Rapport Ad_renover ordi infecté par search-we

Hello,

search-web n'est pas dans le changelog de ad-remover et ne le seras pas à posteriori

Cependant.

▶ Relance AD-Remover, clique sur Nettoyer
▶ Laisse le pc redémarrer.
▶ Une fois revenu sur le bureau, le rapport devrait s''ouvrir : poste son contenu.
▶ S''il ne s''ouvre pas; il se trouve là : C:\AD-Report[CLEAN]1.txt

===================================

Nous allons effectuer un diagnostic de ton PC:
▶ Télécharge ZHPDiag sur ton bureau :

http://telechargement.zebulon.fr/zhpdiag.html
ou :
http://www.premiumorange.com/zeb-help-process/zhpdiag.html
ou :
ftp://zebulon.fr/ZHPDiag2.exe

▶ Laisse toi guider lors de l''installation,coche "Ajouter une icône sur le bureau" et décoche la case "Exécuter ZHPDiag"

/!\Utilisateur de Vista et Seven : Clique droit sur le logo de ZHPdiag, « exécuter en tant qu''Administrateur »

▶ Clique sur l''icône représentant une loupe (« Lancer le diagnostic »)
▶ Enregistre le rapport sur ton Bureau à l''aide de l''icône représentant une disquette
▶ Héberge le rapport ZHPDiag.txt sur un des sites ci dessous, puis copie/colle le lien fourni dans ta prochaine réponse sur le forum :
http://pjjoint.malekal.com/

Si indispo:
http://www.cijoint.fr/
ou :
http://www.toofiles.com/fr/documents-upload.html
ou :
http://www.cjoint.com
ou :
http://www.casimages.com

▶ Tuto zhpdiag :
http://www.premiumorange.com/zeb-help-process/zhpdiag.html


Hébergement de rapport sur pjjoint.malekal.com

▶ Rends toi sur pjjoint.malekal.com
▶ Clique sur le bouton Parcourir
▶ Sélectionne le fichier que tu veux heberger et clique sur Ouvrir
▶ Clique sur le bouton Envoyer
▶ Un message de confirmation s''affiche (L''upload a réussi ! - Le lien à transmettre à vos correspondant pour visualiser le fichier est : http://pjjoint.malekal.com/files.php?id=df5ea299241015) Copie le lien dans ta prochaine réponse.

re et merci

j ai telechargé ZHPdiag et je te transmet le lien

http://pjjoint.malekal.com/files.php?id=247cd77e071467

a bientot

as tu passé ad-remover en Nettoyage?
pourrais je avoir le rapport ?

il c fait il est au dessus lol

mais je te le redonne
======= RAPPORT D'AD-REMOVER 2.0.0.2,G | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 12/04/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

C:\Program Files (x86)\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 19:20:40 le 12/05/2011, Mode normal

Microsoft Windows 7 Édition Familiale Premium (X64)
Christel@CHRISTEL-PC (SAMSUNG ELECTRONICS CO., LTD. R780/R778)

============== ACTION(S) ==============



(!) -- Fichiers temporaires supprimés.


-- Fichier ouvert: C:\Users\Christel\AppData\Roaming\Mozilla\FireFox\Profiles\ovh33iuz.default\Prefs.js --
Ligne supprimée: user_pref("CT2567681.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT256...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/FR", "\"0\"")...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/960546/956314/FR", "\"0\"")...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2567681", ...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/toolbar/", "\"63425009534667...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "63...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=1/11/20...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=11/8/20...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=12/21/2...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=2/17/20...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=2/22/20...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=3/13/20...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT2567681&octid=...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Funky/minimize.gif...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Funky/play.gif", "...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Funky/stop.gif", "...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Funky/stopped.GIF"...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/BankImages/RadioSkins/Funky/vol.gif", "\...
Ligne supprimée: user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=fr-fr", "\"...
Ligne supprimée: user_pref("CommunityToolbar.EngineOwner", "CT2567681");
Ligne supprimée: user_pref("CommunityToolbar.EngineOwnerGuid", "{59994074-c06d-4a75-9768-49e5a8c21264}");
Ligne supprimée: user_pref("CommunityToolbar.EngineOwnerToolbarId", "messenger_plus_live_france");
Ligne supprimée: user_pref("CommunityToolbar.IsEngineShown", false);
Ligne supprimée: user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);
Ligne supprimée: user_pref("CommunityToolbar.OriginalEngineOwner", "CT2567681");
Ligne supprimée: user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "{59994074-c06d-4a75-9768-49e5a8c21264}");
Ligne supprimée: user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "messenger_plus_live_france");
Ligne supprimée: user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://www.cherche.us/Result.php?cx=part...
Ligne supprimée: user_pref("CommunityToolbar.ToolbarsList", "ConduitEngine,CT2567681");
Ligne supprimée: user_pref("CommunityToolbar.ToolbarsList2", "CT2567681");
Ligne supprimée: user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Tue May 03 2011 14:04:51 GMT+02...
Ligne supprimée: user_pref("CommunityToolbar.alert.alertInfoInterval", 60);
Ligne supprimée: user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Thu May 12 2011 17:09:53 GMT+0200");
Ligne supprimée: user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");
Ligne supprimée: user_pref("CommunityToolbar.alert.firstTimeAlertShown", true);
Ligne supprimée: user_pref("CommunityToolbar.alert.locale", "en");
Ligne supprimée: user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);
Ligne supprimée: user_pref("CommunityToolbar.alert.loginLastCheckTime", "Thu May 12 2011 17:09:45 GMT+0200");
Ligne supprimée: user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1303303927");
Ligne supprimée: user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);
Ligne supprimée: user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");
Ligne supprimée: user_pref("CommunityToolbar.alert.showTrayIcon", false);
Ligne supprimée: user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);
Ligne supprimée: user_pref("CommunityToolbar.alert.userId", "f4d85d67-38f9-44f9-8c77-5a5ab6fe8f1b");
Ligne supprimée: user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Mon Nov 29 2010 19:27:51 GMT+0100");
Ligne supprimée: user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Ligne supprimée: user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Ligne supprimée: user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2567681");
Ligne supprimée: user_pref("ConduitEngine.DialogsGetterLastCheckTime", "Tue May 03 2011 14:04:50 GMT+0200");
Ligne supprimée: user_pref("ConduitEngine.FirstServerDate", "11/29/2010 20");
Ligne supprimée: user_pref("ConduitEngine.FirstTime", true);
Ligne supprimée: user_pref("ConduitEngine.FirstTimeFF3", true);
Ligne supprimée: user_pref("ConduitEngine.HasUserGlobalKeys", true);
Ligne supprimée: user_pref("ConduitEngine.Initialize", true);
Ligne supprimée: user_pref("ConduitEngine.InitializeCommonPrefs", true);
Ligne supprimée: user_pref("ConduitEngine.InstalledDate", "Mon Nov 29 2010 19:27:50 GMT+0100");
Ligne supprimée: user_pref("ConduitEngine.IsMulticommunity", false);
Ligne supprimée: user_pref("ConduitEngine.IsOpenThankYouPage", false);
Ligne supprimée: user_pref("ConduitEngine.IsOpenUninstallPage", true);
Ligne supprimée: user_pref("ConduitEngine.LanguagePackLastCheckTime", "Sat Mar 26 2011 20:40:29 GMT+0100");
Ligne supprimée: user_pref("ConduitEngine.LastLogin_3.2.3.3", "Fri Dec 17 2010 05:54:07 GMT+0100");
Ligne supprimée: user_pref("ConduitEngine.SearchFromAddressBarIsInit", true);
Ligne supprimée: user_pref("ConduitEngine.SettingsLastCheckTime", "Sun Mar 27 2011 11:52:38 GMT+0200");
Ligne supprimée: user_pref("ConduitEngine.UserID", "UN60338711778892560");
Ligne supprimée: user_pref("ConduitEngine.engineLocale", "fr");
Ligne supprimée: user_pref("ConduitEngine.enngineContextMenuLastCheckTime", "Sat Mar 26 2011 20:40:29 GMT+0100");
Ligne supprimée: user_pref("ConduitEngine.globalFirstTimeInfoLastCheckTime", "Tue May 03 2011 14:04:50 GMT+0200");
Ligne supprimée: user_pref("ConduitEngine.initDone", true);
Ligne supprimée: user_pref("ConduitEngine.isAppTrackingManagerOn", true);
Ligne supprimée: user_pref("ConduitEngine.usagesFlag", 2);
Ligne supprimée: user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2567681&Sea...
-- Fichier Fermé --




============== SCAN ADDITIONNEL ==============

**** Mozilla Firefox Version [4.0.1 (fr)] ****

Searchplugins\bing.xml ( hxxp://www.bing.com/search)
Components\browsercomps.dll (Mozilla Foundation)

-- C:\Users\Christel\AppData\Roaming\Mozilla\FireFox\Profiles\ovh33iuz.default --
Prefs.js - browser.startup.homepage, hxxp://www.search-web.net/
Prefs.js - browser.startup.homepage, hxxp://www.search-web.net/
Prefs.js - browser.startup.homepage, hxxp://www.search-web.net/
Prefs.js - browser.download.lastDir, C:\\Users\\Christel\\Downloads
Prefs.js - browser.search.defaultenginename,
Prefs.js - browser.startup.homepage, hxxp://www.search-web.net/
Prefs.js - browser.startup.homepage_override.buildID, 20110413222027
Prefs.js - browser.startup.homepage_override.mstone, rv:2.0.1

========================================

**** Internet Explorer Version [9.0.8112.16421] ****

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896
HKCU_Main|Start Page - hxxp://fr.msn.com/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Start Page - hxxp://fr.msn.com/
HKCU_URLSearchHooks|{59994074-c06d-4a75-9768-49e5a8c21264} (x)
HKCU_SearchScopes\{557C21FE-7274-410D-853E-9ED4471BF193} - "search-web.net" (hxxp://search-web.net/results.php?cx=partner-pub-0420647136319153%3A5n6ugpjrdrh&...)
HKCU_SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64} - "?" (?)
HKLM_ElevationPolicy\{07d873dc-b9b9-44f5-af0b-fb59fa54fb7a} - C:\Windows\SysWOW64\wpcer.exe (x)
HKLM_ElevationPolicy\{0a402d70-1f10-4ae7-bec9-286a98240695} - C:\Windows\SysWOW64\winfxdocobj.exe (x)
HKLM_ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291} - C:\Program Files (x86)\IMinent Toolbar\TbHelper2.exe (x)
HKLM_ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999} - C:\Program Files (x86)\Internet Explorer\iedw.exe (x)
HKLM_ElevationPolicy\{B43A0C1E-B63F-4691-B68F-CD807A45DA01} - C:\windows\system32\TSWbPrxy.exe (x)
HKLM_ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08} - C:\Program Files (x86)\Iminent\MMServer\Iminent.MMServer.exe (x)

========================================

C:\Program Files (x86)\Ad-Remover\Quarantine: 0 Fichier(s)
C:\Program Files (x86)\Ad-Remover\Backup: 16 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 12/05/2011 19:20:44 (11082 Octet(s))
C:\Ad-Report-SCAN[1].txt - 12/05/2011 18:16:56 (11202 Octet(s))

Fin à: 19:21:33, 12/05/2011

============== E.O.F ==============

désolé mdr

1/

▶ Rentre dans ton panneau de configuration....
▶ Apparence et personnalisation...
▶ Option des dossiers...(double cliquer dessus)
▶ Dans l''onglet affichage un peu plus bas où il est indiqué "Afficher les dossiers et fichiers cachés": Coche cette option
▶ Encore plus bas : Masquer les fichiers protégés du système d''exploitation (recommandé) : à décocher.

▶ ▶ ensuite rends toi sur ce lien:
http://www.virustotal.com/

(si virustotal ne fonctionne pas: http://virusscan.jotti.org/fr)


▶ Là où il est indiqué "envoyer le fichier", Clique sur "parcourir"
recherche les entrées suivante dans ton disque :

C:\windows\SysWOW64\Rezip.exe

▶ Si une fenêtre apparait disant, "Le fichier à déjà été Analysé", Alors clique sur Réanalyser le fichier maintenant

▶ Copie et colle le lien de ta barre d''adresse ici, après que l''analyse soit terminée

=====================================================

2/

▶ Copie tout le texte présent dans la balise code ci-dessous ( tu le sélectionnes avec ta souris / Clique droit dessus et choisis "copier" ou fait Ctrl+C )

R3 - URLSearchHook: (no name) [64Bits] - {59994074-c06d-4a75-9768-49e5a8c21264} Clé orpheline    
O4 - Global Startup: C:\Users\Christel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\binternet.lnk . (...)  -- C:\Users\Christel\binternet.jar
[HKCU\Software\AppDataLow\Software\Messenger_Plus_Live_France]   
O69 - SBI: prefs.js [Christel - ovh33iuz.default] user_pref("CT2567681.SearchFromAddressBarUrl", "http://search.conduit.com/ResultsExt.aspx?ctid=CT2567681
O69 - SBI: prefs.js [Christel - ovh33iuz.default] user_pref("browser.search.defaulturl", "http://search.conduit.com/ResultsExt.aspx?ctid=CT2567681&SearchSource=
[HKCU\Software\AppDataLow\Software\Messenger_Plus_Live_France]   
C:\Users\Christel\Appdata\Local\Temp\Iminent
M0 - MFSP: prefs.js [Christel - ovh33iuz.default] http://www.search-web.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.search-web.net
R0 - HKUS\S-1-5-21-3849805104-749619427-1806466223-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.search-web.net
O15 - Trusted Zone: [HKCU\...\Domains] *.chat-land.org
O15 - Trusted Zone: [HKCU\...\Domains\www] *.chat-land.org
[HKCU\Software\Iminent]     
[HKLM\Software\ASK]
[HKLM\Software\Iminent]    
O69 - SBI: prefs.js [Christel - ovh33iuz.default] user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "http://www.cherche.us/Result.php?cx=partner-
O69 - SBI: SearchScopes [HKCU] {557C21FE-7274-410D-853E-9ED4471BF193} - (search-web.net) - http://search-web.net3A%23FFFFF0%3B&ie=iso-8859-1&oe=iso-8859-1&sa=Rechercher&lang=en&q=/...{searchTerms}  
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{557C21FE-7274-410D-853E-9ED4471BF193}]     
[HKCU\Software\Iminent]    
[HKLM\Software\Iminent]   
[HKLM\Software\Wow6432Node\Iminent]    

▶ Puis Lance ZHPFix depuis le raccourci du bureau .

▶ Une fois l''outil ZHPFix ouvert , clique sur le bouton [ H ] ( "coller les lignes Helper" ) .

▶ Dans l''encadré principal tu verras donc les lignes que tu as copié précédemment apparaitrent .

▶ Vérifie que toutes les lignes que je t''ai demandé de copier (et seulement elles) sont dans la fenêtre.

▶ Clique sur le bouton « GO » pour lancer le nettoyage

▶ Copie/Colle le rapport à l''écran dans ton prochain message

▶ (le rapport se trouve aussi dans le dossier de zhpdiag dans program files sous le nom de ZHPFixReport.txt)

▶ Redémarre ton ordinateur

=======================================================

3/

▶ Télécharge Malwarebytes'' Anti-Malware et enregistre le sur ton bureau.

▶ ▶ Miroir 1 si inaccessible

▶ ▶ Miroir 2 si inaccessible

▶ ▶ /!\ Utilisateur de Vista et Windows 7 : Clique droit sur le logo de Malwarebytes'' Anti-Malware, « exécuter en tant qu''Administrateur »

▶ Double clique sur le fichier téléchargé pour lancer le processus d''installation.
▶ Dans l''onglet "mise à jour", clique sur le bouton Recherche de mise à jour
▶ si le pare-feu demande l''autorisation de se connecter pour Malwarebytes, accepte
▶ Une fois la mise à jour terminée
▶ rends-toi dans l''onglet Recherche
▶ Sélectionne Exécuter un examen complet
▶ Clique sur Rechercher
▶ ▶ Le scan démarre.
▶ A la fin de l''analyse, un message s''affiche : L''examen s''est terminé normalement. Cliquez sur ''Afficher les résultats'' pour afficher tous les objets trouvés.
▶ Clique sur Ok pour poursuivre.
▶ Si des malwares ont été détectés, cliques sur Afficher les résultats
▶ Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection . Malwarebytes va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
▶ Malwarebytes va ouvrir le bloc-notes et y copier le rapport d''analyse. Copie/colle le ici (ctrl+a pour tout sélectionner, ctrl+c pour copier, ctrl+v pour coller)

▶ ▶ Il se peut que MBAM ait besoin de redémarrer le pc pour finaliser la suppression, donc pas de panique, redémarre ton pc !!!
▶ Une fois le PC redémarré, rends toi dans l''onglet rapport/log
▶ Tu clique dessus pour l''afficher, une fois affiché
▶ Copie/colle le ici (ctrl+a pour tout sélectionner, ctrl+c pour copier, ctrl+v pour coller)

Si tu as besoin d''aide regarde ce tutoriel :
http://www.malekal.com/tutorial_MalwareBytes_AntiMalware.php

▶ ▶ Si tu n''arrive pas à le mettre à jour, télécharge ce fichier , ferme MBAM, et exécute le

======================================================

4/

Refais un ZHPDiag stp ;)

A+

lien 1 http://www.virustotal.com/...

rapport ZHPFIX

a suivre car zhpfix est tres long (c normal?)
si oui je te donne le rapport des que possible

Re,

Concernant l'étape 1 : le lien n'est pas passé.
Soit tu t'inscrit, soit tu met le lien entre les balises code (le bouton à côté du S souligné)

============

Etapes 2 et 3 : ok

============

Manque l'étape 4.

Normalement, tu es débarré de Search web mais y'a encore quelques reste qu'on va éliminer demain :)

Bonne nuit.

je te remet le lien de l etape 1

http://www.virustotal.com/...

oups j avais zappé de te transmettre le rapport de l etape 4 le voila

Rapport de ZHPDiag v1.27.203 par Nicolas Coolman, Update du 12/05/2011
Run by Christel at 5/12/2011 9:36:11 PM
Web site : http://www.premiumorange.com/zeb-help-process/zhpdiag.html


---\\ Web Browser
MSIE: Internet Explorer v9.0.8112.16421
MFIE: Mozilla Firefox 4.0.1 v4.0.1 (Defaut)

---\\ System Information
Windows 7 Home Premium Edition, 64-bit (Build 7600)
Processor: Intel64 Family 6 Model 37 Stepping 2, GenuineIntel
Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3949.6 MB (67% free)
System Restore: Activé (Enable)
System drive C: has 290 GB (83%) free of 347 GB

---\\ Logged in mode
Computer Name: CHRISTEL-PC
User Name: Christel
All Users Names: HomeGroupUser$, Christel, Administrateur,
Unselected Option: O45,O61,O62,O65,O66,O82
Logged in as Administrator

---\\ Environnement Variables
%AppData%=C:\Users\Christel\AppData\Roaming
%LocalAppData%=C:\Users\Christel\AppData\Local
%StartMenu%=C:\Users\Christel\AppData\Roaming\Microsoft\Windows\Start Menu

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 290 Go of 347 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 103 Go of 104 Go)
E:\ CD-ROM drive (Not Inserted)



---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Security Center] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UacDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] UacDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] NoActiveDesktopChanges: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowSearch: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: OK



---\\ Recherche particulière de fichiers génériques
[MD5.0862495E0C825893DB75EF44FAEA8E93] - (.Microsoft Corporation - Explorateur Windows.) (.2/26/2011 7:23:14 AM.) -- C:\windows\Explorer.exe [2870272]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Application de démarrage de Windows.) (.7/14/2009 2:14:45 AM.) -- C:\windows\system32\Wininit.exe [96256]
[MD5.A1236375B74EA63C75657D564890C436] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.4/10/2011 8:31:33 AM.) -- C:\windows\system32\wininet.dll [1126912]



---\\ Processus lancés
[MD5.6EEDA0FEC23567185CECDE98AE6A897C] - (.SAMSUNG Electronics - SSCKbdHk.) -- C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe [91136]
[MD5.A46796CCF032D35720347262998D1F90] - (.Samsung Electronics Co., Ltd. - Easy Display Manager.) -- C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe [835072]
[MD5.167F9E5AF87B57763DAAA27D3144C2A0] - (.SEC - Samsung Recovery Solution 4.) -- C:\Program Files (x86)\Samsung\Samsung Recovery Solution 4\WCScheduler.exe [2201192]
[MD5.E3735DC796E5183D63F35921B058934C] - (.Samsung Electronics Co., Ltd. - EasySpeedUpManager.) -- C:\Program Files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [716800]
[MD5.BC9C9BE7BB74D629362608ACE470E7DA] - (.Microsoft Corporation - Notification de cadeaux MSN.) -- C:\Users\Christel\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe [135680]
[MD5.54FA8528EDA1B6B34615F4EA3FCB35E6] - (.CyberLink - CyberLink MediaLibray Service.) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [103720]
[MD5.28FD28A29C637C9AFEFE0A26E27C6DFE] - (.CyberLink Corp. - PowerDVD RC Service.) -- C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe [91432]
[MD5.36086951E7475DC238830173163186D3] - (.DoctorSoft - AnyPC Language Application.) -- C:\Program Files (x86)\AnyPC Client\APLangApp.exe [13312]
[MD5.2E9A1A6555C20424FC6DCC3AF21F4D68] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3451496]
[MD5.37BF603C3685289CA684C4D3400A9DE7] - (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe [35760]
[MD5.BAD6BEA0DE1F69C82BDB74378CE0C20A] - (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288]
[MD5.2E5212A0BFB98FE0167C92C76C87AFE3] - (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [249064]
[MD5.E83508D9A0F0D0D8449317DC6A4C5E02] - (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [924632]
[MD5.3B2CC09944488DB5ED5DFDC315C9AB57] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe [16856]
[MD5.1E7E8FE07832E577FF31703542D2E8A1] - (.Nicolas Coolman - Diagnostic Tool.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [645632]



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
M3 - MFPP: Plugins - [Christel] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\amazon-france.xml
M3 - MFPP: Plugins - [Christel] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\bing.xml
M3 - MFPP: Plugins - [Christel] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\cnrtl-tlfi-fr.xml
M3 - MFPP: Plugins - [Christel] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\eBay-france.xml
M3 - MFPP: Plugins - [Christel] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\google.xml
M3 - MFPP: Plugins - [Christel] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\wikipedia-fr.xml
M3 - MFPP: Plugins - [Christel] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\yahoo-france.xml
P2 - FPN:Firefox Plugin Navigator . (.Sun Microsystems, Inc. - NPRuntime Script Plug-in Library for Java(TM) Deploy.) -- C:\Program Files (x86)\Mozilla Firefox\Plugins\npdeployJava1.dll
P2 - FPN:Firefox Plugin Navigator . (.Microsoft Corporation - Office Plugin for Netscape Navigator.) -- C:\Program Files (x86)\Mozilla Firefox\Plugins\NPOFF12.DLL
P2 - FPN:Firefox Plugin Navigator . (.Adobe Systems Inc. - Adobe PDF Plug-In For Firefox and Netscape "9.4.3".) -- C:\Program Files (x86)\Mozilla Firefox\Plugins\nppdf32.dll
M0 - MFSP: prefs.js [Christel - ovh33iuz.default] http://www.search-web.net/



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com
R0 - HKUS\S-1-5-21-3849805104-749619427-1806466223-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R3 - URLSearchHook: Microsoft Url Search Hook [64Bits] - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Navigateur Internet.) (9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)) -- C:\Windows\System32\ieframe.dll
R4 - HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,EnabledV8 = 0



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll



---\\ ---\\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2)
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: VMApplet=C:\WINDOWS\system32\SystemPropertiesPerformance.exe



---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: Windows Live ID Sign-in Helper [64Bits] - {9030D464-4C02-4ABF-8ECC-5164760863C6} . (.Microsoft Corp. - Microsoft® Windows Live ID Login Helper.) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll



---\\ ---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
O4 - HKLM\..\Run: [SynTPEnh] . (.Synaptics Incorporated - Synaptics TouchPad Enhancements.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NvCplDaemon] C:\windows\system32\NvCpl.dll (.not file.)
O4 - HKCU\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
O4 - HKLM\..\Wow6432Node\Run: [UpdateLBPShortCut] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Wow6432Node\Run: [CLMLServer] . (.CyberLink - CyberLink MediaLibray Service.) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
O4 - HKLM\..\Wow6432Node\Run: [UpdateP2GoShortCut] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Wow6432Node\Run: [UpdatePDRShortCut] C:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exer\7.0 (.not file.)
O4 - HKLM\..\Wow6432Node\Run: [RemoteControl8] . (.CyberLink Corp. - PowerDVD RC Service.) -- C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe
O4 - HKLM\..\Wow6432Node\Run: [PDVD8LanguageShortcut] . (.CyberLink Corp. - PowerDVD Language Application.) -- C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe
O4 - HKLM\..\Wow6432Node\Run: [UpdatePPShortCut] C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exer\5.0 (.not file.)
O4 - HKLM\..\Wow6432Node\Run: [UpdatePSTShortCut] Clé orpheline
O4 - HKLM\..\Wow6432Node\Run: [APLangApp] . (.DoctorSoft - AnyPC Language Application.) -- C:\Program Files (x86)\AnyPC Client\APLangApp.exe
O4 - HKLM\..\Wow6432Node\Run: [UCam_Menu] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe
O4 - HKLM\..\Wow6432Node\Run: [avast5] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\Alwil Software\Avast5\avastUI.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-21-3849805104-749619427-1806466223-1000\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (.not file.)
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (.not file.)
O4 - Global Startup: C:\Users\Christel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notification de cadeaux MSN.lnk . (.Microsoft Corporation.) -- C:\Users\Christel\AppData\Roaming\Microsoft\Notification de cadeaux MSN\lsnfier.exe



---\\ ---\\ Autres liens utilisateurs (O4)
O4 - Global Startup: C:\Users\Christel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\Christel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\Christel\Desktop\AD-R.lnk . (...) -- C:\Program Files (x86)\Ad-Remover\main.exe
O4 - Global Startup: C:\Users\Christel\Desktop\CyberLink DVD Suite.lnk . (.CyberLink.) -- C:\Program Files (x86)\CyberLink\DVD Suite\PowerStarter.exe
O4 - Global Startup: C:\Users\Christel\Desktop\CyberLink YouCam.lnk . (.CyberLink Corp..) -- C:\Program Files (x86)\CyberLink\YouCam\YouCam.exe
O4 - Global Startup: C:\Users\Christel\Desktop\Internet Explorer.lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\Christel\Desktop\Windows Live Messenger.lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
O4 - Global Startup: C:\Users\Christel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk . (.Microsoft Corporation.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - Global Startup: C:\Users\Christel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk . (.Mozilla Corporation.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe



---\\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)
O8 - Extra context menu item: E&xporter vers Microsoft Excel . (.Microsoft Corporation - Microsoft Office Excel.) -- C:\PROGRA~2\MICROS~2\Office12\EXCEL.exe



---\\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Network Location Awareness 2.) -- C:\windows\system32\NLAapi.dll
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\windows\system32\mswsock.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\windows\system32\winrnr.dll
O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - Fournisseur Shim d'affectation de noms de messagerie.) -- C:\windows\system32\napinsp.dll
O10 - WLSP:\000000000005\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000006\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000007\Winsock LSP File . (.Microsoft Corporation - Windows Sockets Helper DLL.) -- C:\windows\system32\wshbth.dll
O10 - WLSP:\000000000008\Winsock LSP File . (.Microsoft Corp. - Microsoft® Windows Live ID Namespace Provider.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
O10 - WLSP:\000000000009\Winsock LSP File . (.Microsoft Corp. - Microsoft® Windows Live ID Namespace Provider.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{3AF464C6-BD2B-4AF0-986E-1B349EEEB122}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{3AF464C6-BD2B-4AF0-986E-1B349EEEB122}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{3AF464C6-BD2B-4AF0-986E-1B349EEEB122}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1



---\\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.



---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: (avast! Antivirus) . (.AVAST Software - avast! Service.) - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: (nvsvc) . (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 188.6.) - C:\windows\system32\nvvsvc.exe
O23 - Service: (Rezip) . (...) - C:\windows\SysWOW64\Rezip.exe
O23 - Service: (RichVideo) . (.Pas de propriétaire - RichVideo Module.) - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
O23 - Service: (wlidsvc) . (.Microsoft Corp. - Microsoft® Windows Live ID Service.) - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.exe



---\\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Default MHTML Editor: Last - .(...) - (.not file.)



---\\ Tâches planifiées en automatique (O39)
[MD5.167F9E5AF87B57763DAAA27D3144C2A0] [APT] [advSRS4] (.SEC.) -- C:\Program Files (x86)\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
[MD5.DC4BBD0A16557EC21CCA97390DD8D561] [APT] [APSchedulerC] (.DoctorSoft.) -- C:\Program Files (x86)\AnyPC Client\APLanMgrC.exe
[MD5.21E26DC6538C0C255467312559BEB107] [APT] [BatteryLifeExtender] (.Samsung Electronics. Co. Ltd..) -- C:\Program Files (x86)\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe
[MD5.A46796CCF032D35720347262998D1F90] [APT] [EasyDisplayMgr] (.Samsung Electronics Co., Ltd..) -- C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe



---\\ Pilotes lancés au démarrage (O41)
O41 - Driver: C:\windows\system32\drivers\afd.sys (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\windows\system32\drivers\afd.sys
O41 - Driver: (blbdrive) . (.Microsoft Corporation - BLB Drive Driver.) - C:\Windows\System32\DRIVERS\blbdrive.sys
O41 - Driver: (cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\Windows\System32\DRIVERS\cdrom.sys
O41 - Driver: C:\windows\system32\drivers\dfsc.sys (DfsC) . (.Microsoft Corporation - DFS Namespace Client Driver.) - C:\Windows\System32\Drivers\dfsc.sys
O41 - Driver: C:\windows\system32\drivers\discache.sys (discache) . (.Microsoft Corporation - System Indexer/Cache Driver.) - C:\Windows\System32\drivers\discache.sys
O41 - Driver: (mssmbios) . (.Microsoft Corporation - System Management BIOS Driver.) - C:\Windows\System32\DRIVERS\mssmbios.sys
O41 - Driver: (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\Windows\System32\DRIVERS\netbios.sys
O41 - Driver: (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\Windows\System32\DRIVERS\netbt.sys
O41 - Driver: C:\windows\system32\drivers\nsiproxy.sys (nsiproxy) . (.Microsoft Corporation - NSI Proxy.) - C:\Windows\System32\drivers\nsiproxy.sys
O41 - Driver: C:\windows\system32\drivers\pacer.sys (Psched) . (.Microsoft Corporation - Planificateur de paquets QoS.) - C:\Windows\System32\DRIVERS\pacer.sys
O41 - Driver: C:\windows\system32\wkssvc.dll (rdbss) . (.Microsoft Corporation - Pilote du sous-système de mise en mémoire t.) - C:\Windows\System32\DRIVERS\rdbss.sys
O41 - Driver: C:\windows\system32\DRIVERS\RDPCDD.sys (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\Windows\System32\DRIVERS\RDPCDD.sys
O41 - Driver: C:\windows\system32\drivers\RDPENCDD.sys (RDPENCDD) . (.Microsoft Corporation - RDP Encoder Miniport.) - C:\Windows\System32\drivers\rdpencdd.sys
O41 - Driver: C:\windows\system32\drivers\RdpRefMp.sys (RDPREFMP) . (.Microsoft Corporation - RDP Reflector Driver Miniport.) - C:\Windows\System32\drivers\rdprefmp.sys
O41 - Driver: (SABI) . (.SAMSUNG ELECTRONICS - SAMSUNG Kernel Driver.) - C:\windows\system32\Drivers\SABI.sys
O41 - Driver: C:\windows\system32\tcpipcfg.dll (Tcpip) . (.Microsoft Corporation - Pilote TCP/IP.) - C:\Windows\System32\drivers\tcpip.sys
O41 - Driver: C:\windows\system32\tcpipcfg.dll (tdx) . (.Microsoft Corporation - TDI Translation Driver.) - C:\Windows\System32\DRIVERS\tdx.sys
O41 - Driver: (TermDD) . (.Microsoft Corporation - Remote Desktop Server Driver.) - C:\Windows\System32\DRIVERS\termdd.sys
O41 - Driver: (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\windows\system32\drivers\vga.sys
O41 - Driver: (vwififlt) . (.Microsoft Corporation - Virtual WiFi Filter Driver.) - C:\Windows\System32\DRIVERS\vwififlt.sys
O41 - Driver: C:\windows\system32\rascfg.dll (Wanarpv6) . (.Microsoft Corporation - MS Remote Access and Routing ARP Driver.) - C:\Windows\System32\DRIVERS\wanarp.sys
O41 - Driver: (WfpLwf) . (.Microsoft Corporation - WFP NDIS 6.20 Lightweight Filter Driver.) - C:\Windows\System32\DRIVERS\wfplwf.sys



---\\ Logiciels installés (O42)
O42 - Logiciel: Update for Microsoft Office 2007 (KB2508958) - (.Microsoft.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}
O42 - Logiciel: Adobe Flash Player 10 ActiveX - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- Adobe Flash Player ActiveX
O42 - Logiciel: Adobe Flash Player 10 Plugin - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- Adobe Flash Player Plugin
O42 - Logiciel: Adobe Reader 9.4.3 - Français - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- {AC76BA86-7AD7-1036-7B44-A94000000001}
O42 - Logiciel: Akamai NetSession Interface - (.Pas de propriétaire.) [HKLM][64Bits] -- Akamai
O42 - Logiciel: AnyPC Client - (.Doctorsoft.) [HKLM][64Bits] -- {1AFA1FEF-8CF9-4A51-AC46-64FAA7F3D9E2}
O42 - Logiciel: Atheros Client Installation Program - (.Atheros.) [HKLM][64Bits] -- {D1434266-0486-4469-B338-A60082CC04E1}
O42 - Logiciel: BatteryLifeExtender - (.Samsung.) [HKLM][64Bits] -- {853F8A41-A3C9-43FA-87FA-1AE74FC6F3F7}
O42 - Logiciel: CCleaner - (.Piriform.) [HKLM] -- CCleaner
O42 - Logiciel: ChargeableUSB - (.SAMSUNG.) [HKLM][64Bits] -- {92D50865-FC60-4EA8-BA7A-5581B0D13EFB}
O42 - Logiciel: Complément Messenger - (.Microsoft Corporation.) [HKLM][64Bits] -- {6E5324C1-84FC-4F76-9A3A-C65E07F80EE6}
O42 - Logiciel: Contrôle ActiveX Windows Live Mesh pour connexions à distance - (.Microsoft Corporation.) [HKLM][64Bits] -- {55D003F4-9599-44BF-BA9E-95D060730DD3}
O42 - Logiciel: CyberLink DVD Suite - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}
O42 - Logiciel: CyberLink DVD Suite - (.CyberLink Corp..) [HKLM][64Bits] -- {1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}
O42 - Logiciel: CyberLink LabelPrint - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}
O42 - Logiciel: CyberLink LabelPrint - (.CyberLink Corp..) [HKLM][64Bits] -- {C59C179C-668D-49A9-B6EA-0121CCFC1243}
O42 - Logiciel: CyberLink Power2Go - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}
O42 - Logiciel: CyberLink Power2Go - (.CyberLink Corp..) [HKLM][64Bits] -- {40BF1E83-20EB-11D8-97C5-0009C5020658}
O42 - Logiciel: CyberLink PowerDVD 8 - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}
O42 - Logiciel: CyberLink PowerDVD 8 - (.CyberLink Corp..) [HKLM][64Bits] -- {2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}
O42 - Logiciel: CyberLink PowerDirector - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}
O42 - Logiciel: CyberLink PowerDirector - (.CyberLink Corp..) [HKLM][64Bits] -- {CB099890-1D5F-11D5-9EA9-0050BAE317E1}
O42 - Logiciel: CyberLink PowerProducer - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}
O42 - Logiciel: CyberLink PowerProducer - (.CyberLink Corp..) [HKLM][64Bits] -- {B7A0CE06-068E-11D6-97FD-0050BACBF861}
O42 - Logiciel: CyberLink YouCam - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}
O42 - Logiciel: CyberLink YouCam - (.CyberLink Corp..) [HKLM][64Bits] -- {01FB4998-33C4-4431-85ED-079E3EEFE75D}
O42 - Logiciel: D3DX10 - (.Microsoft.) [HKLM][64Bits] -- {E09C4DB7-630C-4F06-A631-8EA7239923AF}
O42 - Logiciel: Easy Display Manager - (.Samsung Electronics Co., Ltd..) [HKLM][64Bits] -- {17283B95-21A8-4996-97DA-547A48DB266F}
O42 - Logiciel: Easy Network Manager - (.Samsung.) [HKLM][64Bits] -- {34B76DCB-BF7C-440F-B058-C84172C1E338}
O42 - Logiciel: Easy SpeedUp Manager - (.Samsung Electronics Co.,Ltd..) [HKLM][64Bits] -- {EF367AA4-070B-493C-9575-85BE59D789C9}
O42 - Logiciel: EasyBatteryManager - (.Samsung.) [HKLM][64Bits] -- {178EE5F4-0F86-4BF0-A0D1-9790AFF409D1}
O42 - Logiciel: Feedback Tool - (.Microsoft Corporation.) [HKLM][64Bits] -- {13A5E785-5197-4EAD-8EE3-D660271E49BC}
O42 - Logiciel: Galerie de photos Windows Live - (.Microsoft Corporation.) [HKLM][64Bits] -- {488F0347-C4A7-4374-91A7-30818BEDA710}
O42 - Logiciel: Intel(R) Rapid Storage Technology - (.Intel Corporation.) [HKLM][64Bits] -- {3E29EE6C-963A-4aae-86C1-DC237C4A49FC}
O42 - Logiciel: Intel(R) Turbo Boost Technology Driver - (.Intel Corporation.) [HKLM][64Bits] -- {D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}
O42 - Logiciel: Java(TM) 6 Update 24 - (.Sun Microsystems, Inc..) [HKLM][64Bits] -- {26A24AE4-039D-4CA4-87B4-2F83216013FF}
O42 - Logiciel: Junk Mail filter update - (.Microsoft Corporation.) [HKLM][64Bits] -- {1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}
O42 - Logiciel: Logiciel d'archivage WinRAR - (.Pas de propriétaire.) [HKLM][64Bits] -- WinRAR archiver
O42 - Logiciel: MSVCRT - (.Microsoft.) [HKLM][64Bits] -- {8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}
O42 - Logiciel: MSVCRT_amd64 - (.Microsoft.) [HKLM][64Bits] -- {D0B44725-3666-492D-BEF6-587A14BD9BD9}
O42 - Logiciel: Malwarebytes' Anti-Malware - (.Malwarebytes Corporation.) [HKLM][64Bits] -- Malwarebytes' Anti-Malware_is1
O42 - Logiciel: Marvell Miniport Driver - (.Marvell.) [HKLM][64Bits] -- Marvell Miniport Driver
O42 - Logiciel: Mesh Runtime - (.Microsoft Corporation.) [HKLM][64Bits] -- {8C6D6116-B724-4810-8F2D-D047E6B7D68E}
O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- Microsoft .NET Framework 4 Client Profile
O42 - Logiciel: Microsoft .NET Framework 4 Client Profile - (.Microsoft Corporation.) [HKLM] -- {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM][64Bits] -- {90120000-0016-040C-0000-0000000FF1CE}_HOMESTUDENTR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM][64Bits] -- {90120000-0018-040C-0000-0000000FF1CE}_HOMESTUDENTR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM][64Bits] -- {90120000-001B-040C-0000-0000000FF1CE}_HOMESTUDENTR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM][64Bits] -- {90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{E64BA721-2310-4B55-BE5A-2925F9706192}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM][64Bits] -- {90120000-002A-040C-1000-0000000FF1CE}_HOMESTUDENTR_{B165D3C2-40AE-4D39-86F7-E5C87C4264C0}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM][64Bits] -- {90120000-006E-040C-0000-0000000FF1CE}_HOMESTUDENTR_{B165D3C2-40AE-4D39-86F7-E5C87C4264C0}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM][64Bits] -- {90120000-00A1-040C-0000-0000000FF1CE}_HOMESTUDENTR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
O42 - Logiciel: Microsoft Office 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
O42 - Logiciel: Microsoft Office Excel MUI (French) 2007 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90120000-0016-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Home and Student 2007 - (.Microsoft Corporation.) [HKLM][64Bits] -- HOMESTUDENTR
O42 - Logiciel: Microsoft Office Home and Student 2007 - (.Microsoft Corporation.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Live Add-in 1.3 - (.Microsoft Corporation.) [HKLM][64Bits] -- {57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}
O42 - Logiciel: Microsoft Office Office 64-bit Components 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-002A-0000-1000-0000000FF1CE}
O42 - Logiciel: Microsoft Office OneNote MUI (French) 2007 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90120000-00A1-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office PowerPoint MUI (French) 2007 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90120000-0018-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office PowerPoint Viewer 2007 (French) - (.Microsoft Corporation.) [HKLM][64Bits] -- {95120000-00AF-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proof (Arabic) 2007 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90120000-001F-0401-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proof (Dutch) 2007 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90120000-001F-0413-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proof (English) 2007 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90120000-001F-0409-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proof (French) 2007 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90120000-001F-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proof (German) 2007 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90120000-001F-0407-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proof (Spanish) 2007 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90120000-001F-0C0A-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proofing (French) 2007 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90120000-002C-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM][64Bits] -- {90120000-001F-0401-0000-0000000FF1CE}_HOMESTUDENTR_{14809F99-C601-4D4A-9391-F1E8FAA964C5}
O42 - Logiciel: Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM][64Bits] -- {90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A0516415-ED61-419A-981D-93596DA74165}
O42 - Logiciel: Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM][64Bits] -- {90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
O42 - Logiciel: Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM][64Bits] -- {90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}
O42 - Logiciel: Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM][64Bits] -- {90120000-001F-0413-0000-0000000FF1CE}_HOMESTUDENTR_{D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}
O42 - Logiciel: Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) - (.Microsoft.) [HKLM][64Bits] -- {90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}
O42 - Logiciel: Microsoft Office Shared 64-bit MUI (French) 2007 - (.Microsoft Corporation.) [HKLM] -- {90120000-002A-040C-1000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Shared MUI (French) 2007 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90120000-006E-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft Office Suite Activation Assistant - (.Microsoft Corporation.) [HKLM][64Bits] -- {E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}
O42 - Logiciel: Microsoft Office Word MUI (French) 2007 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90120000-001B-040C-0000-0000000FF1CE}
O42 - Logiciel: Microsoft SQL Server 2005 Compact Edition [ENU] - (.Microsoft Corporation.) [HKLM][64Bits] -- {F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
O42 - Logiciel: Microsoft Silverlight - (.Microsoft Corporation.) [HKLM][64Bits] -- {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
O42 - Logiciel: Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 - (.Microsoft Corporation.) [HKLM][64Bits] -- {770657D0-A123-3C07-8E44-1C83EC895118}
O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable - (.Microsoft Corporation.) [HKLM][64Bits] -- {7299052b-02a4-4627-81f2-1818da5d550d}
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 - (.Microsoft Corporation.) [HKLM][64Bits] -- {9A25302D-30C0-39D9-BD6F-21E6EC160475}
O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 - (.Microsoft Corporation.) [HKLM][64Bits] -- {1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
O42 - Logiciel: Microsoft Works - (.Microsoft Corporation.) [HKLM][64Bits] -- {3B160861-7250-451E-B5EE-8B92BF30A710}
O42 - Logiciel: Module de compatibilité pour Microsoft Office System 2007 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90120000-0020-040C-0000-0000000FF1CE}
O42 - Logiciel: Mozilla Firefox 4.0.1 (x86 fr) - (.Mozilla.) [HKLM][64Bits] -- Mozilla Firefox 4.0.1 (x86 fr)
O42 - Logiciel: NVIDIA Drivers - (.NVIDIA Corporation.) [HKLM] -- NVIDIA Drivers
O42 - Logiciel: Notification de cadeaux MSN - (.Microsoft.) [HKCU] -- Notification de cadeaux MSN
O42 - Logiciel: REALTEK Wireless LAN Software - (.REALTEK Semiconductor Corp..) [HKLM][64Bits] -- {F2BC3383-F000-410C-A038-3846ADBE8D90}
O42 - Logiciel: Realtek High Definition Audio Driver - (.Realtek Semiconductor Corp..) [HKLM][64Bits] -- {F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}
O42 - Logiciel: Samsung R-Series - (.Samsung.) [HKLM][64Bits] -- {3EED7541-55F8-4DC6-B9CD-28762D71310E}
O42 - Logiciel: Samsung Recovery Solution 4 - (.Samsung.) [HKLM][64Bits] -- {145DE957-0679-4A2A-BB5C-1D3E9808FAB2}
O42 - Logiciel: Samsung Support Center - (.Samsung.) [HKLM][64Bits] -- {0A353130-D22C-41DD-8C67-1B02A05F2CE0}
O42 - Logiciel: Samsung Update Plus - (.Samsung Electronics Co., Ltd..) [HKLM][64Bits] -- {D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}
O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB2288621) - (.Microsoft.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{5C497F0B-2061-4CC9-A61C-6B45B867354D}
O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB2288931) - (.Microsoft.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CD769337-C8AC-46DB-A7DC-643E50089263}
O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB2345043) - (.Microsoft.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{536FB502-775F-4494-BACE-C02CC90B7A5B}
O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB2466156) - (.Microsoft.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CEF209AB-F96D-404F-B5CC-44057C057CA3}
O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB2509488) - (.Microsoft.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{AD0DE453-0804-4495-9C91-33D0F9AA5463}
O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB969559) - (.Microsoft.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB976321) - (.Microsoft.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{7F207DCA-3399-40CB-A968-6E5991B1421A}
O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841) - (.Microsoft Corporation.) [HKLM][64Bits] -- {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2160841
O42 - Logiciel: Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) - (.Microsoft Corporation.) [HKLM][64Bits] -- {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2446708
O42 - Logiciel: Security Update for Microsoft Office Excel 2007 (KB2464583) - (.Microsoft.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{151E2FEA-C3A6-4CB6-BE6B-16651FDF04BE}
O42 - Logiciel: Security Update for Microsoft Office InfoPath 2007 (KB979441) - (.Microsoft.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{8CCB781A-CF6B-4FCB-B6D8-59C64DF5C6DB}
O42 - Logiciel: Security Update for Microsoft Office PowerPoint 2007 (KB2535818) - (.Microsoft.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{8588DD11-6BD7-4400-B55C-DD5AB74B43E1}
O42 - Logiciel: Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623) - (.Microsoft.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{D75E6D0C-BADF-4F41-98B2-0C0F02C15062}
O42 - Logiciel: Security Update for Microsoft Office Visio Viewer 2007 (KB973709) - (.Microsoft.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
O42 - Logiciel: Security Update for Microsoft Office Word 2007 (KB2344993) - (.Microsoft.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{7A5B74FA-7A92-4FC9-821A-2DD5D4E73E48}
O42 - Logiciel: Security Update for Microsoft Office system 2007 (972581) - (.Microsoft.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}
O42 - Logiciel: Security Update for Microsoft Office system 2007 (KB974234) - (.Microsoft.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{FCD742B9-7A55-44BC-A776-F795F21FEDDC}
O42 - Logiciel: Synaptics Pointing Device Driver - (.Synaptics Incorporated.) [HKLM] -- SynTPDeinstKey
O42 - Logiciel: Update for 2007 Microsoft Office System (KB2284654) - (.Microsoft.) [HKLM][64Bits] -- {90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{FB166E7C-8AA6-48C8-B726-1F25BEE7825A}
O42 - Logiciel: Update for 2007 Microsoft Office System (KB967642) - (.Microsoft.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}
O42 - Logiciel: Update for Microsoft .NET Framework 4 Client Profile (KB2473228) - (.Microsoft Corporation.) [HKLM][64Bits] -- {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2473228
O42 - Logiciel: Update for Microsoft Office OneNote 2007 (KB980729) - (.Microsoft.) [HKLM][64Bits] -- {91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{329050A9-EF80-40F9-B633-74508F54C1FF}
O42 - Logiciel: User Guide - (.Pas de propriétaire.) [HKLM][64Bits] -- {BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}
O42 - Logiciel: Windows Live - (.Microsoft Corporation.) [HKLM][64Bits] -- WinLiveSuite
O42 - Logiciel: Windows Live - (.Microsoft Corporation.) [HKLM][64Bits] -- {34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}
O42 - Logiciel: Windows Live Communications Platform - (.Microsoft Corporation.) [HKLM][64Bits] -- {D45240D3-B6B3-4FF9-B243-54ECE3E10066}
O42 - Logiciel: Windows Live FolderShare - (.Microsoft Corporation.) [HKLM][64Bits] -- {2075CB0A-D26F-4DAA-B424-5079296B43BA}
O42 - Logiciel: Windows Live ID Sign-in Assistant - (.Microsoft Corporation.) [HKLM] -- {1B8ABA62-74F0-47ED-B18C-A43128E591B8}
O42 - Logiciel: Windows Live Installer - (.Microsoft Corporation.) [HKLM][64Bits] -- {0B0F231F-CE6A-483D-AA23-77B364F75917}
O42 - Logiciel: Windows Live Language Selector - (.Microsoft Corporation.) [HKLM] -- {D07A61E5-A59C-433C-BCBD-22025FA2287B}
O42 - Logiciel: Windows Live MIME IFilter - (.Microsoft Corporation.) [HKLM] -- {DA54F80E-261C-41A2-A855-549A144F2F59}
O42 - Logiciel: Windows Live Mail - (.Microsoft Corporation.) [HKLM][64Bits] -- {9D56775A-93F3-44A3-8092-840E3826DE30}
O42 - Logiciel: Windows Live Mail - (.Microsoft Corporation.) [HKLM][64Bits] -- {9FAE6E8D-E686-49F5-A574-0A58DFD9580C}
O42 - Logiciel: Windows Live Mesh - (.Microsoft Corporation.) [HKLM][64Bits] -- {841F1FB4-FDF8-461C-A496-3E1CFD84C0B5}
O42 - Logiciel: Windows Live Mesh - (.Microsoft Corporation.) [HKLM][64Bits] -- {DECDCB7C-58CC-4865-91AF-627F9798FE48}
O42 - Logiciel: Windows Live Messenger - (.Microsoft Corporation.) [HKLM][64Bits] -- {6057E21C-ABE9-4059-AE3E-3BEB9925E660}
O42 - Logiciel: Windows Live Messenger - (.Microsoft Corporation.) [HKLM][64Bits] -- {EB4DF488-AAEF-406F-A341-CB2AAA315B90}
O42 - Logiciel: Windows Live Messenger Companion Core - (.Microsoft Corporation.) [HKLM][64Bits] -- {78A96B4C-A643-4D0F-98C2-A8E16A6669F9}
O42 - Logiciel: Windows Live Movie Maker - (.Microsoft Corporation.) [HKLM][64Bits] -- {6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}
O42 - Logiciel: Windows Live Movie Maker - (.Microsoft Corporation.) [HKLM][64Bits] -- {92EA4134-10D1-418A-91E1-5A0453131A38}
O42 - Logiciel: Windows Live PIMT Platform - (.Microsoft Corporation.) [HKLM][64Bits] -- {83C292B7-38A5-440B-A731-07070E81A64F}
O42 - Logiciel: Windows Live Photo Common - (.Microsoft Corporation.) [HKLM][64Bits] -- {A9BDCA6B-3653-467B-AC83-94367DA3BFE3}
O42 - Logiciel: Windows Live Photo Common - (.Microsoft Corporation.) [HKLM][64Bits] -- {C893D8C0-1BA0-4517-B11C-E89B65E72F70}
O42 - Logiciel: Windows Live Photo Gallery - (.Microsoft Corporation.) [HKLM][64Bits] -- {3336F667-9049-4D46-98B6-4C743EEBC5B1}
O42 - Logiciel: Windows Live Remote Client - (.Microsoft Corporation.) [HKLM] -- {DF6D988A-EEA0-4277-AAB8-158E086E439B}
O42 - Logiciel: Windows Live Remote Client Resources - (.Microsoft Corporation.) [HKLM] -- {B750FA38-7AB0-42CB-ACBB-E7DBE9FF603F}
O42 - Logiciel: Windows Live Remote Service - (.Microsoft Corporation.) [HKLM] -- {E02A6548-6FDE-40E2-8ED9-119D7D7E641F}
O42 - Logiciel: Windows Live Remote Service Resources - (.Microsoft Corporation.) [HKLM] -- {5E2CD4FB-4538-4831-8176-05D653C3E6D4}
O42 - Logiciel: Windows Live SOXE - (.Microsoft Corporation.) [HKLM][64Bits] -- {682B3E4F-696A-42DE-A41C-4C07EA1678B4}
O42 - Logiciel: Windows Live SOXE Definitions - (.Microsoft Corporation.) [HKLM][64Bits] -- {200FEC62-3C34-4D60-9CE8-EC372E01C08F}
O42 - Logiciel: Windows Live UX Platform - (.Microsoft Corporation.) [HKLM][64Bits] -- {CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}
O42 - Logiciel: Windows Live UX Platform Language Pack - (.Microsoft Corporation.) [HKLM][64Bits] -- {05E379CC-F626-4E7D-8354-463865B303BF}
O42 - Logiciel: Windows Live Writer - (.Microsoft Corporation.) [HKLM][64Bits] -- {3B9A92DA-6374-4872-B646-253F18624D5F}
O42 - Logiciel: Windows Live Writer - (.Microsoft Corporation.) [HKLM][64Bits] -- {A726AE06-AAA3-43D1-87E3-70F510314F04}
O42 - Logiciel: Windows Live Writer - (.Microsoft Corporation.) [HKLM][64Bits] -- {AAAFC670-569B-4A2F-82B4-42945E0DE3EF}
O42 - Logiciel: Windows Live Writer Resources - (.Microsoft Corporation.) [HKLM][64Bits] -- {62687B11-58B5-4A18-9BC3-9DF4CE03F194}
O42 - Logiciel: avast! Free Antivirus - (.AVAST Software.) [HKLM][64Bits] -- avast
O42 - Logiciel: eMule - (.Pas de propriétaire.) [HKLM][64Bits] -- eMule

---\\ HKCU & HKLM Software Keys
[HKCU\Software\ALWIL Software]
[HKCU\Software\AVAST Software]
[HKCU\Software\Ad-Remover]
[HKCU\Software\Adobe]
[HKCU\Software\AppDataLow\Software\Google]
[HKCU\Software\AppDataLow\Software\Microsoft]
[HKCU\Software\AppDataLow\Software]
[HKCU\Software\AppDataLow]
[HKCU\Software\Classes]
[HKCU\Software\Clients]
[HKCU\Software\CyberLink]
[HKCU\Software\HookNetwork]
[HKCU\Software\IM Providers]
[HKCU\Software\JavaSoft]
[HKCU\Software\Lake]
[HKCU\Software\Macromedia]
[HKCU\Software\Malwarebytes' Anti-Malware]
[HKCU\Software\NVIDIA Corporation]
[HKCU\Software\Netscape]
[HKCU\Software\ODBC]
[HKCU\Software\Piriform]
[HKCU\Software\Policies]
[HKCU\Software\Realtek]
[HKCU\Software\Samsung]
[HKCU\Software\Synaptics]
[HKCU\Software\WinRAR SFX]
[HKCU\Software\WinRAR]
[HKCU\Software\Wow6432Node]
[HKCU\Software\YahooPartnerToolbar]
[HKCU\Software\eMule]
[HKLM\Software\ALWIL Software]
[HKLM\Software\ASK]
[HKLM\Software\ATI Technologies]
[HKLM\Software\AVAST Software]
[HKLM\Software\Adobe]
[HKLM\Software\America Online]
[HKLM\Software\Atheros]
[HKLM\Software\CHECKINSTALLER]
[HKLM\Software\Canon]
[HKLM\Software\Classes]
[HKLM\Software\Clients]
[HKLM\Software\CyberLink]
[HKLM\Software\Digital River]
[HKLM\Software\Dr.Soft]
[HKLM\Software\Google]
[HKLM\Software\InstalledOptions]
[HKLM\Software\Intel]
[HKLM\Software\JavaSoft]
[HKLM\Software\JreMetrics]
[HKLM\Software\Lake]
[HKLM\Software\Macromedia]
[HKLM\Software\Malwarebytes' Anti-Malware]
[HKLM\Software\Marvell]
[HKLM\Software\McAfeeInstaller]
[HKLM\Software\Messenger Plus!]
[HKLM\Software\MimarSinan]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\Mozilla]
[HKLM\Software\NVIDIA Corporation]
[HKLM\Software\ODBC]
[HKLM\Software\Piriform]
[HKLM\Software\Policies]
[HKLM\Software\Realtek Semiconductor Corp.]
[HKLM\Software\Realtek]
[HKLM\Software\RegisteredApplications]
[HKLM\Software\RtWLan]
[HKLM\Software\SRS Labs]
[HKLM\Software\Samsung Electronics Co., Ltd.]
[HKLM\Software\Samsung]
[HKLM\Software\SiteAdvisor]
[HKLM\Software\Sonic]
[HKLM\Software\Synaptics]
[HKLM\Software\Uniblue]
[HKLM\Software\Waves Audio]
[HKLM\Software\WinRAR]
[HKLM\Software\Windows]
[HKLM\Software\Wow6432Node]
[HKLM\Software\mozilla.org]



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 10/27/2010 - 7:39:50 PM - [236647894] ----D- C:\Program Files\Alwil Software
O43 - CFD: 4/27/2011 - 10:18:12 AM - [7201624] ----D- C:\Program Files\CCleaner
O43 - CFD: 10/27/2010 - 7:56:32 PM - [78026479] ----D- C:\Program Files\Common Files
O43 - CFD: 10/30/2010 - 8:23:06 PM - [90257428] ----D- C:\Program Files\DVD Maker
O43 - CFD: 10/27/2010 - 7:30:16 PM - [0] ----D- C:\Program Files\Google
O43 - CFD: 4/10/2011 - 9:42:40 AM - [6747000] ----D- C:\Program Files\Internet Explorer
O43 - CFD: 3/15/2010 - 9:54:42 PM - [149236786] ----D- C:\Program Files\Microsoft Games
O43 - CFD: 10/27/2010 - 6:42:08 PM - [1141526] ----D- C:\Program Files\Microsoft Office
O43 - CFD: 7/14/2009 - 7:32:40 AM - [25757] ----D- C:\Program Files\MSBuild
O43 - CFD: 3/15/2010 - 5:53:18 AM - [14798944] ----D- C:\Program Files\Realtek
O43 - CFD: 7/14/2009 - 7:32:40 AM - [36253865] ----D- C:\Program Files\Reference Assemblies
O43 - CFD: 10/27/2010 - 6:52:50 PM - [290834116] ----D- C:\Program Files\Samsung
O43 - CFD: 3/15/2010 - 5:56:00 AM - [28292422] ----D- C:\Program Files\Synaptics
O43 - CFD: 7/14/2009 - 7:09:28 AM - [0] --H-D- C:\Program Files\Uninstall Information
O43 - CFD: 10/30/2010 - 8:23:32 PM - [4039168] ----D- C:\Program Files\Windows Defender
O43 - CFD: 10/30/2010 - 8:23:32 PM - [9224824] ----D- C:\Program Files\Windows Journal
O43 - CFD: 12/6/2010 - 6:42:40 PM - [7755583] ----D- C:\Program Files\Windows Live
O43 - CFD: 12/16/2010 - 10:40:26 PM - [6667264] ----D- C:\Program Files\Windows Mail
O43 - CFD: 10/30/2010 - 8:23:32 PM - [7687085] ----D- C:\Program Files\Windows Media Player
O43 - CFD: 7/14/2009 - 7:32:40 AM - [12627124] ----D- C:\Program Files\Windows NT
O43 - CFD: 10/30/2010 - 8:23:32 PM - [5516568] ----D- C:\Program Files\Windows Photo Viewer
O43 - CFD: 7/14/2009 - 7:32:40 AM - [235008] ----D- C:\Program Files\Windows Portable Devices
O43 - CFD: 10/30/2010 - 8:23:32 PM - [11460487] ----D- C:\Program Files\Windows Sidebar
O43 - CFD: 12/6/2010 - 6:42:34 PM - [65405038] ----D- C:\Program Files\Common Files\Microsoft Shared
O43 - CFD: 7/14/2009 - 5:20:10 AM - [2702] ----D- C:\Program Files\Common Files\Services
O43 - CFD: 7/14/2009 - 5:20:10 AM - [608768] ----D- C:\Program Files\Common Files\SpeechEngines
O43 - CFD: 10/30/2010 - 8:23:32 PM - [12009971] ----D- C:\Program Files\Common Files\System
O43 - CFD: 11/24/2010 - 9:07:24 PM - [3887873] ----D- C:\ProgramData\Adobe
O43 - CFD: 10/27/2010 - 7:39:50 PM - [39475521] ----D- C:\ProgramData\Alwil Software
O43 - CFD: 7/14/2009 - 7:08:58 AM - [0] -SH-D- C:\ProgramData\Application Data
O43 - CFD: 10/28/2010 - 6:33:00 PM - [66367] ----D- C:\ProgramData\CyberLink
O43 - CFD: 7/14/2009 - 7:08:58 AM - [0] -SH-D- C:\ProgramData\Desktop
O43 - CFD: 7/14/2009 - 7:08:58 AM - [0] -SH-D- C:\ProgramData\Documents
O43 - CFD: 2/3/2011 - 3:46:18 PM - [0] ----D- C:\ProgramData\eMule
O43 - CFD: 7/14/2009 - 7:08:58 AM - [0] -SH-D- C:\ProgramData\Favorites
O43 - CFD: 5/12/2011 - 8:44:06 PM - [6678443] ----D- C:\ProgramData\Malwarebytes
O43 - CFD: 10/27/2010 - 8:34:32 PM - [7873] ----D- C:\ProgramData\McAfee
O43 - CFD: 12/6/2010 - 6:42:54 PM - [963049374] -S--D- C:\ProgramData\Microsoft
O43 - CFD: 5/12/2011 - 8:20:50 PM - [57688] ----D- C:\ProgramData\Microsoft Help
O43 - CFD: 3/15/2010 - 9:35:54 AM - [245445] ----D- C:\ProgramData\NVIDIA
O43 - CFD: 10/27/2010 - 7:30:16 PM - [695] ----D- C:\ProgramData\Partner
O43 - CFD: 3/15/2010 - 6:37:06 AM - [537533] ----D- C:\ProgramData\SAMSUNG
O43 - CFD: 3/15/2010 - 6:21:44 AM - [36] ----D- C:\ProgramData\SiteAdvisor
O43 - CFD: 7/14/2009 - 7:08:58 AM - [0] -SH-D- C:\ProgramData\Start Menu
O43 - CFD: 10/31/2010 - 10:48:26 AM - [189] ----D- C:\ProgramData\Sun
O43 - CFD: 10/27/2010 - 6:51:34 PM - [360732] ----D- C:\ProgramData\Temp
O43 - CFD: 7/14/2009 - 7:08:58 AM - [0] -SH-D- C:\ProgramData\Templates
O43 - CFD: 10/28/2010 - 5:17:22 AM - [15532894] ----D- C:\ProgramData\WinClon
O43 - CFD: 11/3/2010 - 6:22:28 PM - [2119709] ----D- C:\Users\Christel\AppData\Roaming\Adobe
O43 - CFD: 10/28/2010 - 6:32:56 PM - [20] ----D- C:\Users\Christel\AppData\Roaming\CyberLink
O43 - CFD: 10/27/2010 - 7:26:02 PM - [0] ----D- C:\Users\Christel\AppData\Roaming\Google
O43 - CFD: 10/27/2010 - 6:53:42 PM - [0] ----D- C:\Users\Christel\AppData\Roaming\Identities
O43 - CFD: 10/27/2010 - 7:37:16 PM - [9812] ----D- C:\Users\Christel\AppData\Roaming\Macromedia
O43 - CFD: 5/12/2011 - 8:44:20 PM - [412537] ----D- C:\Users\Christel\AppData\Roaming\Malwarebytes
O43 - CFD: 3/15/2010 - 9:54:40 PM - [0] ----D- C:\Users\Christel\AppData\Roaming\Media Center Programs
O43 - CFD: 5/12/2011 - 7:50:18 PM - [10621677] -S--D- C:\Users\Christel\AppData\Roaming\Microsoft
O43 - CFD: 10/27/2010 - 8:20:16 PM - [17538145] ----D- C:\Users\Christel\AppData\Roaming\Mozilla
O43 - CFD: 12/27/2010 - 10:14:40 PM - [0] ----D- C:\Users\Christel\AppData\Roaming\Windows Live Writer
O43 - CFD: 2/3/2011 - 2:43:06 PM - [12] ----D- C:\Users\Christel\AppData\Roaming\WinRAR
O43 - CFD: 11/24/2010 - 9:07:04 PM - [190600] ----D- C:\Users\Christel\Appdata\Local\Adobe
O43 - CFD: 10/27/2010 - 6:34:16 PM - [0] -SH-D- C:\Users\Christel\Appdata\Local\Application Data
O43 - CFD: 5/12/2011 - 6:05:30 PM - [102585] ----D- C:\Users\Christel\Appdata\Local\Diagnostics
O43 - CFD: 3/27/2011 - 1:16:24 PM - [198082] ----D- C:\Users\Christel\Appdata\Local\eMule
O43 - CFD: 10/27/2010 - 7:27:34 PM - [0] ----D- C:\Users\Christel\Appdata\Local\Google
O43 - CFD: 10/27/2010 - 6:34:16 PM - [0] -SH-D- C:\Users\Christel\Appdata\Local\Historique
O43 - CFD: 4/1/2011 - 11:24:40 AM - [779414585] ----D- C:\Users\Christel\Appdata\Local\Microsoft
O43 - CFD: 11/1/2010 - 11:00:08 PM - [82897] ----D- C:\Users\Christel\Appdata\Local\Microsoft Games
O43 - CFD: 10/27/2010 - 6:41:46 PM - [0] ----D- C:\Users\Christel\Appdata\Local\Microsoft Help
O43 - CFD: 10/27/2010 - 8:19:56 PM - [177463438] ----D- C:\Users\Christel\Appdata\Local\Mozilla
O43 - CFD: 11/4/2010 - 9:45:34 PM - [0] ----D- C:\Users\Christel\Appdata\Local\NOS
O43 - CFD: 5/12/2011 - 6:33:52 PM - [0] ----D- C:\Users\Christel\Appdata\Local\PackageAware
O43 - CFD: 10/27/2010 - 6:54:26 PM - [40960] ----D- C:\Users\Christel\Appdata\Local\Power2Go
O43 - CFD: 5/12/2011 - 9:35:46 PM - [45060171] ----D- C:\Users\Christel\Appdata\Local\Temp
O43 - CFD: 10/27/2010 - 6:34:16 PM - [0] -SH-D- C:\Users\Christel\Appdata\Local\Temporary Internet Files
O43 - CFD: 10/27/2010 - 6:54:32 PM - [0] ----D- C:\Users\Christel\Appdata\Local\VirtualStore
O43 - CFD: 12/27/2010 - 10:14:12 PM - [53248] ----D- C:\Users\Christel\Appdata\Local\Windows Live
O43 - CFD: 12/27/2010 - 10:14:50 PM - [372494] ----D- C:\Users\Christel\Appdata\Local\Windows Live Writer
O43 - CFD: 5/12/2011 - 6:16:54 PM - [93691218] ----D- C:\Program Files (x86)\Ad-Remover
O43 - CFD: 11/24/2010 - 9:07:20 PM - [162743158] ----D- C:\Program Files (x86)\Adobe
O43 - CFD: 3/15/2010 - 6:23:00 AM - [38988800] ----D- C:\Program Files (x86)\AnyPC Client
O43 - CFD: 3/15/2010 - 5:55:20 AM - [1078] ----D- C:\Program Files (x86)\Atheros Client Installation Program
O43 - CFD: 1/2/2011 - 9:05:56 PM - [0] ----D- C:\Program Files (x86)\Canon
O43 - CFD: 5/10/2011 - 2:13:58 PM - [646136608] ----D- C:\Program Files (x86)\Common Files
O43 - CFD: 10/27/2010 - 6:51:52 PM - [1187933880] ----D- C:\Program Files (x86)\CyberLink
O43 - CFD: 2/3/2011 - 3:46:04 PM - [10906334] ----D- C:\Program Files (x86)\eMule
O43 - CFD: 3/11/2011 - 5:58:22 PM - [2420768] ----D- C:\Program Files (x86)\Feedback Tool
O43 - CFD: 10/27/2010 - 6:52:50 PM - [113897623] --H-D- C:\Program Files (x86)\InstallShield Installation Information
O43 - CFD: 3/15/2010 - 5:51:56 AM - [7526825] ----D- C:\Program Files (x86)\Intel
O43 - CFD: 5/11/2011 - 4:38:52 PM - [5193146] ----D- C:\Program Files (x86)\Internet Explorer
O43 - CFD: 3/23/2011 - 6:13:22 PM - [90247782] ----D- C:\Program Files (x86)\Java
O43 - CFD: 5/12/2011 - 8:44:10 PM - [4935593] ----D- C:\Program Files (x86)\Malwarebytes' Anti-Malware
O43 - CFD: 3/15/2010 - 5:53:50 AM - [3407947] ----D- C:\Program Files (x86)\Marvell
O43 - CFD: 10/27/2010 - 7:54:48 PM - [502195] ----D- C:\Program Files (x86)\Microsoft
O43 - CFD: 10/27/2010 - 6:43:48 PM - [370163535] ----D- C:\Program Files (x86)\Microsoft Office
O43 - CFD: 10/27/2010 - 6:46:22 PM - [7791803] ----D- C:\Program Files (x86)\Microsoft Office Suite Activation Assistant
O43 - CFD: 4/26/2011 - 10:38:20 AM - [38388859] ----D- C:\Program Files (x86)\Microsoft Silverlight
O43 - CFD: 12/6/2010 - 6:45:38 PM - [1829877] ----D- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
O43 - CFD: 12/16/2010 - 10:36:34 PM - [145421942] ----D- C:\Program Files (x86)\Microsoft Works
O43 - CFD: 12/17/2010 - 7:31:48 PM - [8167779] ----D- C:\Program Files (x86)\Microsoft.NET
O43 - CFD: 5/3/2011 - 1:58:14 PM - [33295345] ----D- C:\Program Files (x86)\Mozilla Firefox
O43 - CFD: 7/14/2009 - 7:32:40 AM - [25757] ----D- C:\Program Files (x86)\MSBuild
O43 - CFD: 3/15/2010 - 5:52:54 AM - [3358313] ----D- C:\Program Files (x86)\Realtek
O43 - CFD: 3/15/2010 - 5:55:42 AM - [7717257] ----D- C:\Program Files (x86)\REALTEK Wireless LAN Software
O43 - CFD: 7/14/2009 - 7:32:40 AM - [38597377] ----D- C:\Program Files (x86)\Reference Assemblies
O43 - CFD: 3/15/2010 - 6:06:44 AM - [181315903] ----D- C:\Program Files (x86)\Samsung
O43 - CFD: 3/15/2010 - 5:53:26 AM - [0] --H-D- C:\Program Files (x86)\Temp
O43 - CFD: 7/14/2009 - 6:57:08 AM - [0] --H-D- C:\Program Files (x86)\Uninstall Information
O43 - CFD: 10/28/2010 - 8:29:16 PM - [420832] ----D- C:\Program Files (x86)\VideoLAN
O43 - CFD: 10/30/2010 - 8:23:32 PM - [524800] ----D- C:\Program Files (x86)\Windows Defender
O43 - CFD: 12/6/2010 - 6:53:34 PM - [180390955] ----D- C:\Program Files (x86)\Windows Live
O43 - CFD: 12/16/2010 - 10:40:26 PM - [6180864] ----D- C:\Program Files (x86)\Windows Mail
O43 - CFD: 10/30/2010 - 8:23:32 PM - [5024017] ----D- C:\Program Files (x86)\Windows Media Player
O43 - CFD: 7/14/2009 - 7:32:40 AM - [12197556] ----D- C:\Program Files (x86)\Windows NT
O43 - CFD: 10/30/2010 - 8:23:32 PM - [4417800] ----D- C:\Program Files (x86)\Windows Photo Viewer
O43 - CFD: 7/14/2009 - 7:32:42 AM - [189440] ----D- C:\Program Files (x86)\Windows Portable Devices
O43 - CFD: 10/30/2010 - 8:23:32 PM - [5994114] ----D- C:\Program Files (x86)\Windows Sidebar
O43 - CFD: 2/3/2011 - 2:41:32 PM - [3887186] ----D- C:\Program Files (x86)\WinRAR
O43 - CFD: 5/12/2011 - 9:36:22 PM - [3946885] ----D- C:\Program Files (x86)\ZHPDiag
O43 - CFD: 11/24/2010 - 9:07:24 PM - [6281214] ----D- C:\Program Files (x86)\Common Files\Adobe
O43 - CFD: 5/12/2011 - 9:32:26 PM - [13858556] ----D- C:\Program Files (x86)\Common Files\Akamai
O43 - CFD: 3/15/2010 - 6:02:30 AM - [128512] ----D- C:\Program Files (x86)\Common Files\CyberLink
O43 - CFD: 11/1/2010 - 10:49:16 PM - [86016] ----D- C:\Program Files (x86)\Common Files\DESIGNER
O43 - CFD: 3/15/2010 - 5:50:20 AM - [5419214] ----D- C:\Program Files (x86)\Common Files\InstallShield
O43 - CFD: 3/23/2011 - 6:58:50 PM - [1247175] ----D- C:\Program Files (x86)\Common Files\Java
O43 - CFD: 12/6/2010 - 6:42:00 PM - [254527196] ----D- C:\Program Files (x86)\Common Files\microsoft shared
O43 - CFD: 3/15/2010 - 6:06:24 AM - [4617163] ----D- C:\Program Files (x86)\Common Files\Samsung
O43 - CFD: 7/14/2009 - 5:20:10 AM - [2702] ----D- C:\Program Files (x86)\Common Files\Services
O43 - CFD: 7/14/2009 - 5:20:10 AM - [41103783] ----D- C:\Program Files (x86)\Common Files\SpeechEngines
O43 - CFD: 10/30/2010 - 8:23:32 PM - [44114543] ----D- C:\Program Files (x86)\Common Files\System
O43 - CFD: 10/27/2010 - 6:47:06 PM - [274750534] ----D- C:\Program Files (x86)\Common Files\Windows Live



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.8BD25A34DA5E53AE115977DD1E15AB3C] - 4/19/2011 - 3:33:58 PM ---A- . (.Adobe Systems - Windows NT OpenType/Type 1 API Library..) -- C:\windows\SysNative\atmlib.dll [46080]
O44 - LFC:[MD5.8BD25A34DA5E53AE115977DD1E15AB3C] - 4/19/2011 - 3:33:58 PM ---A- . (.Adobe Systems - Windows NT OpenType/Type 1 API Library..) -- C:\windows\System32\atmlib.dll [34304]
O44 - LFC:[MD5.EFC5353E4F513DEF55ED7B7872363957] - 4/19/2011 - 3:33:58 PM ---A- . (.Adobe Systems Incorporated - Windows NT OpenType/Type 1 Font Driver.) -- C:\windows\System32\atmfd.dll [294912]
O44 - LFC:[MD5.EFC5353E4F513DEF55ED7B7872363957] - 4/19/2011 - 3:33:59 PM ---A- . (.Adobe Systems Incorporated - Windows NT OpenType/Type 1 Font Driver.) -- C:\windows\SysNative\atmfd.dll [367104]
O44 - LFC:[MD5.D077D961D478FEFEEB2F6E293C967494] - 4/26/2011 - 9:01:46 AM ---A- . (...) -- C:\windows\SysNative\PerfStringBackup.INI [1571554]
O44 - LFC:[MD5.6DE04A1E1ECE3B045BA73561F265F99F] - 4/26/2011 - 9:01:46 AM ---A- . (...) -- C:\windows\SysNative\perfc009.dat [106388]
O44 - LFC:[MD5.CCBF645257D1113B525A131CA1BC0475] - 4/26/2011 - 9:01:46 AM ---A- . (...) -- C:\windows\SysNative\perfc00C.dat [130754]
O44 - LFC:[MD5.CAD13B4E9ECC988D1B1798CEE91A4BF2] - 4/26/2011 - 9:01:46 AM ---A- . (...) -- C:\windows\SysNative\perfh009.dat [616008]
O44 - LFC:[MD5.FC174D186AB656115FAB96A08C92E74D] - 4/26/2011 - 9:01:46 AM ---A- . (...) -- C:\windows\SysNative\perfh00C.dat [704480]
O44 - LFC:[MD5.E491472AFD3F3A09C67585C0DF4CB5F9] - 4/26/2011 - 9:38:51 AM ---A- . (...) -- C:\windows\SysNative\FNTCACHE.DAT [352552]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 4/27/2011 - 9:32:01 AM ---A- . (...) -- C:\windows\setuperr.log [0]
O44 - LFC:[MD5.42DD9A7C1B012131ED5758257991A343] - 5/11/2011 - 3:39:15 PM ---A- . (...) -- C:\windows\IE9_main.log [6335]
O44 - LFC:[MD5.B26507B014D833BE026BB9D00CF1DFE5] - 5/12/2011 - 5:17:44 PM ---A- . (...) -- C:\Ad-Report-SCAN[1].txt [11202]
O44 - LFC:[MD5.891BAAF9C1E0449E693EFCA1B23C8CE3] - 5/12/2011 - 6:15:28 PM ---A- . (...) -- C:\PhysicalDisk0_MBR.bin [512]
O44 - LFC:[MD5.2AC2AAC4BC810E57DEE88B7597B9F5AB] - 5/12/2011 - 6:21:34 PM ---A- . (...) -- C:\Ad-Report-CLEAN[1].txt [11288]
O44 - LFC:[MD5.DC0AF01D1523E27723109FAA783D68BD] - 5/12/2011 - 7:01:58 PM ---A- . (...) -- C:\ZHPRegY0.zhp [412]
O44 - LFC:[MD5.464E5203D00FAC3EBBC8152E42EB9F77] - 5/12/2011 - 7:18:02 PM ---A- . (...) -- C:\ZHPRegY1.zhp [5502]
O44 - LFC:[MD5.0D8C105E033DA03C6D0E3C6AD32D9836] - 5/12/2011 - 7:18:04 PM ---A- . (...) -- C:\ZHPRegY2.zhp [5806]
O44 - LFC:[MD5.AE0CAA8663238C47DBF548205CD82FE6] - 5/12/2011 - 7:18:04 PM ---A- . (...) -- C:\ZHPRegY3.zhp [348]
O44 - LFC:[MD5.2DD98798F83FE236FC93EF6FA84367E5] - 5/12/2011 - 7:18:04 PM ---A- . (...) -- C:\ZHPRegY4.zhp [300]
O44 - LFC:[MD5.9D11E9493BFB4F0524FAE349E9AAA1D6] - 5/12/2011 - 7:18:05 PM ---A- . (...) -- C:\ZHPRegY5.zhp [992]
O44 - LFC:[MD5.A299E1CB2FC9134490F6FA8550A1329A] - 5/12/2011 - 7:18:05 PM ---A- . (...) -- C:\ZHPRegY6.zhp [302]
O44 - LFC:[MD5.BE8C334B99635DBA97D8CBAB2FCAC922] - 5/12/2011 - 8:31:53 PM -S-A- . (...) -- C:\windows\bootstat.dat [67584]
O44 - LFC:[MD5.80A65C0A7B55981E3B2C32662184E589] - 5/12/2011 - 8:31:54 PM ---A- . (...) -- C:\windows\setupact.log [728]
O44 - LFC:[MD5.020000000000000000000000A0EF1800] - 5/12/2011 - 8:35:16 PM ---A- . (...) -- C:\windows\WindowsUpdate.log [1127354]



---\\ Trojan Driver Search Da

Hello,

Je ne peux toujours pas consulter le lien virustotal, inscris toi stp ...

Concernant ZHPDiag il faut l'héberger car il est trop long pour passer ici :)

Utilise pjjoint ou cijoint ou cjoint .......

A+