Publicité
Publicité
Format du document : text/plain
Prévisualisation
~ Rapport de ZHPDiag v2014.4.18.33 - Nicolas Coolman (18/04/2014)
~ Lancé par Male (18/04/2014 18:13:11)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by program
---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.17041
GCIE: Google Chrome v34.0.1847.116 (Defaut)
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Windows ID Activation : OK
~ Windows Partial Key : RWM9H
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ Logiciels de protection du système
Bitdefender Internet Security v17.23.0.996
Malwarebytes Anti-Malware version 1.75.0.1300
Windows Defender W7
---\\ Logiciels d'optimisation du système
CCleaner v4.11 =>.Piriform Ltd
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 12 Plugin
Java 7 Update 51
---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 58 Stepping 9, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 8175 MB (53% free)
System Restore: Activé (Enable)
System drive C: has 63 GB (35%) free of 180 GB
---\\ Mode de connexion au système
~ Computer Name: VENGEANCE
~ User Name: Male
~ All Users Names: Male, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Male\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Male\AppData\Roaming\
~ %Desktop% : C:\Users\Male\Desktop\
~ %Favorites% : C:\Users\Male\Favorites\
~ %LocalAppData% : C:\Users\Male\AppData\Local\
~ %StartMenu% : C:\Users\Male\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 63 Go of 180 Go)
D: Hard drive, Flash drive, Thumb drive (Free 97 Go of 286 Go)
E: CD-ROM drive (Not Inserted)
F: Floppy drive, Flash card reader, USB Key (Not Inserted)
G: Floppy drive, Flash card reader, USB Key (Not Inserted)
H: Floppy drive, Flash card reader, USB Key (Not Inserted)
I: Floppy drive, Flash card reader, USB Key (Not Inserted)
---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 41 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.F220BA78AB542C70211D73AE4729B2CD] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.06/03/2014 - 07:22:40.) -- C:\Windows\System32\wininet.dll [2260480]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.21/11/2010 - 04:24:29.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.21/11/2010 - 04:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/09/2013 - 02:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 04:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.24/01/2014 - 03:37:55.) -- C:\Windows\system32\Drivers\ntfs.sys [1684928]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 04:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/3660
~ Mes Videos (My Videos) : 1/67
~ Mes Favoris (My Favorites) : 1/26
~ Mes Documents (My Documents) : 1/13
~ Mon Bureau (My Desktop) : 1/1693
~ Menu demarrer (Programs) : 0/45
~ Hidden Files: Scanned in 00mn 00s
---\\ Processus lancés
[MD5.E98D481EEF14767B1615DE88674D307A] - (.ASUS - GPUTweak.) -- C:\Program Files (x86)\ASUS\GPU Tweak\GPUTweak.exe [3282680] [PID.2256]
[MD5.EE316C8D7C1B99412F2C8F1C64268182] - (.NVIDIA Corporation - NVIDIA GeForce Experience Backend.) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144] [PID.2736]
[MD5.597CF4BEDFDC81B8903982664CAC6ED0] - (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe [614232] [PID.1616]
[MD5.5E32AEE9866C484D041AA1C0776D6976] - (.Bogdan Sharkov - Clownfish for Skype.) -- C:\Program Files (x86)\Clownfish\Clownfish.exe [1313536] [PID.2484]
[MD5.6441EB9BA26BE495ECA68CF579BDCC8E] - (.Dropbox, Inc. - Dropbox.) -- C:\Users\Male\AppData\Roaming\Dropbox\bin\Dropbox.exe [32179440] [PID.3124]
[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336] [PID.3168]
[MD5.CDE6586CC383BCAC4D1E4F8A57DCB291] - (.Corsair Components, Inc. - Corsair Vengeance Headset.) -- C:\Program Files (x86)\Corsair\Corsair Headset Software\HeadsetControlPanel.exe [3167544] [PID.3180]
[MD5.A63DC5C2EA944E6657203E0C8EDEAF61] - (.Microsoft Corporation - COM Surrogate.) -- C:\Windows\SysWOW64\DllHost.exe [7168] [PID.3244]
[MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.2712]
[MD5.40B887A9D6EA6181E26CC82BF179096F] - (.ASUS - Monitor.) -- C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe [2701048] [PID.1476]
[MD5.2EBBBFC120593C683796092F2DDA0EFC] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [841032] [PID.4280]
[MD5.C0EAE6AC1C580FC39754180A3726180E] - (.Bitdefender - Bitdefender Wallet Chrome Extension Native.) -- C:\Program Files\Bitdefender\Bitdefender\Antispam32\pmbxcrnmh.exe [62664] [PID.4576]
[MD5.84FCBA7D88B92804A3D28A24DC5223EB] - (...) -- C:\ProgramData\BOINC\projects\aerospaceresearch.net_constellation\trackjack_0.10_windows_x86_64 [492288] [PID.5032] =>Hijacker.SearchNet
[MD5.161233DC79656145086BDBD6918A08D4] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8216576] [PID.2080]
[MD5.B5D2F4BF587FD60AF75B09EFC1AD0E0A] - (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [411936] [PID.1092]
[MD5.E536856E96A7605EBF580D62A868E5FE] - (...) -- C:\Windows\SysWOW64\ASGT.exe [55296] [PID.1624]
[MD5.8C856E531A1170F53AC6844E89CD0B5F] - (...) -- C:\Program Files (x86)\Dokan\DokanLibrary\mounter.exe [14848] [PID.1380]
[MD5.7E6B107120108B3A15BFECE0DE3201DB] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler.exe [228744] [PID.2440]
[MD5.65085456FD9A74D7F1A999520C299ECB] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376] [PID.4000]
[MD5.E0D7732F2D2E24B2DB3F67B6750295B8] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512] [PID.2704]
[MD5.6F5D2728019DCE7BFF3BAC1885CC0449] - (.NVIDIA Corporation - NVIDIA Network Service.) -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632] [PID.1744]
[MD5.E4E034F79D88B34C5B4BA28BAE2259F7] - (.Razer Inc. - RzKLService.) -- C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe [105448] [PID.3496]
[MD5.52069AEB42D3D0F97CBCA1085EBF55E6] - (.Intel Corporation - Intel(R) Dynamic Application Loader Host In.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432] [PID.6120]
[MD5.6DC3A4E939B0F3EE16B54C5EC431D8C1] - (.Intel Corporation - Intel(R) Local Management Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [390616] [PID.2324]
~ Processes Running: Scanned in 00mn 00s
---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Male\AppData\Local\Google\Chrome\User Data\Default\Preferences
G1 - GCS: Preference [User Data\Default] http://feed.snapdo.com =>Hijacker.SmartBar
G0 - GCSP: Preference [User Data\Default][HomePage] http://www.delta-search.com =>Toolbar.DeltaSearch
G2 - GCE: Preference [User Data\Default] [apdfllckaahabafndbhieahigkjlhalf] Google Drive v.6.3 (Activé)
G2 - GCE: Preference [User Data\Default] [ccahoghmggldkcdjiebjkidpfongdfbl] Bitdefender Wallet v.17.28.1 (Activé)
G2 - GCE: Preference [User Data\Default] [hkdmamhlklklmdocdapicehaaljgphkk] Prévisions Météo v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nfmgehhghdejfcdmbdiphiemhfpjeaaa] gorueAtssaver v.2.7 (Désactivé) =>PUP.GreatSaver
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Wallet v.0.0.6.1 (Activé)
---\\ Liste des dossiers d'extension Google Chrome
~ Google Lines Browser: 21 Legitimates Filtered in 00mn 03s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
O1 - Hosts: 54.204.28.26 achhmapmjlcjlomcbmbicbgkihghgnie
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 23
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Snap.Do - [HKLM]{ae07101b-46d4-4a98-af68-0333ea26e113} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation
~ Toolbar: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: ASUS GPU Tweak.lnk . (.ASUS - GPUTweak.) -- C:\Program Files (x86)\ASUS\GPU Tweak\GPUTweak.exe
O4 - GS\Desktop [Public]: GeForce Experience.lnk . (.NVIDIA - NVIDIA GeForce Experience.) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\GFExperience.exe
O4 - GS\Desktop [Public]: Intel(R) Extreme Tuning Utility.lnk . (.Intel(R) Corporation - PerfTune.) -- C:\Windows\Installer\{57482760-8D96-4DDB-B11A-E57180465EDE}\PerfTuneIcon.B089625E_E454_492E_B2F2_7E934E4807F0.exe
O4 - GS\Desktop [Public]: Oracle VM VirtualBox.lnk . (...) -- C:\Program Files (x86)\Oracle\VirtualBox\VirtualBox.exe (.not file.)
O4 - GS\Desktop [Public]: Razer Game Booster.lnk . (.Razer Inc. - RazerGameBooster.) -- C:\Program Files (x86)\Razer\Razer Game Booster\RazerGameBooster.exe
O4 - GS\QuickLaunch [Male]: BitTorrent.lnk . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Male\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent
O4 - GS\QuickLaunch [Male]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Male]: Oracle VM VirtualBox.lnk . (...) -- C:\Program Files (x86)\Oracle\VirtualBox\VirtualBox.exe (.not file.)
O4 - GS\TaskBar [Male]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [Male]: BitTorrent.lnk . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Male\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent
O4 - GS\Desktop [Male]: FurMark.lnk . (.Geeks3D (www.geeks3d.com) - FurMark - swiss made GPU stress test and Op.) -- C:\Program Files (x86)\Geeks3D\Benchmarks\FurMark_1.10.3\FurMark.exe
O4 - GS\Desktop [Male]: PC Remote Server.lnk . (.PC Remote - PC Remote Server.) -- C:\Program Files (x86)\PC Remote\PC Remote\PCRemote.exe
O4 - GS\Desktop [Male]: Recup - Raccourci.lnk . (...) -- D:\Recup
O4 - GS\Desktop [Male]: Smellyriver.TankInspector.exe - Raccourci.lnk . (.Smellyriver - Tank Inspector.) -- C:\Users\Male\Desktop\Nouveau dossier\Smellyriver.TankInspector.exe
~ Global Startup: 70 Legitimates Filtered in 00mn 01s
---\\ Applications lancées au démarrage du système (O4)
O4 - GS\Startup [Male]: Dropbox.lnk . (.Dropbox, Inc. - Dropbox.) -- C:\Users\Male\AppData\Roaming\Dropbox\bin\Dropbox.exe =>.Dropbox
O4 - HKLM\..\Run: [ShadowPlay] . (.NVIDIA Corporation - NVIDIA Capture Server Proxy.) -- C:\Windows\system32\nvspcap64.dll
O4 - HKLM\..\Run: [IAStorIcon] . (.Intel Corporation - Delayed launcher.) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =>.Realtek Semiconductor Corp
O4 - HKLM\..\Run: [Bdagent] . (.Bitdefender - Bitdefender Agent.) -- C:\Program Files\Bitdefender\Bitdefender\bdagent.exe
O4 - HKLM\..\Run: [NvBackend] . (.NVIDIA Corporation - NVIDIA GeForce Experience Backend.) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
O4 - HKLM\..\Run: [boinctray] . (.Space Sciences Laboratory - BOINC System Tray for Windows.) -- C:\Program Files\BOINC\boinctray.exe
O4 - HKLM\..\Run: [boincmgr] . (.Space Sciences Laboratory - BOINC Manager for Windows.) -- C:\Program Files\BOINC\boincmgr.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKCU\..\Run: [BitTorrent] . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Male\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent
O4 - HKCU\..\Run: [Bitdefender Wallet Agent] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe
O4 - HKCU\..\Run: [Bitdefender Wallet] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe
O4 - HKCU\..\Run: [Bitdefender Agent de l'application Wallet] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe
O4 - HKCU\..\Run: [PC Remote Server] . (.PC Remote - PC Remote Server.) -- C:\Program Files (x86)\PC Remote\PC Remote\PCRemote.exe
O4 - HKCU\..\Run: [Clownfish] . (.Bogdan Sharkov - Clownfish for Skype.) -- C:\Program Files (x86)\Clownfish\Clownfish.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe =>.DT Soft Ltd
O4 - HKCU\..\Run: [CCleaner Monitoring] . (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner64.exe =>.Piriform Ltd
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKLM\..\Wow6432Node\Run: [Corsair Headset Software] . (.Corsair Components, Inc. - Corsair Vengeance Headset.) -- C:\Program Files (x86)\Corsair\Corsair Headset Software\HeadsetControlPanel.exe
O4 - HKUS\.DEFAULT\..\Run: [Bitdefender Wallet Agent] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe
O4 - HKUS\.DEFAULT\..\Run: [Bitdefender Wallet] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe
O4 - HKUS\.DEFAULT\..\Run: [Bitdefender Agent de l'application Wallet] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe
O4 - HKUS\S-1-5-18\..\Run: [Bitdefender Wallet Agent] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe
O4 - HKUS\S-1-5-18\..\Run: [Bitdefender Wallet] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe
O4 - HKUS\S-1-5-18\..\Run: [Bitdefender Agent de l'application Wallet] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [BitTorrent] . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Male\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent
O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [Bitdefender Wallet Agent] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe
O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [Bitdefender Wallet] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe
O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [Bitdefender Agent de l'application Wallet] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe
O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [PC Remote Server] . (.PC Remote - PC Remote Server.) -- C:\Program Files (x86)\PC Remote\PC Remote\PCRemote.exe
O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [Clownfish] . (.Bogdan Sharkov - Clownfish for Skype.) -- C:\Program Files (x86)\Clownfish\Clownfish.exe
O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe =>.DT Soft Ltd
O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [CCleaner Monitoring] . (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner64.exe =>.Piriform Ltd
~ Application: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{38FEA77E-9FB4-4794-B08E-BE42886F8312}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{9A46A404-B4B9-402C-812A-187171ED3950}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{9A46A404-B4B9-402C-812A-187171ED3950}: DhcpDomain = netgear.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{38FEA77E-9FB4-4794-B08E-BE42886F8312}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{9A46A404-B4B9-402C-812A-187171ED3950}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{9A46A404-B4B9-402C-812A-187171ED3950}: DhcpDomain = netgear.com
O17 - HKLM\System\CS2\Services\Tcpip\..\{38FEA77E-9FB4-4794-B08E-BE42886F8312}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{9A46A404-B4B9-402C-812A-187171ED3950}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{9A46A404-B4B9-402C-812A-187171ED3950}: DhcpDomain = netgear.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: ASGT (ASGT) . (...) - C:\Windows\SysWOW64\ASGT.exe
O23 - Service: DokanMounter (DokanMounter) . (...) - C:\Program Files (x86)\Dokan\DokanLibrary\mounter.exe
O23 - Service: GS-Supporter (e81a9dc1) . (...) - C:\Program Files (x86)\gs-ena~1\AssistantSvc.dll (.not file.) =>PUP.SaveClicker
~ Services: 19 Legitimates Filtered in 00mn 06s
---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [SomotoUpdateCheckerAutoStart] (...) -- C:\Users\Male\AppData\Local\FilesFrog Update Checker\update_checker.exe (.not file.) [0] =>Adware.MegaSearch
~ Scheduled Task: 9 Legitimates Filtered in 00mn 02s
---\\ Logiciels installés (O42)
O42 - Logiciel: AndroozBarre M-B-v2.12e - (.Agia3D.) [HKLM][64Bits] -- {FAA33BD4-EC73-43BB-9E0D-D04FCB37D756}_is1
O42 - Logiciel: CashobarreV1.2 - (.Legend-Edition.) [HKCU][64Bits] -- 9573548c9ce6ad12
O42 - Logiciel: Click-CPM-Barre M-B-v2.12e - (.Agia3D.) [HKLM][64Bits] -- {0BE2D054-1DB5-4F22-A1A5-84481F7E42F5}_is1
O42 - Logiciel: Dead Surf - (.Legend Edition.) [HKCU][64Bits] -- ca5afe92da7ae5fe
O42 - Logiciel: DiscoveryBarre M-B-v2.15e - (.Agia3D.) [HKLM][64Bits] -- {4F1CFE21-CFA8-4BE9-8581-B403B51A9DCB}_is1
O42 - Logiciel: LPT System Updater Service - (.LPT.) [HKLM][64Bits] -- {BC0BF363-63AB-4FF7-8EF1-AE0D7F711B24} =>Adware.IncrediBar
O42 - Logiciel: LaBoitaKados M-B-v1.1 - (.Agia3D.) [HKLM][64Bits] -- {0B19DC32-C613-4B1C-8116-98A808261AE9}_is1
O42 - Logiciel: PackBarre - (.BPMconcept.) [HKLM][64Bits] -- {EF9C70A5-CE26-48A1-9578-172706628019} =>Adware.ADON
O42 - Logiciel: Soul-Code - (.Legend Edition.) [HKCU][64Bits] -- b04e6fc329b9f61e
O42 - Logiciel: Sun7Barre version 1.4 - (.WiwildBarre.) [HKLM][64Bits] -- {988B07B6-DCAE-4091-AC3F-14BDCCCEF63E}_is1
O42 - Logiciel: TunesBarre version 1.2 - (.TunesBarre.Com.) [HKLM][64Bits] -- {C045FCE6-E4EB-4D9C-881E-E959E053AA40}_is1 =>Toolbar.TunesBarre
O42 - Logiciel: pipilajeux - (.Legend Edition.) [HKCU][64Bits] -- f96643f978ef374a
O42 - Logiciel: v1.1 - (.Agia3D.) [HKLM][64Bits] -- {979B9A3E-EBFA-472B-9508-5A30A86C3551}_is1
~ Logic: 23 Legitimates Filtered in 00mn 00s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\ELIGCHK]
[HKCU\Software\Smartbar] =>Hijacker.SmartBar
~ Key Software: 245 Legitimates Filtered in 00mn 00s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 10/01/2014 - 20:57:12 - [] ----D C:\Program Files (x86)\PackBarre =>Adware.ADON
O43 - CFD: 04/02/2014 - 17:54:52 - [] ----D C:\Program Files (x86)\Sun7Barre
O43 - CFD: 10/01/2014 - 20:53:36 - [] ----D C:\Program Files (x86)\Thread Manager
O43 - CFD: 11/01/2014 - 23:03:10 - [] ----D C:\Program Files (x86)\TunesBarre =>Toolbar.TunesBarre
O43 - CFD: 17/01/2014 - 20:14:12 - [] ----D C:\ProgramData\87c24eac7fe2ee8d
O43 - CFD: 17/01/2014 - 20:12:59 - [] ----D C:\ProgramData\InstallMate =>PUP.Tarma
O43 - CFD: 12/03/2014 - 10:07:05 - [] ----D C:\Users\Male\AppData\Local\Smellyriver
O43 - CFD: 01/02/2014 - 19:40:59 - [] ----D C:\Users\Male\AppData\Local\Wiwild
O43 - CFD: 19/03/2014 - 18:54:52 - [] ----D C:\Users\Male\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Legend Edition
O43 - CFD: 11/01/2014 - 23:12:06 - [] ----D C:\Users\Male\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Legend-Edition
O43 - CFD: 10/01/2014 - 20:57:12 - [] ----D C:\Users\Male\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PackBarre =>Adware.ADON
~ Program Folder: 167 Legitimates Filtered in 00mn 00s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.2BF6DE757CBC9DC4D69FE9C0156BC762] - 17/04/2014 - 20:14:23 ---A- . (...) -- C:\bdlog.txt [105538]
~ Files: 47 Legitimates Filtered in 00mn 06s
---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.FA122BC1451B1B35B7814FBE1ACF1924] - 10/01/2011 - 13:51:40 ----- . (.Windows (R) Win 7 DDK provider - Dokan Filesystem Driver.) -- C:\Windows\System32\Drivers\dokan.sys [120408]
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:[MD5.FD291A75ECAF197F07BD2040C2A7322A] - 17/07/2013 - 14:23:50 ----- . (.Etron Technology Inc - Etron eXtensible Hub Driver..) -- C:\Windows\System32\Drivers\EtronHub3.sys [65408]
O58 - SDL:[MD5.DDE9068F9BAC0210195F217AA39B9276] - 17/07/2013 - 14:23:46 ----- . (.Etron Technology Inc - Etron eXtensible Host Controller Driver..) -- C:\Windows\System32\Drivers\EtronXHCI.sys [94208]
O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:[MD5.385044010950C76471A4F1AE47435157] - 19/04/2013 - 04:56:48 ---A- . (...) -- C:\Windows\System32\Drivers\nvflash.sys [15648]
O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
~ Drivers: 16 Legitimates Filtered in 00mn 01s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html>[HKLM\..\open\Command] (.Not Key.)
O67 - Shell Spawning: <.html>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <>[HKLM\..\Shell\open\Command] (.Not Key.)
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {006ee092-9658-4fd6-bd8e-a21a348e59f5} [DefaultScope] - (Web Search) - http://feed.snapdo.com =>Hijacker.SmartBar
~ Keys: Scanned in 00mn 00s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.F72FE7F8D1D7BB53383F95DB98BF1A82] [SPRF][08/01/2014] (...) -- C:\ProgramData\1389185697.bdinstall.bin [544510]
~ Files: 2 Legitimates Filtered in 00mn 00s
---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "266110108A678E141B8AF4881275A05C" . (.Advanced Archive Password Recovery.) -- C:\Windows\Installer\{01011662-76A8-41E8-B1A8-4F8821570AC5}\product_icon
~ Update Products: 28 Legitimates Filtered in 00mn 00s
---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.7A6570D2B4609776B65B7B8DFB5E34B5] [WIS][17/02/2014] (.PC Remote - PC Remote Server - Installer.) -- C:\Windows\Installer\11179c9.msi [1183744]
[MD5.CCF09B872963321F1A5018A24DA92FEC] [WIS][24/03/2014] (.LPT - LPT System Updater Service.) -- C:\Windows\Installer\28ce670.msi [1884160] =>Adware.IncrediBar
[MD5.4F23992ABF894691390C29F83F8CD758] [WIS][10/01/2014] (.BPMconcept - PackBarre.) -- C:\Windows\Installer\b03815c.msi [1646592] =>Adware.ADON
~ WIS: 31 Legitimates Filtered in 00mn 07s
---\\ Recherche de clés de registre Tracing (O100)
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BitTorrent [1]_RASAPI32 =>P2P.BitTorrent
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BitTorrent [1]_RASMANCS =>P2P.BitTorrent
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BitTorrent_RASAPI32 =>P2P.BitTorrent
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BitTorrent_RASMANCS =>P2P.BitTorrent
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SnapDo_RASAPI32 =>Hijacker.SmartBar
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SnapDo_RASMANCS =>Hijacker.SmartBar
~ BTK: 99 Legitimates Filtered in 00mn 00s
---\\ Recherche de clés de registre CLSID (O101)
[HKCR\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}] (SmartbarInternetExplorerBHOEngine) =>Hijacker.SmartBar
[HKCR\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}] (Snap.Do) =>Hijacker.SmartBar
~ BCK: 4429 Legitimates Filtered in 00mn 02s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 18/03/2014 257928 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Disabled 21/11/2013 77632 | (BdDesktopParental) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender\bdparentalservice.exe
SS - | Auto 10/07/1658 0 | (e81a9dc1) . (...) - C:\Program Files (x86)\gs-ena~1\AssistantSvc.dll
SS - | Auto 02/01/2014 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 02/01/2014 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Auto 21/11/2013 15720 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
SS - | Demand 01/02/2012 160256 | (ICCS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
SS - | Demand 11/05/2013 822232 | (Intel(R) Capability Licensing Service TCP IP Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
SS - | Auto 23/10/2013 172192 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Auto 17/01/2014 18384 | (XTU3SERVICE) . (.Intel(R) Corporation.) - C:\Program Files (x86)\Intel\Extreme Tuning Utility\XtuService.exe
SR - | Auto 17/01/2012 55296 | (ASGT) . (...) - C:\Windows\SysWOW64\ASGT.exe
SR - | Auto 10/01/2011 14848 | (DokanMounter) . (...) - C:\Program Files (x86)\Dokan\DokanLibrary\mounter.exe
SR - | Auto 11/05/2013 733696 | (Intel(R) Capability Licensing Service Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\iCLS Client\HeciServer.exe
SR - | Auto 27/08/2013 169432 | (jhi_service) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
SR - | Auto 27/08/2013 390616 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
SR - | Auto 25/10/2013 2768208 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe
SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
SR - | Auto 21/01/2014 1593632 | (NvNetworkService) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
SR - | Auto 21/01/2014 16939296 | (NvStreamSvc) . (.NVIDIA Corporation.) - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
SR - | Auto 08/02/2014 923936 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe
SR - | Auto 25/02/2014 105448 | (RzKLService) . (.Razer Inc..) - C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe
SR - | Auto 08/02/2014 411936 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
SR - | Auto 07/10/2013 67320 | (UPDATESRV) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender\updatesrv.exe
SR - | Auto 04/04/2014 1523728 | (VSSERV) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender\vsserv.exe
SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 03s
---\\ Scan Additionnel (O88)
Database Version : 13044 - (18/04/2014)
Clés trouvées (Keys found) : 17
Valeurs trouvées (Values found) : 3
Dossiers trouvés (Folders found) : 6
Fichiers trouvés (Files found) : 6
[HKLM\Software\Google\Chrome\Extensions\nfmgehhghdejfcdmbdiphiemhfpjeaaa] =>PUP.GreatSaver^
[HKLM\SYSTEM\CurrentControlSet\Services\e81a9dc1] =>PUP.SaveClicker^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{BC0BF363-63AB-4FF7-8EF1-AE0D7F711B24}] =>Adware.IncrediBar^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{EF9C70A5-CE26-48A1-9578-172706628019}] =>Adware.ADON^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{C045FCE6-E4EB-4D9C-881E-E959E053AA40}_is1] =>Toolbar.TunesBarre^
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}] =>Hijacker.SmartBar
[HKLM\Software\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}] =>Toolbar.Agent
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}] =>Toolbar.Agent
[HKLM\Software\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}] =>Hijacker.SmartBar
[HKLM\Software\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}] =>Hijacker.SmartBar
[HKLM\Software\Wow6432Node\Microsoft\Tracing\SnapDo_RASAPI32] =>Hijacker.SmartBar
[HKLM\Software\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}] =>Hijacker.SmartBar
[HKLM\Software\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}] =>Hijacker.SmartBar
[HKLM\Software\Wow6432Node\Microsoft\Tracing\SnapDo_RASMANCS] =>Hijacker.SmartBar
[HKLM\Software\Classes\CLSID\{ae07101b-46d4-4a98-af68-0333ea26e113}] =>Adware.Agent
[HKLM\Software\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}] =>Hijacker.SmartBar
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CA0054A5AB3EFFE4CB5660E44A1E7DCC] =>Adware.Boxore^
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:BitTorrent =>P2P.BitTorrent^
C:\Users\Male\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfmgehhghdejfcdmbdiphiemhfpjeaaa =>PUP.GreatSaver^
C:\Program Files (x86)\PackBarre =>Adware.ADON^
C:\Program Files (x86)\TunesBarre =>Toolbar.TunesBarre^
C:\ProgramData\InstallMate =>PUP.Tarma^
C:\Users\Male\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PackBarre =>Adware.ADON^
C:\Users\Male\AppData\Local\Software =>Adware.Boxore
C:\ProgramData\BOINC\projects\aerospaceresearch.net_constellation\trackjack_0.10_windows_x86_64 =>Hijacker.SearchNet^
[HKCU\Software\Smartbar] =>Hijacker.SmartBar^
C:\Windows\Installer\28ce670.msi =>Adware.IncrediBar^
C:\Windows\Installer\b03815c.msi =>Adware.ADON^
[HKCR\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}] (SmartbarInternetExplorerBHOEngine) =>Hijacker.SmartBar^
[HKCR\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}] (Snap.Do) =>Hijacker.SmartBar^
~ Additionnel Scan: 183791 Items scanned in 00mn 11s
---\\ Récapitulatif des détections trouvées sur votre station
http://nicolascoolman.webs.com/apps/blog/show/42042097-hijacker-searchnet =>Hijacker.SearchNet
http://nicolascoolman.webs.com/apps/blog/show/26990375-hijacker-smartbar =>Hijacker.SmartBar
http://nicolascoolman.webs.com/apps/blog/show/27875657-toolbar-deltasearch =>Toolbar.DeltaSearch
http://nicolascoolman.webs.com/apps/blog/show/41737185-pup-saveclicker =>PUP.SaveClicker
http://nicolascoolman.webs.com/apps/blog/show/26919368-adware-megasearch =>Adware.MegaSearch
http://nicolascoolman.webs.com/apps/blog/show/26898222-adware-incredibar =>Adware.IncrediBar
http://nicolascoolman.webs.com/apps/blog/show/27154930-adware-adon =>Adware.ADON
http://nicolascoolman.webs.com/apps/blog/show/34019179-toolbar-tunesbarre =>Toolbar.TunesBarre
http://nicolascoolman.webs.com/apps/blog/show/29637859-toolbar-tarma =>PUP.Tarma
http://nicolascoolman.webs.com/apps/blog/show/26626977-adware-boxore =>Adware.Boxore
~ MSI: 10 link(s) detected in 00mn 00s
~ 989 Legitimates filtered by white list
End of the scan (526 lines in 01mn 04s)(0)
~ Lancé par Male (18/04/2014 18:13:11)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by program
---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.17041
GCIE: Google Chrome v34.0.1847.116 (Defaut)
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Windows ID Activation : OK
~ Windows Partial Key : RWM9H
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ Logiciels de protection du système
Bitdefender Internet Security v17.23.0.996
Malwarebytes Anti-Malware version 1.75.0.1300
Windows Defender W7
---\\ Logiciels d'optimisation du système
CCleaner v4.11 =>.Piriform Ltd
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 12 Plugin
Java 7 Update 51
---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 58 Stepping 9, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 8175 MB (53% free)
System Restore: Activé (Enable)
System drive C: has 63 GB (35%) free of 180 GB
---\\ Mode de connexion au système
~ Computer Name: VENGEANCE
~ User Name: Male
~ All Users Names: Male, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Male\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Male\AppData\Roaming\
~ %Desktop% : C:\Users\Male\Desktop\
~ %Favorites% : C:\Users\Male\Favorites\
~ %LocalAppData% : C:\Users\Male\AppData\Local\
~ %StartMenu% : C:\Users\Male\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 63 Go of 180 Go)
D: Hard drive, Flash drive, Thumb drive (Free 97 Go of 286 Go)
E: CD-ROM drive (Not Inserted)
F: Floppy drive, Flash card reader, USB Key (Not Inserted)
G: Floppy drive, Flash card reader, USB Key (Not Inserted)
H: Floppy drive, Flash card reader, USB Key (Not Inserted)
I: Floppy drive, Flash card reader, USB Key (Not Inserted)
---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 41 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.F220BA78AB542C70211D73AE4729B2CD] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.06/03/2014 - 07:22:40.) -- C:\Windows\System32\wininet.dll [2260480]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.21/11/2010 - 04:24:29.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.21/11/2010 - 04:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/09/2013 - 02:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 04:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.24/01/2014 - 03:37:55.) -- C:\Windows\system32\Drivers\ntfs.sys [1684928]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 04:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/3660
~ Mes Videos (My Videos) : 1/67
~ Mes Favoris (My Favorites) : 1/26
~ Mes Documents (My Documents) : 1/13
~ Mon Bureau (My Desktop) : 1/1693
~ Menu demarrer (Programs) : 0/45
~ Hidden Files: Scanned in 00mn 00s
---\\ Processus lancés
[MD5.E98D481EEF14767B1615DE88674D307A] - (.ASUS - GPUTweak.) -- C:\Program Files (x86)\ASUS\GPU Tweak\GPUTweak.exe [3282680] [PID.2256]
[MD5.EE316C8D7C1B99412F2C8F1C64268182] - (.NVIDIA Corporation - NVIDIA GeForce Experience Backend.) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144] [PID.2736]
[MD5.597CF4BEDFDC81B8903982664CAC6ED0] - (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe [614232] [PID.1616]
[MD5.5E32AEE9866C484D041AA1C0776D6976] - (.Bogdan Sharkov - Clownfish for Skype.) -- C:\Program Files (x86)\Clownfish\Clownfish.exe [1313536] [PID.2484]
[MD5.6441EB9BA26BE495ECA68CF579BDCC8E] - (.Dropbox, Inc. - Dropbox.) -- C:\Users\Male\AppData\Roaming\Dropbox\bin\Dropbox.exe [32179440] [PID.3124]
[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336] [PID.3168]
[MD5.CDE6586CC383BCAC4D1E4F8A57DCB291] - (.Corsair Components, Inc. - Corsair Vengeance Headset.) -- C:\Program Files (x86)\Corsair\Corsair Headset Software\HeadsetControlPanel.exe [3167544] [PID.3180]
[MD5.A63DC5C2EA944E6657203E0C8EDEAF61] - (.Microsoft Corporation - COM Surrogate.) -- C:\Windows\SysWOW64\DllHost.exe [7168] [PID.3244]
[MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.2712]
[MD5.40B887A9D6EA6181E26CC82BF179096F] - (.ASUS - Monitor.) -- C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe [2701048] [PID.1476]
[MD5.2EBBBFC120593C683796092F2DDA0EFC] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [841032] [PID.4280]
[MD5.C0EAE6AC1C580FC39754180A3726180E] - (.Bitdefender - Bitdefender Wallet Chrome Extension Native.) -- C:\Program Files\Bitdefender\Bitdefender\Antispam32\pmbxcrnmh.exe [62664] [PID.4576]
[MD5.84FCBA7D88B92804A3D28A24DC5223EB] - (...) -- C:\ProgramData\BOINC\projects\aerospaceresearch.net_constellation\trackjack_0.10_windows_x86_64 [492288] [PID.5032] =>Hijacker.SearchNet
[MD5.161233DC79656145086BDBD6918A08D4] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8216576] [PID.2080]
[MD5.B5D2F4BF587FD60AF75B09EFC1AD0E0A] - (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [411936] [PID.1092]
[MD5.E536856E96A7605EBF580D62A868E5FE] - (...) -- C:\Windows\SysWOW64\ASGT.exe [55296] [PID.1624]
[MD5.8C856E531A1170F53AC6844E89CD0B5F] - (...) -- C:\Program Files (x86)\Dokan\DokanLibrary\mounter.exe [14848] [PID.1380]
[MD5.7E6B107120108B3A15BFECE0DE3201DB] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler.exe [228744] [PID.2440]
[MD5.65085456FD9A74D7F1A999520C299ECB] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376] [PID.4000]
[MD5.E0D7732F2D2E24B2DB3F67B6750295B8] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512] [PID.2704]
[MD5.6F5D2728019DCE7BFF3BAC1885CC0449] - (.NVIDIA Corporation - NVIDIA Network Service.) -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632] [PID.1744]
[MD5.E4E034F79D88B34C5B4BA28BAE2259F7] - (.Razer Inc. - RzKLService.) -- C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe [105448] [PID.3496]
[MD5.52069AEB42D3D0F97CBCA1085EBF55E6] - (.Intel Corporation - Intel(R) Dynamic Application Loader Host In.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432] [PID.6120]
[MD5.6DC3A4E939B0F3EE16B54C5EC431D8C1] - (.Intel Corporation - Intel(R) Local Management Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [390616] [PID.2324]
~ Processes Running: Scanned in 00mn 00s
---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Male\AppData\Local\Google\Chrome\User Data\Default\Preferences
G1 - GCS: Preference [User Data\Default] http://feed.snapdo.com =>Hijacker.SmartBar
G0 - GCSP: Preference [User Data\Default][HomePage] http://www.delta-search.com =>Toolbar.DeltaSearch
G2 - GCE: Preference [User Data\Default] [apdfllckaahabafndbhieahigkjlhalf] Google Drive v.6.3 (Activé)
G2 - GCE: Preference [User Data\Default] [ccahoghmggldkcdjiebjkidpfongdfbl] Bitdefender Wallet v.17.28.1 (Activé)
G2 - GCE: Preference [User Data\Default] [hkdmamhlklklmdocdapicehaaljgphkk] Prévisions Météo v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nfmgehhghdejfcdmbdiphiemhfpjeaaa] gorueAtssaver v.2.7 (Désactivé) =>PUP.GreatSaver
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Wallet v.0.0.6.1 (Activé)
---\\ Liste des dossiers d'extension Google Chrome
~ Google Lines Browser: 21 Legitimates Filtered in 00mn 03s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
O1 - Hosts: 54.204.28.26 achhmapmjlcjlomcbmbicbgkihghgnie
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 23
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Snap.Do - [HKLM]{ae07101b-46d4-4a98-af68-0333ea26e113} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation
~ Toolbar: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: ASUS GPU Tweak.lnk . (.ASUS - GPUTweak.) -- C:\Program Files (x86)\ASUS\GPU Tweak\GPUTweak.exe
O4 - GS\Desktop [Public]: GeForce Experience.lnk . (.NVIDIA - NVIDIA GeForce Experience.) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\GFExperience.exe
O4 - GS\Desktop [Public]: Intel(R) Extreme Tuning Utility.lnk . (.Intel(R) Corporation - PerfTune.) -- C:\Windows\Installer\{57482760-8D96-4DDB-B11A-E57180465EDE}\PerfTuneIcon.B089625E_E454_492E_B2F2_7E934E4807F0.exe
O4 - GS\Desktop [Public]: Oracle VM VirtualBox.lnk . (...) -- C:\Program Files (x86)\Oracle\VirtualBox\VirtualBox.exe (.not file.)
O4 - GS\Desktop [Public]: Razer Game Booster.lnk . (.Razer Inc. - RazerGameBooster.) -- C:\Program Files (x86)\Razer\Razer Game Booster\RazerGameBooster.exe
O4 - GS\QuickLaunch [Male]: BitTorrent.lnk . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Male\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent
O4 - GS\QuickLaunch [Male]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Male]: Oracle VM VirtualBox.lnk . (...) -- C:\Program Files (x86)\Oracle\VirtualBox\VirtualBox.exe (.not file.)
O4 - GS\TaskBar [Male]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [Male]: BitTorrent.lnk . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Male\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent
O4 - GS\Desktop [Male]: FurMark.lnk . (.Geeks3D (www.geeks3d.com) - FurMark - swiss made GPU stress test and Op.) -- C:\Program Files (x86)\Geeks3D\Benchmarks\FurMark_1.10.3\FurMark.exe
O4 - GS\Desktop [Male]: PC Remote Server.lnk . (.PC Remote - PC Remote Server.) -- C:\Program Files (x86)\PC Remote\PC Remote\PCRemote.exe
O4 - GS\Desktop [Male]: Recup - Raccourci.lnk . (...) -- D:\Recup
O4 - GS\Desktop [Male]: Smellyriver.TankInspector.exe - Raccourci.lnk . (.Smellyriver - Tank Inspector.) -- C:\Users\Male\Desktop\Nouveau dossier\Smellyriver.TankInspector.exe
~ Global Startup: 70 Legitimates Filtered in 00mn 01s
---\\ Applications lancées au démarrage du système (O4)
O4 - GS\Startup [Male]: Dropbox.lnk . (.Dropbox, Inc. - Dropbox.) -- C:\Users\Male\AppData\Roaming\Dropbox\bin\Dropbox.exe =>.Dropbox
O4 - HKLM\..\Run: [ShadowPlay] . (.NVIDIA Corporation - NVIDIA Capture Server Proxy.) -- C:\Windows\system32\nvspcap64.dll
O4 - HKLM\..\Run: [IAStorIcon] . (.Intel Corporation - Delayed launcher.) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =>.Realtek Semiconductor Corp
O4 - HKLM\..\Run: [Bdagent] . (.Bitdefender - Bitdefender Agent.) -- C:\Program Files\Bitdefender\Bitdefender\bdagent.exe
O4 - HKLM\..\Run: [NvBackend] . (.NVIDIA Corporation - NVIDIA GeForce Experience Backend.) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
O4 - HKLM\..\Run: [boinctray] . (.Space Sciences Laboratory - BOINC System Tray for Windows.) -- C:\Program Files\BOINC\boinctray.exe
O4 - HKLM\..\Run: [boincmgr] . (.Space Sciences Laboratory - BOINC Manager for Windows.) -- C:\Program Files\BOINC\boincmgr.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKCU\..\Run: [BitTorrent] . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Male\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent
O4 - HKCU\..\Run: [Bitdefender Wallet Agent] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe
O4 - HKCU\..\Run: [Bitdefender Wallet] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe
O4 - HKCU\..\Run: [Bitdefender Agent de l'application Wallet] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe
O4 - HKCU\..\Run: [PC Remote Server] . (.PC Remote - PC Remote Server.) -- C:\Program Files (x86)\PC Remote\PC Remote\PCRemote.exe
O4 - HKCU\..\Run: [Clownfish] . (.Bogdan Sharkov - Clownfish for Skype.) -- C:\Program Files (x86)\Clownfish\Clownfish.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe =>.DT Soft Ltd
O4 - HKCU\..\Run: [CCleaner Monitoring] . (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner64.exe =>.Piriform Ltd
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKLM\..\Wow6432Node\Run: [Corsair Headset Software] . (.Corsair Components, Inc. - Corsair Vengeance Headset.) -- C:\Program Files (x86)\Corsair\Corsair Headset Software\HeadsetControlPanel.exe
O4 - HKUS\.DEFAULT\..\Run: [Bitdefender Wallet Agent] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe
O4 - HKUS\.DEFAULT\..\Run: [Bitdefender Wallet] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe
O4 - HKUS\.DEFAULT\..\Run: [Bitdefender Agent de l'application Wallet] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe
O4 - HKUS\S-1-5-18\..\Run: [Bitdefender Wallet Agent] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe
O4 - HKUS\S-1-5-18\..\Run: [Bitdefender Wallet] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe
O4 - HKUS\S-1-5-18\..\Run: [Bitdefender Agent de l'application Wallet] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [BitTorrent] . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Male\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent
O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [Bitdefender Wallet Agent] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe
O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [Bitdefender Wallet] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe
O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [Bitdefender Agent de l'application Wallet] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe
O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [PC Remote Server] . (.PC Remote - PC Remote Server.) -- C:\Program Files (x86)\PC Remote\PC Remote\PCRemote.exe
O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [Clownfish] . (.Bogdan Sharkov - Clownfish for Skype.) -- C:\Program Files (x86)\Clownfish\Clownfish.exe
O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe =>.DT Soft Ltd
O4 - HKUS\S-1-5-21-3573267556-4013039890-3347091036-1000\..\Run: [CCleaner Monitoring] . (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner64.exe =>.Piriform Ltd
~ Application: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{38FEA77E-9FB4-4794-B08E-BE42886F8312}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{9A46A404-B4B9-402C-812A-187171ED3950}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{9A46A404-B4B9-402C-812A-187171ED3950}: DhcpDomain = netgear.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{38FEA77E-9FB4-4794-B08E-BE42886F8312}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{9A46A404-B4B9-402C-812A-187171ED3950}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{9A46A404-B4B9-402C-812A-187171ED3950}: DhcpDomain = netgear.com
O17 - HKLM\System\CS2\Services\Tcpip\..\{38FEA77E-9FB4-4794-B08E-BE42886F8312}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{9A46A404-B4B9-402C-812A-187171ED3950}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{9A46A404-B4B9-402C-812A-187171ED3950}: DhcpDomain = netgear.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: ASGT (ASGT) . (...) - C:\Windows\SysWOW64\ASGT.exe
O23 - Service: DokanMounter (DokanMounter) . (...) - C:\Program Files (x86)\Dokan\DokanLibrary\mounter.exe
O23 - Service: GS-Supporter (e81a9dc1) . (...) - C:\Program Files (x86)\gs-ena~1\AssistantSvc.dll (.not file.) =>PUP.SaveClicker
~ Services: 19 Legitimates Filtered in 00mn 06s
---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [SomotoUpdateCheckerAutoStart] (...) -- C:\Users\Male\AppData\Local\FilesFrog Update Checker\update_checker.exe (.not file.) [0] =>Adware.MegaSearch
~ Scheduled Task: 9 Legitimates Filtered in 00mn 02s
---\\ Logiciels installés (O42)
O42 - Logiciel: AndroozBarre M-B-v2.12e - (.Agia3D.) [HKLM][64Bits] -- {FAA33BD4-EC73-43BB-9E0D-D04FCB37D756}_is1
O42 - Logiciel: CashobarreV1.2 - (.Legend-Edition.) [HKCU][64Bits] -- 9573548c9ce6ad12
O42 - Logiciel: Click-CPM-Barre M-B-v2.12e - (.Agia3D.) [HKLM][64Bits] -- {0BE2D054-1DB5-4F22-A1A5-84481F7E42F5}_is1
O42 - Logiciel: Dead Surf - (.Legend Edition.) [HKCU][64Bits] -- ca5afe92da7ae5fe
O42 - Logiciel: DiscoveryBarre M-B-v2.15e - (.Agia3D.) [HKLM][64Bits] -- {4F1CFE21-CFA8-4BE9-8581-B403B51A9DCB}_is1
O42 - Logiciel: LPT System Updater Service - (.LPT.) [HKLM][64Bits] -- {BC0BF363-63AB-4FF7-8EF1-AE0D7F711B24} =>Adware.IncrediBar
O42 - Logiciel: LaBoitaKados M-B-v1.1 - (.Agia3D.) [HKLM][64Bits] -- {0B19DC32-C613-4B1C-8116-98A808261AE9}_is1
O42 - Logiciel: PackBarre - (.BPMconcept.) [HKLM][64Bits] -- {EF9C70A5-CE26-48A1-9578-172706628019} =>Adware.ADON
O42 - Logiciel: Soul-Code - (.Legend Edition.) [HKCU][64Bits] -- b04e6fc329b9f61e
O42 - Logiciel: Sun7Barre version 1.4 - (.WiwildBarre.) [HKLM][64Bits] -- {988B07B6-DCAE-4091-AC3F-14BDCCCEF63E}_is1
O42 - Logiciel: TunesBarre version 1.2 - (.TunesBarre.Com.) [HKLM][64Bits] -- {C045FCE6-E4EB-4D9C-881E-E959E053AA40}_is1 =>Toolbar.TunesBarre
O42 - Logiciel: pipilajeux - (.Legend Edition.) [HKCU][64Bits] -- f96643f978ef374a
O42 - Logiciel: v1.1 - (.Agia3D.) [HKLM][64Bits] -- {979B9A3E-EBFA-472B-9508-5A30A86C3551}_is1
~ Logic: 23 Legitimates Filtered in 00mn 00s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\ELIGCHK]
[HKCU\Software\Smartbar] =>Hijacker.SmartBar
~ Key Software: 245 Legitimates Filtered in 00mn 00s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 10/01/2014 - 20:57:12 - [] ----D C:\Program Files (x86)\PackBarre =>Adware.ADON
O43 - CFD: 04/02/2014 - 17:54:52 - [] ----D C:\Program Files (x86)\Sun7Barre
O43 - CFD: 10/01/2014 - 20:53:36 - [] ----D C:\Program Files (x86)\Thread Manager
O43 - CFD: 11/01/2014 - 23:03:10 - [] ----D C:\Program Files (x86)\TunesBarre =>Toolbar.TunesBarre
O43 - CFD: 17/01/2014 - 20:14:12 - [] ----D C:\ProgramData\87c24eac7fe2ee8d
O43 - CFD: 17/01/2014 - 20:12:59 - [] ----D C:\ProgramData\InstallMate =>PUP.Tarma
O43 - CFD: 12/03/2014 - 10:07:05 - [] ----D C:\Users\Male\AppData\Local\Smellyriver
O43 - CFD: 01/02/2014 - 19:40:59 - [] ----D C:\Users\Male\AppData\Local\Wiwild
O43 - CFD: 19/03/2014 - 18:54:52 - [] ----D C:\Users\Male\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Legend Edition
O43 - CFD: 11/01/2014 - 23:12:06 - [] ----D C:\Users\Male\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Legend-Edition
O43 - CFD: 10/01/2014 - 20:57:12 - [] ----D C:\Users\Male\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PackBarre =>Adware.ADON
~ Program Folder: 167 Legitimates Filtered in 00mn 00s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.2BF6DE757CBC9DC4D69FE9C0156BC762] - 17/04/2014 - 20:14:23 ---A- . (...) -- C:\bdlog.txt [105538]
~ Files: 47 Legitimates Filtered in 00mn 06s
---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.FA122BC1451B1B35B7814FBE1ACF1924] - 10/01/2011 - 13:51:40 ----- . (.Windows (R) Win 7 DDK provider - Dokan Filesystem Driver.) -- C:\Windows\System32\Drivers\dokan.sys [120408]
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:[MD5.FD291A75ECAF197F07BD2040C2A7322A] - 17/07/2013 - 14:23:50 ----- . (.Etron Technology Inc - Etron eXtensible Hub Driver..) -- C:\Windows\System32\Drivers\EtronHub3.sys [65408]
O58 - SDL:[MD5.DDE9068F9BAC0210195F217AA39B9276] - 17/07/2013 - 14:23:46 ----- . (.Etron Technology Inc - Etron eXtensible Host Controller Driver..) -- C:\Windows\System32\Drivers\EtronXHCI.sys [94208]
O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:[MD5.385044010950C76471A4F1AE47435157] - 19/04/2013 - 04:56:48 ---A- . (...) -- C:\Windows\System32\Drivers\nvflash.sys [15648]
O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
~ Drivers: 16 Legitimates Filtered in 00mn 01s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html>
O67 - Shell Spawning: <.html>
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet:
O68 - StartMenuInternet:
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {006ee092-9658-4fd6-bd8e-a21a348e59f5} [DefaultScope] - (Web Search) - http://feed.snapdo.com =>Hijacker.SmartBar
~ Keys: Scanned in 00mn 00s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.F72FE7F8D1D7BB53383F95DB98BF1A82] [SPRF][08/01/2014] (...) -- C:\ProgramData\1389185697.bdinstall.bin [544510]
~ Files: 2 Legitimates Filtered in 00mn 00s
---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "266110108A678E141B8AF4881275A05C" . (.Advanced Archive Password Recovery.) -- C:\Windows\Installer\{01011662-76A8-41E8-B1A8-4F8821570AC5}\product_icon
~ Update Products: 28 Legitimates Filtered in 00mn 00s
---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.7A6570D2B4609776B65B7B8DFB5E34B5] [WIS][17/02/2014] (.PC Remote - PC Remote Server - Installer.) -- C:\Windows\Installer\11179c9.msi [1183744]
[MD5.CCF09B872963321F1A5018A24DA92FEC] [WIS][24/03/2014] (.LPT - LPT System Updater Service.) -- C:\Windows\Installer\28ce670.msi [1884160] =>Adware.IncrediBar
[MD5.4F23992ABF894691390C29F83F8CD758] [WIS][10/01/2014] (.BPMconcept - PackBarre.) -- C:\Windows\Installer\b03815c.msi [1646592] =>Adware.ADON
~ WIS: 31 Legitimates Filtered in 00mn 07s
---\\ Recherche de clés de registre Tracing (O100)
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BitTorrent [1]_RASAPI32 =>P2P.BitTorrent
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BitTorrent [1]_RASMANCS =>P2P.BitTorrent
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BitTorrent_RASAPI32 =>P2P.BitTorrent
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BitTorrent_RASMANCS =>P2P.BitTorrent
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SnapDo_RASAPI32 =>Hijacker.SmartBar
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SnapDo_RASMANCS =>Hijacker.SmartBar
~ BTK: 99 Legitimates Filtered in 00mn 00s
---\\ Recherche de clés de registre CLSID (O101)
[HKCR\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}] (SmartbarInternetExplorerBHOEngine) =>Hijacker.SmartBar
[HKCR\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}] (Snap.Do) =>Hijacker.SmartBar
~ BCK: 4429 Legitimates Filtered in 00mn 02s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 18/03/2014 257928 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Disabled 21/11/2013 77632 | (BdDesktopParental) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender\bdparentalservice.exe
SS - | Auto 10/07/1658 0 | (e81a9dc1) . (...) - C:\Program Files (x86)\gs-ena~1\AssistantSvc.dll
SS - | Auto 02/01/2014 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 02/01/2014 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Auto 21/11/2013 15720 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
SS - | Demand 01/02/2012 160256 | (ICCS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
SS - | Demand 11/05/2013 822232 | (Intel(R) Capability Licensing Service TCP IP Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
SS - | Auto 23/10/2013 172192 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Auto 17/01/2014 18384 | (XTU3SERVICE) . (.Intel(R) Corporation.) - C:\Program Files (x86)\Intel\Extreme Tuning Utility\XtuService.exe
SR - | Auto 17/01/2012 55296 | (ASGT) . (...) - C:\Windows\SysWOW64\ASGT.exe
SR - | Auto 10/01/2011 14848 | (DokanMounter) . (...) - C:\Program Files (x86)\Dokan\DokanLibrary\mounter.exe
SR - | Auto 11/05/2013 733696 | (Intel(R) Capability Licensing Service Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\iCLS Client\HeciServer.exe
SR - | Auto 27/08/2013 169432 | (jhi_service) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
SR - | Auto 27/08/2013 390616 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
SR - | Auto 25/10/2013 2768208 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe
SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
SR - | Auto 21/01/2014 1593632 | (NvNetworkService) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
SR - | Auto 21/01/2014 16939296 | (NvStreamSvc) . (.NVIDIA Corporation.) - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
SR - | Auto 08/02/2014 923936 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe
SR - | Auto 25/02/2014 105448 | (RzKLService) . (.Razer Inc..) - C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe
SR - | Auto 08/02/2014 411936 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
SR - | Auto 07/10/2013 67320 | (UPDATESRV) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender\updatesrv.exe
SR - | Auto 04/04/2014 1523728 | (VSSERV) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender\vsserv.exe
SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 03s
---\\ Scan Additionnel (O88)
Database Version : 13044 - (18/04/2014)
Clés trouvées (Keys found) : 17
Valeurs trouvées (Values found) : 3
Dossiers trouvés (Folders found) : 6
Fichiers trouvés (Files found) : 6
[HKLM\Software\Google\Chrome\Extensions\nfmgehhghdejfcdmbdiphiemhfpjeaaa] =>PUP.GreatSaver^
[HKLM\SYSTEM\CurrentControlSet\Services\e81a9dc1] =>PUP.SaveClicker^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{BC0BF363-63AB-4FF7-8EF1-AE0D7F711B24}] =>Adware.IncrediBar^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{EF9C70A5-CE26-48A1-9578-172706628019}] =>Adware.ADON^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{C045FCE6-E4EB-4D9C-881E-E959E053AA40}_is1] =>Toolbar.TunesBarre^
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}] =>Hijacker.SmartBar
[HKLM\Software\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}] =>Toolbar.Agent
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}] =>Toolbar.Agent
[HKLM\Software\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}] =>Hijacker.SmartBar
[HKLM\Software\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}] =>Hijacker.SmartBar
[HKLM\Software\Wow6432Node\Microsoft\Tracing\SnapDo_RASAPI32] =>Hijacker.SmartBar
[HKLM\Software\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}] =>Hijacker.SmartBar
[HKLM\Software\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}] =>Hijacker.SmartBar
[HKLM\Software\Wow6432Node\Microsoft\Tracing\SnapDo_RASMANCS] =>Hijacker.SmartBar
[HKLM\Software\Classes\CLSID\{ae07101b-46d4-4a98-af68-0333ea26e113}] =>Adware.Agent
[HKLM\Software\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}] =>Hijacker.SmartBar
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CA0054A5AB3EFFE4CB5660E44A1E7DCC] =>Adware.Boxore^
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:BitTorrent =>P2P.BitTorrent^
C:\Users\Male\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfmgehhghdejfcdmbdiphiemhfpjeaaa =>PUP.GreatSaver^
C:\Program Files (x86)\PackBarre =>Adware.ADON^
C:\Program Files (x86)\TunesBarre =>Toolbar.TunesBarre^
C:\ProgramData\InstallMate =>PUP.Tarma^
C:\Users\Male\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PackBarre =>Adware.ADON^
C:\Users\Male\AppData\Local\Software =>Adware.Boxore
C:\ProgramData\BOINC\projects\aerospaceresearch.net_constellation\trackjack_0.10_windows_x86_64 =>Hijacker.SearchNet^
[HKCU\Software\Smartbar] =>Hijacker.SmartBar^
C:\Windows\Installer\28ce670.msi =>Adware.IncrediBar^
C:\Windows\Installer\b03815c.msi =>Adware.ADON^
[HKCR\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}] (SmartbarInternetExplorerBHOEngine) =>Hijacker.SmartBar^
[HKCR\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}] (Snap.Do) =>Hijacker.SmartBar^
~ Additionnel Scan: 183791 Items scanned in 00mn 11s
---\\ Récapitulatif des détections trouvées sur votre station
http://nicolascoolman.webs.com/apps/blog/show/42042097-hijacker-searchnet =>Hijacker.SearchNet
http://nicolascoolman.webs.com/apps/blog/show/26990375-hijacker-smartbar =>Hijacker.SmartBar
http://nicolascoolman.webs.com/apps/blog/show/27875657-toolbar-deltasearch =>Toolbar.DeltaSearch
http://nicolascoolman.webs.com/apps/blog/show/41737185-pup-saveclicker =>PUP.SaveClicker
http://nicolascoolman.webs.com/apps/blog/show/26919368-adware-megasearch =>Adware.MegaSearch
http://nicolascoolman.webs.com/apps/blog/show/26898222-adware-incredibar =>Adware.IncrediBar
http://nicolascoolman.webs.com/apps/blog/show/27154930-adware-adon =>Adware.ADON
http://nicolascoolman.webs.com/apps/blog/show/34019179-toolbar-tunesbarre =>Toolbar.TunesBarre
http://nicolascoolman.webs.com/apps/blog/show/29637859-toolbar-tarma =>PUP.Tarma
http://nicolascoolman.webs.com/apps/blog/show/26626977-adware-boxore =>Adware.Boxore
~ MSI: 10 link(s) detected in 00mn 00s
~ 989 Legitimates filtered by white list
End of the scan (526 lines in 01mn 04s)(0)