cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

~ Rapport de ZHPDiag v2014.2.14.14 - Nicolas Coolman (2014-02-14)
~ Lancé par ghislain (2014-02-16 18:41:11)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by program


---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.16518
MFIE: Mozilla Firefox 27.0 (Defaut)
GCIE: Google Chrome v32.0.1700.107
OBIE: Pale Moon 24.2.2 v24.2.2
OBIE: Safari v5.34.57.2

---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_COA_NSLP channel
Windows ID Activation : OK
~ Windows Partial Key : J9HK3
Windows License : OK
~ Windows Remaining Initializations Number : 4
Software Protection Service (Protection logicielle) : OK
Key Management Service client information : KO
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ Logiciels de protection du système
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft Security Client v4.4.0304.0
Windows Defender W7

---\\ Logiciels d'optimisation du système

---\\ Logiciels de partage PeerToPeer
eMule

---\\ Surveillance de Logiciels
Adobe Flash Player 12 Plugin
Adobe Reader XI
Java 7 Update 51
Java 7 Update 25

---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 26 Stepping 5, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 12279 MB (79% free)
System Restore: Activé (Enable)
System drive C: has 439 GB (47%) free of 917 GB

---\\ Mode de connexion au système
~ Computer Name: GHISLAIN-PC
~ User Name: ghislain
~ All Users Names: HomeGroupUser$, GuestUser, ghislain, ASPNET, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\ghislain\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\ghislain\AppData\Roaming\
~ %Desktop% : C:\Users\ghislain\Desktop\
~ %Favorites% : C:\Users\ghislain\Contacts\Favorites\
~ %LocalAppData% : C:\Users\ghislain\AppData\Local\
~ %StartMenu% : C:\Users\ghislain\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 439 Go of 917 Go)
D: CD-ROM drive (Not Inserted)
E: CD-ROM drive (Not Inserted)
F: Hard drive, Flash drive, Thumb drive (Free 1994 Go of 2794 Go)
K: Hard drive, Flash drive, Thumb drive (Free 101 Go of 466 Go)



---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 44 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.2011-02-25 - 01:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.2009-07-13 - 20:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.263B6E451526A90FF8B1CEC759F22956] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.2014-02-06 - 04:24:52.) -- C:\Windows\System32\wininet.dll [2334208]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.2010-11-20 - 08:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.2010-11-20 - 08:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.2013-09-27 - 20:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.2009-07-13 - 20:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.2009-07-13 - 18:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.2010-11-20 - 04:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.2010-11-20 - 04:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.2010-11-20 - 05:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.2009-07-13 - 18:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.2009-07-13 - 19:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.2011-04-26 - 21:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.2010-11-20 - 04:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.2013-04-12 - 09:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.2009-07-13 - 19:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.2010-11-20 - 05:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.2009-07-13 - 19:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.2010-11-20 - 04:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.2010-11-20 - 08:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 4/17211
~ Mes musiques (My Musics) : 4/6452
~ Mes Videos (My Videos) : 2/333
~ Mes Favoris (My Favorites) : 1/18
~ Mes Documents (My Documents) : 3/15032
~ Mon Bureau (My Desktop) : 2/739
~ Menu demarrer (Programs) : 1/222
~ Hidden Files: Scanned in 00mn 44s



---\\ Processus lancés
[MD5.CAA0C16ADCCE6142A43AD83BFA20B38B] - (.Motorola Mobility LLC - MotoHelperAgent.) -- C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe [698680] [PID.3284]
[MD5.E8592697D55B515379F781FAF199C73A] - (.Pelmorex Media Inc. - Pas de description.) -- C:\Users\ghislain\AppData\Local\MétéoMédia\weathereye.exe [310920] [PID.4600]
[MD5.EF6B3E18CCEB5577C5700EBFD975C61D] - (.Saitek - Manual Configuration.) -- C:\Program Files (x86)\Saitek\Software\Profiler.exe [159744] [PID.4692]
[MD5.3CA66EE8DC0377A80032C7039DA06282] - (.Saitek - Smart Button Special Sauce.) -- C:\Program Files (x86)\Saitek\Software\SaiSmart.exe [98304] [PID.4724]
[MD5.A4F2C2A3885670F5836B5C383588D62E] - (.Saitek - MFD File System Driver.) -- C:\Program Files (x86)\Saitek\Software\SaiMfd.exe [135168] [PID.4796]
[MD5.B5C774CFA944AF3E9A42B592B476F570] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8337920] [PID.4968]
[MD5.B362181ED3771DC03B4141927C80F801] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65432] [PID.2088]
[MD5.30E3850F303EAE5C364782EA78579CC9] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [55624] [PID.2132]
[MD5.C752A6902163B5E9C3554BA69A275F41] - (...) -- C:\Program Files (x86)\Roxio\BackOnTrack\App\BService.exe [21488] [PID.2200]
[MD5.1355EBE184F9DAB1718BC587F8A7E05E] - (.MAGIX AG - Verzeichnisüberwachung und Hilfsaufgaben fü.) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376] [PID.2244]
[MD5.876D29312C0A297EEE28F3DA30A994E8] - (.Garmin Ltd or its subsidiaries - Garmin Core Update Service.) -- C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [250712] [PID.2392]
[MD5.C98ACDE22458C8F46FD0503CB9E2D01F] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler.exe [223112] [PID.2816]
[MD5.11F714F85530A2BD134074DC30E99FCA] - (.Microsoft Corporation - Machine Debug Manager.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.exe [322120] [PID.1884]
[MD5.7ED3A9C3763725BD700946971215EE77] - (.Motorola Mobility LLC - MotoHelper Service.) -- C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [137528] [PID.3140]
[MD5.543A4EF0923BF70D126625B034EF25AF] - (.Protexis Inc. - PsiService PsiService.) -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe [189728] [PID.3200]
[MD5.EA735BF6DF13A857A83C99BF27A422AD] - (.Motorola - ForwardDemon.) -- C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [65657] [PID.3304]
[MD5.A0FF419B61AE47E26ADF3BB15DB4F2FE] - (...) -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [38608] [PID.3344]
[MD5.E59AFB64C2F6E0C99350E1C944C75088] - (.Nero AG - NeroUpdate.) -- C:\Program Files (x86)\Nero\Update\NASvc.exe [762192] [PID.3516]
~ Processes Running: Scanned in 00mn 02s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\ghislain\AppData\Local\Google\Chrome\User Data\Default\Preferences
~ Google Browser: 0 Legitimates Filtered in 00mn 00s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\ghislain\AppData\Roaming\Mozilla\Firefox\Profiles\01rn421q.default\prefs.js
C:\Users\ghislain\AppData\Roaming\Mozilla\Firefox\Profiles\1myiu6b6.default\prefs.js
M0 - MFSP: prefs.js [ghislain - 1myiu6b6.default] http://fr.canoe.ca
M2 - MFEP: prefs.js [ghislain - 01rn421q.default\57ffxtbr@MarineAquarium3Free_57.com] [] Marine Aquarium Lite v2.50.0.52860 (..) =>Adware.MarineAquarium
M2 - MFEP: prefs.js [ghislain - 1myiu6b6.default\50ef75d8544f0@50ef75d854529.com] [] continuetosave v3.9 (..) =>PUP.OfferWare
M2 - MFEP: prefs.js [ghislain - 1myiu6b6.default\support@websteroidsapp.com] [] Websteroids v2.6.5367042 (..) =>PUP.TubeDimmer
P2 - FPN: [HKLM] [@microsoft.com/VirtualEarth3D,version=4.0] - (...) -- (.not file.)
~ Firefox Browser: 14 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.canoe.ca
R0 - HKCU\SOFTWARE\Classes\Software\Microsoft\Internet Explorer\Main,Start Page = http://allssearch.com =>Adware.SocialSkinz
R3 - URLSearchHook: (no name) [64Bits] - {167d9323-f7cc-48f5-948a-6f012831a69f} . (...) (No version) -- (.not file.)
R3 - URLSearchHook: (no name) [64Bits] - {ef79f67a-6ad7-4715-a0f8-932fca442023} . (...) (No version) -- (.not file.)
R3 - URLSearchHook: (no name) [64Bits] - {327f75ed-061b-4339-8cc6-5dd45ad1396d} . (...) (No version) -- (.not file.)
~ IE Browser: 25 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.*.*;*.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 93



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{167D9323-F7CC-48F5-948A-6F012831A69F} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{EF79F67A-6AD7-4715-A0F8-932FCA442023} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{07189B84-B33B-4A1E-9B32-AD203C983C20} Clé orpheline
~ Toolbar: Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Assassin's Creed IV - Black Flag.lnk . (...) -- F:\game\Assassin's Creed IV - Black Flag\GameUpdater.exe
O4 - GS\Desktop [Public]: Call of Duty - Ghosts.lnk . (.Activision - Call of Duty: Ghosts.) -- C:\games\Call of Duty - Ghosts\iw6sp64_ship.exe
O4 - GS\Desktop [Public]: MP3 Rocket 6.4.6.lnk . (...) -- C:\Program Files (x86)\MP3 Rocket\MP3Rocket.exe
O4 - GS\Desktop [Public]: Prepar3D v2.lnk . (.Lockheed Martin® - Prepar3D exe.) -- C:\Program Files (x86)\Lockheed Martin\Prepar3D v2\Prepar3D.exe
O4 - GS\Desktop [Public]: QuickBooks SuccèsPME.lnk . (.Intuit Canada, a General Partnership - QuickBooks Application.) -- C:\Program Files (x86)\Intuit\QuickBooks 2009\QBW32Simplestart.exe
O4 - GS\Desktop [Public]: Saitek Smart Technology Programming Software.lnk . (.Saitek - Profile Editor.) -- C:\Program Files (x86)\Saitek\Software\Profile.exe
O4 - GS\Program [Public]: Bluetooth Problem Report.lnk . (...) -- C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BtwProblemReport.exe (.not file.)
O4 - GS\Program [Public]: F1 2013.lnk . (.Codemasters - F1 2013 Executable.) -- F:\game\F1 2013\F1_2013.exe
O4 - GS\Program [Public]: IP Camera Viewer 1.2.lnk . (.DeskShare - IPCameraViewer.) -- C:\Program Files (x86)\Deskshare\IP Camera Viewer 1.0\IP Camera Viewer.exe
O4 - GS\Program [Public]: LabelCreator Pro.lnk . (.LabelWhiz of MN, Inc. - Pas de description.) -- C:\Program Files (x86)\LabelCreator Pro\LabelCreatorPro.exe
O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Program [Public]: Pale Moon.lnk . (.Moonchild Productions - Pale Moon web browser.) -- C:\Program Files (x86)\Pale Moon\palemoon.exe
O4 - GS\Program [Public]: Safari.lnk . (...) -- C:\Windows\Installer\{C779648B-410E-4BBA-B75B-5815BCEFE71D}\SafariIco.exe
O4 - GS\Program [Public]: Serif AlbumPlus Organizer Starter Edition.lnk . (...) -- C:\Windows\Installer\{A0765939-76F5-48D8-82B1-8D0BBFAD0702}\AlbumPlus.ico
O4 - GS\Program [Public]: Serif PhotoPlus Starter Edition.lnk . (...) -- C:\Windows\Installer\{A0765939-76F5-48D8-82B1-8D0BBFAD0702}\PhotoPlus.ico
O4 - GS\Program [Public]: Webplayer.lnk . (...) -- C:\Program Files (x86)\Webplayer\Webplayer.exe (.not file.) =>Adware.SocialSkinz
O4 - GS\QuickLaunch [GuestUser]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [GuestUser]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [GuestUser]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\TaskBar [GuestUser]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Program [GuestUser]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [GuestUser]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [GuestUser]: ATR Configuration Manager.lnk . (.Flight One Software - Pas de description.) -- C:\Program Files (x86)\Microsoft Games\Flight Simulator 9\Aircraft\Flight 1 ATR-72-500\ATR_Config_Manager.exe
O4 - GS\QuickLaunch [ghislain]: Apple Safari.lnk . (...) -- C:\Windows\Installer\{C779648B-410E-4BBA-B75B-5815BCEFE71D}\SafariIco.exe
O4 - GS\QuickLaunch [ghislain]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [ghislain]: ImageConverter Plus.lnk . (.fCoder Group, Inc. - ImageConverter Plus.) -- C:\Program Files (x86)\ImageConverter Plus\icp.exe
O4 - GS\QuickLaunch [ghislain]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch [ghislain]: MAGIX Photo Manager 10.lnk . (.MAGIX - MAGIX Foto Manager 10 deluxe.) -- C:\Program Files (x86)\MAGIX\Photo_Manager_10\FotoManager_dlx.exe
O4 - GS\QuickLaunch [ghislain]: Marine Aquarium Lite.lnk . (.SereneScreen - MarineAquariumFree.) -- C:\Windows\System32\MarineAquariumLite.scr =>Adware.MarineAquarium
O4 - GS\QuickLaunch [ghislain]: MP3 Rocket 6.4.6.lnk . (...) -- C:\Program Files (x86)\MP3 Rocket\MP3Rocket.exe
O4 - GS\QuickLaunch [ghislain]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Users\ghislain\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\TaskBar [ghislain]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\TaskBar [ghislain]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\TaskBar [ghislain]: Pale Moon.lnk . (.Moonchild Productions - Pale Moon web browser.) -- C:\Program Files\Pale Moon\palemoon.exe
O4 - GS\TaskBar [ghislain]: Roxio Creator 2012 Pro.lnk . (...) -- C:\Program Files (x86)\Roxio 2012\Roxio Central\RoxioCentralFx.exe
O4 - GS\TaskBar [ghislain]: Safari.lnk . (...) -- C:\Windows\Installer\{C779648B-410E-4BBA-B75B-5815BCEFE71D}\SafariIco.exe
O4 - GS\Program [ghislain]: Canoe.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://fr.canoe.ca =>Hijacker.Browsers
O4 - GS\Program [ghislain]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Program [ghislain]: MegaDébrideur Download Manager.lnk . (.Microsoft Corporation - Microsoft Silverlight Out-of-Browser Launch.) -- C:\Program Files (x86)\Microsoft Silverlight\sllauncher.exe
O4 - GS\SystemTools [ghislain]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [ghislain]: 4 Elements.exe - Raccourci.lnk . (...) -- C:\Program Files (x86)\4.Elements.II.Collector's.Edition.v1.0.Cracked-F4CG\4.Elements.II.Collector's.Edition.v1.0.Cracked-F4CG\4 Elements.exe
O4 - GS\Desktop [ghislain]: Bébé Éliot - Raccourci.lnk . (...) -- C:\Users\ghislain\Pictures\Bébé Éliot
O4 - GS\Desktop [ghislain]: C.I.P..lnk . (.CyberAvia - CyberAvia Interface Pilote.) -- C:\CYBERAVIA\CIP.exe
O4 - GS\Desktop [ghislain]: fsx.exe - Raccourci.lnk . (.Microsoft Corp. - Microsoft Flight Simulator®.) -- C:\Program Files (x86)\Microsoft Games\Microsoft Flight Simulator X\fsx.exe
O4 - GS\Desktop [ghislain]: Poker - Espacejeux.lnk . (...) -- C:\Program Files (x86)\Poker - Espacejeux\poker.exe
O4 - GS\Desktop [ghislain]: Puerto vallarta 2014.lnk . (...) -- C:\Users\ghislain\Pictures\Puerto vallarta 2014
O4 - GS\Desktop [ghislain]: RM.exe - Raccourci.lnk . (.www.moofdev.net - Ratio Master.) -- C:\ratio master\RM.exe
O4 - GS\Desktop [ghislain]: Tower Simulator v1.lnk . (...) -- C:\Program Files\Tower Simulator v1\Tower.exe
~ Global Startup: 120 Legitimates Filtered in 00mn 04s



---\\ Applications lancées au démarrage du sytème (O4)
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- C:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =>.Realtek Semiconductor Corp
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKCU\..\Run: [AdobeBridge] Clé orpheline
O4 - HKCU\..\Run: [WeatherEye] . (.Pelmorex Media Inc. - Pas de description.) -- C:\Users\ghislain\AppData\Local\MétéoMédia\WeatherEye.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [Profiler] . (.Saitek - Manual Configuration.) -- C:\Program Files (x86)\Saitek\Software\Profiler.exe
O4 - HKLM\..\Wow6432Node\Run: [SaiSmart] . (.Saitek - Smart Button Special Sauce.) -- C:\Program Files (x86)\Saitek\Software\SaiSmart.exe
O4 - HKLM\..\Wow6432Node\Run: [SaiMfd] . (.Saitek - MFD File System Driver.) -- C:\Program Files (x86)\Saitek\Software\SaiMfd.exe
O4 - HKUS\.DEFAULT\..\Run: [SearchProtect] Clé orpheline =>Toolbar.Conduit
O4 - HKUS\S-1-5-18\..\Run: [SearchProtect] Clé orpheline =>Toolbar.Conduit
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-1409875168-3970991592-3381297945-1001\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-1409875168-3970991592-3381297945-1001\..\Run: [AdobeBridge] Clé orpheline
O4 - HKUS\S-1-5-21-1409875168-3970991592-3381297945-1001\..\Run: [WeatherEye] . (.Pelmorex Media Inc. - Pas de description.) -- C:\Users\ghislain\AppData\Local\MétéoMédia\WeatherEye.exe
~ Application: Scanned in 00mn 00s



---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Se&nd to OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} -- C:\Program Files (x86)\MICROS~4\Office14\ONBttnIE.dll (.not file.)
O9 - Extra button: OneNote Lin&ked Notes [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} -- C:\Program Files (x86)\MICROS~4\Office14\ONBTTN~1.dll (.not file.)
O9 - Extra button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 [64Bits] - {CCA281CA-C863-46ef-9331-5C8D4460577F} . (...) -- C:\Program Files\WIDCOMM\Bluetooth Software\bt_hot_icon.ico
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{54B07495-146F-4731-8C08-153087470684}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{54B07495-146F-4731-8C08-153087470684}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{54B07495-146F-4731-8C08-153087470684}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation
O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: LBTWlgn . (.Logitech, Inc. - Logitech Bluetooth Service.) -- c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
~ Winlogon: Scanned in 00mn 00s



---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: BOT4Service (BOT4Service) . (...) - C:\Program Files (x86)\Roxio\BackOnTrack\App\BService.exe
O23 - Service: KMService (KMService) . (...) - C:\Windows\SysWOW64\srvany.exe =>Hijacker.Office
O23 - Service: SessionLauncher (SessionLauncher) . (...) - C:\Users\ghislain\AppData\Local\Temp\DX9\SessionLauncher.exe (.not file.)
O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
~ Services: 18 Legitimates Filtered in 00mn 03s



---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At25.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At26.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At27.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At28.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At29.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At30.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At31.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At32.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At33.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At34.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At35.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At36.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At37.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At38.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At39.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At40.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At41.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At42.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At43.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At44.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At45.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At46.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At47.job [340]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\At48.job [340]
[MD5.00000000000000000000000000000000] [APT] [At25] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At26] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At27] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At28] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At29] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At30] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At31] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At32] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At33] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At34] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At35] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At36] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At37] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At38] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At39] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At40] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At41] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At42] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At43] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At44] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At45] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At46] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At47] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [At48] (...) -- C:\ProgramData\6I1x32i6.exe_ (.not file.) [0]
[MD5.B6037110B175707A353B12C814D34968] [APT] [Motorola Device Manager Engine] (...) -- C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [196920]
[MD5.B6037110B175707A353B12C814D34968] [APT] [Motorola Device Manager Initial Update] (...) -- C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [196920]
[MD5.B6037110B175707A353B12C814D34968] [APT] [Motorola Device Manager Update] (...) -- C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [196920]
[MD5.00000000000000000000000000000000] [APT] [wp_update] (...) -- C:\Users\ghislain\AppData\Roaming\~riecymq.exe (.not file.) [0] =>PUP.WpManager
[MD5.CAA5E2B9030007FB7EFA74E5211FBBAA] [APT] [ZOTAC FireStorm] (...) -- C:\Program Files (x86)\ZOTAC FireStorm\FireStorm.exe [4741120]
[MD5.00000000000000000000000000000000] [APT] [{21ABCACB-CF6E-4D88-A81E-5F4D06D5FB96}] (...) -- C:\Program Files (x86)\Google\Picasa3\Picasa3.exe (.not file.) [0]
[MD5.99A1D140BAB36CD3B40E61E7CBF9922D] [APT] [{44B9D117-9675-4718-969C-C291AB15525D}] (...) -- C:\Eufloria\Eufloria.exe [108429864]
[MD5.00000000000000000000000000000000] [APT] [{4CAF5C6D-CDAD-4965-BF0A-1F0C4427744E}] (...) -- C:\Users\ghislain\Downloads\lightroom 3.5\Install Lightroom 3.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{5B70C6DD-0312-400B-A2CB-41DD67DE274B}] (...) -- D:\setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{7AAB75EB-2DF1-4196-981C-76A7EE41A531}] (...) -- C:\Torrent\The.Testament.of.Sherlock.Holmes.v1.0.0.2.Update-SKIDROW\sr-ttpsh1002\setup_1.00.2.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{7E9F8C12-1F1B-407B-ADA2-A0B6E1D98EF0}] (...) -- D:\install.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{7EC363FD-9902-4399-A750-68428E129E53}] (...) -- C:\Program Files (x86)\Google\Picasa3\Picasa3.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{8AC27744-D7AF-40A4-8BAB-93A34550EA48}] (...) -- I:\OriginInstaller.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{A46028D8-F845-46ED-8CDB-04F0201835DB}] (...) -- C:\Downloads\VirtualDJSDM.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{A71C68F3-E1D0-44D5-A883-11B0FBF6C82D}] (...) -- C:\Downloads\Saitek_X52_Flight_Controller_SD6_64.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{B0688358-139A-4145-AB44-D8D9C0C48552}] (...) -- D:\Setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{E00B4CDA-B2D0-446B-98D7-BD8260BC8ECB}] (...) -- C:\Logiciel\Tower simulator\TowerSim_v12.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{E2725135-7D1C-4FCF-8DA5-FE51E232B7F6}] (...) -- D:\SETUP.exe (.not file.) [0]
~ Scheduled Task: 89 Legitimates Filtered in 00mn 10s



---\\ Pilotes lancés au démarrage du système (O41)
O41 - Driver: (nvport) . (. - .) - C:\Windows\system32\Drivers\nvport.sys (.not file.)
~ Drivers: 81 Legitimates Filtered in 00mn 00s



---\\ Logiciels installés (O42)
O42 - Logiciel: ContinueToSave - (.CloudSoft.) [HKLM][64Bits] -- ContinueToSave =>PUP.OfferWare
O42 - Logiciel: CyberAvia Interface Pilote - (...) [HKCU][64Bits] -- CyberAvia Interface Pilote
O42 - Logiciel: F1 2013 - (...) [HKLM][64Bits] -- RjEyMDEz_is1
O42 - Logiciel: FileParade bundle uninstaller - (.FileParade.) [HKLM][64Bits] -- FileParade bundle uninstaller
O42 - Logiciel: Free 3D Christmas Screensaver 1.0 - (...) [HKLM][64Bits] -- Free 3D Christmas Screensaver_is1
O42 - Logiciel: Free 3D Valley Screensaver 1.0 - (...) [HKLM][64Bits] -- Free 3D Valley Screensaver_is1
O42 - Logiciel: GPS TrackMaker - (.Geo Studio Technology Ltd.) [HKLM][64Bits] -- {1FEE9698-33D4-4633-B7BA-7368C87E49AA}
O42 - Logiciel: ICP 9.0 - (...) [HKLM][64Bits] -- ICP install2_is1
O42 - Logiciel: Lotto Pro - (.Data Solutions.) [HKLM][64Bits] -- Lotto Pro
O42 - Logiciel: MP3 Rocket - (.MP3 Rocket Inc.) [HKLM][64Bits] -- MP3 Rocket
O42 - Logiciel: NoDupe 64-bit (v1.16.8.2) - (.OTIS Soft.) [HKLM][64Bits] -- {C38C0BF4-586B-4D57-B08C-AB1571F01674}
O42 - Logiciel: Poker - Espacejeux - (...) [HKLM][64Bits] -- Poker - Espacejeux
O42 - Logiciel: QuickBooks SuccèsPME - (...) [HKLM][64Bits] -- {111EBC34-F370-4d78-AD0A-FB04B62E89D3}
O42 - Logiciel: Rocketfish Bluetooth Combo - (.RocketFish.) [HKLM][64Bits] -- {8C099AC0-189B-4413-AC25-AC461A172223}
O42 - Logiciel: Roger Wilco - (...) [HKLM][64Bits] -- Roger Wilco
O42 - Logiciel: SearchExpress.B Toolbar for IE - (.SearchExpress.B.) [HKLM][64Bits] -- IECT3281621
O42 - Logiciel: Tilt Wheel Driver V1.1 20110217 - (...) [HKLM][64Bits] -- Tilt_Wheel
O42 - Logiciel: Tower Simulator - (...) [HKCU][64Bits] -- Tower Simulator
O42 - Logiciel: Vafmusic2 Toolbar for IE - (.Vafmusic2.) [HKLM][64Bits] -- IECT3316528 =>Toolbar.Vafmusic
O42 - Logiciel: Webplayer - (.Kreapixel.) [HKLM][64Bits] -- {F750DB0E-D452-3108-63C9-FE16BC686741} =>Adware.SocialSkinz
O42 - Logiciel: Wilco Fleet : A380 - (...) [HKLM][64Bits] -- Wilco Fleet : A380
O42 - Logiciel: continuetosave - (.continue to save.) [HKLM][64Bits] -- {C1C6816E-CBB3-A748-85F9-A8B47B68985B} =>PUP.OfferWare
O42 - Logiciel: melondrea - (.melondrea.) [HKLM][64Bits] -- melondrea
O42 - Logiciel: oPlayer - (.object.) [HKLM][64Bits] -- {AA1B7F27-A49D-4D7F-9755-570AF5597160}
O42 - Logiciel: voip platform - (...) [HKLM][64Bits] -- {DBAE4A41-8CBC-4964-BBC2-0A558FC01690}
~ Logic: 53 Legitimates Filtered in 00mn 01s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\2K75]
[HKCU\Software\3DSavers]
[HKCU\Software\Casino]
[HKCU\Software\CyberAvia]
[HKCU\Software\Data Solutions]
[HKCU\Software\HCW]
[HKCU\Software\MiniGet]
[HKCU\Software\OTIS Soft]
[HKCU\Software\Protector]
[HKCU\Software\RHR Technologies]
[HKCU\Software\SilentBob]
[HKCU\Software\Titan Casino]
[HKLM\Software\OTIS Soft]
[HKLM\Software\Wow6432Node\Better Surf Plus]
[HKLM\Software\Wow6432Node\Better-Surf] =>PUP.BetterSurf
[HKLM\Software\Wow6432Node\BetterSurf] =>PUP.BetterSurf
[HKLM\Software\Wow6432Node\CyberAvia]
[HKLM\Software\Wow6432Node\Florenc]
[HKLM\Software\Wow6432Node\MarineAquarium3Free_57] =>Adware.MarineAquarium
[HKLM\Software\Wow6432Node\MediaPlayerV1]
[HKLM\Software\Wow6432Node\RadioRage_4jEI]
[HKLM\Software\Wow6432Node\RocketFish]
[HKLM\Software\Wow6432Node\SD EnterNET]
[HKLM\Software\Wow6432Node\VBMZ] =>PUP.Duuqu
[HKLM\Software\Wow6432Node\voip]
~ Key Software: 818 Legitimates Filtered in 00mn 01s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 2011-08-02 - 22:37:59 - [237,765] ----D C:\Program Files (x86)\4.Elements.II.Collector's.Edition.v1.0.Cracked-F4CG
O43 - CFD: 2012-05-22 - 22:13:59 - [0,360] ----D C:\Program Files (x86)\DNA
O43 - CFD: 2013-02-18 - 13:38:14 - [109,080] ----D C:\Program Files (x86)\Eufloria
O43 - CFD: 2011-11-09 - 18:48:00 - [28,125] ----D C:\Program Files (x86)\Every Day Genius Square Logic
O43 - CFD: 2011-12-05 - 19:18:04 - [0,651] ----D C:\Program Files (x86)\Free 3D Christmas Screensaver
O43 - CFD: 2011-12-05 - 19:24:03 - [0,651] ----D C:\Program Files (x86)\Free 3D Valley Screensaver
O43 - CFD: 2012-10-16 - 13:32:15 - [252,859] ----D C:\Program Files (x86)\Google ori
O43 - CFD: 2011-11-09 - 14:12:11 - [74,715] ----D C:\Program Files (x86)\ImageConverter Plus
O43 - CFD: 2014-02-09 - 12:56:04 - [599,647] ----D C:\Program Files (x86)\Le Mystere de la Momie Demo
O43 - CFD: 2012-11-18 - 09:43:47 - [1,133] ----D C:\Program Files (x86)\MarineAquarium3Free_57 =>Adware.MarineAquarium
O43 - CFD: 2014-02-16 - 18:33:26 - [0] ----D C:\Program Files (x86)\MediaPlayerV1
O43 - CFD: 2014-02-13 - 11:32:38 - [0,089] ----D C:\Program Files (x86)\MiniGet
O43 - CFD: 2014-02-12 - 09:22:49 - [47,186] ----D C:\Program Files (x86)\MP3 Rocket
O43 - CFD: 2012-03-14 - 19:40:52 - [0,072] ----D C:\Program Files (x86)\Mystère a Londres
O43 - CFD: 2012-05-14 - 15:18:32 - [0,016] ----D C:\Program Files (x86)\OrgBusiness
O43 - CFD: 2013-11-24 - 08:05:47 - [17,156] ----D C:\Program Files (x86)\Poker - Espacejeux
O43 - CFD: 2013-09-04 - 13:50:25 - [0,024] ----D C:\Program Files (x86)\Protected
O43 - CFD: 2014-02-13 - 15:44:42 - [1,071] ----D C:\Program Files (x86)\Roger Wilco
O43 - CFD: 2013-10-15 - 21:02:51 - [0,528] ----D C:\Program Files (x86)\SoftQuick =>Hijacker.SoftQuick
O43 - CFD: 2013-06-01 - 09:19:37 - [0,567] ----D C:\Program Files (x86)\Tilt_Wheel
O43 - CFD: 2012-12-05 - 20:42:06 - [116,177] ----D C:\Program Files (x86)\TrackMaker
O43 - CFD: 2013-03-27 - 10:59:07 - [1030,830] ----D C:\Program Files (x86)\Transport Giant
O43 - CFD: 2013-09-04 - 13:50:25 - [0,024] ----D C:\Program Files (x86)\Tuvaro_1.1 =>Toolbar.Tuvaro
O43 - CFD: 2012-12-14 - 14:24:00 - [8,252] ----D C:\Program Files (x86)\voip
O43 - CFD: 2011-11-24 - 13:10:31 - [4,974] ----D C:\Program Files (x86)\Windows Lotto Pro 2000
O43 - CFD: 2013-12-09 - 11:35:45 - [0,001] ----D C:\ProgramData\Gamerizon
O43 - CFD: 2013-01-10 - 20:57:54 - [2,771] ----D C:\ProgramData\InstallMate =>PUP.Tarma
O43 - CFD: 2013-05-16 - 20:28:26 - [0] ----D C:\ProgramData\STORE
O43 - CFD: 2014-02-16 - 18:35:19 - [1,225] ----D C:\ProgramData\Updater =>PUP.CrossRider
O43 - CFD: 2011-11-21 - 14:09:41 - [5,012] ----D C:\Users\ghislain\AppData\Roaming\Data Solutions
O43 - CFD: 2012-11-18 - 09:45:19 - [0,001] ----D C:\Users\ghislain\AppData\Roaming\Marine Aquarium Lite
O43 - CFD: 2014-02-13 - 11:32:17 - [0,004] ----D C:\Users\ghislain\AppData\Roaming\MiniGet
O43 - CFD: 2014-02-12 - 09:22:49 - [4,116] ----D C:\Users\ghislain\AppData\Roaming\MP3Rocket
O43 - CFD: 2011-11-08 - 23:32:59 - [0,001] ----D C:\Users\ghislain\AppData\Roaming\RCP 6
O43 - CFD: 2013-08-08 - 16:14:58 - [0] ----D C:\Users\ghislain\AppData\Roaming\Search tool
O43 - CFD: 2011-11-09 - 19:13:28 - [0,312] ----D C:\Users\ghislain\AppData\Roaming\SquareLogic
O43 - CFD: 2014-02-16 - 17:07:39 - [0] ----D C:\Users\ghislain\AppData\Roaming\wp_update =>PUP.WpManager
O43 - CFD: 2012-10-29 - 09:56:36 - [0,001] --H-D C:\Users\ghislain\AppData\Local\6MdA1RCIG90J
O43 - CFD: 2012-10-29 - 09:56:36 - [0,001] --H-D C:\Users\ghislain\AppData\Local\8HfvVsXDUm
O43 - CFD: 2012-05-22 - 09:11:35 - [0,023] ----D C:\Users\ghislain\AppData\Local\Ares
O43 - CFD: 2013-10-06 - 18:15:24 - [0,008] ----D C:\Users\ghislain\AppData\Local\BusCableCarSimulator
O43 - CFD: 2013-12-26 - 14:39:17 - [1,531] ----D C:\Users\ghislain\AppData\Local\Game Updater
O43 - CFD: 2014-02-16 - 18:32:47 - [0] ----D C:\Users\ghislain\AppData\Local\genienext
O43 - CFD: 2012-11-18 - 09:45:21 - [0,094] ----D C:\Users\ghislain\AppData\Local\MarineAquarium3Free_57 =>Adware.MarineAquarium
O43 - CFD: 2011-09-04 - 18:32:09 - [0] ----D C:\Users\ghislain\AppData\Local\MediaGet2 =>PUP.MediaGet
O43 - CFD: 2013-12-03 - 21:21:33 - [0] -SH-D C:\Users\ghislain\AppData\Local\ms-drivers
O43 - CFD: 2012-03-11 - 11:52:59 - [0,022] ----D C:\Users\ghislain\AppData\Local\OTIS_Soft
O43 - CFD: 2013-12-26 - 14:25:13 - [0] ----D C:\Users\ghislain\AppData\Local\Setup Integrity Check
O43 - CFD: 2011-10-23 - 08:43:19 - [0] ----D C:\Users\ghislain\AppData\Local\VHS to DVD
O43 - CFD: 2014-02-13 - 13:43:54 - [0,006] ----D C:\Users\ghislain\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberAvia
O43 - CFD: 2013-02-18 - 13:37:41 - [0,003] ----D C:\Users\ghislain\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Eufloria
O43 - CFD: 2011-11-09 - 18:45:15 - [0,004] ----D C:\Users\ghislain\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Every Day Genius Square Logic
O43 - CFD: 2011-11-21 - 14:09:58 - [0] ----D C:\Users\ghislain\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lotto Pro
O43 - CFD: 2013-04-10 - 07:41:20 - [0,003] ----D C:\Users\ghislain\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MemOptimizer 3
O43 - CFD: 2011-12-20 - 13:48:11 - [0,002] ----D C:\Users\ghislain\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Poker - Espacejeux
O43 - CFD: 2014-02-13 - 15:44:42 - [0] ----D C:\Users\ghislain\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roger Wilco
~ Program Folder: 586 Legitimates Filtered in 04mn 20s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.E13F489F0B1E52319A86BDD996263F4B] - 2014-02-12 - 21:03:11 ---A- . (...) -- C:\Windows\win.ini [478]
O44 - LFC:[MD5.2E4BA0F0C3891F88C9CB435B48E51F12] - 2014-02-13 - 11:41:39 ---A- . (...) -- C:\Windows\IE11_main.log [17768]
O44 - LFC:[MD5.81629B565C101A07ABC8A7F985BD94E2] - 2014-02-14 - 20:19:16 ---A- . (...) -- C:\Windows\Directx.log [111573]
O44 - LFC:[MD5.14B7CB152E191B34D2359458FB17A0C3] - 2014-02-14 - 20:57:07 ---A- . (...) -- C:\Windows\UHOS6BHH.ocx [3120]
O44 - LFC:[MD5.EC6F8E093C43BEA8C05E90AB91F41F5C] - 2014-02-16 - 18:46:15 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [23072]
O44 - LFC:[MD5.EC6F8E093C43BEA8C05E90AB91F41F5C] - 2014-02-16 - 18:46:15 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [23072]
~ Files: 58 Legitimates Filtered in 00mn 10s



---\\ Opérations et fonctions au démarrage de Windows Explorer (O46)
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook [64Bits] - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
~ ShellExecuteHooks: Scanned in 00mn 00s



---\\ Clé de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{3e2e5ded-d1d5-11e0-98e3-0002761ed66b}\AutoRun\command. (...) -- I:\autorun.exe (.not file.)
O51 - MPSK:{41253b88-d26a-11e0-8d13-0002761ed66b}\AutoRun\command. (...) -- J:\autorun.exe (.not file.)
O51 - MPSK:{41253b8a-d26a-11e0-8d13-0002761ed66b}\AutoRun\command. (...) -- L:\autorun.exe (.not file.)
O51 - MPSK:{622667d0-d428-11e2-a74e-0002761ed66b}\AutoRun\command. (...) -- E:\MotorolaDeviceManagerSetup.exe (.not file.)
O51 - MPSK:{7cefefc1-3a66-11e1-9ef5-806e6f6e6963}\AutoRun\command. (...) -- J:\setup.exe (.not file.)
~ Keys: Scanned in 00mn 00s



---\\ Enumération des clés de registre StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\AppleSyncNotifier [Key] . (...) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\ares [Key] . (...) -- C:\Program Files (x86)\Ares\Ares.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\BackgroundContainer [Key] . (...) -- C:\Users\ghislain\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll (.not file.) =>PUP.Babylon
O53 - SMSR:HKLM\...\startupreg\BitTorrent [Key] . (...) -- C:\Program Files (x86)\BitTorrent761\BitTorrent.exe (.not file.) =>P2P.BitTorrent
O53 - SMSR:HKLM\...\startupreg\boincmgr [Key] . (...) -- C:\Program Files (x86)\BOINC\boincmgr.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\boinctray [Key] . (...) -- C:\Program Files (x86)\BOINC\boinctray.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\cacaoweb [Key] . (...) -- C:\Users\ghislain\AppData\Roaming\cacaoweb\cacaoweb.exe (.not file.) =>PUP.CacaoWeb
O53 - SMSR:HKLM\...\startupreg\ConduitFloatingPlugin_ibclbohbddcmmaaobgjamgbfbchjdfae [Key] . (...) -- C:\Program Files (x86)\Conduit\CT3298935\plugins\TBVerifier.dll (.not file.)
O53 - SMSR:HKLM\...\startupreg\DataMgr [Key] . (...) -- C:\Users\ghislain\AppData\Roaming\DataMgr\DataMgr.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\DATAMNGR [Key] . (...) -- C:\Program Files (x86)\SEARCH~3\Datamngr\DATAMN~1.exe (.not file.) =>PUP.Datamngr
O53 - SMSR:HKLM\...\startupreg\DriverScanner [Key] . (...) -- C:\Program Files (x86)\Uniblue\DriverScanner\launcher.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\EasyDownloads [Key] . (...) -- C:\Program Files (x86)\Easy Downloads\easydownloads.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\facemoods [Key] . (...) -- C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.7\facemoodssrv.exe (.not file.) =>Adware.Facemoods
O53 - SMSR:HKLM\...\startupreg\Intermediate [Key] . (...) -- C:\Users\ghislain\AppData\Roaming\Intermediate\Intermediate.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\Marine Aquarium Lite Search Scope Monitor [Key] . (.MindSpark - MindSpark Toolbar Platform SearchScope Moni.) -- C:\Program Files (x86)\MARINE~2\bar\1.bin\57srchmn.exe
O53 - SMSR:HKLM\...\startupreg\MarineAquarium3Free_57 Browser Plugin Loader [Key] . (...) -- C:\Program Files (x86)\MARINE~2\bar\1.bin\57brmon.exe (.not file.) =>Adware.MarineAquarium
O53 - SMSR:HKLM\...\startupreg\Media Finder [Key] . (...) -- C:\Program Files (x86)\Media Finder\Media Finder.exe (.not file.) =>PUP.MediaFinder
O53 - SMSR:HKLM\...\startupreg\MediaGet2 [Key] . (...) -- C:\Users\ghislain\AppData\Local\MediaGet2\mediaget.exe (.not file.) =>PUP.MediaGet
O53 - SMSR:HKLM\...\startupreg\Megakey [Key] . (...) -- C:\Users\ghislain\AppData\Local\Megamedia\Megakey\Megakey.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\MegakeyUpdater [Key] . (...) -- C:\Users\ghislain\AppData\Local\Megamedia\Megakey\MegakeyUpdater.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\mobilegeni daemon [Key] . (...) -- C:\Program Files (x86)\Mobogenie\DaemonProcess.exe (.not file.) =>PUP.Mobogenie
O53 - SMSR:HKLM\...\startupreg\Multimedia Keyboard [Key] . (.NONE - Pas de description.) -- C:\Program Files (x86)\MultiMedia Keyboard\KBLED.exe
O53 - SMSR:HKLM\...\startupreg\NextLive [Key] . (...) -- C:\Users\ghislain\AppData\Roaming\newnext.me\nengine.dll (.not file.) =>PUP.NextLive
O53 - SMSR:HKLM\...\startupreg\Norton Ghost 15.0 [Key] . (...) -- C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\Rocketfish Input Device Main Program [Key] . (.Pas de propriétaire - xDaemon.) -- C:\Program Files\RocketFish\Rocketfish Bluetooth Combo\TSR\xDaemon.exe
O53 - SMSR:HKLM\...\startupreg\SCheck [Key] . (...) -- C:\Users\ghislain\AppData\Roaming\SCheck\SCheck.exe (.not file.) =>PUP.LuaRT
O53 - SMSR:HKLM\...\startupreg\SearchProtect [Key] . (...) -- C:\Users\ghislain\AppData\Roaming\SearchProtect\bin\cltmng.exe (.not file.) =>Toolbar.Conduit
O53 - SMSR:HKLM\...\startupreg\SearchProtectAll [Key] . (...) -- C:\Program Files (x86)\SearchProtect\bin\cltmng.exe (.not file.) =>Toolbar.Conduit
O53 - SMSR:HKLM\...\startupreg\SpeedUpMyPC [Key] . (...) -- C:\Program Files (x86)\Uniblue\SpeedUpMyPC\launcher.exe (.not file.) =>Rogue.SpeedUpMyPC
O53 - SMSR:HKLM\...\startupreg\SSync [Key] . (...) -- C:\Users\ghislain\AppData\Roaming\SSync\SSync.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\uTorrent [Key] . (.BitTorrent Inc. - µTorrent.) -- C:\Users\ghislain\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O53 - SMSR:HKLM\...\startupreg\VooMuuSA [Key] . (...) -- C:\Program Files (x86)\VooMuu\bin\1.0.29.0\VooMuuSA.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\Yontoo Desktop [Key] . (...) -- C:\Users\ghislain\AppData\Roaming\Yontoo\YontooDesktop.exe (.not file.) =>Adware.Yontoo
~ SMSR Keys: 77 Legitimates Filtered in 00mn 01s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 18 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.FC0E8778C000291CAF60EB88C011E931] - 2011-10-23 - 16:07:20 ---A- . (...) -- C:\Windows\System32\Drivers\atksgt.sys [314016]
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 2009-07-13 - 20:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:[MD5.23E2233788D654526B5EDFC1B1971603] - 2008-12-01 - 10:06:44 ---A- . (.eMPIA Technology, Inc. - USB EMP Audio Device.) -- C:\Windows\System32\Drivers\emAudio64.sys [70144]
O58 - SDL:[MD5.A2A94AABF5200A19A2510E94775D6423] - 2008-12-01 - 10:06:44 ---A- . (.eMPIA Technology, Inc. - USB 28xx BDA Driver.) -- C:\Windows\System32\Drivers\emBDA64.sys [658560]
O58 - SDL:[MD5.B92D2C09EBADE76117B06F9FC58EED5B] - 2008-12-01 - 10:06:44 ---A- . (.Hauppauge Computer Works, Inc. - USB 28xx BDA Lower filter.) -- C:\Windows\System32\Drivers\emOEM64.sys [151808]
O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 2009-06-10 - 15:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:[MD5.8DECF397B091FF0AF81CC48C601C6B94] - 2013-12-04 - 14:46:36 ---A- . (.Highlightly - Highlightly Driver x64.) -- C:\Windows\System32\Drivers\hlnfd.sys [58256]
O58 - SDL:[MD5.156AB2E56DC3CA0B582E3362E07CDED7] - 2011-10-23 - 16:07:19 ---A- . (...) -- C:\Windows\System32\Drivers\lirsgt.sys [43680]
O58 - SDL:[MD5.CA88F2094C8746BA6A4F3885AE062B49] - 2009-06-23 - 14:50:44 ---A- . (.Primax Electronics Ltd. - PS/2 Mouse Filter Driver (For Windows 2000 Only).) -- C:\Windows\System32\Drivers\rbbtm.SYS [16384]
O58 - SDL:[MD5.61ACBE94CEE5E6BA507352489526F1FD] - 2009-06-23 - 14:50:28 ---A- . (.Primax Electronics Ltd. - Mouse Suite Driver (For Windows 2000 and Whistler Only).) -- C:\Windows\System32\Drivers\rbmouse.SYS [22016]
O58 - SDL:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 1601-01-01 - 05:00:00 ---A- . (...) -- C:\Windows\System32\Drivers\sptd.sys [530488]
O58 - SDL:[MD5.6060106CE00F32F63F1A73160E46E9D2] - 2012-05-20 - 21:09:00 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG USB Composite Device Driver (MSS Ver.3).) -- C:\Windows\System32\Drivers\ssudbus.sys [99384]
O58 - SDL:[MD5.855335BF5792E56164F98C012E3D92DD] - 2012-05-20 - 21:09:00 ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG Android Modem Device Driver (MSS Ver.3).) -- C:\Windows\System32\Drivers\ssudmdm.sys [203320]
O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 2009-07-13 - 20:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
O58 - SDL:[MD5.48D9D00C2E0E72C3D4F52772C80355F6] - 2010-10-04 - 08:40:18 ---A- . (.Teruten Inc - File System Mini Filter Drvier.) -- C:\Windows\System32\Drivers\TFsExDisk.sys [16448]
O58 - SDL:[MD5.DA86016F0672ADA925F589EDE715F185] - 2006-03-29 - 08:49:26 ----- . (.Padus, Inc. - Padus(R) ASPI Shell.) -- C:\Windows\SysWOW64\drivers\pfc.sys [9856]
O58 - SDL:[MD5.306521935042FC0A6988D528643619B3] - 2007-10-25 - 16:26:10 ----- . (...) -- C:\Windows\SysWOW64\drivers\StarOpen.sys [5632]
O58 - SDL:[MD5.48D9D00C2E0E72C3D4F52772C80355F6] - 2010-10-04 - 08:40:18 ----- . (.Teruten Inc - File System Mini Filter Drvier.) -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys [16448]
~ Drivers: 18 Legitimates Filtered in 00mn 31s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Moonchild Productions - Pale Moon web browser.) -- C:\Program Files (x86)\Pale Moon\palemoon.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Apple Inc. - Safari.) -- C:\Program Files (x86)\Safari\Safari.exe
~ Keys: Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] ${searchCLSID} - (Yahoo! Search) - http://search.yahoo.com
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Google) - http://www.google.com
O69 - SBI: SearchScopes [HKCU] {89DAA5D8-DB16-49B7-989A-8A68908B0C20} - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKUS\.DEFAULT] {274daec0-c4e8-4f30-9e5c-9424990769b9} - (My Web Search) - http://search.mywebsearch.com =>Adware.MyWebSearch
O69 - SBI: SearchScopes [HKUS\S-1-5-18] {274daec0-c4e8-4f30-9e5c-9424990769b9} - (My Web Search) - http://search.mywebsearch.com =>Adware.MyWebSearch
~ Keys: Scanned in 00mn 00s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.83824D4567A53AC19E40E82B3E5E317F] [SPRF][2013-05-01] (...) -- C:\ProgramData\a3Hvy46k.dat [112]
[MD5.B3861FF4424139E104B203E07A86B978] [SPRF][2012-01-15] (...) -- C:\ProgramData\ezsidmv.dat [56]
[MD5.54DB2B8C60F04C5ADE6D711D47EABA75] [SPRF][2014-02-16] (...) -- C:\Users\ghislain\Desktop\adwcleaner.exe [1166132]
~ Files: 10 Legitimates Filtered in 00mn 02s



---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{E0F93BA1-81A3-4D02-BF21-061FA16D8D2E}" |In - Domain - P6 - TRUE | .(...) -- D:\setup.exe (.not file.)
O87 - FAEL: "{2B34E2A4-B0E4-4004-BF1A-7E62661F70FB}" |In - Domain - P17 - TRUE | .(...) -- D:\setup.exe (.not file.)
O87 - FAEL: "{9364D09A-675F-4173-98F8-5C4F522356FF}" |In - Private - P6 - TRUE | .(...) -- D:\setup.exe (.not file.)
O87 - FAEL: "{8577ADAE-B50B-467B-920F-F11FF876F85D}" |In - Private - P17 - TRUE | .(...) -- D:\setup.exe (.not file.)
O87 - FAEL: "TCP Query User{CA77E916-4B46-4455-89C6-72087E8C7DBA}C:\users\ghislain\appdata\local\mediaget2\mediaget.exe" |In - Private - P6 - TRUE | .(...) -- C:\users\ghislain\appdata\local\mediaget2\mediaget.exe (.not file.) =>PUP.MediaGet
O87 - FAEL: "UDP Query User{A16B2311-DD34-4624-87B1-C26DA194EDBF}C:\users\ghislain\appdata\local\mediaget2\mediaget.exe" |In - Private - P17 - TRUE | .(...) -- C:\users\ghislain\appdata\local\mediaget2\mediaget.exe (.not file.) =>PUP.MediaGet
O87 - FAEL: "{5682D009-67FE-4FD7-A374-CCAA16E1544C}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files (x86)\EA Play\Create Demo\pc\Create.exe (.not file.)
O87 - FAEL: "{A3ADD783-E7EE-4193-A61D-F77C28E7A54C}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files (x86)\EA Play\Create Demo\pc\Create.exe (.not file.)
O87 - FAEL: "TCP Query User{CA690FAF-5975-4AFB-AC32-E62B032D22F7}C:\program files (x86)\windows lotto pro 2000\proupdt.exe" | In - Private - P6 - TRUE | .(...) -- C:\program files (x86)\windows lotto pro 2000\proupdt.exe
O87 - FAEL: "UDP Query User{9CFF8884-1577-4809-B137-0AF6CAB40891}C:\program files (x86)\windows lotto pro 2000\proupdt.exe" | In - Private - P17 - TRUE | .(...) -- C:\program files (x86)\windows lotto pro 2000\proupdt.exe
O87 - FAEL: "{766538A9-3966-43B2-A772-B6D8B24FB5B4}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files (x86)\Easy Downloads\easydownloads.exe (.not file.)
O87 - FAEL: "{77923216-09FF-4334-81C0-08F67AC2B2B9}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files (x86)\Easy Downloads\easydownloads.exe (.not file.)
O87 - FAEL: "{34743264-FC9D-46DC-918A-B4682F9F4639}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files (x86)\Easy Downloads\easydl.exe (.not file.)
O87 - FAEL: "{DDA358E8-93A7-4446-A332-5C9AA8EEA49E}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files (x86)\Easy Downloads\easydl.exe (.not file.)
O87 - FAEL: "TCP Query User{E675B5C3-6850-4077-A274-DF4451515B8C}C:\users\ghislain\appdata\roaming\cacaoweb\cacaoweb.exe" |In - Public - P6 - TRUE | .(...) -- C:\users\ghislain\appdata\roaming\cacaoweb\cacaoweb.exe (.not file.) =>PUP.CacaoWeb
O87 - FAEL: "UDP Query User{C6549B70-2173-4AC7-9CF0-E2D2A5D6E6D7}C:\users\ghislain\appdata\roaming\cacaoweb\cacaoweb.exe" |In - Public - P17 - TRUE | .(...) -- C:\users\ghislain\appdata\roaming\cacaoweb\cacaoweb.exe (.not file.) =>PUP.CacaoWeb
O87 - FAEL: "TCP Query User{8F1B4554-2060-4D39-9477-9C91D66F9D41}C:\users\ghislain\appdata\roaming\cacaoweb\cacaoweb.exe" |In - Private - P6 - TRUE | .(...) -- C:\users\ghislain\appdata\roaming\cacaoweb\cacaoweb.exe (.not file.) =>PUP.CacaoWeb
O87 - FAEL: "UDP Query User{B3B8ECD4-3134-4C72-94C2-9C15CF608D59}C:\users\ghislain\appdata\roaming\cacaoweb\cacaoweb.exe" |In - Private - P17 - TRUE | .(...) -- C:\users\ghislain\appdata\roaming\cacaoweb\cacaoweb.exe (.not file.) =>PUP.CacaoWeb
O87 - FAEL: "TCP Query User{4CB3B20A-F99D-41C6-9613-40F9C2C73F1B}C:\program files\tower simulator v1\tower.exe" | In - Private - P6 - TRUE | .(...) -- C:\program files\tower simulator v1\tower.exe
O87 - FAEL: "UDP Query User{6E4D7257-0DE6-4D7A-B0A6-91A85A859889}C:\program files\tower simulator v1\tower.exe" | In - Private - P17 - TRUE | .(...) -- C:\program files\tower simulator v1\tower.exe
O87 - FAEL: "{633CF1E8-49E4-4FDE-81C3-0B01FFE20955}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files (x86)\searchresults1\dtUser.exe (.not file.)
O87 - FAEL: "{5F209628-A114-43FE-95C3-8A6632D3D85F}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files (x86)\searchresults1\dtUser.exe (.not file.)
O87 - FAEL: "TCP Query User{EEE86844-07A7-4BDC-AA98-FD18DCF827BF}C:\program files (x86)\ares\ares.exe" |In - Private - P6 - TRUE | .(...) -- C:\program files (x86)\ares\ares.exe (.not file.)
O87 - FAEL: "UDP Query User{B67FD646-A535-422D-A959-D30DC389019E}C:\program files (x86)\ares\ares.exe" |In - Private - P17 - TRUE | .(...) -- C:\program files (x86)\ares\ares.exe (.not file.)
O87 - FAEL: "{8790FD35-4F71-4305-A1BC-2FFDDE806920}" | In - Private - P6 - TRUE | .(...) -- C:\Program Files (x86)\DNA\btdna.exe
O87 - FAEL: "{B26BE4A8-B785-4586-90A0-6914F2E39322}" | In - Private - P17 - TRUE | .(...) -- C:\Program Files (x86)\DNA\btdna.exe
O87 - FAEL: "{AC9A6F3C-C4B7-4848-AFDB-678041CB4512}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files (x86)\searchresultstb\dtUser.exe (.not file.) =>PUP.SearchResults
O87 - FAEL: "{DE00FD8F-B9AB-45C7-98AD-1C4CC78432D1}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files (x86)\searchresultstb\dtUser.exe (.not file.) =>PUP.SearchResults
O87 - FAEL: "{831D17F5-3D0A-4E12-B1B8-B9F1DD8DA191}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\dtUser.exe (.not file.) =>PUP.Datamngr
O87 - FAEL: "{3EC9DDD7-1899-4AAD-AA3D-72A9085EC651}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\dtUser.exe (.not file.) =>PUP.Datamngr
O87 - FAEL: "{FE72B823-C46F-41DD-ADA7-147BCCEB2F3F}" |In - Private - P6 - TRUE | .(...) -- C:\Games_1\Mass Effect 3\Binaries\Win32\MassEffect3.exe (.not file.)
O87 - FAEL: "{7D861AE1-4B4E-4241-8A0F-D241C9881527}" |In - Private - P17 - TRUE | .(...) -- C:\Games_1\Mass Effect 3\Binaries\Win32\MassEffect3.exe (.not file.)
O87 - FAEL: "{745FD1D6-71CC-4219-89DB-6034198DCCB2}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files (x86)\yolobartb\dtUser.exe (.not file.)
O87 - FAEL: "{02EA260B-AC58-46D8-809F-ED51E463E127}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files (x86)\yolobartb\dtUser.exe (.not file.)
O87 - FAEL: "TCP Query User{0BD39EC9-27E6-49E3-A16A-A743537ADFEA}C:\users\ghislain\appdata\local\temp\resources\kmskg\keygen.exe" |In - Private - P6 - TRUE | .(...) -- C:\users\ghislain\appdata\local\temp\resources\kmskg\keygen.exe (.not file.)
O87 - FAEL: "UDP Query User{BBA17745-B4BC-49DD-A6E3-540F5E4A0A6C}C:\users\ghislain\appdata\local\temp\resources\kmskg\keygen.exe" |In - Private - P17 - TRUE | .(...) -- C:\users\ghislain\appdata\local\temp\resources\kmskg\keygen.exe (.not file.)
O87 - FAEL: "TCP Query User{47196605-5823-4E20-960D-8DB7195C103C}D:\english\search tool.exe" |In - Private - P6 - TRUE | .(...) -- D:\english\search tool.exe (.not file.)
O87 - FAEL: "UDP Query User{20DE73DB-36D9-4F48-9F56-63C699E03238}D:\english\search tool.exe" |In - Private - P17 - TRUE | .(...) -- D:\english\search tool.exe (.not file.)
O87 - FAEL: "{E848264B-D768-4826-9E62-1E016B3F000B}" |In - Public - P17 - TRUE | .(...) -- D:\english\search tool.exe (.not file.)
O87 - FAEL: "{91A0DF20-82C0-4BC6-AB98-71D35A9E4851}" |In - Public - P6 - TRUE | .(...) -- D:\english\search tool.exe (.not file.)
O87 - FAEL: "TCP Query User{07112D4A-787C-445C-9373-2E63E673492E}C:\wanscam\english\search tool.exe" | In - Private - P6 - TRUE | .(...) -- C:\wanscam\english\search tool.exe
O87 - FAEL: "UDP Query User{15C93E89-A8F2-43D9-95FC-6B5A2CA382E6}C:\wanscam\english\search tool.exe" | In - Private - P17 - TRUE | .(...) -- C:\wanscam\english\search tool.exe
O87 - FAEL: "TCP Query User{8C5B6900-3518-4736-8EFC-2D41AA04B48E}C:\users\ghislain\desktop\search tool.exe" |In - Private - P6 - TRUE | .(...) -- C:\users\ghislain\desktop\search tool.exe (.not file.)
O87 - FAEL: "UDP Query User{CA7CF16B-9C3F-4D31-9951-B7784A76BD85}C:\users\ghislain\desktop\search tool.exe" |In - Private - P17 - TRUE | .(...) -- C:\users\ghislain\desktop\search tool.exe (.not file.)
O87 - FAEL: "{CB51BCAA-82B5-4213-8E0B-50746B42B5E3}" |In - Public - P17 - TRUE | .(...) -- C:\users\ghislain\desktop\search tool.exe (.not file.)
O87 - FAEL: "{D088C6D9-1BB7-4AA3-984F-5F594A232EB6}" |In - Public - P6 - TRUE | .(...) -- C:\users\ghislain\desktop\search tool.exe (.not file.)
O87 - FAEL: "TCP Query User{9B57E224-E09B-45CC-BBAA-98BB3F7C7E5B}C:\program files (x86)\miniget\miniget.exe" |In - Public - P6 - TRUE | .(...) -- C:\program files (x86)\miniget\miniget.exe (.not file.)
O87 - FAEL: "UDP Query User{FAADCC5F-9E49-4F5C-8286-99C744A6924C}C:\program files (x86)\miniget\miniget.exe" |In - Public - P17 - TRUE | .(...) -- C:\program files (x86)\miniget\miniget.exe (.not file.)
~ Firewall: 404 Legitimates Filtered in 00mn 04s



---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "4FB0C83CB68575D40BC8BA51170F6147" . (.NoDupe 64-bit (v1.16.8.2).) -- C:\Windows\Installer\{C38C0BF4-586B-4D57-B08C-AB1571F01674}\NoDupeIcon
O90 - PUC: "8969EEF14D3333647BAB37868CE794AA" . (.GPS TrackMaker.) -- C:\Windows\Installer\{1FEE9698-33D4-4633-B7BA-7368C87E49AA}\ARPPRODUCTICON.exe
O90 - PUC: "ABB33403853514B418E76E4990D21C87" . (.Crazy Machines II.) -- C:\Windows\Installer\{30433BBA-5358-4B41-817E-E694092DC178}\ARPPRODUCTICON.exe
O90 - PUC: "D5FC3DD537598A4459346DB5DE591329" . (.Prepar3D v2 Professional.) -- C:\Windows\Installer\{5DD3CF5D-9573-44A8-9543-D65BED953192}\Prepar3D.ico
O90 - PUC: "E154C8CC028A8C84EA290AFF8098968D" . (.Stereoscopic Player.) -- C:\Windows\Installer\{CC8C451E-A820-48C8-AE92-A0FF088969D8}\_853F67D554F05449430E7E.exe
~ Update Products: 208 Legitimates Filtered in 00mn 00s



---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.27CAFC59EE89ADF0C09C09AFC3EBC503] [WIS][2008-12-17] (.Intuit Inc. - QuickBooks.) -- C:\Windows\Installer\1b27b2.msi [60766720]
[MD5.AC826AC63E988366F25BB7286FC6AEEB] [WIS][2012-06-05] (.Sterling Wight - LEC Translate DotNet.) -- C:\Windows\Installer\343bfee.msi [10913792]
[MD5.A6DBE1F133F81280CE2B373FA75D6C26] [WIS][2004-03-30] (.Gerhard Rotter - LabelWhiz LabelCreator Pro.) -- C:\Windows\Installer\4a94d2e3.msi [17918464]
[MD5.69D293D8F6A78D185C55272473F4ADC2] [WIS][2014-02-08] (.Kreapixel - Webplayer.) -- C:\Windows\Installer\7e65f4b.msi [21504] =>Adware.SocialSkinz
[MD5.65242CF37BC2B7733CDB2929D4972FD8] [WIS][2008-07-21] (.FAKT Software GmbH - Crazy Machines II.) -- C:\Windows\Installer\87ffd34.msi [1553408]
[MD5.D2F34AF196CCAF29A124324392FC3DFF] [WIS][2011-10-04] (.Valve Corporation - Steam.) -- C:\Windows\Installer\ae0f81.msi [8532992]
[MD5.9D77EBADD06770237B9DC914B1D1DF06] [WIS][2012-02-16] (.OTIS Soft - NoDupe 64-bit (v1.16.8.2).) -- C:\Windows\Installer\f5b6857.msi [851968]
~ WIS: 215 Legitimates Filtered in 01mn 12s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Disabled 2011-02-09 457200 | (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) . (...) - C:\Program Files (x86)\Roxio\BackOnTrack\App\SaibSVC.exe =>Adware.InstallBrain
SS - | Disabled 2014-02-06 257928 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Disabled 2013-02-01 135272 | (atashost) . (.Cisco WebEx LLC.) - C:\Windows\SysWOW64\atashost.exe
SS - | Disabled 2011-10-01 69120 | (Boonty Games) . (.BOONTY.) - C:\Program Files (x86)\Common Files\BOONTY Shared\Service\Boonty.exe
SS - | Disabled 2011-07-14 211440 | (BOTService) . (.Rovi Corporation.) - C:\Program Files (x86)\Roxio\BackOnTrack\Instant Restore\BOTService.exe
SS - | Disabled 2013-02-27 1008344 | (btwdins) . (.Broadcom Corporation..) - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
SS - | Disabled 2011-02-15 19968 | (CronService) . (.Fork Ltd..) - C:\Prey\platform\windows\cronsvc.exe
SS - | Disabled 2009-09-14 166400 | (EPSON_EB_RPCV4_04) . (.SEIKO EPSON CORPORATION.) - C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.exe
SS - | Disabled 2009-09-14 128512 | (EPSON_PM_RPCV4_04) . (.SEIKO EPSON CORPORATION.) - C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.exe
SS - | Disabled 2008-08-07 3276800 | (FirebirdServerMAGIXInstance) . (.MAGIX®.) - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe
SS - | Disabled 2012-04-02 1044816 | (FLEXnet Licensing Service) . (.Flexera Software, Inc..) - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
SS - | Auto 2012-12-15 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 2012-12-15 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 1658-07-10 0 | (gusvc) . (...) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Disabled 2012-09-07 2464400 | (IconMan_R) . (.Realsil Microelectronics Inc..) - C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
SS - | Disabled 2005-04-03 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
SS - | Auto 1658-07-10 0 | (KMService) . (...) - C:\Windows\system32\srvany.exe =>Hijacker.Office
SS - | Demand 2009-07-20 160784 | (LBTServ) . (.Logitech, Inc..) - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
SS - | Disabled 2014-02-04 118896 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Disabled 2012-05-24 20480 | (QBCFMonitorService) . (.Intuit.) - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
SS - | Disabled 2006-11-09 65536 | (QBFCService) . (.Intuit Inc..) - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
SS - | Auto 1658-07-10 0 | (RoxLiveShare10) . (...) - C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe
SS - | Demand 2011-07-13 1095664 | (RoxMediaDB13) . (.Rovi Corporation.) - C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxMediaDB13.exe
SS - | Auto 2011-07-13 340976 | (RoxWatch12) . (.Rovi Corporation.) - C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatch13.exe
SS - | Auto 1658-07-10 0 | (SessionLauncher) . (...) - C:\Users\ghislain\AppData\Local\Temp\DX9\SessionLauncher.exe
SS - | Auto 2013-10-23 172192 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Disabled 2012-04-09 489256 | (Steam Client Service) . (.Valve Corporation.) - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
SS - | Disabled 2012-11-29 3463080 | (TeamViewer8) . (.TeamViewer GmbH.) - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
SS - | Demand 2009-07-13 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

SR - | Auto 2012-05-05 1192272 | (AcrSch2Svc) . (.Acronis.) - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
SR - | Auto 2013-12-21 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 2013-09-07 55624 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 2011-08-30 462184 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Auto 2011-07-15 21488 | (BOT4Service) . (...) - C:\Program Files (x86)\Roxio\BackOnTrack\App\BService.exe
SR - | Auto 2009-08-27 1253376 | (Fabs) . (.MAGIX AG.) - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
SR - | Auto 2013-11-08 250712 | (Garmin Core Update Service) . (.Garmin Ltd or its subsidiaries.) - C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
SR - | Auto 2013-05-15 1144144 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe
SR - | Auto 2013-11-15 137528 | (Motorola Device Manager) . (.Motorola Mobility LLC.) - C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
SR - | Auto 2013-10-23 23808 | (MsMpSvc) . (.Microsoft Corporation.) - c:\Program Files\Microsoft Security Client\MsMpEng.exe
SR - | Auto 2013-07-18 762192 | (NAUpdate) . (.Nero AG.) - C:\Program Files (x86)\Nero\Update\NASvc.exe
SR - | Auto 2013-10-23 922912 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe
SR - | Auto 2010-03-10 189728 | (PSI_SVC_2) . (.Protexis Inc..) - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
SR - | Auto 2011-09-02 65657 | (PST Service) . (.Motorola.) - C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe
SR - | Auto 2012-11-29 38608 | (RealNetworks Downloader Resolver Service) . (...) - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
SR - | Auto 1658-07-10 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 2009-07-13 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

~ Services: Scanned in 01mn 15s



---\\ Liste des émulateurs de CD/DVD (MBR Hook)
O58 - SDL:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 1601-01-01 - 05:00:00 ---A- . (...) -- C:\Windows\System32\Drivers\sptd.sys [530488]
~ Emulateurs: Scanned in 01mn 15s



---\\ Scan Additionnel (O88)
Database Version : 13031 - (2014-02-14)
Clés trouvées (Keys found) : 58
Valeurs trouvées (Values found) : 4
Dossiers trouvés (Folders found) : 16
Fichiers trouvés (Files found) : 16

[HKLM\SYSTEM\CurrentControlSet\Services\KMService] =>Hijacker.Office^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\ContinueToSave] =>PUP.OfferWare^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\IECT3316528] =>Toolbar.Vafmusic^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F750DB0E-D452-3108-63C9-FE16BC686741}] =>Adware.SocialSkinz^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{C1C6816E-CBB3-A748-85F9-A8B47B68985B}] =>PUP.OfferWare^
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\BackgroundContainer] =>PUP.Babylon^
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\BitTorrent] =>P2P.BitTorrent^
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\cacaoweb] =>PUP.CacaoWeb^
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\DATAMNGR] =>PUP.Datamngr^
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\facemoods] =>Adware.Facemoods^
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\MarineAquarium3Free_57 Browser Plugin Loader] =>Adware.MarineAquarium^
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\Media Finder] =>PUP.MediaFinder^
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\MediaGet2] =>PUP.MediaGet^
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\mobilegeni daemon] =>PUP.Mobogenie^
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\NextLive] =>PUP.NextLive^
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\SCheck] =>PUP.LuaRT^
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\SearchProtect] =>Toolbar.Conduit^
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\SearchProtectAll] =>Toolbar.Conduit^
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\SpeedUpMyPC] =>Rogue.SpeedUpMyPC^
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\uTorrent] =>P2P.BitTorrent^
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\Yontoo Desktop] =>Adware.Yontoo^
[HKCU\{C5C31551-23FC-4895-B1C7-E209163DECA5}] =>Toolbar.Agent
[HKLM\Software\Classes\Interface\{db885111-f39f-4d88-9ee5-c88460b6df7b}] =>Adware.Agent
[HKLM\Software\Wow6432Node\Classes\Interface\{db885111-f39f-4d88-9ee5-c88460b6df7b}] =>Adware.Agent
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF] =>Toolbar.AVGSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E] =>Toolbar.Ask
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9] =>Adware.MyWebSearch
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater] =>Toolbar.Ask
[HKLM\Software\Classes\Interface\{7131C082-F3C6-404D-B8CC-8AF9CFB6209D}] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Classes\Interface\{7131C082-F3C6-404D-B8CC-8AF9CFB6209D}] =>Toolbar.Agent
[HKLM\Software\Classes\AppID\{5C731C2A-6ADF-487E-99A2-7291BF794A14}] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Classes\AppID\{5C731C2A-6ADF-487E-99A2-7291BF794A14}] =>Toolbar.Agent
[HKLM\Software\Classes\AppID\osmax.ocx] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\VBMZ] =>Toolbar.Conduit
[HKCU\Software\Classes\MF] =>PUP.MediaFinder
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2] =>Toolbar.Ask
[HKCU\Software\Protector] =>PUP.AdvancedSystemProtector
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\VooMuuSA] =>Adware.Hotbar
[HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220322542297}] =>PUP.CrossRider
[HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220322542299}] =>PUP.CrossRider
C:\Users\ghislain\AppData\Roaming\Mozilla\Firefox\Profiles\01rn421q.default\extensions\57ffxtbr@MarineAquarium3Free_57.com =>Adware.MarineAquarium^
C:\Users\ghislain\AppData\Roaming\Mozilla\Firefox\Profiles\1myiu6b6.default\extensions\50ef75d8544f0@50ef75d854529.com =>PUP.OfferWare^
C:\Users\ghislain\AppData\Roaming\Mozilla\Firefox\Profiles\1myiu6b6.default\extensions\support@websteroidsapp.com =>PUP.TubeDimmer^
C:\Program Files (x86)\MarineAquarium3Free_57 =>Adware.MarineAquarium^
C:\Program Files (x86)\SoftQuick =>Hijacker.SoftQuick^
C:\Program Files (x86)\Tuvaro_1.1 =>Toolbar.Tuvaro^
C:\ProgramData\InstallMate =>PUP.Tarma^
C:\ProgramData\Updater =>PUP.CrossRider^
C:\Users\ghislain\AppData\Roaming\wp_update =>PUP.WpManager^
C:\Users\ghislain\AppData\Local\MarineAquarium3Free_57 =>Adware.MarineAquarium^
C:\Users\ghislain\AppData\Local\MediaGet2 =>PUP.MediaGet^
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WhiteSmoke =>PUP.Whitesmoke
C:\Users\ghislain\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbpkiefagocgkmemidfngdkamloieekf =>Hijacker.TornTV
C:\Users\ghislain\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfmopbbadnfoelckkcmjjeaaegjpjjbk =>Spyware.GophotoIt
C:\Users\ghislain\AppData\Local\Google\Chrome\User Data\Default\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi =>PUP.Whitesmoke
C:\Users\ghislain\AppData\Local\Google\Chrome\User Data\Default\Extensions\badkodiapncjgddgfhpeijmodfnfebeg =>Toolbar.SearchExpressB
[HKLM\Software\Wow6432Node\Better-Surf] =>PUP.BetterSurf^
[HKLM\Software\Wow6432Node\BetterSurf] =>PUP.BetterSurf^
[HKLM\Software\Wow6432Node\MarineAquarium3Free_57] =>Adware.MarineAquarium^
C:\Windows\Installer\7e65f4b.msi =>Adware.SocialSkinz^
C:\Users\ghislain\AppData\Local\Temp\uninst1.exe =>PUP.Babylon
C:\Users\ghislain\AppData\Local\Temp\793B865.tmp =>Adware.Yontoo
C:\Users\ghislain\AppData\Local\Temp\793C3B3.tmp =>Adware.Yontoo
C:\Users\ghislain\AppData\Local\Temp\conduitinstaller.exe =>Toolbar.Conduit
C:\Users\ghislain\AppData\Local\Temp\tbBit0.dll =>Toolbar.Conduit
C:\Users\ghislain\AppData\Local\Temp\tbWhit.dll =>Toolbar.Conduit
~ Additionnel Scan: 1891906 Items scanned in 03mn 59s



---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com/apps/blog/show/35305816-adware-marineaquarium =>Adware.MarineAquarium
~ http://nicolascoolman.webs.com/apps/blog/show/27332348-pup-offerware =>PUP.Offerware
~ http://nicolascoolman.webs.com/apps/blog/show/37242682-pup-tubedimmer =>PUP.TubeDimmer
~ http://nicolascoolman.webs.com/apps/blog/show/27480243-adware-socialskinz =>Adware.SocialSkinz
~ http://nicolascoolman.webs.com/apps/blog/show/33263878-hijacker-browser =>Hijacker.Browsers
~ http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit
~ http://nicolascoolman.webs.com/apps/blog/show/29626487-hijacker-office =>Hijacker.Office
~ http://nicolascoolman.webs.com/apps/blog/show/38737316-pup-wpmanager =>PUP.WpManager
~ http://nicolascoolman.webs.com/apps/blog/show/36340918-pup-bettersurf =>PUP.BetterSurf
~ http://nicolascoolman.webs.com/apps/blog/show/37752731-pup-duuqu =>PUP.Duuqu
~ http://nicolascoolman.webs.com/apps/blog/show/28834943-hijacker-softquick =>Hijacker.SoftQuick
~ http://nicolascoolman.webs.com/apps/blog/show/29637859-toolbar-tarma =>PUP.Tarma
~ http://nicolascoolman.webs.com/apps/blog/show/27583526-pup-crossrider =>PUP.CrossRider
~ http://nicolascoolman.webs.com/apps/blog/show/28151468-pup-mediaget =>PUP.MediaGet
~ http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon =>PUP.Babylon
~ http://nicolascoolman.webs.com/apps/blog/show/27566847-pup-cacaoweb =>PUP.CacaoWeb
~ http://nicolascoolman.webs.com/apps/blog/show/27583992-pup-datamngr =>PUP.Datamngr
~ http://nicolascoolman.webs.com/apps/blog/show/26764465-adware-facemoods =>Adware.Facemoods
~ http://nicolascoolman.webs.com/apps/blog/show/28445531-pup-mediafinder =>PUP.MediaFinder
~ http://nicolascoolman.webs.com/apps/blog/show/41034005-pup-mobogenie =>PUP.Mobogenie
~ http://nicolascoolman.webs.com/apps/blog/show/40528410-pup-nextlive =>PUP.NextLive
~ http://nicolascoolman.webs.com/apps/blog/show/35337893-pup-luart =>PUP.LuaRT
~ http://nicolascoolman.webs.com/apps/blog/show/33047509-rogue-speedupmypc =>Rogue.SpeedUpMyPC
~ http://nicolascoolman.webs.com/apps/blog/show/26811836-adware-yontoo =>Adware.Yontoo
~ http://nicolascoolman.webs.com/apps/blog/show/27146838-adware-mywebsearch =>Adware.MyWebSearch
~ http://nicolascoolman.webs.com/apps/blog/show/30319724-pup-searchresults =>PUP.SearchResults
~ http://nicolascoolman.webs.com/apps/blog/show/26907365-adware-installbrain =>Adware.InstallBrain
~ http://nicolascoolman.webs.com/apps/blog/show/28927746-toolbar-ask =>Toolbar.Ask
~ http://nicolascoolman.webs.com/apps/blog/show/26630283-pup-advancedsystemprotector =>PUP.AdvancedSystemProtector
~ http://nicolascoolman.webs.com/apps/blog/show/26834113-adware-hotbar =>Adware.Hotbar
~ http://nicolascoolman.webs.com/apps/blog/show/27636417-pup-whitesmoke =>PUP.WhiteSmoke
~ http://nicolascoolman.webs.com/apps/blog/show/27660150-hijacker-torntv =>Hijacker.TornTV
~ http://nicolascoolman.webs.com/apps/blog/show/27793524-spyware-gophotoit =>Spyware.GophotoIt
~ MSI: 33 link(s) detected in 03mn 59s



~ 2376 Legitimates filtered by white list
End of the scan (929 lines in 11mn 46s)(0)

Publicité


Signaler le contenu de ce document

Publicité