Un spécialiste derais le bien venu
Résolu/Fermé
Bryan444
Messages postés
19
Date d'inscription
samedi 23 août 2014
Statut
Membre
Dernière intervention
24 novembre 2014
-
28 août 2014 à 22:22
Utilisateur anonyme - 29 août 2014 à 07:17
Utilisateur anonyme - 29 août 2014 à 07:17
A voir également:
- Un spécialiste derais le bien venu
- Nos systèmes ont détecté un trafic exceptionnel sur votre réseau informatique. cette page permet de vérifier que c'est bien vous qui envoyez des requêtes, et non un robot ✓ - Forum Virus
- 72 mbits s c'est bien ✓ - Forum WiFi
- Message le bon coin votre bien est toujours disponible - Forum Réseaux sociaux
- Roulement en 12h qui fonctionne bien - Télécharger - Outils professionnels
- Tapez cette phrase, en respectant bien les espaces et la ponctuation. - Guide
5 réponses
Fermiparadox
Messages postés
11215
Date d'inscription
samedi 26 avril 2014
Statut
Membre
Dernière intervention
28 août 2016
2 911
28 août 2014 à 22:25
28 août 2014 à 22:25
Bonjour,
Rien compris.
Commence par le commencement..........
Rien compris.
Commence par le commencement..........
Utilisateur anonyme
28 août 2014 à 22:26
28 août 2014 à 22:26
Bonsoir
Pour de plus amples informations, fait ceci stp
Ouvre ce lien et télécharge ZHPDiag de Nicolas Coolman :
https://nicolascoolman.eu
Ou
https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/
Une fois le téléchargement achevé,
Double-clique sur l'icône pour lancer le programme. Sous Vista ; Seven ou Windows 8 clic droit « exécuter en tant que administrateur »
Dans la fenêtre ZHPDiag qui vient de s'ouvrir, clique sur "Configurer"
Clique sur la loupe en bas à gauche avec le signe plus pour lancer l'analyse.
Laisse l'outil travailler, il peut être assez long.
Un rapport s'ouvre. Ce rapport se trouve également sur ton bureau
Pour transmettre le rapport clique sur ce lien:
http://pjjoint.malekal.com/
Si problème utilise un des suivants
https://forums-fec.be/upload
https://www.cjoint.com/
Regarde sur le bureau
Sélectionne le fichier ZHPDiag.txt.
Clique sur "Cliquez ici pour déposer le fichier".
Un lien de cette forme :
http://www.cijoint.com/cjlink.php?file=cj200905/cijSKAP5fU.txt
est ajouté dans la page.
Copie ce lien dans ta réponse.
Merci
@+
Pour de plus amples informations, fait ceci stp
Ouvre ce lien et télécharge ZHPDiag de Nicolas Coolman :
https://nicolascoolman.eu
Ou
https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/
Une fois le téléchargement achevé,
Double-clique sur l'icône pour lancer le programme. Sous Vista ; Seven ou Windows 8 clic droit « exécuter en tant que administrateur »
Dans la fenêtre ZHPDiag qui vient de s'ouvrir, clique sur "Configurer"
Clique sur la loupe en bas à gauche avec le signe plus pour lancer l'analyse.
Laisse l'outil travailler, il peut être assez long.
Un rapport s'ouvre. Ce rapport se trouve également sur ton bureau
Pour transmettre le rapport clique sur ce lien:
http://pjjoint.malekal.com/
Si problème utilise un des suivants
https://forums-fec.be/upload
https://www.cjoint.com/
Regarde sur le bureau
Sélectionne le fichier ZHPDiag.txt.
Clique sur "Cliquez ici pour déposer le fichier".
Un lien de cette forme :
http://www.cijoint.com/cjlink.php?file=cj200905/cijSKAP5fU.txt
est ajouté dans la page.
Copie ce lien dans ta réponse.
Merci
@+
Bryan444
Messages postés
19
Date d'inscription
samedi 23 août 2014
Statut
Membre
Dernière intervention
24 novembre 2014
29 août 2014 à 01:15
29 août 2014 à 01:15
Merci Guillaume t,envie le message:~ Rapport de ZHPDiag v2014.8.28.125 - Nicolas Coolman (2014-08-28)
~ Lancé par PC (2014-08-28 18:47:12)
~ Adresse du Site Web https://nicolascoolman.eu
~ Adresse du Forum https://nicolascoolman.eu
~ Traduit par Nicolas Coolman
~ Etat de la version : Version à jour.
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user
---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.17239
MFIE: Mozilla Firefox 31.0
GCIE: Google Chrome v36.0.1985.143 (Defaut)
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows Operating System - Windows(R) 7, OEM_COA_SLP channel
Windows ID Activation : OK
~ Windows Partial Key : JDTHV
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ Logiciels de protection du système
Malwarebytes Anti-Malware version 2.0.2.1012
Microsoft Security Client v4.5.0216.0
Spybot - Search & Destroy v2.4.40
Windows Defender W7 (Deactivate)
---\\ Logiciels d'optimisation du système
CCleaner v4.17
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 14 Plugin
Adobe Reader XI
Java 7 Update 60 (64-bit)
---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 55 Stepping 3, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3797 MB (36% free)
System Restore: Activé (Enable)
System drive C: has 425 GB (91%) free of 466 GB
---\\ Mode de connexion au système
~ Computer Name: PC-PC
~ User Name: PC
~ All Users Names: PC, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\PC\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\PC\AppData\Roaming\
~ %Desktop% : C:\Users\PC\Desktop\
~ %Favorites% : C:\Users\PC\Favorites\
~ %LocalAppData% : C:\Users\PC\AppData\Local\
~ %StartMenu% : C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 425 Go of 466 Go)
D: CD-ROM drive (Not Inserted)
---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 41 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.2011-02-25 - 01:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.2009-07-13 - 20:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.8E71A5CB5312B8392D4DA4CA37BB5868] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.2014-07-25 - 05:52:06.) -- C:\Windows\System32\wininet.dll [2266624]
[MD5.88AB9B72B4BF3963A0DE0820B4B0B06C] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.2014-03-04 - 04:43:50.) -- C:\Windows\System32\Winlogon.exe [455168]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.2010-11-20 - 22:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.FA886682CFC5D36718D3E436AACF10B9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.2014-05-30 - 01:45:52.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.2009-07-13 - 20:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.2009-07-13 - 18:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.2010-11-20 - 22:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.2010-11-20 - 22:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.2010-11-20 - 22:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.2009-07-13 - 18:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.2009-07-13 - 19:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.2011-04-26 - 21:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.2010-11-20 - 22:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.2014-01-23 - 21:37:55.) -- C:\Windows\system32\Drivers\ntfs.sys [1684928]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.2009-07-13 - 19:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.2010-11-20 - 22:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.2009-07-13 - 19:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.2010-11-20 - 22:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.2010-11-20 - 22:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 04s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/32
~ Mes musiques (My Musics) : 1/7
~ Mes Favoris (My Favorites) : 1/154
~ Mes Documents (My Documents) : 1/9
~ Mon Bureau (My Desktop) : 1/22
~ Menu demarrer (Programs) : 1/39
~ Hidden Files: Scanned in 00mn 00s
---\\ Processus lancés
[MD5.4FBC630768570E6AC35C3DE8F6EC79F5] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe [6970168] [PID.2208]
[MD5.5D61BE7DB55B026A5D61A3EED09D0EAD] - (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408] [PID.2536]
[MD5.BD2C0CDD525902E3033DAA8D08D0F015] - (.Intel Corporation - iusb3mon.) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848] [PID.2696]
[MD5.7EE68A122ED08E4AAD8DA551E34D2515] - (.Safer-Networking Ltd. - Spybot - Search & Destroy tray access.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576] [PID.2704]
[MD5.8A86F41B857DA166033B1795FE69BF37] - (.Almico Software (www.almico.com) - Pas de description.) -- C:\Program Files (x86)\SpeedFan\speedfan.exe [4683768] [PID.2844]
[MD5.3FAFBCCE3F066EDCC263E25A786FFD50] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe [21650016] [PID.3224]
[MD5.CDF01A5C7927786A708EAEE91F14797B] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\IEXPLORE.exe [812224] [PID.6376]
[MD5.E8B7FD67DA14A7BE57A5CB80E3139E60] - (.Google Inc. - Google Toolbar Broker.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe [309704] [PID.1648]
[MD5.33BF80A2291C54DC7D7601CDEF63138E] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8099328] [PID.4352]
[MD5.B362181ED3771DC03B4141927C80F801] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65432] [PID.1480]
[MD5.6B73E94F9FE82D45781B8C8A09483082] - (.Apple Inc. - YSLoader.exe.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [43336] [PID.1524]
[MD5.1F79342D9EB530A48742F651E570983A] - (.Microsoft Corporation - Updates Skype Click to Call.) -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176] [PID.1588]
[MD5.E4938E0A376CF0B9D989EE5C0A146891] - (.Microsoft Corporation - Phone Number Recognition (PNR) module.) -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520] [PID.1624]
[MD5.D84AEA3F3329D622DFC1297DDDF6163B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720] [PID.1776]
[MD5.4F45ED469906494F9BF754E476390DBD] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472] [PID.2092]
[MD5.397D14958D6C9C2B365469A857B2AC4E] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe [230792] [PID.2252]
[MD5.D777F1417D9BB9F66CD9D9C3B61F730F] - (.Safer-Networking Ltd. - Spybot-S&D 2 Scanner Service.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168] [PID.2248]
[MD5.68D6C7F99BC73B88954D844FCCBEB2A0] - (.Safer-Networking Ltd. - Spybot-S&D 2 Background update service.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408] [PID.572]
[MD5.9B9B368A8FF5CAF91D7A333CF62CD2CC] - (.Safer-Networking Ltd. - Windows Security Center integration..) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928] [PID.3236]
[MD5.9CCE733E5262FB92C2331E8578512B49] - (.Safer-Networking Ltd. - Update.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [4747720] [PID.6672]
~ Processes Running: Scanned in 00mn 10s
---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Preferences
G0 - GCSP: Preference [User Data\Default][HomePage] http://search.conduit.com
G2 - GCE: Preference [User Data\Default] [apdfllckaahabafndbhieahigkjlhalf] Google Drive v.6.3 (Activé)
G2 - GCE: Preference [User Data\Default] [dbaidnecjbnadknkpdlhicbamnjlccfg] The interpreter v.1.3 (Activé)
G2 - GCE: Preference [User Data\Default] [gjgkjeheegjnnmheaflhdocglkiegoni] Un périple à travers la Terre du Milieu v.0.0.1.3 (Désactivé)
G2 - GCE: Preference [User Data\Default] [kmendfapggjehodndflmmgagdbamhnfd] CryptoTokenExtension v.0.0.1 (Activé)
G2 - GCE: Preference [User Data\Default] [lopaplcmfjlfdkmaadlchgbgenjkfboe] Traduction Anglais Français v.2.8.8 (Activé)
G2 - GCE: Preference [User Data\Default] [mfffpogegjflfpflabcdkioaeobkgjik] GaiaAuthExtension v.0.0.1, (Activé)
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Wallet v.0.0.6.1 (Activé)
G2 - GCE: Preference [User Data\Default] [nppllibpnmahfaklnpggkibhkapjkeob] Norton Security Toolbar v.2014.7.6.17, (Désactivé)
G2 - GCE: Preference [User Data\Default] [pafkbggdmjlpgkdkcbjmhmfcdpncadgh] Google Now v.1.2.0.1 (Activé)
---\\ Liste des dossiers d'extension Google Chrome
~ Google Lines Browser: 25 Legitimates Filtered in 00mn 30s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\w7k7zyrl.default\prefs.js
M2 - MFEP: prefs.js [PC - w7k7zyrl.default\{18d5a8fe-5428-485b-968f-b97b05a92b54}] [] Astromenda Search Addon v1.2 (..) =>PUP.Astromenda
M2 - MFEP: Extension [PC - w7k7zyrl.default] {b9bfaf1c-a63f-47cd-8b9a-29526ced9060}
~ Firefox Browser: 9 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local>;*.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (15516)
~ Hosts File: Scanned in 00mn 19s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
O3 - Toolbar: Norton Identity Safe Toolbar - [HKLM]{A13C2648-91D4-4bf3-BC6D-0079707C4389} . (...) -- C:\Program Files (x86)\Norton Identity Safe\Engine64\2014.7.3.12\coIEPlg.dll
O3 - Toolbar: Norton Toolbar - [HKLM]{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} . (...) -- C:\Program Files (x86)\Norton 360\Norton 360\Engine64\21.5.0.19\coIEPlg.dll
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Applications lancées au démarrage du système (O4)
O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =>.Realtek Semiconductor Corp
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKCU\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKLM\..\Wow6432Node\Run: [USB3MON] . (.Intel Corporation - iusb3mon.) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
O4 - HKLM\..\Wow6432Node\Run: [LWS] . (.Logitech Inc. - Logitech Webcam Software.) -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe =>.Logitech Inc
O4 - HKLM\..\Wow6432Node\Run: [SDTray] . (.Safer-Networking Ltd. - Spybot - Search & Destroy tray access.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2731293000-1977296109-539070842-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2731293000-1977296109-539070842-1000\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
~ Application: Scanned in 00mn 00s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Skype Click to Call settings [64Bits] - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- c:\program files (x86)\skype\toolbars\internet explorer x64\icon.ico
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpDomain = gateway.2wire.net
O17 - HKLM\System\CS1\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpDomain = gateway.2wire.net
O17 - HKLM\System\CS2\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpDomain = gateway.2wire.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (...) -- igfxdev.dll
O20 - Winlogon Notify: LBTWlgn . (.Logitech, Inc. - Logitech Bluetooth Service.) -- c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
~ Winlogon: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) . (.Safer-Networking Ltd. - Windows Security Center integration..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: AVG PC TuneUp Service (TuneUp.UtilitiesSvc) . (...) - C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe (.not file.)
~ Services: 14 Legitimates Filtered in 00mn 12s
---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [ATuning] (...) -- C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\ATuning.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [FileCure Default] (...) -- C:\Program Files (x86)\ParetoLogic\FileCure\FileCure.exe (.not file.) [0] =>PUP.Paretologic
[MD5.00000000000000000000000000000000] [APT] [ParetoLogic Update Version3 Startup Task] (...) -- C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe (.not file.) [0] =>PUP.Paretologic
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{2280F8F6-F4AB-4EEA-886E-E5F1BCE4A98F}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{24151242-5DAA-47E3-9691-367423F38358}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{27C60DA1-3532-4BB8-9519-622B1C3BFCC1}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{2A19A388-63F6-48E8-B7C1-B7F4E7D1CCEB}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{2FEF56E1-7CD4-43D3-8EB1-00384E7E3E6E}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{365CDB04-8701-4DDE-BD1F-62BBE348C3AE}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{393FB9E6-599D-4C73-858D-9B33D64525C5}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{4DECC12F-B3D2-4856-8C17-1F37FFA57FD2}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{50C78FF8-EBC6-48CC-947D-BBD3E65FC414}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{655D0907-B053-43BF-B545-DA9506176264}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{673BC69E-71E0-4C7F-9AC1-BE7446B322C6}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{6793B200-BEA1-4AAB-8E26-9B7094A13591}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{6BF9B303-983B-4CB0-9150-18EC002500B7}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{73DF704B-8850-470B-888D-0D9CB12C4CB2}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{7826EFCE-FBAF-4E6D-A90A-8D918D39AFF8}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{7F44EC4F-A4C1-4BEA-A7DE-6FA2D1FEB2C1}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{80FFBF07-9D9E-4B5F-9048-47952C14F11D}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{81C1086E-99FC-4C46-B778-6AA0CA8F156E}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{87331739-BFEC-474E-B1C7-2D249CD297BC}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{87AE38CA-21F6-4565-9BB6-D63B579FD0DE}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{8A292A91-56CC-44EB-90F4-7B7B782A8A48}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{A8E00CF6-A262-4B24-A600-344E78A1E2F8}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{B531D692-868D-408E-B31E-CEBBAAAB5206}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{B88C1787-017E-44F6-813F-23D33F098241}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{BECEF950-C315-4ACD-A13F-403D8DDD0C88}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{C05066AA-D729-43F8-8E16-D168FAEFBFE2}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{C707E465-B84E-4499-842D-C5C38ABB7E69}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{CB0B3977-1276-42E3-907D-D4DC20C8EB69}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{CE870E20-DA1A-4416-83D0-0035011597B3}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{D13FF831-1163-4D50-8A66-4EC99C908BA6}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{D6987A79-AE35-439A-B928-FE2C1793632F}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{DEDA031B-01FA-4C24-AADE-EB4CB84B498D}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{E5939AB6-1D1F-44B6-8F0A-C95356320B78}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{E6A05030-8D95-4546-985C-2B2AAC36A609}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{EB3CB80E-6CDF-4D3E-9AE5-FD8ED7E56BE6}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{F217AEC5-6C66-4398-AA69-5951DA5D23D0}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater [1002]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore [1056]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA [1060]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\HP Photo Creations Communicator [318]
~ Scheduled Task: 65 Legitimates Filtered in 01mn 02s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\DriverRestore]
[HKCU\Software\DriverWhiz]
~ Key Software: 256 Legitimates Filtered in 00mn 00s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 2014-08-10 - 17:10:34 - [] ----D C:\Program Files (x86)\APO Usb Autorun
O43 - CFD: 2014-07-03 - 03:35:30 - [0] ----D C:\Program Files (x86)\GUM531E.tmp
O43 - CFD: 2014-08-19 - 23:49:20 - [0] -SH-D C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
O43 - CFD: 2014-08-19 - 23:49:20 - [0] -SH-D C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
~ 1 Dossier CLSID vide (CLSID Empty Folder)
~ Program Folder: 203 Legitimates Filtered in 00mn 02s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.62507E599AE37E91C1BEED8DE35E5236] - 2014-08-18 - 12:26:05 ---A- . (.AVG - AVG WinLogon Extension.) -- C:\Windows\System32\authuitu.dll [29496]
O44 - LFC:[MD5.40D653A452721F45F5FDCDF7C6A67569] - 2014-08-18 - 12:26:06 ---A- . (.AVG - AVG Registry Optimization Boot Application.) -- C:\Windows\System32\TURegOpt.exe [40248]
O44 - LFC:[MD5.0A34066D56D57C0DA73BFFC1E4169FF2] - 2014-08-25 - 12:58:42 ---A- . (...) -- C:\Windows\wininit.ini [85]
~ Files: 29 Legitimates Filtered in 00mn 14s
---\\ Contrôle du Safe Boot (CSB) (O49)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\CleanHlp.sys . (...) -- C:\Windows\System32\Drivers\CleanHlp.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\CleanHlp.sys . (...) -- C:\Windows\System32\Drivers\CleanHlp.sys (.not file.)
~ CSB: 15 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:2013-03-05 - 11:24:26 ----- . (...) -- C:\Windows\System32\Drivers\AQFileRestore.sys [21584]
O58 - SDL:2009-07-13 - 20:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:2009-06-10 - 15:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:2014-05-13 - 08:21:18 ---A- . (.Visicom Media Inc. - ManyCam Virtual Microphone.) -- C:\Windows\System32\Drivers\mcaudrv_x64.sys [35440]
O58 - SDL:2014-07-28 - 09:06:24 ---A- . (.Visicom Media Inc. - ManyCam Virtual Webcam Driver.) -- C:\Windows\System32\Drivers\mcvidrv.sys [49264]
O58 - SDL:2009-07-13 - 20:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
~ Drivers: 72 Legitimates Filtered in 00mn 14s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} [DefaultScope] - (Google) - https://www.google.com/?gws_rd=ssl
O69 - SBI: SearchScopes [HKCU] {C456BAF5-3C8B-49E9-B2B3-987BC16FC062} - ((www.google.com) Google) - https://www.google.com/?gws_rd=ssl
~ Keys: Scanned in 00mn 00s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.E920E867854B6B4DBD3485DB6F936F80] [SPRF][2014-08-15] (...) -- C:\ProgramData\ntuser.dat [262144]
~ Files: 1 Legitimates Filtered in 00mn 00s
---\\ Recherche de clés de registre Tracing (O100)
HKLM\SOFTWARE\Microsoft\Tracing\BackupStack_RASAPI32 =>PUP.MyPCBackup
HKLM\SOFTWARE\Microsoft\Tracing\BackupStack_RASMANCS =>PUP.MyPCBackup
HKLM\SOFTWARE\Microsoft\Tracing\Signup Wizard_RASAPI32 =>PUP.JDIBackup
HKLM\SOFTWARE\Microsoft\Tracing\Signup Wizard_RASMANCS =>PUP.JDIBackup
~ BTK: 126 Legitimates Filtered in 00mn 00s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 2014-08-26 262320 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 2014-06-13 279000 | (cphs) . (.Intel Corporation.) - C:\Windows\SysWow64\IntelCpHeciSvc.exe
SS - | Auto 2014-07-03 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 2014-07-03 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 2014-08-07 194032 | (gusvc) . (.Google.) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Demand 2012-04-24 169752 | (ICCS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
SS - | Demand 2013-07-01 822232 | (Intel(R) Capability Licensing Service TCP IP Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe
SS - | Demand 2014-08-01 641352 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SS - | Demand 2014-03-24 357144 | (LBTServ) . (.Logitech, Inc..) - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
SS - | Demand 2014-08-10 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Auto 2014-04-03 315008 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Auto 1658-07-10 0 | (TuneUp.UtilitiesSvc) . (...) - C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
SS - | Demand 2009-07-13 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 2014-05-08 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 2014-06-12 43336 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 2011-08-30 462184 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Auto 2014-06-13 315352 | (igfxCUIService1.0.0.0) . (.Intel Corporation.) - C:\Windows\System32\igfxCUIService.exe
SR - | Auto 2013-07-01 733696 | (Intel(R) Capability Licensing Service Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
SR - | Auto 2014-06-24 2820424 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe
SR - | Auto 2014-05-12 1809720 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
SR - | Auto 2014-05-12 860472 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
SR - | Auto 2014-03-11 23808 | (MsMpSvc) . (.Microsoft Corporation.) - c:\Program Files\Microsoft Security Client\MsMpEng.exe
SR - | Auto 2014-06-26 130104 | (NCO) . (.Symantec Corporation.) - C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.3.12\NST.exe
SR - | Auto 2014-06-24 1738168 | (SDScannerService) . (.Safer-Networking Ltd..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
SR - | Auto 2014-06-27 2088408 | (SDUpdateService) . (.Safer-Networking Ltd..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
SR - | Auto 2014-04-25 171928 | (SDWSCService) . (.Safer-Networking Ltd..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
SR - | Demand 1658-07-10 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 2009-07-13 27136 | C:\Windows\system32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 21s
---\\ Scan Additionnel (O88)
Database Version : 13026 - (2014-08-28)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 1
Fichiers trouvés (Files found) : 0
C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\w7k7zyrl.default\extensions\{18d5a8fe-5428-485b-968f-b97b05a92b54} =>PUP.Astromenda^
~ Additionnel Scan: 289152 Items scanned in 00mn 48s
---\\ Informations complémentaires sur les modules
~ https://nicolascoolman.eu =>.Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
~ https://nicolascoolman.eu =>.Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
~ https://nicolascoolman.eu =>.Internet Explorer, Proxy Management (R5)
~ https://nicolascoolman.eu =>.Internet Explorer Toolbars (O3)
~ https://nicolascoolman.eu =>.Applications lancées au démarrage du système (O4)
~ AMI: 5 Legitimates Filtered in 00mn 00s
---\\ Récapitulatif des détections trouvées sur votre station
https://nicolascoolman.eu =>PUP.Astromenda
http://nicolascoolman.fr/30068076-pup-paretologic =>PUP.Paretologic
https://nicolascoolman.eu =>PUP.MyPCBackup
~ MSI: 3 link(s) detected in 00mn 00s
~ 860 Legitimates filtered by white list
End of the scan (475 lines in 05mn 14s)(0)~ Rapport de ZHPDiag v2014.8.28.125 - Nicolas Coolman (2014-08-28)
~ Lancé par PC (2014-08-28 18:47:12)
~ Adresse du Site Web https://nicolascoolman.eu
~ Adresse du Forum https://nicolascoolman.eu
~ Traduit par Nicolas Coolman
~ Etat de la version : Version à jour.
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user
---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.17239
MFIE: Mozilla Firefox 31.0
GCIE: Google Chrome v36.0.1985.143 (Defaut)
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows Operating System - Windows(R) 7, OEM_COA_SLP channel
Windows ID Activation : OK
~ Windows Partial Key : JDTHV
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ Logiciels de protection du système
Malwarebytes Anti-Malware version 2.0.2.1012
Microsoft Security Client v4.5.0216.0
Spybot - Search & Destroy v2.4.40
Windows Defender W7 (Deactivate)
---\\ Logiciels d'optimisation du système
CCleaner v4.17
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 14 Plugin
Adobe Reader XI
Java 7 Update 60 (64-bit)
---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 55 Stepping 3, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3797 MB (36% free)
System Restore: Activé (Enable)
System drive C: has 425 GB (91%) free of 466 GB
---\\ Mode de connexion au système
~ Computer Name: PC-PC
~ User Name: PC
~ All Users Names: PC, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\PC\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\PC\AppData\Roaming\
~ %Desktop% : C:\Users\PC\Desktop\
~ %Favorites% : C:\Users\PC\Favorites\
~ %LocalAppData% : C:\Users\PC\AppData\Local\
~ %StartMenu% : C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 425 Go of 466 Go)
D: CD-ROM drive (Not Inserted)
---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 41 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.2011-02-25 - 01:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.2009-07-13 - 20:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.8E71A5CB5312B8392D4DA4CA37BB5868] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.2014-07-25 - 05:52:06.) -- C:\Windows\System32\wininet.dll [2266624]
[MD5.88AB9B72B4BF3963A0DE0820B4B0B06C] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.2014-03-04 - 04:43:50.) -- C:\Windows\System32\Winlogon.exe [455168]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.2010-11-20 - 22:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.FA886682CFC5D36718D3E436AACF10B9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.2014-05-30 - 01:45:52.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.2009-07-13 - 20:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.2009-07-13 - 18:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.2010-11-20 - 22:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.2010-11-20 - 22:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.2010-11-20 - 22:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.2009-07-13 - 18:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.2009-07-13 - 19:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.2011-04-26 - 21:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.2010-11-20 - 22:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.2014-01-23 - 21:37:55.) -- C:\Windows\system32\Drivers\ntfs.sys [1684928]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.2009-07-13 - 19:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.2010-11-20 - 22:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.2009-07-13 - 19:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.2010-11-20 - 22:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.2010-11-20 - 22:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 04s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/32
~ Mes musiques (My Musics) : 1/7
~ Mes Favoris (My Favorites) : 1/154
~ Mes Documents (My Documents) : 1/9
~ Mon Bureau (My Desktop) : 1/22
~ Menu demarrer (Programs) : 1/39
~ Hidden Files: Scanned in 00mn 00s
---\\ Processus lancés
[MD5.4FBC630768570E6AC35C3DE8F6EC79F5] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe [6970168] [PID.2208]
[MD5.5D61BE7DB55B026A5D61A3EED09D0EAD] - (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408] [PID.2536]
[MD5.BD2C0CDD525902E3033DAA8D08D0F015] - (.Intel Corporation - iusb3mon.) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848] [PID.2696]
[MD5.7EE68A122ED08E4AAD8DA551E34D2515] - (.Safer-Networking Ltd. - Spybot - Search & Destroy tray access.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576] [PID.2704]
[MD5.8A86F41B857DA166033B1795FE69BF37] - (.Almico Software (www.almico.com) - Pas de description.) -- C:\Program Files (x86)\SpeedFan\speedfan.exe [4683768] [PID.2844]
[MD5.3FAFBCCE3F066EDCC263E25A786FFD50] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe [21650016] [PID.3224]
[MD5.CDF01A5C7927786A708EAEE91F14797B] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\IEXPLORE.exe [812224] [PID.6376]
[MD5.E8B7FD67DA14A7BE57A5CB80E3139E60] - (.Google Inc. - Google Toolbar Broker.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe [309704] [PID.1648]
[MD5.33BF80A2291C54DC7D7601CDEF63138E] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8099328] [PID.4352]
[MD5.B362181ED3771DC03B4141927C80F801] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65432] [PID.1480]
[MD5.6B73E94F9FE82D45781B8C8A09483082] - (.Apple Inc. - YSLoader.exe.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [43336] [PID.1524]
[MD5.1F79342D9EB530A48742F651E570983A] - (.Microsoft Corporation - Updates Skype Click to Call.) -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176] [PID.1588]
[MD5.E4938E0A376CF0B9D989EE5C0A146891] - (.Microsoft Corporation - Phone Number Recognition (PNR) module.) -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520] [PID.1624]
[MD5.D84AEA3F3329D622DFC1297DDDF6163B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720] [PID.1776]
[MD5.4F45ED469906494F9BF754E476390DBD] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472] [PID.2092]
[MD5.397D14958D6C9C2B365469A857B2AC4E] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe [230792] [PID.2252]
[MD5.D777F1417D9BB9F66CD9D9C3B61F730F] - (.Safer-Networking Ltd. - Spybot-S&D 2 Scanner Service.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168] [PID.2248]
[MD5.68D6C7F99BC73B88954D844FCCBEB2A0] - (.Safer-Networking Ltd. - Spybot-S&D 2 Background update service.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408] [PID.572]
[MD5.9B9B368A8FF5CAF91D7A333CF62CD2CC] - (.Safer-Networking Ltd. - Windows Security Center integration..) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928] [PID.3236]
[MD5.9CCE733E5262FB92C2331E8578512B49] - (.Safer-Networking Ltd. - Update.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [4747720] [PID.6672]
~ Processes Running: Scanned in 00mn 10s
---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Preferences
G0 - GCSP: Preference [User Data\Default][HomePage] http://search.conduit.com
G2 - GCE: Preference [User Data\Default] [apdfllckaahabafndbhieahigkjlhalf] Google Drive v.6.3 (Activé)
G2 - GCE: Preference [User Data\Default] [dbaidnecjbnadknkpdlhicbamnjlccfg] The interpreter v.1.3 (Activé)
G2 - GCE: Preference [User Data\Default] [gjgkjeheegjnnmheaflhdocglkiegoni] Un périple à travers la Terre du Milieu v.0.0.1.3 (Désactivé)
G2 - GCE: Preference [User Data\Default] [kmendfapggjehodndflmmgagdbamhnfd] CryptoTokenExtension v.0.0.1 (Activé)
G2 - GCE: Preference [User Data\Default] [lopaplcmfjlfdkmaadlchgbgenjkfboe] Traduction Anglais Français v.2.8.8 (Activé)
G2 - GCE: Preference [User Data\Default] [mfffpogegjflfpflabcdkioaeobkgjik] GaiaAuthExtension v.0.0.1, (Activé)
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Wallet v.0.0.6.1 (Activé)
G2 - GCE: Preference [User Data\Default] [nppllibpnmahfaklnpggkibhkapjkeob] Norton Security Toolbar v.2014.7.6.17, (Désactivé)
G2 - GCE: Preference [User Data\Default] [pafkbggdmjlpgkdkcbjmhmfcdpncadgh] Google Now v.1.2.0.1 (Activé)
---\\ Liste des dossiers d'extension Google Chrome
~ Google Lines Browser: 25 Legitimates Filtered in 00mn 30s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\w7k7zyrl.default\prefs.js
M2 - MFEP: prefs.js [PC - w7k7zyrl.default\{18d5a8fe-5428-485b-968f-b97b05a92b54}] [] Astromenda Search Addon v1.2 (..) =>PUP.Astromenda
M2 - MFEP: Extension [PC - w7k7zyrl.default] {b9bfaf1c-a63f-47cd-8b9a-29526ced9060}
~ Firefox Browser: 9 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local>;*.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (15516)
~ Hosts File: Scanned in 00mn 19s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
O3 - Toolbar: Norton Identity Safe Toolbar - [HKLM]{A13C2648-91D4-4bf3-BC6D-0079707C4389} . (...) -- C:\Program Files (x86)\Norton Identity Safe\Engine64\2014.7.3.12\coIEPlg.dll
O3 - Toolbar: Norton Toolbar - [HKLM]{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} . (...) -- C:\Program Files (x86)\Norton 360\Norton 360\Engine64\21.5.0.19\coIEPlg.dll
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Applications lancées au démarrage du système (O4)
O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =>.Realtek Semiconductor Corp
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKCU\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKLM\..\Wow6432Node\Run: [USB3MON] . (.Intel Corporation - iusb3mon.) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
O4 - HKLM\..\Wow6432Node\Run: [LWS] . (.Logitech Inc. - Logitech Webcam Software.) -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe =>.Logitech Inc
O4 - HKLM\..\Wow6432Node\Run: [SDTray] . (.Safer-Networking Ltd. - Spybot - Search & Destroy tray access.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2731293000-1977296109-539070842-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2731293000-1977296109-539070842-1000\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
~ Application: Scanned in 00mn 00s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Skype Click to Call settings [64Bits] - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- c:\program files (x86)\skype\toolbars\internet explorer x64\icon.ico
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpDomain = gateway.2wire.net
O17 - HKLM\System\CS1\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpDomain = gateway.2wire.net
O17 - HKLM\System\CS2\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpDomain = gateway.2wire.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (...) -- igfxdev.dll
O20 - Winlogon Notify: LBTWlgn . (.Logitech, Inc. - Logitech Bluetooth Service.) -- c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
~ Winlogon: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) . (.Safer-Networking Ltd. - Windows Security Center integration..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: AVG PC TuneUp Service (TuneUp.UtilitiesSvc) . (...) - C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe (.not file.)
~ Services: 14 Legitimates Filtered in 00mn 12s
---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [ATuning] (...) -- C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\ATuning.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [FileCure Default] (...) -- C:\Program Files (x86)\ParetoLogic\FileCure\FileCure.exe (.not file.) [0] =>PUP.Paretologic
[MD5.00000000000000000000000000000000] [APT] [ParetoLogic Update Version3 Startup Task] (...) -- C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe (.not file.) [0] =>PUP.Paretologic
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{2280F8F6-F4AB-4EEA-886E-E5F1BCE4A98F}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{24151242-5DAA-47E3-9691-367423F38358}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{27C60DA1-3532-4BB8-9519-622B1C3BFCC1}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{2A19A388-63F6-48E8-B7C1-B7F4E7D1CCEB}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{2FEF56E1-7CD4-43D3-8EB1-00384E7E3E6E}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{365CDB04-8701-4DDE-BD1F-62BBE348C3AE}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{393FB9E6-599D-4C73-858D-9B33D64525C5}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{4DECC12F-B3D2-4856-8C17-1F37FFA57FD2}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{50C78FF8-EBC6-48CC-947D-BBD3E65FC414}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{655D0907-B053-43BF-B545-DA9506176264}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{673BC69E-71E0-4C7F-9AC1-BE7446B322C6}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{6793B200-BEA1-4AAB-8E26-9B7094A13591}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{6BF9B303-983B-4CB0-9150-18EC002500B7}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{73DF704B-8850-470B-888D-0D9CB12C4CB2}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{7826EFCE-FBAF-4E6D-A90A-8D918D39AFF8}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{7F44EC4F-A4C1-4BEA-A7DE-6FA2D1FEB2C1}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{80FFBF07-9D9E-4B5F-9048-47952C14F11D}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{81C1086E-99FC-4C46-B778-6AA0CA8F156E}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{87331739-BFEC-474E-B1C7-2D249CD297BC}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{87AE38CA-21F6-4565-9BB6-D63B579FD0DE}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{8A292A91-56CC-44EB-90F4-7B7B782A8A48}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{A8E00CF6-A262-4B24-A600-344E78A1E2F8}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{B531D692-868D-408E-B31E-CEBBAAAB5206}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{B88C1787-017E-44F6-813F-23D33F098241}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0
~ Lancé par PC (2014-08-28 18:47:12)
~ Adresse du Site Web https://nicolascoolman.eu
~ Adresse du Forum https://nicolascoolman.eu
~ Traduit par Nicolas Coolman
~ Etat de la version : Version à jour.
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user
---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.17239
MFIE: Mozilla Firefox 31.0
GCIE: Google Chrome v36.0.1985.143 (Defaut)
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows Operating System - Windows(R) 7, OEM_COA_SLP channel
Windows ID Activation : OK
~ Windows Partial Key : JDTHV
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ Logiciels de protection du système
Malwarebytes Anti-Malware version 2.0.2.1012
Microsoft Security Client v4.5.0216.0
Spybot - Search & Destroy v2.4.40
Windows Defender W7 (Deactivate)
---\\ Logiciels d'optimisation du système
CCleaner v4.17
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 14 Plugin
Adobe Reader XI
Java 7 Update 60 (64-bit)
---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 55 Stepping 3, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3797 MB (36% free)
System Restore: Activé (Enable)
System drive C: has 425 GB (91%) free of 466 GB
---\\ Mode de connexion au système
~ Computer Name: PC-PC
~ User Name: PC
~ All Users Names: PC, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\PC\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\PC\AppData\Roaming\
~ %Desktop% : C:\Users\PC\Desktop\
~ %Favorites% : C:\Users\PC\Favorites\
~ %LocalAppData% : C:\Users\PC\AppData\Local\
~ %StartMenu% : C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 425 Go of 466 Go)
D: CD-ROM drive (Not Inserted)
---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 41 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.2011-02-25 - 01:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.2009-07-13 - 20:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.8E71A5CB5312B8392D4DA4CA37BB5868] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.2014-07-25 - 05:52:06.) -- C:\Windows\System32\wininet.dll [2266624]
[MD5.88AB9B72B4BF3963A0DE0820B4B0B06C] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.2014-03-04 - 04:43:50.) -- C:\Windows\System32\Winlogon.exe [455168]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.2010-11-20 - 22:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.FA886682CFC5D36718D3E436AACF10B9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.2014-05-30 - 01:45:52.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.2009-07-13 - 20:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.2009-07-13 - 18:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.2010-11-20 - 22:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.2010-11-20 - 22:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.2010-11-20 - 22:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.2009-07-13 - 18:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.2009-07-13 - 19:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.2011-04-26 - 21:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.2010-11-20 - 22:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.2014-01-23 - 21:37:55.) -- C:\Windows\system32\Drivers\ntfs.sys [1684928]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.2009-07-13 - 19:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.2010-11-20 - 22:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.2009-07-13 - 19:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.2010-11-20 - 22:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.2010-11-20 - 22:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 04s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/32
~ Mes musiques (My Musics) : 1/7
~ Mes Favoris (My Favorites) : 1/154
~ Mes Documents (My Documents) : 1/9
~ Mon Bureau (My Desktop) : 1/22
~ Menu demarrer (Programs) : 1/39
~ Hidden Files: Scanned in 00mn 00s
---\\ Processus lancés
[MD5.4FBC630768570E6AC35C3DE8F6EC79F5] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe [6970168] [PID.2208]
[MD5.5D61BE7DB55B026A5D61A3EED09D0EAD] - (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408] [PID.2536]
[MD5.BD2C0CDD525902E3033DAA8D08D0F015] - (.Intel Corporation - iusb3mon.) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848] [PID.2696]
[MD5.7EE68A122ED08E4AAD8DA551E34D2515] - (.Safer-Networking Ltd. - Spybot - Search & Destroy tray access.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576] [PID.2704]
[MD5.8A86F41B857DA166033B1795FE69BF37] - (.Almico Software (www.almico.com) - Pas de description.) -- C:\Program Files (x86)\SpeedFan\speedfan.exe [4683768] [PID.2844]
[MD5.3FAFBCCE3F066EDCC263E25A786FFD50] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe [21650016] [PID.3224]
[MD5.CDF01A5C7927786A708EAEE91F14797B] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\IEXPLORE.exe [812224] [PID.6376]
[MD5.E8B7FD67DA14A7BE57A5CB80E3139E60] - (.Google Inc. - Google Toolbar Broker.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe [309704] [PID.1648]
[MD5.33BF80A2291C54DC7D7601CDEF63138E] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8099328] [PID.4352]
[MD5.B362181ED3771DC03B4141927C80F801] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65432] [PID.1480]
[MD5.6B73E94F9FE82D45781B8C8A09483082] - (.Apple Inc. - YSLoader.exe.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [43336] [PID.1524]
[MD5.1F79342D9EB530A48742F651E570983A] - (.Microsoft Corporation - Updates Skype Click to Call.) -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176] [PID.1588]
[MD5.E4938E0A376CF0B9D989EE5C0A146891] - (.Microsoft Corporation - Phone Number Recognition (PNR) module.) -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520] [PID.1624]
[MD5.D84AEA3F3329D622DFC1297DDDF6163B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720] [PID.1776]
[MD5.4F45ED469906494F9BF754E476390DBD] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472] [PID.2092]
[MD5.397D14958D6C9C2B365469A857B2AC4E] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe [230792] [PID.2252]
[MD5.D777F1417D9BB9F66CD9D9C3B61F730F] - (.Safer-Networking Ltd. - Spybot-S&D 2 Scanner Service.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168] [PID.2248]
[MD5.68D6C7F99BC73B88954D844FCCBEB2A0] - (.Safer-Networking Ltd. - Spybot-S&D 2 Background update service.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408] [PID.572]
[MD5.9B9B368A8FF5CAF91D7A333CF62CD2CC] - (.Safer-Networking Ltd. - Windows Security Center integration..) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928] [PID.3236]
[MD5.9CCE733E5262FB92C2331E8578512B49] - (.Safer-Networking Ltd. - Update.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [4747720] [PID.6672]
~ Processes Running: Scanned in 00mn 10s
---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Preferences
G0 - GCSP: Preference [User Data\Default][HomePage] http://search.conduit.com
G2 - GCE: Preference [User Data\Default] [apdfllckaahabafndbhieahigkjlhalf] Google Drive v.6.3 (Activé)
G2 - GCE: Preference [User Data\Default] [dbaidnecjbnadknkpdlhicbamnjlccfg] The interpreter v.1.3 (Activé)
G2 - GCE: Preference [User Data\Default] [gjgkjeheegjnnmheaflhdocglkiegoni] Un périple à travers la Terre du Milieu v.0.0.1.3 (Désactivé)
G2 - GCE: Preference [User Data\Default] [kmendfapggjehodndflmmgagdbamhnfd] CryptoTokenExtension v.0.0.1 (Activé)
G2 - GCE: Preference [User Data\Default] [lopaplcmfjlfdkmaadlchgbgenjkfboe] Traduction Anglais Français v.2.8.8 (Activé)
G2 - GCE: Preference [User Data\Default] [mfffpogegjflfpflabcdkioaeobkgjik] GaiaAuthExtension v.0.0.1, (Activé)
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Wallet v.0.0.6.1 (Activé)
G2 - GCE: Preference [User Data\Default] [nppllibpnmahfaklnpggkibhkapjkeob] Norton Security Toolbar v.2014.7.6.17, (Désactivé)
G2 - GCE: Preference [User Data\Default] [pafkbggdmjlpgkdkcbjmhmfcdpncadgh] Google Now v.1.2.0.1 (Activé)
---\\ Liste des dossiers d'extension Google Chrome
~ Google Lines Browser: 25 Legitimates Filtered in 00mn 30s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\w7k7zyrl.default\prefs.js
M2 - MFEP: prefs.js [PC - w7k7zyrl.default\{18d5a8fe-5428-485b-968f-b97b05a92b54}] [] Astromenda Search Addon v1.2 (..) =>PUP.Astromenda
M2 - MFEP: Extension [PC - w7k7zyrl.default] {b9bfaf1c-a63f-47cd-8b9a-29526ced9060}
~ Firefox Browser: 9 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local>;*.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (15516)
~ Hosts File: Scanned in 00mn 19s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
O3 - Toolbar: Norton Identity Safe Toolbar - [HKLM]{A13C2648-91D4-4bf3-BC6D-0079707C4389} . (...) -- C:\Program Files (x86)\Norton Identity Safe\Engine64\2014.7.3.12\coIEPlg.dll
O3 - Toolbar: Norton Toolbar - [HKLM]{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} . (...) -- C:\Program Files (x86)\Norton 360\Norton 360\Engine64\21.5.0.19\coIEPlg.dll
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Applications lancées au démarrage du système (O4)
O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =>.Realtek Semiconductor Corp
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKCU\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKLM\..\Wow6432Node\Run: [USB3MON] . (.Intel Corporation - iusb3mon.) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
O4 - HKLM\..\Wow6432Node\Run: [LWS] . (.Logitech Inc. - Logitech Webcam Software.) -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe =>.Logitech Inc
O4 - HKLM\..\Wow6432Node\Run: [SDTray] . (.Safer-Networking Ltd. - Spybot - Search & Destroy tray access.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2731293000-1977296109-539070842-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2731293000-1977296109-539070842-1000\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
~ Application: Scanned in 00mn 00s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Skype Click to Call settings [64Bits] - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- c:\program files (x86)\skype\toolbars\internet explorer x64\icon.ico
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpDomain = gateway.2wire.net
O17 - HKLM\System\CS1\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpDomain = gateway.2wire.net
O17 - HKLM\System\CS2\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpDomain = gateway.2wire.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (...) -- igfxdev.dll
O20 - Winlogon Notify: LBTWlgn . (.Logitech, Inc. - Logitech Bluetooth Service.) -- c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
~ Winlogon: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) . (.Safer-Networking Ltd. - Windows Security Center integration..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: AVG PC TuneUp Service (TuneUp.UtilitiesSvc) . (...) - C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe (.not file.)
~ Services: 14 Legitimates Filtered in 00mn 12s
---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [ATuning] (...) -- C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\ATuning.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [FileCure Default] (...) -- C:\Program Files (x86)\ParetoLogic\FileCure\FileCure.exe (.not file.) [0] =>PUP.Paretologic
[MD5.00000000000000000000000000000000] [APT] [ParetoLogic Update Version3 Startup Task] (...) -- C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe (.not file.) [0] =>PUP.Paretologic
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{2280F8F6-F4AB-4EEA-886E-E5F1BCE4A98F}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{24151242-5DAA-47E3-9691-367423F38358}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{27C60DA1-3532-4BB8-9519-622B1C3BFCC1}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{2A19A388-63F6-48E8-B7C1-B7F4E7D1CCEB}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{2FEF56E1-7CD4-43D3-8EB1-00384E7E3E6E}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{365CDB04-8701-4DDE-BD1F-62BBE348C3AE}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{393FB9E6-599D-4C73-858D-9B33D64525C5}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{4DECC12F-B3D2-4856-8C17-1F37FFA57FD2}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{50C78FF8-EBC6-48CC-947D-BBD3E65FC414}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{655D0907-B053-43BF-B545-DA9506176264}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{673BC69E-71E0-4C7F-9AC1-BE7446B322C6}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{6793B200-BEA1-4AAB-8E26-9B7094A13591}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{6BF9B303-983B-4CB0-9150-18EC002500B7}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{73DF704B-8850-470B-888D-0D9CB12C4CB2}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{7826EFCE-FBAF-4E6D-A90A-8D918D39AFF8}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{7F44EC4F-A4C1-4BEA-A7DE-6FA2D1FEB2C1}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{80FFBF07-9D9E-4B5F-9048-47952C14F11D}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{81C1086E-99FC-4C46-B778-6AA0CA8F156E}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{87331739-BFEC-474E-B1C7-2D249CD297BC}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{87AE38CA-21F6-4565-9BB6-D63B579FD0DE}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{8A292A91-56CC-44EB-90F4-7B7B782A8A48}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{A8E00CF6-A262-4B24-A600-344E78A1E2F8}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{B531D692-868D-408E-B31E-CEBBAAAB5206}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{B88C1787-017E-44F6-813F-23D33F098241}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{BECEF950-C315-4ACD-A13F-403D8DDD0C88}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{C05066AA-D729-43F8-8E16-D168FAEFBFE2}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{C707E465-B84E-4499-842D-C5C38ABB7E69}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{CB0B3977-1276-42E3-907D-D4DC20C8EB69}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{CE870E20-DA1A-4416-83D0-0035011597B3}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{D13FF831-1163-4D50-8A66-4EC99C908BA6}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{D6987A79-AE35-439A-B928-FE2C1793632F}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{DEDA031B-01FA-4C24-AADE-EB4CB84B498D}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{E5939AB6-1D1F-44B6-8F0A-C95356320B78}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{E6A05030-8D95-4546-985C-2B2AAC36A609}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{EB3CB80E-6CDF-4D3E-9AE5-FD8ED7E56BE6}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{F217AEC5-6C66-4398-AA69-5951DA5D23D0}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater [1002]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore [1056]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA [1060]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\HP Photo Creations Communicator [318]
~ Scheduled Task: 65 Legitimates Filtered in 01mn 02s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\DriverRestore]
[HKCU\Software\DriverWhiz]
~ Key Software: 256 Legitimates Filtered in 00mn 00s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 2014-08-10 - 17:10:34 - [] ----D C:\Program Files (x86)\APO Usb Autorun
O43 - CFD: 2014-07-03 - 03:35:30 - [0] ----D C:\Program Files (x86)\GUM531E.tmp
O43 - CFD: 2014-08-19 - 23:49:20 - [0] -SH-D C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
O43 - CFD: 2014-08-19 - 23:49:20 - [0] -SH-D C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
~ 1 Dossier CLSID vide (CLSID Empty Folder)
~ Program Folder: 203 Legitimates Filtered in 00mn 02s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.62507E599AE37E91C1BEED8DE35E5236] - 2014-08-18 - 12:26:05 ---A- . (.AVG - AVG WinLogon Extension.) -- C:\Windows\System32\authuitu.dll [29496]
O44 - LFC:[MD5.40D653A452721F45F5FDCDF7C6A67569] - 2014-08-18 - 12:26:06 ---A- . (.AVG - AVG Registry Optimization Boot Application.) -- C:\Windows\System32\TURegOpt.exe [40248]
O44 - LFC:[MD5.0A34066D56D57C0DA73BFFC1E4169FF2] - 2014-08-25 - 12:58:42 ---A- . (...) -- C:\Windows\wininit.ini [85]
~ Files: 29 Legitimates Filtered in 00mn 14s
---\\ Contrôle du Safe Boot (CSB) (O49)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\CleanHlp.sys . (...) -- C:\Windows\System32\Drivers\CleanHlp.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\CleanHlp.sys . (...) -- C:\Windows\System32\Drivers\CleanHlp.sys (.not file.)
~ CSB: 15 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:2013-03-05 - 11:24:26 ----- . (...) -- C:\Windows\System32\Drivers\AQFileRestore.sys [21584]
O58 - SDL:2009-07-13 - 20:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:2009-06-10 - 15:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:2014-05-13 - 08:21:18 ---A- . (.Visicom Media Inc. - ManyCam Virtual Microphone.) -- C:\Windows\System32\Drivers\mcaudrv_x64.sys [35440]
O58 - SDL:2014-07-28 - 09:06:24 ---A- . (.Visicom Media Inc. - ManyCam Virtual Webcam Driver.) -- C:\Windows\System32\Drivers\mcvidrv.sys [49264]
O58 - SDL:2009-07-13 - 20:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
~ Drivers: 72 Legitimates Filtered in 00mn 14s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} [DefaultScope] - (Google) - https://www.google.com/?gws_rd=ssl
O69 - SBI: SearchScopes [HKCU] {C456BAF5-3C8B-49E9-B2B3-987BC16FC062} - ((www.google.com) Google) - https://www.google.com/?gws_rd=ssl
~ Keys: Scanned in 00mn 00s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.E920E867854B6B4DBD3485DB6F936F80] [SPRF][2014-08-15] (...) -- C:\ProgramData\ntuser.dat [262144]
~ Files: 1 Legitimates Filtered in 00mn 00s
---\\ Recherche de clés de registre Tracing (O100)
HKLM\SOFTWARE\Microsoft\Tracing\BackupStack_RASAPI32 =>PUP.MyPCBackup
HKLM\SOFTWARE\Microsoft\Tracing\BackupStack_RASMANCS =>PUP.MyPCBackup
HKLM\SOFTWARE\Microsoft\Tracing\Signup Wizard_RASAPI32 =>PUP.JDIBackup
HKLM\SOFTWARE\Microsoft\Tracing\Signup Wizard_RASMANCS =>PUP.JDIBackup
~ BTK: 126 Legitimates Filtered in 00mn 00s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 2014-08-26 262320 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 2014-06-13 279000 | (cphs) . (.Intel Corporation.) - C:\Windows\SysWow64\IntelCpHeciSvc.exe
SS - | Auto 2014-07-03 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 2014-07-03 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 2014-08-07 194032 | (gusvc) . (.Google.) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Demand 2012-04-24 169752 | (ICCS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
SS - | Demand 2013-07-01 822232 | (Intel(R) Capability Licensing Service TCP IP Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe
SS - | Demand 2014-08-01 641352 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SS - | Demand 2014-03-24 357144 | (LBTServ) . (.Logitech, Inc..) - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
SS - | Demand 2014-08-10 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Auto 2014-04-03 315008 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Auto 1658-07-10 0 | (TuneUp.UtilitiesSvc) . (...) - C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
SS - | Demand 2009-07-13 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 2014-05-08 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 2014-06-12 43336 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 2011-08-30 462184 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Auto 2014-06-13 315352 | (igfxCUIService1.0.0.0) . (.Intel Corporation.) - C:\Windows\System32\igfxCUIService.exe
SR - | Auto 2013-07-01 733696 | (Intel(R) Capability Licensing Service Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
SR - | Auto 2014-06-24 2820424 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe
SR - | Auto 2014-05-12 1809720 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
SR - | Auto 2014-05-12 860472 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
SR - | Auto 2014-03-11 23808 | (MsMpSvc) . (.Microsoft Corporation.) - c:\Program Files\Microsoft Security Client\MsMpEng.exe
SR - | Auto 2014-06-26 130104 | (NCO) . (.Symantec Corporation.) - C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.3.12\NST.exe
SR - | Auto 2014-06-24 1738168 | (SDScannerService) . (.Safer-Networking Ltd..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
SR - | Auto 2014-06-27 2088408 | (SDUpdateService) . (.Safer-Networking Ltd..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
SR - | Auto 2014-04-25 171928 | (SDWSCService) . (.Safer-Networking Ltd..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
SR - | Demand 1658-07-10 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 2009-07-13 27136 | C:\Windows\system32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 21s
---\\ Scan Additionnel (O88)
Database Version : 13026 - (2014-08-28)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 1
Fichiers trouvés (Files found) : 0
C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\w7k7zyrl.default\extensions\{18d5a8fe-5428-485b-968f-b97b05a92b54} =>PUP.Astromenda^
~ Additionnel Scan: 289152 Items scanned in 00mn 48s
---\\ Informations complémentaires sur les modules
~ https://nicolascoolman.eu =>.Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
~ https://nicolascoolman.eu =>.Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
~ https://nicolascoolman.eu =>.Internet Explorer, Proxy Management (R5)
~ https://nicolascoolman.eu =>.Internet Explorer Toolbars (O3)
~ https://nicolascoolman.eu =>.Applications lancées au démarrage du système (O4)
~ AMI: 5 Legitimates Filtered in 00mn 00s
---\\ Récapitulatif des détections trouvées sur votre station
https://nicolascoolman.eu =>PUP.Astromenda
http://nicolascoolman.fr/30068076-pup-paretologic =>PUP.Paretologic
https://nicolascoolman.eu =>PUP.MyPCBackup
~ MSI: 3 link(s) detected in 00mn 00s
~ 860 Legitimates filtered by white list
End of the scan (475 lines in 05mn 14s)(0)~ Rapport de ZHPDiag v2014.8.28.125 - Nicolas Coolman (2014-08-28)
~ Lancé par PC (2014-08-28 18:47:12)
~ Adresse du Site Web https://nicolascoolman.eu
~ Adresse du Forum https://nicolascoolman.eu
~ Traduit par Nicolas Coolman
~ Etat de la version : Version à jour.
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user
---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.17239
MFIE: Mozilla Firefox 31.0
GCIE: Google Chrome v36.0.1985.143 (Defaut)
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows Operating System - Windows(R) 7, OEM_COA_SLP channel
Windows ID Activation : OK
~ Windows Partial Key : JDTHV
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ Logiciels de protection du système
Malwarebytes Anti-Malware version 2.0.2.1012
Microsoft Security Client v4.5.0216.0
Spybot - Search & Destroy v2.4.40
Windows Defender W7 (Deactivate)
---\\ Logiciels d'optimisation du système
CCleaner v4.17
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 14 Plugin
Adobe Reader XI
Java 7 Update 60 (64-bit)
---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 55 Stepping 3, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3797 MB (36% free)
System Restore: Activé (Enable)
System drive C: has 425 GB (91%) free of 466 GB
---\\ Mode de connexion au système
~ Computer Name: PC-PC
~ User Name: PC
~ All Users Names: PC, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\PC\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\PC\AppData\Roaming\
~ %Desktop% : C:\Users\PC\Desktop\
~ %Favorites% : C:\Users\PC\Favorites\
~ %LocalAppData% : C:\Users\PC\AppData\Local\
~ %StartMenu% : C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 425 Go of 466 Go)
D: CD-ROM drive (Not Inserted)
---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 41 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.2011-02-25 - 01:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.2009-07-13 - 20:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.8E71A5CB5312B8392D4DA4CA37BB5868] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.2014-07-25 - 05:52:06.) -- C:\Windows\System32\wininet.dll [2266624]
[MD5.88AB9B72B4BF3963A0DE0820B4B0B06C] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.2014-03-04 - 04:43:50.) -- C:\Windows\System32\Winlogon.exe [455168]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.2010-11-20 - 22:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.FA886682CFC5D36718D3E436AACF10B9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.2014-05-30 - 01:45:52.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.2009-07-13 - 20:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.2009-07-13 - 18:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.2010-11-20 - 22:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.2010-11-20 - 22:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.2010-11-20 - 22:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.2009-07-13 - 18:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.2009-07-13 - 19:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.2011-04-26 - 21:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.2010-11-20 - 22:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.2014-01-23 - 21:37:55.) -- C:\Windows\system32\Drivers\ntfs.sys [1684928]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.2009-07-13 - 19:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.2010-11-20 - 22:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.2009-07-13 - 19:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.2010-11-20 - 22:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.2010-11-20 - 22:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 04s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/32
~ Mes musiques (My Musics) : 1/7
~ Mes Favoris (My Favorites) : 1/154
~ Mes Documents (My Documents) : 1/9
~ Mon Bureau (My Desktop) : 1/22
~ Menu demarrer (Programs) : 1/39
~ Hidden Files: Scanned in 00mn 00s
---\\ Processus lancés
[MD5.4FBC630768570E6AC35C3DE8F6EC79F5] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe [6970168] [PID.2208]
[MD5.5D61BE7DB55B026A5D61A3EED09D0EAD] - (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408] [PID.2536]
[MD5.BD2C0CDD525902E3033DAA8D08D0F015] - (.Intel Corporation - iusb3mon.) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848] [PID.2696]
[MD5.7EE68A122ED08E4AAD8DA551E34D2515] - (.Safer-Networking Ltd. - Spybot - Search & Destroy tray access.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576] [PID.2704]
[MD5.8A86F41B857DA166033B1795FE69BF37] - (.Almico Software (www.almico.com) - Pas de description.) -- C:\Program Files (x86)\SpeedFan\speedfan.exe [4683768] [PID.2844]
[MD5.3FAFBCCE3F066EDCC263E25A786FFD50] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe [21650016] [PID.3224]
[MD5.CDF01A5C7927786A708EAEE91F14797B] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\IEXPLORE.exe [812224] [PID.6376]
[MD5.E8B7FD67DA14A7BE57A5CB80E3139E60] - (.Google Inc. - Google Toolbar Broker.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe [309704] [PID.1648]
[MD5.33BF80A2291C54DC7D7601CDEF63138E] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8099328] [PID.4352]
[MD5.B362181ED3771DC03B4141927C80F801] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65432] [PID.1480]
[MD5.6B73E94F9FE82D45781B8C8A09483082] - (.Apple Inc. - YSLoader.exe.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [43336] [PID.1524]
[MD5.1F79342D9EB530A48742F651E570983A] - (.Microsoft Corporation - Updates Skype Click to Call.) -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176] [PID.1588]
[MD5.E4938E0A376CF0B9D989EE5C0A146891] - (.Microsoft Corporation - Phone Number Recognition (PNR) module.) -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520] [PID.1624]
[MD5.D84AEA3F3329D622DFC1297DDDF6163B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720] [PID.1776]
[MD5.4F45ED469906494F9BF754E476390DBD] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472] [PID.2092]
[MD5.397D14958D6C9C2B365469A857B2AC4E] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe [230792] [PID.2252]
[MD5.D777F1417D9BB9F66CD9D9C3B61F730F] - (.Safer-Networking Ltd. - Spybot-S&D 2 Scanner Service.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168] [PID.2248]
[MD5.68D6C7F99BC73B88954D844FCCBEB2A0] - (.Safer-Networking Ltd. - Spybot-S&D 2 Background update service.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408] [PID.572]
[MD5.9B9B368A8FF5CAF91D7A333CF62CD2CC] - (.Safer-Networking Ltd. - Windows Security Center integration..) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928] [PID.3236]
[MD5.9CCE733E5262FB92C2331E8578512B49] - (.Safer-Networking Ltd. - Update.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [4747720] [PID.6672]
~ Processes Running: Scanned in 00mn 10s
---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Preferences
G0 - GCSP: Preference [User Data\Default][HomePage] http://search.conduit.com
G2 - GCE: Preference [User Data\Default] [apdfllckaahabafndbhieahigkjlhalf] Google Drive v.6.3 (Activé)
G2 - GCE: Preference [User Data\Default] [dbaidnecjbnadknkpdlhicbamnjlccfg] The interpreter v.1.3 (Activé)
G2 - GCE: Preference [User Data\Default] [gjgkjeheegjnnmheaflhdocglkiegoni] Un périple à travers la Terre du Milieu v.0.0.1.3 (Désactivé)
G2 - GCE: Preference [User Data\Default] [kmendfapggjehodndflmmgagdbamhnfd] CryptoTokenExtension v.0.0.1 (Activé)
G2 - GCE: Preference [User Data\Default] [lopaplcmfjlfdkmaadlchgbgenjkfboe] Traduction Anglais Français v.2.8.8 (Activé)
G2 - GCE: Preference [User Data\Default] [mfffpogegjflfpflabcdkioaeobkgjik] GaiaAuthExtension v.0.0.1, (Activé)
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Wallet v.0.0.6.1 (Activé)
G2 - GCE: Preference [User Data\Default] [nppllibpnmahfaklnpggkibhkapjkeob] Norton Security Toolbar v.2014.7.6.17, (Désactivé)
G2 - GCE: Preference [User Data\Default] [pafkbggdmjlpgkdkcbjmhmfcdpncadgh] Google Now v.1.2.0.1 (Activé)
---\\ Liste des dossiers d'extension Google Chrome
~ Google Lines Browser: 25 Legitimates Filtered in 00mn 30s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\w7k7zyrl.default\prefs.js
M2 - MFEP: prefs.js [PC - w7k7zyrl.default\{18d5a8fe-5428-485b-968f-b97b05a92b54}] [] Astromenda Search Addon v1.2 (..) =>PUP.Astromenda
M2 - MFEP: Extension [PC - w7k7zyrl.default] {b9bfaf1c-a63f-47cd-8b9a-29526ced9060}
~ Firefox Browser: 9 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local>;*.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (15516)
~ Hosts File: Scanned in 00mn 19s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
O3 - Toolbar: Norton Identity Safe Toolbar - [HKLM]{A13C2648-91D4-4bf3-BC6D-0079707C4389} . (...) -- C:\Program Files (x86)\Norton Identity Safe\Engine64\2014.7.3.12\coIEPlg.dll
O3 - Toolbar: Norton Toolbar - [HKLM]{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} . (...) -- C:\Program Files (x86)\Norton 360\Norton 360\Engine64\21.5.0.19\coIEPlg.dll
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Applications lancées au démarrage du système (O4)
O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =>.Realtek Semiconductor Corp
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKCU\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKLM\..\Wow6432Node\Run: [USB3MON] . (.Intel Corporation - iusb3mon.) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
O4 - HKLM\..\Wow6432Node\Run: [LWS] . (.Logitech Inc. - Logitech Webcam Software.) -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe =>.Logitech Inc
O4 - HKLM\..\Wow6432Node\Run: [SDTray] . (.Safer-Networking Ltd. - Spybot - Search & Destroy tray access.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2731293000-1977296109-539070842-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2731293000-1977296109-539070842-1000\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
~ Application: Scanned in 00mn 00s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Skype Click to Call settings [64Bits] - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- c:\program files (x86)\skype\toolbars\internet explorer x64\icon.ico
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpDomain = gateway.2wire.net
O17 - HKLM\System\CS1\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpDomain = gateway.2wire.net
O17 - HKLM\System\CS2\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpDomain = gateway.2wire.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (...) -- igfxdev.dll
O20 - Winlogon Notify: LBTWlgn . (.Logitech, Inc. - Logitech Bluetooth Service.) -- c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
~ Winlogon: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) . (.Safer-Networking Ltd. - Windows Security Center integration..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: AVG PC TuneUp Service (TuneUp.UtilitiesSvc) . (...) - C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe (.not file.)
~ Services: 14 Legitimates Filtered in 00mn 12s
---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [ATuning] (...) -- C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\ATuning.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [FileCure Default] (...) -- C:\Program Files (x86)\ParetoLogic\FileCure\FileCure.exe (.not file.) [0] =>PUP.Paretologic
[MD5.00000000000000000000000000000000] [APT] [ParetoLogic Update Version3 Startup Task] (...) -- C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe (.not file.) [0] =>PUP.Paretologic
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{2280F8F6-F4AB-4EEA-886E-E5F1BCE4A98F}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{24151242-5DAA-47E3-9691-367423F38358}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{27C60DA1-3532-4BB8-9519-622B1C3BFCC1}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{2A19A388-63F6-48E8-B7C1-B7F4E7D1CCEB}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{2FEF56E1-7CD4-43D3-8EB1-00384E7E3E6E}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{365CDB04-8701-4DDE-BD1F-62BBE348C3AE}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{393FB9E6-599D-4C73-858D-9B33D64525C5}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{4DECC12F-B3D2-4856-8C17-1F37FFA57FD2}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{50C78FF8-EBC6-48CC-947D-BBD3E65FC414}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{655D0907-B053-43BF-B545-DA9506176264}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{673BC69E-71E0-4C7F-9AC1-BE7446B322C6}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{6793B200-BEA1-4AAB-8E26-9B7094A13591}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{6BF9B303-983B-4CB0-9150-18EC002500B7}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{73DF704B-8850-470B-888D-0D9CB12C4CB2}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{7826EFCE-FBAF-4E6D-A90A-8D918D39AFF8}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{7F44EC4F-A4C1-4BEA-A7DE-6FA2D1FEB2C1}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{80FFBF07-9D9E-4B5F-9048-47952C14F11D}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{81C1086E-99FC-4C46-B778-6AA0CA8F156E}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{87331739-BFEC-474E-B1C7-2D249CD297BC}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{87AE38CA-21F6-4565-9BB6-D63B579FD0DE}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{8A292A91-56CC-44EB-90F4-7B7B782A8A48}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{A8E00CF6-A262-4B24-A600-344E78A1E2F8}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{B531D692-868D-408E-B31E-CEBBAAAB5206}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{B88C1787-017E-44F6-813F-23D33F098241}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0
Bryan444
Messages postés
19
Date d'inscription
samedi 23 août 2014
Statut
Membre
Dernière intervention
24 novembre 2014
29 août 2014 à 01:15
29 août 2014 à 01:15
~ Rapport de ZHPDiag v2014.8.28.125 - Nicolas Coolman (2014-08-28)
~ Lancé par PC (2014-08-28 18:47:12)
~ Adresse du Site Web https://nicolascoolman.eu
~ Adresse du Forum https://nicolascoolman.eu
~ Traduit par Nicolas Coolman
~ Etat de la version : Version à jour.
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user
---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.17239
MFIE: Mozilla Firefox 31.0
GCIE: Google Chrome v36.0.1985.143 (Defaut)
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows Operating System - Windows(R) 7, OEM_COA_SLP channel
Windows ID Activation : OK
~ Windows Partial Key : JDTHV
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ Logiciels de protection du système
Malwarebytes Anti-Malware version 2.0.2.1012
Microsoft Security Client v4.5.0216.0
Spybot - Search & Destroy v2.4.40
Windows Defender W7 (Deactivate)
---\\ Logiciels d'optimisation du système
CCleaner v4.17
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 14 Plugin
Adobe Reader XI
Java 7 Update 60 (64-bit)
---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 55 Stepping 3, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3797 MB (36% free)
System Restore: Activé (Enable)
System drive C: has 425 GB (91%) free of 466 GB
---\\ Mode de connexion au système
~ Computer Name: PC-PC
~ User Name: PC
~ All Users Names: PC, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\PC\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\PC\AppData\Roaming\
~ %Desktop% : C:\Users\PC\Desktop\
~ %Favorites% : C:\Users\PC\Favorites\
~ %LocalAppData% : C:\Users\PC\AppData\Local\
~ %StartMenu% : C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 425 Go of 466 Go)
D: CD-ROM drive (Not Inserted)
---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 41 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.2011-02-25 - 01:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.2009-07-13 - 20:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.8E71A5CB5312B8392D4DA4CA37BB5868] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.2014-07-25 - 05:52:06.) -- C:\Windows\System32\wininet.dll [2266624]
[MD5.88AB9B72B4BF3963A0DE0820B4B0B06C] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.2014-03-04 - 04:43:50.) -- C:\Windows\System32\Winlogon.exe [455168]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.2010-11-20 - 22:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.FA886682CFC5D36718D3E436AACF10B9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.2014-05-30 - 01:45:52.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.2009-07-13 - 20:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.2009-07-13 - 18:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.2010-11-20 - 22:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.2010-11-20 - 22:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.2010-11-20 - 22:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.2009-07-13 - 18:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.2009-07-13 - 19:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.2011-04-26 - 21:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.2010-11-20 - 22:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.2014-01-23 - 21:37:55.) -- C:\Windows\system32\Drivers\ntfs.sys [1684928]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.2009-07-13 - 19:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.2010-11-20 - 22:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.2009-07-13 - 19:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.2010-11-20 - 22:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.2010-11-20 - 22:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 04s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/32
~ Mes musiques (My Musics) : 1/7
~ Mes Favoris (My Favorites) : 1/154
~ Mes Documents (My Documents) : 1/9
~ Mon Bureau (My Desktop) : 1/22
~ Menu demarrer (Programs) : 1/39
~ Hidden Files: Scanned in 00mn 00s
---\\ Processus lancés
[MD5.4FBC630768570E6AC35C3DE8F6EC79F5] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe [6970168] [PID.2208]
[MD5.5D61BE7DB55B026A5D61A3EED09D0EAD] - (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408] [PID.2536]
[MD5.BD2C0CDD525902E3033DAA8D08D0F015] - (.Intel Corporation - iusb3mon.) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848] [PID.2696]
[MD5.7EE68A122ED08E4AAD8DA551E34D2515] - (.Safer-Networking Ltd. - Spybot - Search & Destroy tray access.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576] [PID.2704]
[MD5.8A86F41B857DA166033B1795FE69BF37] - (.Almico Software (www.almico.com) - Pas de description.) -- C:\Program Files (x86)\SpeedFan\speedfan.exe [4683768] [PID.2844]
[MD5.3FAFBCCE3F066EDCC263E25A786FFD50] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe [21650016] [PID.3224]
[MD5.CDF01A5C7927786A708EAEE91F14797B] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\IEXPLORE.exe [812224] [PID.6376]
[MD5.E8B7FD67DA14A7BE57A5CB80E3139E60] - (.Google Inc. - Google Toolbar Broker.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe [309704] [PID.1648]
[MD5.33BF80A2291C54DC7D7601CDEF63138E] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8099328] [PID.4352]
[MD5.B362181ED3771DC03B4141927C80F801] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65432] [PID.1480]
[MD5.6B73E94F9FE82D45781B8C8A09483082] - (.Apple Inc. - YSLoader.exe.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [43336] [PID.1524]
[MD5.1F79342D9EB530A48742F651E570983A] - (.Microsoft Corporation - Updates Skype Click to Call.) -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176] [PID.1588]
[MD5.E4938E0A376CF0B9D989EE5C0A146891] - (.Microsoft Corporation - Phone Number Recognition (PNR) module.) -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520] [PID.1624]
[MD5.D84AEA3F3329D622DFC1297DDDF6163B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720] [PID.1776]
[MD5.4F45ED469906494F9BF754E476390DBD] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472] [PID.2092]
[MD5.397D14958D6C9C2B365469A857B2AC4E] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe [230792] [PID.2252]
[MD5.D777F1417D9BB9F66CD9D9C3B61F730F] - (.Safer-Networking Ltd. - Spybot-S&D 2 Scanner Service.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168] [PID.2248]
[MD5.68D6C7F99BC73B88954D844FCCBEB2A0] - (.Safer-Networking Ltd. - Spybot-S&D 2 Background update service.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408] [PID.572]
[MD5.9B9B368A8FF5CAF91D7A333CF62CD2CC] - (.Safer-Networking Ltd. - Windows Security Center integration..) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928] [PID.3236]
[MD5.9CCE733E5262FB92C2331E8578512B49] - (.Safer-Networking Ltd. - Update.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [4747720] [PID.6672]
~ Processes Running: Scanned in 00mn 10s
---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Preferences
G0 - GCSP: Preference [User Data\Default][HomePage] http://search.conduit.com
G2 - GCE: Preference [User Data\Default] [apdfllckaahabafndbhieahigkjlhalf] Google Drive v.6.3 (Activé)
G2 - GCE: Preference [User Data\Default] [dbaidnecjbnadknkpdlhicbamnjlccfg] The interpreter v.1.3 (Activé)
G2 - GCE: Preference [User Data\Default] [gjgkjeheegjnnmheaflhdocglkiegoni] Un périple à travers la Terre du Milieu v.0.0.1.3 (Désactivé)
G2 - GCE: Preference [User Data\Default] [kmendfapggjehodndflmmgagdbamhnfd] CryptoTokenExtension v.0.0.1 (Activé)
G2 - GCE: Preference [User Data\Default] [lopaplcmfjlfdkmaadlchgbgenjkfboe] Traduction Anglais Français v.2.8.8 (Activé)
G2 - GCE: Preference [User Data\Default] [mfffpogegjflfpflabcdkioaeobkgjik] GaiaAuthExtension v.0.0.1, (Activé)
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Wallet v.0.0.6.1 (Activé)
G2 - GCE: Preference [User Data\Default] [nppllibpnmahfaklnpggkibhkapjkeob] Norton Security Toolbar v.2014.7.6.17, (Désactivé)
G2 - GCE: Preference [User Data\Default] [pafkbggdmjlpgkdkcbjmhmfcdpncadgh] Google Now v.1.2.0.1 (Activé)
---\\ Liste des dossiers d'extension Google Chrome
~ Google Lines Browser: 25 Legitimates Filtered in 00mn 30s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\w7k7zyrl.default\prefs.js
M2 - MFEP: prefs.js [PC - w7k7zyrl.default\{18d5a8fe-5428-485b-968f-b97b05a92b54}] [] Astromenda Search Addon v1.2 (..) =>PUP.Astromenda
M2 - MFEP: Extension [PC - w7k7zyrl.default] {b9bfaf1c-a63f-47cd-8b9a-29526ced9060}
~ Firefox Browser: 9 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local>;*.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (15516)
~ Hosts File: Scanned in 00mn 19s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
O3 - Toolbar: Norton Identity Safe Toolbar - [HKLM]{A13C2648-91D4-4bf3-BC6D-0079707C4389} . (...) -- C:\Program Files (x86)\Norton Identity Safe\Engine64\2014.7.3.12\coIEPlg.dll
O3 - Toolbar: Norton Toolbar - [HKLM]{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} . (...) -- C:\Program Files (x86)\Norton 360\Norton 360\Engine64\21.5.0.19\coIEPlg.dll
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Applications lancées au démarrage du système (O4)
O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =>.Realtek Semiconductor Corp
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKCU\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKLM\..\Wow6432Node\Run: [USB3MON] . (.Intel Corporation - iusb3mon.) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
O4 - HKLM\..\Wow6432Node\Run: [LWS] . (.Logitech Inc. - Logitech Webcam Software.) -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe =>.Logitech Inc
O4 - HKLM\..\Wow6432Node\Run: [SDTray] . (.Safer-Networking Ltd. - Spybot - Search & Destroy tray access.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2731293000-1977296109-539070842-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2731293000-1977296109-539070842-1000\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
~ Application: Scanned in 00mn 00s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Skype Click to Call settings [64Bits] - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- c:\program files (x86)\skype\toolbars\internet explorer x64\icon.ico
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpDomain = gateway.2wire.net
O17 - HKLM\System\CS1\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpDomain = gateway.2wire.net
O17 - HKLM\System\CS2\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpDomain = gateway.2wire.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (...) -- igfxdev.dll
O20 - Winlogon Notify: LBTWlgn . (.Logitech, Inc. - Logitech Bluetooth Service.) -- c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
~ Winlogon: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) . (.Safer-Networking Ltd. - Windows Security Center integration..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: AVG PC TuneUp Service (TuneUp.UtilitiesSvc) . (...) - C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe (.not file.)
~ Services: 14 Legitimates Filtered in 00mn 12s
---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [ATuning] (...) -- C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\ATuning.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [FileCure Default] (...) -- C:\Program Files (x86)\ParetoLogic\FileCure\FileCure.exe (.not file.) [0] =>PUP.Paretologic
[MD5.00000000000000000000000000000000] [APT] [ParetoLogic Update Version3 Startup Task] (...) -- C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe (.not file.) [0] =>PUP.Paretologic
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{2280F8F6-F4AB-4EEA-886E-E5F1BCE4A98F}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{24151242-5DAA-47E3-9691-367423F38358}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{27C60DA1-3532-4BB8-9519-622B1C3BFCC1}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{2A19A388-63F6-48E8-B7C1-B7F4E7D1CCEB}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{2FEF56E1-7CD4-43D3-8EB1-00384E7E3E6E}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{365CDB04-8701-4DDE-BD1F-62BBE348C3AE}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{393FB9E6-599D-4C73-858D-9B33D64525C5}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{4DECC12F-B3D2-4856-8C17-1F37FFA57FD2}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{50C78FF8-EBC6-48CC-947D-BBD3E65FC414}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{655D0907-B053-43BF-B545-DA9506176264}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{673BC69E-71E0-4C7F-9AC1-BE7446B322C6}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{6793B200-BEA1-4AAB-8E26-9B7094A13591}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{6BF9B303-983B-4CB0-9150-18EC002500B7}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{73DF704B-8850-470B-888D-0D9CB12C4CB2}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{7826EFCE-FBAF-4E6D-A90A-8D918D39AFF8}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{7F44EC4F-A4C1-4BEA-A7DE-6FA2D1FEB2C1}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{80FFBF07-9D9E-4B5F-9048-47952C14F11D}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{81C1086E-99FC-4C46-B778-6AA0CA8F156E}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{87331739-BFEC-474E-B1C7-2D249CD297BC}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{87AE38CA-21F6-4565-9BB6-D63B579FD0DE}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{8A292A91-56CC-44EB-90F4-7B7B782A8A48}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{A8E00CF6-A262-4B24-A600-344E78A1E2F8}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{B531D692-868D-408E-B31E-CEBBAAAB5206}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{B88C1787-017E-44F6-813F-23D33F098241}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{BECEF950-C315-4ACD-A13F-403D8DDD0C88}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{C05066AA-D729-43F8-8E16-D168FAEFBFE2}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{C707E465-B84E-4499-842D-C5C38ABB7E69}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{CB0B3977-1276-42E3-907D-D4DC20C8EB69}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{CE870E20-DA1A-4416-83D0-0035011597B3}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{D13FF831-1163-4D50-8A66-4EC99C908BA6}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{D6987A79-AE35-439A-B928-FE2C1793632F}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{DEDA031B-01FA-4C24-AADE-EB4CB84B498D}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{E5939AB6-1D1F-44B6-8F0A-C95356320B78}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{E6A05030-8D95-4546-985C-2B2AAC36A609}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{EB3CB80E-6CDF-4D3E-9AE5-FD8ED7E56BE6}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{F217AEC5-6C66-4398-AA69-5951DA5D23D0}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater [1002]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore [1056]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA [1060]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\HP Photo Creations Communicator [318]
~ Scheduled Task: 65 Legitimates Filtered in 01mn 02s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\DriverRestore]
[HKCU\Software\DriverWhiz]
~ Key Software: 256 Legitimates Filtered in 00mn 00s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 2014-08-10 - 17:10:34 - [] ----D C:\Program Files (x86)\APO Usb Autorun
O43 - CFD: 2014-07-03 - 03:35:30 - [0] ----D C:\Program Files (x86)\GUM531E.tmp
O43 - CFD: 2014-08-19 - 23:49:20 - [0] -SH-D C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
O43 - CFD: 2014-08-19 - 23:49:20 - [0] -SH-D C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
~ 1 Dossier CLSID vide (CLSID Empty Folder)
~ Program Folder: 203 Legitimates Filtered in 00mn 02s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.62507E599AE37E91C1BEED8DE35E5236] - 2014-08-18 - 12:26:05 ---A- . (.AVG - AVG WinLogon Extension.) -- C:\Windows\System32\authuitu.dll [29496]
O44 - LFC:[MD5.40D653A452721F45F5FDCDF7C6A67569] - 2014-08-18 - 12:26:06 ---A- . (.AVG - AVG Registry Optimization Boot Application.) -- C:\Windows\System32\TURegOpt.exe [40248]
O44 - LFC:[MD5.0A34066D56D57C0DA73BFFC1E4169FF2] - 2014-08-25 - 12:58:42 ---A- . (...) -- C:\Windows\wininit.ini [85]
~ Files: 29 Legitimates Filtered in 00mn 14s
---\\ Contrôle du Safe Boot (CSB) (O49)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\CleanHlp.sys . (...) -- C:\Windows\System32\Drivers\CleanHlp.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\CleanHlp.sys . (...) -- C:\Windows\System32\Drivers\CleanHlp.sys (.not file.)
~ CSB: 15 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:2013-03-05 - 11:24:26 ----- . (...) -- C:\Windows\System32\Drivers\AQFileRestore.sys [21584]
O58 - SDL:2009-07-13 - 20:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:2009-06-10 - 15:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:2014-05-13 - 08:21:18 ---A- . (.Visicom Media Inc. - ManyCam Virtual Microphone.) -- C:\Windows\System32\Drivers\mcaudrv_x64.sys [35440]
O58 - SDL:2014-07-28 - 09:06:24 ---A- . (.Visicom Media Inc. - ManyCam Virtual Webcam Driver.) -- C:\Windows\System32\Drivers\mcvidrv.sys [49264]
O58 - SDL:2009-07-13 - 20:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
~ Drivers: 72 Legitimates Filtered in 00mn 14s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} [DefaultScope] - (Google) - https://www.google.com/?gws_rd=ssl
O69 - SBI: SearchScopes [HKCU] {C456BAF5-3C8B-49E9-B2B3-987BC16FC062} - ((www.google.com) Google) - https://www.google.com/?gws_rd=ssl
~ Keys: Scanned in 00mn 00s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.E920E867854B6B4DBD3485DB6F936F80] [SPRF][2014-08-15] (...) -- C:\ProgramData\ntuser.dat [262144]
~ Files: 1 Legitimates Filtered in 00mn 00s
---\\ Recherche de clés de registre Tracing (O100)
HKLM\SOFTWARE\Microsoft\Tracing\BackupStack_RASAPI32 =>PUP.MyPCBackup
HKLM\SOFTWARE\Microsoft\Tracing\BackupStack_RASMANCS =>PUP.MyPCBackup
HKLM\SOFTWARE\Microsoft\Tracing\Signup Wizard_RASAPI32 =>PUP.JDIBackup
HKLM\SOFTWARE\Microsoft\Tracing\Signup Wizard_RASMANCS =>PUP.JDIBackup
~ BTK: 126 Legitimates Filtered in 00mn 00s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 2014-08-26 262320 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 2014-06-13 279000 | (cphs) . (.Intel Corporation.) - C:\Windows\SysWow64\IntelCpHeciSvc.exe
SS - | Auto 2014-07-03 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 2014-07-03 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 2014-08-07 194032 | (gusvc) . (.Google.) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Demand 2012-04-24 169752 | (ICCS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
SS - | Demand 2013-07-01 822232 | (Intel(R) Capability Licensing Service TCP IP Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe
SS - | Demand 2014-08-01 641352 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SS - | Demand 2014-03-24 357144 | (LBTServ) . (.Logitech, Inc..) - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
SS - | Demand 2014-08-10 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Auto 2014-04-03 315008 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Auto 1658-07-10 0 | (TuneUp.UtilitiesSvc) . (...) - C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
SS - | Demand 2009-07-13 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 2014-05-08 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 2014-06-12 43336 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 2011-08-30 462184 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Auto 2014-06-13 315352 | (igfxCUIService1.0.0.0) . (.Intel Corporation.) - C:\Windows\System32\igfxCUIService.exe
SR - | Auto 2013-07-01 733696 | (Intel(R) Capability Licensing Service Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
SR - | Auto 2014-06-24 2820424 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe
SR - | Auto 2014-05-12 1809720 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
SR - | Auto 2014-05-12 860472 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
SR - | Auto 2014-03-11 23808 | (MsMpSvc) . (.Microsoft Corporation.) - c:\Program Files\Microsoft Security Client\MsMpEng.exe
SR - | Auto 2014-06-26 130104 | (NCO) . (.Symantec Corporation.) - C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.3.12\NST.exe
SR - | Auto 2014-06-24 1738168 | (SDScannerService) . (.Safer-Networking Ltd..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
SR - | Auto 2014-06-27 2088408 | (SDUpdateService) . (.Safer-Networking Ltd..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
SR - | Auto 2014-04-25 171928 | (SDWSCService) . (.Safer-Networking Ltd..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
SR - | Demand 1658-07-10 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 2009-07-13 27136 | C:\Windows\system32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 21s
---\\ Scan Additionnel (O88)
Database Version : 13026 - (2014-08-28)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 1
Fichiers trouvés (Files found) : 0
C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\w7k7zyrl.default\extensions\{18d5a8fe-5428-485b-968f-b97b05a92b54} =>PUP.Astromenda^
~ Additionnel Scan: 289152 Items scanned in 00mn 48s
---\\ Informations complémentaires sur les modules
~ https://nicolascoolman.eu =>.Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
~ https://nicolascoolman.eu =>.Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
~ https://nicolascoolman.eu =>.Internet Explorer, Proxy Management (R5)
~ https://nicolascoolman.eu =>.Internet Explorer Toolbars (O3)
~ https://nicolascoolman.eu =>.Applications lancées au démarrage du système (O4)
~ AMI: 5 Legitimates Filtered in 00mn 00s
---\\ Récapitulatif des détections trouvées sur votre station
https://nicolascoolman.eu =>PUP.Astromenda
http://nicolascoolman.fr/30068076-pup-paretologic =>PUP.Paretologic
https://nicolascoolman.eu =>PUP.MyPCBackup
~ MSI: 3 link(s) detected in 00mn 00s
~ 860 Legitimates filtered by white list
End of the scan (475 lines in 05mn 14s)(0)
~ Lancé par PC (2014-08-28 18:47:12)
~ Adresse du Site Web https://nicolascoolman.eu
~ Adresse du Forum https://nicolascoolman.eu
~ Traduit par Nicolas Coolman
~ Etat de la version : Version à jour.
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user
---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.17239
MFIE: Mozilla Firefox 31.0
GCIE: Google Chrome v36.0.1985.143 (Defaut)
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows Operating System - Windows(R) 7, OEM_COA_SLP channel
Windows ID Activation : OK
~ Windows Partial Key : JDTHV
Windows License : OK
~ Windows Remaining Initializations Number : 3
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ Logiciels de protection du système
Malwarebytes Anti-Malware version 2.0.2.1012
Microsoft Security Client v4.5.0216.0
Spybot - Search & Destroy v2.4.40
Windows Defender W7 (Deactivate)
---\\ Logiciels d'optimisation du système
CCleaner v4.17
---\\ Logiciels de partage PeerToPeer
---\\ Surveillance de Logiciels
Adobe Flash Player 14 Plugin
Adobe Reader XI
Java 7 Update 60 (64-bit)
---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 55 Stepping 3, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3797 MB (36% free)
System Restore: Activé (Enable)
System drive C: has 425 GB (91%) free of 466 GB
---\\ Mode de connexion au système
~ Computer Name: PC-PC
~ User Name: PC
~ All Users Names: PC, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\PC\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\PC\AppData\Roaming\
~ %Desktop% : C:\Users\PC\Desktop\
~ %Favorites% : C:\Users\PC\Favorites\
~ %LocalAppData% : C:\Users\PC\AppData\Local\
~ %StartMenu% : C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 425 Go of 466 Go)
D: CD-ROM drive (Not Inserted)
---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 41 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.2011-02-25 - 01:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.2009-07-13 - 20:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.8E71A5CB5312B8392D4DA4CA37BB5868] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.2014-07-25 - 05:52:06.) -- C:\Windows\System32\wininet.dll [2266624]
[MD5.88AB9B72B4BF3963A0DE0820B4B0B06C] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.2014-03-04 - 04:43:50.) -- C:\Windows\System32\Winlogon.exe [455168]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.2010-11-20 - 22:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.FA886682CFC5D36718D3E436AACF10B9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.2014-05-30 - 01:45:52.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.2009-07-13 - 20:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.2009-07-13 - 18:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.2010-11-20 - 22:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.2010-11-20 - 22:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.2010-11-20 - 22:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.2009-07-13 - 18:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.2009-07-13 - 19:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.2011-04-26 - 21:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.2010-11-20 - 22:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.2014-01-23 - 21:37:55.) -- C:\Windows\system32\Drivers\ntfs.sys [1684928]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.2009-07-13 - 19:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.2010-11-20 - 22:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.2009-07-13 - 19:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.2010-11-20 - 22:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.2010-11-20 - 22:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 04s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/32
~ Mes musiques (My Musics) : 1/7
~ Mes Favoris (My Favorites) : 1/154
~ Mes Documents (My Documents) : 1/9
~ Mon Bureau (My Desktop) : 1/22
~ Menu demarrer (Programs) : 1/39
~ Hidden Files: Scanned in 00mn 00s
---\\ Processus lancés
[MD5.4FBC630768570E6AC35C3DE8F6EC79F5] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe [6970168] [PID.2208]
[MD5.5D61BE7DB55B026A5D61A3EED09D0EAD] - (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408] [PID.2536]
[MD5.BD2C0CDD525902E3033DAA8D08D0F015] - (.Intel Corporation - iusb3mon.) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848] [PID.2696]
[MD5.7EE68A122ED08E4AAD8DA551E34D2515] - (.Safer-Networking Ltd. - Spybot - Search & Destroy tray access.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576] [PID.2704]
[MD5.8A86F41B857DA166033B1795FE69BF37] - (.Almico Software (www.almico.com) - Pas de description.) -- C:\Program Files (x86)\SpeedFan\speedfan.exe [4683768] [PID.2844]
[MD5.3FAFBCCE3F066EDCC263E25A786FFD50] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe [21650016] [PID.3224]
[MD5.CDF01A5C7927786A708EAEE91F14797B] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\IEXPLORE.exe [812224] [PID.6376]
[MD5.E8B7FD67DA14A7BE57A5CB80E3139E60] - (.Google Inc. - Google Toolbar Broker.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe [309704] [PID.1648]
[MD5.33BF80A2291C54DC7D7601CDEF63138E] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8099328] [PID.4352]
[MD5.B362181ED3771DC03B4141927C80F801] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65432] [PID.1480]
[MD5.6B73E94F9FE82D45781B8C8A09483082] - (.Apple Inc. - YSLoader.exe.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [43336] [PID.1524]
[MD5.1F79342D9EB530A48742F651E570983A] - (.Microsoft Corporation - Updates Skype Click to Call.) -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176] [PID.1588]
[MD5.E4938E0A376CF0B9D989EE5C0A146891] - (.Microsoft Corporation - Phone Number Recognition (PNR) module.) -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520] [PID.1624]
[MD5.D84AEA3F3329D622DFC1297DDDF6163B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720] [PID.1776]
[MD5.4F45ED469906494F9BF754E476390DBD] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472] [PID.2092]
[MD5.397D14958D6C9C2B365469A857B2AC4E] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe [230792] [PID.2252]
[MD5.D777F1417D9BB9F66CD9D9C3B61F730F] - (.Safer-Networking Ltd. - Spybot-S&D 2 Scanner Service.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168] [PID.2248]
[MD5.68D6C7F99BC73B88954D844FCCBEB2A0] - (.Safer-Networking Ltd. - Spybot-S&D 2 Background update service.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408] [PID.572]
[MD5.9B9B368A8FF5CAF91D7A333CF62CD2CC] - (.Safer-Networking Ltd. - Windows Security Center integration..) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928] [PID.3236]
[MD5.9CCE733E5262FB92C2331E8578512B49] - (.Safer-Networking Ltd. - Update.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [4747720] [PID.6672]
~ Processes Running: Scanned in 00mn 10s
---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Preferences
G0 - GCSP: Preference [User Data\Default][HomePage] http://search.conduit.com
G2 - GCE: Preference [User Data\Default] [apdfllckaahabafndbhieahigkjlhalf] Google Drive v.6.3 (Activé)
G2 - GCE: Preference [User Data\Default] [dbaidnecjbnadknkpdlhicbamnjlccfg] The interpreter v.1.3 (Activé)
G2 - GCE: Preference [User Data\Default] [gjgkjeheegjnnmheaflhdocglkiegoni] Un périple à travers la Terre du Milieu v.0.0.1.3 (Désactivé)
G2 - GCE: Preference [User Data\Default] [kmendfapggjehodndflmmgagdbamhnfd] CryptoTokenExtension v.0.0.1 (Activé)
G2 - GCE: Preference [User Data\Default] [lopaplcmfjlfdkmaadlchgbgenjkfboe] Traduction Anglais Français v.2.8.8 (Activé)
G2 - GCE: Preference [User Data\Default] [mfffpogegjflfpflabcdkioaeobkgjik] GaiaAuthExtension v.0.0.1, (Activé)
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Wallet v.0.0.6.1 (Activé)
G2 - GCE: Preference [User Data\Default] [nppllibpnmahfaklnpggkibhkapjkeob] Norton Security Toolbar v.2014.7.6.17, (Désactivé)
G2 - GCE: Preference [User Data\Default] [pafkbggdmjlpgkdkcbjmhmfcdpncadgh] Google Now v.1.2.0.1 (Activé)
---\\ Liste des dossiers d'extension Google Chrome
~ Google Lines Browser: 25 Legitimates Filtered in 00mn 30s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\w7k7zyrl.default\prefs.js
M2 - MFEP: prefs.js [PC - w7k7zyrl.default\{18d5a8fe-5428-485b-968f-b97b05a92b54}] [] Astromenda Search Addon v1.2 (..) =>PUP.Astromenda
M2 - MFEP: Extension [PC - w7k7zyrl.default] {b9bfaf1c-a63f-47cd-8b9a-29526ced9060}
~ Firefox Browser: 9 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local>;*.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (15516)
~ Hosts File: Scanned in 00mn 19s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
O3 - Toolbar: Norton Identity Safe Toolbar - [HKLM]{A13C2648-91D4-4bf3-BC6D-0079707C4389} . (...) -- C:\Program Files (x86)\Norton Identity Safe\Engine64\2014.7.3.12\coIEPlg.dll
O3 - Toolbar: Norton Toolbar - [HKLM]{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} . (...) -- C:\Program Files (x86)\Norton 360\Norton 360\Engine64\21.5.0.19\coIEPlg.dll
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Applications lancées au démarrage du système (O4)
O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe =>.Realtek Semiconductor Corp
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKCU\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKLM\..\Wow6432Node\Run: [USB3MON] . (.Intel Corporation - iusb3mon.) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
O4 - HKLM\..\Wow6432Node\Run: [LWS] . (.Logitech Inc. - Logitech Webcam Software.) -- C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe =>.Logitech Inc
O4 - HKLM\..\Wow6432Node\Run: [SDTray] . (.Safer-Networking Ltd. - Spybot - Search & Destroy tray access.) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2731293000-1977296109-539070842-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2731293000-1977296109-539070842-1000\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
~ Application: Scanned in 00mn 00s
---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Skype Click to Call settings [64Bits] - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- c:\program files (x86)\skype\toolbars\internet explorer x64\icon.ico
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpDomain = gateway.2wire.net
O17 - HKLM\System\CS1\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpDomain = gateway.2wire.net
O17 - HKLM\System\CS2\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{2BB8BA75-1E72-4ECD-AA2C-39D949C32E65}: DhcpDomain = gateway.2wire.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (...) -- igfxdev.dll
O20 - Winlogon Notify: LBTWlgn . (.Logitech, Inc. - Logitech Bluetooth Service.) -- c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
~ Winlogon: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) . (.Safer-Networking Ltd. - Windows Security Center integration..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: AVG PC TuneUp Service (TuneUp.UtilitiesSvc) . (...) - C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe (.not file.)
~ Services: 14 Legitimates Filtered in 00mn 12s
---\\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [ATuning] (...) -- C:\Program Files (x86)\ASRock Utility\A-Tuning\Bin\ATuning.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [FileCure Default] (...) -- C:\Program Files (x86)\ParetoLogic\FileCure\FileCure.exe (.not file.) [0] =>PUP.Paretologic
[MD5.00000000000000000000000000000000] [APT] [ParetoLogic Update Version3 Startup Task] (...) -- C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe (.not file.) [0] =>PUP.Paretologic
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{2280F8F6-F4AB-4EEA-886E-E5F1BCE4A98F}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{24151242-5DAA-47E3-9691-367423F38358}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{27C60DA1-3532-4BB8-9519-622B1C3BFCC1}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{2A19A388-63F6-48E8-B7C1-B7F4E7D1CCEB}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{2FEF56E1-7CD4-43D3-8EB1-00384E7E3E6E}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{365CDB04-8701-4DDE-BD1F-62BBE348C3AE}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{393FB9E6-599D-4C73-858D-9B33D64525C5}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{4DECC12F-B3D2-4856-8C17-1F37FFA57FD2}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{50C78FF8-EBC6-48CC-947D-BBD3E65FC414}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{655D0907-B053-43BF-B545-DA9506176264}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{673BC69E-71E0-4C7F-9AC1-BE7446B322C6}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{6793B200-BEA1-4AAB-8E26-9B7094A13591}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{6BF9B303-983B-4CB0-9150-18EC002500B7}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{73DF704B-8850-470B-888D-0D9CB12C4CB2}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{7826EFCE-FBAF-4E6D-A90A-8D918D39AFF8}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{7F44EC4F-A4C1-4BEA-A7DE-6FA2D1FEB2C1}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{80FFBF07-9D9E-4B5F-9048-47952C14F11D}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{81C1086E-99FC-4C46-B778-6AA0CA8F156E}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{87331739-BFEC-474E-B1C7-2D249CD297BC}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{87AE38CA-21F6-4565-9BB6-D63B579FD0DE}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{8A292A91-56CC-44EB-90F4-7B7B782A8A48}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{A8E00CF6-A262-4B24-A600-344E78A1E2F8}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{B531D692-868D-408E-B31E-CEBBAAAB5206}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{B88C1787-017E-44F6-813F-23D33F098241}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{BECEF950-C315-4ACD-A13F-403D8DDD0C88}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{C05066AA-D729-43F8-8E16-D168FAEFBFE2}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{C707E465-B84E-4499-842D-C5C38ABB7E69}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{CB0B3977-1276-42E3-907D-D4DC20C8EB69}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{CE870E20-DA1A-4416-83D0-0035011597B3}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{D13FF831-1163-4D50-8A66-4EC99C908BA6}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{D6987A79-AE35-439A-B928-FE2C1793632F}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{DEDA031B-01FA-4C24-AADE-EB4CB84B498D}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{E5939AB6-1D1F-44B6-8F0A-C95356320B78}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.8756B799BE8B2F7B73F8F7231CB0A33A] [APT] [{E6A05030-8D95-4546-985C-2B2AAC36A609}] (...) -- C:\Users\PC\Downloads\lws110_x64.exe [53539128]
[MD5.00000000000000000000000000000000] [APT] [{EB3CB80E-6CDF-4D3E-9AE5-FD8ED7E56BE6}] (...) -- C:\Users\PC\Desktop\BACKUP\Users\Claude\Downloads\lws110_x64.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{F217AEC5-6C66-4398-AA69-5951DA5D23D0}] (...) -- C:\Users\PC\Downloads\lws110_x64 (1).exe (.not file.) [0]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater [1002]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore [1056]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA [1060]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\HP Photo Creations Communicator [318]
~ Scheduled Task: 65 Legitimates Filtered in 01mn 02s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\DriverRestore]
[HKCU\Software\DriverWhiz]
~ Key Software: 256 Legitimates Filtered in 00mn 00s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 2014-08-10 - 17:10:34 - [] ----D C:\Program Files (x86)\APO Usb Autorun
O43 - CFD: 2014-07-03 - 03:35:30 - [0] ----D C:\Program Files (x86)\GUM531E.tmp
O43 - CFD: 2014-08-19 - 23:49:20 - [0] -SH-D C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
O43 - CFD: 2014-08-19 - 23:49:20 - [0] -SH-D C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
~ 1 Dossier CLSID vide (CLSID Empty Folder)
~ Program Folder: 203 Legitimates Filtered in 00mn 02s
---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.62507E599AE37E91C1BEED8DE35E5236] - 2014-08-18 - 12:26:05 ---A- . (.AVG - AVG WinLogon Extension.) -- C:\Windows\System32\authuitu.dll [29496]
O44 - LFC:[MD5.40D653A452721F45F5FDCDF7C6A67569] - 2014-08-18 - 12:26:06 ---A- . (.AVG - AVG Registry Optimization Boot Application.) -- C:\Windows\System32\TURegOpt.exe [40248]
O44 - LFC:[MD5.0A34066D56D57C0DA73BFFC1E4169FF2] - 2014-08-25 - 12:58:42 ---A- . (...) -- C:\Windows\wininit.ini [85]
~ Files: 29 Legitimates Filtered in 00mn 14s
---\\ Contrôle du Safe Boot (CSB) (O49)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\CleanHlp.sys . (...) -- C:\Windows\System32\Drivers\CleanHlp.sys (.not file.)
O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\CleanHlp.sys . (...) -- C:\Windows\System32\Drivers\CleanHlp.sys (.not file.)
~ CSB: 15 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:2013-03-05 - 11:24:26 ----- . (...) -- C:\Windows\System32\Drivers\AQFileRestore.sys [21584]
O58 - SDL:2009-07-13 - 20:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:2009-06-10 - 15:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:2014-05-13 - 08:21:18 ---A- . (.Visicom Media Inc. - ManyCam Virtual Microphone.) -- C:\Windows\System32\Drivers\mcaudrv_x64.sys [35440]
O58 - SDL:2014-07-28 - 09:06:24 ---A- . (.Visicom Media Inc. - ManyCam Virtual Webcam Driver.) -- C:\Windows\System32\Drivers\mcvidrv.sys [49264]
O58 - SDL:2009-07-13 - 20:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
~ Drivers: 72 Legitimates Filtered in 00mn 14s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} [DefaultScope] - (Google) - https://www.google.com/?gws_rd=ssl
O69 - SBI: SearchScopes [HKCU] {C456BAF5-3C8B-49E9-B2B3-987BC16FC062} - ((www.google.com) Google) - https://www.google.com/?gws_rd=ssl
~ Keys: Scanned in 00mn 00s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.E920E867854B6B4DBD3485DB6F936F80] [SPRF][2014-08-15] (...) -- C:\ProgramData\ntuser.dat [262144]
~ Files: 1 Legitimates Filtered in 00mn 00s
---\\ Recherche de clés de registre Tracing (O100)
HKLM\SOFTWARE\Microsoft\Tracing\BackupStack_RASAPI32 =>PUP.MyPCBackup
HKLM\SOFTWARE\Microsoft\Tracing\BackupStack_RASMANCS =>PUP.MyPCBackup
HKLM\SOFTWARE\Microsoft\Tracing\Signup Wizard_RASAPI32 =>PUP.JDIBackup
HKLM\SOFTWARE\Microsoft\Tracing\Signup Wizard_RASMANCS =>PUP.JDIBackup
~ BTK: 126 Legitimates Filtered in 00mn 00s
---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 2014-08-26 262320 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 2014-06-13 279000 | (cphs) . (.Intel Corporation.) - C:\Windows\SysWow64\IntelCpHeciSvc.exe
SS - | Auto 2014-07-03 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 2014-07-03 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 2014-08-07 194032 | (gusvc) . (.Google.) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Demand 2012-04-24 169752 | (ICCS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
SS - | Demand 2013-07-01 822232 | (Intel(R) Capability Licensing Service TCP IP Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe
SS - | Demand 2014-08-01 641352 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SS - | Demand 2014-03-24 357144 | (LBTServ) . (.Logitech, Inc..) - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
SS - | Demand 2014-08-10 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Auto 2014-04-03 315008 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Auto 1658-07-10 0 | (TuneUp.UtilitiesSvc) . (...) - C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
SS - | Demand 2009-07-13 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 2014-05-08 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 2014-06-12 43336 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 2011-08-30 462184 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Auto 2014-06-13 315352 | (igfxCUIService1.0.0.0) . (.Intel Corporation.) - C:\Windows\System32\igfxCUIService.exe
SR - | Auto 2013-07-01 733696 | (Intel(R) Capability Licensing Service Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
SR - | Auto 2014-06-24 2820424 | (MaConfigAgent) . (.CybelSoft.) - C:\Program Files\ma-config.com\MaConfigAgent.exe
SR - | Auto 2014-05-12 1809720 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
SR - | Auto 2014-05-12 860472 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
SR - | Auto 2014-03-11 23808 | (MsMpSvc) . (.Microsoft Corporation.) - c:\Program Files\Microsoft Security Client\MsMpEng.exe
SR - | Auto 2014-06-26 130104 | (NCO) . (.Symantec Corporation.) - C:\Program Files (x86)\Norton Identity Safe\Engine\2014.7.3.12\NST.exe
SR - | Auto 2014-06-24 1738168 | (SDScannerService) . (.Safer-Networking Ltd..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
SR - | Auto 2014-06-27 2088408 | (SDUpdateService) . (.Safer-Networking Ltd..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
SR - | Auto 2014-04-25 171928 | (SDWSCService) . (.Safer-Networking Ltd..) - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
SR - | Demand 1658-07-10 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 2009-07-13 27136 | C:\Windows\system32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 21s
---\\ Scan Additionnel (O88)
Database Version : 13026 - (2014-08-28)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 1
Fichiers trouvés (Files found) : 0
C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\w7k7zyrl.default\extensions\{18d5a8fe-5428-485b-968f-b97b05a92b54} =>PUP.Astromenda^
~ Additionnel Scan: 289152 Items scanned in 00mn 48s
---\\ Informations complémentaires sur les modules
~ https://nicolascoolman.eu =>.Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
~ https://nicolascoolman.eu =>.Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
~ https://nicolascoolman.eu =>.Internet Explorer, Proxy Management (R5)
~ https://nicolascoolman.eu =>.Internet Explorer Toolbars (O3)
~ https://nicolascoolman.eu =>.Applications lancées au démarrage du système (O4)
~ AMI: 5 Legitimates Filtered in 00mn 00s
---\\ Récapitulatif des détections trouvées sur votre station
https://nicolascoolman.eu =>PUP.Astromenda
http://nicolascoolman.fr/30068076-pup-paretologic =>PUP.Paretologic
https://nicolascoolman.eu =>PUP.MyPCBackup
~ MSI: 3 link(s) detected in 00mn 00s
~ 860 Legitimates filtered by white list
End of the scan (475 lines in 05mn 14s)(0)
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Utilisateur anonyme
29 août 2014 à 07:17
29 août 2014 à 07:17
Bonjour
1) Commence par désinstaller Spybot,logiciel obsolète et qui ne sert à rien.
2)Poste moi un rapport de Malwaresbytes
Merci
@+
1) Commence par désinstaller Spybot,logiciel obsolète et qui ne sert à rien.
2)Poste moi un rapport de Malwaresbytes
Merci
@+
