Rapport de ZHPDiag v2013.4.19.112 par Nicolas Coolman, Update du 19/04/2013
Run by st�phanie at 20/04/2013 10:46:51
State : Version � jour.
WhiteList : Enable
High Elevated Privileges : OK
UAC :


---\\ Web Browser
MSIE: Internet Explorer v9.0.8112.16421
MFIE: Mozilla Firefox 20.0.1
GCIE: Google Chrome v26.0.1410.64 (Defaut)
OBIE: Safari v5.34.57.2

---\\ Windows Product Information
~ Langage: Fran�ais
Windows Vista Home Premium Edition, 32-bit Service Pack 2 (Build 6002)
Windows Server License Manager Script : OK
Windows Automatic Updates : OK

---\\ System Protection
Avira AntiVir Personal - Free Antivirus v10.2.0.167
Malwarebytes Anti-Malware version 1.62.0.1300
SUPERAntiSpyware Free Edition v4.30.0.1004

---\\ System Optimizer
CCleaner v3.17

---\\ Software Update
Adobe Flash Player 11 Plugin
Adobe Reader X
Java 7 Update 17

---\\ System Information
~ Processor: x86 Family 15 Model 6 Stepping 5, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Sans �chec avec prise en charge du r�seau (Fail-safe with network boot)
Total RAM: 3069 MB (72% free)
System Restore: Activ� (Enable)
System drive C: has 22 GB (19%) free of 113 GB

---\\ Logged in mode
~ Computer Name: PC-DE-ST�PHANIE
~ User Name: st�phanie
~ All Users Names: st�phanie, ASPNET, Administrateur,
~ Unselected Option: None
Logged in as Administrator

---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Users\st�phanie\AppData\Roaming\
~ %Desktop% : C:\Users\st�phanie\Desktop\
~ %Favorites% : C:\Users\st�phanie\Favorites\
~ %LocalAppData% : C:\Users\st�phanie\AppData\Local\
~ %StartMenu% : C:\Users\st�phanie\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 22 Go of 113 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 3 Go of 113 Go)
E:\ CD-ROM drive (Not Inserted)
G:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
H:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
I:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
J:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
K:\ CD-ROM drive (Free 0 Go of 0 Go)



---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UacDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] WarnOnHTTPSToHTTPRedirect: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : OK
~ Security Center: Scanned in 00mn 00s



---\\ Recherche particuli�re de fichiers g�n�riques
[MD5.D07D4C3038F3578FFCE1C0237F2A1253] - (.Microsoft Corporation - Explorateur Windows.) (.11/04/2009 - 07:27:36.) -- C:\Windows\Explorer.exe [2926592]
[MD5.101BA3EA053480BB5D957EF37C06B5ED] - (.Microsoft Corporation - Application de d�marrage de Windows.) (.19/01/2008 - 08:33:37.) -- C:\Windows\System32\Wininit.exe [96768]
[MD5.C5B6468422DB1C8AA36C32CBB0197E5E] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.22/02/2013 - 04:38:00.) -- C:\Windows\System32\wininet.dll [1129472]
[MD5.898E7C06A350D4A1A64A9EA264D55452] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.11/04/2009 - 07:28:13.) -- C:\Windows\System32\Winlogon.exe [314368]
[MD5.3911B972B55FEA0478476B2E777B29FA] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.21/04/2011 - 14:58:27.) -- C:\Windows\system32\Drivers\AFD.sys [273408]
[MD5.1F05B78AB91C9075565A9D8A4B880BC4] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.11/04/2009 - 07:32:26.) -- C:\Windows\system32\Drivers\atapi.sys [19944]
[MD5.7ADD03E75BEB9E6DD102C3081D29840A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.19/01/2008 - 06:28:02.) -- C:\Windows\system32\Drivers\Cdfs.sys [70144]
[MD5.6B4BFFB9BECD728097024276430DB314] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.11/04/2009 - 05:39:17.) -- C:\Windows\system32\Drivers\Cdrom.sys [67072]
[MD5.622C41A07CA7E6DD91770F50D532CB6C] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.14/04/2011 - 15:59:03.) -- C:\Windows\system32\Drivers\DfsC.sys [75264]
[MD5.062452B7FFD68C8C042A6261FE8DFF4A] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.11/04/2009 - 05:42:42.) -- C:\Windows\system32\Drivers\HDAudBus.sys [561152]
[MD5.22D56C8184586B7A1F6FA60BE5F5A2BD] - (.Microsoft Corporation - Pilote de port i8042.) (.19/01/2008 - 06:49:18.) -- C:\Windows\system32\Drivers\i8042prt.sys [54784]
[MD5.8793643A67B42CEC66490B2A0CF92D68] - (.Microsoft Corporation - IP Network Address Translator.) (.19/01/2008 - 06:56:28.) -- C:\Windows\system32\Drivers\IpNat.sys [100864]
[MD5.1E94971C4B446AB2290DEB71D01CF0C2] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.29/04/2011 - 14:24:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [106496]
[MD5.ECD64230A59CBD93C85F1CD1CAB9F3F6] - (.Microsoft Corporation - MBT Transport driver.) (.11/04/2009 - 05:45:37.) -- C:\Windows\system32\Drivers\netBT.sys [185856]
[MD5.2C1121F2B87E9A6B12485DF53CD848C7] - (.Microsoft Corporation - Pilote du syst�me de fichiers NT.) (.03/03/2013 - 20:07:52.) -- C:\Windows\system32\Drivers\ntfs.sys [1082232]
[MD5.8A79FDF04A73428597E2CAF9D0D67850] - (.Microsoft Corporation - Pilote de port parall�le.) (.19/01/2008 - 06:49:33.) -- C:\Windows\system32\Drivers\Parport.sys [79360]
[MD5.A214ADBAF4CB47DD2728859EF31F26B0] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.19/01/2008 - 06:56:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [76288]
[MD5.E8BD98D46F2ED77132BA927FCCB47D8B] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.02/11/2006 - 10:03:00.) -- C:\Windows\system32\Drivers\rdpdr.sys [242688]
[MD5.7B75299A4D201D6A6533603D6914AB04] - (.Microsoft Corporation - SMB Transport driver.) (.11/04/2009 - 05:45:22.) -- C:\Windows\system32\Drivers\smb.sys [66560]
[MD5.76B06EB8A01FC8624D699E7045303E54] - (.Microsoft Corporation - TDI Translation Driver.) (.11/04/2009 - 05:45:56.) -- C:\Windows\system32\Drivers\tdx.sys [72192]
[MD5.786DB5771F05EF300390399F626BF30A] - (.Microsoft Corporation - Pilote de clich� instantan� du volume.) (.21/08/2012 - 12:47:42.) -- C:\Windows\system32\Drivers\volsnap.sys [224640]
~ Generic Processes: Scanned in 00mn 02s



---\\ Etat des fichiers cach�s (Cach�/Total)
~ Mes images (My Pictures) : 1/4
~ Mes musiques (My Musics) : 63/87
~ Mes Videos (My Videos) : 1/42
~ Mes Favoris (My Favorites) : 3/305
~ Mes Documents (My Documents) : 3/2263
~ Mon Bureau (My Desktop) : 1/18
~ Menu demarrer (Programs) : 1/52
~ Hidden Files: Scanned in 00mn 18s



---\\ Processus lanc�s
[MD5.4E9592BB2C100E571F82640E59E9ECD5] - (.Google Inc. - Google Chrome.) -- C:\Users\st�phanie\AppData\Local\Google\Chrome\Application\chrome.exe [1312720] [PID.1452]
[MD5.774CD0E47EB7CB97A225AD120CD85CFD] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [6879744] [PID.1248]
[MD5.5DAF7081A4BB112FA3F1915819330A3E] - (...) -- C:\Program Files\ZHPDiag\pv.exe [61440] [PID.0]
~ Processes Running: Scanned in 00mn 00s



---\\ Google Chrome, D�marrage,Recherche,Extensions (G0,G1,G2)
C:\Users\st�phanie\AppData\Local\Google\Chrome\User Data\Default\Preferences
G1 - GCS: Preference [User Data\Default] None
~ Google Browser: Scanned in 00mn 00s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\st�phanie\AppData\Roaming\Mozilla\Firefox\Profiles\k0u2daf0.default\prefs.js
M3 - MFPP: Plugins - [st�phanie] -- C:\Users\st�phanie\AppData\Roaming\Mozilla\Firefox\Profiles\k0u2daf0.default\searchplugins\delta.xml
M3 - MFPP: Plugins - [st�phanie] -- C:\Users\st�phanie\AppData\Roaming\Mozilla\Firefox\Profiles\k0u2daf0.default\searchplugins\YouGoo.xml
M3 - MFPP: Plugins - [st�phanie] -- C:\Program Files\Mozilla FireFox\searchplugins\Web Search.xml
M0 - MFSP: prefs.js [st�phanie - k0u2daf0.default] about:home
M2 - MFEP: prefs.js [st�phanie - k0u2daf0.default\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}] [dwhelper] DownloadHelper v4.9.14 (..)
P2 - FPN:Firefox Plugin Navigator . (.The OpenSSL Project, http://www.openssl.org - OpenSSL Shared Library.) -- C:\Program Files\Mozilla Firefox\Plugins\libdivx.dll
P2 - FPN:Firefox Plugin Navigator . (.BitComet - BitCometAgent for Firefox.) -- C:\Program Files\Mozilla Firefox\Plugins\npBitCometAgent.dll
P2 - FPN:Firefox Plugin Navigator . (.DivX,Inc. - DivX Web Player version 1.5.0.52.) -- C:\Program Files\Mozilla Firefox\Plugins\npdivx32.dll
P2 - FPN:Firefox Plugin Navigator . (.DivX, Inc - npdivxplayerplugin.) -- C:\Program Files\Mozilla Firefox\Plugins\npDivxPlayerPlugin.dll
P2 - FPN:Firefox Plugin Navigator . (.The OpenSSL Project, http://www.openssl.org - OpenSSL Shared Library.) -- C:\Program Files\Mozilla Firefox\Plugins\ssldivx.dll
P2 - FPN: [HKLM] [@bittorrent.com/BitTorrentDNA] - (.BitTorrent, Inc. - Delivery Network Acceleration by BitTorrent�.) -- C:\Program Files\DNA\plugins\npbtdna.dll
P2 - FPN: [HKLM] [@divx.com/DivX Browser Plugin,version=1.0.0] - (.DivX,Inc. - DivX Web Player version 1.5.0.52.) -- C:\Program Files\DivX\DivX Web Player\npdivx32.dll
P2 - FPN: [HKLM] [@divx.com/DivX Player Plugin,version=1.0.0] - (.DivX, Inc - npdivxplayerplugin.) -- C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll
~ Firefox Browser: 60 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, D�marrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com =>Toolbar.Babylon
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.msn.com
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Google Inc. - Google Update.) (No version) -- (.not file.)
R4 - HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,Enabled = 2
~ IE Browser: 13 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Keys: Scanned in 00mn 00s



---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 20



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Acer eDataSecurity Management - [HKLM]{5CBE3B7C-1E47-477e-A7DD-396DB0476E29} . (.HiTRUST - eDStoolbar Module.) -- C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Mirar - [HKLM]{7C523BE6-3EB3-4FD5-87D1-FC95E65AA763} . (...) -- (.not file.)
O3 - Toolbar: Easy Photo Print - [HKLM]{9421DD08-935F-4701-A9CA-22DF90AC4EA6} . (.SEIKO EPSON CORPORATION / CyCom Technology - Epson Easy Photo Print (TBL).) -- C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
~ Toolbar: Scanned in 00mn 00s



---\\ Applications d�marr�es par registre & par dossier (O4)
O4 - HKLM\..\Run: [Windows Defender] . (.Microsoft Corporation - Windows Defender User Interface.) -- C:\Program Files\Windows Defender\MSASCui.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] . (.HiTRUST - eDataSecurity System Loader( Load and prepa.) -- C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [WarReg_PopUp] . (.Acer Inc. - WR_PopUp.) -- C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [BigDogPath] . (.BIGDOG - BIGDOG.) -- C:\Windows\VM_STI.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] . (...) -- C:\Windows\system32\SysMonitor.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - HD Audio Control Panel.) -- C:\Windows\RtHDVCpl.exe
O4 - HKLM\..\Run: [avgnt] . (.Avira GmbH - Antivirus System Tray Tool.) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
O4 - HKLM\..\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
O4 - HKLM\..\Run: [KiesTrayAgent] . (.Samsung Electronics Co., Ltd. - Kies TrayAgent Application.) -- C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
O4 - HKLM\..\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- C:\Program Files\QuickTime\QTTask.exe
O4 - HKLM\..\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [ehTray.exe] . (.Microsoft Corporation - Media Center Tray Applet.) -- C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [EPSON SX410 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIFCE.exe
O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\st�phanie\AppData\Local\Google\Update\GoogleUpdate.exe
O4 - HKCU\..\Run: [Win Startup Manager] . (.Microsoft Corporation - Microsoft� Resource File To COFF Object Con.) -- C:\Users\st�phanie\AppData\Roaming\Windows NT\recovery.exe
O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Users\st�phanie\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKCU\..\Run: [KiesHelper] . (.Samsung - Kies.) -- C:\Program Files\Samsung\Kies\KiesHelper.exe
O4 - HKCU\..\Run: [KiesPDLR] . (.Pas de propri�taire - KiesPDLR.) -- C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - HKCU\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe
O4 - HKCU\..\Run: [WMPNSCFG] . (.Microsoft Corporation - Application de configuration du service Par.) -- C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Spotify] . (.Spotify Ltd - Spotify.) -- C:\Users\st�phanie\AppData\Roaming\Spotify\Spotify.exe
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] oobefldr.dll
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] oobefldr.dll
O4 - HKUS\S-1-5-21-2555148778-847838647-376290905-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKUS\S-1-5-21-2555148778-847838647-376290905-1000\..\Run: [ehTray.exe] . (.Microsoft Corporation - Media Center Tray Applet.) -- C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-21-2555148778-847838647-376290905-1000\..\Run: [EPSON SX410 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIFCE.exe
O4 - HKUS\S-1-5-21-2555148778-847838647-376290905-1000\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\st�phanie\AppData\Local\Google\Update\GoogleUpdate.exe
O4 - HKUS\S-1-5-21-2555148778-847838647-376290905-1000\..\Run: [Win Startup Manager] . (.Microsoft Corporation - Microsoft� Resource File To COFF Object Con.) -- C:\Users\st�phanie\AppData\Roaming\Windows NT\recovery.exe
O4 - HKUS\S-1-5-21-2555148778-847838647-376290905-1000\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Users\st�phanie\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKUS\S-1-5-21-2555148778-847838647-376290905-1000\..\Run: [KiesHelper] . (.Samsung - Kies.) -- C:\Program Files\Samsung\Kies\KiesHelper.exe
O4 - HKUS\S-1-5-21-2555148778-847838647-376290905-1000\..\Run: [KiesPDLR] . (.Pas de propri�taire - KiesPDLR.) -- C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - HKUS\S-1-5-21-2555148778-847838647-376290905-1000\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files\Windows Live\Messenger\msnmsgr.exe
O4 - HKUS\S-1-5-21-2555148778-847838647-376290905-1000\..\Run: [WMPNSCFG] . (.Microsoft Corporation - Application de configuration du service Par.) -- C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-21-2555148778-847838647-376290905-1000\..\Run: [Spotify] . (.Spotify Ltd - Spotify.) -- C:\Users\st�phanie\AppData\Roaming\Spotify\Spotify.exe
~ Application: Scanned in 00mn 01s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Programs: Spotify.lnk . (.Spotify Ltd - Spotify.) -- C:\Users\st�phanie\AppData\Roaming\Spotify\spotify.exe
O4 - GS\Programs: TeamViewer 7.lnk . (.TeamViewer GmbH - TeamViewer Remote Control Application.) -- C:\Users\st�phanie\temp\TeamViewer\Version7\TeamViewer.exe
O4 - GS\Programs: Windows Mail.lnk . (.Microsoft Corporation - Windows Mail.) -- C:\Program Files\Windows Mail\WinMail.exe
O4 - GS\Programs: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe
O4 - GS\QuickLaunch: Advanced WindowsCare V2 Personal.lnk . (.IObit - Advanced WindowsCare V2 Personal.) -- C:\Program Files\IObit\Advanced WindowsCare V2\Awcl.exe
O4 - GS\QuickLaunch: Apple Safari.lnk . (...) -- C:\Windows\Installer\{C779648B-410E-4BBA-B75B-5815BCEFE71D}\SafariIco.exe
O4 - GS\QuickLaunch: BitTorrent.lnk . (.BitTorrent, Inc. - BitTorrent.) -- C:\Program Files\BitTorrent\bittorrent.exe
O4 - GS\QuickLaunch: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\st�phanie\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch: Horaires de Trains.lnk - Cl� orpheline
O4 - GS\QuickLaunch: InfraRecorder.lnk . (.Christian Kindahl - InfraRecorder.) -- C:\Program Files\InfraRecorder\infrarecorder.exe
O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O4 - GS\QuickLaunch: Mozilla Thunderbird.lnk . (.Mozilla Corporation - Thunderbird.) -- C:\Program Files\Mozilla Thunderbird\thunderbird.exe
O4 - GS\QuickLaunch: MP3 Rocket 6.3.2.lnk . (...) -- C:\Program Files\MP3 Rocket\MP3Rocket.exe
O4 - GS\QuickLaunch: Samsung Kies.lnk . (.Samsung - Kies.) -- C:\Program Files\Samsung\Kies\Kies.exe
O4 - GS\QuickLaunch: Vos D�marches Administratives.lnk - Cl� orpheline
O4 - GS\QuickLaunch: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe
O4 - GS\QuickLaunch: XML Marker.lnk . (...) -- C:\Program Files\XML Marker\xmlmarker.exe
O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SendTo: XML Marker.lnk . (...) -- C:\Program Files\XML Marker\xmlmarker.exe
O4 - GS\Desktop: Assistance Livebox.lnk . (...) -- C:\Program Files\Orange\Assistance Livebox\AssistanceLivebox.exe
O4 - Global Startup: C:\Users\st�phanie\Desktop\Contr�le parental.url . (...) -- C:\Users\st�phanie\Desktop\Contr�le parental.url
O4 - GS\Desktop: EasyCleaner.lnk . (.ToniArts - EasyCleaner executable.) -- C:\Program Files\ToniArts\EasyCleaner\EasyClea.exe
O4 - GS\Desktop: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\st�phanie\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop: Revo Uninstaller.lnk . (.VS Revo Group - Revo Uninstaller.) -- C:\Program Files\VS Revo Group\Revo Uninstaller\Revouninstaller.exe
O4 - GS\Desktop: Spotify.lnk . (.Spotify Ltd - Spotify.) -- C:\Users\st�phanie\AppData\Roaming\Spotify\spotify.exe
O4 - GS\Desktop: TeamViewer 7.lnk . (.TeamViewer GmbH - TeamViewer Remote Control Application.) -- C:\Users\st�phanie\temp\TeamViewer\Version7\TeamViewer.exe
O4 - GS\Desktop: TornTV.lnk . (.TornTVApp - TornTVApp.) -- C:\Program Files\TornTV.com\TornTV.exe =>Hijacker.TornTV
O4 - GS\Desktop: TreeSize Free.lnk . (.JAM Software - TreeSize Free hard disk space manager.) -- C:\Program Files\JAM Software\TreeSize Free\TreeSizeFree.exe
O4 - GS\Desktop: Video Downloader.lnk . (...) -- C:\Program Files\vGrabber-software\VideoDownloader.exe
O4 - GS\Desktop: WBFS Manager 3.0.lnk . (...) -- C:\Program Files\WBFS\WBFS Manager 3.0\WBFSManager.exe
O4 - GS\Desktop: Windows Photo Gallery.lnk . (.Microsoft Corporation - Galerie de photos Windows.) -- C:\Program Files\Windows Photo Gallery\WindowsPhotoGallery.exe
O4 - GS\Desktop: Wondershare Streaming Audio Recorder.lnk . (...) -- C:\Program Files\Wondershare\Streaming Audio Recorder\StreamingAudioRecorder.exe
O4 - GS\Desktop: XML Marker.lnk . (...) -- C:\Program Files\XML Marker\xmlmarker.exe
~ Global Startup: Scanned in 00mn 00s



---\\ Boutons situ�s sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} . (.Microsoft Corporation - Windows Live Messenger Companion core resources.) -- C:\Program Files\Windows Live\Companion\companionres.dll
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} -- Cl� orpheline
O9 - Extra button: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -- Cl� orpheline
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} . (.Microsoft Corporation - Windows Live Writer Blog This Extension.) -- C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} -- Cl� orpheline
O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Messenger.) -- C:\Program Files\Messenger\MSMSGS.exe
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} ((no name)) - http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} ((no name)) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
~ Objets ActiveX: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{33417D56-5BD1-4033-BD59-4783FF91B01D}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{33417D56-5BD1-4033-BD59-4783FF91B01D}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{33417D56-5BD1-4033-BD59-4783FF91B01D}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (.Microsoft Corporation - Windows Live Album Download Protocol Handle.) -- C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter: application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-cl�s Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: !SASWinLogon . (.SUPERAntiSpyware.com - SUPERAntiSpyware WinLogon Processor.) -- C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
~ Winlogon: Scanned in 00mn 00s



---\\ Cl� de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Biblioth�que de l'interface utilisateur du.) -- C:\Windows\System32\browseui.dll
~ STS/SSO: Scanned in 00mn 00s



---\\ Liste des services NT non Microsoft et non d�sactiv�s (O23)
O23 - Service: Capture Device Service (Capture Device Service) . (.InterVideo Inc. - Capture Device Service.) - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: eRecovery Service (eRecoveryService) . (.Acer Inc. - eRecoveryService.) - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) . (.Pas de propri�taire - RichVideo Module.) - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
~ Services: 15 Legitimates Filtered in 00mn 06s



---\\ T�ches planifi�es en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\PCConfidential.job [416]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\RegClean Pro_DEFAULT.job [272]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\RegClean Pro_UPDATES.job [280]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\rpc.job [386]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\SLOW-PCfighter-st�phanie-Startup.job [364]
~ Scheduled Task: 11 Legitimates Filtered in 00mn 00s



---\\ Logiciels install�s (O42)
O42 - Logiciel: BitTorrent - (.BitTorrent, Inc.) [HKCU] -- BitTorrent
O42 - Logiciel: BitTorrent - (.BitTorrent, Inc.) [HKLM] -- BitTorrent
O42 - Logiciel: Contextual Tool Extrafind - (...) [HKLM] -- 9fc1711b
O42 - Logiciel: Favorit (oxhox) - (...) [HKLM] -- oxhox
O42 - Logiciel: Filters Unlimited 2.0 - (...) [HKLM] -- Filters Unlimited_is1
O42 - Logiciel: Free Stuff version 1.5 - (...) [HKLM] -- {7E1B484F-C15A-48C2-BF42-450310E39165}_is1
O42 - Logiciel: Images&Search Ver.1 - (.Images&Search.) [HKLM] -- {7E6A94FF-8260-4D3D-8D27-BC057BE50399}_is1
O42 - Logiciel: MP3 Rocket - (...) [HKLM] -- MP3 Rocket
O42 - Logiciel: Mirar - (...) [HKLM] -- {7C523BE6-3EB3-4FD5-87D1-FC95E65AA763}
O42 - Logiciel: RegClean Pro - (.Systweak Inc.) [HKLM] -- RegClean Pro_is1
O42 - Logiciel: STK014_V2.01 - (...) [HKLM] -- {E7C401C6-B490-4C92-9E6D-F6A862A27B65}
O42 - Logiciel: SmartGlobe(TM) 3, V3.13.116001 - (.Oregon Scientific.) [HKLM] -- Oregon Scientific SmartGlobe(TM) 3_is1
O42 - Logiciel: TViX NetShare 2.10 - (.DVICO.) [HKLM] -- {8409B1FB-9B55-452A-8CDC-4AE9D0F97FB4}
O42 - Logiciel: Trellian Button Factory - (...) [HKLM] -- Trellian Button Factory
O42 - Logiciel: XML Marker version 1.1 - (.Symbol Click.) [HKLM] -- XML Marker_is1
~ Logic: 157 Legitimates Filtered in 00mn 01s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\Anfy Team]
[HKCU\Software\AppDataLow\IE7Pro]
[HKCU\Software\AppDataLow\IEPro]
[HKCU\Software\AppDataLow\Software\AskSBar]
[HKCU\Software\AppDataLow\Software\Screensavers.com]
[HKCU\Software\BI]
[HKCU\Software\BitComet]
[HKCU\Software\Bot Productions]
[HKCU\Software\ContextEnhancer]
[HKCU\Software\DownloadMR]
[HKCU\Software\Fb_hack]
[HKCU\Software\FunkyEmoticons]
[HKCU\Software\GoforFiles]
[HKCU\Software\InfraRecorder]
[HKCU\Software\JetCar]
[HKCU\Software\Kazaa]
[HKCU\Software\LetsTunes]
[HKCU\Software\Live-Player]
[HKCU\Software\MGS]
[HKCU\Software\MicroGaming]
[HKCU\Software\Oregon Scientific]
[HKCU\Software\Photocite]
[HKCU\Software\Rentabiliweb]
[HKCU\Software\Serif]
[HKCU\Software\StudioV5]
[HKCU\Software\SweetIM] =>PUP.SweetIM
[HKCU\Software\Symbol Click]
[HKCU\Software\TViX]
[HKCU\Software\Vista-Buttons]
[HKCU\Software\WebAnim]
[HKCU\Software\ZONEJEUX]
[HKCU\Software\delta LTD]
[HKCU\Software\eMule]
[HKCU\Software\iPhotoSoft]
[HKLM\Software\AskSBar]
[HKLM\Software\BSmax ScripT]
[HKLM\Software\DVICO]
[HKLM\Software\Deckard]
[HKLM\Software\FunkyEmoticons]
[HKLM\Software\GoforFiles]
[HKLM\Software\IEPro]
[HKLM\Software\InstallationKit]
[HKLM\Software\LetsTunes]
[HKLM\Software\LimeWire]
[HKLM\Software\Live-Player]
[HKLM\Software\NetDragon]
[HKLM\Software\Photocite]
[HKLM\Software\STK014]
[HKLM\Software\Serif]
[HKLM\Software\SweetIM] =>PUP.SweetIM
[HKLM\Software\Syntek]
[HKLM\Software\TRELLIAN]
[HKLM\Software\WCM]
[HKLM\Software\WebAnim Gif]
[HKLM\Software\Winferno]
[HKLM\Software\Winsudate]
[HKLM\Software\iPhotoSoft]
~ Key Software: 358 Legitimates Filtered in 00mn 01s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 23/12/2008 - 12:32:19 - [0] ----D C:\Program Files\B4Playing
O43 - CFD: 29/07/2007 - 16:22:25 - [0,668] ----D C:\Program Files\BearShare Applications =>PUP.BearShare
O43 - CFD: 09/02/2013 - 15:32:41 - [1,060] ----D C:\Program Files\BitTorrent
O43 - CFD: 09/02/2013 - 15:06:42 - [119,360] ----D C:\Program Files\CityVilleBot
O43 - CFD: 25/11/2010 - 16:02:05 - [0] ----D C:\Program Files\CopyRightLeft
O43 - CFD: 10/01/2009 - 23:45:41 - [0,403] ----D C:\Program Files\DNA
O43 - CFD: 25/03/2009 - 22:07:44 - [1,063] ----D C:\Program Files\DVICO
O43 - CFD: 01/04/2012 - 22:27:48 - [0,684] ----D C:\Program Files\Free Stuff
O43 - CFD: 04/01/2008 - 11:58:50 - [0] ----D C:\Program Files\IE7Pro
O43 - CFD: 25/08/2010 - 10:32:34 - [0,679] ----D C:\Program Files\ImagesSearch
O43 - CFD: 15/08/2007 - 15:07:04 - [0,000] ----D C:\Program Files\Impression Grand Format
O43 - CFD: 06/08/2011 - 18:00:48 - [13,329] ----D C:\Program Files\InfraRecorder
O43 - CFD: 02/11/2007 - 22:56:49 - [9,816] ----D C:\Program Files\KSS
O43 - CFD: 10/01/2011 - 13:56:05 - [28,034] ----D C:\Program Files\LetsTunes
O43 - CFD: 26/02/2013 - 00:27:35 - [33,772] ----D C:\Program Files\MP3 Rocket
O43 - CFD: 26/02/2013 - 00:26:27 - [0,298] ----D C:\Program Files\MP3 Rocket Downloader
O43 - CFD: 02/10/2008 - 16:38:40 - [0,000] ----D C:\Program Files\Navilog1
O43 - CFD: 17/01/2011 - 10:32:05 - [2,291] ----D C:\Program Files\NetDragon
O43 - CFD: 25/12/2011 - 22:41:23 - [4,735] ----D C:\Program Files\Oregon Scientific
O43 - CFD: 15/04/2012 - 17:11:35 - [14,723] ----D C:\Program Files\RegClean Pro
O43 - CFD: 16/02/2008 - 22:24:42 - [0] ----D C:\Program Files\Serif
O43 - CFD: 08/09/2012 - 23:01:26 - [0,426] ----D C:\Program Files\STK014_V2.01
O43 - CFD: 22/07/2007 - 16:10:26 - [0] ----D C:\Program Files\SunXi
O43 - CFD: 09/02/2013 - 00:37:22 - [0,844] ----D C:\Program Files\TornTV.com =>Hijacker.TornTV
O43 - CFD: 22/07/2007 - 16:08:05 - [6,427] ----D C:\Program Files\TRELLIAN
O43 - CFD: 09/07/2009 - 17:13:22 - [0,048] ----D C:\Program Files\Winletmin
O43 - CFD: 26/01/2011 - 23:20:09 - [1,478] ----D C:\Program Files\XML Marker
O43 - CFD: 17/01/2011 - 10:36:35 - [0,177] ----D C:\Program Files\Common Files\NetDragon
O43 - CFD: 19/07/2010 - 19:35:23 - [7,413] ----D C:\ProgramData\Artweaver
O43 - CFD: 19/07/2010 - 19:35:23 - [0,532] ----D C:\Users\st�phanie\AppData\Roaming\Artweaver
O43 - CFD: 29/07/2007 - 16:22:27 - [11,466] ----D C:\Users\st�phanie\AppData\Roaming\BearShare =>PUP.BearShare
O43 - CFD: 04/04/2013 - 00:28:23 - [1,483] ----D C:\Users\st�phanie\AppData\Roaming\BitTorrent
O43 - CFD: 15/04/2012 - 14:05:57 - [0,007] ----D C:\Users\st�phanie\AppData\Roaming\Charles
O43 - CFD: 04/08/2009 - 14:42:25 - [0] ----D C:\Users\st�phanie\AppData\Roaming\FunkyEmoticons
O43 - CFD: 16/10/2012 - 20:27:12 - [0,004] ----D C:\Users\st�phanie\AppData\Roaming\GoforFiles
O43 - CFD: 06/08/2011 - 18:01:00 - [0,082] ----D C:\Users\st�phanie\AppData\Roaming\InfraRecorder
O43 - CFD: 10/01/2011 - 13:56:44 - [0,001] ----D C:\Users\st�phanie\AppData\Roaming\letstunes
O43 - CFD: 17/06/2008 - 15:56:28 - [0,000] ----D C:\Users\st�phanie\AppData\Roaming\LogoMaker
O43 - CFD: 15/04/2012 - 14:05:59 - [0,027] ----D C:\Users\st�phanie\AppData\Roaming\MiniDm
O43 - CFD: 14/04/2013 - 19:14:36 - [2,393] ----D C:\Users\st�phanie\AppData\Roaming\MP3Rocket
O43 - CFD: 01/07/2007 - 18:46:03 - [0,001] ----D C:\Users\st�phanie\AppData\Roaming\Quiz Press prefs
O43 - CFD: 13/04/2012 - 22:08:44 - [0] ----D C:\Users\st�phanie\AppData\Roaming\system32
O43 - CFD: 09/01/2008 - 22:02:23 - [0] ----D C:\Users\st�phanie\AppData\Local\ColorPlaza
O43 - CFD: 30/05/2007 - 22:24:47 - [0] ----D C:\Users\st�phanie\AppData\Local\Fastlab Print Service
O43 - CFD: 27/05/2007 - 16:23:24 - [1008,776] ----D C:\Users\st�phanie\AppData\Local\IM
O43 - CFD: 17/01/2011 - 10:36:27 - [1,329] ----D C:\Users\st�phanie\AppData\Local\NetDragon
O43 - CFD: 06/03/2009 - 00:25:45 - [0] ----D C:\Users\st�phanie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitComet
O43 - CFD: 09/01/2009 - 11:40:14 - [0] ----D C:\Users\st�phanie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Groom Toox
O43 - CFD: 11/05/2008 - 22:39:08 - [0] ----D C:\Users\st�phanie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LimeWire
O43 - CFD: 03/12/2012 - 13:30:01 - [0,002] ----D C:\Users\st�phanie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com =>Hijacker.TornTV
~ 1230 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 1726 Legitimates Filtered in 01mn 30s



---\\ Derniers fichiers modifi�s ou cr�es sous Windows et System32 (O44)
O44 - LFC:[MD5.EBBD702D9CE34B50A43FB707FA11006A] - 20/04/2013 - 09:40:32 ---A- . (...) -- C:\Windows\ntbtlog.txt [509840]
O44 - LFC:[MD5.6123AEBD8CE983BEA7CDCBF7471BC97B] - 20/04/2013 - 09:34:22 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [5152]
O44 - LFC:[MD5.6123AEBD8CE983BEA7CDCBF7471BC97B] - 20/04/2013 - 09:34:22 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [5152]
~ Files: 41 Legitimates Filtered in 00mn 08s



---\\ Derniers fichiers cr��s dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.933F454CA9A2EC739E7B3D6BA8C3A2EF] - 19/04/2013 - 11:59:08 ---A- - C:\Windows\Prefetch\WLSETTINGS.EXE-4DBF79AB.pf
O45 - LFCP:[MD5.05CB24197061A23831C47D5A46EA95EC] - 19/04/2013 - 17:52:18 ---A- - C:\Windows\Prefetch\SPOTIFYSETUP (1).EXE-DA2E7824.pf
O45 - LFCP:[MD5.18173DC0ECF5D9BD0AF15960664010E1] - 19/04/2013 - 17:52:26 ---A- - C:\Windows\Prefetch\SPWEBINST0.EXE-68A2C407.pf
O45 - LFCP:[MD5.E3DF848030FDBDF31F634564250B3BFC] - 19/04/2013 - 17:52:37 ---A- - C:\Windows\Prefetch\SPOTIFY.EXE-C41E70F2.pf
O45 - LFCP:[MD5.D9F54C9F1FD10A38525BE1B853536FC2] - 20/04/2013 - 09:32:18 ---A- - C:\Windows\Prefetch\NSF154.TMP-043014B5.pf
O45 - LFCP:[MD5.F5833F4A4FE97367F55A97BD08DF932B] - 20/04/2013 - 09:35:19 ---A- - C:\Windows\Prefetch\EDSLOADER.EXE-365CA171.pf
~ Prefetcher: 73 Legitimates Filtered in 00mn 00s



---\\ Op�rations et fonctions au d�marrage de Windows Explorer (O46)
O46 - SEH:ShellExecuteHooks - SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL
~ ShellExecuteHooks: Scanned in 00mn 00s



---\\ Export de cl� d'application autoris�e (O47)
O47 - AAKE:Key Export SP - "C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe" [Enabled] .(.Acer Inc..) -- C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe
O47 - AAKE:Key Export SP - "C:\Acer\Empowering Technology\eDataSecurity\encryption.exe" [Enabled] .(.HiTRUST.) -- C:\Acer\Empowering Technology\eDataSecurity\encryption.exe
O47 - AAKE:Key Export SP - "C:\Acer\Empowering Technology\eDataSecurity\decryption.exe" [Enabled] .(.HiTRUST.) -- C:\Acer\Empowering Technology\eDataSecurity\decryption.exe
O47 - AAKE:Key Export SP - "C:\Program Files\IEPro\MiniDM.exe" [Enabled] .(...) -- C:\Program Files\IEPro\MiniDM.exe (.not file.)
O47 - AAKE:Key Export SP - "C:\Program Files\BitTorrent\bittorrent.exe" [Enabled] .(.BitTorrent, Inc..) -- C:\Program Files\BitTorrent\bittorrent.exe
O47 - AAKE:Key Export SP - "C:\Program Files\NetDragon\91 Mobile\iPhone\iPhone PC Suite.exe" [Enabled] .(...) -- C:\Program Files\NetDragon\91 Mobile\iPhone\iPhone PC Suite.exe (.not file.)
~ Keys Export: 6 Legitimates Filtered in 00mn 00s



---\\ MountPoints2 Shell Key (O51)
O51 - MPSK:{c7ecd60e-c6c1-11e1-8cd2-0019db5de69d}\AutoRun\command. (...) -- F:\iStudio.exe (.not file.)
~ Keys: Scanned in 00mn 00s



---\\ ShareTools MSconfig StartupReg (O53)
O53 - SMSR:HKLM\...\startupreg\BitTorrent DNA [Key] . (...) -- C:\Users\st�phanie\Program Files\DNA\btdna.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\Pokki [Key] . (...) -- C:\Users\st�phanie\AppData\Local\Pokki\v0.260.8.396\pokki.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\TViXNetShare [Key] . (.DVICO - Pas de description.) -- C:\Program Files\DVICO\TViXNetShare\TViXNetShare.exe
~ SMSR Keys: 9 Legitimates Filtered in 00mn 00s



---\\ Microsoft Windows Policies System (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "HideLegacyLogonScripts"=0
O55 - MWPS:[HKLM\...\Policies\System] - "HideLogoffScripts"=0
O55 - MWPS:[HKLM\...\Policies\System] - "RunLogonScriptSync"=1
O55 - MWPS:[HKLM\...\Policies\System] - "RunStartupScriptSync"=1
O55 - MWPS:[HKLM\...\Policies\System] - "HideStartupScripts"=0
O55 - MWPS:[HKCU\...\Policies\System] - "HideLegacyLogonScripts"=0
O55 - MWPS:[HKCU\...\Policies\System] - "HideLogoffScripts"=0
O55 - MWPS:[HKCU\...\Policies\System] - "RunLogonScriptSync"=1
O55 - MWPS:[HKCU\...\Policies\System] - "RunStartupScriptSync"=1
O55 - MWPS:[HKCU\...\Policies\System] - "HideStartupScripts"=0
~ MWPS: 26 Legitimates Filtered in 00mn 00s



---\\ Liste des Drivers Syst�me (O58)
O58 - SDL:[MD5.D079068B720258EA3D0653ECAC2F9874] - 28/12/2006 - 14:50:26 ---A- . (.Sonix Technology Co., Ltd. - Driver for 9KD ICE Writer.) -- C:\Windows\System32\Drivers\9kdUSBXP.sys [16000]
O58 - SDL:[MD5.D6634E1ACC801363FD0A998FF1B3CADD] - 10/12/2007 - 22:00:02 RSH-- . (...) -- C:\Windows\System32\11F34CC2E2.sys [56]
~ Drivers: Scanned in 00mn 00s



---\\ Derniers fichiers modifi�s ou cr�es (Utilisateur) (O61)
O61 - LFC: 17/04/2013 - 18:22:14 ---A- C:\Users\st�phanie\Searches\Downloads\HousecallLauncher.exe [2002424]
O61 - LFC: 17/04/2013 - 18:36:37 ---A- C:\Users\st�phanie\AppData\Local\ars.cache [246542]
O61 - LFC: 17/04/2013 - 18:36:41 ---A- C:\Users\st�phanie\AppData\Local\census.cache [254242]
O61 - LFC: 17/04/2013 - 21:07:30 ---A- C:\Users\st�phanie\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\Partial Backups\00000007.rmx [122]
O61 - LFC: 17/04/2013 - 21:07:30 ---A- C:\Users\st�phanie\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\Partial Backups\00000007.rxb [7381]
O61 - LFC: 18/04/2013 - 11:33:13 ---A- C:\Users\st�phanie\Documents\img014.jpg [1361332]
O61 - LFC: 18/04/2013 - 11:36:31 ---A- C:\Users\st�phanie\Documents\dossier c\Scan0003.tif [1089480]
O61 - LFC: 18/04/2013 - 11:36:36 ---A- C:\Users\st�phanie\Documents\dossier c\Scan0005.tif [1079348]
O61 - LFC: 18/04/2013 - 11:43:22 ---A- C:\Users\st�phanie\Documents\dossier c\1.jpg [87536]
O61 - LFC: 19/04/2013 - 14:01:11 ---A- C:\Users\st�phanie\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\ExcludeList.rcp [390]
O61 - LFC: 19/04/2013 - 14:01:11 ---A- C:\Users\st�phanie\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\French_rcp.dat [56644]
O61 - LFC: 19/04/2013 - 14:01:11 ---A- C:\Users\st�phanie\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\TempHLList.rcp [2448]
O61 - LFC: 19/04/2013 - 14:01:11 ---A- C:\Users\st�phanie\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\results.rcp [60]
O61 - LFC: 19/04/2013 - 21:49:29 ---A- C:\Users\st�phanie\AppData\Roaming\Intelli-studio\upload_history.xml [79]
O61 - LFC: 19/04/2013 - 22:02:59 ---A- C:\Users\st�phanie\Videos\SAM_2093_Converted.wmv [322558714]
O61 - LFC: 19/04/2013 - 22:03:08 ---A- C:\Users\st�phanie\AppData\Roaming\Intelli-studio\File_v20_5.db [10779648]
O61 - LFC: 19/04/2013 - 22:03:09 ---A- C:\Users\st�phanie\AppData\Roaming\Intelli-studio\Folder_v20_5.db [262144]
O61 - LFC: 20/04/2013 - 09:46:47 ---A- C:\Users\st�phanie\AppData\Local\Google\Chrome\User Data\Certificate Revocation Lists [268698]
O61 - LFC: 20/04/2013 - 09:47:06 ---A- C:\Users\st�phanie\AppData\Local\Google\Chrome\User Data\Local State [38077]
~ 60 Fichiers temporaires (Temporary files)
~ 3 Fichiers cookies (Cookies files)
~ Files: 823 Legitimates Filtered in 00mn 42s



---\\ Liste des outils de nettoyage (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
O63 - Logiciel: RSIT - (.random/random.)
O63 - Logiciel: Toolbar SD - (.IDN Team.)
~ ADS: Scanned in 00mn 00s



---\\ Liste des services Legacy (O64)
O64 - Services: CurCS - 11/11/2009 - C:\Program Files\SUPERAntiSpyware\SASDIFSV.sys (SASDIFSV) .(.SUPERAdBlocker.com and SUPERAntiSpyware.com - SASDIFSV.SYS.) - LEGACY_SASDIFSV
O64 - Services: CurCS - 11/11/2009 - C:\Program Files\SUPERAntiSpyware\SASENUM.sys (SASENUM) .(. SUPERAdBlocker.com and SUPERAntiSpyware.co - SASENUM.SYS.) - LEGACY_SASENUM
~ Legacy: 94 Legitimates Filtered in 00mn 00s



---\\ File Associations Shell Spawning (O67)
O67 - Shell Spawning: <.exe> [HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 19 Legitimates Filtered in 00mn 00s



---\\ Start Menu Internet (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\st�phanie\AppData\Local\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\IEXPLORE.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Apple Inc. - Safari.) -- C:\Program Files\Safari\Safari.exe
~ Keys: Scanned in 00mn 00s



---\\ Search Browser Infection (O69)
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("extensions.delta.admin", false);
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("extensions.delta.aflt", "babsst");
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("extensions.delta.autoRvrt", "false");
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("extensions.delta.dfltLng", "en");
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("extensions.delta.excTlbr", false);
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("extensions.delta.id", "38a54ac30000000000000019db5de69d");
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("extensions.delta.instlDay", "15753");
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("extensions.delta.instlRef", "sst");
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("extensions.delta.newTab", false);
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("extensions.delta.prdct", "delta");
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("extensions.delta.prtnrId", "delta");
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("extensions.delta.rvrt", "false");
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("extensions.delta.smplGrp", "none");
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("extensions.delta.tlbrId", "base");
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("extensions.delta.tlbrSrchUrl", "");
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("extensions.delta.vrsn", "1.8.10.0");
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("extensions.delta.vrsnTs", "1.8.10.020:31:35");
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("extensions.delta.vrsni", "1.8.10.0");
O69 - SBI: prefs.js [st�phanie - k0u2daf0.default] user_pref("weboftrust.search.ask.display", "Ask.com Web Search");
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (@ieframe.dll,-12512) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {A3B0E929-3E3B-45ED-B677-79ED6AF604B2} - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKUS\.DEFAULT] {94D57B42-E3BA-4C01-B98A-8CCA2FCBF29E} - (Zumie Search) - http://www.zumie.com
O69 - SBI: SearchScopes [HKUS\S-1-5-18] {94D57B42-E3BA-4C01-B98A-8CCA2FCBF29E} - (Zumie Search) - http://www.zumie.com
~ Keys: Scanned in 00mn 00s



---\\ Recherche particuliere � la racine de certains dossiers (O84)
[MD5.D70E4E2A6E2997CCB01685733C983512] [SPRF][16/05/2009] (...) -- C:\ProgramData\E2C24CF311.sys [88]
[MD5.6FF297195402145E3B4A140557AF8C00] [SPRF][16/05/2009] (...) -- C:\ProgramData\KGyGaAvL.sys [2516]
[MD5.3F7F7B9F746191312CA51A77F9605B4D] [SPRF][26/09/2008] (...) -- C:\ProgramData\pswi_preloaded.exe [480848]
[MD5.3B8E1A1728D91B8D4EF284608B775E98] [SPRF][15/10/2011] (...) -- C:\Users\st�phanie\AppData\Local\d3d9caps.dat [1356]
[MD5.FC57B304F615B4F20C1F8E5EB68F89FB] [SPRF][07/10/2007] (...) -- C:\Users\st�phanie\AppData\Local\fusioncache.dat [97]
[MD5.C96095256277FA3F9365E72908707146] [SPRF][02/02/2009] (...) -- C:\Users\st�phanie\AppData\Local\jfbetw.bat [93]
[MD5.BE6B613DABC8ACD3DE8CECB7A7CE53B0] [SPRF][05/08/2009] (...) -- C:\Users\st�phanie\AppData\Local\oxhox.bat [92]
[MD5.B3FDF6E7B0AECD48CA7E4921773FB606] [SPRF][09/02/2013] (...) -- C:\Users\st�phanie\AppData\Local\Temp\7z920.exe [1110476]
[MD5.817E86B7C18A015223A405E79DB836E9] [SPRF][29/01/2013] (.Ask.com - AskStub Application.) -- C:\Users\st�phanie\AppData\Local\Temp\ApnStub.exe [356520]
[MD5.D2537381019991C0D067EEED86D19171] [SPRF][09/02/2010] (.Ask.com - Ask Install Checker.) -- C:\Users\st�phanie\AppData\Local\Temp\AskInstallChecker.exe [201616]
[MD5.B28C334C03CEE7C5E829C43AE75DAE5A] [SPRF][23/08/2012] (.Ask.com - AskIC Dynamic Link Library.) -- C:\Users\st�phanie\AppData\Local\Temp\AskSLib.dll [248008]
[MD5.11D751D299B9ABDC77BFF4156C75C4CF] [SPRF][17/02/2013] (...) -- C:\Users\st�phanie\AppData\Local\Temp\bitool.dll [38480]
[MD5.3D7CDC3E67A97110321BF7453C649B1F] [SPRF][17/02/2013] (...) -- C:\Users\st�phanie\AppData\Local\Temp\DeltaTB.exe [775664]
[MD5.7B96A975DECF746361A39A31E01F4BDF] [SPRF][28/06/2012] (.Ellora Assets Corporation - Freemake Video Converter Setup.) -- C:\Users\st�phanie\AppData\Local\Temp\FreemakeVideoConverter_3.0.2.15.exe [18306784]
[MD5.F6278B5A16F830885B184D5F72E1B935] [SPRF][22/03/2013] (.Terra Informatica Software, Inc., British C - HTMLayout - embeddable HTML rendering and layout component.) -- C:\Users\st�phanie\AppData\Local\Temp\htmlayout.dll [947200]
[MD5.9831C439ED0BD31D625A93DD86389843] [SPRF][20/04/2013] (.Pas de propri�taire - APN Install Checker Library for Java.) -- C:\Users\st�phanie\AppData\Local\Temp\JavaIC.dll [114376]
[MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][17/04/2013] (...) -- C:\Users\st�phanie\AppData\Local\Temp\jqkidpbo.dll [0]
[MD5.F88C296A9109CF540EEDEF41E8A46E09] [SPRF][12/01/2013] (.Oracle Corporation - Java(TM) Platform SE binary.) -- C:\Users\st�phanie\AppData\Local\Temp\jre-7u11-windows-i586-iftw.exe [896424]
[MD5.F655170EB3DC3CBB3F564077C670A7E1] [SPRF][31/01/2013] (.Oracle Corporation - Java(TM) Platform SE binary.) -- C:\Users\st�phanie\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe [897448]
[MD5.5CC163324A11091C975B686EF4C52C73] [SPRF][16/02/2013] (.Oracle Corporation - Java(TM) Platform SE binary.) -- C:\Users\st�phanie\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe [897448]
[MD5.A620A735458E04AE0CF471319B6D6E7D] [SPRF][01/03/2013] (.Oracle Corporation - Java(TM) Platform SE binary.) -- C:\Users\st�phanie\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe [897448]
[MD5.6C137D2BEF3CDD43F3AE2FD6705B9FED] [SPRF][05/04/2013] (.Oracle Corporation - Java(TM) Platform SE binary.) -- C:\Users\st�phanie\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe [904104]
[MD5.8EC2A656042BFF1243C09FFD33F25496] [SPRF][29/08/2012] (.Oracle Corporation - Java(TM) Platform SE binary.) -- C:\Users\st�phanie\AppData\Local\Temp\jre-7u7-windows-i586-iftw.exe [894952]
[MD5.EC3A1A84A0A407FE3985ED6F9A0CC436] [SPRF][27/09/2012] (.Oracle Corporation - Java(TM) Platform SE binary.) -- C:\Users\st�phanie\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe [895464]
[MD5.71571DF7DBF4705F3C88222EF1B6FA79] [SPRF][20/04/2013] (.McAfee, Inc. - Partner Offer Manager Criteria Check.) -- C:\Users\st�phanie\AppData\Local\Temp\msscct32.dll [341032]
[MD5.30290976476F285670AE4E83BBCB5903] [SPRF][27/11/2012] (.SweetLabs,Inc. - Pokki.) -- C:\Users\st�phanie\AppData\Local\Temp\oct2D27.tmp.exe [32581936]
[MD5.BCC6E3E1F8ECC44DE3A461F00A600E36] [SPRF][07/10/2012] (.SweetLabs,Inc. - Pokki.) -- C:\Users\st�phanie\AppData\Local\Temp\oct3153.tmp.exe [31733016]
[MD5.0AFE24C0DE6E49BB06DB89849FD33D36] [SPRF][16/11/2012] (.SweetLabs,Inc. - Pokki.) -- C:\Users\st�phanie\AppData\Local\Temp\oct3EEC.tmp.exe [32580480]
[MD5.BCC6E3E1F8ECC44DE3A461F00A600E36] [SPRF][03/10/2012] (.SweetLabs,Inc. - Pokki.) -- C:\Users\st�phanie\AppData\Local\Temp\oct6FAE.tmp.exe [31733016]
[MD5.463D5EE1F960F309F47D256694CA9BE9] [SPRF][29/11/2012] (.SweetLabs,Inc. - Pokki.) -- C:\Users\st�phanie\AppData\Local\Temp\oct7972.tmp.exe [32581144]
[MD5.77BE448F28F10B71262FF213F8614A90] [SPRF][23/11/2012] (.SweetLabs,Inc. - Pokki.) -- C:\Users\st�phanie\AppData\Local\Temp\oct94FF.tmp.exe [32582048]
[MD5.832CBE5428D9B63AE974BEEB188EC3D8] [SPRF][27/10/2012] (.SweetLabs,Inc. - Pokki.) -- C:\Users\st�phanie\AppData\Local\Temp\octB377.tmp.exe [32508120]
[MD5.497B16C836A919E0233427A6146FC251] [SPRF][22/11/2012] (.SweetLabs,Inc. - Pokki.) -- C:\Users\st�phanie\AppData\Local\Temp\octBC1E.tmp.exe [32581592]
[MD5.4EF414D857F3DB4F363C4A2073BB7F5F] [SPRF][03/11/2012] (.SweetLabs,Inc. - Pokki.) -- C:\Users\st�phanie\AppData\Local\Temp\octC8BB.tmp.exe [32517688]
[MD5.4EF414D857F3DB4F363C4A2073BB7F5F] [SPRF][10/11/2012] (.SweetLabs,Inc. - Pokki.) -- C:\Users\st�phanie\AppData\Local\Temp\octE273.tmp.exe [32517688]
[MD5.3AC89D931C908F23CF0EA048670DBA8D] [SPRF][02/10/2012] (.SweetLabs,Inc. - Pokki.) -- C:\Users\st�phanie\AppData\Local\Temp\octECED.tmp.exe [31732648]
[MD5.573617564F8E39579934924D3BB5E8F8] [SPRF][23/10/2012] (.SweetLabs,Inc. - Pokki.) -- C:\Users\st�phanie\AppData\Local\Temp\octF3B0.tmp.exe [32487624]
[MD5.39DB3561990EB852EF19ED1DBDD9EE22] [SPRF][30/08/2012] (.Pokki - Pokki Installer.) -- C:\Users\st�phanie\AppData\Local\Temp\Pokki.exe [1326424]
[MD5.57BC8F4F1201610668773875A4484C1E] [SPRF][31/01/2013] (.Babylon Ltd. - Uninstaller Application.) -- C:\Users\st�phanie\AppData\Local\Temp\uninst1.exe [392784] =>Toolbar.Babylon
[MD5.F6278B5A16F830885B184D5F72E1B935] [SPRF][08/12/2012] (.Terra Informatica Software, Inc., British C - HTMLayout - embeddable HTML rendering and layout component.) -- C:\Users\st�phanie\AppData\Local\Temp\uninstall13068687.exe [947200]
[MD5.A55B82103A202C20717F45C201EC4553] [SPRF][16/10/2012] (.Terra Informatica Software, Inc., British C - HTMLayout - embeddable HTML rendering and layout component.) -- C:\Users\st�phanie\AppData\Local\Temp\uninstall13104785.exe [936960]
[MD5.5C89E24D47562D08D9447F7BAA14338D] [SPRF][16/10/2012] (.http://goforfiles.com/ - GoforFiles Application.) -- C:\Users\st�phanie\AppData\Local\Temp\uninstall13105097.exe [904848]
[MD5.C9D496AF64C56389C511B4C4E5938037] [SPRF][16/10/2012] (.http://www.goforfiles.com/ - GoforFiles.) -- C:\Users\st�phanie\AppData\Local\Temp\uninstall13105300.exe [4604560]
[MD5.7810AB1CF04E012469C141ABC693D3A7] [SPRF][09/02/2013] (.Somoto Ltd. - FilesFrog Update Checker.) -- C:\Users\st�phanie\AppData\Local\Temp\UpdateCheckerSetup.exe [295440] =>Adware.MegaSearch
[MD5.9DC1D28A2B4E57410DE20C7E59364A22] [SPRF][21/09/2012] (...) -- C:\Users\st�phanie\AppData\Local\Temp\utt1B5D.tmp.bat [98]
[MD5.9DC1D28A2B4E57410DE20C7E59364A22] [SPRF][21/09/2012] (...) -- C:\Users\st�phanie\AppData\Local\Temp\utt1BCB.tmp.bat [98]
[MD5.9A105C7F55B43FEFA444A94F714B5B29] [SPRF][11/07/2012] (...) -- C:\Users\st�phanie\AppData\Local\Temp\utt9E1E.tmp.bat [74]
[MD5.BD6AB920E99E8AFC70D6BE086ED40F0C] [SPRF][08/01/2008] (...) -- C:\Users\st�phanie\AppData\Roaming\mdb.bin [8594]
[MD5.6BECCD726B613CC43EF6D36F8FC4D9AF] [SPRF][20/01/2012] (.Microsoft Corporation - Pas de description.) -- C:\Users\st�phanie\Desktop\FileFormatConverters.exe [29017528]
[MD5.CB216BEA0CA6EF97D9EF3C539F5B2F35] [SPRF][03/11/2007] (...) -- C:\Program Files\ffdsasetts.reg [1292]
[MD5.CE598D0052B1EC5A6EC0853D674BC858] [SPRF][03/11/2007] (...) -- C:\Program Files\ffdssetts.reg [1658]
[MD5.D18C5F55DEB684113BD30E55578367FB] [SPRF][03/11/2007] (...) -- C:\Program Files\mpc1.reg [596]
[MD5.B9EB849EC191A7E0AE6B463902B1D9B5] [SPRF][03/11/2007] (...) -- C:\Program Files\mpc2.reg [680]
[MD5.9981D5BBF4430D6C836A0BDC758187FE] [SPRF][03/11/2007] (...) -- C:\Program Files\mpc3.reg [3026]
[MD5.4991FDA023C7D8188DDC882344D9B90E] [SPRF][03/11/2007] (...) -- C:\Program Files\mpc4.reg [348]
[MD5.BC0D2101AF3DD1E7B111A2AF88BDC62C] [SPRF][03/11/2007] (...) -- C:\Program Files\mpc5.reg [16220]
[MD5.F93A83DA2BE77E7637F1FAE3B346D0ED] [SPRF][03/11/2007] (...) -- C:\Program Files\mpc6.reg [18156]
[MD5.E1BF5664C40AFBF6B0EEC20A56D6A7E9] [SPRF][03/11/2007] (...) -- C:\Program Files\mpc7.reg [3476]
[MD5.77D3A60B2E838E1CC6A682BD9761DA63] [SPRF][15/08/2007] (.RealNetworks, Inc. - RngInterstitial.) -- C:\Program Files\RngInterstitial.dll [774144]
[MD5.3FEA9D2EDF23B0283C7A66C8DEA380BD] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player Module.) -- C:\Windows\Downloaded Program Files\dwusplay.dll [24576]
[MD5.CDBE35EA59BC9223E4F800BD1DB82D27] [SPRF][25/07/2002] (.InstallShield Software Corporation - InstallShield Update Service Setup Player.) -- C:\Windows\Downloaded Program Files\dwusplay.exe [196608]
[MD5.B8F39C9E0F0B71E454DBA431CF3B99C9] [SPRF][11/08/2005] (.Macrovision Corporation - InstallShield Update Service Web Agent.) -- C:\Windows\Downloaded Program Files\isusweb.dll [417792]
[MD5.8945CCA5FC4F25168E8B6F401EFAF51F] [SPRF][22/02/2007] (.Microsoft Corporation - Zone.com Stats Client for MSN Messenger.) -- C:\Windows\Downloaded Program Files\MessengerStatsPAClient.dll [304544]
~ Files: Scanned in 00mn 08s



---\\ Firewall Active Exception List (FirewallRules) (O87)
O87 - FAEL: "{801EC1BA-4EA4-4830-8FE6-B53B0271F818}" | In - Public - P17 - TRUE | .(.Pas de propri�taire - DVAX2Process MFC Application.) -- C:\Program Files\Acer Zone\Acer Plug and Record\Component\DVAX2Process.exe
O87 - FAEL: "{3CF0A38F-BDCA-4850-B9CC-79DA144B0CA6}" | In - Public - P6 - TRUE | .(.Pas de propri�taire - DVAX2Process MFC Application.) -- C:\Program Files\Acer Zone\Acer Plug and Record\Component\DVAX2Process.exe
O87 - FAEL: "{F1B5D3AE-FBEF-47B7-99BA-34893748B475}" | In - Public - P6 - TRUE | .(.BitTorrent, Inc. - DNA.) -- C:\Program Files\DNA\btdna.exe
O87 - FAEL: "{43DCEBCC-B32B-404F-A7EC-7CF885BEB043}" | In - Public - P17 - TRUE | .(.BitTorrent, Inc. - DNA.) -- C:\Program Files\DNA\btdna.exe
O87 - FAEL: "TCP Query User{B588C859-DF6F-4CA9-B6B3-452F267EAA06}C:\program files\bittorrent\bittorrent.exe" | In - Public - P6 - TRUE | .(.BitTorrent, Inc. - BitTorrent.) -- C:\program files\bittorrent\bittorrent.exe
O87 - FAEL: "UDP Query User{EF921477-86C6-4542-AD69-E43A0D497241}C:\program files\bittorrent\bittorrent.exe" | In - Public - P17 - TRUE | .(.BitTorrent, Inc. - BitTorrent.) -- C:\program files\bittorrent\bittorrent.exe
O87 - FAEL: "TCP Query User{A05457F4-E410-43E1-AF76-36EE73BBDB62}C:\program files\dvico\tvixnetshare\tvixnetshare.exe" | In - Public - P6 - TRUE | .(.DVICO - Pas de description.) -- C:\program files\dvico\tvixnetshare\tvixnetshare.exe
O87 - FAEL: "UDP Query User{7391FAC9-58EF-4293-9092-58F11172B2A9}C:\program files\dvico\tvixnetshare\tvixnetshare.exe" | In - Public - P17 - TRUE | .(.DVICO - Pas de description.) -- C:\program files\dvico\tvixnetshare\tvixnetshare.exe
O87 - FAEL: "TCP Query User{CE8163AF-6D4B-4825-A27B-6F072706842A}C:\program files\cityvillebot\iexplore.exe" |In - Public - P6 - TRUE | .(...) -- C:\program files\cityvillebot\iexplore.exe (.not file.)
O87 - FAEL: "UDP Query User{F18AF909-A220-4271-A796-ECBF9B616C32}C:\program files\cityvillebot\iexplore.exe" |In - Public - P17 - TRUE | .(...) -- C:\program files\cityvillebot\iexplore.exe (.not file.)
O87 - FAEL: "{42FE29E6-9BA7-4F5F-A5D0-5358603C84FF}" |In - Public - P6 - TRUE | .(...) -- C:\Program Files\GoforFiles\goforfilesdl.exe (.not file.)
O87 - FAEL: "{3670A3F4-0CE4-4A3F-ABE1-21E949799DED}" |In - Public - P17 - TRUE | .(...) -- C:\Program Files\GoforFiles\goforfilesdl.exe (.not file.)
O87 - FAEL: "{A4DB7BC7-CFFD-4D59-9C88-1793492AD23F}" |In - Public - P6 - TRUE | .(...) -- C:\Program Files\GoforFiles\GoforFiles.exe (.not file.)
O87 - FAEL: "{D251F077-117D-43FA-B51A-C47F78CEE0CF}" |In - Public - P17 - TRUE | .(...) -- C:\Program Files\GoforFiles\GoforFiles.exe (.not file.)
O87 - FAEL: "{3CE514F0-AA85-4602-9207-13CA07EFC27E}" |In - None - P17 - TRUE | .(...) -- C:\Program Files\Protected Search\ProtectedSearch.exe (.not file.) =>Spyware.ProtectedSearch
O87 - FAEL: "{B7ABA13D-4722-4D25-AF8A-62170C57EF0E}" |Out - None - P17 - TRUE | .(...) -- C:\Program Files\Protected Search\ProtectedSearch.exe (.not file.) =>Spyware.ProtectedSearch
O87 - FAEL: "{2A9DF138-FAFC-46BB-9232-2652E32DFE04}" |In - Public - P6 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\Downloader.exe (.not file.)
O87 - FAEL: "{35C54831-8C7C-4695-8738-D59FD3161F1C}" |In - Public - P17 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\Downloader.exe (.not file.)
O87 - FAEL: "{AF2B1BD7-8860-4974-8672-19AED749E79E}" |In - Public - P6 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\YourFile.exe (.not file.)
O87 - FAEL: "{C0BD3D7C-6957-4137-8F2F-C512E88EEE67}" |In - Public - P17 - TRUE | .(...) -- C:\Program Files\YourFileDownloader\YourFile.exe (.not file.)
O87 - FAEL: "{BCCB1F69-307F-4422-BC58-1E5532AA243F}" | In - None - P6 - TRUE | .(.BitTorrent, Inc. - BitTorrent.) -- C:\Program Files\BitTorrent\BitTorrent.exe
O87 - FAEL: "{A987714D-1849-41D6-ACE3-2E1D4A686B7F}" | In - None - P17 - TRUE | .(.BitTorrent, Inc. - BitTorrent.) -- C:\Program Files\BitTorrent\BitTorrent.exe
~ Firewall: 271 Legitimates Filtered in 00mn 01s



---\\ Scan Additionnel (O88)
Database Version : v2.11593 - (19/04/2013)
Cl�s trouv�es (Keys found) : 42
Valeurs trouv�es (Values found) : 1
Dossiers trouv�s (Folders found) : 10
Fichiers trouv�s (Files found) : 4

[HKCU\Software\delta LTD] =>Toolbar.DeltaSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{177586E7-E42E-4F38-83D1-D15B4AF5B714}] =>Toolbar.DeltaSearch
[HKCU\Software\Microsoft\Office\Word\Addins\BabylonOfficeAddin.OfficeAddin] =>Toolbar.Babylon
[HKCU\Software\Microsoft\Office\PowerPoint\Addins\BabylonOfficeAddin.OfficeAddin] =>Toolbar.Babylon
[HKCU\{C5C31551-23FC-4895-B1C7-E209163DECA5}] =>Toolbar.Agent
[HKLM\Software\Classes\Interface\{db885111-f39f-4d88-9ee5-c88460b6df7b}] =>Adware.Agent
[HKCU\Software\funkyemoticons] =>Adware.Navipromo
[HKLM\Software\funkyemoticons] =>Adware.Navipromo
[HKCU\Software\live-player] =>Adware.Navipromo
[HKLM\Software\live-player] =>Adware.Navipromo
[HKCU\Software\SweetIM] =>PUP.SweetIM
[HKLM\Software\SweetIM] =>PUP.SweetIM
[HKLM\Software\Winsudate] =>Adware.Gibmedia
[HKLM\Software\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}] =>Toolbar.Babylon
[HKCU\Software\MicroGaming\Thumper\Casino\prime] =>Adware.Casino
[HKLM\Software\Classes\Installer\Features\7E685771E24E83F4381D1DB5A45F7B41] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\Installer\Products\7E685771E24E83F4381D1DB5A45F7B41] =>Toolbar.DeltaSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\7E685771E24E83F4381D1DB5A45F7B41] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\Interface\{0194532A-A99C-4337-937E-2A452C8957BE}] =>Toolbar.Agent
[HKLM\Software\Classes\Interface\{7131C082-F3C6-404D-B8CC-8AF9CFB6209D}] =>Toolbar.Agent
[HKLM\Software\Classes\AppID\{5C731C2A-6ADF-487E-99A2-7291BF794A14}] =>Toolbar.Agent
[HKLM\Software\Classes\AppID\osmax.ocx] =>Toolbar.Agent
[HKLM\Software\Classes\AppID\secman.DLL] =>Toolbar.Babylon
[HKLM\Software\Classes\TypeLib\{3E288F79-03E4-4983-A48E-0D879B51FF19}] =>Toolbar.ToolBand
[HKLM\Software\Classes\Interface\{DB885111-F39F-4D88-9EE5-C88460B6DF7B}] =>Toolbar.ToolBand
[HKLM\Software\Classes\Interface\{B7EA2226-F876-4BE4-B478-76EBAE2A668A}] =>Toolbar.Babylon
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\bi_uninstaller] =>Adware.MegaSearch
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] =>Toolbar.Bing
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] =>Toolbar.Bing
[HKLM\Software\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}] =>Toolbar.DeltaSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E5C8B5FB7CB5DD447A0BAAAF637FBD77] =>PUP.ClaroSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF96568971BEAC14B8815883832BD484] =>PUP.ClaroSearch
[HKLM\Software\Classes\TypeLib\{5C9A2304-70A5-11D5-AFB0-0050DAC67890}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{C3F058A9-407D-4CD1-8F66-B75605B54B69}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{8911483C-C00A-4183-9FBC-6C9C00946C15}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{5C9A230D-70A5-11D5-AFB0-0050DAC67890}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{0BF91075-F457-4A8B-99EF-140B52D2F22A}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{431FB0E5-2CBB-4602-9FE6-F1D64488ADD7}] =>Toolbar.Conduit
[HKCU\Software\AppDataLow\Software\oovootoolbar] =>Toolbar.ooVoo
[HKLM\Software\Cheat Engine\OpenCandy] =>Adware.OpenCandy
[HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\Arpcache\TBSB02209.TBSB02209Toolbar] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011441179}] =>PUP.CrossRider
[HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]:{4e7bd74f-2b8d-469e-8da9-fd60bb9aae33} =>Adware.BHO
C:\Program Files\BearShare Applications =>PUP.BearShare
C:\Program Files\Winletmin =>Trojan.Agent
C:\Program Files\torntv.com =>Hijacker.TornTV
C:\Program Files\RegClean Pro =>Rogue.RegistryPowerCleaner
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FunkyEmoticons =>Adware.Navipromo
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Live-Player =>Adware.Navipromo
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegClean Pro =>Rogue.RegistryPowerCleaner
C:\Users\st�phanie\AppData\Roaming\FunkyEmoticons =>Adware.Navipromo
C:\Users\st�phanie\AppData\Local\Bundled software uninstaller =>Adware.MegaSearch
C:\Users\st�phanie\AppData\LocalLow\VMNToolbar =>Spyware.VMNToolbar
C:\Users\st�phanie\AppData\Local\Temp\uninst1.exe =>Toolbar.Babylon
C:\Users\st�phanie\AppData\Local\Temp\UpdateCheckerSetup.exe =>Adware.MegaSearch
~ Additionnel: Scanned in 00mn 36s



---\\ Product Upgrade Codes (O90)
O90 - PUC: "7E685771E24E83F4381D1DB5A45F7B41" . (.Delta Chrome Toolbar.) -- C:\Windows\Installer\{177586E7-E42E-4F38-83D1-D15B4AF5B714}\Delta.ico
~ Update Products: 101 Legitimates Filtered in 00mn 00s



---\\ Etat g�n�ral des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Auto 24576 | (AcerMemUsageCheckService) . (...) - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
SS - | Demand 12/07/2007 72704 | (Adobe LM Service) . (.Adobe Systems.) - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
SS - | Auto 18/12/2012 65192 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 13/04/2013 256904 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Auto 28/04/2011 136360 | (AntiVirSchedulerService) . (.Avira GmbH.) - C:\Program Files\Avira\AntiVir Desktop\sched.exe
SS - | Auto 31/08/2011 269480 | (AntiVirService) . (.Avira GmbH.) - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
SS - | Auto 21/12/2012 57008 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SS - | Auto 14/01/2009 729088 | (Ati External Event Utility) . (.ATI Technologies Inc..) - C:\Windows\System32\Ati2evxx.exe
SS - | Auto 30/08/2011 390504 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SS - | Auto 06/03/2007 198168 | (Capture Device Service) . (.InterVideo Inc..) - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
SS - | Auto 14/12/2006 49152 | (eRecoveryService) . (.Acer Inc..) - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
SS - | Auto 27/06/2012 96768 | (Freemake Improver) . (.Freemake.) - C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
SS - | Demand 18/06/2007 138680 | (gusvc) . (.Google.) - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Demand 20/02/2013 553288 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SS - | Auto 19/10/2006 61440 | (LightScribeService) . (.Hewlett-Packard Company.) - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
SS - | Auto 03/07/2012 655944 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
SS - | Demand 12/04/2013 115608 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Auto 18/09/2012 1082016 | (Orange update Core Service) . (.France Telecom SA.) - C:\Program Files\Orange\OrangeUpdate\Service\OUCore.exe
SS - | Auto 174656 | (ProtexisLicensing) . (...) - C:\Windows\system32\PSIService.exe
SS - | Auto 143360 | (RichVideo) . (...) - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
SS - | Auto 22/09/2010 249136 | (SeaPort) . (.Microsoft Corporation.) - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
SR - | Auto 19/01/2008 21504 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SS - | Auto 19/01/2008 21504 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 00s



---\\ Recherche Master Boot Record Infection (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
~ MBR: 1 Legitimates Filtered in 00mn 02s



~ 3813 Legitimates filtered by white list
End of the scan (854 lines in 05mn 36s)(0)