:[MD5.C9CD2BAEC392E37AF8946A62E35FDE24] - 17/04/2013 - 07:14:00 ---A- - C:\WINDOWS\Prefetch\MESSAGECHECK.EXE-19FD9FD3.pf
O45 - LFCP:[MD5.F57691CCC767FD7C5E7AFB6034928A4B] - 17/04/2013 - 07:24:32 ---A- - C:\WINDOWS\Prefetch\SERVICES.EXE-2F433351.pf
O45 - LFCP:[MD5.597C053540FA694C8BC94A078826B2EF] - 17/04/2013 - 07:24:52 ---A- - C:\WINDOWS\Prefetch\CISVC.EXE-21F69875.pf
O45 - LFCP:[MD5.22722F7301E1DE1007364BD3220B24FC] - 17/04/2013 - 07:24:56 ---A- - C:\WINDOWS\Prefetch\DEFWATCH.EXE-072A5A71.pf
O45 - LFCP:[MD5.5031E00CBCA715644EF9D86727651B6A] - 17/04/2013 - 07:25:09 ---A- - C:\WINDOWS\Prefetch\MDM.EXE-1EFE14A5.pf
O45 - LFCP:[MD5.11D946719D3D5A2E19C8CC4FFCE65AA5] - 17/04/2013 - 07:25:15 ---A- - C:\WINDOWS\Prefetch\MSCAMS32.EXE-0322BB5E.pf
O45 - LFCP:[MD5.4DE13342AB9CAC7B470B015B47E7103D] - 17/04/2013 - 07:25:21 ---A- - C:\WINDOWS\Prefetch\OUCORE.EXE-10371D4D.pf
O45 - LFCP:[MD5.576EFF3C4F323627763D0A405208E1D7] - 17/04/2013 - 07:25:36 ---A- - C:\WINDOWS\Prefetch\RTVSCAN.EXE-1D887DCC.pf
~ Prefetcher: 58 Legitimates Filtered in 00mn 02s



---\\ Op�rations et fonctions au d�marrage de Windows Explorer (O46)
O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll
~ ShellExecuteHooks: Scanned in 00mn 00s



---\\ Export de cl� d'application autoris�e (O47)
O47 - AAKE:Key Export SP - "C:\Program Files\Securitoo\av_fw\backweb\1044199\Program\backWeb-1044199.exe" [Enabled] .(...) -- C:\Program Files\Securitoo\av_fw\backweb\1044199\Program\backWeb-1044199.exe (.not file.)
O47 - AAKE:Key Export SP - "C:\Program Files\Orange Link\Application\eConfv4\olinkp.exe" [Enabled] .(...) -- C:\Program Files\Orange Link\Application\eConfv4\olinkp.exe (.not file.)
O47 - AAKE:Key Export SP - "C:\Program Files\Orange Link\Application\Exe\Orange Link.exe" [Enabled] .(...) -- C:\Program Files\Orange Link\Application\exe\Orange Link.exe (.not file.)
O47 - AAKE:Key Export SP - "D:\setup.exe" [Enabled] .(...) -- D:\setup.exe (.not file.)
O47 - AAKE:Key Export SP - "C:\Program Files\Internet Explorer\DualPix Exchange\Station2.exe" [Enabled] .(...) -- C:\Program Files\Internet Explorer\DualPix Exchange\Station2.exe (.not file.)
~ Keys Export: 38 Legitimates Filtered in 00mn 06s



---\\ D�ni du service (Local Security Authority) (O48)
O48 - LSA:Local Security Authority Authentication Packages . (...) --
~ LSA: 7 Legitimates Filtered in 00mn 00s



---\\ Image File Execution Options (IFEO) (O50)
O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d
~ IFEO: Scanned in 00mn 00s



---\\ Microsoft Windows Policies Explorer (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoSMBalloonTip"=0
~ MWPE Keys: 4 Legitimates Filtered in 00mn 00s



---\\ Liste des Drivers Syst�me (O58)
O58 - SDL:[MD5.C685CC27A2E637F0DCB5A45E67CC6F74] - 03/05/2003 - 05:10:46 ---A- . (.Oak Technology Inc. - Audio File System.) -- C:\WINDOWS\system32\Drivers\AFS2K.SYS [43672]
O58 - SDL:[MD5.6D3ADA4CE95CECA7BCE527A08C4C474E] - 05/08/2004 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ansi.sys [9037]
~ Drivers: Scanned in 00mn 00s



---\\ Derniers fichiers modifi�s ou cr�es (Utilisateur) (O61)
O61 - LFC: 15/04/2013 - 13:20:15 -SHA- C:\Documents and Settings\Paguy\UserData\index.dat [16384]
O61 - LFC: 15/04/2013 - 16:33:57 ---A- C:\Documents and Settings\Paguy\Local Settings\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Logs\04152013.Log [770]
O61 - LFC: 16/04/2013 - 07:09:04 ---A- C:\Documents and Settings\Paguy\Application Data\Microsoft\Internet Explorer\Quick Launch\ZNsoft Free.lnk [1845]
O61 - LFC: 16/04/2013 - 07:09:04 ---A- C:\Documents and Settings\Paguy\Bureau\ZNsoft Free.lnk [1827]
O61 - LFC: 16/04/2013 - 07:09:51 ---A- C:\Documents and Settings\Paguy\Local Settings\Application Data\Google\Toolbar\metrics_2493979574182.xml [5424]
O61 - LFC: 16/04/2013 - 07:09:52 ---A- C:\Documents and Settings\Paguy\Local Settings\Application Data\Microsoft\Internet Explorer\frameiconcache.dat [18712]
O61 - LFC: 16/04/2013 - 07:12:32 ---A- C:\Documents and Settings\Paguy\Local Settings\Application Data\Google\Toolbar\metrics_2974330035446.xml [3052]
O61 - LFC: 16/04/2013 - 08:06:39 ---A- C:\Documents and Settings\Paguy\Application Data\Microsoft\Internet Explorer\Quick Launch\ZNsoft Xp.lnk [1909]
O61 - LFC: 16/04/2013 - 08:06:39 ---A- C:\Documents and Settings\Paguy\Bureau\ZNsoft Xp.lnk [1891]
O61 - LFC: 16/04/2013 - 08:07:06 ---A- C:\Documents and Settings\Paguy\Local Settings\Application Data\Google\Toolbar\metrics_12773472978042.xml [1549]
O61 - LFC: 17/04/2013 - 07:18:40 ---A- C:\Documents and Settings\Paguy\Recent\mbam-log-2013-04-16 (21-38-36).txt.lnk [369]
O61 - LFC: 17/04/2013 - 07:18:41 ---A- C:\Documents and Settings\Paguy\Recent\USB2GO (E).lnk [185]
O61 - LFC: 17/04/2013 - 07:20:58 ---A- C:\Documents and Settings\Paguy\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences [328]
O61 - LFC: 17/04/2013 - 07:27:36 -SHA- C:\Documents and Settings\Paguy\Application Data\Microsoft\Credentials\S-1-5-21-2050404483-677177641-1429353510-1007\Credentials [1332]
O61 - LFC: 17/04/2013 - 07:27:36 -SHA- C:\Documents and Settings\Paguy\Local Settings\Application Data\Microsoft\Credentials\S-1-5-21-2050404483-677177641-1429353510-1007\Credentials [2954]
O61 - LFC: 17/04/2013 - 07:40:45 -SHA- C:\Documents and Settings\Paguy\IETldCache\index.dat [262144]
~ 3 Fichiers temporaires (Temporary files)
~ 3 Fichiers cookies (Cookies files)
~ Files: 40 Legitimates Filtered in 06mn 17s



---\\ Liste des outils de nettoyage (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
~ ADS: Scanned in 00mn 00s



---\\ Liste des services Legacy (O64)
O64 - Services: CurCS - 14/04/2008 - C:\WINDOWS\system32\svchost.exe (EventSystem) .(.Microsoft Corporation - Generic Host Process for Win32 Services.) - LEGACY_EVENTSYSTEM
O64 - Services: CurCS - 27/07/2004 - C:\Program Files\HPQ\SHARED\HPQWMI.exe (hpqwmi) .(.Hewlett-Packard Development Company, L.P. - hpqwmi Module.) - LEGACY_HPQWMI
O64 - Services: CurCS - 10/05/2004 - C:\Program Files\iPod\bin\iPodService.exe (iPodService) .(.Apple Computer, Inc. - Module iPodService.) - LEGACY_IPODSERVICE
O64 - Services: CurCS - 01/05/2003 - C:\WINDOWS\system32\DRIVERS\strmdisp.sys (StreamDispatcher) .(.Conexant Systems, Inc. - Conexant Stream Dispatcher.) - LEGACY_STREAMDISPATCHER
O64 - Services: CurCS - ??\??\???? - Pas de propri�taire (ZDPSp50) .(...) - LEGACY_ZDPSP50
~ Legacy: 163 Legitimates Filtered in 00mn 05s



---\\ File Associations Shell Spawning (O67)
O67 - Shell Spawning: <.js> [HKLM\..\open\Command] (.Microsoft Corporation - Microsoft (R) Console Based Script Host.) -- C:\WINDOWS\system32\CScript.exe
O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.Not Key.)
O67 - Shell Spawning: <.js> [HKCR\..\open\Command] (.Microsoft Corporation - Microsoft (R) Console Based Script Host.) -- C:\WINDOWS\system32\CScript.exe
~ FASS Keys: 17 Legitimates Filtered in 00mn 00s



---\\ Start Menu Internet (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: <>[HKLM\..\Shell\open\Command] (.Not Key.)
~ Keys: Scanned in 00mn 00s



---\\ Search Browser Infection (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {814C76CB-2623-43F4-AAD0-58A0E5190A20} - (Orange) - http://r.orange.fr
O69 - SBI: SearchScopes [HKCU] {D34B1B88-B943-4964-A4C3-25AFAEB32641} - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {DEC0D2B4-C57F-43CE-A300-DAEC186F35FD} - (Search) - http://flvdirect.iamwired.net
~ Keys: Scanned in 00mn 00s



---\\ Recherche particuliere � la racine de certains dossiers (O84)
[MD5.030F8EB58FC0172F3F26BE0F98B6A249] [SPRF][12/01/2005] (...) -- C:\Documents and Settings\Paguy\Local Settings\Application Data\fusioncache.dat [128]
[MD5.BDA238D4079311DB2C4C96A5A098C956] [SPRF][17/03/2013] (...) -- C:\Documents and Settings\Paguy\Bureau\adwcleaner (1).exe [597667]
[MD5.02C4F6C257542FCB7C58B7164D674471] [SPRF][13/04/2013] (...) -- C:\Documents and Settings\Paguy\Bureau\adwcleaner.exe [613083]
[MD5.0FB6D382FA5FBF72D05FC2A4503B7DF2] [SPRF][17/03/2013] (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Documents and Settings\Paguy\Bureau\mbam-setup-1.70.0.1100.exe [10156344]
[MD5.8A200CBE3AF04B7212AF0F94FA143EBA] [SPRF][17/03/2013] (...) -- C:\Documents and Settings\Paguy\Bureau\RogueKiller-8.5.3.exe [816128]
[MD5.6EAB6295856E32F8962EDE34C920FAD3] [SPRF][24/02/2007] (.InstallShield Software Corporation - InstallShield (R) Setup Launcher.) -- C:\Program Files\SetupSynchroInternetOrange_3.66.003.exe [3168212]
[MD5.29CFE9ED23C55E55838A789EB1182A9B] [SPRF][04/10/2008] (.Adobe Systems Incorporated - Adobe� Flash� Player ActiveX Installer.) -- C:\WINDOWS\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe [1887080]
~ Files: Scanned in 00mn 04s



---\\ Scan Additionnel (O88)
Database Version : v2.11560 - (16/04/2013)
Cl�s trouv�es (Keys found) : 21
Valeurs trouv�es (Values found) : 0
Dossiers trouv�s (Folders found) : 0
Fichiers trouv�s (Files found) : 0

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype
[HKLM\Software\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype
[HKLM\Software\Microsoft\Internet Explorer\extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{A047FE02-C91C-41CB-898C-4ED21B86025A}] =>Toolbar.Orange
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKLM\Software\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}] =>Toolbar.Agent
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}] =>Toolbar.Agent
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}] =>Toolbar.Agent
[HKLM\Software\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}] =>Toolbar.Agent
[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}] =>Toolbar.Agent
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}] =>Toolbar.Agent
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] =>Toolbar.Bing
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] =>Toolbar.Bing
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D970ED5-3EDA-438D-BFFD-715931E2775B}] =>Toolbar.Sorcim
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1D970ED5-3EDA-438D-BFFD-715931E2775B}] =>Toolbar.Sorcim
[HKLM\Software\Classes\CLSID\{1D970ED5-3EDA-438D-BFFD-715931E2775B}] =>Toolbar.Sorcim
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1D970ED5-3EDA-438D-BFFD-715931E2775B}] =>Toolbar.Sorcim
~ Additionnel: Scanned in 00mn 39s



---\\ Product Upgrade Codes (O90)
O90 - PUC: "160231E2A87C4D848A99D1319B1D98AF" . (.Memories Disc Creator 2.0.) -- C:\WINDOWS\Installer\{2E132061-C78A-48D4-A899-1D13B9D189FA}\HewlettPackard_0002ICON.exe
~ Update Products: 91 Legitimates Filtered in 00mn 00s



---\\ Etat g�n�ral des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 24/03/2006 192160 | (ccEvtMgr) . (.Symantec Corporation.) - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
SR - | Auto 24/03/2006 169632 | (ccSetMgr) . (.Symantec Corporation.) - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
SR - | Auto 01/08/2006 31888 | (DefWatch) . (.Symantec Corporation.) - C:\Program Files\Symantec AntiVirus\DefWatch.exe
SS - | Demand 14/04/2008 225280 | (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\system32\dmadmin.exe
SS - | Auto 05/02/2010 135664 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 05/02/2010 135664 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 29/11/2012 194032 | (gusvc) . (.Google.) - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Demand 27/07/2004 98304 | (hpqwmi) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files\HPQ\SHARED\HPQWMI.exe
SS - | Demand 14/11/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
SS - | Demand 10/05/2004 401408 | (iPodService) . (.Apple Computer, Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SR - | Auto 15/01/2013 154032 | (JavaQuickStarterService) . (.Sun Microsystems, Inc..) - C:\Program Files\Java\jre6\bin\jqs.exe
SS - | Demand 29/03/2006 2045632 | C:\Program Files\Symantec\LIVEUP~1\LUCOMS~1.exe (LiveUpdate) . (.Symantec Corporation.) - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.exe
SR - | Auto 12/03/2004 81920 | (NVSvc) . (.NVIDIA Corporation.) - C:\WINDOWS\system32\nvsvc32.exe
SS - | Auto 18/09/2012 1082016 | (Orange update Core Service) . (.France Telecom SA.) - C:\Program Files\Orange\OrangeUpdate\Service\OUCore.exe
SR - | Auto 09/08/2007 73728 | (Pml Driver HPZ12) . (.HP.) - C:\WINDOWS\system32\HPZipm12.exe
SS - | Demand 01/08/2006 118928 | (SavRoam) . (.symantec.) - C:\Program Files\Symantec AntiVirus\SavRoam.exe
SR - | Auto 13/08/2012 3064000 | (Skype C2C Service) . (.Skype Technologies S.A..) - C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
SS - | Auto 09/11/2012 160944 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe
SS - | Demand 24/01/2006 214720 | (SNDSrvc) . (.Symantec Corporation.) - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
SR - | Auto 11/04/2006 1160848 | (SPBBCSvc) . (.Symantec Corporation.) - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
SR - | Auto 01/08/2006 1827472 | (Symantec AntiVirus) . (.Symantec Corporation.) - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
~ Services: Scanned in 00mn 05s



---\\ Recherche Master Boot Record Infection (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by Paguy at 17/04/2013 09:01:36

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
1 nt!IofCallDriver[0x804E13B9] >> \Device\Harddisk0\DR0[0x8234DAB8]
kernel: MBR read successfully
user & kernel MBR OK
~ MBR: 13 Legitimates Filtered in 00mn 02s



---\\ Recherche Master Boot Record Infection (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Paguy at 17/04/2013 09:01:38

********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 04s



~ 1003 Legitimates filtered by white list
End of the scan (567 lines in 17mn 27s)(0)

Publicité

Soutenons La Quadrature du Net ! Soutenons La Quadrature du Net !

Signaler le contenu de ce document

Publicité

Soutenons La Quadrature du Net !