cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

~ Rapport de ZHPDiag v2013.10.15.37 - Nicolas Coolman (2013-10-15)
~ Lanc� par Martine (2013-10-15 16:57:10)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance � la d�sinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activ�e par le programme
~ El�vation des Privil�ges : OK
~ User Account Control (UAC): Deactivate by program


---\\ Navigateurs Internet
MSIE: Internet Explorer v9.0.8112.16421
MFIE: Mozilla Firefox 24.0 (Defaut)
GCIE: Google Chrome
OBIE: Safari v5.34.52.7

---\\ Informations sur les produits Windows
~ Langage: Fran�ais
Windows Vista Home Premium Edition, 32-bit Service Pack 2 (Build 6002)
Windows Server License Manager Script : OK
Windows Automatic Updates : OK

---\\ Logiciels de protection du syst�me
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft Security Client v2.1.1116.0

---\\ Logiciels d'optimisation du syst�me

---\\ Logiciels de partage PeerToPeer

---\\ Surveillance de Logiciels
Adobe Flash Player 11 Plugin
Adobe Reader X
Java 7 Update 25

---\\ Informations sur le syst�me
~ Processor: x86 Family 15 Model 107 Stepping 1, AuthenticAMD
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3005 MB (55% free)
System Restore: Activ� (Enable)
System drive C: has 34 GB (15%) free of 223 GB

---\\ Mode de connexion au syst�me
~ Computer Name: PC-GRANTHAM-MAR
~ User Name: Martine
~ All Users Names: Rose-Marie, Martine, Juliette, Guy, Administrateur,
~ Unselected Option: O45
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Martine\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Martine\AppData\Roaming\
~ %Desktop% : C:\Users\Martine\Desktop\
~ %Favorites% : C:\Users\Martine\Favorites\
~ %LocalAppData% : C:\Users\Martine\AppData\Local\
~ %StartMenu% : C:\Users\Martine\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enum�ration des unit�s disques
C: Hard drive, Flash drive, Thumb drive (Free 34 Go of 223 Go)
D: Hard drive, Flash drive, Thumb drive (Free 7 Go of 10 Go)
E: CD-ROM drive (Not Inserted)
F: Floppy drive, Flash card reader, USB Key (Free 1 Go of 2 Go)
G: Floppy drive, Flash card reader, USB Key (Free 1 Go of 4 Go)



---\\ Etat du Centre de S�curit� Windows
~ Security Center: 38 Legitimates Filtered in 00mn 00s



---\\ Recherche particuli�re de fichiers g�n�riques
[MD5.D07D4C3038F3578FFCE1C0237F2A1253] - (.Microsoft Corporation - Explorateur Windows.) (.2009-04-11 - 01:27:36.) -- C:\Windows\Explorer.exe [2926592]
[MD5.101BA3EA053480BB5D957EF37C06B5ED] - (.Microsoft Corporation - Application de d�marrage de Windows.) (.2008-01-19 - 02:33:37.) -- C:\Windows\System32\Wininit.exe [96768]
[MD5.02F98B5C0E397AD06124D84428CF8F1A] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.2011-11-03 - 17:39:47.) -- C:\Windows\System32\wininet.dll [1127424]
[MD5.898E7C06A350D4A1A64A9EA264D55452] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.2009-04-11 - 01:28:13.) -- C:\Windows\System32\Winlogon.exe [314368]
[MD5.3911B972B55FEA0478476B2E777B29FA] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.2011-04-21 - 08:58:27.) -- C:\Windows\system32\Drivers\AFD.sys [273408]
[MD5.9E7E85EC61D1C9C3171CC08427108863] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.2007-05-16 - 13:14:47.) -- C:\Windows\system32\Drivers\atapi.sys [21688]
[MD5.7ADD03E75BEB9E6DD102C3081D29840A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.2008-01-19 - 00:28:02.) -- C:\Windows\system32\Drivers\Cdfs.sys [70144]
[MD5.6B4BFFB9BECD728097024276430DB314] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.2009-04-10 - 23:39:17.) -- C:\Windows\system32\Drivers\Cdrom.sys [67072]
[MD5.622C41A07CA7E6DD91770F50D532CB6C] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.2011-04-14 - 09:59:03.) -- C:\Windows\system32\Drivers\DfsC.sys [75264]
[MD5.062452B7FFD68C8C042A6261FE8DFF4A] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.2009-04-10 - 23:42:42.) -- C:\Windows\system32\Drivers\HDAudBus.sys [561152]
[MD5.22D56C8184586B7A1F6FA60BE5F5A2BD] - (.Microsoft Corporation - Pilote de port i8042.) (.2008-01-19 - 00:49:18.) -- C:\Windows\system32\Drivers\i8042prt.sys [54784]
[MD5.8793643A67B42CEC66490B2A0CF92D68] - (.Microsoft Corporation - IP Network Address Translator.) (.2008-01-19 - 00:56:28.) -- C:\Windows\system32\Drivers\IpNat.sys [100864]
[MD5.1E94971C4B446AB2290DEB71D01CF0C2] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.2011-04-29 - 08:24:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [106496]
[MD5.ECD64230A59CBD93C85F1CD1CAB9F3F6] - (.Microsoft Corporation - MBT Transport driver.) (.2009-04-10 - 23:45:37.) -- C:\Windows\system32\Drivers\netBT.sys [185856]
[MD5.6A4A98CEE84CF9E99564510DDA4BAA47] - (.Microsoft Corporation - Pilote du syst�me de fichiers NT.) (.2009-04-11 - 01:32:49.) -- C:\Windows\system32\Drivers\ntfs.sys [1083880]
[MD5.0FA9B5055484649D63C303FE404E5F4D] - (.Microsoft Corporation - Pilote de port parall�le.) (.2006-11-02 - 03:51:30.) -- C:\Windows\system32\Drivers\Parport.sys [79360]
[MD5.A214ADBAF4CB47DD2728859EF31F26B0] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.2008-01-19 - 00:56:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [76288]
[MD5.0245418224CFA77BF4B41C2FE0622258] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.2007-05-16 - 13:14:10.) -- C:\Windows\system32\Drivers\rdpdr.sys [242688]
[MD5.7B75299A4D201D6A6533603D6914AB04] - (.Microsoft Corporation - SMB Transport driver.) (.2009-04-10 - 23:45:22.) -- C:\Windows\system32\Drivers\smb.sys [66560]
[MD5.76B06EB8A01FC8624D699E7045303E54] - (.Microsoft Corporation - TDI Translation Driver.) (.2009-04-10 - 23:45:56.) -- C:\Windows\system32\Drivers\tdx.sys [72192]
[MD5.147281C01FCB1DF9252DE2A10D5E7093] - (.Microsoft Corporation - Pilote de clich� instantan� du volume.) (.2009-04-11 - 01:32:55.) -- C:\Windows\system32\Drivers\volsnap.sys [226280]
~ Generic Processes: Scanned in 00mn 01s



---\\ Etat des fichiers cach�s (Cach�/Total)
~ Mes images (My Pictures) : 2/14500
~ Mes musiques (My Musics) : 9/1282
~ Mes Videos (My Videos) : 1/69
~ Mes Favoris (My Favorites) : 1/107
~ Mes Documents (My Documents) : 2/1632
~ Mon Bureau (My Desktop) : 10/5187
~ Menu demarrer (Programs) : 1/35
~ Hidden Files: Scanned in 00mn 16s



---\\ Processus lanc�s
[MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.3148]
[MD5.0D7BF641151539AE14889C2080C80592] - (.Dell - DellDevice Monitor.) -- C:\Program Files\Dell AIO Printer 946\DLCImon.exe [435696] [PID.3292]
[MD5.62BB79160F86CD962F312C68C6239BFD] - (.Microsoft Corporation - Windows Update.) -- C:\Windows\system32\wuauclt.exe [53472] [PID.3852]
[MD5.A9182CE59CFC56F9C1DDE8B3C0AE8378] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe [274840] [PID.1076]
[MD5.72BE75AADEB890AE5BD8DEC30508F992] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8091648] [PID.1268]
[MD5.6080A176D09435FC8E6E800996656E18] - (.Microsoft Corporation - Console IME.) -- C:\Windows\system32\conime.exe [69120] [PID.540]
[MD5.CFCE43B70CA0CC4DCC8ADB62B792B173] - (.Microsoft Corporation - Antimalware Service Executable.) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [11736] [PID.1016]
[MD5.862BB4CBC05D80C5B45BE430E5EF872F] - (.Microsoft Corporation - Service de gestion des licences Microsoft.) -- C:\Windows\system32\SLsvc.exe [3408896] [PID.1396]
[MD5.8F0DE4FEF8201E306F9938B0905AC96A] - (.Google Inc. - Programme d'installation de Google.) -- C:\Program Files\Google\Update\GoogleUpdate.exe [135664] [PID.1548]
[MD5.A4C7EB91404F4D9B2F08BF7667D5E163] - (.Pas de propri�taire - Printer Communication System.) -- C:\Windows\system32\dlcicoms.exe [537480] [PID.1684]
[MD5.AD52269897626D614B31E153F5C5D65C] - (.McAfee, Inc. - McAfee Process Validation Service.) -- C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe [150856] [PID.1372]
[MD5.31E023681015C35EBFE1498B07813B87] - (.Microsoft Corporation - MsCamSvc.exe.) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe [139120] [PID.2068]
[MD5.853CC832F4FE57C74AF51C0DC104AC14] - (.SafeApp Software, LLC - Registry Helper Service.) -- C:\Program Files\Registry Helper\RegistryHelperService.exe [84328] [PID.2288]
[MD5.3F17534B8867854113DF2B45FFF3ACF5] - (.McAfee, Inc. - McAfee Core Firewall Service.) -- C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe [160608] [PID.2480]
[MD5.A5CB074F34BBD89948E34A630D459C0C] - (.Microsoft Corporation - Microsoft Network Inspection System.) -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [208944] [PID.2704]
[MD5.65085456FD9A74D7F1A999520C299ECB] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376] [PID.3084]
[MD5.E0D7732F2D2E24B2DB3F67B6750295B8] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512] [PID.3112]
~ Processes Running: Scanned in 00mn 01s



---\\ Google Chrome, D�marrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Martine\AppData\Local\Google\Chrome\User Data\Default\Preferences
~ Google Browser: 0 Legitimates Filtered in 00mn 00s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Martine\AppData\Roaming\Mozilla\Firefox\Profiles\axv86c3u.default\prefs.js
M2 - MFEP: prefs.js [Martine - axv86c3u.default\9518042e-7ad6-4dac-b377-056e28d00c8f@f1cc0a13-4df1-4d66-938f-088db8838882.com] [] Solid Savings v (..) =>Adware.SolidSavings
M2 - MFEP: prefs.js [Martine - axv86c3u.default\crossriderapp19962@crossrider.com] [] Supreme Savings v (..) =>PUP.RewardsArcade
M2 - MFEP: prefs.js [Martine - axv86c3u.default\crossriderapp4479@crossrider.com] [] Giant Savings v (..) =>Adware.VidSaver
M2 - MFEP: prefs.js [Martine - axv86c3u.default\{3112ca9c-de6d-4884-a869-9855de68056c}] [] Google Toolbar for Firefox v3.0.20070525W (..) =>Toolbar.Google
~ Firefox Browser: 29 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 20



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} Cl� orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{21FA44EF-376D-4D53-9B0F-8A89D3229068} Cl� orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} Cl� orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} Cl� orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{04A8DD1A-4754-48FE-A703-99846646EF04} Cl� orpheline
~ Toolbar: Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Barbie(R) idesign(TM) Ultimate Stylist(TM).lnk . (.Macrovision Corporation - InstallShield.) -- C:\Windows\Installer\{3EDF07A0-0362-4881-A772-ED4E66D3084A}\BarbieFashionCards_0CEDF579A685416B92F41EB19FC1936B.exe
O4 - GS\Desktop [Public]: Conseiller de mise � niveau vers Windows 7.lnk . (.Microsoft Corporation - Windows 7 Upgrade Advisor.) -- C:\Program Files\Microsoft Windows 7 Upgrade Advisor\WindowsUpgradeAdvisor.exe
O4 - GS\Desktop [Public]: Consommables pour l'imprimante Dell - Jet d'encre.lnk . (...) -- C:\Windows\system32\spool\drivers\w32x86\3\dlcipswx.exe
O4 - GS\Desktop [Public]: Free YouTube to MP3 Converter.lnk . (.DVDVideoSoft Ltd. - FreeYouTubeToMP3Converter.) -- C:\Program Files\DVDVideoSoft\Free YouTube to MP3 Converter\FreeYouTubeToMP3Converter.exe
O4 - GS\Desktop [Public]: Jojo's Fashion Show.lnk . (...) -- C:\Program Files\iWin Games\iWinGames.exe (.not file.) =>Adware.FunWebProducts)
O4 - GS\Desktop [Public]: MiniTool Partition Wizard Home Edition.lnk . (...) -- C:\Program Files\MiniTool Partition Wizard Home Edition 8.1.1\loader.exe
O4 - GS\Desktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O4 - GS\Desktop [Public]: OpenOffice 4.0.0.lnk . (.Apache Software Foundation - OpenOffice 4.0.0.) -- C:\Program Files\OpenOffice 4\program\soffice.exe
O4 - GS\Desktop [Public]: Registry Helper.lnk . (.SafeApp Software, LLC - Registry Helper.) -- C:\Program Files\Registry Helper\RegistryHelper.exe
O4 - GS\Program [Public]: Conseiller de mise � niveau vers Windows 7.lnk . (.Microsoft Corporation - Windows 7 Upgrade Advisor.) -- C:\Program Files\Microsoft Windows 7 Upgrade Advisor\WindowsUpgradeAdvisor.exe
O4 - GS\Program [Public]: IncrediMail.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files\IncrediMail\Bin\IncMail.exe
O4 - GS\Program [Public]: McAfee Virtual Technician.lnk . (.McAfee Inc. - McAfee Virtual Technician Application.) -- C:\Program Files\McAfee\Supportability\MVT\MvtApp.exe
O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O4 - GS\Program [Public]: Prezi Desktop.lnk . (...) -- C:\Program Files\Prezi Desktop 4\Prezi Desktop.exe
O4 - GS\Program [Public]: Safari.lnk . (...) -- C:\Windows\Installer\{F2AF3E5D-9697-485C-A5AC-E2B9468C446A}\SafariIco.exe
O4 - GS\QuickLaunch [Rose-Marie]: Apple Safari.lnk . (...) -- C:\Windows\Installer\{AFAC914D-9E83-4A89-8ABE-427521C82CCF}\SafariIco.exe
O4 - GS\QuickLaunch [Rose-Marie]: BearShare.lnk . (...) -- C:\Program Files\BearShare Applications\BearShare\BearShare.exe (.not file.) =>PUP.BearShare
O4 - GS\QuickLaunch [Rose-Marie]: Go to RealArcade.lnk . (...) -- C:\Program Files\RealArcade\RealArcade.exe (.not file.)
O4 - GS\QuickLaunch [Rose-Marie]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Program [Rose-Marie]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [Rose-Marie]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Rose-Marie]: BeTrapped!.lnk . (...) -- C:\Program Files\MumboJumbo\Inspector Parker Mystery Bundle\BeTrapped!\BeTrapped.exe (.not file.)
O4 - GS\Desktop [Rose-Marie]: Inspector Parker.lnk . (...) -- C:\Program Files\MumboJumbo\Inspector Parker Mystery Bundle\Inspector Parker\Parker.exe (.not file.)
O4 - GS\Desktop [Rose-Marie]: LMSOFT Web Creator 4.lnk . (...) -- C:\Program Files\LMSOFT Web Creator 4\WebCreator4.exe (.not file.)
O4 - GS\Desktop [Rose-Marie]: RegCleaner.lnk . (...) -- C:\Program Files\RegCleaner\RegCleanr.exe
O4 - GS\Desktop [Rose-Marie]: Safari.lnk - Cl� orpheline
O4 - GS\Desktop [Rose-Marie]: Tukanas Files Converter.lnk . (...) -- C:\Program Files\Tukanas Files Converter\UNWISE.exe (.not file.)
O4 - GS\QuickLaunch [Martine]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O4 - GS\Program [Martine]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [Martine]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SendTo [Martine]: Print to Fax.lnk . (...) -- C:\Program Files\Dell AIO Printer 946\FAXTOOLS\SendFax.exe
O4 - GS\Desktop [Martine]: Candace Kane's Candy Factory.lnk . (...) -- C:\Program Files\Candace Kane's Candy Factory\Candace Kanes Candy Factory.exe
O4 - GS\Desktop [Martine]: chkdsk - Raccourci.lnk . (.Microsoft Corporation - Utilitaire de v�rification de disque.) -- C:\Windows\System32\chkdsk.exe
O4 - GS\Desktop [Martine]: HD Tune.lnk . (.EFD Software - HD Tune.) -- C:\Program Files\HD Tune\HDTune.exe
O4 - GS\QuickLaunch [Juliette]: Apple Safari.lnk . (...) -- C:\Windows\Installer\{2EEC2A94-7204-45C6-93BB-67EAEB19E4D6}\SafariIco.exe
O4 - GS\QuickLaunch [Juliette]: BearShare.lnk . (...) -- C:\Program Files\BearShare Applications\BearShare\BearShare.exe (.not file.) =>PUP.BearShare
O4 - GS\QuickLaunch [Juliette]: Go to RealArcade.lnk . (...) -- C:\Program Files\RealArcade\RealArcade.exe (.not file.)
O4 - GS\QuickLaunch [Juliette]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Program [Juliette]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [Juliette]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Juliette]: BeTrapped!.lnk . (...) -- C:\Program Files\MumboJumbo\Inspector Parker Mystery Bundle\BeTrapped!\BeTrapped.exe (.not file.)
O4 - GS\Desktop [Juliette]: Inspector Parker.lnk . (...) -- C:\Program Files\MumboJumbo\Inspector Parker Mystery Bundle\Inspector Parker\Parker.exe (.not file.)
O4 - GS\Desktop [Juliette]: LMSOFT Web Creator 4.lnk . (...) -- C:\Program Files\LMSOFT Web Creator 4\WebCreator4.exe (.not file.)
O4 - GS\Desktop [Juliette]: Play Puppy Luv Adventures.lnk . (...) -- C:\Program Files\Puppy Luv Adventures\PuppyLuvDE.exe (.not file.)
O4 - GS\Desktop [Juliette]: RegCleaner.lnk . (...) -- C:\Program Files\RegCleaner\RegCleanr.exe
O4 - GS\Desktop [Juliette]: Safari.lnk - Cl� orpheline
O4 - GS\Desktop [Juliette]: Tukanas Files Converter.lnk . (...) -- C:\Program Files\Tukanas Files Converter\UNWISE.exe (.not file.)
O4 - GS\QuickLaunch [Guy]: Apple Safari.lnk . (...) -- C:\Windows\Installer\{AFAC914D-9E83-4A89-8ABE-427521C82CCF}\SafariIco.exe
O4 - GS\QuickLaunch [Guy]: BearShare.lnk . (...) -- C:\Program Files\BearShare Applications\BearShare\BearShare.exe (.not file.) =>PUP.BearShare
O4 - GS\QuickLaunch [Guy]: Go to RealArcade.lnk . (...) -- C:\Program Files\RealArcade\RealArcade.exe (.not file.)
O4 - GS\QuickLaunch [Guy]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Program [Guy]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [Guy]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Guy]: BeTrapped!.lnk . (...) -- C:\Program Files\MumboJumbo\Inspector Parker Mystery Bundle\BeTrapped!\BeTrapped.exe (.not file.)
O4 - GS\Desktop [Guy]: Inspector Parker.lnk . (...) -- C:\Program Files\MumboJumbo\Inspector Parker Mystery Bundle\Inspector Parker\Parker.exe (.not file.)
O4 - GS\Desktop [Guy]: RegCleaner.lnk . (...) -- C:\Program Files\RegCleaner\RegCleanr.exe
~ Global Startup: 144 Legitimates Filtered in 00mn 05s



---\\ Applications lanc�es au d�marrage du syt�me (O4)
O4 - GS\Startup [Rose-Marie]: OpenOffice.org 2.2.lnk . (...) -- C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe (.not file.)
O4 - GS\Startup [Rose-Marie]: OpenOffice.org 3.1.lnk . (...) -- C:\Program Files\OpenOffice.org 3\program\quickstart.exe (.not file.)
O4 - GS\Startup [Rose-Marie]: StarOffice 8.lnk . (...) -- C:\Program Files\Sun\StarOffice 8\program\quickstart.exe (.not file.)
O4 - GS\Startup [Guy]: OpenOffice.org 2.2.lnk . (...) -- C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe (.not file.)
O4 - HKLM\..\Run: [DLCICATS] rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\DLCItime.dll (.not file.)
O4 - HKLM\..\Run: [dlcimon.exe] . (.Dell - DellDevice Monitor.) -- C:\Program Files\Dell AIO Printer 946\dlcimon.exe
O4 - HKLM\..\Run: [FaxCenterServer] . (.Pas de propri�taire - Fax Man Server.) -- C:\Program Files\Dell Fax Solutions\fm3032.exe
O4 - HKCU\..\Run: [DellSystemDetect] . (...) -- C:\Users\Martine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell\Dell System Detect.appref-ms
O4 - HKCU\..\Run: [iLivid] C:\Users\Martine\AppData\Local\iLivid\iLivid.exe (.not file.) =>Adware.Bandoo
O4 - HKCU\..\Run: [WMPNSCFG] . (.Microsoft Corporation - Application de configuration du service Par.) -- C:\Program Files\Windows Media Player\WMPNSCFG.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] C:\Program Files\Windows Live\Messenger\msnmsgr.exe (.not file.)
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] Cl� orpheline
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] Cl� orpheline
O4 - HKUS\S-1-5-18\..\RunOnce: [DelayShred] c:\program files\mcafee\mshr\ShrCL.exe (.not file.)
O4 - HKUS\S-1-5-21-2111685095-2842039935-3567830899-1000\..\Run: [DellSystemDetect] . (...) -- C:\Users\Martine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell\Dell System Detect.appref-ms
O4 - HKUS\S-1-5-21-2111685095-2842039935-3567830899-1000\..\Run: [iLivid] C:\Users\Martine\AppData\Local\iLivid\iLivid.exe (.not file.) =>Adware.Bandoo
O4 - HKUS\S-1-5-21-2111685095-2842039935-3567830899-1000\..\Run: [WMPNSCFG] . (.Microsoft Corporation - Application de configuration du service Par.) -- C:\Program Files\Windows Media Player\WMPNSCFG.exe =>.Microsoft Corporation
~ Application: Scanned in 00mn 00s



---\\ Boutons situ�s sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\OFFICE11\REFBARH.ICO
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} . (...) -- C:\Program Files\IMVU\imvu.ico
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Site dans la Zone de confiance d'Internet Explorer (O15)
O15 - Trusted Zone: [HKCU\...\Domains] *.dell.com
O15 - Trusted Zone: [HKCU\...\Domains] http.mcafee.com
~ IE Zone Confiance: Scanned in 00mn 00s



---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: CabBuilder (CabBuilder) - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} ((no name)) - http://a1540.g.akamai.net/7/1540/52/20040105/qtinstall.info.apple.com/mickey/fr/win/QuickTimeInstaller.exe
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} ((no name)) - http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} ((no name)) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} ((no name)) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
~ Objets ActiveX: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{95799A27-D36F-4F71-AA8F-4124E45DACD7}: NameServer = 67.69.239.49 207.164.234.129
O17 - HKLM\System\CCS\Services\Tcpip\..\{EDE3EAD7-56CB-4D50-9AAB-F19706A18700}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{95799A27-D36F-4F71-AA8F-4124E45DACD7}: NameServer = 67.69.239.49 207.164.234.129
O17 - HKLM\System\CS1\Services\Tcpip\..\{EDE3EAD7-56CB-4D50-9AAB-F19706A18700}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{EDE3EAD7-56CB-4D50-9AAB-F19706A18700}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\system32\mshtml.dll =>.Microsoft Corporation
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} . (...) --
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-cl�s Winlogon Notify (autorun) (O20)
O20 - AppInit_DLLs: . (.Google - Google Desktop.) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll
~ AppInit DLL: Scanned in 00mn 00s



---\\ Cl� de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Biblioth�que de l'interface utilisateur du.) -- C:\Windows\System32\browseui.dll
~ STS/SSO: Scanned in 00mn 00s



---\\ Liste des services NT non Microsoft et non d�sactiv�s (O23)
O23 - Service: Registry Helper Service (Registry Helper Service) . (.SafeApp Software, LLC - Registry Helper Service.) - C:\Program Files\Registry Helper\RegistryHelperService.exe
~ Services: 7 Legitimates Filtered in 00mn 12s



---\\ T�ches planifi�es en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\PC Medkit.job [322] =>Adware.iHaveNet
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\vtscheduletask.job [458]
[MD5.00000000000000000000000000000000] [APT] [BFGLaunch_bfgclient] (...) -- C:\Program Files\bfgclient\bfgclient.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [BrowserSafeguard Update Task] (...) -- C:\Program Files\Browsersafeguard\uninstall.browsersafeguard.exe (.not file.) [0] =>PUP.BrowserSafeguard
[MD5.00000000000000000000000000000000] [APT] [Dr. CleanUp] (...) -- C:\Program Files\DrCleanUp\drCleanup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [IHUninstallTrackingTASK] (...) -- C:\Users\Martine\AppData\Local\Temp\IHU5968.tmp.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [PC Medkit] (...) -- C:\Program Files\PC Medkit\PC Medkit.lnk --scan --stack=from-scheduler (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [wrSpySweeperTrialSweep] (...) -- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{05CFB9FC-C323-46F0-A2E3-E0C2A6D8ECC7}] (...) -- E:\setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{05D49E18-C5E6-49B1-B51A-40B7C5949798}] (...) -- E:\autorun.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{19714F75-25C2-4D66-820E-A2DE940D1084}] (...) -- C:\Users\Martine\AppData\Local\Zylom Games\AquaPark Deluxe\GameInstlr.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{32A9A47E-CB79-497F-9983-2D5FC38AD887}] (...) -- C:\Users\Martine\Downloads\atlant10n_fr.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{7AA93A88-B4D8-411A-B440-CB6CDDEBF577}] (...) -- E:\SETUP.exe (.not file.) [0]
~ Scheduled Task: 31 Legitimates Filtered in 00mn 05s



---\\ Logiciels install�s (O42)
O42 - Logiciel: BrowserSafeguard - (.Browsersafeguard.) [HKLM] -- Browsersafeguard =>PUP.BrowserSafeguard
O42 - Logiciel: Candace Kane's Candy Factory 1.0 - (.Gnosis Games.) [HKLM] -- Candace Kane's Candy Factory
O42 - Logiciel: Dogz2 (remove only) - (...) [HKLM] -- Dogz2
O42 - Logiciel: IncrediMail - (.IncrediMail.) [HKLM] -- {2CF22C94-1369-4C04-9A5F-A4BC6D91B508}
O42 - Logiciel: IncrediMail 2.0 - (.IncrediMail Ltd..) [HKLM] -- IncrediMail
O42 - Logiciel: My Scene(TM) STARS D' Hollywood - (...) [HKLM] -- My Scene(TM) STARS D' Hollywood
O42 - Logiciel: Totally Spies! Totally Party - (...) [HKLM] -- Totally Party
~ Logic: 100 Legitimates Filtered in 00mn 01s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\Alterlab]
[HKCU\Software\BearShare] =>PUP.BearShare
[HKCU\Software\ELIGCHK]
[HKCU\Software\Eyeblaster]
[HKCU\Software\Fixie]
[HKCU\Software\FxDrCl]
[HKCU\Software\IM]
[HKCU\Software\ITTNord]
[HKCU\Software\IncrediMail]
[HKCU\Software\Linksolutions]
[HKCU\Software\Mixi.DJ]
[HKCU\Software\TOPCMM]
[HKCU\Software\Teyon]
[HKCU\Software\WhiteSmoke] =>PUP.WhiteSmoke
[HKCU\Software\Yahoo]
[HKCU\Software\iWin.com Games]
[HKCU\Software\iWin]
[HKLM\Software\AMPing]
[HKLM\Software\DaycareNightmare2]
[HKLM\Software\Gnosis Games]
[HKLM\Software\Gnosis]
[HKLM\Software\Her Interactive, Inc.]
[HKLM\Software\Katana]
[HKLM\Software\MediaCenterPaths]
[HKLM\Software\NGWare]
[HKLM\Software\SDC Player]
[HKLM\Software\TLC]
[HKLM\Software\VBMZ]
[HKLM\Software\WhiteSmoke] =>PUP.WhiteSmoke
[HKLM\Software\Yahoo]
[HKLM\Software\iWin]
~ Key Software: 323 Legitimates Filtered in 00mn 01s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 2013-04-26 - 16:37:22 - [0] ----D C:\Program Files\ABC 3GP Converter
O43 - CFD: 2009-11-03 - 19:42:13 - [0] ----D C:\Program Files\Anime Bowling Babes
O43 - CFD: 2007-06-12 - 22:50:03 - [97,352] ----D C:\Program Files\Autofr
O43 - CFD: 2008-07-13 - 14:04:21 - [0,040] ----D C:\Program Files\Baby Blimp
O43 - CFD: 2009-11-15 - 15:21:09 - [0] ----D C:\Program Files\Baby Luv
O43 - CFD: 2010-06-27 - 21:01:16 - [0,529] ----D C:\Program Files\BearShareTb =>PUP.BearShare
O43 - CFD: 2013-08-18 - 08:30:16 - [97,557] ----D C:\Program Files\Candace Kane's Candy Factory
O43 - CFD: 2012-10-07 - 16:08:40 - [0] ----D C:\Program Files\Carlton Books
O43 - CFD: 2009-06-19 - 18:37:23 - [0,022] ----D C:\Program Files\CookingAcademy2_at
O43 - CFD: 2012-10-07 - 16:01:20 - [39,514] ----D C:\Program Files\Family Restaurant
O43 - CFD: 2012-10-07 - 16:01:21 - [0,006] ----D C:\Program Files\Fashion Craze
O43 - CFD: 2011-04-24 - 11:36:10 - [0,001] ----D C:\Program Files\Hollywood Pets
O43 - CFD: 2013-01-23 - 12:17:18 - [26,687] ----D C:\Program Files\IncrediMail
O43 - CFD: 2011-05-31 - 09:43:04 - [0,837] ----D C:\Program Files\iWin.com
O43 - CFD: 2013-07-17 - 09:38:45 - [34,627] ----D C:\Program Files\iWin.com Games
O43 - CFD: 2007-08-18 - 13:59:07 - [582,885] ----D C:\Program Files\My Scene(TM)
O43 - CFD: 2009-11-15 - 15:38:58 - [0,024] ----D C:\Program Files\Puppy Luv
O43 - CFD: 2009-11-15 - 15:40:11 - [0,004] ----D C:\Program Files\Sallys Salon
O43 - CFD: 2009-11-15 - 15:40:54 - [0,008] ----D C:\Program Files\Sallys Spa
O43 - CFD: 2009-04-27 - 11:30:01 - [0,072] ----D C:\Program Files\Spyware Doctor
O43 - CFD: 2009-11-24 - 12:17:54 - [0] ----D C:\Program Files\The Tuttles
O43 - CFD: 2007-11-16 - 15:13:13 - [3,950] ----D C:\Program Files\TLC
O43 - CFD: 2010-09-08 - 13:07:18 - [0,003] ----D C:\ProgramData\12A
O43 - CFD: 2009-08-10 - 10:51:38 - [0,002] ----D C:\ProgramData\25262
O43 - CFD: 2008-04-11 - 04:33:06 - [17,810] ----D C:\ProgramData\Alterlab
O43 - CFD: 2011-06-29 - 06:08:45 - [0,003] ----D C:\ProgramData\clp
O43 - CFD: 2010-06-29 - 08:27:01 - [0,002] ----D C:\ProgramData\DigiCont
O43 - CFD: 2008-03-31 - 05:21:08 - [3,094] ----D C:\ProgramData\Fashion Solitaire 1.2
O43 - CFD: 2012-06-28 - 10:44:14 - [0] ----D C:\ProgramData\Fixie
O43 - CFD: 2009-09-20 - 12:43:14 - [0] ----D C:\ProgramData\IM
O43 - CFD: 2009-09-20 - 12:39:20 - [25,682] ----D C:\ProgramData\IncrediMail
O43 - CFD: 2013-09-16 - 12:59:36 - [0,062] ----D C:\ProgramData\iWin Games =>Adware.FunWebProducts)
O43 - CFD: 2008-05-21 - 15:56:11 - [0,010] ----D C:\ProgramData\Lifetime
O43 - CFD: 2008-04-10 - 16:45:06 - [0,241] ----D C:\ProgramData\Megastore Madness
O43 - CFD: 2008-03-14 - 12:29:19 - [0,001] ----D C:\ProgramData\n7-89-o9-3r-4t-r9
O43 - CFD: 2008-04-28 - 05:24:32 - [7,528] ----D C:\ProgramData\Pets Fun House
O43 - CFD: 2008-03-01 - 07:18:08 - [12,683] ----D C:\ProgramData\VogueTales
O43 - CFD: 2012-10-07 - 16:07:30 - [3,412] --H-D C:\ProgramData\~1
O43 - CFD: 2008-12-08 - 18:32:19 - [0,026] ----D C:\Users\Martine\AppData\Roaming\BFG_JanesRealty
O43 - CFD: 2007-11-30 - 13:27:19 - [0,058] ----D C:\Users\Martine\AppData\Roaming\Eyeblaster
O43 - CFD: 2012-06-28 - 10:44:15 - [1,109] ----D C:\Users\Martine\AppData\Roaming\Fixie
O43 - CFD: 2009-06-27 - 10:14:19 - [3,308] ----D C:\Users\Martine\AppData\Roaming\Fuzzy Games
O43 - CFD: 2012-06-28 - 10:57:21 - [0] ----D C:\Users\Martine\AppData\Roaming\FxDrCl
O43 - CFD: 2009-06-29 - 09:39:47 - [0,010] ----D C:\Users\Martine\AppData\Roaming\ITTNord
O43 - CFD: 2008-10-20 - 07:09:59 - [0,002] ----D C:\Users\Martine\AppData\Roaming\iWin_DressUpRush
O43 - CFD: 2008-10-18 - 13:10:07 - [0,036] ----D C:\Users\Martine\AppData\Roaming\iWin_JanesRealty
O43 - CFD: 2011-03-31 - 19:39:05 - [0,002] ----D C:\Users\Martine\AppData\Roaming\Mondou.A15764D5156612413EFCD55C47961909C8BF9BB1.1
O43 - CFD: 2011-05-31 - 09:47:50 - [2,704] ----D C:\Users\Martine\AppData\Roaming\MP3Rocket
O43 - CFD: 2009-06-13 - 18:14:40 - [0,009] ----D C:\Users\Martine\AppData\Roaming\Pi Eye Games
O43 - CFD: 2009-07-22 - 17:49:31 - [0,055] ----D C:\Users\Martine\AppData\Roaming\Reflexive_Janes_Realty
O43 - CFD: 2011-11-20 - 15:16:49 - [0,001] ----D C:\Users\Martine\AppData\Roaming\WhiteSmoke =>PUP.WhiteSmoke
O43 - CFD: 2008-03-24 - 07:53:53 - [0] ----D C:\Users\Martine\AppData\Roaming\Yahoo!
O43 - CFD: 2009-08-31 - 20:51:08 - [0] ----D C:\Users\Martine\AppData\Local\ICS
O43 - CFD: 2010-04-19 - 16:55:12 - [177,875] ----D C:\Users\Martine\AppData\Local\IM
O43 - CFD: 2013-07-17 - 09:39:42 - [0,003] ----D C:\Users\Martine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iWin.com Games
~ Program Folder: 425 Legitimates Filtered in 01mn 34s



---\\ Derniers fichiers modifi�s ou cr�es sous Windows et System32 (O44)
O44 - LFC:[MD5.5A5CFF37F1BD0F86B9BDAAD7A9445882] - 2013-10-03 - 21:17:41 R-HA- . (...) -- C:\Windows\WindowsShell.Manifest [749]
O44 - LFC:[MD5.570E88C94F9ECE8383BB031D7444465D] - 2013-10-07 - 15:05:39 ---A- . (...) -- C:\dlci.log [4287]
O44 - LFC:[MD5.A6C28FC0C3F31E3DB980A75958273B28] - 2013-10-07 - 15:16:13 ---A- . (.Pas de propri�taire - Printer Communication System.) -- C:\Windows\System32\dlcicfg.exe [381832]
O44 - LFC:[MD5.E6AD9406ED28CB01FBC90E8395999333] - 2013-10-07 - 15:16:14 ---A- . (.Pas de propri�taire - Printer Communication System.) -- C:\Windows\System32\dlcicomc.dll [684032]
O44 - LFC:[MD5.454E20DF156B42BC4B14DC6E4414C1FF] - 2013-10-07 - 15:16:14 ---A- . (.Pas de propri�taire - Printer Communication System.) -- C:\Windows\System32\dlcicomm.dll [421888]
O44 - LFC:[MD5.C16EE66C704681BB47AC98809E2D77EA] - 2013-10-07 - 15:16:15 ---A- . (.Pas de propri�taire - CU bitmap resource DLL.) -- C:\Windows\System32\dlcicub.dll [86016]
O44 - LFC:[MD5.43EE531BC15B19EEB0EFCF44E2A847BC] - 2013-10-07 - 15:16:15 ---A- . (.Pas de propri�taire - Cu DLL.) -- C:\Windows\System32\dlcicu.dll [73728]
O44 - LFC:[MD5.80E67C1BB21A1DF4F24B6F87474243A5] - 2013-10-07 - 15:16:15 ---A- . (.Pas de propri�taire - Cu resource DLL.) -- C:\Windows\System32\dlcicur.dll [36864]
O44 - LFC:[MD5.A4C7EB91404F4D9B2F08BF7667D5E163] - 2013-10-07 - 15:16:15 ---A- . (.Pas de propri�taire - Printer Communication System.) -- C:\Windows\System32\dlcicoms.exe [537480]
O44 - LFC:[MD5.1DB146716891A253A8C0A250F2BD326A] - 2013-10-07 - 15:16:16 ---A- . (...) -- C:\Windows\System32\dlcihelp.chm [291764]
O44 - LFC:[MD5.D45AADF2C95A91DB5F4E222D16F05A24] - 2013-10-07 - 15:16:16 ---A- . (.Pas de propri�taire - Printer Communication System.) -- C:\Windows\System32\dlcihbn3.dll [696320]
O44 - LFC:[MD5.1B5A7CE3E532490B1398EEFCFE0D476F] - 2013-10-07 - 15:16:17 ---A- . (.Pas de propri�taire - INS bitmap resource DLL.) -- C:\Windows\System32\dlciinsb.dll [176128]
O44 - LFC:[MD5.0020A07DF1F0F5ECC9511A01978403CB] - 2013-10-07 - 15:16:17 ---A- . (.Pas de propri�taire - Ins resource DLL.) -- C:\Windows\System32\dlciinsr.dll [114688]
O44 - LFC:[MD5.8A297D7BA913C51B7EA3ABFBB4D9C2F7] - 2013-10-07 - 15:16:17 ---A- . (.Pas de propri�taire - Jsw resource DLL.) -- C:\Windows\System32\dlcijswr.dll [135168]
O44 - LFC:[MD5.57BE21279F0DC37FB42208CA76DF55F3] - 2013-10-07 - 15:16:17 ---A- . (.Pas de propri�taire - Printer Communication System.) -- C:\Windows\System32\dlciih.exe [385928]
O44 - LFC:[MD5.1E94BE9356E6B2481CDA48D0DBA29C01] - 2013-10-07 - 15:16:17 ---A- . (.Pas de propri�taire - ins DLL.) -- C:\Windows\System32\dlciins.dll [159744]
O44 - LFC:[MD5.2A0C32CB84C6313400EF1B8626307C55] - 2013-10-07 - 15:16:18 ---A- . (.Pas de propri�taire - Printer Communication System.) -- C:\Windows\System32\dlcilmpm.dll [585728]
O44 - LFC:[MD5.29A92F76359A5BD75146782C7A2A2C31] - 2013-10-07 - 15:16:18 ---A- . (.Pas de propri�taire - Printer Communication System.) -- C:\Windows\System32\dlcipmui.dll [643072]
O44 - LFC:[MD5.7AEAA7800620387C03A7C560BDB327EA] - 2013-10-07 - 15:16:18 ---A- . (.Pas de propri�taire - Printer Communication System.) -- C:\Windows\System32\dlcipplc.dll [94208]
O44 - LFC:[MD5.21AB55041668F9424A3698070A918A5A] - 2013-10-07 - 15:16:18 ---A- . (.Pas de propri�taire - Printer Communication System.) -- C:\Windows\System32\dlciprox.dll [163840]
O44 - LFC:[MD5.98D36796CC850C94DD6EDEC384ECE304] - 2013-10-07 - 15:16:19 ---A- . (.Pas de propri�taire - Printer Communication System.) -- C:\Windows\System32\dlciserv.dll [1224704]
O44 - LFC:[MD5.FCE162D9604C08F2A0D60A674B64699D] - 2013-10-07 - 15:16:19 ---A- . (.Pas de propri�taire - Printer Communication System.) -- C:\Windows\System32\dlciusb1.dll [991232]
O44 - LFC:[MD5.91A9D940A9335BC14755F2027D44FB0E] - 2013-10-07 - 15:16:20 ---A- . (.Pas de propri�taire - Printer Communication System.) -- C:\Windows\System32\dlciiesc.dll [397312]
O44 - LFC:[MD5.D6B87681650DF6E516CC69EB3BD2C36B] - 2013-10-07 - 15:16:20 ---A- . (.Pas de propri�taire - Printer Communication System.) -- C:\Windows\System32\dlciinpa.dll [413696]
O44 - LFC:[MD5.C91F268F3CB4958FB89E0C3D10303BC9] - 2013-10-07 - 15:16:20 ---A- . (.Pas de propri�taire - utilities DLL.) -- C:\Windows\System32\dlciutil.dll [434176]
O44 - LFC:[MD5.057108B7EFA273711413908461ADD507] - 2013-10-07 - 15:16:21 ---A- . (...) -- C:\Windows\System32\DLCIinst.dll [274432]
O44 - LFC:[MD5.5B60FD90BADDF40B4199087E04F610E9] - 2013-10-07 - 15:16:21 ---A- . (.Pas de propri�taire - Printer Communication System.) -- C:\Windows\System32\DLCIhcp.dll [323584]
O44 - LFC:[MD5.CD0E2B2F2CAD53E5ED6AD8F9CEA15ACC] - 2013-10-07 - 15:18:13 ---A- . (...) -- C:\Windows\System32\dlcicoin.dll [344064]
O44 - LFC:[MD5.4BF5D69CB37DFB6AB3D38DBC11B86D20] - 2013-10-07 - 15:22:56 ---A- . (...) -- C:\setupfax.log [172]
O44 - LFC:[MD5.6AABA6E8AD90DD2854B6309C06264E96] - 2013-10-07 - 15:23:01 ---A- . (...) -- C:\Windows\System32\LexFiles.ulf [23355]
O44 - LFC:[MD5.88B84992EF2C7D597D365FD9F59E7DFD] - 2013-10-11 - 13:40:05 ---A- . (...) -- C:\Windows\System32\mfc45.dat [74703]
O44 - LFC:[MD5.682AE0FFA6A865A8D137C43139BB4BCD] - 2013-10-11 - 15:52:26 ---A- . (...) -- C:\Windows\diagerr.xml [1905]
O44 - LFC:[MD5.682AE0FFA6A865A8D137C43139BB4BCD] - 2013-10-11 - 15:52:26 ---A- . (...) -- C:\Windows\diagwrn.xml [1905]
O44 - LFC:[MD5.9D00D015159B6ADF0980BAEEB5DCC5E4] - 2013-10-13 - 17:20:22 ----- . (...) -- C:\Windows\System32\pwdspio.sys [10320]
O44 - LFC:[MD5.3A6489DCB6F28970B6BBD9687777FA00] - 2013-10-13 - 17:20:38 ----- . (...) -- C:\Windows\System32\pwdrvio.sys [15688]
O44 - LFC:[MD5.048131BBA0D5D183F433F75A24ADDAC6] - 2013-10-13 - 17:20:39 ---A- . (...) -- C:\Windows\System32\pwNative.exe [2881848]
~ Files: 49 Legitimates Filtered in 02mn 05s



---\\ Cl� de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{12f36356-428e-11dc-8cc7-806e6f6e6963}\AutoRun\command. (...) -- E:\setup.exe (.not file.)
O51 - MPSK:{67e9da30-ceea-11df-819b-00188b633591}\AutoRun\command. (...) -- F:\Ursulines\Windows\Ursulines.exe (.not file.)
~ Keys: Scanned in 00mn 00s



---\\ Enum�ration des cl�s de registre StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\Anti Trojan Elite [Key] . (.ISecSoft - Pas de description.) -- C:\Program Files\Anti Trojan Elite\TJEnder.exe
O53 - SMSR:HKLM\...\startupreg\ECenter [Key] . (...) -- c:\dell\E-Center\EULALauncher.exe
O53 - SMSR:HKLM\...\startupreg\FaxCenterServer [Key] . (.Pas de propri�taire - Fax Man Server.) -- C:\Program Files\Dell Fax Solutions\fm3032.exe
O53 - SMSR:HKLM\...\startupreg\IncrediMail [Key] . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files\IncrediMail\bin\IncMail.exe
O53 - SMSR:HKLM\...\startupreg\OtShot [Key] . (...) -- C:\Program Files\OtShot\otshot.exe (.not file.)
~ SMSR Keys: 29 Legitimates Filtered in 00mn 00s



---\\ Enum�ration des cl�s de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
~ MWPS: 20 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du syst�me (SDL) (O58)
O58 - SDL:[MD5.E8F3F21A71720C84BCF423B80028359F] - 2006-11-02 - 04:51:34 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [316520]
O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 2006-11-02 - 02:09:42 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029]
~ Drivers: 20 Legitimates Filtered in 00mn 00s



---\\ Derniers fichiers modifi�s ou cr�es (Utilisateur) (O61)
O61 - LFC: 2013-10-12 - 17:13:14 ---A- . (...) -- C:\Users\Martine\AppData\Roaming\Microsoft\Network\Connections\Pbk\rasphone.pbk [1774]
O61 - LFC: 2013-10-14 - 17:05:26 ---A- . (...) -- C:\Users\Martine\AppData\Local\IM\content.xml [88514]
O61 - LFC: 2013-10-14 - 17:13:16 ---A- . (...) -- C:\Users\Martine\AppData\Roaming\Microsoft\OIS\Toolbars.dat [780]
O61 - LFC: 2013-10-15 - 17:13:13 ---A- . (...) -- C:\Users\Martine\AppData\Roaming\McAfee\Supportability\MVTLogs\Results\CANFIXDETAILS.XSL [22162]
O61 - LFC: 2013-10-15 - 17:13:13 ---A- . (...) -- C:\Users\Martine\AppData\Roaming\McAfee\Supportability\MVTLogs\Results\CANNOTFIXDETAILS.XSL [47196]
O61 - LFC: 2013-10-15 - 17:13:13 ---A- . (...) -- C:\Users\Martine\AppData\Roaming\McAfee\Supportability\MVTLogs\Results\COMPLETELOG.XSL [54859]
O61 - LFC: 2013-10-15 - 17:13:13 ---A- . (...) -- C:\Users\Martine\AppData\Roaming\McAfee\Supportability\MVTLogs\Results\COMPLETELOGSAVE.XSL [51670]
O61 - LFC: 2013-10-15 - 17:13:13 ---A- . (...) -- C:\Users\Martine\AppData\Roaming\McAfee\Supportability\MVTLogs\Results\FINALREPORTDETAILS.XSL [63622]
O61 - LFC: 2013-10-15 - 17:13:13 ---A- . (...) -- C:\Users\Martine\AppData\Roaming\McAfee\Supportability\MVTLogs\Results\IE6.CSS [744]
O61 - LFC: 2013-10-15 - 17:13:13 ---A- . (...) -- C:\Users\Martine\AppData\Roaming\McAfee\Supportability\MVTLogs\Results\IE7.CSS [1062]
O61 - LFC: 2013-10-15 - 17:13:13 ---A- . (...) -- C:\Users\Martine\AppData\Roaming\McAfee\Supportability\MVTLogs\Results\MVTSCREEN.CSS [7422]
O61 - LFC: 2013-10-15 - 17:13:13 ---A- . (...) -- C:\Users\Martine\AppData\Roaming\McAfee\Supportability\MVTLogs\Results\PREREQUISITE.XSL [5932]
O61 - LFC: 2013-10-15 - 17:13:13 ---A- . (...) -- C:\Users\Martine\AppData\Roaming\McAfee\Supportability\MVTLogs\Results\PROBLEMLOG.XSL [43026]
O61 - LFC: 2013-10-15 - 17:13:13 ---A- . (...) -- C:\Users\Martine\AppData\Roaming\McAfee\Supportability\MVTLogs\Results\PROBLEMLOGSAVE.XSL [37306]
O61 - LFC: 2013-10-15 - 17:13:13 ---A- . (...) -- C:\Users\Martine\AppData\Roaming\McAfee\Supportability\MVTLogs\Results\REMEDIATE.XSL [2580]
O61 - LFC: 2013-10-15 - 17:13:13 ---A- . (...) -- C:\Users\Martine\AppData\Roaming\McAfee\Supportability\MVTLogs\Results\STYLE.CSS [28746]
O61 - LFC: 2013-10-15 - 17:13:13 ---A- . (...) -- C:\Users\Martine\AppData\Roaming\McAfee\Supportability\MVTLogs\Results\XSLSTRINGS.XSL [2958]
O61 - LFC: 2013-10-15 - 17:13:14 ---A- . (...) -- C:\Users\Martine\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\rasphone.pbk [3545]
O61 - LFC: 2013-10-15 - 17:13:46 ---A- . (...) -- C:\Users\Martine\AppData\Roaming\ZHP\Log.txt [45162] =>.Nicolas Coolman
O61 - LFC: 2013-10-15 - 17:13:46 ---A- . (...) -- C:\Users\Martine\AppData\Roaming\ZHP\TestsZHPDiag.txt [2872] =>.Nicolas Coolman
~ 2 Fichiers temporaires (Temporary files)
~ Files: 994 Legitimates Filtered in 18mn 46s



---\\ Liste des outils de d�sinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
O63 - Logiciel: RSIT - (.random/random.)
~ ADS: Scanned in 00mn 00s



---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 1601-01-01 - C:\Program Files\Anti Trojan Elite\ATEPMon.sys (ATE_PROCMON) .(...) - LEGACY_ATE_PROCMON
~ Legacy: 293 Legitimates Filtered in 00mn 08s



---\\ Menu de d�marrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Apple Inc. - Safari.) -- C:\Program Files\Safari\Safari.exe
~ Keys: Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: prefs.js [Martine - axv86c3u.default] user_pref("extensions.crossrider.bic", "141adfa6ca099c163e57e3744a41137c"); =>PUP.CrossRider
O69 - SBI: prefs.js [Martine - axv86c3u.default] user_pref("extensions.crossriderapp19962.19962.InstallationTime", 1381603373); =>PUP.CrossRider
O69 - SBI: prefs.js [Martine - axv86c3u.default] user_pref("extensions.crossriderapp19962.19962.cookie.InstallationTime.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500"); =>PUP.CrossRider
O69 - SBI: prefs.js [Martine - axv86c3u.default] user_pref("extensions.crossriderapp19962.19962.cookie.InstallationTime.value", "1381603373"); =>PUP.CrossRider
O69 - SBI: prefs.js [Martine - axv86c3u.default] user_pref("extensions.crossriderapp19962.bic", "141adfa6ca099c163e57e3744a41137c"); =>PUP.CrossRider
O69 - SBI: prefs.js [Martine - axv86c3u.default] user_pref("extensions.crossriderapp19962.firstrun", false); =>PUP.CrossRider
O69 - SBI: prefs.js [Martine - axv86c3u.default] user_pref("extensions.crossriderapp19962.installationdate", 1381603373); =>PUP.CrossRider
O69 - SBI: prefs.js [Martine - axv86c3u.default] user_pref("extensions.crossriderapp19962.lastcheck", 23031168); =>PUP.CrossRider
O69 - SBI: prefs.js [Martine - axv86c3u.default] user_pref("extensions.crossriderapp19962.lastcheckitem", 23031199); =>PUP.CrossRider
O69 - SBI: prefs.js [Martine - axv86c3u.default] user_pref("extensions.crossriderapp19962.statsDailyCounter", 9); =>PUP.CrossRider
O69 - SBI: prefs.js [Martine - axv86c3u.default] user_pref("extensions.crossriderapp4479.4479.InstallationTime", 1381603372); =>PUP.CrossRider
O69 - SBI: prefs.js [Martine - axv86c3u.default] user_pref("extensions.crossriderapp4479.4479.cookie.InstallationTime.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500"); =>PUP.CrossRider
O69 - SBI: prefs.js [Martine - axv86c3u.default] user_pref("extensions.crossriderapp4479.4479.cookie.InstallationTime.value", "1381603372"); =>PUP.CrossRider
O69 - SBI: prefs.js [Martine - axv86c3u.default] user_pref("extensions.crossriderapp4479.bic", "141adfa6ca099c163e57e3744a41137c"); =>PUP.CrossRider
O69 - SBI: prefs.js [Martine - axv86c3u.default] user_pref("extensions.crossriderapp4479.firstrun", false); =>PUP.CrossRider
O69 - SBI: prefs.js [Martine - axv86c3u.default] user_pref("extensions.crossriderapp4479.installationdate", 1381603372); =>PUP.CrossRider
O69 - SBI: prefs.js [Martine - axv86c3u.default] user_pref("extensions.crossriderapp4479.lastcheck", 23031168); =>PUP.CrossRider
O69 - SBI: prefs.js [Martine - axv86c3u.default] user_pref("extensions.crossriderapp4479.lastcheckitem", 23031199); =>PUP.CrossRider
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com
~ Keys: Scanned in 00mn 00s



---\\ Enum�re les fichiers Crack & Keygen (CKF) (O82)
C:\Users\Martine\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#crackle.com\settings.sol
C:\Users\Martine\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#crackle.com\settings.sol
~ Files: Scanned in 02mn 20s



---\\ Recherche particuli�re � la racine du syst�me (SPRF) (O84)
[MD5.F836F8F03E8D92339289629B6155A13B] [SPRF][2009-12-28] (...) -- C:\ProgramData\ezsidmv.dat [56]
[MD5.4944061495A29666114571167313DA42] [SPRF][2008-09-22] (...) -- C:\Users\Martine\AppData\Local\d3d8caps.dat [552]
[MD5.3E34BE968715862965BD325660259AE3] [SPRF][2013-02-19] (...) -- C:\Users\Martine\AppData\Local\d3d9caps.dat [1356]
[MD5.C4CA4238A0B923820DCC509A6F75849B] [SPRF][2008-04-28] (...) -- C:\Users\Martine\AppData\Local\gdia.dat [1]
[MD5.A282B74ADB7726C007DDE900E0B2E9E9] [SPRF][2008-04-28] (...) -- C:\Users\Martine\AppData\Local\gnome.dat [8]
[MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][2011-11-30] (...) -- C:\Users\Martine\AppData\Roaming\wklnhst.dat [0]
[MD5.AC799DA0E0E8789750D9219AFA698568] [SPRF][2013-04-08] (...) -- C:\Users\Martine\Desktop\a3gpset.exe [4676944]
[MD5.31E39E9FF261030F71C0209C016580F4] [SPRF][2013-10-12] (...) -- C:\Users\Martine\Desktop\adwcleaner.exe [1048960]
[MD5.749BCEB7D5A880E323B699199858FB71] [SPRF][2013-06-05] (.FileZilla Project - FileZilla FTP Client.) -- C:\Users\Martine\Desktop\FileZilla_3.7.0.2_win32-setup.exe [4808816]
[MD5.088812A121E0A9CEB40CE9C808C8A90C] [SPRF][2013-10-12] (.EFD Software - HD Tune Setup.) -- C:\Users\Martine\Desktop\hd-tune_hd_tune_2.55_anglais_12775.exe [642632]
[MD5.4CFB1526D8B8B3CD9B083E3C5DB10C50] [SPRF][2013-10-11] (.Pas de propri�taire - Configuration du PC.) -- C:\Users\Martine\Desktop\PCConfig.exe [2271542]
[MD5.7BDDC4BBD95F60ADCF3CB8597580BB76] [SPRF][2013-04-13] (...) -- C:\Users\Martine\Desktop\PDFT30.exe [271813029]
[MD5.666BD24BE5A29F1FF17D91CC280BD2EE] [SPRF][2013-10-12] (.Pas de propri�taire - Nettoyage des fichiers temporaires.) -- C:\Users\Martine\Desktop\SFTGC.exe [1064060]
[MD5.46E2D72A986DCEF5B2827311E3B5C2EC] [SPRF][2009-01-15] (.Kiwee - Installer Control.) -- C:\Windows\Downloaded Program Files\InstallerControl.dll [204800]
[MD5.22A276F8F08420E28E6A800914643D03] [SPRF][2007-06-10] (...) -- C:\Windows\Downloaded Program Files\QuickTimeInstaller(1).exe [573440]
[MD5.3535F8E1DA7CBE9491771C7C0C388646] [SPRF][2007-06-10] (...) -- C:\Windows\Downloaded Program Files\QuickTimeInstaller.exe [578728]
~ Files: 29 Legitimates Filtered in 00mn 17s



---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{F94C1880-CF7A-4E3C-9C4C-C7F29D462E78}" | In - Public - P6 - TRUE | .(.Pas de propri�taire - AIOC exe.) -- C:\Program Files\Dell AIO Printer 946\DLCIaiox.exe
O87 - FAEL: "{01C8495C-0500-46C8-B1F7-881E0D6B97E4}" | In - Public - P17 - TRUE | .(.Pas de propri�taire - AIOC exe.) -- C:\Program Files\Dell AIO Printer 946\DLCIaiox.exe
O87 - FAEL: "{A0468C9F-818B-4495-8DF1-6205115975A3}" | In - Public - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{05D53052-ED1C-4DE2-A676-BDEE4967BF39}" | In - Public - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{9F41EF19-5E8B-4F04-8B22-7474632FC982}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\dtUser.exe (.not file.) =>Adware.Bandoo
O87 - FAEL: "{15696DB8-9D34-4DF3-B36A-BDFBCEE1D538}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\dtUser.exe (.not file.) =>Adware.Bandoo
O87 - FAEL: "{3EBCFD3D-96C4-41A6-AA6A-39D4B6C78C4B}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{6B3055AB-D45F-4934-88FB-88326C6D00E1}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files\IncrediMail\Bin\IncMail.exe
O87 - FAEL: "{E26C70B6-7523-46F7-8421-52C8610BDDF2}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "{6D2B8E7B-1AC8-40D8-99A3-B94D2D02423E}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files\IncrediMail\Bin\ImApp.exe
O87 - FAEL: "{1C8256C5-0EDE-48D3-894F-F9485FE155EA}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{1CBD4B18-898E-4180-A07A-299161EA3A66}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{76AB0726-8141-4F28-9E4E-BC7A17FB9544}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{FD424BD0-818F-4C21-821C-3113C49CBEE3}" | In - Private - P6 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{AB10D55D-ABA5-4EB4-B3DA-792BD3284953}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{D7F39914-AA61-4039-B3A1-B668049E3870}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{3E4CE34E-50A3-470F-A82C-DA9673B93F89}" | In - Private - P17 - FALSE | .(.IncrediMail, Ltd. - IncrediMail Content Importer.) -- C:\Program Files\IncrediMail\Bin\ImpCnt.exe
O87 - FAEL: "{975A045C-E59F-4AFC-AB53-8019E5C3102D}" | In - Private - P6 - TRUE | .(.Pas de propri�taire - AIOC exe.) -- C:\Program Files\Dell AIO Printer 946\DLCIaiox.exe
O87 - FAEL: "{F83B1E73-244F-4074-965B-8C129FCFFC79}" | In - Private - P17 - TRUE | .(.Pas de propri�taire - AIOC exe.) -- C:\Program Files\Dell AIO Printer 946\DLCIaiox.exe
O87 - FAEL: "TCP Query User{6CA2B081-CEB7-4595-87E0-6CA00846F1BA}C:\users\martine\desktop\pcconfig.exe" | In - Private - P6 - TRUE | .(.Pas de propri�taire - Configuration du PC.) -- C:\users\martine\desktop\pcconfig.exe
O87 - FAEL: "UDP Query User{FF375289-EFD4-4E47-AD10-9B29CF6617A5}C:\users\martine\desktop\pcconfig.exe" | In - Private - P17 - TRUE | .(.Pas de propri�taire - Configuration du PC.) -- C:\users\martine\desktop\pcconfig.exe
O87 - FAEL: "{D95DDA3B-43A6-4B66-A410-8BE24BA16C9A}" |In - Private - P6 - TRUE | .(...) -- C:\Users\Martine\AppData\Local\iLivid\iLivid.exe (.not file.) =>Adware.Bandoo
O87 - FAEL: "{C9DC2430-3DBC-4481-B730-8097B58D4571}" |In - Private - P17 - TRUE | .(...) -- C:\Users\Martine\AppData\Local\iLivid\iLivid.exe (.not file.) =>Adware.Bandoo
~ Firewall: 247 Legitimates Filtered in 00mn 02s



---\\ Enum�re les codes produits des logiciels (PUC) (O90)
O90 - PUC: "0A70FDE3263018847A27DEE4663D80A4" . (.Barbie(R) idesign(TM) Ultimate Stylist(TM).) -- C:\Windows\Installer\{3EDF07A0-0362-4881-A772-ED4E66D3084A}\ARPPRODUCTICON.exe
O90 - PUC: "49C22FC2963140C4A9F54ACBD6195B80" . (.IncrediMail.) -- C:\Windows\Installer\{2CF22C94-1369-4C04-9A5F-A4BC6D91B508}\ARPPRODUCTICON.exe
~ Update Products: 64 Legitimates Filtered in 00mn 00s



---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.1961AC1D29439E2EC6C9DA552D3B4AFA] [WIS][2012-11-24] (.Gorilla Games - Barbie(R) idesign(TM) Ultimate Stylist(TM).) -- C:\Windows\Installer\69c93.msi [21746176]
[MD5.A10EB92BEB2DEC0B192380542D6E9171] [WIS][2013-01-23] (.IncrediMail - IncrediMail.) -- C:\Windows\Installer\92370a4.msi [2833408]
~ WIS: 65 Legitimates Filtered in 00mn 06s



---\\ Etat g�n�ral des services not Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Disabled 2013-05-10 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Disabled 2013-09-19 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Disabled 2011-10-24 55144 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 2006-12-08 537480 | (dlci_device) . (...) - C:\Windows\system32\dlcicoms.exe
SS - | Disabled 2010-06-22 30192 | (GoogleDesktopManager-051210-111108) . (.Google.) - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
SS - | Disabled 2010-03-17 135664 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Disabled 2010-03-17 135664 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Auto 2011-09-06 194104 | (gusvc) . (.Google.) - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Disabled 2004-10-22 73728 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
SS - | Demand 2011-11-13 821608 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SR - | Auto 2013-04-04 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
SR - | Auto 2013-04-04 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
SS - | Disabled 2011-10-18 166288 | (McShield) . (.McAfee, Inc..) - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
SR - | Auto 2011-10-18 160608 | (mfefire) . (.McAfee, Inc..) - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
SR - | Auto 2011-10-18 150856 | (mfevtp) . (.McAfee, Inc..) - C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
SS - | Demand 2013-09-10 118680 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Disabled 2011-08-24 430136 | (PMBDeviceInfoProvider) . (.Sony Corporation.) - C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
SR - | Auto 2013-09-20 84328 | (Registry Helper Service) . (.SafeApp Software, LLC.) - C:\Program Files\Registry Helper\RegistryHelperService.exe
SS - | Disabled 2013-02-28 161384 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe
SS - | Auto 2008-01-19 21504 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 2008-01-19 21504 | C:\Windows\system32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 07s



---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by Martine at 2013-10-15 17:23:38

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll sfsync02.sys storport.sys nvstor32.sys
C:\Windows\System32\drivers\sfsync02.sys Protection Technology StarForce Protection System
C:\Windows\system32\DRIVERS\nvstor32.sys NVIDIA Corporation NVIDIA nForce(TM) SATA Driver
1 ntkrnlpa!IofCallDriver[0x82077912] >> \Device\Harddisk0\DR0[0x86819A78]
kernel: MBR read successfully
user & kernel MBR OK
~ MBR: 15 Legitimates Filtered in 00mn 02s



---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Martine at 2013-10-15 17:23:40

********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 04s



---\\ Scan Additionnel (O88)
Database Version : 12948 - (2013-10-15)
Cl�s trouv�es (Keys found) : 19
Valeurs trouv�es (Values found) : 5
Dossiers trouv�s (Folders found) : 12
Fichiers trouv�s (Files found) : 4

[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Browsersafeguard] =>PUP.BrowserSafeguard^
[HKLM\Software\Classes\TypeLib\{495874fe-4a82-4ad1-9476-0b957e0b95eb}] =>Adware.AdMedia
[HKLM\Software\Classes\AppID\{87E8D7F8-7052-42a2-B48B-674C1F700A0B}] =>PUP.BearShare
[HKLM\Software\Classes\TypeLib\{87E8D7F8-7052-42a2-B48B-674C1F700A0B}] =>PUP.BearShare
[HKLM\Software\Classes\Interface\{ec1a2105-5621-440f-987d-27ef428131d9}] =>Adware.BHO
[HKLM\Software\Classes\AppID\BearShare.exe] =>PUP.BearShare
[HKCU\Software\iwin] =>Adware.iWinArcade
[HKLM\Software\iwin] =>Adware.iWinArcade
[HKLM\Software\VBMZ] =>Toolbar.Conduit
[HKCU\Software\Mixi.DJ] =>Toolbar.MixiDJ
[HKCU\Software\iWin.com Games] =>Adware.iWinArcade
[HKCU\Software\iWinArcade] =>Adware.iWinArcade
[HKLM\Software\iWinArcade] =>Adware.iWinArcade
[HKLM\Software\Classes\agcore.Text.JSON] =>Adware.BHO
[HKLM\Software\Classes\IncrediSpooler.DeltaSync] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\IncrediSpooler.DeltaSync.1] =>Toolbar.DeltaSearch
[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110111991162}] =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011441179}] =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110111991162}] =>PUP.CrossRider
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:iLivid =>Adware.Bandoo^
C:\Users\Martine\AppData\Roaming\Mozilla\Firefox\Profiles\axv86c3u.default\9518042e-7ad6-4dac-b377-056e28d00c8f@f1cc0a13-4df1-4d66-938f-088db8838882.com =>Adware.SolidSavings^
C:\Users\Martine\AppData\Roaming\Mozilla\Firefox\Profiles\axv86c3u.default\crossriderapp19962@crossrider.com =>PUP.RewardsArcade^
C:\Users\Martine\AppData\Roaming\Mozilla\Firefox\Profiles\axv86c3u.default\crossriderapp4479@crossrider.com =>Adware.VidSaver^
C:\Users\Martine\AppData\Roaming\Mozilla\Firefox\Profiles\axv86c3u.default\{3112ca9c-de6d-4884-a869-9855de68056c} =>Toolbar.Google^
C:\Program Files\BearShareTb =>PUP.BearShare^
C:\ProgramData\iWin Games =>Adware.FunWebProducts)^
C:\Users\Martine\AppData\Roaming\WhiteSmoke =>PUP.WhiteSmoke^
C:\Program Files\iWin.com =>Adware.iWinArcade
C:\Program Files\iWin.com Games =>Adware.iWinArcade
C:\ProgramData\{9CD61942-8DA1-4781-925C-4FE1471E0820} =>Toolbar.Conduit
C:\Users\Martine\AppData\Local\Google\Chrome\User Data\Default\Extensions\dloejdefkancmfajekobpfoacecnhpgp =>Adware.Bandoo
C:\Users\Martine\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbffombmdffoemfimpemoaaplncjdgfm =>Toolbar.IncrediMail
C:\Windows\Tasks\PC Medkit.job =>Adware.iHaveNet^
[HKCU\Software\BearShare] =>PUP.BearShare^
[HKCU\Software\WhiteSmoke] =>PUP.WhiteSmoke^
[HKLM\Software\WhiteSmoke] =>PUP.WhiteSmoke^
~ Additionnel Scan: 365904 Items scanned in 00mn 41s



---\\ R�capitulatif des d�tections trouv�es sur votre station
~ http://nicolascoolman.webs.com/apps/blog/show/27852918-adware-solidsavings =>Adware.SolidSavings
~ http://nicolascoolman.webs.com/apps/blog/show/28000037-pup-rewardsarcade =>PUP.RewardsArcade
~ http://nicolascoolman.webs.com/apps/blog/show/27557062-adware-vidsaver =>Adware.VidSaver
~ http://nicolascoolman.webs.com/apps/blog/show/32384220-toolbar-google =>Toolbar.Google
~ http://nicolascoolman.webs.com/apps/blog/show/26705717-pup-bearshare =>PUP.BearShare
~ http://nicolascoolman.webs.com/apps/blog/show/26611092-adware-bandoo =>Adware.Bandoo
~ http://nicolascoolman.webs.com/apps/blog/show/32799788-pup-browsersafeguard =>PUP.BrowserSafeguard
~ http://nicolascoolman.webs.com/apps/blog/show/27636417-pup-whitesmoke =>PUP.WhiteSmoke
~ http://nicolascoolman.webs.com/apps/blog/show/27583526-pup-crossrider =>PUP.CrossRider
~ http://nicolascoolman.webs.com/apps/blog/show/28766471-adware-iwinarcade =>Adware.iWinArcade
~ http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit
~ http://nicolascoolman.webs.com/apps/blog/show/27875657-toolbar-deltasearch =>Toolbar.DeltaSearch
~ MSI: 12 link(s) detected in 00mn 41s



~ 2765 Legitimates filtered by white list
End of the scan (791 lines in 27mn 12s)(2)

Publicité


Signaler le contenu de ce document

Publicité