Rapport de ZHPDiag v2013.7.7.10 par Nicolas Coolman, Update du 07/07/2013 Run by Julien at 09/07/2013 15:35:47 WebSite: http://nicolascoolman.webs.com State : Version à jour. WhiteList : Enable High Elevated Privileges : OK UAC : Deactivate by program ---\\ Web Browser MSIE: Internet Explorer v7.0.6001.18000 MFIE: Mozilla Firefox 22.0 (Defaut) ---\\ Windows Product Information ~ Langage: Français Windows Vista Home Basic Edition, 32-bit Service Pack 1 (Build 6001) Windows Server License Manager Script : OK ~ Vista, OEM_SLP channel System Locked Preinstallation (OEM_SLP) : OK Windows ID Activation : OK ~ Windows Partial Key : P92J4 Windows License : OK Windows Automatic Updates : OK ---\\ System Protection Bitdefender Total Security 2012 v15.0.41 Malwarebytes Anti-Malware version 1.75.0.1300 McAfee Security Scan Plus v3.0.318.3 ---\\ System Optimizer ---\\ Peer To Peer (P2P) µTorrent v3.3.0.29625 =>P2P.µTorrent ---\\ Software Update Adobe Flash Player 11 Plugin Adobe Reader X ---\\ System Information ~ Processor: x86 Family 6 Model 15 Stepping 13, GenuineIntel ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 1976 MB (55% free) System Restore: Activé (Enable) System drive C: has 22 GB (31%) free of 70 GB ---\\ Logged in mode ~ Computer Name: PC-DE-JULIEN ~ User Name: Julien ~ All Users Names: Julien, Administrateur, ~ Unselected Option: None Logged in as Administrator ---\\ Environnement Variables ~ System Unit : C:\ ~ %AppData% : C:\Users\Julien\AppData\Roaming\ ~ %Desktop% : C:\Users\Julien\Desktop\ ~ %Favorites% : C:\Users\Julien\Favorites\ ~ %LocalAppData% : C:\Users\Julien\AppData\Local\ ~ %StartMenu% : C:\Users\Julien\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\\ DOS/Devices C:\ Hard drive, Flash drive, Thumb drive (Free 22 Go of 70 Go) D:\ Hard drive, Flash drive, Thumb drive (Free 17 Go of 70 Go) E:\ CD-ROM drive (Not Inserted) ---\\ Security Center & Tools Informations [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date ~ Security Center: 29 Legitimates Filtered in 00mn 00s ---\\ Recherche particulière de fichiers génériques [MD5.4F554999D7D5F05DAAEBBA7B5BA1089D] - (.Microsoft Corporation - Explorateur Windows.) (.29/10/2008 - 07:29:41.) -- C:\Windows\Explorer.exe [2927104] [MD5.101BA3EA053480BB5D957EF37C06B5ED] - (.Microsoft Corporation - Application de démarrage de Windows.) (.21/01/2008 - 03:33:13.) -- C:\Windows\System32\Wininit.exe [96768] [MD5.DA5A72211661C7F162B332FEA4F09A69] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.21/04/2011 - 16:00:34.) -- C:\Windows\System32\wininet.dll [833024] [MD5.C2610B6BDBEFC053BBDAB4F1B965CB24] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.21/01/2008 - 03:34:38.) -- C:\Windows\System32\Winlogon.exe [314880] [MD5.48EB99503533C27AC6135648E5474457] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.21/04/2011 - 14:16:42.) -- C:\Windows\system32\Drivers\AFD.sys [273408] [MD5.2D9C903DC76A66813D350A562DE40ED9] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.21/01/2008 - 03:32:21.) -- C:\Windows\system32\Drivers\atapi.sys [21560] [MD5.7ADD03E75BEB9E6DD102C3081D29840A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.21/01/2008 - 03:33:23.) -- C:\Windows\system32\Drivers\Cdfs.sys [70144] [MD5.1EC25CEA0DE6AC4718BF89F9E1778B57] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/01/2008 - 03:32:23.) -- C:\Windows\system32\Drivers\Cdrom.sys [67072] [MD5.A3E9FA213F443AC77C7746119D13FEEC] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.14/04/2011 - 15:24:14.) -- C:\Windows\system32\Drivers\DfsC.sys [75264] [MD5.C87B1EE051C0464491C1A7B03FA0BC99] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/01/2008 - 03:32:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [53760] [MD5.22D56C8184586B7A1F6FA60BE5F5A2BD] - (.Microsoft Corporation - Pilote de port i8042.) (.21/01/2008 - 03:32:45.) -- C:\Windows\system32\Drivers\i8042prt.sys [54784] [MD5.8793643A67B42CEC66490B2A0CF92D68] - (.Microsoft Corporation - IP Network Address Translator.) (.21/01/2008 - 03:34:06.) -- C:\Windows\system32\Drivers\IpNat.sys [100864] [MD5.5734A0F2BE7E495F7D3ED6EFD4B9F5A1] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.29/04/2011 - 13:49:35.) -- C:\Windows\system32\Drivers\MRxSmb.sys [105984] [MD5.7C5FEE5B1C5728507CD96FB4A13E7A02] - (.Microsoft Corporation - MBT Transport driver.) (.21/01/2008 - 03:34:49.) -- C:\Windows\system32\Drivers\netBT.sys [184320] [MD5.B4EFFE29EB4F15538FD8A9681108492D] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.21/01/2008 - 03:33:23.) -- C:\Windows\system32\Drivers\ntfs.sys [1081912] [MD5.0FA9B5055484649D63C303FE404E5F4D] - (.Microsoft Corporation - Pilote de port parallèle.) (.02/11/2006 - 09:51:30.) -- C:\Windows\system32\Drivers\Parport.sys [79360] [MD5.A214ADBAF4CB47DD2728859EF31F26B0] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/01/2008 - 03:34:44.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [76288] [MD5.FBC0BACD9C3D7F6956853F64A66E252D] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.21/01/2008 - 03:32:22.) -- C:\Windows\system32\Drivers\rdpdr.sys [248832] [MD5.031E6BCD53C9B2B9ACE111EAFEC347B6] - (.Microsoft Corporation - SMB Transport driver.) (.21/01/2008 - 03:34:49.) -- C:\Windows\system32\Drivers\smb.sys [66560] [MD5.D09276B1FAB033CE1D40DCBDF303D10F] - (.Microsoft Corporation - TDI Translation Driver.) (.21/01/2008 - 03:34:42.) -- C:\Windows\system32\Drivers\tdx.sys [71680] [MD5.D8B4A53DD2769F226B3EB374374987C9] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/01/2008 - 03:32:47.) -- C:\Windows\system32\Drivers\volsnap.sys [227896] ~ Generic Processes: Scanned in 00mn 00s ---\\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 1/2 ~ Mes musiques (My Musics) : 1/40 ~ Mes Videos (My Videos) : 1/4 ~ Mes Favoris (My Favorites) : 1/21 ~ Mes Documents (My Documents) : 1/168 ~ Mon Bureau (My Desktop) : 1/106 ~ Menu demarrer (Programs) : 1/77 ~ Hidden Files: Scanned in 00mn 01s ---\\ Processus lancés [MD5.6B778E95130FE940736F2A5C7D78F545] - (.Bitdefender - Bitdefender Agent.) -- C:\Program Files\Bitdefender\Bitdefender 2012\bdagent.exe [1199344] [PID.520] [MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.2724] [MD5.D3804513FC9C11A4637392B4F0F43BC5] - (.Intel Corporation - Event Monitor User Notification Tool.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe [182808] [PID.3064] [MD5.C459786D07FEAD5717DD1AC287BB2519] - (.Realtek Semiconductor - HD Audio Control Panel.) -- C:\Windows\RtHDVCpl.exe [6265376] [PID.3076] [MD5.19D93154C82FE39A99B269CED1056A92] - (.Synaptics, Inc. - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1033512] [PID.3088] [MD5.6882D187F65ECA79110848A68FDEB2BF] - (.Pas de propriétaire - NTI Backup Now 5 Tray Module.) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe [34040] [PID.3096] [MD5.F6474B8FC4744A7E467370C3B66EF9FC] - (.Intel Corporation - igfxTray Module.) -- C:\Windows\System32\igfxtray.exe [150040] [PID.3104] [MD5.2DEF9EEA8F37FB2770359DA35C609142] - (.Intel Corporation - hkcmd Module.) -- C:\Windows\System32\hkcmd.exe [170520] [PID.3112] [MD5.5EA38E789957EF8386C8458438BFF90B] - (.Intel Corporation - persistence Module.) -- C:\Windows\System32\igfxpers.exe [145944] [PID.3120] [MD5.17ED0AE8DDEF1ABF12C106BBC245DC76] - (.Dritek System Inc. - Launch Manager.) -- C:\Program Files\Launch Manager\QtZyEmachine.exe [817672] [PID.3724] [MD5.3CB07566302BCEEB898DE270A0BEC175] - (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352] [PID.3756] [MD5.278A1F51C56B06436C4227A85A0914ED] - (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\System32\spool\drivers\w32x86\3\E_FATIEDE.exe [188928] [PID.3784] [MD5.BD713579A87D698E1F2158CE10E48130] - (.McAfee, Inc. - McAfee Security Scanner Scheduler.) -- C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe [272248] [PID.3792] [MD5.9FEE8D10461760D2B0644B2D76BB9DE4] - (.Intel Corporation - igfxsrvc Module.) -- C:\Windows\system32\igfxsrvc.exe [256536] [PID.2120] [MD5.ACE58599BDD6051CBE3D78353E7D21F0] - (.Intel Corporation - igfxext Module.) -- C:\Windows\system32\igfxext.exe [174616] [PID.1912] [MD5.892699A6AEB910C58B726BD70BEA4F4B] - (.Synaptics, Inc. - Synaptics Pointing Device Helper.) -- C:\Program Files\Synaptics\SynTP\SynTPHelper.exe [95528] [PID.2300] [MD5.F96EBC5A624349D81DCC7600A3C5DC43] - (.Microsoft Corporation - Console IME.) -- C:\Windows\system32\conime.exe [69120] [PID.1752] [MD5.639B783F5BC546D8D9662881730AFF9B] - (.Adobe Systems Incorporated - AAM Updates Notifier Application.) -- C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe [310224] [PID.3292] [MD5.7E9AA22FC48A43223C7154E810EC7F68] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7684096] [PID.1396] [MD5.634DDFC788E1EC0A045E9969529FFCB3] - (.Bitdefender - Bitdefender Security Service.) -- C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe [1554176] [PID.944] [MD5.0BA91E1358AD25236863039BB2609A2E] - (.Microsoft Corporation - Service de gestion des licences Microsoft.) -- C:\Windows\system32\SLsvc.exe [2623488] [PID.1572] [MD5.3927397AC60D943DAF8808AFFED582B7] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [65192] [PID.2060] [MD5.09E6AFFAE6C0E9158BF05C7D08D0107A] - (.NewTech Infosystems, Inc. - NTI Backup Now 5 Agent service..) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [16384] [PID.2108] [MD5.4D06D9A26227AC485305133916888DF1] - (.Pas de propriétaire - Acer Empowering Technology Framework Servic.) -- C:\Program Files\EMACHINES\eMachines Recovery Management\Service\ETService.exe [24576] [PID.2140] [MD5.793FF718477345CD5D232C50BED1E452] - (.Hewlett-Packard Company - Pas de description.) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440] [PID.2360] [MD5.65085456FD9A74D7F1A999520C299ECB] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376] [PID.2496] [MD5.E0D7732F2D2E24B2DB3F67B6750295B8] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512] [PID.2560] [MD5.CB76F68BA0D57C5D25B538981B1C611C] - (.NewTech InfoSystems, Inc. - NTI Backup Now 5 BackupSvc Application.) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [50424] [PID.2588] [MD5.DF1C10A75DF7E50195FC417F88A33227] - (...) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [131072] [PID.2644] [MD5.03579BEC2E930B92EFD6D4E7F899CFF5] - (.Bitdefender - Bitdefender Update Service.) -- C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe [55032] [PID.2740] [MD5.3E42C4691AAD4B1E8D0466F9CBF05CBE] - (.Intel Corporation - RAID Monitor.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [354840] [PID.2860] ~ Processes Running: Scanned in 00mn 01s ---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) C:\Users\Julien\AppData\Roaming\Mozilla\Firefox\Profiles\uhwmpvwu.default\prefs.js M3 - MFPP: Plugins - [Julien] -- C:\Users\Julien\AppData\Roaming\Mozilla\Firefox\Profiles\uhwmpvwu.default\searchplugins\EcoStartPage.xml ~ Firefox Browser: 7 Legitimates Filtered in 00mn 00s ---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4) R4 - HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,Enabled = 1 ~ IE Browser: 10 Legitimates Filtered in 00mn 00s ---\\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl" ~ Keys: Scanned in 00mn 00s ---\\ Redirection du fichier Hosts (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 00s ~ Nombre de lignes (Lines number): 20 ---\\ Applications démarrées par registre & par dossier (O4) O4 - HKLM\..\Run: [IAAnotif] . (.Intel Corporation - Event Monitor User Notification Tool.) -- C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - HD Audio Control Panel.) -- C:\Windows\RtHDVCpl.exe O4 - HKLM\..\Run: [SynTPEnh] . (.Synaptics, Inc. - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [BkupTray] . (.Pas de propriétaire - NTI Backup Now 5 Tray Module.) -- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [WarReg_PopUp] . (.eMachines - WR_PopUp.) -- C:\Program Files\eMachines\WR_PopUp\WarReg_PopUp.exe O4 - HKLM\..\Run: [LManager] . (.Dritek System Inc. - Launch Manager.) -- C:\Program Files\Launch Manager\QtZyEmachine.exe O4 - HKLM\..\Run: [eRecoveryService] Clé orpheline O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] . (.Adobe Systems Incorporated - Adobe Updater Startup Utility.) -- C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe O4 - HKLM\..\Run: [SwitchBoard] . (.Adobe Systems Incorporated - SwitchBoard Server (32 bit).) -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe O4 - HKLM\..\Run: [AdobeCS5ServiceManager] . (.Adobe Systems Incorporated - Adobe CS5 Service Manager.) -- C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe O4 - HKLM\..\Run: [BDAgent] . (.Bitdefender - Bitdefender Agent.) -- C:\Program Files\Bitdefender\Bitdefender 2012\bdagent.exe O4 - HKCU\..\Run: [WindowsWelcomeCenter] oobefldr.dll O4 - HKCU\..\Run: [AdobeBridge] Clé orpheline O4 - HKCU\..\Run: [EPSON SX100 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIEDE.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] oobefldr.dll O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] oobefldr.dll O4 - HKUS\S-1-5-21-1924100809-2360900263-2351898234-1000\..\Run: [WindowsWelcomeCenter] oobefldr.dll O4 - HKUS\S-1-5-21-1924100809-2360900263-2351898234-1000\..\Run: [AdobeBridge] Clé orpheline O4 - HKUS\S-1-5-21-1924100809-2360900263-2351898234-1000\..\Run: [EPSON SX100 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIEDE.exe ~ Application: Scanned in 00mn 00s ---\\ Autres liens utilisateurs (O4) O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Programs: Windows Mail.lnk . (.Microsoft Corporation - Windows Mail.) -- C:\Program Files\Windows Mail\WinMail.exe O4 - GS\Programs: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe O4 - GS\QuickLaunch: Guitar Pro 6.lnk . (...) -- C:\Program Files\Guitar Pro 6\GuitarPro.exe O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\QuickLaunch: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O4 - GS\QuickLaunch: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe O4 - GS\QuickLaunch: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.) -- C:\Program Files\uTorrent\uTorrent.exe =>P2P.µTorrent O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Desktop: Adobe Photoshop CS5.lnk . (.Adobe Systems, Incorporated - Adobe Photoshop CS5.) -- C:\Program Files\Adobe\Adobe Photoshop CS5\Photoshop.exe O4 - GS\Desktop: Cubase 5.lnk . (.Steinberg Media Technologies - Cubase.) -- C:\Program Files\Steinberg\Cubase 5\Cubase5.exe O4 - GS\Desktop: Guitar Pro 5.lnk . (.Arobas Music - Pas de description.) -- C:\Program Files\Guitar Pro 5\GP5.exe O4 - GS\Desktop: Internet - Raccourci.lnk - Clé orpheline O4 - GS\Desktop: Wordpad.lnk . (.Microsoft Corporation - Application Windows Wordpad.) -- C:\Program Files\Windows NT\Accessories\wordpad.exe ~ Global Startup: Scanned in 00mn 00s ---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9) O9 - Extra button: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft Office OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO ~ IE Extra Buttons: Scanned in 00mn 00s ---\\ Winsock hijacker (Layered Service Provider) (O10) O10 - Broken Internet access because of LSP provider (.not file.) -- mswsock.dll ~ Winsock: 6 Legitimates Filtered in 00mn 00s ---\\ Objets ActiveX (Downloaded Program Files)(O16) O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} ((no name)) - http://quickscan.bitdefender.com/qsax/qsax.cab ~ Objets ActiveX: Scanned in 00mn 00s ---\\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{AA975B17-4863-40F5-A33E-7412273C0706}: DhcpNameServer = 212.27.40.240 212.27.40.241 O17 - HKLM\System\CS1\Services\Tcpip\..\{AA975B17-4863-40F5-A33E-7412273C0706}: DhcpNameServer = 212.27.40.240 212.27.40.241 O17 - HKLM\System\CS2\Services\Tcpip\..\{AA975B17-4863-40F5-A33E-7412273C0706}: DhcpNameServer = 212.27.40.240 212.27.40.241 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.240 212.27.40.241 ~ Domain: Scanned in 00mn 00s ---\\ Protocole additionnel (O18) O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\system32\mshtml.dll O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.dll ~ Protocole Additionnel: Scanned in 00mn 00s ---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll ~ Winlogon: Scanned in 00mn 00s ---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22) O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\Windows\System32\browseui.dll ~ STS/SSO: Scanned in 00mn 00s ---\\ Enumération Active Desktop & MHTML Editor (O24) O24 - Desktop General: BackupWallPaper - .(...) - C:\Windows\Web\Wallpaper\eM3_Wide.bmp O24 - Desktop General: WallPaper - .(...) - C:\Windows\Web\Wallpaper\eM3_Wide.bmp ~ Desktop Component: 4 Legitimates Filtered in 00mn 00s ---\\ Tâches planifiées en automatique (O39) [MD5.00000000000000000000000000000000] [APT] [Go for FilesUpdate] (...) -- C:\Program Files\GoforFiles\GFFUpdater.exe (.not file.) [0] =>P2P.GoforFiles [MD5.00000000000000000000000000000000] [APT] [{CD63C85D-24D8-476C-A432-8EBDE8F8615D}] (...) -- D:\Guitar Pro 5.2 + RSE\RSE Bass Pack.exe (.not file.) [0] ~ Scheduled Task: 6 Legitimates Filtered in 00mn 02s ---\\ Logiciels installés (O42) O42 - Logiciel: Chronotron Pro - (.Chronotron.com.) [HKLM] -- {4CCE77B1-36E1-4A25-91BD-350A0B7C11DE} O42 - Logiciel: Power Tab Editor 1.7 - (.Power Tab Software.) [HKLM] -- {6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3} ~ Logic: 63 Legitimates Filtered in 00mn 00s ---\\ HKCU & HKLM Software Keys [HKCU\Software\Chronotron.com] [HKCU\Software\RiffMastertrialtime] ~ Key Software: 136 Legitimates Filtered in 00mn 00s ---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 23/07/2012 - 22:33:05 - [3,101] ----D C:\Program Files\Chronotron.com O43 - CFD: 01/07/2013 - 23:56:10 - [0] ----D C:\ProgramData\RiffMasterPro O43 - CFD: 13/07/2012 - 17:53:14 - [1,294] ----D C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} O43 - CFD: 28/02/2013 - 16:08:26 - [0] ----D C:\ProgramData\????0 O43 - CFD: 28/02/2013 - 00:10:34 - [0] ----D C:\ProgramData\?Æ?Æ0 O43 - CFD: 27/02/2013 - 22:51:42 - [0] ----D C:\ProgramData\?Ð?Ð0 O43 - CFD: 28/02/2013 - 12:48:12 - [0] ----D C:\ProgramData\?ý?ý0 O43 - CFD: 26/02/2013 - 19:18:37 - [0] ----D C:\ProgramData\?U?U0 ~ Program Folder: 152 Legitimates Filtered in 00mn 46s ---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 09/07/2013 - 14:21:35 ---A- . (...) -- C:\Windows\System32\LogConfigTemp.xml [0] O44 - LFC:[MD5.CEAF98D916D2B75B8704BEE7680EE0B5] - 09/07/2013 - 14:21:33 ---A- . (...) -- C:\Windows\System32\agent.log [147] O44 - LFC:[MD5.AB0E759B08A49D91B43097412712CDC3] - 09/07/2013 - 14:20:11 ---A- . (...) -- C:\bdlog.txt [11132] O44 - LFC:[MD5.4E8F2BB3A5A87E75C35533723B50E685] - 02/07/2013 - 13:31:09 ---A- . (...) -- C:\Windows\System32\user_gensett.xml [385] ~ Files: 28 Legitimates Filtered in 00mn 02s ---\\ Derniers fichiers créés dans Windows Prefetcher (O45) O45 - LFCP:[MD5.26E8097769A5BBE059C65739BF1833CA] - 01/07/2013 - 20:00:08 ---A- - C:\Windows\Prefetch\SOUNDRECORDER.EXE-9865DC1B.pf O45 - LFCP:[MD5.EC09379E67D31EE9FA52E60C5806C840] - 01/07/2013 - 20:23:57 ---A- - C:\Windows\Prefetch\28AE.TMP-F8434817.pf O45 - LFCP:[MD5.1A66FFF1B76C70062FB441E085523AE6] - 01/07/2013 - 20:35:31 ---A- - C:\Windows\Prefetch\3241.TMP-1F686CC9.pf O45 - LFCP:[MD5.DFDEA02E09C8B37C428353A697F04B78] - 01/07/2013 - 22:53:34 ---A- - C:\Windows\Prefetch\HELPERSERVICE.EXE-31F39CB0.pf O45 - LFCP:[MD5.A02D494F57BD98CB38659419F8E6B4BB] - 01/07/2013 - 22:53:36 ---A- - C:\Windows\Prefetch\PDFSERVERENGINE.EXE-40138676.pf O45 - LFCP:[MD5.01F4304C05BA40F089A3B41B430D6C31] - 01/07/2013 - 22:53:37 ---A- - C:\Windows\Prefetch\PREVIEWERSURROGATE.EXE-54AACE7C.pf O45 - LFCP:[MD5.0A88E30C6494F58B0D5E94E1AC479AFB] - 01/07/2013 - 22:53:38 ---A- - C:\Windows\Prefetch\CONVERSIONSERVICE.EXE-898FB6E6.pf O45 - LFCP:[MD5.9F0A466CF2D0E51E26B53723BE331430] - 08/07/2013 - 12:40:53 ---A- - C:\Windows\Prefetch\TEMPOPERFECT.EXE-0E2FB141.pf O45 - LFCP:[MD5.7C5C7A6B8EC5CBDF6B9402DBC95D95C8] - 08/07/2013 - 14:03:03 ---A- - C:\Windows\Prefetch\CUBASE5.EXE-1A83F909.pf O45 - LFCP:[MD5.731616BC458CA76D1713D23025B32EFA] - 08/07/2013 - 21:45:25 ---A- - C:\Windows\Prefetch\GP5.EXE-8EEA8054.pf O45 - LFCP:[MD5.CB90AA99BB79E8D3BC20C1DE04BC07B9] - 30/06/2013 - 13:20:11 ---A- - C:\Windows\Prefetch\CRYPTED.EXE-DC2EA5F7.pf O45 - LFCP:[MD5.CD6DEEFF17B3B77795DE430ACCBA24D6] - 30/06/2013 - 13:20:11 ---A- - C:\Windows\Prefetch\KEYGEN.EXE-A4EA1020.pf O45 - LFCP:[MD5.D1DEB9A91F36CF76D77C7C296EFE8583] - 30/06/2013 - 13:20:11 ---A- - C:\Windows\Prefetch\RIFFMA~1.TMP-73CFB07B.pf O45 - LFCP:[MD5.1EAD07AEC7CFE6321CB35D50A7F55E16] - 30/06/2013 - 13:20:23 ---A- - C:\Windows\Prefetch\RIFFMA~1.EXE-E2D25704.pf O45 - LFCP:[MD5.25FD61A45C6971F059DB2981CFBB2E0D] - 30/06/2013 - 13:20:23 ---A- - C:\Windows\Prefetch\RIFFMA~1.TMP-50110872.pf O45 - LFCP:[MD5.2ED618FB1BBEB9F5A23BA2E44A6A8691] - 30/06/2013 - 13:21:21 ---A- - C:\Windows\Prefetch\3F06.TMP-FE427C92.pf O45 - LFCP:[MD5.90D4C7D889CC11BF50E9AF9592A6E7C6] - 30/06/2013 - 13:28:34 ---A- - C:\Windows\Prefetch\DOTNETFX45_FULL_SETUP(1).EXE-79D1E6E4.pf O45 - LFCP:[MD5.392C6B9E68A1E39EDE6A7759FED8730C] - 30/06/2013 - 13:32:37 ---A- - C:\Windows\Prefetch\TMP7647.TMP.EXE-8F799D6B.pf O45 - LFCP:[MD5.858309FF143973B38FBC362EC8802F05] - 30/06/2013 - 13:42:09 ---A- - C:\Windows\Prefetch\DOTNETFX45LP_FULL_X86FR.EXE-B9F7A043.pf O45 - LFCP:[MD5.130C433DDBE7258DF71A9DC49DD32A61] - 30/06/2013 - 13:54:00 ---A- - C:\Windows\Prefetch\RIFFMASTER.EXE-60036EA9.pf O45 - LFCP:[MD5.55CD38D8757477B95AD4CF5B7A96CC3E] - 30/06/2013 - 13:58:21 ---A- - C:\Windows\Prefetch\RIFFSTATION PRO. V2.3TRIAL.EX-A209D868.pf O45 - LFCP:[MD5.6A8B633C7F2BB4125420DB3C48C0C5ED] - 30/06/2013 - 13:58:22 ---A- - C:\Windows\Prefetch\RIFFMA~1.EXE-57500261.pf O45 - LFCP:[MD5.8D31FEEFCC2E27DD88B7430FF7E0D65C] - 30/06/2013 - 13:58:22 ---A- - C:\Windows\Prefetch\RIFFMA~1.TMP-2A10A364.pf O45 - LFCP:[MD5.BF4264EBBBF185BFD38E7727E87FC24C] - 30/06/2013 - 13:58:22 ---A- - C:\Windows\Prefetch\RIFFMA~1.TMP-8852055F.pf O45 - LFCP:[MD5.98BED0C20C1AA2140D7C535D2C6D6C5A] - 30/06/2013 - 13:58:25 ---A- - C:\Windows\Prefetch\CRYPTED.EXE-B64E879C.pf O45 - LFCP:[MD5.7E0522D30640D8E1422E7D193797F07B] - 30/06/2013 - 14:54:07 ---A- - C:\Windows\Prefetch\RIFFSTATION TRIAL.EXE-EA16D168.pf ~ Prefetcher: 138 Legitimates Filtered in 00mn 00s ---\\ Microsoft Windows Policies System (O55) O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 ~ MWPS: 18 Legitimates Filtered in 00mn 00s ---\\ Liste des Drivers Système (O58) O58 - SDL:[MD5.04F0FCAC69C7C71A3AC4EB97FAFC8303] - 21/01/2008 - 03:32:46 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [422968] O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 02/11/2006 - 08:09:42 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029] ~ Drivers: Scanned in 00mn 00s ---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61) O61 - LFC: 07/07/2013 - 18:32:10 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\logs\2013-07-07--16-41-35.klg [85742] O61 - LFC: 08/07/2013 - 13:14:34 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\logs\2013-07-08--13-46-47.klg [86338] O61 - LFC: 08/07/2013 - 13:26:14 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\logs\2013-07-08--14-15-46.klg [86035] O61 - LFC: 08/07/2013 - 13:27:26 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\logs\2013-07-08--14-27-25.klg [389] O61 - LFC: 08/07/2013 - 13:32:11 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\logs\2013-07-08--14-28-13.klg [86440] O61 - LFC: 08/07/2013 - 13:33:20 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\logs\2013-07-08--14-33-19.klg [389] O61 - LFC: 08/07/2013 - 14:01:23 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\logs\2013-07-08--14-36-43.klg [8663] O61 - LFC: 08/07/2013 - 14:02:56 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\logs\2013-07-08--15-02-09.klg [85836] O61 - LFC: 08/07/2013 - 14:04:10 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\mediabay.db [1949696] O61 - LFC: 08/07/2013 - 15:29:11 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\Db\kontaktdb [936444] O61 - LFC: 08/07/2013 - 15:29:11 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\Db\kontaktdbLock [240] O61 - LFC: 08/07/2013 - 15:29:12 ---A- C:\Users\Julien\AppData\Local\Native Instruments\Kontakt 4\logs\2013-07-08--15-04-26.klg [86440] O61 - LFC: 08/07/2013 - 15:29:13 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\External Plugins.xml [79] O61 - LFC: 08/07/2013 - 15:29:13 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Midi Devices.bin [13710] O61 - LFC: 08/07/2013 - 15:29:14 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\MediaDefaults.xml [22874] O61 - LFC: 08/07/2013 - 15:29:14 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Port Setup.xml [5003] O61 - LFC: 08/07/2013 - 15:29:14 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Quick Controls MIDI.xml [1074] O61 - LFC: 08/07/2013 - 15:29:14 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Vst2xBlacklist.xml [2937] O61 - LFC: 08/07/2013 - 15:29:14 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Vst2xPlugins.xml [164115] O61 - LFC: 08/07/2013 - 15:29:15 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Edit Modifiers.xml [2627] O61 - LFC: 08/07/2013 - 15:29:15 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\FileSysObserver.xml [1090] O61 - LFC: 08/07/2013 - 15:29:15 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\GuitarLib.xml [67095] O61 - LFC: 08/07/2013 - 15:29:15 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Key Commands.xml [148143] O61 - LFC: 08/07/2013 - 15:29:15 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Presets\RAMPresets.xml [52011] O61 - LFC: 08/07/2013 - 15:29:15 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Score Custom Palettes.xml [3075] O61 - LFC: 08/07/2013 - 15:29:15 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Score Default Font.xml [253] O61 - LFC: 08/07/2013 - 15:29:15 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Score Setting Window.xml [158] O61 - LFC: 08/07/2013 - 15:29:18 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Presets\Chord Symbols.pxml [3414] O61 - LFC: 08/07/2013 - 15:29:18 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Presets\InsertsFolderPresets.pxml [3359066] O61 - LFC: 08/07/2013 - 15:29:18 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Presets\VstEqPreset.pxml [157019] O61 - LFC: 08/07/2013 - 15:29:18 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Window Layouts.xml [194] O61 - LFC: 08/07/2013 - 15:29:19 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Defaults.xml [735586] O61 - LFC: 08/07/2013 - 15:29:23 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\ContentManager.xml [5138] O61 - LFC: 08/07/2013 - 15:29:23 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\scannedFolders.bin [13624] O61 - LFC: 08/07/2013 - 15:29:24 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\Frame.xml [273] O61 - LFC: 08/07/2013 - 15:29:24 ---A- C:\Users\Julien\AppData\Roaming\Steinberg\Cubase 5\VstPlugInfo.xml [51076] ~ 4 Fichiers temporaires (Temporary files) ~ Files: 42 Legitimates Filtered in 00mn 06s ---\\ Liste des outils de nettoyage (O63) O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 ~ ADS: Scanned in 00mn 00s ---\\ Start Menu Internet (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\\ Search Browser Infection (O69) O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (@ieframe.dll,-12512) - http://www.bing.com O69 - SBI: SearchScopes [HKCU] {67A2568C-7A0A-4EED-AECC-B5405DE63B64} - (Google) - http://www.google.com O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - http://www.bing.com ~ Keys: Scanned in 00mn 00s ---\\ Internet Feature Controls (O81) O81 - IFC: Internet Feature Controls [HKUS\.DEFAULT] [FEATURE_BROWSER_EMULATION] -- svchost.exe =>Rootkit.TDSS O81 - IFC: Internet Feature Controls [HKUS\S-1-5-18] [FEATURE_BROWSER_EMULATION] -- svchost.exe =>Rootkit.TDSS ~ Keys: Scanned in 00mn 00s ---\\ Recherche particuliere à la racine de certains dossiers (O84) [MD5.AAC9C787EE0F38625FFBC8E34FCE961C] [SPRF][02/07/2013] (...) -- C:\ProgramData\1372723922.bdinstall.bin [169469] [MD5.F3CC9DF2129412EE70C0B04CE65B5AE1] [SPRF][02/07/2013] (...) -- C:\ProgramData\1372759702.bdinstall.bin [557238] [MD5.FE2EC4726DB325BDD11B9485565F5EBA] [SPRF][01/07/2013] (...) -- C:\Users\Julien\AppData\Local\Temp\bitdefender_isecurity_[quickscan].exe [2436368] [MD5.3C0A436B68E1FF41BE35C5C7CC9A9211] [SPRF][01/04/2013] (.NCH Software - Express Burn.) -- C:\Users\Julien\AppData\Local\Temp\burnsetup.exe [777880] [MD5.3D7CDC3E67A97110321BF7453C649B1F] [SPRF][26/02/2013] (...) -- C:\Users\Julien\AppData\Local\Temp\DeltaTB.exe [775664] =>Toolbar.DeltaSearch [MD5.A55B82103A202C20717F45C201EC4553] [SPRF][13/01/2013] (.Terra Informatica Software, Inc., British C - HTMLayout - embeddable HTML rendering and layout component.) -- C:\Users\Julien\AppData\Local\Temp\htmlayout.dll [936960] [MD5.2FF9B590342C62748885D459D082295F] [SPRF][30/06/2013] (.Adobe Systems, Inc. - Adobe® Flash® Player Installer/Uninstaller 11.0 r1.) -- C:\Users\Julien\AppData\Local\Temp\InstallFlashPlayer.exe [89248] [MD5.AC3129819FAA20A776239F48E57D2B35] [SPRF][26/02/2013] (.Babylon Ltd. - Babylon Client Setup.) -- C:\Users\Julien\AppData\Local\Temp\MyBabylonTB.exe [786584] =>Toolbar.Babylon [MD5.C969BCFA5CB2A54411FB075D067B71AC] [SPRF][26/02/2013] (.PC Utilities Pro - Fix, clean, optimize your PC!.) -- C:\Users\Julien\AppData\Local\Temp\OptimizerPro.exe [4159008] =>PUP.OptimizerPro [MD5.D88D453C3DDBE7CD0056B36FFA115573] [SPRF][26/02/2013] (.QuickShare - QuickShare.) -- C:\Users\Julien\AppData\Local\Temp\QuickShare1.exe [7900944] =>PUP.QuickShare [MD5.5CB17097A5752337977A9A7FED3A06E5] [SPRF][19/06/2013] (.Spotify Ltd - Spotify.) -- C:\Users\Julien\AppData\Local\Temp\SpotifyUninstall.exe [4643328] [MD5.F9D5E3DE90D94D5B0B2C09963A442A20] [SPRF][13/07/2012] (...) -- C:\Users\Julien\AppData\Local\Temp\srtspse.dat [588] [MD5.EC8A1FA9641545E16B3B7C9E6D9FD02E] [SPRF][18/07/2012] (...) -- C:\Users\Julien\AppData\Local\Temp\srtspso.dat [2692] [MD5.861405D1F7AC1B58177392F7401FCD76] [SPRF][29/05/2008] (...) -- C:\Users\Julien\AppData\Local\Temp\srtspsp.dat [524] [MD5.57BC8F4F1201610668773875A4484C1E] [SPRF][31/01/2013] (.Babylon Ltd. - Uninstaller Application.) -- C:\Users\Julien\AppData\Local\Temp\uninst1.exe [392784] =>Toolbar.Babylon [MD5.909B1A67B2AFB5CFD77D88FFF8983BBC] [SPRF][08/01/2013] (.http://goforfiles.com/ - GoforFiles Application.) -- C:\Users\Julien\AppData\Local\Temp\uninstall3507432.exe [899728] =>P2P.GoforFiles [MD5.A55B82103A202C20717F45C201EC4553] [SPRF][08/01/2013] (.Terra Informatica Software, Inc., British C - HTMLayout - embeddable HTML rendering and layout component.) -- C:\Users\Julien\AppData\Local\Temp\uninstall3507479.exe [936960] [MD5.7810AB1CF04E012469C141ABC693D3A7] [SPRF][26/02/2013] (.Somoto Ltd. - FilesFrog Update Checker.) -- C:\Users\Julien\AppData\Local\Temp\UpdateCheckerSetup.exe [295440] =>Adware.MegaSearch [MD5.1CBF54A0FF546754683FC314FFC80623] [SPRF][10/05/2013] (...) -- C:\Users\Julien\AppData\Local\Temp\uttBBD4.tmp.bat [96] [MD5.1CBF54A0FF546754683FC314FFC80623] [SPRF][10/05/2013] (...) -- C:\Users\Julien\AppData\Local\Temp\uttBC1E.tmp.bat [96] [MD5.8197D807A8D81F3FF3D19D0902E2FEB2] [SPRF][22/12/2012] (...) -- C:\Users\Julien\AppData\Local\Temp\uttC50.tmp.bat [96] [MD5.8197D807A8D81F3FF3D19D0902E2FEB2] [SPRF][22/12/2012] (...) -- C:\Users\Julien\AppData\Local\Temp\uttCBD.tmp.bat [96] [MD5.6F818F88CD2498A4D522BA138B2AE816] [SPRF][16/06/2013] (...) -- C:\Users\Julien\AppData\Roaming\wklnhst.dat [1624] [MD5.1078C8BD8C62CF4DEE6FE1058C3D56A7] [SPRF][08/07/2013] (...) -- C:\Users\Julien\Desktop\adwcleaner.exe [650027] [MD5.94247F2C722FE9FE2DA9EB7FD5BED9B0] [SPRF][08/07/2013] (.Oleg N. Scherbakov - 7z Setup SFX.) -- C:\Users\Julien\Desktop\JRT.exe [547139] [MD5.F57DCAA101AEF91CA302EA2E26EE61EB] [SPRF][08/07/2013] (.Nicolas Coolman - ZHPDiag.) -- C:\Users\Julien\Desktop\ZHPDiag2.exe [5703563] [MD5.42BCB2ABD0474745C615641D033F1AF4] [SPRF][08/07/2013] (.Nicolas Coolman - ZHPFix.) -- C:\Users\Julien\Desktop\ZHPFix.exe [3436678] [MD5.56940B50AB0E5923822F47B0E4463885] [SPRF][26/06/2012] (.Bitdefender LLC - Bitdefender QuickScan.) -- C:\Windows\Downloaded Program Files\qsax.dll [731688] ~ Files: Scanned in 00mn 02s ---\\ Scan Additionnel (O88) Database Version : v2.12703 - (07/07/2013) Clés trouvées (Keys found) : 0 Valeurs trouvées (Values found) : 0 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 6 C:\Users\Julien\AppData\Local\Temp\uninst1.exe =>Toolbar.Babylon C:\Users\Julien\AppData\Local\Temp\MyBabylonTB.exe =>PUP.SweetIM C:\Users\Julien\AppData\Local\Temp\UpdateCheckerSetup.exe =>Adware.MegaSearch ~ Additionnel Scan: 283551 Items scanned in 00mn 34s ---\\ Product Upgrade Codes (O90) O90 - PUC: "2F0F48BCB729D854D95C7838E2D36C35" . (.GearDrvs.) -- C:\Windows\Installer\{CB84F0F2-927B-458D-9DC5-87832E3DC653}\ARPPRODUCTICON.exe ~ Update Products: 45 Legitimates Filtered in 00mn 00s ---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped) SR - | Auto 18/12/2012 65192 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe SS - | Demand 30/06/2013 256904 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe SR - | Auto 03/03/2008 16384 | (BUNAgentSvc) . (.NewTech Infosystems, Inc..) - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe SR - | Auto 24576 | (ETService) . (...) - C:\Program Files\EMACHINES\eMachines Recovery Management\Service\ETService.exe SR - | Auto 20/07/2008 354840 | (IAANTMON) . (.Intel Corporation.) - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe SR - | Auto 17/01/2007 61440 | (LightScribeService) . (.Hewlett-Packard Company.) - C:\Program Files\Common Files\LightScribe\LSSrvc.exe SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe SS - | Demand 05/02/2013 235216 | (McComponentHostService) . (.McAfee, Inc..) - C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe SS - | Demand 03/07/2013 117144 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe SR - | Auto 06/04/2008 50424 | (NTIBackupSvc) . (.NewTech InfoSystems, Inc..) - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe SR - | Auto 131072 | (NTISchedulerSvc) . (...) - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe SS - | Demand 02/04/2012 67120 | (SafeBox) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe SS - | Demand 19/02/2010 517096 | (SwitchBoard) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe SS - | Demand 14/10/2011 307544 | (Update Server) . (.BitDefender.) - C:\Program Files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe SR - | Auto 28/05/2012 55032 | (UPDATESRV) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender 2012\updatesrv.exe SR - | Auto 21/11/2012 1554176 | (vsserv) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender 2012\vsserv.exe ~ Services: Scanned in 00mn 01s ---\\ Recherche Master Boot Record Infection (MBR)(O80) Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net Run by Julien at 09/07/2013 15:40:09 device: opened successfully user: MBR read successfully Disk trace: called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x86DB9698]<< 1 ntkrnlpa!IofCallDriver[0x81ED7FEF] >> \Device\Harddisk0\DR0[0x85BCA8E0] \Driver\00000756[0x86BEFD50] >> IRP_MJ_CREATE >> 0x86DB9698 kernel: MBR read successfully user & kernel MBR OK ~ MBR: 13 Legitimates Filtered in 00mn 02s ---\\ Recherche Master Boot Record Infection (MBRCheck)(O80) Written by ad13, http://ad13.geekstog Run by Julien at 09/07/2013 15:40:11 ********* Dump file Name ********* C:\PhysicalDisk0_MBR.bin ~ MBR: Scanned in 00mn 04s ---\\ Malicius Software Information ~ http://nicolascoolman.webs.com/apps/blog/show/26611908-rootkit-tdss =>Rootkit.TDSS ~ http://nicolascoolman.webs.com/apps/blog/show/27875657-toolbar-deltasearch =>Toolbar.DeltaSearch ~ http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon =>Toolbar.Babylon ~ http://nicolascoolman.webs.com/apps/blog/show/28204239-pup-optimizerpro =>PUP.OptimizerPro ~ http://nicolascoolman.webs.com/apps/blog/show/28577022-pup-quickshare =>PUP.QuickShare ~ http://nicolascoolman.webs.com/apps/blog/show/26919368-adware-megasearch =>Adware.MegaSearch ~ http://nicolascoolman.webs.com/apps/blog/show/29216159-pup-sweetim =>PUP.SweetIM ~ MSI: 7 link(s) detected in 00mn 04s ~ 871 Legitimates filtered by white list End of the scan (564 lines in 04mn 24s)(0)