comment activer zhpfixRésolu/Fermé

Question

Bonsoir,
                                              Ma page  firefox est masquée à l'ouverture par un malveillant.
   J'ai fait ZHPDIAG que j'ai reporté sur le bureau.
Je suis passé sur ZHPFIX et suis bloqué, je ne vois pas Quels boutons activer, pouvez vous me renseigner ?
                                                                   Merci d'avance.

https://www.cjoint.com/?CDzvAZ1tdrg

juju666 · Answer

Bonsoir,

 Ma page firefox est masquée à l'ouverture par un malveillant.  

Tu peux en dire plus stp ? 
La capture de ZHPFix ne nous intéresse pas, si on ne connait pas les problèmes initiaux ... 
A la limite, tu aurais posté le rapport de ZHPDiag mais là, tu parles dans le vide :)

Et tout le monde n'utilise pas ZHPDiag/fix, chacun sa méthode.
Donc dis nous en plus stp. 
C'est par ceci que tu es bloqué ? :

A+

perfido · Answer

Merci pour ton intervention Lorsque j'ouvre firefox je trouve https://www.cjoint.com/?CDzwMfwIGKm Fonctionnalités de Firefo Mozilla mozilla * Ordinateur * Mobile ¬ * Modules * Assistance * À propos * Accès presse * FirefoxTéléchargement gratuit Respect de la vie privée - Autres langues et systèmes Fonctionnalités de Firefox Toute une gamme de super fonctionnalités pour améliorer votre navigation. * Navigation facilitée * Performances élevées * Sécurité renforcée * Personnalisation développée * Technologies de pointe * Accès universel Fonctionnalités principales (survolez pour en savoir plus) * Rapidité * Synchronisation * Personnalisation facile * Barre intelligente * Interface intuitive Haut de la page Navigation facilitée Rapport de ZHPDiag v2013.4.24.149 par Nicolas Coolman, Update du 24/04/2013 Run by User at 25/04/2013 22:04:49 State : Version à jour. WhiteList : Enable High Elevated Privileges : OK UAC : Deactivate by user ---\ Web Browser MSIE: Internet Explorer v9.0.8112.16421 MFIE: Mozilla Firefox 20.0.1 (Defaut) GCIE: Google Chrome v26.0.1410.64 ---\ Windows Product Information ~ Langage: Français Windows 7 Business Edition, 64-bit Service Pack 1 (Build 7601) Windows Server License Manager Script : OK ~ Windows(R) 7, OEM_SLP channel System Locked Preinstallation (OEM_SLP) : OK Windows ID Activation : OK ~ Windows Partial Key : 24367 Windows License : OK ~ Windows Remaining Initializations Number : 2 Software Protection Service (Protection logicielle) : OK Windows Automatic Updates : OK Windows Activation Technologies : OK ---\ System Protection AVG 2013 v13.0.3162 Windows Defender W7 ---\ System Optimizer ---\ Software Update Adobe Flash Player 11 Plugin Adobe Reader X Java 7 Update 6 Java 7 Update 9 ---\ System Information ~ Processor: Intel64 Family 6 Model 42 Stepping 7, GenuineIntel ~ Operating System: 64 Bits Boot mode: Normal (Normal boot) Total RAM: 3916 MB (60% free) System Restore: Activé (Enable) System drive C: has 401 GB (88%) free of 451 GB ---\ Logged in mode ~ Computer Name: USER-THINK ~ User Name: User ~ All Users Names: User, LogMeInRemoteUser, HomeGroupUser$, Administrateur, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\ Environnement Variables ~ System Unit : C:\ ~ %AppData% : C:\Users\User\AppData\Roaming\ ~ %Desktop% : C:\Users\User\Desktop\ ~ %Favorites% : C:\Users\User\Favorites\ ~ %LocalAppData% : C:\Users\User\AppData\Local\ ~ %StartMenu% : C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\ DOS/Devices C:\ Hard drive, Flash drive, Thumb drive (Free 401 Go of 451 Go) D:\ CD-ROM drive (Not Inserted) Q:\ Hard drive, Flash drive, Thumb drive (Free 4 Go of 14 Go) ---\ Security Center & Tools Informations [HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK [HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK [HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : OK ~ Security Center: Scanned in 00mn 00s ---\ Recherche particulière de fichiers génériques [MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.08/12/2011 - 21:56:11.) -- C:\Windows\Explorer.exe [2871808] [MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024] [MD5.A4F6142CABA82FB7293ECE5FF864B440] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.22/02/2013 - 07:20:51.) -- C:\Windows\System32\wininet.dll [1392128] [MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.21/11/2010 - 04:24:29.) -- C:\Windows\System32\Winlogon.exe [390656] [MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.21/11/2010 - 04:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448] [MD5.1C7857B62DE5994A75B054A9FD4C3825] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.23/06/2012 - 07:57:07.) -- C:\Windows\system32\Drivers\AFD.sys [498688] [MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128] [MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160] [MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456] [MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400] [MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368] [MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472] [MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224] [MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.08/12/2011 - 21:58:09.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208] [MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 04:23:51.) -- C:\Windows\system32\Drivers etBT.sys [261632] [MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers tfs.sys [1656680] [MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280] [MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 04:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536] [MD5.1B6163C503398B23FF8B939C67747683] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.21/11/2010 - 04:25:07.) -- C:\Windows\system32\Drivers dpdr.sys [165888] [MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184] [MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 04:24:32.) -- C:\Windows\system32\Drivers dx.sys [119296] [MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/11/2010 - 04:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808] ~ Generic Processes: Scanned in 00mn 00s ---\ Etat des fichiers cachés (Caché/Total) ~ Mes images (My Pictures) : 1/45 ~ Mes Favoris (My Favorites) : 1/23 ~ Mes Documents (My Documents) : 5/221 ~ Mon Bureau (My Desktop) : 1/612 ~ Menu demarrer (Programs) : 1/28 ~ Hidden Files: Scanned in 00mn 00s ---\ Processus lancés [MD5.D9C8DC2D7EC28E3FF25C99EF17C8631A] - (...) -- C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [2787280] [PID.1880] =>Toolbar.Babylon [MD5.BA92C496F08D78F7DB263A20C36AA546] - (.AVG Technologies CZ, s.r.o. - AVG User Interface.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe [4394032] [PID.2952] [MD5.D722AA885336EDBA2AC0EB4D8E15D050] - (.SPAMfighter ApS - FIGHTERtools Update Manager.) -- C:\Program Files (x86)\Fighters\Tray\FightersTray.exe [1405544] [PID.2968] [MD5.AE94B9E946239BF390AA8918CADFCE40] - (.SPAMfighter ApS - SPAMfighter Agent.) -- C:\Program Files (x86)\Fighters\SPAMfighter\sfagent.exe [1460768] [PID.3060] [MD5.7DFA6844BB54E6FE73E0032877AE6793] - (.Symantec Corporation - Symantec VIP Access.) -- C:\Program Files (x86)\Symantec\VIP Access Client\VIPUIManager.exe [1666704] [PID.4480] [MD5.1321DC81E317EE48C4D004775FB29AC9] - (.Nicolas Coolman - ZHPDiag Setup.) -- C:\Program Files (x86)\ZHPDiag\ZHPhep.exe [1916928] [PID.960] [MD5.8ECBD447964D1D003FF0ADAA10AE3376] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [6987264] [PID.3920] [MD5.3927397AC60D943DAF8808AFFED582B7] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65192] [PID.1732] [MD5.0D8244A9DB70BC6C36E2FB56F6039AB6] - (.AVG Technologies CZ, s.r.o. - AVG Identity Protection Service.) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4937264] [PID.1784] [MD5.DC98337F0D2A9F6C0B6FB682297ECE3B] - (.AVG Technologies CZ, s.r.o. - AVG Watchdog Service.) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [282624] [PID.1820] [MD5.63511240AF70D10343A4AE05F8E2CA12] - (.Lenovo - RapidBoot HDD Accelerator Service.) -- C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [169776] [PID.2012] [MD5.BB3FAB073189F3BBC5F0BD30A1FF5377] - (.Pas de propriétaire - Installer.) -- C:\ProgramData\IBUpdaterService\ibsvc.exe [649984] [PID.1404] =>Adware.InstallBrain [MD5.5A9894E80575647DC77A7D1954B05CE7] - (.Intel Corporation - Intel IPT Host Interface Service.) -- C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe [212944] [PID.2392] [MD5.11E09CE1C14E76F9A658D02198365F37] - (.Lenovo Group Limited - Camera Mute Control Service for ThinkPad.) -- C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe [58192] [PID.2420] [MD5.D7D72179E2696F6DB6CD082984A3400E] - (.Lenovo Group Limited - Microphone volume control service.) -- C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe [61264] [PID.2456] [MD5.5FECAD752E908D92EA8BD3E9E3862C98] - (.Lenovo - Power Manager Dynamic Brightness Control Se.) -- C:\Program Files (x86)\Lenovo\PowerMgr\PWMDBSVC.exe [70968] [PID.2640] [MD5.ACEE95093C47CE3EC342578EE5F47E01] - (.SPAMfighter ApS - SPAMfighter Update Service.) -- C:\Program Files (x86)\Fighters\SPAMfighter\sfus.exe [216608] [PID.2728] [MD5.DE43E582B80C4DF7D6425A42BCABB90A] - (.SPAMfighter ApS - Fighter Suite Service.) -- C:\Program Files (x86)\Fighters\FighterSuiteService.exe [1270376] [PID.2776] [MD5.BE788A747457E6916586C410EC0111E7] - (.Ulead Systems, Inc. - ULCDRSvr.) -- C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [61440] [PID.3536] [MD5.545462D0DBE24AF379BA869B7C185CCD] - (.Intel Corporation - IAStorDataSvc.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [13592] [PID.2712] [MD5.BF22ACF4CF3734D61357E67F0521BC03] - (.Intel Corporation - Local Manageability Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [277784] [PID.5796] [MD5.A9C45E3CFD3054EF391827BCF0BF1F61] - (.Symantec Corporation - Symantec VIPAppService.) -- C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe [81552] [PID.5900] [MD5.B097EBA0E3FEB020BB65FE43AF5ECCFF] - (.Intel Corporation - User Notification Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [363800] [PID.3548] ~ Processes Running: Scanned in 00mn 00s ---\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2) C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Preferences ~ Google Browser: Scanned in 00mn 00s ---\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\prefs.js C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\user.js M3 - MFPP: Plugins - [User] -- C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\searchplugins\amazon.xml M3 - MFPP: Plugins - [User] -- C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\searchplugins\babylon.xml =>Toolbar.Babylon M3 - MFPP: Plugins - [User] -- C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\searchplugins\BrowserProtect.xml =>Toolbar.Babylon M3 - MFPP: Plugins - [User] -- C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\searchplugins\delta.xml M3 - MFPP: Plugins - [User] -- C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\searchplugins\fileconverter-15-customized-web-search.xml M3 - MFPP: Plugins - [User] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\babylon.xml =>Toolbar.Babylon M3 - MFPP: Plugins - [User] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\portaldosites.xml M0 - MFSP: prefs.js [User - vn2atj3w.default] https://www.mozilla.org/en-US/ M2 - MFEP: prefs.js [User - vn2atj3w.default\SpecialSavings@SpecialSavings.com] [] SpecialSavings v2.0.0.1 (..) ~ Firefox Browser: 20 Legitimates Filtered in 00mn 00s ---\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4) R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www2.delta-search.com =>Toolbar.DeltaSearch R4 - HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,EnabledV8 = 1 R4 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\PhishingFilter,EnabledV8 = 1 ~ IE Browser: 14 Legitimates Filtered in 00mn 00s ---\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe ~ Keys: Scanned in 00mn 00s ---\ Redirection du fichier Hosts (O1) O1 - Hosts: 0.0.0.0 boxore.com =>Adware.Boxore O1 - Hosts: 0.0.0.0 www.boxore.com =>Adware.Boxore O1 - Hosts: 0.0.0.0 boxore.org =>Adware.Boxore O1 - Hosts: 0.0.0.0 www.boxore.org =>Adware.Boxore O1 - Hosts: 0.0.0.0 boxore.net =>Adware.Boxore O1 - Hosts: 0.0.0.0 www.boxore.net =>Adware.Boxore O1 - Hosts: 0.0.0.0 dlmanager.com O1 - Hosts: 0.0.0.0 www.dlmanager.com O1 - Hosts: 0.0.0.0 dlmanager.org O1 - Hosts: 0.0.0.0 www.dlmanager.org O1 - Hosts: 0.0.0.0 dlmanager.net O1 - Hosts: 0.0.0.0 www.dlmanager.net ~ Hosts File: Scanned in 00mn 00s ~ Nombre de lignes (Lines number): 34 ---\ Browser Helper Objects de navigateur (O2) O2 - BHO: SpecialSavings [64Bits] - {938958E8-355C-49FF-92B0-53C1B87ACEA9} . (.SpecialSavings.com - ScriptHost.) -- C:\Program Files (x86)\SpecialSavings\ScriptHost.dll ~ BHO: 8 Legitimates Filtered in 00mn 00s ---\ Applications démarrées par registre & par dossier (O4) O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Wow6432Node\Run: [AVG_UI] . (.AVG Technologies CZ, s.r.o. - AVG User Interface.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe O4 - HKLM\..\Wow6432Node\Run: [CommonToolkitTray] . (.SPAMfighter ApS - FIGHTERtools Update Manager.) -- C:\Program Files (x86)\Fighters\Tray\FightersTray.exe O4 - HKLM\..\Wow6432Node\Run: [sfagent] . (.SPAMfighter ApS - SPAMfighter Agent.) -- C:\Program Files (x86)\Fighters\SPAMfighter\sfagent.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe ~ Application: Scanned in 00mn 00s ---\ Autres liens utilisateurs (O4) O4 - GS\TaskBar: FreeOCR.lnk . (...) -- C:\FreeOCR\FreeOCR.exe O4 - GS\TaskBar: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe O4 - GS\TaskBar: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe http://www.portaldosites.com O4 - GS\TaskBar: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O4 - GS\TaskBar: Windows Media Player.lnk . (.Microsoft Corporation - Lecteur Windows Media.) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe O4 - GS\TaskBar: ZHPFix.lnk . (.Nicolas Coolman - ZHPFix.) -- C:\Program Files (x86)\ZHPFix\ZHPFix.exe O4 - GS\Programs: Internet Explorer (64-bit).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\QuickLaunch: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe http://www.portaldosites.com O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Accessories: Private Character Editor.lnk . (.Microsoft Corporation - Éditeur de caractères privés.) -- C:\Windows\system32\eudcedit.exe O4 - GS\SendTo: Desk 365.lnk . (...) -- C:\Program Files (x86)\Desk 365\desk365.exe (.not file.) O4 - GS\SendTo: Fax Recipient.lnk . (.Microsoft Corporation - Microsoft Windows Fax and Scan.) -- C:\Windows\system32\WFS.exe O4 - GS\SendTo: Transfert de fichiers Bluetooth.LNK . (.Microsoft Corporation - Pas de description.) -- C:\Windows\System32\fsquirt.exe O4 - GS\Desktop: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe http://www.portaldosites.com O4 - GS\Desktop: Microsoft Office - Raccourci.lnk . (...) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office O4 - GS\Desktop: Microsoft Office Excel 2007.lnk . (...) -- C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe O4 - GS\Desktop: Microsoft Office Word 2007.lnk . (...) -- C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe O4 - GS\Desktop: Paint (2).lnk . (.Microsoft Corporation - Paint.) -- C:\Windows\system32\mspaint.exe O4 - GS\Desktop: Paint.lnk . (.Microsoft Corporation - Paint.) -- C:\Windows\system32\mspaint.exe O4 - GS\Desktop: PhotoFiltre.lnk . (.Antonio Da Cruz - PhotoFiltre.) -- C:\Program Files (x86)\PhotoFiltre\PhotoFiltre.exe O4 - GS\Desktop: Windows Live Mail (2).lnk . (.Microsoft Corporation - Windows Live Mail.) -- C:\Program Files (x86)\Windows Live\Mail\wlmail.exe O4 - GS\Desktop: ZHPFix 2013 - Raccourci (2).lnk . (...) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHPFix 2013 O4 - GS\Desktop: ZHPFix 2013 - Raccourci (3).lnk . (...) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHPFix 2013 O4 - GS\Desktop: ZHPFix 2013 - Raccourci.lnk . (...) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHPFix 2013 ~ Global Startup: Scanned in 00mn 00s ---\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{5078CA81-73E2-4B3E-B198-F4EAFFB00E65}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{5078CA81-73E2-4B3E-B198-F4EAFFB00E65}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{5078CA81-73E2-4B3E-B198-F4EAFFB00E65}: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 ~ Domain: Scanned in 00mn 00s ---\ Protocole additionnel (O18) O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) -- O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll ~ Protocole Additionnel: Scanned in 00mn 00s ---\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: GoToAssist . (.Citrix Online, a division of Citrix Systems - Citrix Online GoToAssist Corporate.) -- C:\Program Files (x86)\Citrix\GoToAssist\759\G2AWinLogon_x64.dll O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll ~ Winlogon: Scanned in 00mn 00s ---\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: BrowserProtect (BrowserProtect) . (...) - C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe =>Toolbar.Babylon O23 - Service: FastbootService (FastbootService) . (.Lenovo - RapidBoot HDD Accelerator Service.) - C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe O23 - Service: Updater Service (IBUpdaterService) . (.Pas de propriétaire - Installer.) - C:\ProgramData\IBUpdaterService\ibsvc.exe =>Adware.InstallBrain O23 - Service: Lenovo Camera Mute (LENOVO.CAMMUTE) . (.Lenovo Group Limited - Camera Mute Control Service for ThinkPad.) - C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe O23 - Service: Lenovo Keyboard Noise Reduction (LENOVO.TPKNRSVC) . (.Lenovo Group Limited - Microphone volume control service.) - C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe O23 - Service: Power Manager DBC Service (Power Manager DBC Service) . (.Lenovo - Power Manager Dynamic Brightness Control Se.) - C:\Program Files (x86)\Lenovo\PowerMgr\PWMDBSVC.exe O23 - Service: Skdaemon Service (Sks8821) . (...) - C:\Program Files\Lenovo\Lenovo Slim USB Keyboard\Sks8821.exe O23 - Service: VIPAppService (VIPAppService) . (.Symantec Corporation - Symantec VIPAppService.) - C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe O23 - Service: (vToolbarUpdater14.2.0) . (...) - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe (.not file.) =>Toolbar.AVGSearch ~ Services: 23 Legitimates Filtered in 00mn 08s ---\ Tâches planifiées en automatique (O39) [MD5.534C82F1D7246EDF654B5257CA82FE70] [APT] [DealPly] (...) -- C:\Users\User\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.exe [93728] =>PUP.DealPly [MD5.00000000000000000000000000000000] [APT] [DealPlyUpdate] (...) -- C:\Program Files (x86)\DealPly\DealPlyUpdate.exe (.not file.) [0] =>PUP.DealPly [MD5.00000000000000000000000000000000] [APT] [Desk 365 RunAsStdUser] (...) -- C:\Program Files (x86)\Desk 365\desk365.exe (.not file.) [0] [MD5.65611587D8245CE8DB9E306D239EE22F] [APT] [EPUpdater] (...) -- C:\Users\User\AppData\Roaming\BabSolution\Shared\BabMaint.exe [9808] =>Hijacker.BabSolution [MD5.00000000000000000000000000000000] [APT] [MCP] (...) -- C:\Program Files (x86)\LENOVO\Message Center Plus\MCPLaunch.exe (.not file.) [0] [MD5.DB175958FDF8DE7F3E1E3AC6E24D81EF] [APT] [PMTask] (.Lenovo Group Limited.) -- C:\Program Files (x86)\Lenovo\PowerMgr\PWMIDTSV.exe [169272] [MD5.7F91A8D7192B1664D4C4B19996ED8281] [APT] [Test TimeTrigger] (...) -- C:\Users\User\AppData\Local\Temp\Runner.exe [40587] [MD5.295E67A34ACF7525C65E3B72F0146005] [APT] [{14926FEE-1575-4A1A-89A8-00FE09161CEE}] (.SPAMfighter ApS.) -- C:\Users\User\Downloads\spamfighter_web.exe [2581368] [MD5.295E67A34ACF7525C65E3B72F0146005] [APT] [{185AAE90-66AC-4744-8ECC-D1A9885580AC}] (.SPAMfighter ApS.) -- C:\Users\User\Downloads\spamfighter_web.exe [2581368] [MD5.295E67A34ACF7525C65E3B72F0146005] [APT] [{3B158F06-B3BE-428D-B24D-3C4B1AED66D2}] (.SPAMfighter ApS.) -- C:\Users\User\Downloads\spamfighter_web.exe [2581368] [MD5.295E67A34ACF7525C65E3B72F0146005] [APT] [{9601BC2B-7D18-4A2F-9275-91B433F4CE72}] (.SPAMfighter ApS.) -- C:\Users\User\Downloads\spamfighter_web.exe [2581368] [MD5.295E67A34ACF7525C65E3B72F0146005] [APT] [{F6BB7E90-674E-4B48-B63F-751BE71D090E}] (.SPAMfighter ApS.) -- C:\Users\User\Downloads\spamfighter_web.exe [2581368] [MD5.2235796E99BDC3FFA45B93556E97FE5B] [APT] [TVSUUpdateTask] (...) -- C:\Program Files (x86)\Lenovo\System Update vsuShim.exe [184680] ~ Scheduled Task: 31 Legitimates Filtered in 00mn 01s ---\ Logiciels installés (O42) O42 - Logiciel: SpecialSavings - (.SpecialSavings.com.) [HKLM][64Bits] -- SpecialSavings O42 - Logiciel: Updater Service - (...) [HKLM][64Bits] -- Updater Service ~ Logic: 85 Legitimates Filtered in 00mn 00s ---\ HKCU & HKLM Software Keys [HKCU\Software\AppDataLow\Software\Smartbar] =>Hijacker.SmartBar [HKCU\Software\DataMngr] =>PUP.Datamngr [HKCU\Software\DataMngr_Toolbar] =>PUP.Datamngr [HKCU\Software\Duuqu] [HKCU\Software\LiveKit] [HKCU\Software\e28cd8e269e517] [HKLM\Software\LTON_HIS] [HKLM\Software\Wow6432Node\Babylon] =>Toolbar.Babylon [HKLM\Software\Wow6432Node\DataMngr] =>PUP.Datamngr [HKLM\Software\Wow6432Node\Duuqu] [HKLM\Software\Wow6432Node\ThinkVantage] [HKLM\Software\Wow6432Node\e28cd8e269e517] ~ Key Software: 167 Legitimates Filtered in 00mn 00s ---\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 22/04/2013 - 05:25:48 - [0,062] ----D C:\Program Files (x86)\mixiedj O43 - CFD: 25/04/2013 - 18:37:30 - [1,467] ----D C:\Program Files (x86)\SpecialSavings O43 - CFD: 25/04/2013 - 18:36:55 - [0] ----D C:\ProgramData\Babylon =>Toolbar.Babylon O43 - CFD: 25/04/2013 - 18:37:25 - [7,800] ----D C:\ProgramData\BrowserProtect =>Toolbar.Babylon O43 - CFD: 16/12/2012 - 11:52:32 - [0,003] ----D C:\ProgramData\clp O43 - CFD: 25/04/2013 - 18:36:54 - [0,622] ----D C:\ProgramData\IBUpdaterService =>Adware.InstallBrain O43 - CFD: 25/04/2013 - 18:37:18 - [1,933] ----D C:\Users\User\AppData\Roaming\BabSolution =>Hijacker.BabSolution O43 - CFD: 17/04/2013 - 22:51:33 - [0,081] ----D C:\Users\User\AppData\Roaming\Babylon =>Toolbar.Babylon O43 - CFD: 23/04/2013 - 05:46:59 - [0,090] ----D C:\Users\User\AppData\Roaming\DealPly =>PUP.DealPly O43 - CFD: 23/04/2013 - 15:16:18 - [11,815] ----D C:\Users\User\AppData\Roaming\Desk 365 O43 - CFD: 23/04/2013 - 15:14:13 - [5,560] ----D C:\Users\User\AppData\Roaming\eIntaller O43 - CFD: 17/04/2013 - 22:51:32 - [0,308] ----D C:\Users\User\AppData\Roaming\File Scout O43 - CFD: 01/12/2012 - 15:39:59 - [1,402] ----D C:\Users\User\AppData\Roaming\LiveKit O43 - CFD: 30/08/2012 - 16:58:42 - [0,009] ----D C:\Users\User\AppData\Roaming\LSC O43 - CFD: 20/04/2013 - 05:03:41 - [27,280] ----D C:\Users\User\AppData\Roaming\OpenCandy =>Adware.OpenCandy O43 - CFD: 25/04/2013 - 18:37:32 - [0,066] ----D C:\Users\User\AppData\Roaming\SpecialSavings O43 - CFD: 24/04/2013 - 11:16:40 - [0,138] ----D C:\Users\User\AppData\Roaming\Yontoo =>PUP.Yontoo O43 - CFD: 22/04/2013 - 05:22:45 - [0] ----D C:\Users\User\AppData\Local\Duuqu O43 - CFD: 25/04/2013 - 17:50:39 - [0] ----D C:\Users\User\AppData\Local\Lollipop =>Adware.Lollipop O43 - CFD: 30/08/2012 - 17:15:21 - [0,250] ----D C:\Users\User\AppData\Local\LSC O43 - CFD: 23/04/2013 - 15:34:07 - [0] ----D C:\Users\User\AppData\Local\Tiger Savings O43 - CFD: 25/04/2013 - 18:37:28 - [0,001] ----D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserProtect =>Toolbar.Babylon O43 - CFD: 23/04/2013 - 05:46:58 - [0,001] ----D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly =>PUP.DealPly O43 - CFD: 23/04/2013 - 08:52:07 - [0,002] ----D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\QTRAX ~ 148 Dossiers CLSID vides (CLSID Empty Folders) ~ Program Folder: 354 Legitimates Filtered in 00mn 01s ---\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.A69FE04618C8F6A0C6B9565C83DBE841] - 24/04/2013 - 14:47:39 ---A- . (...) -- C:\DelFix.txt [361] O44 - LFC:[MD5.815372073DA85B2098A37DED84083C8A] - 24/04/2013 - 04:55:04 ---A- . (...) -- C:\Windows\_MSRSTRT.EXE [2560] O44 - LFC:[MD5.882D792A41DD9CFE1F87B7AB40F446E1] - 23/04/2013 - 07:34:51 ---A- . (...) -- C:\Windows\BUZZTWLC.INI [101] O44 - LFC:[MD5.73B0CE289F75A103DFA3F5CDC9513970] - 20/04/2013 - 12:36:14 ---A- . (...) -- C:\Windows\AVControl.ini [90] O44 - LFC:[MD5.87E5AAE1AA9431EF1DDEDC46D2145BDB] - 20/04/2013 - 12:36:09 ---A- . (...) -- C:\Windows\DDRLog.ini [32] ~ Files: 19 Legitimates Filtered in 00mn 01s ---\ MountPoints2 Shell Key (O51) O51 - MPSK:{27b4c52e-bcad-11e1-a26d-806e6f6e6963}\AutoRun\command. (.Lenovo Group Limited - Lenovo Factory Backup Partition Information.) -- Q:\LenovoQDrive.exe ~ Keys: Scanned in 00mn 00s ---\ ShareTools MSconfig StartupReg (O53) O53 - SMSR:HKLM\...\startupreg\sfagent [Key] . (.SPAMfighter ApS - SPAMfighter Agent.) -- C:\Program Files (x86)\Fighters\SPAMfighter\sfagent.exe ~ SMSR Keys: 15 Legitimates Filtered in 00mn 00s ---\ Microsoft Windows Policies System (O55) O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0 O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0 O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 ~ MWPS: 16 Legitimates Filtered in 00mn 00s ---\ Microsoft Windows Policies Explorer (O56) O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1 ~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s ---\ Liste des Drivers Système (O58) O58 - SDL:[MD5.2F6B34B83843F0C5118B63AC634F5BF4] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [491088] O58 - SDL:[MD5.A4E07DA3AE2078BD96E84D4BAA07B71D] - 23/12/2004 - 03:47:10 R--A- . (.Ulead Systems, Inc. - ULCDRHlp driver.) -- C:\Windows\SysWOW64\drivers\ULCDRHlp.sys [27392] ~ Drivers: Scanned in 00mn 00s ---\ Liste des outils de nettoyage (O63) O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 O63 - Logiciel: ZHPFix 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPFix_is1 ~ ADS: Scanned in 00mn 00s ---\ Liste des services Legacy (O64) O64 - Services: CurCS - 24/07/2008 - C:\Windows\system32\drivers\LMIRfsDriver.sys (LMIRfsDriver) .(.LogMeIn, Inc. - LogMeIn Rfs Drivemap Driver.) - LEGACY_LMIRFSDRIVER O64 - Services: CurCS - 10/06/2009 - C:\Windows\System32\Drivers\secdrv.sys (secdrv) .(.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) - LEGACY_SECDRV ~ Legacy: 122 Legitimates Filtered in 00mn 00s ---\ File Associations Shell Spawning (O67) O67 - Shell Spawning: <.reg> [HKLM\..\open\Command] (.Not Key.) O67 - Shell Spawning: <.reg> [HKCR\..\open\Command] (.Not Key.) ~ FASS Keys: 19 Legitimates Filtered in 00mn 00s ---\ Start Menu Internet (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\ Search Browser Infection (O69) O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("browser.search.defaultthis.engineName", "FileConverter 1.5 Customized Web Search"); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("browser.search.defaulturl", "http://search.conduit.com/ResultsExt.aspx?ctid=CT3241952&CUI=UN38232132948890256&UM=1&Sear[...] O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("CT3241952.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"http://search.conduit.com/?ctid=CT3241952&octid=CT3[...] O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("CT3241952.SearchFromAddressBarUrl", "http://search.conduit.com/ResultsExt.aspx?ctid=CT3241952&SearchSource=2&CUI=UN3823[...] O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.admin", false); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.aflt", "babsst"); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}"); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.autoRvrt", "fals O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.bbDpng", "23"); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.cntry", "FR"); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.dfltLng", "en");user O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.ffxUnstlRst", true); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.instlDay", "15818"); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.instlRef", "sst"); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.lastVrsnTs", "1.8.16.168:49:40"); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.newTab", false); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.prdct", "delta"); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.prtnrId", "delta"); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.rvrt", "false"); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.sg", "tzb"); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.smplGrp", "none"); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.tlbrId", "base"); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.tlbrSrchUrl", ""); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.vrsn", "1.8.16.16"); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.vrsni", "1.8.16.16"); O69 - SBI: prefs.js [User - vn2atj3w.default] user_pref("extensions.delta.vrsnTs", "1.8.16.168:49:40"); O69 - SBI: SearchScopes [HKCU] {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} - (Delta Search) - http://www2.delta-search.com =>Toolbar.DeltaSearch O69 - SBI: SearchScopes [HKCU] {4C4C7AAB-5854-4241-A414-E2F1EF119C4A} [DefaultScope] - (DnsBasic) - http://www.dnsbasic.com O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Google) - https://www.google.com/?gws_rd=ssl O69 - SBI: SearchScopes [HKCU] {B3B3A6AC-74EC-BD56-BCDB-EFA4799FB9DF} - (Amazon) - https://www.amazon.fr/ O69 - SBI: SearchScopes [HKUS\.DEFAULT] {4C4C7AAB-5854-4241-A414-E2F1EF119C4A} - (DnsBasic) - http://www.dnsbasic.com O69 - SBI: SearchScopes [HKUS\S-1-5-18] {4C4C7AAB-5854-4241-A414-E2F1EF119C4A} - (DnsBasic) - http://www.dnsbasic.com ~ Keys: Scanned in 00mn 00s ---\ Recherche particuliere à la racine de certains dossiers (O84) [MD5.B3FDF6E7B0AECD48CA7E4921773FB606] [SPRF][18/04/2013] (...) -- C:\Users\User\AppData\Local\Temp\7z920.exe [1110476] [MD5.7EE382396FFE5B846EF4C276F916DB8B] [SPRF][25/04/2013] (...) -- C:\Users\User\AppData\Local\Temp\803.bat [208] [MD5.1BDF5E5015EFCAA68B05CEC0A79BE484] [SPRF][16/08/2012] (.Somoto Ltd. - Better Installer Host.) -- C:\Users\User\AppData\Local\Temp\BI_RunOnce (1).exe [222208] =>Adware.MegaSearch [MD5.1BDF5E5015EFCAA68B05CEC0A79BE484] [SPRF][16/08/2012] (.Somoto Ltd. - Better Installer Host.) -- C:\Users\User\AppData\Local\Temp\BI_RunOnce.exe [222208] =>Adware.MegaSearch [MD5.55B59C2C685CF6A684881FA2AB1DB55A] [SPRF][18/04/2013] (.SweetIM Technologies Ltd. - SweetIM Installer by SweetPacks.) -- C:\Users\User\AppData\Local\Temp\bundlesweetimsetup.exe [9895184] =>PUP.SweetIM [MD5.81019731EC6A3B72840FFF974C55EFB3] [SPRF][07/04/2013] (...) -- C:\Users\User\AppData\Local\Temp\busunint.exe [12880] [MD5.FC1F33785FB9C61EC8409B47DE71B1BB] [SPRF][23/04/2013] (...) -- C:\Users\User\AppData\Local\Temp\DNS.exe [1027609] [MD5.E15D071AD57CB4FD957609B085BADE57] [SPRF][23/04/2013] (...) -- C:\Users\User\AppData\Local\Temp\ICReinstall_InstSocr.exe [667016] [MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][30/12/1899] (...) -- C:\Users\User\AppData\Local\Temp\LyricsPal.exe [269508] [MD5.1D99754A57A2FDD3E14EFCCB42D7A396] [SPRF][26/12/2012] (...) -- C:\Users\User\AppData\Local\Temp\MixiDJToolbar.exe [885400] [MD5.AC3129819FAA20A776239F48E57D2B35] [SPRF][18/04/2013] (.Babylon Ltd. - Babylon Client Setup.) -- C:\Users\User\AppData\Local\Temp\MyBabylonTB.exe [786584] =>Toolbar.Babylon [MD5.35F783E83866CDFD580A06A59C375A61] [SPRF][18/04/2013] (.QuickShare - QuickShare.) -- C:\Users\User\AppData\Local\Temp\QuickShare1.exe [7704368] =>PUP.QuickShare [MD5.7F91A8D7192B1664D4C4B19996ED8281] [SPRF][02/11/2012] (...) -- C:\Users\User\AppData\Local\Temp\Runner.exe [40587] [MD5.F3A10836603E03A28CAF404B29328F92] [SPRF][07/04/2013] (.Babylon Ltd. - Uninstaller Application.) -- C:\Users\User\AppData\Local\Temp\uninst1.exe [394320] =>Toolbar.Babylon [MD5.BCFAEE85EC74C624D660EF170D1FCEB5] [SPRF][25/04/2013] (...) -- C:\Users\User\AppData\Local\Temp\wajam_install.exe [493544] =>Toolbar.Wajam ~ Files: Scanned in 00mn 00s ---\ Firewall Active Exception List (FirewallRules) (O87) O87 - FAEL: "{3DE0322A-9F5B-47F4-A163-E5735064A356}" | In - Private - P6 - TRUE | .(.Pas de propriétaire - UNCServer.) -- C:\Program Files (x86)\Lenovo\System Update\UNCServer.exe O87 - FAEL: "{C8B8415F-0AC2-4BF0-87BF-9A333921364F}" | In - Private - P17 - TRUE | .(.Pas de propriétaire - UNCServer.) -- C:\Program Files (x86)\Lenovo\System Update\UNCServer.exe ~ Firewall: 208 Legitimates Filtered in 00mn 00s ---\ Scan Additionnel (O88) Database Version : v2.11707 - (24/04/2013) Clés trouvées (Keys found) : 79 Valeurs trouvées (Values found) : 0 Dossiers trouvés (Folders found) : 20 Fichiers trouvés (Files found) : 13 [HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9}] =>Toolbar.Babylon [HKLM\Software\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}] =>Toolbar.Babylon [HKLM\Software\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}] =>Toolbar.Babylon [HKLM\Software\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}] =>Toolbar.Babylon [HKLM\Software\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}] =>Toolbar.Babylon [HKLM\Software\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}] =>Toolbar.Babylon [HKLM\Software\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}] =>Toolbar.Babylon [HKLM\Software\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}] =>Toolbar.Babylon [HKLM\Software\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}] =>Toolbar.Babylon [HKLM\Software\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}] =>Adware.CDNHelper [HKLM\Software\Wow6432Node\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}] =>Adware.CDNHelper [HKLM\Software\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}] =>Toolbar.Babylon [HKLM\Software\Wow6432Node\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}] =>Toolbar.Babylon [HKLM\Software\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}] =>Toolbar.Babylon [HKLM\Software\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}] =>Toolbar.Babylon [HKLM\Software\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}] =>Toolbar.Babylon [HKLM\Software\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}] =>Toolbar.Babylon [HKLM\Software\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}] =>Toolbar.Babylon [HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASMANCS] =>Toolbar.Bing [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\90C64EA18BA25EE488BF80DCF07F2FFD] =>Toolbar.Agent [HKLM\SYSTEM\CurrentControlSet\Services\IBUpdaterService] =>Adware.IncrediBar [HKCU\Software\DataMngr] =>Adware.Bandoo [HKLM\Software\Wow6432Node\DataMngr] =>Adware.Bandoo [HKLM\Software\Wow6432Node\Microsoft\Tracing\MyBabylontb_RASAPI32] =>Toolbar.Babylon [HKLM\Software\Wow6432Node\Microsoft\Tracing\MyBabylontb_RASMANCS] =>Toolbar.Babylon [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1AE46C09-2AB8-4EE5-88FB-08CD0FF7F2DF}] =>Toolbar.Agent [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SpecialSavings] =>PUP.SpecialSavings [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Updater Service] =>Adware.IncrediBar [HKLM\Software\Classes\Prod.cap] =>Toolbar.Babylon [HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASAPI32] =>Toolbar.Bing [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings] =>PUP.BProtector [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375] =>Toolbar.Agent [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5] =>Toolbar.Agent [HKLM\Software\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}] =>Toolbar.DeltaSearch [HKLM\Software\Wow6432Node\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}] =>Toolbar.DeltaSearch [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\desksvc] =>Hijacker.22find [HKLM\Software\Classes\ScriptHost.Tool.1] =>Toolbar.Agent [HKLM\Software\Classes\ScriptHost.Tool] =>Toolbar.Agent [HKLM\Software\Classes\AppID\{562B9316-C08A-444A-9482-62080DD851AE}] =>Toolbar.Freecorder [HKLM\Software\Wow6432Node\Classes\AppID\{562B9316-C08A-444A-9482-62080DD851AE}] =>Toolbar.Freecorder [HKLM\Software\Classes\AppID\AddonsFramework.DLL] =>Toolbar.Freecorder [HKLM\Software\Classes\AppID\ButtonSite.DLL] =>Toolbar.Freecorder [HKLM\Software\Classes\AppID\PropertySync.EXE] =>Toolbar.Freecorder [HKLM\Software\Classes\AppID\ScriptHost.DLL] =>Toolbar.Freecorder [HKLM\Software\Classes\AppID\{18B9B16E-716F-43DF-A6AD-512C7D2EB983}] =>Toolbar.Freecorder [HKLM\Software\Wow6432Node\Classes\AppID\{18B9B16E-716F-43DF-A6AD-512C7D2EB983}] =>Toolbar.Freecorder [HKLM\Software\Classes\AppID\{19975B78-1907-4DD6-A437-4C48120F46A4}] =>Toolbar.Freecorder [HKLM\Software\Wow6432Node\Classes\AppID\{19975B78-1907-4DD6-A437-4C48120F46A4}] =>Toolbar.Freecorder [HKLM\Software\Classes\AppID\{562B9317-C08A-444A-9482-62080DD851AE}] =>Toolbar.Freecorder [HKLM\Software\Wow6432Node\Classes\AppID\{562B9317-C08A-444A-9482-62080DD851AE}] =>Toolbar.Freecorder [HKLM\Software\Classes\Interface\{045F91B3-695F-423A-98C7-8DE3C47AA020}] =>Toolbar.Freecorder [HKLM\Software\Wow6432Node\Classes\Interface\{045F91B3-695F-423A-98C7-8DE3C47AA020}] =>Toolbar.Freecorder [HKLM\Software\Classes\Interface\{1348BD1B-C32A-41A7-9BD4-5377AA1AB925}] =>Toolbar.Freecorder [HKLM\Software\Wow6432Node\Classes\Interface\{1348BD1B-C32A-41A7-9BD4-5377AA1AB925}] =>Toolbar.Freecorder [HKLM\Software\Classes\Interface\{395AFE6E-8308-48DB-89BE-ED5F4AA3D3EC}] =>Toolbar.Freecorder [HKLM\Software\Wow6432Node\Classes\Interface\{395AFE6E-8308-48DB-89BE-ED5F4AA3D3EC}] =>Toolbar.Freecorder [HKLM\Software\Classes\Interface\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}] =>Toolbar.Freecorder [HKLM\Software\Wow6432Node\Classes\Interface\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}] =>Toolbar.Freecorder [HKLM\Software\Classes\Interface\{43B390F0-6BA2-45CA-ABF2-5DB0CEE9B49D}] =>Toolbar.Freecorder [HKLM\Software\Wow6432Node\Classes\Interface\{43B390F0-6BA2-45CA-ABF2-5DB0CEE9B49D}] =>Toolbar.Freecorder [HKLM\Software\Classes\Interface\{93CF54F5-CFAA-4440-B588-8ED0DFAD5C21}] =>Toolbar.Freecorder [HKLM\Software\Wow6432Node\Classes\Interface\{93CF54F5-CFAA-4440-B588-8ED0DFAD5C21}] =>Toolbar.Freecorder [HKLM\Software\Classes\Interface\{94CADA2E-1D3F-419F-8A3D-06C58EDF53C8}] =>Toolbar.Freecorder [HKLM\Software\Wow6432Node\Classes\Interface\{94CADA2E-1D3F-419F-8A3D-06C58EDF53C8}] =>Toolbar.Freecorder [HKLM\Software\Classes\Interface\{9E52EB8B-8DD9-4605-AD36-D352BCD482F2}] =>Toolbar.Freecorder [HKLM\Software\Wow6432Node\Classes\Interface\{9E52EB8B-8DD9-4605-AD36-D352BCD482F2}] =>Toolbar.Freecorder [HKLM\Software\Classes\Interface\{A1440EC3-F0FA-407A-B811-DE6668C06D29}] =>Toolbar.Freecorder [HKLM\Software\Wow6432Node\Classes\Interface\{A1440EC3-F0FA-407A-B811-DE6668C06D29}] =>Toolbar.Freecorder [HKLM\Software\Classes\Interface\{B9A84AD0-5777-46FD-8B8F-1EBD06750FBC}] =>Toolbar.Freecorder [HKLM\Software\Wow6432Node\Classes\Interface\{B9A84AD0-5777-46FD-8B8F-1EBD06750FBC}] =>Toolbar.Freecorder [HKLM\Software\Classes\Interface\{C1995F88-1C7F-40D7-B0FA-6F107F6308B8}] =>Toolbar.Freecorder [HKLM\Software\Wow6432Node\Classes\Interface\{C1995F88-1C7F-40D7-B0FA-6F107F6308B8}] =>Toolbar.Freecorder [HKLM\Software\Classes\Interface\{C815E3DA-0823-49B0-9270-D1771D58B317}] =>Toolbar.Freecorder [HKLM\Software\Wow6432Node\Classes\Interface\{C815E3DA-0823-49B0-9270-D1771D58B317}] =>Toolbar.Freecorder [HKLM\Software\Classes\Interface\{D3BC53E7-0437-4C97-90EE-2CD6FF47FB14}] =>Toolbar.Freecorder [HKLM\Software\Wow6432Node\Classes\Interface\{D3BC53E7-0437-4C97-90EE-2CD6FF47FB14}] =>Toolbar.Freecorder [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110111271167}] =>PUP.CrossRider [HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110111271167}] =>PUP.CrossRider [HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110111271167}] =>PUP.CrossRider C:\Program Files (x86)\Software =>Adware.Boxore C:\Program Files (x86)\SpecialSavings =>PUP.SpecialSavings C:\ProgramData\Babylon =>Toolbar.Babylon C:\ProgramData\IBUpdaterService =>Adware.IncrediBar C:\ProgramData\Software =>Adware.Boxore C:\Users\User\AppData\Roaming\yontoo =>Adware.Yontoo C:\Users\User\AppData\Roaming\Babylon =>Toolbar.Babylon C:\Users\User\AppData\Roaming\DealPly =>PUP.DealPly C:\Users\User\AppData\Roaming\OpenCandy =>Adware.OpenCandy C:\Users\User\AppData\Roaming\SpecialSavings =>PUP.SpecialSavings C:\Users\User\AppData\Roaming\BabSolution =>Hijacker.BabSolution C:\Users\User\AppData\Roaming\Desk 365 =>Hijacker.22find C:\Users\User\AppData\Local\AVG Secure Search =>Toolbar.AVGSearch C:\Users\User\AppData\Local\Duuqu =>Toolbar.Agent C:\Users\User\AppData\Local\lollipop =>Adware.Lollipop C:\Users\User\AppData\Local\Software =>Adware.Boxore C:\Users\User\AppData\Local\Tiger Savings =>PUP.RewardsArcade C:\Users\User\AppData\LocalLow\AVG Secure Search =>Toolbar.AVGSearch C:\Users\User\AppData\Local\Temp\Desk365 =>Hijacker.22find C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\Smartbar =>Hijacker.SmartBar C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\bprotector_extensions.sqlite =>PUP.BProtector C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vn2atj3w.default\bprotector_prefs.js =>PUP.BProtector C:\Users\User\AppData\Local\Temp\uninst1.exe =>Toolbar.Babylon C:\Users\User\AppData\Local\Temp\bundlesweetimsetup.exe =>PUP.SweetIM C:\Users\User\AppData\Local\Temp\MyBabylonTB.exe =>PUP.SweetIM C:\Users\User\AppData\Local\Temp\wajam_install.exe =>Toolbar.Wajam C:\Users\User\AppData\Local\Temp\BI_RunOnce (1).exe =>Adware.MegaSearch C:\Users\User\AppData\Local\Temp\BI_RunOnce.exe =>Adware.MegaSearch ~ Additionnel Scan: 209509 Items scanned in 00mn 14s ---\ Product Upgrade Codes (O90) O90 - PUC: "4154526C49DD5E54780C9BBC093AC498" . (.View Management Utility.) -- C:\Windows\Installer\{C6254514-DD94-45E5-87C0-B9CB90A34C89}\ARPPRODUCTICON.exe O90 - PUC: "430C7076B6DEA6B42BF169B96360BFED" . (.Lenovo Registration.) -- C:\Windows\Installer\{6707C034-ED6B-4B6A-B21F-969B3606FBDE}\ARPPRODUCTICON.exe O90 - PUC: "4C08D494755337D41A3556EFB4E3DC3C" . (.Lenovo Slim USB Keyboard.) -- C:\Windows\Installer\{494D80C4-3557-4D73-A153-65FE4B3ECDC3}\ARPPRODUCTICON.exe O90 - PUC: "6315CD058E12CB84795EA10D556F0B6B" . (.Create Recovery Media.) -- C:\Program Files (x86)\Lenovo\Factory Recovery ecovburncd.exe,0 O90 - PUC: "74846C52009BDA841A46B1F4B9776405" . (.Lenovo System Update.) -- C:\Windows\Installer\{25C64847-B900-48AD-A164-1B4F9B774650}\ARPPRODUCTICON.exe O90 - PUC: "C9335768C821DD4438FBA0D5A6DB2879" . (.Lenovo System Update.) -- C:\Program Files (x86)\Lenovo\System Update\Tvsu.exe O90 - PUC: "E1F3EB3A2742112478538E32B94ED9F9" . (.Burn.Now 4.5.) -- C:\Windows\Installer\{A3BE3F1E-2472-4211-8735-E8239BE49D9F}\ARPPRODUCTICON.exe ~ Update Products: 101 Legitimates Filtered in 00mn 00s ---\ Random Export Key (O91) [HKCU\Software\e28cd8e269e517] =>Toolbar.Babylon^ [HKCU\Software\e28cd8e269e517]:GUID="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}" [HKCU\Software\e28cd8e269e517]:version="2.6.1249.132" [HKLM\Software\Wow6432Node\e28cd8e269e517] =>Toolbar.Babylon^ [HKLM\Software\Wow6432Node\e28cd8e269e517]:GUID="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}" [HKLM\Software\Wow6432Node\e28cd8e269e517]:version="2.6.1249.132" ~ Export Key Software: Scanned in 00mn 00s ---\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped) SR - | Auto 18/12/2012 65192 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe SS - | Demand 13/03/2013 253656 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe SR - | Auto 27/02/2013 4937264 | (AVGIDSAgent) . (.AVG Technologies CZ, s.r.o..) - C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe SR - | Auto 19/02/2013 282624 | (avgwd) . (.AVG Technologies CZ, s.r.o..) - C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe SS - | Auto 11/06/2012 193616 | (BBSvc) . (.Microsoft Corporation..) - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe SR - | Demand 11/06/2012 240208 | (BBUpdate) . (.Microsoft Corporation..) - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe SR - | Auto 2787280 | (BrowserProtect) . (...) - C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe =>Toolbar.Babylon SS - | Demand 14/12/2012 277616 | (cphs) . (.Intel Corporation.) - C:\Windows\SysWow64\IntelCpHeciSvc.exe SR - | Auto 17/01/2012 169776 | (FastbootService) . (.Lenovo.) - C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe SS - | Demand 15/10/2012 13160 | (GoToAssist) . (.Citrix Online, a division of Citrix Systems.) - C:\Program Files (x86)\Citrix\GoToAssist\759\g2aservice.exe SS - | Auto 25/04/2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe SS - | Demand 25/04/2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe SR - | Auto 01/02/2012 13592 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe SR - | Auto 649984 | (IBUpdaterService) . (...) - C:\ProgramData\IBUpdaterService\ibsvc.exe =>Adware.InstallBrain SR - | Auto 08/12/2011 607456 | (Intel(R) Capability Licensing Service Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\iCLS Client\HeciServer.exe SR - | Auto 28/09/2011 212944 | (jhi_service) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe SR - | Auto 09/02/2012 58192 | (LENOVO.CAMMUTE) . (.Lenovo Group Limited.) - C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe SR - | Auto 09/02/2012 61264 | (LENOVO.TPKNRSVC) . (.Lenovo Group Limited.) - C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe SR - | Auto 22/11/2012 375728 | (LMIGuardianSvc) . (.LogMeIn, Inc..) - C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe SR - | Auto 22/11/2012 147888 | (LMIMaint) . (.LogMeIn, Inc..) - C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe SR - | Auto 16/12/2011 277784 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe SR - | Auto 08/06/2012 407424 | (LogMeIn) . (.LogMeIn, Inc..) - C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe SS - | Demand 10/04/2013 115608 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe SR - | Auto 22/02/2012 70968 | (Power Manager DBC Service) . (.Lenovo.) - C:\Program Files (x86)\Lenovo\PowerMgr\PWMDBSVC.exe SS - | Demand 22/02/2012 165176 | (PwmEWSvc) . (.Lenovo Group Limited.) - C:\Program Files (x86)\Lenovo\PowerMgr\PWMEWSVC.exe SR - | Auto 137216 | (Sks8821) . (...) - C:\Program Files\Lenovo\Lenovo Slim USB Keyboard\Sks8821.exe SR - | Auto 15/01/2013 216608 | (SPAMfighter Update Service) . (.SPAMfighter ApS.) - C:\Program Files (x86)\Fighters\SPAMfighter\sfus.exe SR - | Auto 12/11/2012 1270376 | (Suite Service) . (.SPAMfighter ApS.) - C:\Program Files (x86)\Fighters\FighterSuiteService.exe SS - | Demand 22376 | (SUService) . (...) - C:\Program Files (x86)\Lenovo\System Update\SUService.exe SR - | Auto 10/01/2008 61440 | (UleadBurningHelper) . (.Ulead Systems, Inc..) - C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe SR - | Auto 16/12/2011 363800 | (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe SR - | Auto 02/12/2012 81552 | (VIPAppService) . (.Symantec Corporation.) - C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe SS - | Auto 0 | (vToolbarUpdater14.2.0) . (...) - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe =>Toolbar.AVGSearch SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe ~ Services: Scanned in 00mn 00s ~ 1281 Legitimates filtered by white list End of the scan (698 lines in 00mn 38s)(0)

juju666 · Answer

Une véritable poubelle numérique ton PC

~~

Dans l'ordre : 

1/
&#9654 Télécharge sur cette page: AdwCleaner (de Xplode) 

&#9654 Lance-le

clique sur Suppression et patiente le temps du nettoyage.

&#9654 Envoie le rapport que tu trouveras dans ton disque dur c:\ADwcleaner[Sx].txt sur cjoint et poste le lien pour consulter le fichier

2/
&#9654 Télécharge sur cette page: RstHosts 

&#9654 Lance-le

clique sur Restaurer, ça va très vite.

3/ 
Désinstalle ZHPDiag via le panneau de configuration.

4/ 
Faire un scan OTL pour diagnostiquer les programmes qui tournent et déceler des infections : 

&#9654 Télécharge ici :OTL

&#9654 Fais un double clic sur l'icône pour le lancer (clic droit executer en tant qu'administrateur sous Vista, Windows 7 ou Windows 8). Vérifier que toutes les autres fenêtres sont fermées afin qu'il s'exécute sans interruption.

&#9654 Quand la fenêtre apparaît, Coche la case Tous les utilisateurs
&#9654 Coche les cases à coté de Recherche Lop et Recherche Purity.
&#9654 Laisse tous les autres paramètres par défaut 

&#9654 Copie et colle le contenu de ce qui suit en gras dans la partie inférieure d'OTL "Personnalisation"


msconfig 
netsvcs 
/md5start
explorer.exe
winlogon.exe
userinit.exe
svchost.exe
services.exe
winsock.*
/md5stop
%temp%\*.exe /s 
%ALLUSERSPROFILE%\Application Data\*.exe /s 
%ALLUSERSPROFILE%\Application Data\*.
%APPDATA%\*.exe /s 
%SYSTEMDRIVE%\*.*
BASESERVICES
CREATERESTOREPOINT
SAVEMBR:0

&#9654 Clic sur Analyse.

A la fin du scan, 2 Bloc-Notes vont s'ouvrir avec les rapports (OTL.txt et extras.txt).

NE PAS COPIER/COLLER LE RAPPORT ICI - LIRE JUSQU'AU BOUT

Ces fichiers se trouvent à côté de l'exécutable OTL.exe

héberge OTL.txt et extra.txt sur cjoint.com et donne les liens obtenus en échange  

NE PAS COPIER/COLLER LE RAPPORT DANS TA REPONSE, L'HEBERGER SUR CJOINT

Bonne soirée et bon courage, poste bien tout ce qui est demandé :)

perfido · Answer

Bonsoir juju666
                                     Il se trouve qu'en téléchargeant  OTL j'ai retrouvé tout étonné firefox, comme quoi ces malveillants tiennent à peu de chose.
                                        Je ne te remercierais jamais assez.
                                                        Grand merci

# AdwCleaner v2.202 - Rapport créé le 26/04/2013 à 00:38:49
# Mis à jour le 23/04/2013 par Xplode
# Système d'exploitation : Windows 7 Professional Service Pack 1 (64 bits)
# Nom d'utilisateur : User - USER-THINK
# Mode de démarrage : Normal
# Exécuté depuis : C:\Users\User\Nouveau dossier\adwcleaner.exe
# Option [Suppression]


***** [Services] *****


***** [Fichiers / Dossiers] *****


***** [Registre] *****

Clé Supprimée : HKCU\Software\BabylonToolbar

***** [Navigateurs] *****

-\ Internet Explorer v9.0.8112.16476

[OK] Le registre ne contient aucune entrée illégitime.

-\ Mozilla Firefox v20.0.1 (fr)

-\ Google Chrome v26.0.1410.64

*************************

AdwCleaner[R1].txt - [1022 octets] - [25/04/2013 16:49:22]
AdwCleaner[S10].txt - [769 octets] - [26/04/2013 00:38:49]
AdwCleaner[S1].txt - [1122 octets] - [24/04/2013 15:49:11]
AdwCleaner[S5].txt - [473 octets] - [25/04/2013 22:57:06]
AdwCleaner[S6].txt - [679 octets] - [25/04/2013 22:59:04]
AdwCleaner[S7].txt - [467 octets] - [25/04/2013 23:33:38]
AdwCleaner[S8].txt - [467 octets] - [25/04/2013 23:36:00]
AdwCleaner[S9].txt - [4165 octets] - [25/04/2013 23:53:37]

########## EOF - C:\AdwCleaner[S10].txt - [1185 octets] ##########

juju666 · Answer

Bonjour,

Relance AdwCleaner clique sur Désinstaller

~~

J'attends mes rapports OTL ;)

perfido · Answer

Bonsoir juju666
                                  Je pensais firefox retrouvé en avoir terminé.
                                                 Merci.
                                                Bonne soirée.

https://www.cjoint.com/c/CDAsF4VOrGd

http://oldtimer.geekstogo.com/OTL.exehttp://oldtimer.geekstogo.com/OTL.exe

juju666 · Answer

???

perfido · Answer

Bonsoir juju666
                                Voila ce que je suis arrivé à réaliser dans le doute, tel un robot.
                                                            Je te souhaite une bonne soirée.

                                                                                                                                                        http://cjoint.com/?CEfaMrwlfvD
                             http://cjoint.com/?CEfaPEAtweO

juju666 · Answer

Bonjour,

Franchement je comprends pas ce que tu fais ...
Après l'analyse, OTL dépose 2 fichiers à côté de l'exécutable (dans ton cas dans le "Nouveau dossier") il suffit de les envoyer. Pourquoi c'est le "Run 8" ? Pourquoi tu m'as fais un mélange des 2 fichiers ? 
Bref.
AdwCleaner a été mis à jour, il devrait supprimer encore pas mal de chose.
Donc re-télécharge-le ici : http://general-changelog-team.fr/fr/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner
Clic suppression et poster le rapport

A+

perfido · Answer

Bonjour juju666,

                                        Je suis désolé de l'exaspération que je te procure, je suis inexpérimenté en informatique, je ne comprends pas certains termes recommandés.
Pour exécuter et poster otl, je vais sur démarrer>rechercher les programmes et fichiers j'affiche `'otl'' double droit `'exécuter en tant qu'administrateur'' le panneau s'affiche, je coche `'tous les utilisateurs'' `'recherche lop'' `'recherche purity'' ''analyse'' le résumé s'affiche dont je fais un copier/coller sur personnalisation. A partir de manipulation j'hésite, qu'est-ce que l'exécutable, je retourne sur otl où sont affichés otl
                                              J'ai bien remarqué en affichant otl extra accolé à txt me faut-il utiliser ces 2 manipulations ?
                                 Encore merci pour la patience que tu me témoignes.
 
                        Je ne comprends pas, il m'est arrivé d'utiliser nouveaux documents pour un cjoint et pour ce cjoint j'étais dirigé sur nouveau document qui ne contenait pas le document adwcleaner que j'ai trouvé dans la bibliothèque.

   
https://www.cjoint.com/c/CEgje1BpBHR

juju666 · Answer

Bonjour,

Je suis entièrement d'accord et très patient mais il y a des limites.
Encore une fois, tu mets le rapport d'adwcleaner dans un document WORD, pourquoi ? Je ne saisis pas !

A+

perfido · Answer

Merci juju666,
                                 J'ai windows 7, comment ouvrir cette fenêtre ?
                                                                Merci
                                                        Bonne après midi


https://www.cjoint.com/c/CEgm40fnzLa

juju666 · Answer

Bonsoir,
Dans ton entourage, personne ne pourrait d'aider à réaliser les manipulations ?

perfido · Answer

Bonjour juju666,

                             C'est la dernière fois que je t'ennuie.
                             Comment installer cette fenêtre sur l'écran ?
                            Merci.
                                    Bonne journée.



https://www.cjoint.com/c/CEhdKe7N2cJ

juju666 · Answer

Bonjour
C'est déjà ce que tu fais pour m'envoyer tes fichiers word ...

perfido · Answer

Bonjour juju666,
                                             Je suis débordé par l'état de santé de mon épouse qui ne permet plus de participer aux activités que je pratiquais sur mon ordinateur que j'ai décidais de n'utiliser que pour des besoins utilitaires par contre je te communique l'ouverture de firefox qui paraît être occupé d'un indésirable
 

Egalement internet explorer
 
Peux-tu intervenir pour remettre ouvertures en ordre ?
                             Merci pour toutes tes interventions.
                              Bonne journée
        https://www.cjoint.com/c/CEogMXjiP7a

juju666 · Answer

Salut je t'ai demandé si personne ne pouvait t'aider à réaliser les manipulations correctement, je pense que ça sera utile !

Prompt rétablissement à ton épouse.

Comment activer zhpfix

17 réponses

Discussions similaires

Newsletters