Publicité
Publicité
Format du document : text/plain
Prévisualisation
~ Rapport de ZHPDiag v2014.4.12.21 - Nicolas Coolman (12/04/2014)
~ Lancé par DEBRUYNE JOSIANE (12/04/2014 15:55:23)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by program
---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.17031 (Defaut)
MFIE: Mozilla Firefox 28.0
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 8.1 Pro, 32-bit (Build 9600)
Windows Server License Manager Script : OK
---\\ Logiciels de protection du système
Windows Defender W8
---\\ Logiciels d'optimisation du système
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 13 Plugin
---\\ Informations sur le système
~ Processor: x86 Family 15 Model 4 Stepping 9, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1022 MB (21% free)
System Restore: Désactivé (Disabled)
System drive C: has 110 GB (73%) free of 149 GB
---\\ Mode de connexion au système
~ Computer Name: MAISON-101E0972
~ User Name: DEBRUYNE JOSIANE
~ All Users Names: UpdatusUser, SUPPORT_388945a0, HelpAssistant, DEBRUYNE JOSIANE, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\
~ %Desktop% : C:\Users\DEBRUYNE JOSIANE\Desktop\
~ %Favorites% : C:\Users\DEBRUYNE JOSIANE\Favorites\
~ %LocalAppData% : C:\Users\DEBRUYNE JOSIANE\AppData\Local\
~ %StartMenu% : C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
A: Floppy drive, Flash card reader, USB Key (Not Inserted)
C: Hard drive, Flash drive, Thumb drive (Free 110 Go of 149 Go)
D: Hard drive, Flash drive, Thumb drive (Free 9 Go of 10 Go)
E: CD-ROM drive (Not Inserted)
---\\ Etat du Centre de Sécurité Windows
~ Security Center: 37 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.119E091B5386379BC5AA598BE9440C75] - (.Microsoft Corporation - Explorateur Windows.) (.11/04/2014 - 21:53:39.) -- C:\Windows\Explorer.exe [2088160]
[MD5.02BC073156B3097E94D63C4D609020DD] - (.Microsoft Corporation - Application de démarrage de Windows.) (.22/08/2013 - 03:49:55.) -- C:\Windows\System32\Wininit.exe [112640]
[MD5.F89C2BDB6E385ED6CA2AC0085BB6643A] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.18/03/2014 - 08:59:52.) -- C:\Windows\System32\wininet.dll [1789440]
[MD5.70C57DC69D4A7D92D2CAC90C3AD16E6F] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.18/03/2014 - 08:59:51.) -- C:\Windows\System32\Winlogon.exe [459264]
[MD5.BFB9E1202225113991F981D29BFB9029] - (.Microsoft Corporation - Bibliothèque de licences.) (.18/03/2014 - 08:59:51.) -- C:\Windows\System32\sppcomapi.dll [438272]
[MD5.2AF7DA157FFF947A507FCB4AB8BB4C7C] - (.Microsoft Corporation - Pilote de fonction connexe pour WinSock.) (.22/08/2013 - 07:13:54.) -- C:\Windows\system32\Drivers\AFD.sys [455168]
[MD5.72FCAE2CE6DFEAB2AB072435017F3417] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.22/08/2013 - 06:33:25.) -- C:\Windows\system32\Drivers\atapi.sys [23392]
[MD5.CE232BB0965C0C0B786C3F976CCBFB7D] - (.Microsoft Corporation - CD-ROM File System Driver.) (.22/08/2013 - 05:11:55.) -- C:\Windows\system32\Drivers\Cdfs.sys [73728]
[MD5.E2FC132D48EA4E8B04432C33EFB77801] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.22/08/2013 - 02:59:12.) -- C:\Windows\system32\Drivers\Cdrom.sys [124928]
[MD5.55758EBBC45E1628161121D7CFEAD4A1] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.11/04/2014 - 21:53:38.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.A31901DE6A22EA67AB83AAF7036F98CC] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.22/08/2013 - 05:10:12.) -- C:\Windows\system32\Drivers\HDAudBus.sys [69632]
[MD5.5043E69532392A43549E5D41E22638AA] - (.Microsoft Corporation - Pilote de port i8042.) (.22/08/2013 - 05:10:59.) -- C:\Windows\system32\Drivers\i8042prt.sys [82944]
[MD5.FA6C94C754A566EA8A61D658932F32DE] - (.Microsoft Corporation - IP Network Address Translator.) (.18/03/2014 - 08:59:54.) -- C:\Windows\system32\Drivers\IpNat.sys [126976]
[MD5.3225D40D8CBA74A79D3B10879A14755E] - (.Microsoft Corporation - Minirdr SMB Windows NT.) (.11/04/2014 - 21:53:38.) -- C:\Windows\system32\Drivers\MRxSmb.sys [333824]
[MD5.BC242922B0D08F61CF7C87FD08FAFA8B] - (.Microsoft Corporation - MBT Transport driver.) (.22/08/2013 - 05:08:26.) -- C:\Windows\system32\Drivers\netBT.sys [218624]
[MD5.BAFDB3519A9D1A6A0665A70696BA98D5] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.11/04/2014 - 21:53:38.) -- C:\Windows\system32\Drivers\ntfs.sys [1679704]
[MD5.4F30970F15ADCC382544B31D5D7E368E] - (.Microsoft Corporation - Pilote de port parallèle.) (.22/08/2013 - 05:11:49.) -- C:\Windows\system32\Drivers\Parport.sys [81408]
[MD5.C51AB62AB41A2E8560D12472B204CC00] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.22/08/2013 - 05:07:36.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [81920]
[MD5.67E91843B0344411820A012063E876B2] - (.Microsoft Corporation - Redirecteur de périphérique de Microsoft RDP.) (.18/03/2014 - 08:38:09.) -- C:\Windows\system32\Drivers\rdpdr.sys [143872]
[MD5.DB0C184142CF9FA1746F598A16EE92B2] - (.Microsoft Corporation - TDI Translation Driver.) (.22/08/2013 - 07:13:54.) -- C:\Windows\system32\Drivers\tdx.sys [87040]
[MD5.085918BF459BCB835CFC535BE7138539] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.18/03/2014 - 08:59:36.) -- C:\Windows\system32\Drivers\volsnap.sys [265048]
~ Generic Processes: Scanned in 00mn 01s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 2/6
~ Mes musiques (My Musics) : 1/14
~ Mes Favoris (My Favorites) : 1/20
~ Mes Documents (My Documents) : 1/4120
~ Mon Bureau (My Desktop) : 5/168
~ Menu demarrer (Programs) : 1/29
~ Hidden Files: Scanned in 00mn 05s
---\\ Processus lancés
[MD5.6E3C60AC09E03CAEF32AE3DEFD0CC410] - (.Microsoft Corporation - IPoint.exe.) -- c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [1693904] [PID.5008]
[MD5.BFC91929336304802B21DC380F178444] - (.Microsoft Corporation - IType.exe.) -- c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1113296] [PID.3688]
[MD5.2197DED64442B4B342971598208A7D1A] - (.Microsoft Corporation - Processus hôte pour Tâches Windows.) -- C:\WINDOWS\system32\taskhostex.exe [66624] [PID.6080]
[MD5.CA8491E93B94F15E96939E9A8B651CF5] - (.Microsoft Corporation - OneDrive Sync Engine Host.) -- C:\Windows\System32\skydrive.exe [672256] [PID.3696]
[MD5.E0344E54C8327EBF7269B0FC47D38533] - (.NVIDIA Corporation - NVIDIA Settings.) -- C:\Program Files\NVIDIA Corporation\Display\nvtray.exe [1821032] [PID.4436]
[MD5.CDFFB0058BA113ED8C6099DE11FAAD49] - (.CANON INC. - Canon Quick Menu.) -- C:\Program Files\Canon\Quick Menu\CNQMMAIN.exe [1273448] [PID.5376]
[MD5.16AFB34618E1286FF856DC600AC49C79] - (.Pas de propriétaire - DivX Update.) -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe [1861968] [PID.220]
[MD5.847201672ECC9F15ED97F59F6CA2EBE6] - (.PriceMeter - PriceMeterW.) -- C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterw.exe [302080] [PID.2540] =>PUP.PriceMeter
[MD5.6429D2F9ABE84CE1A54E99ABAC439923] - (.PC Drivers Headquarters - Driver Restore.) -- C:\Program Files\Driver Restore\Driver Restore\DriverRestore.exe [3988856] [PID.1612]
[MD5.BE4F25620D39E7FA1A9CB715E2F60E96] - (.CANON INC. - Canon Quick Menu Updater.) -- C:\Program Files\Canon\Quick Menu\CNQMUPDT.exe [1087608] [PID.908]
[MD5.C2AFC01FA404ADFD3B915730C7DB2D55] - (.CANON INC. - Canon Quick Menu Image Display.) -- C:\Program Files\Canon\Quick Menu\CNQMSWCS.exe [940168] [PID.2200]
[MD5.DB0FE6E51909BEB42004242EB08FEF47] - (.Microsoft Corporation - Host Process for Setting Synchronization.) -- C:\Windows\System32\SettingSyncHost.exe [517120] [PID.2192]
[MD5.8E556A72D54F7E3B7844AB9217F02DD7] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe [275568] [PID.4304]
[MD5.CBA0013EBDE3F0B08B043F61857E9809] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files\Mozilla Firefox\plugin-container.exe [18544] [PID.4908]
[MD5.2F777711F4A380AACADBB85A3E7EBFCB] - (.Adobe Systems, Inc. - Adobe Flash Player 13.0 r0.) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerPlugin_13_0_0_182.exe [1864368] [PID.4920]
[MD5.5AD341E69E47F92588D42B4737D30C5A] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8210432] [PID.4312]
~ Processes Running: Scanned in 00mn 07s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\Mozilla\Firefox\Profiles\9gqwd3qc.default\prefs.js
C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\Mozilla\Firefox\Profiles\9gqwd3qc.default\user.js
M3 - MFPP: Plugins - [DEBRUYNE JOSIANE] -- C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\Mozilla\Firefox\Profiles\9gqwd3qc.default\searchplugins\Mysearchdial.xml =>Adware.MyWebSearch
M0 - MFSP: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] http://start.mysearchdial.com =>Adware.MyWebSearch
~ Firefox Browser: 8 Legitimates Filtered in 00mn 01s
---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com =>Adware.MyWebSearch
R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com =>Adware.MyWebSearch
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.PriceMeter - PriceMeterLiveUpdate Update.) (No version) -- (.not file.) =>PUP.PriceMeter
~ IE Browser: 9 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 01s
~ Nombre de lignes (Lines number): 21
---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: Amazon 1Button App for IE - {26B19FA4-E8A1-4A1B-A163-1A1E46F830DD} Clé orpheline
O2 - BHO: Mega Browse - {4e6cd411-ce62-4584-97ff-6afbcf6900af} . (.Mega Browse - Mega Browse.) -- C:\Program Files\Mega Browse\MegaBrowsebho.dll =>PUP.MegaBrowse
~ BHO: 6 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Canon Easy-WebPrint EX - [HKLM]{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} . (.CANON INC. - Easy-WebPrint EX.) -- C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} Clé orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Canon Quick Menu.lnk . (.CANON INC. - Canon Quick Menu.) -- C:\Program Files\Canon\Quick Menu\CNQMMAIN.exe
O4 - GS\Desktop [Public]: Driver Restore.lnk . (.PC Drivers Headquarters - Driver Restore.) -- C:\Program Files\Driver Restore\Driver Restore\DriverRestore.exe
O4 - GS\Desktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O4 - GS\Desktop [Public]: Puzzles Collection.lnk . (.Pavel Bobes - Jp2.) -- C:\Program Files\Micro Application\Puzzles Collection\jp2v.exe
O4 - GS\Program [Public]: Desktop.lnk - Clé orpheline
O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O4 - GS\QuickLaunch [DEBRUYNE JOSIANE]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [DEBRUYNE JOSIANE]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [DEBRUYNE JOSIANE]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O4 - GS\Program [DEBRUYNE JOSIANE]: Documents.lnk . (...) -- C:\Users\DEBRUYNE JOSIANE\Documents
O4 - GS\Program [DEBRUYNE JOSIANE]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop [DEBRUYNE JOSIANE]: AppSafe.lnk . (...) -- C:\Program Files\AppSafe\AppSafe.exe
O4 - GS\Desktop [DEBRUYNE JOSIANE]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop [DEBRUYNE JOSIANE]: iomega (H) - Raccourci.lnk - Clé orpheline
O4 - GS\Program [Administrateur]: Documents.lnk . (...) -- C:\Users\DEBRUYNE JOSIANE\Documents
~ Global Startup: 42 Legitimates Filtered in 00mn 02s
---\\ Applications lancées au démarrage du système (O4)
O4 - HKLM\..\Run: [CanonQuickMenu] . (.CANON INC. - Canon Quick Menu.) -- C:\Program Files\Canon\Quick Menu\CNQMMAIN.exe
O4 - HKLM\..\Run: [DivXMediaServer] . (.DivX, LLC - DivX DLNA Media Server.) -- C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe
O4 - HKLM\..\Run: [DivXUpdate] . (.Pas de propriétaire - DivX Update.) -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
O4 - HKCU\..\Run: [PriceMeterW] . (.PriceMeter - PriceMeterW.) -- C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterw.exe =>PUP.PriceMeter
O4 - HKCU\..\Run: [Driver Restore] . (.PC Drivers Headquarters - Driver Restore.) -- C:\Program Files\Driver Restore\Driver Restore\DriverRestore.exe
O4 - HKUS\S-1-5-21-1085031214-776561741-839522115-1004\..\Run: [PriceMeterW] . (.PriceMeter - PriceMeterW.) -- C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterw.exe =>PUP.PriceMeter
O4 - HKUS\S-1-5-21-1085031214-776561741-839522115-1004\..\Run: [Driver Restore] . (.PC Drivers Headquarters - Driver Restore.) -- C:\Program Files\Driver Restore\Driver Restore\DriverRestore.exe
~ Application: Scanned in 00mn 00s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft Office OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Site dans la Zone de confiance d'Internet Explorer (O15)
O15 - Trusted Zone: [HKCU\...\Domains] http.ma-config.com
O15 - Trusted Zone: [HKCU\...\Domains] http.touslesdrivers.com
~ IE Zone Confiance: Scanned in 00mn 00s
---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {3A226D85-574D-4272-B73C-DBCAECF709B3} ((no name)) - http://www.consoclicker.com/TNSClickrb.CAB
~ Objets ActiveX: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{45F54502-FBAF-4026-AE34-CFC044890D7D}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{45F54502-FBAF-4026-AE34-CFC044890D7D}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - AppInit_DLLs: . (...) - C:\Program Files\Amazon\AMAZON~1\AMAZON~1.dll (.not file.)
~ AppInit DLL: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: PriceMeterLiveUpdate Service (pricemeterliveUpdate) (pricemeterliveUpdate) . (.PriceMeter - PriceMeterLiveUpdate Update.) - C:\Program Files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe =>PUP.PriceMeter
~ Services: 4 Legitimates Filtered in 00mn 14s
---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\MySearchDial.job [352] =>Adware.MyWebSearch
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Price Meter Updater.job [352]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job [1002] =>PUP.PriceMeter
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job [1006] =>PUP.PriceMeter
[MD5.00000000000000000000000000000000] [APT] [CreateChoiceProcessTask] (...) -- C:\Windows\BrowserChoice\browserchoice.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [MySearchDial] (...) -- C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\MYSEAR~1\UPDATE~1\UPDATE~1.exe (.not file.) [0] =>Adware.MyWebSearch
[MD5.1245632D18B5337EB39BE78659C0936D] [APT] [Price Meter Updater] (...) -- C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\PRICEM~1\UPDATE~1\UPDATE~1.exe [272384]
[MD5.19ACD8C35E65B649D0D0D336502D446D] [APT] [pricemeterdownloader] (.PriceMeter.) -- C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterd.exe [370696] =>PUP.PriceMeter
[MD5.3D8B851E7EFCDC130E4B301BDDE10099] [APT] [PriceMeterLiveUpdateUpdateTaskMachineCore] (.PriceMeter.) -- C:\Program Files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [150504] =>PUP.PriceMeter
[MD5.3D8B851E7EFCDC130E4B301BDDE10099] [APT] [PriceMeterLiveUpdateUpdateTaskMachineUA] (.PriceMeter.) -- C:\Program Files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [150504] =>PUP.PriceMeter
[MD5.00000000000000000000000000000000] [APT] [pricemetertask] (...) -- C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\TEMP\pricemeter.exe (.not file.) [0] =>PUP.PriceMeter
[MD5.847201672ECC9F15ED97F59F6CA2EBE6] [APT] [pricemeterwatcher] (.PriceMeter.) -- C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterw.exe [302080] =>PUP.PriceMeter
~ Scheduled Task: 20 Legitimates Filtered in 00mn 23s
---\\ Logiciels installés (O42)
O42 - Logiciel: AppCloudUpdater - (.AppCloudUpdater.) [HKCU] -- AppCloudUpdater
O42 - Logiciel: Mega Browse - (.Mega Browse.) [HKLM] -- Mega Browse =>PUP.MegaBrowse
O42 - Logiciel: Puzzles Collection - (...) [HKLM] -- {C77A8277-C3BF-4260-A121-0AF897E12F18}
O42 - Logiciel: Update for PriceMeter - (.Update for PriceMeter.) [HKCU] -- Price Meter Updater =>PUP.PriceMeter
~ Logic: 16 Legitimates Filtered in 00mn 01s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\InstallCore] =>Adware.InstallCore
[HKCU\Software\Mega Browse] =>PUP.MegaBrowse
[HKCU\Software\ParetoLogic] =>PUP.Paretologic
[HKCU\Software\PriceMeterUpdater] =>PUP.PriceMeter
[HKCU\Software\PriceMeter] =>PUP.PriceMeter
[HKCU\Software\mysearchdial.com] =>Adware.MyWebSearch
[HKLM\Software\DealPlyLive] =>PUP.DealPly
[HKLM\Software\MySearchDial] =>Adware.MyWebSearch
[HKLM\Software\ParetoLogic] =>PUP.Paretologic
~ Key Software: 140 Legitimates Filtered in 00mn 01s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 08/04/2014 - 16:23:29 - [2,385] ----D C:\Program Files\Mega Browse =>PUP.MegaBrowse
O43 - CFD: 11/04/2014 - 10:55:39 - [0,564] ----D C:\Program Files\RegClean Pro =>Rogue.RegistryPowerCleaner
O43 - CFD: 10/04/2014 - 21:53:37 - [0] ----D C:\ProgramData\ParetoLogic =>PUP.Paretologic
O43 - CFD: 11/04/2014 - 10:23:07 - [1,063] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\1H1Q
O43 - CFD: 08/04/2014 - 16:18:21 - [0,103] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\AppCloudUpdater
O43 - CFD: 11/04/2014 - 10:24:20 - [0] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\mysearchdial =>Adware.MyWebSearch
O43 - CFD: 10/04/2014 - 19:34:52 - [0,127] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\ParetoLogic =>PUP.Paretologic
O43 - CFD: 11/04/2014 - 10:16:23 - [0,260] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\PriceMeterUpdater =>PUP.PriceMeter
O43 - CFD: 11/04/2014 - 23:02:02 - [0] -SH-D C:\Users\DEBRUYNE JOSIANE\AppData\Local\EmieSiteList
O43 - CFD: 11/04/2014 - 23:02:02 - [0] -SH-D C:\Users\DEBRUYNE JOSIANE\AppData\Local\EmieUserList
O43 - CFD: 11/04/2014 - 11:19:48 - [54,767] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter =>PUP.PriceMeter
O43 - CFD: 11/04/2014 - 22:31:34 - [0,001] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PriceMeter =>PUP.PriceMeter
~ Program Folder: 125 Legitimates Filtered in 00mn 50s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.93B885ADFE0DA089CDF634904FD59F71] - 07/04/2014 - 19:35:48 -SHA- . (...) -- C:\BOOTNXT [1]
O44 - LFC:[MD5.5731146B3F478A623843192385F644BD] - 11/04/2014 - 09:17:04 ---A- . (.Systweak Inc., (www.systweak.com) - Regclean Pro.) -- C:\Windows\System32\roboot.exe [18776] =>Rogue.RegistryPowerCleaner
O44 - LFC:[MD5.DDC0B6672AB7862A3C2D7AA2ADB6B645] - 11/04/2014 - 09:21:32 ---A- . (.Pas de propriétaire - Setup/Uninstall.) -- C:\Windows\unins000.exe [715038]
O44 - LFC:[MD5.FA425C74CE2EB719B2A77A7A2ADDAE32] - 11/04/2014 - 09:21:46 ---A- . (.Pas de propriétaire - Lagarith.) -- C:\Windows\System32\lagarith.dll [216064]
O44 - LFC:[MD5.94BE6C653028E67437D6D3650388ECF5] - 11/04/2014 - 09:21:52 ---A- . (...) -- C:\Windows\unins000.dat [1802]
O44 - LFC:[MD5.72C57D8501528179C6957E2F541CE215] - 11/04/2014 - 09:22:09 ---A- . (...) -- C:\Windows\System32\unrar.dll [178688]
O44 - LFC:[MD5.C0992C27E792440DA1DD5CFE8EE03E32] - 11/04/2014 - 09:22:45 ---A- . (.Pas de propriétaire - ffdshow VFW.) -- C:\Windows\System32\ff_vfw.dll [79360]
O44 - LFC:[MD5.348AC3C5B87056E24C9E0039332BFB66] - 11/04/2014 - 09:23:52 ---A- . (...) -- C:\Windows\System32\xvidvfw.dll [240640]
O44 - LFC:[MD5.E3833540C755C06EC18D414047448B14] - 11/04/2014 - 09:23:54 ---A- . (...) -- C:\Windows\System32\xvidcore.dll [645632]
O44 - LFC:[MD5.5E8CD1804C1A035311F5DA9C1048F024] - 11/04/2014 - 09:23:55 ---A- . (...) -- C:\Windows\System32\xvid.ax [153088]
O44 - LFC:[MD5.C8DF9379DBC36CF31FE4EB9FE925086F] - 11/04/2014 - 20:34:51 ---A- . (...) -- C:\Windows\WindowsUpdate (1).log [1732217]
O44 - LFC:[MD5.978CC1FB5226010639C73BF00D69799E] - 11/04/2014 - 21:11:09 ---A- . (...) -- C:\Windows\System32\lvcoinst.log [2775]
O44 - LFC:[MD5.91764D7D6153253AD851DB1839E5DEC1] - 11/04/2014 - 21:30:55 ---A- . (...) -- C:\Windows\DtcInstall.log [4893]
O44 - LFC:[MD5.A5C9E1A520F0EDE4A3D4A499D9C345A5] - 11/04/2014 - 21:42:10 ---A- . (...) -- C:\Windows\System32\emptyregdb.dat [21680]
O44 - LFC:[MD5.4C2B8733CC57D36D991EB331BEA626BB] - 11/04/2014 - 21:42:46 ---A- . (...) -- C:\Windows\comsetup.log [6645]
O44 - LFC:[MD5.A59CA020A52569657D064CD0D38495E4] - 11/04/2014 - 21:42:47 ---A- . (...) -- C:\Windows\diagerr.xml [30483]
O44 - LFC:[MD5.A59CA020A52569657D064CD0D38495E4] - 11/04/2014 - 21:42:47 ---A- . (...) -- C:\Windows\diagwrn.xml [30483]
O44 - LFC:[MD5.12B0701B1CEC1A7BB0E4C71D97661E23] - 11/04/2014 - 21:53:39 ---A- . (...) -- C:\Windows\System32\ApnDatabase.xml [387210]
~ Files: 192 Legitimates Filtered in 00mn 24s
---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 17 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.596DB7E4D0DB6AC32DF142C861001979] - 13/08/2013 - 00:25:32 ---A- . (.Windows (R) Win 7 DDK provider - BCM Function 2 Device Driver.) -- C:\Windows\System32\Drivers\bcmfn2.sys [16088]
O58 - SDL:[MD5.B4489EA5810BF73778CD8BDC305109CE] - 22/08/2013 - 06:32:57 ---A- . (.Promise Technology, Inc. - Promise SuperTrak EX Series Driver for Windows x86.) -- C:\Windows\System32\Drivers\stexstor.sys [26976]
~ Drivers: 17 Legitimates Filtered in 00mn 06s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("browser.search.defaultenginename", "Mysearchdial"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("browser.search.selectedEngine", "Mysearchdial"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("browser.startup.homepage", "http://start.mysearchdial.com/?f=1&a=dsites03_14_15_ie&cd=2XzuyEtN2Y1L1QzutDtDtCzyyCyCtCzy0[...] =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.AL", 2); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.aflt", "dsites03_14_15_ie"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.appId", "{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.cd", "2XzuyEtN2Y1L1QzutDtDtCzyyCyCtCzy0CyD0BtB0DyE0C0FtN0D0Tzu0SzztAtCtN1L2XzutBtFtBtDtFtCtFtDt[...] =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.cntry", "FR"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.cr", "1214897532"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.dfltLng", ""); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.dfltSrch", true); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.dnsErr", true); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.dpkLst", "3654782829,1334533236,1121012847,231756876,1895130307,603719297,4288797614,3754950497[...] =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.excTlbr", false); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.hdrMd5", "5D6E650ECCED0BCAE68EF51C6A128E67"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.hmpg", true); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.hmpgUrl", "http://start.mysearchdial.com/?f=1&a=dsites03_14_15_ie&cd=2XzuyEtN2Y1L1QzutDtDtCzyyC[...] =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.id", "00196619C5B2D4CF"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.instlDay", "16171"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.instlRef", "140305_b"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.lastB", "http://start.mysearchdial.com/?f=1&a=dsites03_14_15_ie&cd=2XzuyEtN2Y1L1QzutDtDtCzyyCyC[...] =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.lastVrsnTs", "1.8.29.010:16:48"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.newTabUrl", "http://start.mysearchdial.com/?f=2&a=dsites03_14_15_ie&cd=2XzuyEtN2Y1L1QzutDtDtCzy[...] =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.prdct", "mysearchdial"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.prtnrId", "mysearchdial"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.sg", "none"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.srchPrvdr", "Mysearchdial"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.tlbrId", "base"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.tlbrSrchUrl", "http://start.mysearchdial.com/?f=3&a=dsites03_14_15_ie&cd=2XzuyEtN2Y1L1QzutDtDtC[...] =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.vrsn", "1.8.29.0"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.vrsni", "1.8.29.0"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial_i.newTab", false); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial_i.smplGrp", "none"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial_i.vrsnTs", "1.8.29.010:16:48"); =>Adware.MyWebSearch
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {77AA745B-F4F8-45DA-9B14-61D2D95054C8} - (Mysearchdial) - http://start.mysearchdial.com =>Adware.MyWebSearch
~ Keys: Scanned in 00mn 00s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.02B84503B8540FFC1E4960975F3FC2B2] [SPRF][01/11/2007] (.TNS - Pas de description.) -- C:\Windows\Downloaded Program Files\TNSClickrb.dll [61440]
~ Files: 1 Legitimates Filtered in 00mn 00s
---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "8E031372C71173240AAF38BEFB110E15" . (.Driver Restore.) -- C:\WINDOWS\Installer\{273130E8-117C-4237-A0FA-83EBBF11E051}\ARPPRODUCTICON.exe
~ Update Products: 18 Legitimates Filtered in 00mn 00s
---\\ Enumère les données de la clé NameSpace (MNS) (O92)
O92 - MNS: - {1CF1260C-4DD0-4ebb-811F-33C572699FDE}
O92 - MNS: - {374DE290-123F-4565-9164-39C4925E467B}
O92 - MNS: - {3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}
O92 - MNS: - {A0953C92-50DC-43bf-BE83-3742FED03C9C}
O92 - MNS: - {A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}
O92 - MNS: - {B4BFCC3A-DB2C-424C-B029-7FE99A87C641}
~ MNS: 6 Legitimates Filtered in 00mn 00s
---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.84DE2F73A2ED897A50CCCEE6CD233843] [WIS][12/04/2014] (.Driver Restore - Driver Restore.) -- C:\Windows\Installer\249062f.msi [7377408]
~ WIS: 18 Legitimates Filtered in 00mn 02s
---\\ Recherche de clés de registre CLSID (O101)
[HKCR\CLSID\{126C78A0-36E7-4697-A3AB-32706144398B}] (PriceMeterLiveUpdate Legacy On Demand) =>PUP.PriceMeter
[HKCR\CLSID\{30D1E30D-B7F5-4C7A-8EDA-9F02966538A8}] (PriceMeterLiveUpdate.OneClickProcessLauncher) =>PUP.PriceMeter
[HKCR\CLSID\{41C35ADE-DEDA-439F-8140-D53F2C76C963}] (PriceMeterLiveUpdate Broker Class Factory) =>PUP.PriceMeter
[HKCR\CLSID\{4825ACAD-F495-4CDD-9603-9C91BABB2B88}] (PriceMeterLiveUpdate Legacy On Demand) =>PUP.PriceMeter
[HKCR\CLSID\{4e6cd411-ce62-4584-97ff-6afbcf6900af}] (Mega Browse) =>PUP.MegaBrowse
[HKCR\CLSID\{5B60D1C0-453A-485D-AE91-61FAC9203719}] (PriceMeterLiveUpdate Core Class) =>PUP.PriceMeter
[HKCR\CLSID\{89449F37-4AB2-46ED-A566-BB3A7797701B}] (PriceMeterLiveUpdate Update Plugin) =>PUP.PriceMeter
[HKCR\CLSID\{B1F29F0C-2EC8-487B-97C2-8B8FEA6CEF14}] (PriceMeterLiveUpdate Broker Class Factory) =>PUP.PriceMeter
[HKCR\CLSID\{C0756D99-64A1-4332-B783-A5A1B571D431}] (PriceMeterLiveUpdate Core Class) =>PUP.PriceMeter
[HKCR\CLSID\{D8746A3A-A372-4C8B-96E5-B58F6474EB19}] (PriceMeterLiveUpdate Process Launcher Class) =>PUP.PriceMeter
[HKCR\CLSID\{F509ADC2-B40E-470F-A7B7-45191486B5CB}] (PriceMeterLiveUpdate Update Plugin) =>PUP.PriceMeter
~ BCK: 5696 Legitimates Filtered in 00mn 25s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 09/04/2014 257712 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 15/03/2014 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Auto 11/04/2014 150504 | (pricemeterliveUpdate) . (.PriceMeter.) - C:\Program Files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe =>PUP.PriceMeter
SS - | Demand 11/04/2014 150504 | (pricemeterliveUpdatem) . (.PriceMeter.) - C:\Program Files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe =>PUP.PriceMeter
SS - | Demand 22/08/2013 31552 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 28/03/2012 140456 | (IJPLMSVC) . (...) - C:\Program Files\Canon\IJPLM\IJPLMSVC.exe
SR - | Auto 01/04/2014 2117960 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe
SR - | Auto 07/12/2012 645992 | (nvsvc) . (.NVIDIA Corporation.) - C:\WINDOWS\system32\nvvsvc.exe
SR - | Auto 22/08/2013 22240 | (WinDefend) . (.Microsoft Corporation.) - C:\Program Files\Windows Defender\MsMpEng.exe
~ Services: Scanned in 00mn 29s
---\\ Scan Additionnel (O88)
Database Version : 13044 - (12/04/2014)
Clés trouvées (Keys found) : 11
Valeurs trouvées (Values found) : 2
Dossiers trouvés (Folders found) : 8
Fichiers trouvés (Files found) : 23
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E6CD411-CE62-4584-97FF-6AFBCF6900AF}] =>PUP.MegaBrowse^
[HKLM\SYSTEM\CurrentControlSet\Services\pricemeterliveUpdate) (pricemeterliveUpdate] =>PUP.PriceMeter^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Mega Browse] =>PUP.MegaBrowse^
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Price Meter Updater] =>PUP.PriceMeter^
[HKLM\Software\Classes\AppID\esrv.EXE] =>PUP.Babylon
[HKCU\Software\InstallCore] =>Adware.InstallCore
[HKCU\Software\ParetoLogic] =>PUP.Paretologic
[HKLM\Software\ParetoLogic] =>PUP.Paretologic
[HKLM\Software\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}] =>Adware.BrowseFox
[HKLM\Software\Classes\esrv.mysearchdialESrvc] =>Adware.MyWebSearch
[HKLM\Software\Classes\esrv.mysearchdialESrvc.1] =>Adware.MyWebSearch
[HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks]:{CFBFAE00-17A6-11D0-99CB-00C04FD64497} =>PUP.PriceMeter^
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:PriceMeterW =>PUP.PriceMeter^
C:\Program Files\Mega Browse =>PUP.MegaBrowse^
C:\Program Files\RegClean Pro =>Rogue.RegistryPowerCleaner^
C:\ProgramData\ParetoLogic =>PUP.Paretologic^
C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\mysearchdial =>Adware.MyWebSearch^
C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\ParetoLogic =>PUP.Paretologic^
C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\PriceMeterUpdater =>PUP.PriceMeter^
C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter =>PUP.PriceMeter^
C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PriceMeter =>PUP.PriceMeter^
C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterw.exe =>PUP.PriceMeter^
C:\Windows\Tasks\MySearchDial.job =>Adware.MyWebSearch^
C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job =>PUP.PriceMeter^
C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job =>PUP.PriceMeter^
C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterd.exe =>PUP.PriceMeter^
C:\Program Files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe =>PUP.PriceMeter^
[HKCU\Software\Mega Browse] =>PUP.MegaBrowse^
[HKCU\Software\PriceMeterUpdater] =>PUP.PriceMeter^
[HKCU\Software\PriceMeter] =>PUP.PriceMeter^
[HKCU\Software\mysearchdial.com] =>Adware.MyWebSearch^
[HKLM\Software\DealPlyLive] =>PUP.DealPly^
[HKLM\Software\MySearchDial] =>Adware.MyWebSearch^
[HKCR\CLSID\{126C78A0-36E7-4697-A3AB-32706144398B}] (PriceMeterLiveUpdate Legacy On Demand) =>PUP.PriceMeter^
[HKCR\CLSID\{30D1E30D-B7F5-4C7A-8EDA-9F02966538A8}] (PriceMeterLiveUpdate.OneClickProcessLauncher) =>PUP.PriceMeter^
[HKCR\CLSID\{41C35ADE-DEDA-439F-8140-D53F2C76C963}] (PriceMeterLiveUpdate Broker Class Factory) =>PUP.PriceMeter^
[HKCR\CLSID\{4825ACAD-F495-4CDD-9603-9C91BABB2B88}] (PriceMeterLiveUpdate Legacy On Demand) =>PUP.PriceMeter^
[HKCR\CLSID\{4e6cd411-ce62-4584-97ff-6afbcf6900af}] (Mega Browse) =>PUP.MegaBrowse^
[HKCR\CLSID\{5B60D1C0-453A-485D-AE91-61FAC9203719}] (PriceMeterLiveUpdate Core Class) =>PUP.PriceMeter^
[HKCR\CLSID\{89449F37-4AB2-46ED-A566-BB3A7797701B}] (PriceMeterLiveUpdate Update Plugin) =>PUP.PriceMeter^
[HKCR\CLSID\{B1F29F0C-2EC8-487B-97C2-8B8FEA6CEF14}] (PriceMeterLiveUpdate Broker Class Factory) =>PUP.PriceMeter^
[HKCR\CLSID\{C0756D99-64A1-4332-B783-A5A1B571D431}] (PriceMeterLiveUpdate Core Class) =>PUP.PriceMeter^
[HKCR\CLSID\{D8746A3A-A372-4C8B-96E5-B58F6474EB19}] (PriceMeterLiveUpdate Process Launcher Class) =>PUP.PriceMeter^
[HKCR\CLSID\{F509ADC2-B40E-470F-A7B7-45191486B5CB}] (PriceMeterLiveUpdate Update Plugin) =>PUP.PriceMeter^
~ Additionnel Scan: 186276 Items scanned in 01mn 02s
---\\ Récapitulatif des détections trouvées sur votre station
http://nicolascoolman.webs.com/apps/blog/show/41981105-pup-pricemeter =>PUP.PriceMeter
http://nicolascoolman.webs.com/apps/blog/show/27146838-adware-mywebsearch =>Adware.MyWebSearch
http://nicolascoolman.webs.com/apps/blog/show/41917380-pup-megabrowse =>PUP.MegaBrowse
http://nicolascoolman.webs.com/apps/blog/show/29790567-adware-installcore =>Adware.InstallCore
http://nicolascoolman.webs.com/apps/blog/show/30068076-pup-paretologic =>PUP.Paretologic
http://nicolascoolman.webs.com/apps/blog/show/28060597-pup-dealply =>PUP.DealPly
http://nicolascoolman.webs.com/apps/blog/show/29295819-rogue-registrypowercleaner =>Rogue.RegistryPowerCleaner
http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon =>PUP.Babylon
http://nicolascoolman.webs.com/apps/blog/show/32363262-adware-browsefox =>Adware.BrowseFox
~ MSI: 9 link(s) detected in 00mn 00s
~ 915 Legitimates filtered by white list
End of the scan (541 lines in 04mn 44s)(0)
~ Lancé par DEBRUYNE JOSIANE (12/04/2014 15:55:23)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by program
---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.17031 (Defaut)
MFIE: Mozilla Firefox 28.0
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 8.1 Pro, 32-bit (Build 9600)
Windows Server License Manager Script : OK
---\\ Logiciels de protection du système
Windows Defender W8
---\\ Logiciels d'optimisation du système
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 13 Plugin
---\\ Informations sur le système
~ Processor: x86 Family 15 Model 4 Stepping 9, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1022 MB (21% free)
System Restore: Désactivé (Disabled)
System drive C: has 110 GB (73%) free of 149 GB
---\\ Mode de connexion au système
~ Computer Name: MAISON-101E0972
~ User Name: DEBRUYNE JOSIANE
~ All Users Names: UpdatusUser, SUPPORT_388945a0, HelpAssistant, DEBRUYNE JOSIANE, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\
~ %Desktop% : C:\Users\DEBRUYNE JOSIANE\Desktop\
~ %Favorites% : C:\Users\DEBRUYNE JOSIANE\Favorites\
~ %LocalAppData% : C:\Users\DEBRUYNE JOSIANE\AppData\Local\
~ %StartMenu% : C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
A: Floppy drive, Flash card reader, USB Key (Not Inserted)
C: Hard drive, Flash drive, Thumb drive (Free 110 Go of 149 Go)
D: Hard drive, Flash drive, Thumb drive (Free 9 Go of 10 Go)
E: CD-ROM drive (Not Inserted)
---\\ Etat du Centre de Sécurité Windows
~ Security Center: 37 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.119E091B5386379BC5AA598BE9440C75] - (.Microsoft Corporation - Explorateur Windows.) (.11/04/2014 - 21:53:39.) -- C:\Windows\Explorer.exe [2088160]
[MD5.02BC073156B3097E94D63C4D609020DD] - (.Microsoft Corporation - Application de démarrage de Windows.) (.22/08/2013 - 03:49:55.) -- C:\Windows\System32\Wininit.exe [112640]
[MD5.F89C2BDB6E385ED6CA2AC0085BB6643A] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.18/03/2014 - 08:59:52.) -- C:\Windows\System32\wininet.dll [1789440]
[MD5.70C57DC69D4A7D92D2CAC90C3AD16E6F] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.18/03/2014 - 08:59:51.) -- C:\Windows\System32\Winlogon.exe [459264]
[MD5.BFB9E1202225113991F981D29BFB9029] - (.Microsoft Corporation - Bibliothèque de licences.) (.18/03/2014 - 08:59:51.) -- C:\Windows\System32\sppcomapi.dll [438272]
[MD5.2AF7DA157FFF947A507FCB4AB8BB4C7C] - (.Microsoft Corporation - Pilote de fonction connexe pour WinSock.) (.22/08/2013 - 07:13:54.) -- C:\Windows\system32\Drivers\AFD.sys [455168]
[MD5.72FCAE2CE6DFEAB2AB072435017F3417] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.22/08/2013 - 06:33:25.) -- C:\Windows\system32\Drivers\atapi.sys [23392]
[MD5.CE232BB0965C0C0B786C3F976CCBFB7D] - (.Microsoft Corporation - CD-ROM File System Driver.) (.22/08/2013 - 05:11:55.) -- C:\Windows\system32\Drivers\Cdfs.sys [73728]
[MD5.E2FC132D48EA4E8B04432C33EFB77801] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.22/08/2013 - 02:59:12.) -- C:\Windows\system32\Drivers\Cdrom.sys [124928]
[MD5.55758EBBC45E1628161121D7CFEAD4A1] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.11/04/2014 - 21:53:38.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.A31901DE6A22EA67AB83AAF7036F98CC] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.22/08/2013 - 05:10:12.) -- C:\Windows\system32\Drivers\HDAudBus.sys [69632]
[MD5.5043E69532392A43549E5D41E22638AA] - (.Microsoft Corporation - Pilote de port i8042.) (.22/08/2013 - 05:10:59.) -- C:\Windows\system32\Drivers\i8042prt.sys [82944]
[MD5.FA6C94C754A566EA8A61D658932F32DE] - (.Microsoft Corporation - IP Network Address Translator.) (.18/03/2014 - 08:59:54.) -- C:\Windows\system32\Drivers\IpNat.sys [126976]
[MD5.3225D40D8CBA74A79D3B10879A14755E] - (.Microsoft Corporation - Minirdr SMB Windows NT.) (.11/04/2014 - 21:53:38.) -- C:\Windows\system32\Drivers\MRxSmb.sys [333824]
[MD5.BC242922B0D08F61CF7C87FD08FAFA8B] - (.Microsoft Corporation - MBT Transport driver.) (.22/08/2013 - 05:08:26.) -- C:\Windows\system32\Drivers\netBT.sys [218624]
[MD5.BAFDB3519A9D1A6A0665A70696BA98D5] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.11/04/2014 - 21:53:38.) -- C:\Windows\system32\Drivers\ntfs.sys [1679704]
[MD5.4F30970F15ADCC382544B31D5D7E368E] - (.Microsoft Corporation - Pilote de port parallèle.) (.22/08/2013 - 05:11:49.) -- C:\Windows\system32\Drivers\Parport.sys [81408]
[MD5.C51AB62AB41A2E8560D12472B204CC00] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.22/08/2013 - 05:07:36.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [81920]
[MD5.67E91843B0344411820A012063E876B2] - (.Microsoft Corporation - Redirecteur de périphérique de Microsoft RDP.) (.18/03/2014 - 08:38:09.) -- C:\Windows\system32\Drivers\rdpdr.sys [143872]
[MD5.DB0C184142CF9FA1746F598A16EE92B2] - (.Microsoft Corporation - TDI Translation Driver.) (.22/08/2013 - 07:13:54.) -- C:\Windows\system32\Drivers\tdx.sys [87040]
[MD5.085918BF459BCB835CFC535BE7138539] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.18/03/2014 - 08:59:36.) -- C:\Windows\system32\Drivers\volsnap.sys [265048]
~ Generic Processes: Scanned in 00mn 01s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 2/6
~ Mes musiques (My Musics) : 1/14
~ Mes Favoris (My Favorites) : 1/20
~ Mes Documents (My Documents) : 1/4120
~ Mon Bureau (My Desktop) : 5/168
~ Menu demarrer (Programs) : 1/29
~ Hidden Files: Scanned in 00mn 05s
---\\ Processus lancés
[MD5.6E3C60AC09E03CAEF32AE3DEFD0CC410] - (.Microsoft Corporation - IPoint.exe.) -- c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [1693904] [PID.5008]
[MD5.BFC91929336304802B21DC380F178444] - (.Microsoft Corporation - IType.exe.) -- c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1113296] [PID.3688]
[MD5.2197DED64442B4B342971598208A7D1A] - (.Microsoft Corporation - Processus hôte pour Tâches Windows.) -- C:\WINDOWS\system32\taskhostex.exe [66624] [PID.6080]
[MD5.CA8491E93B94F15E96939E9A8B651CF5] - (.Microsoft Corporation - OneDrive Sync Engine Host.) -- C:\Windows\System32\skydrive.exe [672256] [PID.3696]
[MD5.E0344E54C8327EBF7269B0FC47D38533] - (.NVIDIA Corporation - NVIDIA Settings.) -- C:\Program Files\NVIDIA Corporation\Display\nvtray.exe [1821032] [PID.4436]
[MD5.CDFFB0058BA113ED8C6099DE11FAAD49] - (.CANON INC. - Canon Quick Menu.) -- C:\Program Files\Canon\Quick Menu\CNQMMAIN.exe [1273448] [PID.5376]
[MD5.16AFB34618E1286FF856DC600AC49C79] - (.Pas de propriétaire - DivX Update.) -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe [1861968] [PID.220]
[MD5.847201672ECC9F15ED97F59F6CA2EBE6] - (.PriceMeter - PriceMeterW.) -- C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterw.exe [302080] [PID.2540] =>PUP.PriceMeter
[MD5.6429D2F9ABE84CE1A54E99ABAC439923] - (.PC Drivers Headquarters - Driver Restore.) -- C:\Program Files\Driver Restore\Driver Restore\DriverRestore.exe [3988856] [PID.1612]
[MD5.BE4F25620D39E7FA1A9CB715E2F60E96] - (.CANON INC. - Canon Quick Menu Updater.) -- C:\Program Files\Canon\Quick Menu\CNQMUPDT.exe [1087608] [PID.908]
[MD5.C2AFC01FA404ADFD3B915730C7DB2D55] - (.CANON INC. - Canon Quick Menu Image Display.) -- C:\Program Files\Canon\Quick Menu\CNQMSWCS.exe [940168] [PID.2200]
[MD5.DB0FE6E51909BEB42004242EB08FEF47] - (.Microsoft Corporation - Host Process for Setting Synchronization.) -- C:\Windows\System32\SettingSyncHost.exe [517120] [PID.2192]
[MD5.8E556A72D54F7E3B7844AB9217F02DD7] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe [275568] [PID.4304]
[MD5.CBA0013EBDE3F0B08B043F61857E9809] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files\Mozilla Firefox\plugin-container.exe [18544] [PID.4908]
[MD5.2F777711F4A380AACADBB85A3E7EBFCB] - (.Adobe Systems, Inc. - Adobe Flash Player 13.0 r0.) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerPlugin_13_0_0_182.exe [1864368] [PID.4920]
[MD5.5AD341E69E47F92588D42B4737D30C5A] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8210432] [PID.4312]
~ Processes Running: Scanned in 00mn 07s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\Mozilla\Firefox\Profiles\9gqwd3qc.default\prefs.js
C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\Mozilla\Firefox\Profiles\9gqwd3qc.default\user.js
M3 - MFPP: Plugins - [DEBRUYNE JOSIANE] -- C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\Mozilla\Firefox\Profiles\9gqwd3qc.default\searchplugins\Mysearchdial.xml =>Adware.MyWebSearch
M0 - MFSP: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] http://start.mysearchdial.com =>Adware.MyWebSearch
~ Firefox Browser: 8 Legitimates Filtered in 00mn 01s
---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com =>Adware.MyWebSearch
R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com =>Adware.MyWebSearch
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.PriceMeter - PriceMeterLiveUpdate Update.) (No version) -- (.not file.) =>PUP.PriceMeter
~ IE Browser: 9 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 01s
~ Nombre de lignes (Lines number): 21
---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: Amazon 1Button App for IE - {26B19FA4-E8A1-4A1B-A163-1A1E46F830DD} Clé orpheline
O2 - BHO: Mega Browse - {4e6cd411-ce62-4584-97ff-6afbcf6900af} . (.Mega Browse - Mega Browse.) -- C:\Program Files\Mega Browse\MegaBrowsebho.dll =>PUP.MegaBrowse
~ BHO: 6 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Canon Easy-WebPrint EX - [HKLM]{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} . (.CANON INC. - Easy-WebPrint EX.) -- C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} Clé orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Canon Quick Menu.lnk . (.CANON INC. - Canon Quick Menu.) -- C:\Program Files\Canon\Quick Menu\CNQMMAIN.exe
O4 - GS\Desktop [Public]: Driver Restore.lnk . (.PC Drivers Headquarters - Driver Restore.) -- C:\Program Files\Driver Restore\Driver Restore\DriverRestore.exe
O4 - GS\Desktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O4 - GS\Desktop [Public]: Puzzles Collection.lnk . (.Pavel Bobes - Jp2.) -- C:\Program Files\Micro Application\Puzzles Collection\jp2v.exe
O4 - GS\Program [Public]: Desktop.lnk - Clé orpheline
O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O4 - GS\QuickLaunch [DEBRUYNE JOSIANE]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [DEBRUYNE JOSIANE]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [DEBRUYNE JOSIANE]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O4 - GS\Program [DEBRUYNE JOSIANE]: Documents.lnk . (...) -- C:\Users\DEBRUYNE JOSIANE\Documents
O4 - GS\Program [DEBRUYNE JOSIANE]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop [DEBRUYNE JOSIANE]: AppSafe.lnk . (...) -- C:\Program Files\AppSafe\AppSafe.exe
O4 - GS\Desktop [DEBRUYNE JOSIANE]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop [DEBRUYNE JOSIANE]: iomega (H) - Raccourci.lnk - Clé orpheline
O4 - GS\Program [Administrateur]: Documents.lnk . (...) -- C:\Users\DEBRUYNE JOSIANE\Documents
~ Global Startup: 42 Legitimates Filtered in 00mn 02s
---\\ Applications lancées au démarrage du système (O4)
O4 - HKLM\..\Run: [CanonQuickMenu] . (.CANON INC. - Canon Quick Menu.) -- C:\Program Files\Canon\Quick Menu\CNQMMAIN.exe
O4 - HKLM\..\Run: [DivXMediaServer] . (.DivX, LLC - DivX DLNA Media Server.) -- C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe
O4 - HKLM\..\Run: [DivXUpdate] . (.Pas de propriétaire - DivX Update.) -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
O4 - HKCU\..\Run: [PriceMeterW] . (.PriceMeter - PriceMeterW.) -- C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterw.exe =>PUP.PriceMeter
O4 - HKCU\..\Run: [Driver Restore] . (.PC Drivers Headquarters - Driver Restore.) -- C:\Program Files\Driver Restore\Driver Restore\DriverRestore.exe
O4 - HKUS\S-1-5-21-1085031214-776561741-839522115-1004\..\Run: [PriceMeterW] . (.PriceMeter - PriceMeterW.) -- C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterw.exe =>PUP.PriceMeter
O4 - HKUS\S-1-5-21-1085031214-776561741-839522115-1004\..\Run: [Driver Restore] . (.PC Drivers Headquarters - Driver Restore.) -- C:\Program Files\Driver Restore\Driver Restore\DriverRestore.exe
~ Application: Scanned in 00mn 00s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft Office OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Site dans la Zone de confiance d'Internet Explorer (O15)
O15 - Trusted Zone: [HKCU\...\Domains] http.ma-config.com
O15 - Trusted Zone: [HKCU\...\Domains] http.touslesdrivers.com
~ IE Zone Confiance: Scanned in 00mn 00s
---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {3A226D85-574D-4272-B73C-DBCAECF709B3} ((no name)) - http://www.consoclicker.com/TNSClickrb.CAB
~ Objets ActiveX: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{45F54502-FBAF-4026-AE34-CFC044890D7D}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{45F54502-FBAF-4026-AE34-CFC044890D7D}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - AppInit_DLLs: . (...) - C:\Program Files\Amazon\AMAZON~1\AMAZON~1.dll (.not file.)
~ AppInit DLL: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: PriceMeterLiveUpdate Service (pricemeterliveUpdate) (pricemeterliveUpdate) . (.PriceMeter - PriceMeterLiveUpdate Update.) - C:\Program Files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe =>PUP.PriceMeter
~ Services: 4 Legitimates Filtered in 00mn 14s
---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\MySearchDial.job [352] =>Adware.MyWebSearch
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Price Meter Updater.job [352]
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job [1002] =>PUP.PriceMeter
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job [1006] =>PUP.PriceMeter
[MD5.00000000000000000000000000000000] [APT] [CreateChoiceProcessTask] (...) -- C:\Windows\BrowserChoice\browserchoice.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [MySearchDial] (...) -- C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\MYSEAR~1\UPDATE~1\UPDATE~1.exe (.not file.) [0] =>Adware.MyWebSearch
[MD5.1245632D18B5337EB39BE78659C0936D] [APT] [Price Meter Updater] (...) -- C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\PRICEM~1\UPDATE~1\UPDATE~1.exe [272384]
[MD5.19ACD8C35E65B649D0D0D336502D446D] [APT] [pricemeterdownloader] (.PriceMeter.) -- C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterd.exe [370696] =>PUP.PriceMeter
[MD5.3D8B851E7EFCDC130E4B301BDDE10099] [APT] [PriceMeterLiveUpdateUpdateTaskMachineCore] (.PriceMeter.) -- C:\Program Files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [150504] =>PUP.PriceMeter
[MD5.3D8B851E7EFCDC130E4B301BDDE10099] [APT] [PriceMeterLiveUpdateUpdateTaskMachineUA] (.PriceMeter.) -- C:\Program Files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [150504] =>PUP.PriceMeter
[MD5.00000000000000000000000000000000] [APT] [pricemetertask] (...) -- C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\TEMP\pricemeter.exe (.not file.) [0] =>PUP.PriceMeter
[MD5.847201672ECC9F15ED97F59F6CA2EBE6] [APT] [pricemeterwatcher] (.PriceMeter.) -- C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterw.exe [302080] =>PUP.PriceMeter
~ Scheduled Task: 20 Legitimates Filtered in 00mn 23s
---\\ Logiciels installés (O42)
O42 - Logiciel: AppCloudUpdater - (.AppCloudUpdater.) [HKCU] -- AppCloudUpdater
O42 - Logiciel: Mega Browse - (.Mega Browse.) [HKLM] -- Mega Browse =>PUP.MegaBrowse
O42 - Logiciel: Puzzles Collection - (...) [HKLM] -- {C77A8277-C3BF-4260-A121-0AF897E12F18}
O42 - Logiciel: Update for PriceMeter - (.Update for PriceMeter.) [HKCU] -- Price Meter Updater =>PUP.PriceMeter
~ Logic: 16 Legitimates Filtered in 00mn 01s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\InstallCore] =>Adware.InstallCore
[HKCU\Software\Mega Browse] =>PUP.MegaBrowse
[HKCU\Software\ParetoLogic] =>PUP.Paretologic
[HKCU\Software\PriceMeterUpdater] =>PUP.PriceMeter
[HKCU\Software\PriceMeter] =>PUP.PriceMeter
[HKCU\Software\mysearchdial.com] =>Adware.MyWebSearch
[HKLM\Software\DealPlyLive] =>PUP.DealPly
[HKLM\Software\MySearchDial] =>Adware.MyWebSearch
[HKLM\Software\ParetoLogic] =>PUP.Paretologic
~ Key Software: 140 Legitimates Filtered in 00mn 01s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 08/04/2014 - 16:23:29 - [2,385] ----D C:\Program Files\Mega Browse =>PUP.MegaBrowse
O43 - CFD: 11/04/2014 - 10:55:39 - [0,564] ----D C:\Program Files\RegClean Pro =>Rogue.RegistryPowerCleaner
O43 - CFD: 10/04/2014 - 21:53:37 - [0] ----D C:\ProgramData\ParetoLogic =>PUP.Paretologic
O43 - CFD: 11/04/2014 - 10:23:07 - [1,063] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\1H1Q
O43 - CFD: 08/04/2014 - 16:18:21 - [0,103] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\AppCloudUpdater
O43 - CFD: 11/04/2014 - 10:24:20 - [0] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\mysearchdial =>Adware.MyWebSearch
O43 - CFD: 10/04/2014 - 19:34:52 - [0,127] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\ParetoLogic =>PUP.Paretologic
O43 - CFD: 11/04/2014 - 10:16:23 - [0,260] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\PriceMeterUpdater =>PUP.PriceMeter
O43 - CFD: 11/04/2014 - 23:02:02 - [0] -SH-D C:\Users\DEBRUYNE JOSIANE\AppData\Local\EmieSiteList
O43 - CFD: 11/04/2014 - 23:02:02 - [0] -SH-D C:\Users\DEBRUYNE JOSIANE\AppData\Local\EmieUserList
O43 - CFD: 11/04/2014 - 11:19:48 - [54,767] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter =>PUP.PriceMeter
O43 - CFD: 11/04/2014 - 22:31:34 - [0,001] ----D C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PriceMeter =>PUP.PriceMeter
~ Program Folder: 125 Legitimates Filtered in 00mn 50s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.93B885ADFE0DA089CDF634904FD59F71] - 07/04/2014 - 19:35:48 -SHA- . (...) -- C:\BOOTNXT [1]
O44 - LFC:[MD5.5731146B3F478A623843192385F644BD] - 11/04/2014 - 09:17:04 ---A- . (.Systweak Inc., (www.systweak.com) - Regclean Pro.) -- C:\Windows\System32\roboot.exe [18776] =>Rogue.RegistryPowerCleaner
O44 - LFC:[MD5.DDC0B6672AB7862A3C2D7AA2ADB6B645] - 11/04/2014 - 09:21:32 ---A- . (.Pas de propriétaire - Setup/Uninstall.) -- C:\Windows\unins000.exe [715038]
O44 - LFC:[MD5.FA425C74CE2EB719B2A77A7A2ADDAE32] - 11/04/2014 - 09:21:46 ---A- . (.Pas de propriétaire - Lagarith.) -- C:\Windows\System32\lagarith.dll [216064]
O44 - LFC:[MD5.94BE6C653028E67437D6D3650388ECF5] - 11/04/2014 - 09:21:52 ---A- . (...) -- C:\Windows\unins000.dat [1802]
O44 - LFC:[MD5.72C57D8501528179C6957E2F541CE215] - 11/04/2014 - 09:22:09 ---A- . (...) -- C:\Windows\System32\unrar.dll [178688]
O44 - LFC:[MD5.C0992C27E792440DA1DD5CFE8EE03E32] - 11/04/2014 - 09:22:45 ---A- . (.Pas de propriétaire - ffdshow VFW.) -- C:\Windows\System32\ff_vfw.dll [79360]
O44 - LFC:[MD5.348AC3C5B87056E24C9E0039332BFB66] - 11/04/2014 - 09:23:52 ---A- . (...) -- C:\Windows\System32\xvidvfw.dll [240640]
O44 - LFC:[MD5.E3833540C755C06EC18D414047448B14] - 11/04/2014 - 09:23:54 ---A- . (...) -- C:\Windows\System32\xvidcore.dll [645632]
O44 - LFC:[MD5.5E8CD1804C1A035311F5DA9C1048F024] - 11/04/2014 - 09:23:55 ---A- . (...) -- C:\Windows\System32\xvid.ax [153088]
O44 - LFC:[MD5.C8DF9379DBC36CF31FE4EB9FE925086F] - 11/04/2014 - 20:34:51 ---A- . (...) -- C:\Windows\WindowsUpdate (1).log [1732217]
O44 - LFC:[MD5.978CC1FB5226010639C73BF00D69799E] - 11/04/2014 - 21:11:09 ---A- . (...) -- C:\Windows\System32\lvcoinst.log [2775]
O44 - LFC:[MD5.91764D7D6153253AD851DB1839E5DEC1] - 11/04/2014 - 21:30:55 ---A- . (...) -- C:\Windows\DtcInstall.log [4893]
O44 - LFC:[MD5.A5C9E1A520F0EDE4A3D4A499D9C345A5] - 11/04/2014 - 21:42:10 ---A- . (...) -- C:\Windows\System32\emptyregdb.dat [21680]
O44 - LFC:[MD5.4C2B8733CC57D36D991EB331BEA626BB] - 11/04/2014 - 21:42:46 ---A- . (...) -- C:\Windows\comsetup.log [6645]
O44 - LFC:[MD5.A59CA020A52569657D064CD0D38495E4] - 11/04/2014 - 21:42:47 ---A- . (...) -- C:\Windows\diagerr.xml [30483]
O44 - LFC:[MD5.A59CA020A52569657D064CD0D38495E4] - 11/04/2014 - 21:42:47 ---A- . (...) -- C:\Windows\diagwrn.xml [30483]
O44 - LFC:[MD5.12B0701B1CEC1A7BB0E4C71D97661E23] - 11/04/2014 - 21:53:39 ---A- . (...) -- C:\Windows\System32\ApnDatabase.xml [387210]
~ Files: 192 Legitimates Filtered in 00mn 24s
---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 17 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.596DB7E4D0DB6AC32DF142C861001979] - 13/08/2013 - 00:25:32 ---A- . (.Windows (R) Win 7 DDK provider - BCM Function 2 Device Driver.) -- C:\Windows\System32\Drivers\bcmfn2.sys [16088]
O58 - SDL:[MD5.B4489EA5810BF73778CD8BDC305109CE] - 22/08/2013 - 06:32:57 ---A- . (.Promise Technology, Inc. - Promise SuperTrak EX Series Driver for Windows x86.) -- C:\Windows\System32\Drivers\stexstor.sys [26976]
~ Drivers: 17 Legitimates Filtered in 00mn 06s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet:
O68 - StartMenuInternet:
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("browser.search.defaultenginename", "Mysearchdial"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("browser.search.selectedEngine", "Mysearchdial"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("browser.startup.homepage", "http://start.mysearchdial.com/?f=1&a=dsites03_14_15_ie&cd=2XzuyEtN2Y1L1QzutDtDtCzyyCyCtCzy0[...] =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.AL", 2); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.aflt", "dsites03_14_15_ie"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.appId", "{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.cd", "2XzuyEtN2Y1L1QzutDtDtCzyyCyCtCzy0CyD0BtB0DyE0C0FtN0D0Tzu0SzztAtCtN1L2XzutBtFtBtDtFtCtFtDt[...] =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.cntry", "FR"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.cr", "1214897532"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.dfltLng", ""); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.dfltSrch", true); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.dnsErr", true); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.dpkLst", "3654782829,1334533236,1121012847,231756876,1895130307,603719297,4288797614,3754950497[...] =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.excTlbr", false); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.hdrMd5", "5D6E650ECCED0BCAE68EF51C6A128E67"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.hmpg", true); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.hmpgUrl", "http://start.mysearchdial.com/?f=1&a=dsites03_14_15_ie&cd=2XzuyEtN2Y1L1QzutDtDtCzyyC[...] =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.id", "00196619C5B2D4CF"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.instlDay", "16171"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.instlRef", "140305_b"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.lastB", "http://start.mysearchdial.com/?f=1&a=dsites03_14_15_ie&cd=2XzuyEtN2Y1L1QzutDtDtCzyyCyC[...] =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.lastVrsnTs", "1.8.29.010:16:48"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.newTabUrl", "http://start.mysearchdial.com/?f=2&a=dsites03_14_15_ie&cd=2XzuyEtN2Y1L1QzutDtDtCzy[...] =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.prdct", "mysearchdial"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.prtnrId", "mysearchdial"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.sg", "none"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.srchPrvdr", "Mysearchdial"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.tlbrId", "base"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.tlbrSrchUrl", "http://start.mysearchdial.com/?f=3&a=dsites03_14_15_ie&cd=2XzuyEtN2Y1L1QzutDtDtC[...] =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.vrsn", "1.8.29.0"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial.vrsni", "1.8.29.0"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial_i.newTab", false); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial_i.smplGrp", "none"); =>Adware.MyWebSearch
O69 - SBI: prefs.js [DEBRUYNE JOSIANE - 9gqwd3qc.default] user_pref("extensions.mysearchdial_i.vrsnTs", "1.8.29.010:16:48"); =>Adware.MyWebSearch
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {77AA745B-F4F8-45DA-9B14-61D2D95054C8} - (Mysearchdial) - http://start.mysearchdial.com =>Adware.MyWebSearch
~ Keys: Scanned in 00mn 00s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.02B84503B8540FFC1E4960975F3FC2B2] [SPRF][01/11/2007] (.TNS - Pas de description.) -- C:\Windows\Downloaded Program Files\TNSClickrb.dll [61440]
~ Files: 1 Legitimates Filtered in 00mn 00s
---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "8E031372C71173240AAF38BEFB110E15" . (.Driver Restore.) -- C:\WINDOWS\Installer\{273130E8-117C-4237-A0FA-83EBBF11E051}\ARPPRODUCTICON.exe
~ Update Products: 18 Legitimates Filtered in 00mn 00s
---\\ Enumère les données de la clé NameSpace (MNS) (O92)
O92 - MNS: - {1CF1260C-4DD0-4ebb-811F-33C572699FDE}
O92 - MNS: - {374DE290-123F-4565-9164-39C4925E467B}
O92 - MNS: - {3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}
O92 - MNS: - {A0953C92-50DC-43bf-BE83-3742FED03C9C}
O92 - MNS: - {A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}
O92 - MNS: - {B4BFCC3A-DB2C-424C-B029-7FE99A87C641}
~ MNS: 6 Legitimates Filtered in 00mn 00s
---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.84DE2F73A2ED897A50CCCEE6CD233843] [WIS][12/04/2014] (.Driver Restore - Driver Restore.) -- C:\Windows\Installer\249062f.msi [7377408]
~ WIS: 18 Legitimates Filtered in 00mn 02s
---\\ Recherche de clés de registre CLSID (O101)
[HKCR\CLSID\{126C78A0-36E7-4697-A3AB-32706144398B}] (PriceMeterLiveUpdate Legacy On Demand) =>PUP.PriceMeter
[HKCR\CLSID\{30D1E30D-B7F5-4C7A-8EDA-9F02966538A8}] (PriceMeterLiveUpdate.OneClickProcessLauncher) =>PUP.PriceMeter
[HKCR\CLSID\{41C35ADE-DEDA-439F-8140-D53F2C76C963}] (PriceMeterLiveUpdate Broker Class Factory) =>PUP.PriceMeter
[HKCR\CLSID\{4825ACAD-F495-4CDD-9603-9C91BABB2B88}] (PriceMeterLiveUpdate Legacy On Demand) =>PUP.PriceMeter
[HKCR\CLSID\{4e6cd411-ce62-4584-97ff-6afbcf6900af}] (Mega Browse) =>PUP.MegaBrowse
[HKCR\CLSID\{5B60D1C0-453A-485D-AE91-61FAC9203719}] (PriceMeterLiveUpdate Core Class) =>PUP.PriceMeter
[HKCR\CLSID\{89449F37-4AB2-46ED-A566-BB3A7797701B}] (PriceMeterLiveUpdate Update Plugin) =>PUP.PriceMeter
[HKCR\CLSID\{B1F29F0C-2EC8-487B-97C2-8B8FEA6CEF14}] (PriceMeterLiveUpdate Broker Class Factory) =>PUP.PriceMeter
[HKCR\CLSID\{C0756D99-64A1-4332-B783-A5A1B571D431}] (PriceMeterLiveUpdate Core Class) =>PUP.PriceMeter
[HKCR\CLSID\{D8746A3A-A372-4C8B-96E5-B58F6474EB19}] (PriceMeterLiveUpdate Process Launcher Class) =>PUP.PriceMeter
[HKCR\CLSID\{F509ADC2-B40E-470F-A7B7-45191486B5CB}] (PriceMeterLiveUpdate Update Plugin) =>PUP.PriceMeter
~ BCK: 5696 Legitimates Filtered in 00mn 25s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 09/04/2014 257712 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 15/03/2014 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Auto 11/04/2014 150504 | (pricemeterliveUpdate) . (.PriceMeter.) - C:\Program Files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe =>PUP.PriceMeter
SS - | Demand 11/04/2014 150504 | (pricemeterliveUpdatem) . (.PriceMeter.) - C:\Program Files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe =>PUP.PriceMeter
SS - | Demand 22/08/2013 31552 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 28/03/2012 140456 | (IJPLMSVC) . (...) - C:\Program Files\Canon\IJPLM\IJPLMSVC.exe
SR - | Auto 01/04/2014 2117960 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe
SR - | Auto 07/12/2012 645992 | (nvsvc) . (.NVIDIA Corporation.) - C:\WINDOWS\system32\nvvsvc.exe
SR - | Auto 22/08/2013 22240 | (WinDefend) . (.Microsoft Corporation.) - C:\Program Files\Windows Defender\MsMpEng.exe
~ Services: Scanned in 00mn 29s
---\\ Scan Additionnel (O88)
Database Version : 13044 - (12/04/2014)
Clés trouvées (Keys found) : 11
Valeurs trouvées (Values found) : 2
Dossiers trouvés (Folders found) : 8
Fichiers trouvés (Files found) : 23
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E6CD411-CE62-4584-97FF-6AFBCF6900AF}] =>PUP.MegaBrowse^
[HKLM\SYSTEM\CurrentControlSet\Services\pricemeterliveUpdate) (pricemeterliveUpdate] =>PUP.PriceMeter^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Mega Browse] =>PUP.MegaBrowse^
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Price Meter Updater] =>PUP.PriceMeter^
[HKLM\Software\Classes\AppID\esrv.EXE] =>PUP.Babylon
[HKCU\Software\InstallCore] =>Adware.InstallCore
[HKCU\Software\ParetoLogic] =>PUP.Paretologic
[HKLM\Software\ParetoLogic] =>PUP.Paretologic
[HKLM\Software\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}] =>Adware.BrowseFox
[HKLM\Software\Classes\esrv.mysearchdialESrvc] =>Adware.MyWebSearch
[HKLM\Software\Classes\esrv.mysearchdialESrvc.1] =>Adware.MyWebSearch
[HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks]:{CFBFAE00-17A6-11D0-99CB-00C04FD64497} =>PUP.PriceMeter^
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:PriceMeterW =>PUP.PriceMeter^
C:\Program Files\Mega Browse =>PUP.MegaBrowse^
C:\Program Files\RegClean Pro =>Rogue.RegistryPowerCleaner^
C:\ProgramData\ParetoLogic =>PUP.Paretologic^
C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\mysearchdial =>Adware.MyWebSearch^
C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\ParetoLogic =>PUP.Paretologic^
C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\PriceMeterUpdater =>PUP.PriceMeter^
C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter =>PUP.PriceMeter^
C:\Users\DEBRUYNE JOSIANE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PriceMeter =>PUP.PriceMeter^
C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterw.exe =>PUP.PriceMeter^
C:\Windows\Tasks\MySearchDial.job =>Adware.MyWebSearch^
C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job =>PUP.PriceMeter^
C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job =>PUP.PriceMeter^
C:\Users\DEBRUYNE JOSIANE\AppData\Local\PriceMeter\pricemeterd.exe =>PUP.PriceMeter^
C:\Program Files\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe =>PUP.PriceMeter^
[HKCU\Software\Mega Browse] =>PUP.MegaBrowse^
[HKCU\Software\PriceMeterUpdater] =>PUP.PriceMeter^
[HKCU\Software\PriceMeter] =>PUP.PriceMeter^
[HKCU\Software\mysearchdial.com] =>Adware.MyWebSearch^
[HKLM\Software\DealPlyLive] =>PUP.DealPly^
[HKLM\Software\MySearchDial] =>Adware.MyWebSearch^
[HKCR\CLSID\{126C78A0-36E7-4697-A3AB-32706144398B}] (PriceMeterLiveUpdate Legacy On Demand) =>PUP.PriceMeter^
[HKCR\CLSID\{30D1E30D-B7F5-4C7A-8EDA-9F02966538A8}] (PriceMeterLiveUpdate.OneClickProcessLauncher) =>PUP.PriceMeter^
[HKCR\CLSID\{41C35ADE-DEDA-439F-8140-D53F2C76C963}] (PriceMeterLiveUpdate Broker Class Factory) =>PUP.PriceMeter^
[HKCR\CLSID\{4825ACAD-F495-4CDD-9603-9C91BABB2B88}] (PriceMeterLiveUpdate Legacy On Demand) =>PUP.PriceMeter^
[HKCR\CLSID\{4e6cd411-ce62-4584-97ff-6afbcf6900af}] (Mega Browse) =>PUP.MegaBrowse^
[HKCR\CLSID\{5B60D1C0-453A-485D-AE91-61FAC9203719}] (PriceMeterLiveUpdate Core Class) =>PUP.PriceMeter^
[HKCR\CLSID\{89449F37-4AB2-46ED-A566-BB3A7797701B}] (PriceMeterLiveUpdate Update Plugin) =>PUP.PriceMeter^
[HKCR\CLSID\{B1F29F0C-2EC8-487B-97C2-8B8FEA6CEF14}] (PriceMeterLiveUpdate Broker Class Factory) =>PUP.PriceMeter^
[HKCR\CLSID\{C0756D99-64A1-4332-B783-A5A1B571D431}] (PriceMeterLiveUpdate Core Class) =>PUP.PriceMeter^
[HKCR\CLSID\{D8746A3A-A372-4C8B-96E5-B58F6474EB19}] (PriceMeterLiveUpdate Process Launcher Class) =>PUP.PriceMeter^
[HKCR\CLSID\{F509ADC2-B40E-470F-A7B7-45191486B5CB}] (PriceMeterLiveUpdate Update Plugin) =>PUP.PriceMeter^
~ Additionnel Scan: 186276 Items scanned in 01mn 02s
---\\ Récapitulatif des détections trouvées sur votre station
http://nicolascoolman.webs.com/apps/blog/show/41981105-pup-pricemeter =>PUP.PriceMeter
http://nicolascoolman.webs.com/apps/blog/show/27146838-adware-mywebsearch =>Adware.MyWebSearch
http://nicolascoolman.webs.com/apps/blog/show/41917380-pup-megabrowse =>PUP.MegaBrowse
http://nicolascoolman.webs.com/apps/blog/show/29790567-adware-installcore =>Adware.InstallCore
http://nicolascoolman.webs.com/apps/blog/show/30068076-pup-paretologic =>PUP.Paretologic
http://nicolascoolman.webs.com/apps/blog/show/28060597-pup-dealply =>PUP.DealPly
http://nicolascoolman.webs.com/apps/blog/show/29295819-rogue-registrypowercleaner =>Rogue.RegistryPowerCleaner
http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon =>PUP.Babylon
http://nicolascoolman.webs.com/apps/blog/show/32363262-adware-browsefox =>Adware.BrowseFox
~ MSI: 9 link(s) detected in 00mn 00s
~ 915 Legitimates filtered by white list
End of the scan (541 lines in 04mn 44s)(0)