Virus ???

~ Rapport de ZHPDiag v2014.1.12.13 - Nicolas Coolman (12/01/2014)
~ Lancé par Agnès (15/01/2014 10:42:03)
~ Adresse du Site Web https://nicolascoolman.webs.com/
~ Forums gratuits d'Assistance à la désinfection : https://nicolascoolman.webs.com/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user


---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.16476 (Defaut)
MFIE: Mozilla Firefox 16.0.2

---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : RMV82
Windows License : OK
~ Windows Remaining Initializations Number : 4
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ Logiciels de protection du système
Anti-virus firewall
Windows Defender W7

---\\ Logiciels d'optimisation du système
CCleaner v3.19 =>Piriform Ltd

---\\ Logiciels de partage PeerToPeer

---\\ Surveillance de Logiciels
Adobe Flash Player 11 ActiveX
Adobe Reader 9.2 - Français
Java 7 Update 13

---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 37 Stepping 2, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3959 MB (52% free)
System Restore: Désactivé (Disabled)
System drive C: has 53 GB (11%) free of 456 GB

---\\ Mode de connexion au système
~ Computer Name: NUNU
~ User Name: Agnès
~ All Users Names: HomeGroupUser$, Agnès, Administrateur,
~ Unselected Option: None
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Agnès\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Agnès\AppData\Roaming\
~ %Desktop% : C:\Users\Agnès\Desktop\
~ %Favorites% : C:\Users\Agnès\Favorites\
~ %LocalAppData% : C:\Users\Agnès\AppData\Local\
~ %StartMenu% : C:\Users\Agnès\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 53 Go of 456 Go)
D: CD-ROM drive (Not Inserted)
E: Hard drive, Flash drive, Thumb drive (Free 335 Go of 466 Go)
F: Floppy drive, Flash card reader, USB Key (Not Inserted)
G: Floppy drive, Flash card reader, USB Key (Not Inserted)
H: Floppy drive, Flash card reader, USB Key (Not Inserted)
I: Floppy drive, Flash card reader, USB Key (Not Inserted)
K: Hard drive, Flash drive, Thumb drive (Free 224 Go of 233 Go)



---\\ Etat du Centre de Sécurité Windows
~ Security Center: 41 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.9B6678DB9C6A232C5A84D2FDFFF8B0E1] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.26/11/2013 - 08:07:57.) -- C:\Windows\System32\wininet.dll [2334208]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/09/2013 - 02:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 10/297
~ Mes Videos (My Videos) : 2/41
~ Mes Favoris (My Favorites) : 1/69
Mes Documents (My Documents) : 4/4 (Modified)
~ Mon Bureau (My Desktop) : 1/401
~ Menu demarrer (Programs) : 1/49
~ Hidden Files: Scanned in 00mn 00s



---\\ Processus lancés
[MD5.349AB4F70E2AC44970894E7F03E1576E] - (.Huawei Technologies Co., Ltd. - DataCardMonitor MFC Application.) -- C:\ProgramData\DatacardService\DCSHelper.exe [236384] [PID.1556]
[MD5.D414E7ADEED3FCD299EDE3B86AE688F0] - (.Conduit - Search Protect by Conduit.) -- C:\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe [4333856] [PID.2820] =>Toolbar.Conduit
[MD5.E9477B9700456842ED3D34FC728839C6] - (.Conduit - Search Protect by Conduit.) -- C:\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe [2911520] [PID.2852] =>Toolbar.Conduit
[MD5.F361F1C601BC56883C587529FFF2B069] - (...) -- C:\Users\Agnès\AppData\Local\fst_fr_48\upfst_fr_48.exe [3153904] [PID.3716] =>PUA.FSTfr9
[MD5.8E7AF6DD4E43C14D957C0AD7CA0A7B89] - (.Samsung - Kies.) -- C:\Program Files (x86)\Samsung\Kies\Kies.exe [1476104] [PID.3828]
[MD5.E20433DAC42F0351F237F87D8ADC4E8A] - (.Samsung - KiesPDLR.) -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844296] [PID.3892]
[MD5.2A6C01BAC0F8AA9143D61AE1E28E263A] - (.Yontoo LLC - Yontoo Desktop.) -- C:\Users\Agnès\AppData\Roaming\Yontoo\YontooDesktop.exe [42784] [PID.3960] =>Adware.Yontoo
[MD5.5DBC85C723E421198FD35C3355EBA996] - (.Samsung Electronics Co., Ltd. - Kies TrayAgent Application.) -- C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [310280] [PID.4092]
[MD5.CE5C9977DA751DDC30952AC4DCBCA788] - (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208] [PID.3268]
[MD5.8D673FD0AA6A4B850EB565D13A598A47] - (...) -- C:\Program Files (x86)\fst_fr_48\fst_fr_48.exe [3998152] [PID.3716] =>PUA.FSTfr9
[MD5.CEB82FCECEB9423D8DEE36AABCC9D329] - (.Kaspersky Lab ZAO - Antivirus Orange.) -- C:\Program Files (x86)\Orange\Antivirus Orange\avp.exe [357176] [PID.1612]
[MD5.5E6B0741282C00B5BA5256C1DD4F682C] - (.Pas de propriétaire - FrameworkEngine.) -- C:\Program Files (x86)\Sharp Savings\FrameworkEngine.exe [247848] [PID.3868]
[MD5.4A59A9F53628FD76EAA3EDFE9903BBFD] - (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe [366536] [PID.7492]
[MD5.F4762082DDCFD241BE8BA5DD35133F4A] - (.IncrediMail, Ltd. - IncrediMail Tray Application.) -- C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe [264136] [PID.1852]
[MD5.4C9D9C380E70FF2103E5C33EDF7599AD] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8334336] [PID.8480]
[MD5.CDDF7442FEF3065B4C77799EE2151354] - (.Pas de propriétaire - Installer.) -- C:\ProgramData\IBUpdaterService\ibsvc.exe [622848] [PID.1360] =>Adware.InstallBrain
[MD5.F91DADB2654E29363ADB16717D323441] - (...) -- C:\Program Files (x86)\rnamfler\naofsvc.exe [55296] [PID.2084]
[MD5.0AEB46BD2C19FE3742E3B81EABB98346] - (.Pas de propriétaire - PluginProtect.) -- C:\Users\Agnès\AppData\Roaming\okitspace\protect\PluginProtect.exe [90112] [PID.2284] =>PUP.Onekit
[MD5.35A1B1E33CBED3FB9816913A2E6E8523] - (...) -- C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [188760] [PID.2568] =>Adware.IncrediBar
[MD5.24FB8DB6D1D55E2C5D0A53DFE48E6AF8] - (.Microsoft - Y2Desktop.Updater.) -- C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe [23552] [PID.2632] =>Adware.Yontoo
[MD5.C669A972248A5DE9708A01B992E13F42] - (.Conduit - Search Protect by Conduit.) -- C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe [2301216] [PID.2700] =>Toolbar.Conduit
~ Processes Running: Scanned in 00mn 01s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Agnès\AppData\Local\Google\Chrome\User Data\Default\Preferences
G0 - GCSP: Preference [User Data\Default][HomePage] http://en.eazel.com =>Hijacker.Eazel
~ Google Browser: 1 Legitimates Filtered in 00mn 00s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Agnès\AppData\Roaming\Mozilla\Firefox\Profiles\z08gac8g.default-1352887436018\prefs.js
C:\Users\Agnès\AppData\Roaming\Mozilla\Firefox\Profiles\z08gac8g.default-1352887436018\user.js
M3 - MFPP: Plugins - [Agnès] -- C:\Users\Agnès\AppData\Roaming\Mozilla\Firefox\Profiles\z08gac8g.default-1352887436018\searchplugins\askcom.xml
M3 - MFPP: Plugins - [Agnès] -- C:\Users\Agnès\AppData\Roaming\Mozilla\Firefox\Profiles\z08gac8g.default-1352887436018\searchplugins\babylon.xml =>PUP.Babylon
M3 - MFPP: Plugins - [Agnès] -- C:\Users\Agnès\AppData\Roaming\Mozilla\Firefox\Profiles\z08gac8g.default-1352887436018\searchplugins\BrowserProtect.xml =>Hijacker.Eazel
M3 - MFPP: Plugins - [Agnès] -- C:\Users\Agnès\AppData\Roaming\Mozilla\Firefox\Profiles\z08gac8g.default-1352887436018\searchplugins\conduit-search.xml =>Toolbar.Conduit
M3 - MFPP: Plugins - [Agnès] -- C:\Users\Agnès\AppData\Roaming\Mozilla\Firefox\Profiles\z08gac8g.default-1352887436018\searchplugins\delta.xml =>Toolbar.DeltaSearch
M3 - MFPP: Plugins - [Agnès] -- C:\Users\Agnès\AppData\Roaming\Mozilla\Firefox\Profiles\z08gac8g.default-1352887436018\searchplugins\mngr.xml
M3 - MFPP: Plugins - [Agnès] -- C:\Users\Agnès\AppData\Roaming\Mozilla\Firefox\Profiles\z08gac8g.default-1352887436018\searchplugins\Web Search.xml =>Parasite.Pugi
M3 - MFPP: Plugins - [Agnès] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\babylon.xml =>PUP.Babylon
M0 - MFSP: prefs.js [Agnès - z08gac8g.default-1352887436018] http://search.conduit.com
M2 - MFEP: prefs.js [Agnès - z08gac8g.default-1352887436018\ffxtlbr@delta.com] [] Delta Toolbar v1.5.0 (..) =>Toolbar.DeltaSearch
M2 - MFEP: prefs.js [Agnès - z08gac8g.default-1352887436018\helperbar@helperbar.com] [] Snap.Do v1.5.0 (..) =>Hijacker.SmartBar
M2 - MFEP: prefs.js [Agnès - z08gac8g.default-1352887436018\plugin@yontoo.com] [] Yontoo v1.20.02 (..) =>Adware.Yontoo
M2 - MFEP: prefs.js [Agnès - z08gac8g.default-1352887436018\SpecialSavings@SpecialSavings.com] [] SpecialSavings v2.0.0.1 (..) =>PUP.SpecialSavings
P2 - FPN:Firefox Plugin Navigator . (.BitComet - BitCometAgent v1.30 for Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\Plugins\npBitCometAgent.dll =>P2P.BitComet
~ Firefox Browser: 24 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://en.eazel.com =>Hijacker.Eazel
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = https://search.safefinder.com/?q= =>Hijacker.SmartBar
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = preserve
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = https://search.safefinder.com/?q= =>Hijacker.SmartBar
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = https://search.safefinder.com/?q= =>Hijacker.SmartBar
~ IE Browser: 24 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: Web Assistant Helper [64Bits] - {336D0C35-8A85-403a-B9D2-65C292C39087} . (...) -- C:\Program Files\Web Assistant\Extension32.dll =>Adware.IncrediBar
O2 - BHO: OKitSpace Ads [64Bits] - {3543619C-D563-43f7-95EA-4DA7E1CC396A} . (...) -- C:\Windows\SysWow64\config\systemprofile\AppData\Roaming\okitSpace\IE\OkitSpace.dll =>PUP.Onekit
O2 - BHO: PassWidget [64Bits] - {6a9b7897-b837-48e7-b0f0-0ff0ab86fc85} . (...) -- C:\Program Files (x86)\Pass-Widget\150.dll =>PUP.PassWidget
O2 - BHO: Sharp Savings BHO [64Bits] - {E0445864-8AF4-434F-B0AA-467617D42C05} . (.Pas de propriétaire - FrameworkBHO.) -- C:\Program Files (x86)\Sharp Savings\FrameworkBHO.dll
O2 - BHO: SWEETIE [64Bits] - {EEE6C35C-6118-11DC-9C72-001320C79847} . (.SweetIM Technologies Ltd. - SweetIM Toolbar module for Internet Explore.) -- C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll =>PUP.SweetIM
O2 - BHO: Snap.DoEngine [64Bits] - {31ad400d-1b06-4e33-a59a-90c2c140cba0} . (...) -- mscoree.dll (.not file.) =>Hijacker.SmartBar
~ BHO: 28 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Snap.Do - [HKLM]{ae07101b-46d4-4a98-af68-0333ea26e113} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation
O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll =>Toolbar.Google
O3 - Toolbar: Sharp Savings - [HKLM]{DB1B0F76-EBC6-4D94-965D-470EE399C5E1} . (.Pas de propriétaire - FrameworkBHO.) -- C:\Program Files (x86)\Sharp Savings\FrameworkBHO64.dll
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{21FA44EF-376D-4D53-9B0F-8A89D3229068} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{D4027C7F-154A-4066-A1AD-4243D8127440} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{30F9B915-B755-4826-820B-08FBA6BD249D} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{EEE6C35B-6118-11DC-9C72-001320C79847} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{05EEB91A-AEF7-4F8A-978F-FB83E7B03F8E} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{4B3803EA-5230-4DC3-A7FC-33638F3D3542} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{D7E97865-918F-41E4-9CD0-25AB1C574CE8} Clé orpheline
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{19803860-B306-423C-BBB5-F60A7D82CDE5} Clé orpheline
~ Toolbar: Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Antivirus Orange.lnk . (.Kaspersky Lab ZAO - Kaspersky Anti-Virus Launcher.) -- C:\Program Files (x86)\Orange\Antivirus Orange\starter_avp.exe
O4 - GS\Desktop [Public]: EQ4.lnk . (.The Electric Quilt Company - EQ4 MFC Application.) -- C:\EQ4\Eq98.exe
O4 - GS\Desktop [Public]: HP Officejet 4620 series.lnk . (.Hewlett-Packard Co. - HP Printer Assistant.) -- C:\Program Files\HP\HP Officejet 4620 series\Bin\HP Officejet 4620 series.exe =>.Hewlett-Packard Co
O4 - GS\Desktop [Public]: IncrediMail.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O4 - GS\Desktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe http://en.eazel.com =>Hijacker.Eazel
O4 - GS\Desktop [Public]: PrintPratic.lnk . (.Micro Application - Print Pratic.) -- C:\Program Files (x86)\Micro Application\PrintPratic\PrintPratic.exe
O4 - GS\Desktop [Public]: Songr.lnk . (.Xamasoft - Songr.) -- C:\Program Files (x86)\Songr\Songr.exe
O4 - GS\Desktop [Public]: Wi-Fi Modem.lnk - Clé orpheline
O4 - GS\Program [Public]: Documentation d'aide de Dell.lnk . (...) -- C:\Program Files (x86)\Dell Inc\Dell Edoc Viewer\EDocs.exe (.not file.)
O4 - GS\Program [Public]: IncrediMail.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O4 - GS\Program [Public]: Lollipop.lnk . (...) -- C:\Users\Agnès\AppData\Local\Lollipop\Lollipop.exe (.not file.) =>Adware.Lollipop
O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe http://en.eazel.com =>Hijacker.Eazel
O4 - GS\Program [Public]: Navigateur OfferBox.lnk . (.Aedge Performance BCN SL - OfferBox.) -- C:\Program Files (x86)\OfferBox\OfferBox.exe http://www.offerbox.com =>PUP.OfferBox
O4 - GS\Program [Public]: Songr.lnk . (.Xamasoft - Songr.) -- C:\Program Files (x86)\Songr\Songr.exe
O4 - GS\QuickLaunch [Agnès]: IncrediMail 2.0.lnk . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe
O4 - GS\QuickLaunch [Agnès]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Program [Agnès]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe http://en.eazel.com =>Hijacker.Eazel
O4 - GS\SystemTools [Agnès]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SendTo [Agnès]: Foxmail.LNK . (...) -- C:\Program Files (x86)\Foxmail\Foxmail.exe (.not file.)
O4 - GS\Desktop [Agnès]: ARTIDEVIS_V7.lnk . (.Informatique Concept System - Devis simplifié des artisans du batiment.) -- C:\ARTIDEVIS_V7\ARTIDEVIS_V7.exe
O4 - GS\Desktop [Agnès]: Compta.lnk . (.Sage activité Ciel - Ciel Compta.) -- C:\Program Files (x86)\Ciel\Compta\WK.exe
O4 - GS\Desktop [Agnès]: Continuer Installation de Avast.lnk . (...) -- C:\Users\Agnès\AppData\Local\Temp\ICReinstall_installer_avast_French.exe
O4 - GS\Desktop [Agnès]: Devis facture.lnk . (.Sage activité Ciel - Ciel Devis Factures.) -- C:\Program Files (x86)\Ciel\Devis factures\WDF.exe
O4 - GS\Desktop [Agnès]: Downloads - Raccourci.lnk . (...) -- C:\Downloads
O4 - GS\Desktop [Agnès]: Glary Utilities.lnk . (.Glarysoft Ltd - Glary Utilities.) -- C:\Program Files (x86)\Glary Utilities\Integrator.exe
O4 - GS\Desktop [Agnès]: Print Artist 2002.lnk . (...) -- C:\Sierra\Print Artist 2002\PrintArt.exe
O4 - GS\Desktop [Agnès]: Protection bancaire.lnk . (.Kaspersky Lab ZAO - Kaspersky Anti-Virus Launcher.) -- C:\Program Files (x86)\Orange\Antivirus Orange\starter_avp.exe
O4 - GS\Desktop [Agnès]: Revo Uninstaller.lnk . (.VS Revo Group - Revo Uninstaller.) -- C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe
O4 - GS\Desktop [Agnès]: Sweet Home 3D.lnk . (.eTeks - Sweet Home 3D.) -- C:\Program Files (x86)\Sweet Home 3D\SweetHome3D.exe
O4 - GS\Desktop [Agnès]: WebTarot.lnk . (.AtoutWeb - jeu de tarot.) -- C:\Program Files (x86)\Webtarot\webtarot.exe
O4 - GS\Desktop [Agnès]: Windows Doctor.lnk . (.WindowsDoctor.com - Windows Doctor.) -- C:\Program Files (x86)\Windows Doctor\WindowsDoctor.exe
~ Global Startup: 90 Legitimates Filtered in 00mn 00s



---\\ Applications lancées au démarrage du sytème (O4)
O4 - GS\Startup [Agnès]: Alertes de surveillance de l'encre - HP Officejet 4620 series.lnk . (.Hewlett-Packard Co. - Print Driver Status Business Logic.) -- C:\Program Files\HP\HP Officejet 4620 series\bin\HPStatusBL.dll =>.Hewlett-Packard Co
O4 - HKCU\..\Run: [KiesPreload] . (.Samsung - Kies.) -- C:\Program Files (x86)\Samsung\Kies\Kies.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKCU\..\Run: [Yontoo Desktop] . (.Yontoo LLC - Yontoo Desktop.) -- C:\Users\Agnès\AppData\Roaming\Yontoo\YontooDesktop.exe =>Adware.Yontoo
O4 - HKCU\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe =>Toolbar.Google
O4 - HKCU\..\Run: [Mobile Partner] Clé orpheline
O4 - HKLM\..\Wow6432Node\Run: [KiesTrayAgent] . (.Samsung Electronics Co., Ltd. - Kies TrayAgent Application.) -- C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe =>.Samsung Electronics Co
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKLM\..\Wow6432Node\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe =>.Hewlett-Packard Co
O4 - HKLM\..\Wow6432Node\Run: [fst_fr_48] . (...) -- C:\Program Files (x86)\fst_fr_48\fst_fr_48.exe =>PUA.FSTfr9
O4 - HKLM\..\Wow6432Node\Run: [AVP] . (.Kaspersky Lab ZAO - Antivirus Orange.) -- C:\Program Files (x86)\Orange\Antivirus Orange\avp.exe
O4 - HKLM\..\Wow6432Node\RunOnce: [Sharp Savings-repairJob] . (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\Windows\System32\wscript.exe
O4 - HKLM\..\Wow6432Node\RunOnce: [upfst_fr_48.exe] . (...) -- C:\Users\Agnès\AppData\Local\fst_fr_48\upfst_fr_48.exe =>PUA.FSTfr9
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2724160972-4189976108-2317738353-1000\..\Run: [KiesPreload] . (.Samsung - Kies.) -- C:\Program Files (x86)\Samsung\Kies\Kies.exe
O4 - HKUS\S-1-5-21-2724160972-4189976108-2317738353-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2724160972-4189976108-2317738353-1000\..\Run: [Yontoo Desktop] . (.Yontoo LLC - Yontoo Desktop.) -- C:\Users\Agnès\AppData\Roaming\Yontoo\YontooDesktop.exe =>Adware.Yontoo
O4 - HKUS\S-1-5-21-2724160972-4189976108-2317738353-1000\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe =>Toolbar.Google
O4 - HKUS\S-1-5-21-2724160972-4189976108-2317738353-1000\..\Run: [Mobile Partner] Clé orpheline
~ Application: Scanned in 00mn 00s



---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Clavier virtuel [64Bits] - {0C4CC089-D306-440D-9772-464E226F6539} . (...) -- C:\Program Files (x86)\Orange\Antivirus Orange\kbrd.ico
O9 - Extra button: &Envoyer à OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\MICROS~2\Office14\ONBttnIE.dll =>.Microsoft Corporation
O9 - Extra button: Notes &liées OneNote [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\MICROS~2\Office14\ONBTTN~1.dll =>.Microsoft Corporation
O9 - Extra button: Analyse des liens [64Bits] - {CCF151D8-D089-449F-A5A4-D9909053F20F} . (...) -- C:\Program Files (x86)\Orange\Antivirus Orange\logo.ico
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Site dans la Zone de confiance d'Internet Explorer (O15)
O15 - Trusted Zone: [HKCU\...\Domains] *.dell.com
~ IE Zone Confiance: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{40564E44-54CB-4CEC-AB84-1814DF58054D}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{BD9FFDC1-AADC-437A-91BE-1B4852C2CCFB}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{BD9FFDC1-AADC-437A-91BE-1B4852C2CCFB}: DhcpDomain = wifimodem.orange
O17 - HKLM\System\CS1\Services\Tcpip\..\{40564E44-54CB-4CEC-AB84-1814DF58054D}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{BD9FFDC1-AADC-437A-91BE-1B4852C2CCFB}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{BD9FFDC1-AADC-437A-91BE-1B4852C2CCFB}: DhcpDomain = wifimodem.orange
O17 - HKLM\System\CS2\Services\Tcpip\..\{40564E44-54CB-4CEC-AB84-1814DF58054D}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{BD9FFDC1-AADC-437A-91BE-1B4852C2CCFB}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{BD9FFDC1-AADC-437A-91BE-1B4852C2CCFB}: DhcpDomain = wifimodem.orange
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: wlmailhtml [64Bits] - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} . (...) --
O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Search Protect by Conduit Service (CltMngSvc) . (.Conduit - Search Protect by Conduit.) - C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe =>Toolbar.Conduit
O23 - Service: Updater Service (IBUpdaterService) . (.Pas de propriétaire - Installer.) - C:\ProgramData\IBUpdaterService\ibsvc.exe =>Adware.InstallBrain
O23 - Service: (RdnaoFlSvc) . (...) - C:\Program Files (x86)\rnamfler\naofsvc.exe
O23 - Service: Browser Protect (srvBrowserProtect) . (.Pas de propriétaire - srvBrowserProtect.) - C:\Program Files (x86)\BrowserProtect\srvBrowserProtect.exe =>Hijacker.Eazel
O23 - Service: Protect your browser's extensions (srvPlgProtect) . (.Pas de propriétaire - PluginProtect.) - C:\Users\Agnès\AppData\Roaming\okitspace\protect\PluginProtect.exe =>PUP.Onekit
O23 - Service: Software Updater (SrvUpdater) . (.Pas de propriétaire - Updater.) - C:\Program Files (x86)\SoftwareUpdater\UpdaterService.exe =>PUP.Eorezo
O23 - Service: Web Assistant (Web Assistant) . (...) - C:\Program Files\Web Assistant\ExtensionUpdaterService.exe =>Adware.IncrediBar
~ Services: 10 Legitimates Filtered in 00mn 04s



---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\bench-S-1-5-21-2724160972-4189976108-2317738353-1000.job [344] =>PUP.GiganticSavings
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\bench-sys.job [344] =>PUP.GiganticSavings
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\PassWidget Update.job [384] =>PUP.PassWidget
[MD5.2064E97CF3396C4EC5A497CE49E4515F] [APT] [bench-S-1-5-21-2724160972-4189976108-2317738353-1000] (...) -- C:\Program Files (x86)\Bench\Updater\Updater.exe [254456] =>PUP.GiganticSavings
[MD5.2064E97CF3396C4EC5A497CE49E4515F] [APT] [bench-sys] (...) -- C:\Program Files (x86)\Bench\Updater\Updater.exe [254456] =>PUP.GiganticSavings
[MD5.754F0855B332CA5FEC434D7AF295BE2E] [APT] [EPUpdater] (...) -- C:\Users\Agnès\AppData\Roaming\BabSolution\Shared\BabMaint.exe [10224] =>Hijacker.BabSolution
[MD5.66FD57F889724843FA04F2B163A56B76] [APT] [PassWidget Update] (...) -- C:\Program Files (x86)\Pass-Widget\passwup.exe [251904] =>PUP.PassWidget
[MD5.00000000000000000000000000000000] [APT] [Scheduled Update for Ask Toolbar] (...) -- C:\Program Files (x86)\Ask.com\UpdateTask.exe (.not file.) [0] =>Toolbar.Ask
[MD5.00000000000000000000000000000000] [APT] [Test TimeTrigger] (...) -- C:\Users\Agnès\AppData\Local\Temp\Runner.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{061CBF1C-E77C-4A08-B00C-A653938DB6C8}] (...) -- D:\setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{118C9FB1-0023-4FE4-8BB0-35364E11575D}] (...) -- J:\EASetup.exe (.not file.) [0]
[MD5.D770294E97BB4F83A7A9FB527DD97F4A] [APT] [{150889AB-B3D0-4612-86F6-78DEB6E4AECE}] (...) -- C:\Sierra\Print Artist 2002\PrintArt.exe [2514944]
[MD5.00000000000000000000000000000000] [APT] [{1C8EE1C9-BBDC-4480-99C3-7C42642F4EEE}] (...) -- J:\Atomix Virtual DJ Pro V6.0.2 + Crack + Add Ons\Atomix_Virtual_DJ_Pro V6.0.2 Setup.exe (.not file.) [0]
[MD5.4A59A9F53628FD76EAA3EDFE9903BBFD] [APT] [{29A4DEE5-D57D-492F-B451-E79E207B2C5B}] (.IncrediMail, Ltd..) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe [366536]
[MD5.4A59A9F53628FD76EAA3EDFE9903BBFD] [APT] [{430C9EA8-0098-40E3-9AD6-66B57611008D}] (.IncrediMail, Ltd..) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe [366536]
[MD5.00000000000000000000000000000000] [APT] [{509393A5-788A-4069-8626-7FB87CCC9AD8}] (...) -- C:\Users\Agnès\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\4CP3T7KW\vklsetup[1].exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{57F20237-2569-45E0-9B6F-9223522D0D8D}] (...) -- C:\Users\Agnès\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\HCOUZA9T\AdobeAIRInstaller[1].exe (.not file.) [0]
[MD5.2D5E7A06B411810451C43C6E3D204EBE] [APT] [{5D5B066C-BC92-4860-8F25-DDA0AC9D07C8}] (...) -- C:\Download\SADupd.exe [147512]
[MD5.00000000000000000000000000000000] [APT] [{7372587E-D8C7-4610-9EE0-3ED47EC29798}] (...) -- C:\Users\Agnès\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\I4XORQUO\rk_uninstall[1].exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{74999E68-316D-40E0-A360-45907CABFC48}] (...) -- C:\Program Files (x86)\Star Downloader\stardown.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{7B35DEDB-1733-4395-BD8E-BFE8C091871D}] (...) -- C:\Program Files (x86)\Star Downloader\stardown.exe (.not file.) [0]
[MD5.4A59A9F53628FD76EAA3EDFE9903BBFD] [APT] [{7F33D55E-745F-4C06-B73E-10C95B93FA1A}] (.IncrediMail, Ltd..) -- C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe [366536]
[MD5.00000000000000000000000000000000] [APT] [{89BEEBCE-2B7C-4795-9C12-26D781D716D7}] (...) -- C:\Program Files (x86)\Micro Application\Vos Photos ... la T'l' sur CD-DVD 2\PhotoTV2.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{9807463B-AF0B-4770-A23D-DF44EF5E8AF2}] (...) -- C:\Users\Agnès\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\E5VAPTO2\rk_uninstall[1].exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{9F2B2ACD-CE10-4C33-B5C6-F4D952FE0324}] (...) -- C:\Users\Agnès\Downloads\install_outlook_clic.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{A30D7D1E-EB2B-4E6A-A1C3-3795B92A55DC}] (...) -- C:\Users\Agnès\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\WH6AALSN\dotnetfx35setup[1].exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{B6E80136-508B-441E-9250-5E91053E7A5F}] (...) -- D:\setup\Setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{C9567A97-0B3F-4D9D-9EA6-B2329FC25C8E}] (...) -- D:\INSTALL.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{DCA6B4CB-8032-4F91-80D9-ACD8214FC6A0}] (...) -- C:\Users\Agnès\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\W0S6BOTG\AdobeAIRInstaller[1].exe (.not file.) [0]
[MD5.3DB375C053E7E691C65A77CC33EBB14C] [APT] [{E1F58324-4920-49B0-914F-CDA332F526FA}] (...) -- C:\Program Files (x86)\IncrediMail\Bin\ImSetup.exe [120776]
[MD5.00000000000000000000000000000000] [APT] [{E6CAFBB0-B6D2-4A8A-BD69-785DB156D0CB}] (...) -- C:\Users\Agnès\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\KWO569GT\naomi_naomi_3.2.90_francais_19700[1].exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{EC6260E4-6F1E-43A7-9793-E5324CC918C3}] (...) -- C:\Users\Agnès\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\S764EH4A\jajuk-1.8.4-win32-setup[1].exe (.not file.) [0]
~ Scheduled Task: 48 Legitimates Filtered in 00mn 02s



---\\ Pilotes lancés au démarrage du système (O41)
O41 - Driver: (RxFilter) . (. - .) - C:\Windows\System32\DRIVERS\RxFilter.sys (.not file.)
~ Drivers: 84 Legitimates Filtered in 00mn 00s



---\\ Logiciels installés (O42)
O42 - Logiciel: BrowserProtect - (...) [HKLM][64Bits] -- BrowserProtect =>Hijacker.Eazel
O42 - Logiciel: Carnet d'Adresses - (...) [HKLM][64Bits] -- {54015872-1DB2-4031-A54E-920BED0C2EBF}
O42 - Logiciel: Delta toolbar - (.Delta.) [HKLM][64Bits] -- delta =>Toolbar.DeltaSearch
O42 - Logiciel: EQ4 - (...) [HKLM][64Bits] -- EQ4
O42 - Logiciel: IncrediMail - (.IncrediMail.) [HKLM][64Bits] -- {5E97F3BD-CDDC-4188-9D98-532E14FABB5D}
O42 - Logiciel: IncrediMail 2.0 - (.IncrediMail Ltd..) [HKLM][64Bits] -- IncrediMail
O42 - Logiciel: IncrediMail MediaBar 2 Toolbar - (.IncrediMail MediaBar 2.) [HKLM][64Bits] -- IncrediMail_MediaBar_2 Toolbar
O42 - Logiciel: Morpho Middleware ypsID v5.3.0 - (.Morpho e-Documents.) [HKLM][64Bits] -- {50DFA201-B1FB-4012-8133-3E4044230416}
O42 - Logiciel: PassWidget - (.PassWidget Software.) [HKLM][64Bits] -- ae0d556f-c850-47b5-9732-796da6d36170 =>PUP.PassWidget
O42 - Logiciel: Quilt-Pro Version 4 - (...) [HKLM][64Bits] -- Quilt-Pro Version 4
O42 - Logiciel: Search Protect - (.Conduit.) [HKLM][64Bits] -- SearchProtect =>Toolbar.Conduit
O42 - Logiciel: Super Tricot 2007 - (...) [HKLM][64Bits] -- {CE6BD630-3F8C-4E8E-9A02-FA11655207C5}
O42 - Logiciel: SweetIM for Messenger 3.2 - (.SweetIM Technologies Ltd..) [HKLM][64Bits] -- {08ED8855-4C2E-429B-A878-F129E1F624FA} =>PUP.SweetIM
O42 - Logiciel: SweetIM for Messenger 3.6 - (.SweetIM Technologies Ltd..) [HKLM][64Bits] -- {B85C4CB2-B352-4BD8-818C-BCE353599107} =>PUP.SweetIM
O42 - Logiciel: Vittalia Installer - (.TELECHARGERS.net.) [HKLM][64Bits] -- Vittalia =>PUP.Vittalia
O42 - Logiciel: Web Assistant version 2.0.0.611 - (.IncrediBar.) [HKLM][64Bits] -- {336D0C35-8A85-403a-B9D2-65C292C39087}_is1 =>Adware.IncrediBar
O42 - Logiciel: fst_fr_48 - (.FREESOFTTODAY.) [HKLM][64Bits] -- fst_fr_48_is1 =>Adware.FreeSoftToday
~ Logic: 33 Legitimates Filtered in 00mn 00s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\APN]
[HKCU\Software\Ask.com]
[HKCU\Software\AutoPrntApp]
[HKCU\Software\BabSolution] =>Hijacker.BabSolution
[HKCU\Software\BearShare] =>PUP.BearShare
[HKCU\Software\Conduit] =>Toolbar.Conduit
[HKCU\Software\DataMngr] =>PUP.Datamngr
[HKCU\Software\DataMngr_Toolbar] =>PUP.Datamngr
[HKCU\Software\Delta]
[HKCU\Software\FileScout] =>PUP.FileScout
[HKCU\Software\IM]
[HKCU\Software\IncrediMail]
[HKCU\Software\InstallCore] =>Adware.InstallCore
[HKCU\Software\OfferBox] =>PUP.OfferBox
[HKCU\Software\SmartbarBackup] =>Hijacker.SmartBar
[HKCU\Software\SmartbarLog] =>Hijacker.SmartBar
[HKCU\Software\Smartbar] =>Hijacker.SmartBar
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKCU\Software\SweetIM] =>PUP.SweetIM
[HKCU\Software\TutoTag] =>Spyware.AgenceExclusive
[HKCU\Software\Tutorials] =>Spyware.AgenceExclusive
[HKCU\Software\YahooPartnerToolbar]
[HKCU\Software\delta LTD]
[HKCU\Software\freesofttoday] =>Adware.FreeSoftToday
[HKLM\Software\DataMngr] =>PUP.Datamngr
[HKLM\Software\Morpho]
[HKLM\Software\Tarma Installer] =>PUP.Tarma
[HKLM\Software\Web Assistant] =>Adware.IncrediBar
[HKLM\Software\Wow6432Node\APN]
[HKLM\Software\Wow6432Node\Babylon] =>PUP.Babylon
[HKLM\Software\Wow6432Node\Conduit] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\DataMngr] =>PUP.Datamngr
[HKLM\Software\Wow6432Node\Delta]
[HKLM\Software\Wow6432Node\FREESOFTTODAY] =>Adware.FreeSoftToday
[HKLM\Software\Wow6432Node\Game_Master_2.1]
[HKLM\Software\Wow6432Node\IncrediMail_MediaBar_2]
[HKLM\Software\Wow6432Node\OKitSpace] =>PUP.Onekit
[HKLM\Software\Wow6432Node\OfferBox] =>PUP.OfferBox
[HKLM\Software\Wow6432Node\Rio]
[HKLM\Software\Wow6432Node\SweetIM] =>PUP.SweetIM
[HKLM\Software\Wow6432Node\Tutorials] =>Spyware.AgenceExclusive
[HKLM\Software\Wow6432Node\Web Assistant] =>Adware.IncrediBar
~ Key Software: 498 Legitimates Filtered in 00mn 01s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 10/01/2014 - 11:14:07 - [1,116] ----D C:\Program Files (x86)\BrowserProtect =>Hijacker.Eazel
O43 - CFD: 09/10/2013 - 08:36:29 - [1,428] ----D C:\Program Files (x86)\Delta
O43 - CFD: 10/01/2014 - 11:14:13 - [8,189] ----D C:\Program Files (x86)\fst_fr_48 =>PUA.FSTfr9
O43 - CFD: 17/04/2013 - 12:39:07 - [0,022] ----D C:\Program Files (x86)\Habitat 3D Maison
O43 - CFD: 20/12/2010 - 10:31:36 - [26,444] ----D C:\Program Files (x86)\IncrediMail
O43 - CFD: 03/12/2012 - 20:53:33 - [3,891] ----D C:\Program Files (x86)\IncrediMail_MediaBar_2
O43 - CFD: 01/03/2011 - 17:54:15 - [28,136] ----D C:\Program Files (x86)\Jajuk
O43 - CFD: 17/02/2011 - 10:18:49 - [1,588] ----D C:\Program Files (x86)\mp3-explorer
O43 - CFD: 05/09/2011 - 09:56:55 - [3,455] ----D C:\Program Files (x86)\OfferBox =>PUP.OfferBox
O43 - CFD: 10/01/2014 - 11:13:38 - [1,145] ----D C:\Program Files (x86)\Pass-Widget =>PUP.PassWidget
O43 - CFD: 06/12/2012 - 14:34:11 - [201,245] ----D C:\Program Files (x86)\QuiltPro4
O43 - CFD: 27/01/2012 - 21:38:44 - [1,536] R-H-D C:\Program Files (x86)\rnamfler
O43 - CFD: 16/12/2010 - 19:01:50 - [8,783] ----D C:\Program Files (x86)\SweetIM =>PUP.SweetIM
O43 - CFD: 08/10/2013 - 14:52:06 - [0,104] ----D C:\Program Files (x86)\Vittalia =>PUP.Vittalia
O43 - CFD: 24/09/2012 - 09:27:46 - [0,086] ----D C:\Program Files (x86)\VKL
O43 - CFD: 24/05/2013 - 14:10:19 - [0,022] ----D C:\Program Files (x86)\Yontoo =>Adware.Yontoo
O43 - CFD: 08/06/2012 - 12:02:23 - [0,003] ----D C:\ProgramData\1738A
O43 - CFD: 08/10/2013 - 10:53:13 - [0] ----D C:\ProgramData\Babylon =>PUP.Babylon
O43 - CFD: 09/10/2013 - 08:34:57 - [0,147] ----D C:\ProgramData\DSearchLink =>Toolbar.DeltaSearch
O43 - CFD: 18/04/2013 - 19:13:40 - [0,597] ----D C:\ProgramData\IBUpdaterService =>Adware.InstallBrain
O43 - CFD: 23/09/2010 - 13:16:24 - [0] ----D C:\ProgramData\IM
O43 - CFD: 23/09/2010 - 13:15:44 - [10,430] ----D C:\ProgramData\IncrediMail
O43 - CFD: 16/12/2010 - 19:01:26 - [0,760] ----D C:\ProgramData\SweetIM =>PUP.SweetIM
O43 - CFD: 18/04/2013 - 19:18:07 - [2,153] ----D C:\ProgramData\Tarma Installer =>PUP.Tarma
O43 - CFD: 18/12/2010 - 18:19:29 - [0] --H-D C:\ProgramData\{D8629CB4-484E-4AEC-AC8A-800083A44FF2}
O43 - CFD: 09/10/2013 - 08:35:09 - [1,265] ----D C:\Users\Agnès\AppData\Roaming\BabSolution =>Hijacker.BabSolution
O43 - CFD: 26/11/2012 - 20:28:48 - [0,025] ----D C:\Users\Agnès\AppData\Roaming\Babylon =>PUP.Babylon
O43 - CFD: 05/09/2013 - 09:35:08 - [1,921] ----D C:\Users\Agnès\AppData\Roaming\BitComet =>P2P.BitComet
O43 - CFD: 09/10/2013 - 08:36:29 - [0,259] ----D C:\Users\Agnès\AppData\Roaming\Delta
O43 - CFD: 18/04/2013 - 19:17:33 - [0,308] ----D C:\Users\Agnès\AppData\Roaming\File Scout =>PUP.FileScout
O43 - CFD: 22/07/2012 - 10:59:18 - [0,692] ----D C:\Users\Agnès\AppData\Roaming\OfferBox =>PUP.OfferBox
O43 - CFD: 13/01/2014 - 10:16:10 - [1,212] ----D C:\Users\Agnès\AppData\Roaming\okitspace =>PUP.Onekit
O43 - CFD: 15/07/2011 - 19:42:33 - [0,391] ----D C:\Users\Agnès\AppData\Roaming\Shareaza
O43 - CFD: 18/04/2013 - 19:18:00 - [0,066] ----D C:\Users\Agnès\AppData\Roaming\SpecialSavings =>PUP.SpecialSavings
O43 - CFD: 15/01/2014 - 10:08:57 - [2,105] ----D C:\Users\Agnès\AppData\Roaming\Yontoo =>Adware.Yontoo
O43 - CFD: 03/05/2013 - 09:19:01 - [0] ----D C:\Users\Agnès\AppData\Local\APN
O43 - CFD: 11/06/2012 - 05:54:09 - [0,003] ----D C:\Users\Agnès\AppData\Local\BearShare =>PUP.BearShare
O43 - CFD: 24/09/2012 - 10:35:55 - [204,144] ----D C:\Users\Agnès\AppData\Local\blekkotb_031 =>Toolbar.Blekko
O43 - CFD: 03/12/2012 - 17:55:01 - [0] ----D C:\Users\Agnès\AppData\Local\Conduit
O43 - CFD: 13/01/2014 - 10:30:03 - [0] ----D C:\Users\Agnès\AppData\Local\freeSOFTtoday =>Adware.FreeSoftToday
O43 - CFD: 15/01/2014 - 10:11:52 - [8,656] ----D C:\Users\Agnès\AppData\Local\fst_fr_48 =>PUA.FSTfr9
O43 - CFD: 03/12/2012 - 20:57:52 - [796,099] ----D C:\Users\Agnès\AppData\Local\IM
O43 - CFD: 01/10/2010 - 14:42:28 - [85,165] ----D C:\Users\Agnès\AppData\Local\Shareaza
O43 - CFD: 24/09/2012 - 09:59:18 - [16,740] ----D C:\Users\Agnès\AppData\Local\Smartbar =>Hijacker.SmartBar
O43 - CFD: 08/10/2010 - 09:22:16 - [0,001] ----D C:\Users\Agnès\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Quilt-Pro4
~ Program Folder: 296 Legitimates Filtered in 00mn 01s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.C5490C3D6D254DD788E8562F4C88A18C] - 10/01/2014 - 11:16:51 ---A- . (...) -- C:\Windows\Eq98.ini [3490]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 13/01/2014 - 10:10:53 ---A- . (...) -- C:\END [0]
O44 - LFC:[MD5.48C0FAAF595D491AE97C86C3141A3068] - 13/01/2014 - 11:57:26 ---A- . (...) -- C:\Windows\FSUNINST.log [14701]
~ Files: 16 Legitimates Filtered in 00mn 01s



---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.5AFBC7A2FCF2C6490DEF44B3301F4AD3] - 15/01/2014 - 08:33:49 ---A- - C:\Windows\Prefetch\WDF.EXE-5F3A99E0.pf
O45 - LFCP:[MD5.376C851A25DF333D6EE778A968210FD5] - 15/01/2014 - 10:07:11 ---A- - C:\Windows\Prefetch\IMBPP.EXE-7DDC38F4.pf
O45 - LFCP:[MD5.53156D2627D6699F2FF422D9E2DB53C5] - 15/01/2014 - 10:10:36 ---A- - C:\Windows\Prefetch\FRAMEWORKENGINE.EXE-60C292C7.pf
O45 - LFCP:[MD5.295FDF02CFA6B78E5A515BACBF3A74DA] - 15/01/2014 - 10:11:52 ---A- - C:\Windows\Prefetch\UPFST_FR_48.EXE-222046C4.pf =>PUA.FSTfr9
O45 - LFCP:[MD5.11FC3AF5526E9AEE9E44AA3341AECA42] - 15/01/2014 - 10:11:56 ---A- - C:\Windows\Prefetch\BROWSERPROTECTIU.EXE-65F9F016.pf =>Hijacker.Eazel
O45 - LFCP:[MD5.00FC33E9AEE24BEAC174F7D01B5BD7BA] - 15/01/2014 - 10:23:39 ---A- - C:\Windows\Prefetch\INCMAIL.EXE-160A50B5.pf
O45 - LFCP:[MD5.08B5E22CBA143781A629345CC4BD3367] - 15/01/2014 - 10:23:41 ---A- - C:\Windows\Prefetch\IMLPP.EXE-87D7D106.pf
O45 - LFCP:[MD5.986E2FB097CB484105C1670DD2E2897A] - 15/01/2014 - 10:23:49 ---A- - C:\Windows\Prefetch\IMAPP.EXE-FCDCA9BF.pf
O45 - LFCP:[MD5.6B47BD18A7CAD914DBB39F09BCA5A3CE] - 15/01/2014 - 10:28:57 ---A- - C:\Windows\Prefetch\IMNOTFY.EXE-70CE0CC2.pf
~ Prefetcher: 106 Legitimates Filtered in 00mn 01s



---\\ Clé de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{972a2eab-5e63-11e3-987e-b8ac6f9d277e}\AutoRun\command. (...) -- L:\AutoRun.exe (.not file.)
O51 - MPSK:{972a2eb2-5e63-11e3-987e-b8ac6f9d277e}\AutoRun\command. (...) -- L:\AutoRun.exe (.not file.)
~ Keys: Scanned in 00mn 00s



---\\ Enumération des clés de registre StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\BitComet [Key] . (...) -- C:\Program Files (x86)\BitComet\BitComet.exe (.not file.) =>P2P.BitComet
O53 - SMSR:HKLM\...\startupreg\Browser Infrastructure Helper [Key] . (.Smartbar - Smartbar.) -- C:\Users\Agnès\AppData\Local\Smartbar\Application\SnapDo.exe =>Hijacker.SmartBar
O53 - SMSR:HKLM\...\startupreg\DellSupportCenter [Key] . (...) -- C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\IncrediMail [Key] . (.IncrediMail, Ltd. - IncrediMail Application.) -- C:\Program Files (x86)\IncrediMail\bin\IncMail.exe
O53 - SMSR:HKLM\...\startupreg\msnmsgr [Key] . (...) -- ~"C:\Program Files (x86)\WIC4A1~1\MESSEN~1\msnmsgr.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\PC Accelerateur [Key] . (...) -- C:\Program Files (x86)\PC Accelerateur\PCACLauncher.exe (.not file.) =>PUP.PCAccelerateur
O53 - SMSR:HKLM\...\startupreg\Shareaza [Key] . (...) -- C:\Program Files (x86)\Shareaza\Shareaza.exe (.not file.)
O53 - SMSR:HKLM\...\startupreg\SweetIM [Key] . (.SweetIM Technologies Ltd. - SweetIM Instant Messenger Enhancer.) -- C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe =>PUP.SweetIM
O53 - SMSR:HKLM\...\startupreg\wrna3ls [Key] . (...) -- C:\Program Files (x86)\rnamfler\naomf.exe
O53 - SMSR:HKLM\...\startupreg\WTClient [Key] . (.Tablet Driver - Tablet Client Driver.) -- C:\Windows\System32\WTClient.exe
~ SMSR Keys: 43 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "AllowLegacyWebView"=1
O56 - MWPE:[HKLM\...\policies\Explorer] - "AllowUnhashedWebView"=1
~ MWPE Keys: 6 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.FB9BEF3401EE5ECC2603311B9C64F44A] - 01/06/2011 - 20:52:38 ---A- . (.DT Soft Ltd - DAEMON Tools Virtual Bus Driver.) -- C:\Windows\System32\Drivers\dtsoftbus01.sys [254528]
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:[MD5.F572B7467B5CB4FA8FB6319575902E41] - 08/10/2010 - 09:59:40 ---A- . (.Huawei Tech. Co., Ltd. - HUAWEI USB Smart Card Driver.) -- C:\Windows\System32\Drivers\ewdcsc.sys [32768]
O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:[MD5.07071C1E3CD8F0F9114AAC8B072CA1E5] - 29/04/2009 - 15:28:30 ---A- . (.Windows (R) Codename Longhorn DDK provider - KMWDFilter Driver from UASSOFT.COM.) -- C:\Windows\System32\Drivers\KMWDFILTER.sys [30208]
O58 - SDL:[MD5.15E399875C850B54FC253A2323AD8021] - 06/08/2010 - 00:43:20 ---A- . (.DiBcom SA - DiBcom AVSTREAM BDA driver.) -- C:\Windows\System32\Drivers\mod7700.sys [1001472]
O58 - SDL:[MD5.225D3660F926FE761BC8CE10C512AA02] - 18/06/2009 - 10:41:46 ---A- . (.PenTablet Driver - PenTablet Bus enumerator.) -- C:\Windows\System32\Drivers\PTSimBus.sys [27304]
O58 - SDL:[MD5.BD2194786ABAF4860F41118C0C103E7B] - 18/06/2009 - 10:41:58 ---A- . (.PenTablet Driver - PenTablet Hid MiniDriver for Win2000/XP/Vista.) -- C:\Windows\System32\Drivers\PTSimHid.sys [17064]
O58 - SDL:[MD5.9AB59CF736981ED1F83C6AB5FAA8BA5C] - 13/02/2011 - 21:42:23 ---A- . (.Duplex Secure Ltd. - SCSI Pass Through Direct Host.) -- C:\Windows\System32\Drivers\sptd.sys [868848]
O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
O58 - SDL:[MD5.530A7F0966493DD437E4342F12CCD63B] - 18/06/2009 - 10:42:16 ---A- . (.Tablet Driver - Tablet Class Driver for Win2000/XP/Vista.) -- C:\Windows\System32\Drivers\TClass2k.sys [27304]
O58 - SDL:[MD5.01662B4865FDB282677B11CF416757CE] - 18/06/2009 - 10:42:34 ---A- . (.Tablet Driver - Tablet HID Driver for Win2000/XP/Vista.) -- C:\Windows\System32\Drivers\UCTblHid.sys [22696]
O58 - SDL:[MD5.0E3E5D0486C4E2128B9F0E1C2FD410C4] - 15/12/2010 - 14:56:05 ---A- . (...) -- C:\Windows\SysWOW64\drivers\fsbts.sys [42664]
~ Drivers: 16 Legitimates Filtered in 00mn 00s



---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 13/01/2014 - 10:42:39 ---A- . (...) -- C:\Users\Agnès\AppData\Local\freeSOFTtoday\freeSOFTtoday\1.0\freeSOFTtoday.cyl [58] =>Adware.FreeSoftToday
O61 - LFC: 13/01/2014 - 10:42:42 ---A- . (...) -- C:\Users\Agnès\AppData\Local\Google\Toolbar Cache\7.5.4805.320\fr\translate_element.js.content [2385]
O61 - LFC: 13/01/2014 - 10:42:42 ---A- . (...) -- C:\Users\Agnès\AppData\Local\Google\Toolbar Cache\7.5.4805.320\fr\translate_languages.json.content [2033]
O61 - LFC: 13/01/2014 - 10:43:21 ---A- . (...) -- C:\Users\Agnès\AppData\Roaming\okitspace\IE\config [56] =>PUP.Onekit
O61 - LFC: 13/01/2014 - 10:43:21 ---A- . (...) -- C:\Users\Agnès\AppData\Roaming\okitspace\protect\PluginProtect.exe [90112] =>PUP.Onekit
O61 - LFC: 13/01/2014 - 10:43:21 ---A- . (...) -- C:\Users\Agnès\AppData\Roaming\okitspace\protect\files\version [7] =>PUP.Onekit
O61 - LFC: 13/01/2014 - 10:43:21 ---A- . (...) -- C:\Users\Agnès\AppData\Roaming\okitspace\protect\versionPPSrv [9] =>PUP.Onekit
O61 - LFC: 13/01/2014 - 10:43:23 ---A- . (...) -- C:\Users\Agnès\Downloads\AntivirusOrange_PC.exe [183995800]
O61 - LFC: 14/01/2014 - 10:42:40 ---A- . (...) -- C:\Users\Agnès\AppData\Local\fst_fr_48\fst_fr_48\1.10\eorezo.cyl [69] =>PUA.FSTfr9
O61 - LFC: 14/01/2014 - 10:43:14 ---A- . (...) -- C:\Users\Agnès\AppData\Roaming\BabSolution\Shared\chu.js [2] =>Hijacker.BabSolution
O61 - LFC: 14/01/2014 - 10:43:15 ---A- . (...) -- C:\Users\Agnès\AppData\Roaming\Google\Local Search History\google%2Eweb.w [0]
O61 - LFC: 15/01/2014 - 10:42:40 ---A- . (...) -- C:\Users\Agnès\AppData\Local\fst_fr_48\fst_fr_48\1.10\cnf.cyl [131] =>PUA.FSTfr9
O61 - LFC: 15/01/2014 - 10:42:40 ---A- . (...) -- C:\Users\Agnès\AppData\Local\fst_fr_48\upfst_fr_48.cyp [0] =>PUA.FSTfr9
O61 - LFC: 15/01/2014 - 10:42:42 ---A- . (...) -- C:\Users\Agnès\AppData\Local\Google\Toolbar\broker_metrics.xml [22572]
O61 - LFC: 15/01/2014 - 10:42:42 ---A- . (...) -- C:\Users\Agnès\AppData\Local\IM\content.xml [34273]
O61 - LFC: 15/01/2014 - 10:43:06 ---A- . (...) -- C:\Users\Agnès\AppData\Local\SearchProtect\SearchProtect\rep\UserRepository.dat [96350] =>Toolbar.Conduit
O61 - LFC: 15/01/2014 - 10:43:06 ---A- . (...) -- C:\Users\Agnès\AppData\Local\SearchProtect\SearchProtect\rep\UserSettings.dat [3538] =>Toolbar.Conduit
O61 - LFC: 15/01/2014 - 10:43:06 ---A- . (...) -- C:\Users\Agnès\AppData\Local\SearchProtect\UI\rep\UIRepository.dat [10142] =>Toolbar.Conduit
O61 - LFC: 15/01/2014 - 10:43:21 ---A- . (...) -- C:\Users\Agnès\AppData\Roaming\okitspace\Firefox\chrome\content\main.js [1398] =>PUP.Onekit
O61 - LFC: 15/01/2014 - 10:43:22 ---A- . (...) -- C:\Users\Agnès\AppData\Roaming\Yontoo\dat\Desktop.OS.Plugin.dll [13600] =>Adware.Yontoo
O61 - LFC: 15/01/2014 - 10:43:23 ---A- . (...) -- C:\Users\Agnès\AppData\Roaming\Yontoo\PlugIns.cache [28] =>Adware.Yontoo
O61 - LFC: 15/01/2014 - 10:43:23 ---A- . (...) -- C:\Users\Agnès\AppData\Roaming\ZHP\Log.txt [80132] =>.Nicolas Coolman
O61 - LFC: 15/01/2014 - 10:43:23 ---A- . (...) -- C:\Users\Agnès\AppData\Roaming\ZHP\TestsZHPDiag.txt [2878] =>.Nicolas Coolman
O61 - LFC: 15/01/2014 - 10:43:23 ---A- . (...) -- C:\Users\Agnès\AppData\Roaming\ZHP\ZHPDiag.txt [196931] =>.Nicolas Coolman
O61 - LFC: 15/01/2014 - 10:43:23 ---A- . (...) -- C:\Users\Agnès\AppData\Roaming\ZHP\ZHPDiag1.txt [196931] =>.Nicolas Coolman
O61 - LFC: 15/01/2014 - 10:43:23 -SHA- . (...) -- C:\Users\Agnès\Documents\Thumbs.db [5410816]
~ 173 Fichiers temporaires (Temporary files)
~ Files: 329 Legitimates Filtered in 00mn 59s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: C:\Users\Agnès\AppData\Roaming\Mozilla\Firefox\Profiles\z08gac8g.default-1352887436018\searchplugins\askcom.xml
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("avg.install.userHPSettings", "http://search.babylon.com/?affID=113357&tt=201112_ccp_ctrl_4812_4&babsrc=HP_ss&mntrId=b8b[...] =>PUP.Babylon
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("avg.install.userSPSettings", "Search the web (Babylon)"); =>Adware.IMBooster
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.BabylonToolbar.admin", false); =>PUP.Babylon
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.BabylonToolbar.aflt", "babsst"); =>PUP.Babylon
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}"); =>PUP.Babylon
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.BabylonToolbar.dfltLng", "en"); =>PUP.Babylon
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.BabylonToolbar.excTlbr", false); =>PUP.Babylon
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.BabylonToolbar.id", "b8b0f406000000000000b8ac6f9d277e"); =>PUP.Babylon
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.BabylonToolbar.instlDay", "15670"); =>PUP.Babylon
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.BabylonToolbar.instlRef", "sst"); =>PUP.Babylon
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar"); =>PUP.Babylon
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.BabylonToolbar.prtnrId", "babylon"); =>PUP.Babylon
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.BabylonToolbar.tlbrId", "irhnew"); =>PUP.Babylon
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "http://search.babylon.com/?babsrc=TB_def&mntrId=b8b0f406000000000000b8ac6f9d27[...] =>PUP.Babylon
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.BabylonToolbar.vrsn", "1.8.3.8"); =>PUP.Babylon
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.BabylonToolbar.vrsni", "1.8.3.8"); =>PUP.Babylon
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.BabylonToolbar_i.newTab", true); =>PUP.Babylon
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.BabylonToolbar_i.newTabUrl", "http://search.babylon.com/?affID=113357&tt=201112_ccp_ctrl_4812_4&babsrc=NT_ss[...] =>PUP.Babylon
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.BabylonToolbar_i.smplGrp", "none"); =>PUP.Babylon
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.3.820:31:06"); =>PUP.Babylon
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.asktb.abar-war-regex", "conduit\\.com");
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.asktb.autofill-competitor-query-enabled", true);
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.asktb.cbid", "^U3");
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.asktb.config-updated", false);
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.asktb.crumb", "2013.03.13+06.30.51-toolbar018iad-FR-UG9pdGllcnMsRnJhbmNl");
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.asktb.default-channel-url-mask", "https://fr.ask.com/{query}&qsrc={qsrc}&o={o}&l={l}&gct=bar");
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.asktb.displaybehavior", "");
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.asktb.displaytext", "");
O69 - SBI: prefs.js [Agnès - z08gac8g.default-1352887436018] user_pref("extensions.asktb.dti

Re

je ne vois aucun lien qui mène à ce rapport !!!

https://pjjoint.malekal.com/files.php?id=ZHPDiag_20140115_s5p10c10f6n5

https://pjjoint.malekal.com/files.php?id=20140117_r15k15g6f5g7

Malwaresbytes

Bonjour,

Tu n'as pas répondu à mon dernier envoi.
Est-ce que le rapport est bon ?
Est-ce que tu pourrais me conseiller un logiciel qui pourrai scanner, nettoyer et réparer que je pourrais utiliser de temps en temps.
De plus, depuis mon problème, je ne peux plus aller sur les sites où j'ai un compte. En effet, pas de problème pour entrer mon identifiant, mais il m'est impossible d'entrer mon mot de passe ???
Merci de ton aide,

@ +

Je suis obligée de me connecter avec ma tablette car je ne peux plus utiliser ccm. En effet pas de problème pour l'identifiant mais impossible de rentrer mon MP ????