Mots en verts soulignés deux fois ouvrant une fenêtre de pubRésolu/Fermé

Question

Bonjour,
Depuis peu des mots en verts soulignés deux fois apparaissent sur mes pages de navigation, j'utilise chrome.
Je n'arrive pas à résoudre le pb seul
merci

2011N2 · Answer

Salut,

Fais ceci : http://www.forum-entraide-informatique.com/support/zhpdiag-tutoriel-t4831.html

Et poste moi le rapport hébergé.

Gabriel.

lk1979 · Answer

le rapport :

~ Rapport de ZHPDiag v2013.8.15.24 - Nicolas Coolman  (15/08/2013)
~ Lancé par Loïc (16/08/2013 22:35:43)
~ Adresse du Site Web https://nicolascoolman.webs.com/
~ Traduit par Nicolas Coolman
~ Etat de la version : Version à jour.
~ Liste blanche : Désactivée par l'utilisateur
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user


---\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16660
GCIE: Google Chrome v28.0.1500.95 (Defaut)

---\ Informations sur les produits Windows
~ Langage: Français
Windows 8 Home Premium Edition, 64-bit  (Build 9200)
Windows Server License Manager Script : OK
~ ion : Windows(R) Operating System, OEM_DM channel
Windows ID Activation : OK
~ Windows Partial Key : VH3HT
Windows License : OK
~ Windows Remaining Initializations Number : 998
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\ Logiciels de protection du système
Norton Internet Security v20.4.0.40
Windows Defender W8

---\ Logiciels d'optimisation du système

---\ Logiciels de partage PeerToPeer

---\ Surveillance de Logiciels

---\ Informations sur le système
~ Processor: Intel64 Family 6 Model 58 Stepping 9, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 6082 MB (57% free)
System Restore: Activé (Enable)
System drive C: has 836 GB (91%) free of 913 GB

---\ Mode de connexion au système
~ Computer Name: PC_LOIC
~ User Name: Loïc
~ All Users Names: Loïc, HomeGroupUser$, Administrateur, 
~ Unselected Option: None
Logged in as Administrator

---\ Variables d'environnement
~ System Unit : C:\
~ %AppData% : C:\Users\Loïc\AppData\Roaming\
~ %Desktop% : C:\Users\Loïc\Desktop\
~ %Favorites% : C:\Users\Loïc\Favorites\
~ %LocalAppData% : C:\Users\Loïc\AppData\Local\
~ %StartMenu% : C:\Users\Loïc\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\ Enumération des unités disques
C:\ Hard drive, Flash drive, Thumb drive (Free 836 Go of 913 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 2 Go of 17 Go)
E:\ CD-ROM drive (Not Inserted)
F:\ Hard drive, Flash drive, Thumb drive (Free 45 Go of 298 Go)



---\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime :  OK
~ Security Center: 29 Scanned in 00mn 00s



---\ Recherche particulière de fichiers génériques
[MD5.0E8E6463F81C80AFBED533E0F1F8895D] - (.Microsoft Corporation - Explorateur Windows.) (.01/06/2013 - 12:34:21.) -- C:\Windows\Explorer.exe [2391280]
[MD5.FE9AB232B56A12224E8A3F3F9878C9A3] - (.Microsoft Corporation - Application de démarrage de Windows.) (.26/07/2012 - 04:08:50.) -- C:\Windows\System32\Wininit.exe [132608]
[MD5.AC155DD9BD1E6D3B740826A4D1C68AAE] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.26/07/2013 - 06:13:37.) -- C:\Windows\System32\wininet.dll [2241024]
[MD5.BCF2036A0DD579E47C008C133550283E] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.11/10/2012 - 06:46:58.) -- C:\Windows\System32\Winlogon.exe [517120]
[MD5.9448F5740A037EC0C18F0E9177232DD0] - (.Microsoft Corporation - Bibliothèque de licences.) (.26/07/2012 - 04:07:20.) -- C:\Windows\System32\sppcomapi.dll [273408]
[MD5.36D6A3201721558A8AFBCC09C2DA4C2C] - (.Microsoft Corporation - Pilote de fonction connexe pour WinSock.) (.06/11/2012 - 04:53:44.) -- C:\Windows\system32\Drivers\AFD.sys [560640]
[MD5.A721FF570C2387E383BDDEA9632863C9] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.26/07/2012 - 06:00:48.) -- C:\Windows\system32\Drivers\atapi.sys [25840]
[MD5.990B1BABE6E81FB18E65A87EBEFB1772] - (.Microsoft Corporation - CD-ROM File System Driver.) (.26/07/2012 - 03:30:10.) -- C:\Windows\system32\Drivers\Cdfs.sys [108544]
[MD5.339BFF85D788268752DA8C9644B188EE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.26/07/2012 - 03:26:36.) -- C:\Windows\system32\Drivers\Cdrom.sys [174080]
[MD5.09D9EB9E7898F8E6561473A20CC808B9] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.26/07/2012 - 03:26:53.) -- C:\Windows\system32\Drivers\DfsC.sys [118784]
[MD5.7D87B5B6C7188D553E11B59DC7F0B111] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.12/10/2012 - 02:42:21.) -- C:\Windows\system32\Drivers\HDAudBus.sys [71168]
[MD5.C9E9CBF73AFFBFE3E801EFB516787BA3] - (.Microsoft Corporation - Pilote de port i8042.) (.26/07/2012 - 03:28:51.) -- C:\Windows\system32\Drivers\i8042prt.sys [112640]
[MD5.3969B9C218DD3FAA9F4ED2FFC3651C02] - (.Microsoft Corporation - IP Network Address Translator.) (.26/07/2012 - 03:23:01.) -- C:\Windows\system32\Drivers\IpNat.sys [145920]
[MD5.93179D48066918323628CB016D8C94DC] - (.Microsoft Corporation - Minirdr SMB Windows NT.) (.05/02/2013 - 23:29:09.) -- C:\Windows\system32\Drivers\MRxSmb.sys [370688]
[MD5.7CEC25C682D319D484630B3952C31A11] - (.Microsoft Corporation - MBT Transport driver.) (.26/07/2012 - 03:24:28.) -- C:\Windows\system32\Drivers
etBT.sys [331776]
[MD5.76929F4A69E425911A63B407E26C2589] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.02/02/2013 - 11:54:54.) -- C:\Windows\system32\Drivers
tfs.sys [1933544]
[MD5.4563DAF8C6A740AD7F501E219BD10766] - (.Microsoft Corporation - Pilote de port parallèle.) (.26/07/2012 - 03:29:53.) -- C:\Windows\system32\Drivers\Parport.sys [105984]
[MD5.A14D625C5AEE5FFE0F47D1A1D419FAAE] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.26/07/2012 - 03:23:17.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [124928]
[MD5.B2A3AD74FF2E2FFA73AF2567108231B3] - (.Microsoft Corporation - Redirecteur de périphérique de Microsoft RDP.) (.26/07/2012 - 03:25:18.) -- C:\Windows\system32\Driversdpdr.sys [179712]
[MD5.73DC722CE5DF26D7638CE2446F2655C7] - (.Microsoft Corporation - TDI Translation Driver.) (.26/07/2012 - 06:26:47.) -- C:\Windows\system32\Drivers	dx.sys [117248]
[MD5.78A5BBA3819FFFC62FFEC3E2220D102D] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.01/06/2013 - 12:26:33.) -- C:\Windows\system32\Drivers\volsnap.sys [327936]
~ Generic Processes:  Scanned in 00mn 00s



---\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/1590
~ Mes musiques (My Musics) : 1/6802
~ Mes Favoris (My Favorites) : 1/6
~ Mes Documents (My Documents) : 1/2152
~ Mon Bureau (My Desktop) : 1/2
~ Menu demarrer (Programs) : 1/21
~ Hidden Files:  Scanned in 00mn 07s



---\ Processus lancés au démarrage su système
[MD5.1BF9D6476061B31CD7FC2BF848529A56] - (.Symantec Corporation - Symantec Service Framework.) -- C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe   [144368] [PID.1908]
[MD5.918007C1311C833B58F50B59B454266D] - (.Bake Cake - Desktop.) -- C:\Users\Loïc\AppData\Roaming\Movdap\WebCakeDesktop.exe   [52504] [PID.3924]  =>Adware.WebCake
[MD5.D213F06AE294341F3503FD74E22E7DDA] - (.Microsoft Corporation - Microsoft SkyDrive.) -- C:\Users\Loïc\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe   [257136] [PID.4480]
[MD5.B7F55E2AE978D3D34F7876EE5D689AAE] - (.CyberLink - YouCam Mirage.) -- C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe   [136488] [PID.2904]
[MD5.724CB7A116F7E1A67009D751BCF86586] - (.CyberLink - CyberLink MediaLibray Service.) -- c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe   [111120] [PID.2344]
[MD5.ECCA7F72A24C7CF43131946C076689D1] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe   [846288] [PID.3180]
[MD5.22F297689CAA74CB2BDBE964B8CC2562] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe   [7823360] [PID.4400]
~ Processes Running:  Scanned in 00mn 00s



---\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Loïc\AppData\Local\Google\Chrome\User Data\Default\Preferences
G1 - GCS: Preference [User Data\Default] None
G0 - GCSP: Preference [User Data\Default][HomePage] https://www.google.fr/?gws_rd=ssl
G0 - GCSP: Preference [User Data\Default] https://www.google.fr/?gws_rd=ssl
G2 - GCE: Preference [User Data\Default] [ahfgeienlihckogmohjhadlkjgocpleb] Store v.0.2 (Activé)
G2 - GCE: Preference [User Data\Default] [apdfllckaahabafndbhieahigkjlhalf] Google Drive v.6.3 (Activé)
G2 - GCE: Preference [User Data\Default] [blpcfgokakmgnkcojhhkbfbldkacnbeo] YouTube v.4.2.6 (Activé)
G2 - GCE: Preference [User Data\Default] [coobgpohoikkiipiblmjeljniedjpjpf] Recherche Google v.0.0.0.20 (Activé)
G2 - GCE: Preference [User Data\Default] [eemcgdkfndhakfknompkggombfjjjeno] Bookmark Manager v.0.1 (Activé)
G2 - GCE: Preference [User Data\Default] [ennkphjdgehloodpbhlhldgbnhmacadg] Settings v.0.2 (Activé)
G2 - GCE: Preference [User Data\Default] [fjoijdanhaiflhibkljeklcghcmmfffh] Web Cake v.1.0.3 (Désactivé)  =>Adware.WebCake
G2 - GCE: Preference [User Data\Default] [gighmmpiobklfepjocnamgkkbiglidom] AdBlock v.2.6.4, (Activé)
G2 - GCE: Preference [User Data\Default] [mfehgcgbbipciphmccgaenjidiccnmng] Cloud Print v.0.1 (Activé)
G2 - GCE: Preference [User Data\Default] [mgndgikekgjfcpckkfioiadnlibdjbkf] Chrome v.0.1 (Activé)
G2 - GCE: Preference [User Data\Default] [mkfokfffehpeedafpekjeddnmnjhmcmk] Norton Identity Protection v.2013.4.0.10 (Désactivé)
G2 - GCE: Preference [User Data\Default] [okkbcpjgdooahcefofhjdpacngfecaaa] Lyrics-Fan v.1.128 (Activé)  =>Adware.AddLyrics
G2 - GCE: Preference [User Data\Default] [pjkljhegncpnkpknbcohdijeoejaedia] Gmail v.7 (Activé)
~ Google Browser: 16 Scanned in 00mn 04s



---\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.qvo6.com  =>Hijacker.Qvo6
R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.qvo6.com  =>Hijacker.Qvo6
R0 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.qvo6.com  =>Hijacker.Qvo6
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = https://www.microsoft.com/fr-fr/
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.qvo6.com  =>Hijacker.Qvo6
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.microsoft.com/fr-fr/
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R3 - URLSearchHook: Microsoft Url Search Hook [64Bits] - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Navigateur Internet.) (10.00.9200.16384 (win8_rtm.120725-1247)) -- C:\Windows\SysWOW64\ieframe.dll
~ IE Browser: 11 Scanned in 00mn 00s



---\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management:  Scanned in 00mn 00s



---\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys:  Scanned in 00mn 00s



---\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File:  Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\ Browser Helper Objects de navigateur (O2)
O2 - BHO: WebCake Layers [64Bits] - {2A5A2A90-3B30-4E6E-A955-2F232C6EF517} . (.Web Cake LLC - Web Cake Runtime.) -- C:\Program Files (x86)\Web Cake\WebCakeIEClient.dll  =>Adware.WebCake
O2 - BHO: Norton Identity Protection [64Bits] - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} . (.Symantec Corporation - coIEPlugIn.) -- C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll
O2 - BHO: Norton Vulnerability Protection [64Bits] - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} . (.Symantec Corporation - IPS Browser Helper DLL.) -- C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\IPSBHO.dll
O2 - BHO: HP Network Check Helper [64Bits] - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} . (.Hewlett-Packard - HP Network Check IE Plug-in.) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll
~ BHO: 4 Scanned in 00mn 00s



---\ Internet Explorer Toolbars (O3)
O3 - Toolbar\WebBrowser: (no name) [64Bits] - [HKCU]{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} Clé orpheline
~ Toolbar:  Scanned in 00mn 00s



---\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe 
O4 - HKCU\..\Run: [WebCake Desktop] . (.Bake Cake - Desktop.) -- C:\Users\Loïc\AppData\Roaming\Movdap\WebCakeDesktop.exe  =>Adware.WebCake
O4 - HKCU\..\Run: [SkyDrive] . (.Microsoft Corporation - Microsoft SkyDrive.) -- C:\Users\Loïc\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe 
O4 - HKLM\..\Wow6432Node\Run: [tuto4pc_fr_53] Clé orpheline  =>PUP.Eorezo
O4 - HKUS\S-1-5-21-708777597-865824223-1322870745-1001\..\Run: [WebCake Desktop] . (.Bake Cake - Desktop.) -- C:\Users\Loïc\AppData\Roaming\Movdap\WebCakeDesktop.exe  =>Adware.WebCake
O4 - HKUS\S-1-5-21-708777597-865824223-1322870745-1001\..\Run: [SkyDrive] . (.Microsoft Corporation - Microsoft SkyDrive.) -- C:\Users\Loïc\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe 
~ Application:  Scanned in 00mn 00s



---\ Autres liens utilisateurs (O4)
O4 - GS\Desktop: GrabIt.lnk . (...)  -- C:\Program Files (x86)\GrabIt\GrabIt.exe
~ Global Startup:  Scanned in 00mn 00s



---\ Invisibilité de l'icône d'options IE dans le panneau de Configuration (O5)
O5 - control.ini: [HKLM\..\Control Panel] inetcpl.cpl=no
~ IE Control Panel: 1 Scanned in 00mn 00s



---\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Fournisseur Shim d'affectation de noms de messagerie.) -- C:\windows\system32
apinsp.dll
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - Fournisseur d'espace de noms PNRP.) -- C:\windows\system32\pnrpnsp.dll
O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - Network Location Awareness 2.) -- C:\windows\system32\NLAapi.dll
O10 - WLSP:\000000000005\Winsock LSP File . (.Microsoft Corporation - Fournisseur de service Sockets 2.0 de Microsoft Windows.) -- C:\windows\system32\mswsock.dll
O10 - WLSP:\000000000006\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\windows\system32\winrnr.dll
O10 - WLSP:\000000000007\Winsock LSP File . (.Apple Inc. - Bonjour Namespace Provider.) -- C:\Program Files (x86)\Bonjour\mdnsNSP.dll
~ Winsock: 7 Scanned in 00mn 00s



---\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{26B1F0A1-A9AD-4DC1-AFA5-DE8A470D4DCD}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{26B1F0A1-A9AD-4DC1-AFA5-DE8A470D4DCD}: DhcpDomain = bouyguesbox.fr
O17 - HKLM\System\CCS\Services\Tcpip\..\{CE95D67E-142F-49A1-9113-A7D3CEFB3204}: DhcpDomain = sgt.automation.net
O17 - HKLM\System\CS1\Services\Tcpip\..\{26B1F0A1-A9AD-4DC1-AFA5-DE8A470D4DCD}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{26B1F0A1-A9AD-4DC1-AFA5-DE8A470D4DCD}: DhcpDomain = bouyguesbox.fr
O17 - HKLM\System\CS1\Services\Tcpip\..\{CE95D67E-142F-49A1-9113-A7D3CEFB3204}: DhcpDomain = sgt.automation.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
~ Domain:  Scanned in 00mn 00s



---\ Titr_HJT34=Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) -- 
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll
~ Protocole Additionnel:  Scanned in 00mn 00s



---\ Clé de Registre autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
~ SSODL: 1 Scanned in 00mn 00s



---\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Andrea RT Filters Service (AERTFilters) . (.Andrea Electronics Corporation - Andrea filters APO access service (64-bit).) - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
O23 - Service: Bonjour Service (Bonjour Service) . (.Apple Inc. - Bonjour Service.) - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service Google Update (gupdate) (gupdate) . (.Google Inc. - Programme d'installation de Google.) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: HP Support Assistant Service (HP Support Assistant Service) . (.Hewlett-Packard Company - HP Support Assistant Service.) - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
O23 - Service: HP Connected Remote Service (HPConnectedRemote) . (.Hewlett-Packard - HPConnectedRemoteService.) - c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe
O23 - Service: IconMan_R (IconMan_R) . (.Realsil Microelectronics Inc. - Realtek Card Reader Patch Tool..) - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
O23 - Service: Intel(R) Capability Licensing Service In (Intel(R) Capability Licensing Service Interface) . (.Intel(R) Corporation - Intel(R) Capability Licensing Service Inter.) - c:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) ME Service (Intel(R) ME Service) . (.Intel Corporation - Intel(R) ME Service.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
O23 - Service: Intel(R) Dynamic Application Loader Host (jhi_service) . (.Intel Corporation - Intel(R) Dynamic Application Loader Host In.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: Intel(R) Management and Security Applica (LMS) . (.Intel Corporation - Local Manageability Service.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Norton Internet Security (NIS) . (.Symantec Corporation - Symantec Service Framework.) - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) . (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 305.9.) - C:\windows\system32
vvsvc.exe
O23 - Service: Intel(R) Management and Security Applica (UNS) . (.Intel Corporation - User Notification Service.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service:  (WebCakeUpdater) . (.cake bake - Desktop.Updater.) - C:\Program Files (x86)\Web Cake\WebCakeDesktop.Updater.exe  =>Adware.WebCake
O23 - Service: Wsys Service (WsysSvc) . (.Wsys Co., Ltd. - Wsys Control 10.2.1.2609.) - C:\ProgramData\eSafe\eGdpSvc.exe  =>PUP.eSafeSecurity
~ Services: 15 Scanned in 00mn 04s



---\ Enumération Active Desktop & MHTML Editor (O24)
O24 - Default MHTML Editor: Last - .(...) -  (.not file.)
~ Desktop Component: 4 Scanned in 00mn 00s



---\ Enumère les données de BootExecute (BEX) (O34)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
~ BEX: 1 Scanned in 00mn 00s



---\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task  - C:\Windows\Tasks\DSite.job   [300]
O39 - APT:Automatic Planified Task  - C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job   [1076]
O39 - APT:Automatic Planified Task  - C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job   [1080]
[MD5.724CB7A116F7E1A67009D751BCF86586] [APT] [CLMLSvc_P2G8] (.CyberLink.) -- c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe   [111120]
[MD5.CF7927AE082B578E38B82AE6D95B5F90] [APT] [CLVDLauncher] (.CyberLink Corp..) -- c:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe   [338544]
[MD5.00760D169C756B9CFD6B0FAACBA862CA] [APT] [DSite] (...) -- C:\Users\Loïc\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.exe   [95232]
[MD5.506708142BC63DABA64F2D3AD1DCD5BF] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe   [116648]
[MD5.506708142BC63DABA64F2D3AD1DCD5BF] [APT] [GoogleUpdateTaskMachineUA] (.Google Inc..) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe   [116648]
[MD5.B7F55E2AE978D3D34F7876EE5D689AAE] [APT] [MirageAgent] (.CyberLink.) -- C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe   [136488]
[MD5.C66557728011B83C4FFAE7DD022F99DA] [APT] [Norton WSC Integration] (.Symantec Corporation.) -- C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\WSCStub.exe   [163944]
[MD5.0AE2C218A9AB6C16D79160CCE55B35FC] [APT] [HP Support Assistant Quick Start] (.Hewlett-Packard Company.) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe   [525728]
[MD5.0AE2C218A9AB6C16D79160CCE55B35FC] [APT] [PC Health Analysis] (.Hewlett-Packard Company.) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe   [525728]
[MD5.DDFD05786536EF7AA540CC490A9DE3CE] [APT] [Update Check] (.Hewlett-Packard Company.) -- C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe   [592288]
[MD5.7720251986778B402978761589434491] [APT] [Norton Error Analyzer] (.Symantec Corporation.) -- C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\SymErr.exe   [54096]
[MD5.7720251986778B402978761589434491] [APT] [Norton Error Processor] (.Symantec Corporation.) -- C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\SymErr.exe   [54096]
~ Scheduled Task: 16 Scanned in 00mn 03s



---\ Composants installés (ActiveSetup Installed Components) (O40)
O40 - ASIC: Microsoft Windows Media Player [64Bits] - >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} . (.Microsoft Corporation - Ressources du Lecteur Windows Media.) -- C:\Windows\System32\wmploc.dll
O40 - ASIC: Microsoft Windows Media Player 12.0 [64Bits] - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} . (.Microsoft Corporation - Windows Media Player Extension.) -- C:\Windows\SysWOW64\wmpdxm.dll
O40 - ASIC: Themes Setup [64Bits] - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} . (.Microsoft Corporation - API Windows Theme.) -- C:\Windows\System32	hemeui.dll
O40 - ASIC: Microsoft Windows [64Bits] - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} . (.Microsoft Corporation - Windows Mail.) -- C:\Program Files (x86)\Windows Mail\WinMail.exe
O40 - ASIC: Browsing Enhancements [64Bits] - {630b1da0-b465-11d1-9948-00c04f98bbc9} . (.Microsoft Corporation - Extension Shell dossier FTP Microsoft Internet Explorer..) -- C:\Windows\System32\msieftp.dll
O40 - ASIC: Microsoft Windows Media Player [64Bits] - {6BF52A52-394A-11d3-B153-00C04F79FAA6} . (.Microsoft Corporation - Ressources du Lecteur Windows Media.) -- C:\Windows\System32\wmploc.dll
O40 - ASIC: Windows Desktop Update [64Bits] - {89820200-ECBD-11cf-8B85-00AA005B4340} . (.Microsoft Corporation - DLL commune du shell Windows.) -- C:\Windows\System32\shell32.dll
O40 - ASIC: Web Platform Customizations [64Bits] - {89820200-ECBD-11cf-8B85-00AA005B4383} . (.Microsoft Corporation - Utilitaire d'initialisation d'Internet Explorer par utilisateur.) -- C:\Windows\System32\ie4uinit.exe
O40 - ASIC: (no name) [64Bits] - {89B4C1CD-B018-4511-B0A1-5476DBF70820} . (.Microsoft Corporation - Microsoft .NET IE SECURITY REGISTRATION.) -- C:\Windows\System32\mscories.dll
~ Active Setup: 9 Scanned in 00mn 00s



---\ Pilotes lancés au démarrage du système (O41)
O41 - Driver: C:\Windows\System32\drivers\afd.sys (AFD) . (.Microsoft Corporation - Pilote de fonction connexe pour WinSock.) - C:\Windows\system32\drivers\afd.sys
O41 - Driver: (BasicDisplay) . (.Microsoft Corporation - Microsoft Basic Display Driver.) - C:\Windows\system32\drivers\BasicDisplay.sys
O41 - Driver: (BasicRender) . (.Microsoft Corporation - Microsoft Basic Render Driver.) - C:\Windows\system32\drivers\BasicRender.sys
O41 - Driver: cdrom.inf (cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\Windows\system32\drivers\cdrom.sys
O41 - Driver:  (CLVirtualDrive) . (.CyberLink - It is a virtual device driver which could c.) - C:\Windows\system32\DRIVERS\CLVirtualDrive.sys
O41 - Driver: C:\Windows\System32\drivers\dam.sys (dam) . (.Microsoft Corporation - DAM Kernel Driver.) - C:\Windows\System32\drivers\dam.sys
O41 - Driver: C:\Windows\System32\wkssvc.dll (Dfsc) . (.Microsoft Corporation - DFS Namespace Client Driver.) - C:\Windows\System32\Drivers\dfsc.sys
O41 - Driver: C:\Windows\System32\drivers\discache.sys (discache) . (.Microsoft Corporation - System Indexer/Cache Driver.) - C:\Windows\System32\drivers\discache.sys
O41 - Driver: mssmbios.inf (mssmbios) . (.Microsoft Corporation - System Management BIOS Driver.) - C:\Windows\system32\drivers\mssmbios.sys
O41 - Driver: netnb.inf (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\Windows\System32\DRIVERS
etbios.sys
O41 - Driver: C:\Windows\System32\drivers
etbt.sys (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\Windows\System32\DRIVERS
etbt.sys
O41 - Driver: npsvctrig.inf (npsvctrig) . (.Microsoft Corporation - Named pipe service triggers.) - C:\Windows\system32\drivers
psvctrig.sys
O41 - Driver: C:\Windows\System32\drivers
siproxy.sys (nsiproxy) . (.Microsoft Corporation - NSI Proxy.) - C:\Windows\System32\drivers
siproxy.sys
O41 - Driver: C:\Windows\System32\drivers\pacer.sys (Psched) . (.Microsoft Corporation - Planificateur de paquets QoS.) - C:\Windows\system32\DRIVERS\pacer.sys
O41 - Driver: C:\Windows\System32\wkssvc.dll (rdbss) . (.Microsoft Corporation - Pilote du sous-système de mise en mémoire t.) - C:\Windows\System32\DRIVERSdbss.sys
O41 - Driver: C:\Windows\System32	cpipcfg.dll (tdx) . (.Microsoft Corporation - TDI Translation Driver.) - C:\Windows\system32\DRIVERS	dx.sys
O41 - Driver: C:\Windows\System32\drivers\vwififlt.sys (vwififlt) . (.Microsoft Corporation - Virtual WiFi Filter Driver.) - C:\Windows\system32\DRIVERS\vwififlt.sys
O41 - Driver: C:\Windows\System32ascfg.dll (Wanarpv6) . (.Microsoft Corporation - MS Remote Access and Routing ARP Driver.) - C:\Windows\system32\DRIVERS\wanarp.sys
~ Drivers: 36 Scanned in 00mn 00s



---\ Logiciels installés (O42)
O42 - Logiciel: Aloha TriPeaks - (.WildTangent.) [HKLM][64Bits] -- WTA-f9f99d68-c788-4784-9d86-7c8ddd6a7282
O42 - Logiciel: Bejeweled 3 - (.WildTangent.) [HKLM][64Bits] -- WTA-482a01c7-b334-482b-a159-36a722ec7d55
O42 - Logiciel: Bonjour - (.Apple Inc..) [HKLM][64Bits] -- {6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}
O42 - Logiciel: Build-a-lot 4 - Power Source - (.WildTangent.) [HKLM][64Bits] -- WTA-0c5a8b86-a45a-4120-9f58-729d3b4c3ead
O42 - Logiciel: Connected Music powered by Universal Music Group version 1.0 - (.Snowite.) [HKLM][64Bits] -- {46037DC7-F927-46DF-935F-D6F122BDD34B}_is1
O42 - Logiciel: Cradle of Rome 2 - (.WildTangent.) [HKLM][64Bits] -- WTA-fb85529a-d3f0-43fa-93cf-1b5e456b828b
O42 - Logiciel: Crazy Chicken Soccer - (.WildTangent.) [HKLM][64Bits] -- WTA-feb6b828-abe2-453f-b76f-d2b87e561f7a
O42 - Logiciel: CyberLink LabelPrint - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}
O42 - Logiciel: CyberLink LabelPrint - (.CyberLink Corp..) [HKLM][64Bits] -- {C59C179C-668D-49A9-B6EA-0121CCFC1243}
O42 - Logiciel: CyberLink Media Suite 10 - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}
O42 - Logiciel: CyberLink Media Suite 10 - (.CyberLink Corp..) [HKLM][64Bits] -- {1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}
O42 - Logiciel: CyberLink PhotoDirector - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{4862344A-A39C-4897-ACD4-A1BED5163C5A}
O42 - Logiciel: CyberLink PhotoDirector - (.CyberLink Corp..) [HKLM][64Bits] -- {4862344A-A39C-4897-ACD4-A1BED5163C5A}
O42 - Logiciel: CyberLink Power2Go 8 - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}
O42 - Logiciel: CyberLink Power2Go 8 - (.CyberLink Corp..) [HKLM][64Bits] -- {2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}
O42 - Logiciel: CyberLink PowerDVD - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}
O42 - Logiciel: CyberLink PowerDVD - (.CyberLink Corp..) [HKLM][64Bits] -- {DEC235ED-58A4-4517-A278-C41E8DAEAB3B}
O42 - Logiciel: CyberLink PowerDirector 10 - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}
O42 - Logiciel: CyberLink PowerDirector 10 - (.CyberLink Corp..) [HKLM][64Bits] -- {B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}
O42 - Logiciel: CyberLink YouCam - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}
O42 - Logiciel: CyberLink YouCam - (.CyberLink Corp..) [HKLM][64Bits] -- {01FB4998-33C4-4431-85ED-079E3EEFE75D}
O42 - Logiciel: D3DX10 - (.Microsoft.) [HKLM][64Bits] -- {E09C4DB7-630C-4F06-A631-8EA7239923AF}
O42 - Logiciel: Energy Star - (.Hewlett-Packard Company.) [HKLM][64Bits] -- {FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}
O42 - Logiciel: Farm Frenzy - (.WildTangent.) [HKLM][64Bits] -- WTA-f4bbdb72-038e-4a08-bd65-8cee2fb4a770
O42 - Logiciel: Final Drive Fury - (.WildTangent.) [HKLM][64Bits] -- WTA-e103b5e3-f94f-4781-bf7f-b5612d4af848
O42 - Logiciel: Galerie de photos - (.Microsoft Corporation.) [HKLM][64Bits] -- {FE8DFDD0-A543-4A83-B7A9-C411138194D5}
O42 - Logiciel: Gardenscapes: Mansion Makeover - (.WildTangent.) [HKLM][64Bits] -- WTA-dd31b3a0-b79d-4737-86da-a4a08840b78a
O42 - Logiciel: Google Chrome - (.Google Inc..) [HKLM][64Bits] -- Google Chrome
O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM][64Bits] -- {A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
O42 - Logiciel: Governor of Poker 2 Premium Edition - (.WildTangent.) [HKLM][64Bits] -- WTA-d7291feb-4083-40f8-acb3-6ea15d167fe9
O42 - Logiciel: GrabIt 1.7.2 Beta (build 988) - (.Ilan Shemes.) [HKLM][64Bits] -- GrabIt_is1
O42 - Logiciel: HP Connected Music (Meridian - installer) - (.Meridian Audio Ltd.) [HKLM][64Bits] -- StartHPConnectedMusic
O42 - Logiciel: HP Connected Remote - (.Hewlett-Packard.) [HKLM][64Bits] -- {F243A34B-AB7F-4065-B770-B85B767C247C}
O42 - Logiciel: HP Customer Experience Enhancements - (.Hewlett-Packard.) [HKLM][64Bits] -- {07FA4960-B038-49EB-891B-9F95930AA544}
O42 - Logiciel: HP Games - (.WildTangent.) [HKLM][64Bits] -- WildTangent hp Master Uninstall
O42 - Logiciel: HP Postscript Converter - (.Hewlett-Packard.) [HKLM][64Bits] -- {6E14E6D6-3175-4E1A-B934-CAB5A86367CD}
O42 - Logiciel: HP Registration Service - (.Hewlett-Packard.) [HKLM][64Bits] -- {C2E428EB-116E-41C0-9E84-B22DE9CCA42F}
O42 - Logiciel: HP Support Assistant - (.Hewlett-Packard Company.) [HKLM][64Bits] -- {EE202411-2C26-49E8-9784-1BC1DBF7DE96}
O42 - Logiciel: Hewlett-Packard ACLM.NET v1.2.1.1 - (.Hewlett-Packard Company.) [HKLM][64Bits] -- {6F340107-F9AA-47C6-B54C-C3A19F11553F}
O42 - Logiciel: Image Editor Packages - (...) [HKCU][64Bits] -- Image Editor Packages
O42 - Logiciel: Intel(R) Management Engine Components - (.Intel Corporation.) [HKLM][64Bits] -- {65153EA5-8B6E-43B6-857B-C6E4FC25798A}
O42 - Logiciel: Intel® Trusted Connect Service Client - (.Intel Corporation.) [HKLM][64Bits] -- {F4404AFD-2EF3-40C1-8C09-29E5F3B6972B}
O42 - Logiciel: Jewel Match 3 - (.WildTangent.) [HKLM][64Bits] -- WTA-bd72e0d7-2a4a-4fcc-a414-44a9745e4357
O42 - Logiciel: Jewel Quest II - (.WildTangent.) [HKLM][64Bits] -- WTA-1223411d-f85b-4ad5-96ba-4eec21ab5138
O42 - Logiciel: MSVCRT - (.Microsoft.) [HKLM][64Bits] -- {8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}
O42 - Logiciel: MSVCRT110 - (.Microsoft.) [HKLM][64Bits] -- {8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}
O42 - Logiciel: MSVCRT110_amd64 - (.Microsoft.) [HKLM][64Bits] -- {F842F8B0-6942-4930-821F-543E976B2C66}
O42 - Logiciel: Mahjongg Artifacts - (.WildTangent.) [HKLM][64Bits] -- WTA-adef9fc5-a8bd-4eef-9718-fe12583b2b97
O42 - Logiciel: Microsoft SkyDrive - (.Microsoft Corporation.) [HKCU][64Bits] -- SkyDriveSetup.exe
O42 - Logiciel: Mp3tag v2.57 - (.Florian Heidenreich.) [HKLM][64Bits] -- Mp3tag
O42 - Logiciel: Mystery of Mortlake Mansion - (.WildTangent.) [HKLM][64Bits] -- WTA-9359e858-783f-427f-99a8-3d836efca56d
O42 - Logiciel: NVIDIA Graphics Driver 305.93 - (.NVIDIA Corporation.) [HKLM][64Bits] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver
O42 - Logiciel: NVIDIA PhysX - (.NVIDIA Corporation.) [HKLM][64Bits] -- {64467D47-FFE4-4FBC-ABBA-A0DB829A17EB}
O42 - Logiciel: NVIDIA PhysX System Software 9.12.0613 - (.NVIDIA Corporation.) [HKLM][64Bits] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX
O42 - Logiciel: Norton Internet Security - (.Symantec Corporation.) [HKLM][64Bits] -- NIS
O42 - Logiciel: Polar Bowler - (.WildTangent.) [HKLM][64Bits] -- WTA-3bf73401-e28b-4124-bd6a-0f2d36d43b06
O42 - Logiciel: Ralink RT5390R 802.11bgn Wi-Fi Adapter - (.Ralink.) [HKLM][64Bits] -- {8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}
O42 - Logiciel: Ranch Rush 2 - Premium Edition - (.WildTangent.) [HKLM][64Bits] -- WTA-6b405ac2-264f-44c9-ae80-c2f305155412
O42 - Logiciel: Realtek Ethernet Controller Driver - (.Realtek.) [HKLM][64Bits] -- {8833FFB6-5B0C-4764-81AA-06DFEED9A476}
O42 - Logiciel: Realtek High Definition Audio Driver - (.Realtek Semiconductor Corp..) [HKLM][64Bits] -- {F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}
O42 - Logiciel: Realtek PCIE Card Reader - (.Realtek Semiconductor Corp..) [HKLM][64Bits] -- {C1594429-8296-4652-BF54-9DBE4932A44C}
O42 - Logiciel: Recovery Manager - (.CyberLink Corp..) [HKLM][64Bits] -- {44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}
O42 - Logiciel: Royal Envoy 2 Collector's Edition - (.WildTangent.) [HKLM][64Bits] -- WTA-f3be920f-ab82-4f02-b0e3-244eef79bbc5
O42 - Logiciel: Trinklit Supreme - (.WildTangent.) [HKLM][64Bits] -- WTA-59d487d1-bc53-4df1-8811-43062e4bce5f
O42 - Logiciel: Update Installer for WildTangent Games App - (.WildTangent.) [HKLM][64Bits] -- {2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App
O42 - Logiciel: Update for Image Editor - (...) [HKCU][64Bits] -- DSite
O42 - Logiciel: VLC media player 2.0.5 - (.VideoLAN.) [HKLM][64Bits] -- VLC media player
O42 - Logiciel: Web Cake 3.00 - (.Web Cake LLC.) [HKLM][64Bits] -- {C4ED781C-7394-4906-AAFF-D6AB64FF7C38}  =>Adware.WebCake
O42 - Logiciel: Wedding Dash - (.WildTangent.) [HKLM][64Bits] -- WTA-3291b0f4-e028-41fc-8842-1a78630abe2d
O42 - Logiciel: WildTangent Games - (.WildTangent.) [HKLM][64Bits] -- WildTangent wildgames Master Uninstall
O42 - Logiciel: WildTangent Games App - (.WildTangent.) [HKLM][64Bits] -- {70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp
O42 - Logiciel: WinRAR 4.20 (32-bit) - (.win.rar GmbH.) [HKLM][64Bits] -- WinRAR archiver
O42 - Logiciel: Youda Jewel Shop - (.WildTangent.) [HKLM][64Bits] -- WTA-6f69cba6-fb04-493b-8ac3-b2be2998d04e
O42 - Logiciel: Zuma's Revenge - (.WildTangent.) [HKLM][64Bits] -- WTA-8478f96d-5855-4007-b8e7-f25f1377d632
~ Logic: 143 Scanned in 00mn 00s



---\ HKCU & HKLM Software Keys
[HKCU\Software\AppDataLow\Software\Lyrics_Fan]  =>Adware.AddLyrics
[HKCU\Software\AppDataLow]
[HKCU\Software\Classes]
[HKCU\Software\Clients]
[HKCU\Software\CyberLink]
[HKCU\Software\DSiteProducts]
[HKCU\Software\Dnldstr_Aggregator]
[HKCU\Software\Google]
[HKCU\Software\Hewlett-Packard]
[HKCU\Software\InstallCore]  =>Adware.InstallCore
[HKCU\Software\Macromedia]
[HKCU\Software\Mine]
[HKCU\Software\MozillaPlugins]
[HKCU\Software\Mozilla]
[HKCU\Software\NVIDIA Corporation]
[HKCU\Software\Policies]
[HKCU\Software\Realtek]
[HKCU\Software\RegisteredApplications]
[HKCU\Software\Shemes]
[HKCU\Software\Symantec]
[HKCU\Software\TutoTag]  =>Spyware.AgenceExcusive
[HKCU\Software\Tutorials]  =>Spyware.AgenceExcusive
[HKCU\Software\WinRAR SFX]
[HKCU\Software\WinRAR]
[HKCU\Software\Wow6432Node]
[HKCU\Software\ZebHelpProcess Helper]
[HKLM\Software\AGEIA Technologies]
[HKLM\Software\ATI Technologies]
[HKLM\Software\Apple Inc.]
[HKLM\Software\Classes]
[HKLM\Software\Clients]
[HKLM\Software\CyberLink]
[HKLM\Software\Hewlett-Packard]
[HKLM\Software\Intel]
[HKLM\Software\Khronos]
[HKLM\Software\Macromedia]
[HKLM\Software\NVIDIA Corporation]
[HKLM\Software\Norton]
[HKLM\Software\ODBC]
[HKLM\Software\Policies]
[HKLM\Software\RTLSetup]
[HKLM\Software\Realtek Semiconductor Corp.]
[HKLM\Software\Realtek]
[HKLM\Software\RegisteredApplications]
[HKLM\Software\SRS Labs]
[HKLM\Software\SonicFocus]
[HKLM\Software\Symantec]
[HKLM\Software\Tarma Installer]  =>Toolbar.Tarma
[HKLM\Software\Waves Audio]
[HKLM\Software\Wow6432Node\AGEIA Technologies]
[HKLM\Software\Wow6432Node\Apple Inc.]
[HKLM\Software\Wow6432Node\Classes]
[HKLM\Software\Wow6432Node\Clients]
[HKLM\Software\Wow6432Node\CyberLink]
[HKLM\Software\Wow6432Node\Florian Heidenreich]
[HKLM\Software\Wow6432Node\Google]
[HKLM\Software\Wow6432Node\Hewlett-Packard]
[HKLM\Software\Wow6432Node\Intel]
[HKLM\Software\Wow6432Node\Khronos]
[HKLM\Software\Wow6432Node\Lake]
[HKLM\Software\Wow6432Node\Macromedia]
[HKLM\Software\Wow6432Node\MozillaPlugins]
[HKLM\Software\Wow6432Node\Mozilla]
[HKLM\Software\Wow6432Node\NVIDIA Corporation]
[HKLM\Software\Wow6432Node\Norton]
[HKLM\Software\Wow6432Node\ODBC]
[HKLM\Software\Wow6432Node\Policies]
[HKLM\Software\Wow6432Node\Ralink]
[HKLM\Software\Wow6432Node\Realtek Semiconductor Corp.]
[HKLM\Software\Wow6432Node\Realtek]
[HKLM\Software\Wow6432Node\RegisteredApplications]
[HKLM\Software\Wow6432Node\Symantec]
[HKLM\Software\Wow6432Node\TUTO_4PC]
[HKLM\Software\Wow6432Node\Tutorials]  =>Spyware.AgenceExcusive
[HKLM\Software\Wow6432Node\VideoLAN]
[HKLM\Software\Wow6432Node\WildTangent]
[HKLM\Software\Wow6432Node\WinRAR]
[HKLM\Software\Wow6432Node\eSafeSecControl]  =>PUP.eSafeSecurity
[HKLM\Software\Wow6432Node\qvo6Software]  =>Hijacker.Qvo6
[HKLM\Software\Wow6432Node]
~ Key Software: 151 Scanned in 00mn 00s



---\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 02/04/2013 - 21:41:07 - [0,602] ----D C:\Program Files (x86)\Bonjour
O43 - CFD: 27/07/2013 - 12:27:41 - [29,686] ----D C:\Program Files (x86)\Common Files
O43 - CFD: 02/04/2013 - 21:42:08 - [2,557] ----D C:\Program Files (x86)\Connected Music powered by Universal Music Group
O43 - CFD: 02/04/2013 - 21:47:34 - [-1369,853] ----D C:\Program Files (x86)\CyberLink
O43 - CFD: 27/07/2013 - 12:10:53 - [371,096] ----D C:\Program Files (x86)\Google
O43 - CFD: 01/08/2013 - 20:41:52 - [3,518] ----D C:\Program Files (x86)\GrabIt
O43 - CFD: 02/04/2013 - 21:52:29 - [195,421] ----D C:\Program Files (x86)\Hewlett-Packard
O43 - CFD: 02/04/2013 - 21:49:43 - [667,230] ----D C:\Program Files (x86)\HP Games
O43 - CFD: 02/04/2013 - 21:41:03 - [0,720] ----D C:\Program Files (x86)\HPConnectedMusic
O43 - CFD: 02/04/2013 - 21:47:09 - [194,919] --H-D C:\Program Files (x86)\InstallShield Installation Information
O43 - CFD: 02/04/2013 - 21:34:05 - [14,984] ----D C:\Program Files (x86)\Intel
O43 - CFD: 14/08/2013 - 23:30:39 - [4,623] ----D C:\Program Files (x86)\Internet Explorer
O43 - CFD: 02/04/2013 - 21:37:47 - [6,085] ----D C:\Program Files (x86)\Microsoft Office
O43 - CFD: 02/04/2013 - 21:50:39 - [5,306] ----D C:\Program Files (x86)\Microsoft SkyDrive
O43 - CFD: 02/04/2013 - 21:51:01 - [1,745] ----D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
O43 - CFD: 26/07/2012 - 10:12:59 - [0,023] ----D C:\Program Files (x86)\Microsoft.NET
O43 - CFD: 05/08/2013 - 20:05:31 - [6,743] ----D C:\Program Files (x86)\Mp3tag
O43 - CFD: 10/08/2012 - 17:09:11 - [0,025] ----D C:\Program Files (x86)\MSBuild
O43 - CFD: 02/04/2013 - 21:51:54 - [367,923] ----D C:\Program Files (x86)\Norton Internet Security
O43 - CFD: 02/04/2013 - 21:51:33 - [20,860] ----D C:\Program Files (x86)\NortonInstaller
O43 - CFD: 02/04/2013 - 21:29:05 - [111,427] ----D C:\Program Files (x86)\NVIDIA Corporation
O43 - CFD: 27/07/2013 - 11:01:15 - [1,563] R---D C:\Program Files (x86)\Online Services
O43 - CFD: 02/04/2013 - 21:34:51 - [33,681] ----D C:\Program Files (x86)\Realtek
O43 - CFD: 10/08/2012 - 17:09:11 - [36,536] ----D C:\Program Files (x86)\Reference Assemblies
O43 - CFD: 02/04/2013 - 21:52:21 - [2,444] ----D C:\Program Files (x86)\SymSilent
O43 - CFD: 02/04/2013 - 21:33:47 - [0] --H-D C:\Program Files (x86)\Temp
O43 - CFD: 07/08/2013 - 19:23:53 - [94,419] ----D C:\Program Files (x86)\VideoLAN
O43 - CFD: 07/08/2013 - 19:22:20 - [0,975] ----D C:\Program Files (x86)\Web Cake  =>Adware.WebCake
O43 - CFD: 02/04/2013 - 21:49:40 - [66,181] ----D C:\Program Files (x86)\WildGames
O43 - CFD: 01/08/2013 - 22:46:10 - [32,441] ----D C:\Program Files (x86)\WildTangent Games
O43 - CFD: 14/08/2013 - 23:30:43 - [1,038] ----D C:\Program Files (x86)\Windows Defender
O43 - CFD: 02/04/2013 - 21:51:00 - [86,758] ----D C:\Program Files (x86)\Windows Live
O43 - CFD: 29/07/2013 - 22:53:27 - [5,466] ----D C:\Program Files (x86)\Windows Mail
O43 - CFD: 29/07/2013 - 22:53:27 - [3,494] ----D C:\Program Files (x86)\Windows Media Player
O43 - CFD: 26/07/2012 - 10:13:01 - [0,209] ----D C:\Program Files (x86)\Windows Multimedia Platform
O43 - CFD: 26/07/2012 - 10:12:59 - [7,243] ----D C:\Program Files (x86)\Windows NT
O43 - CFD: 29/07/2013 - 22:54:40 - [5,226] ----D C:\Program Files (x86)\Windows Photo Viewer
O43 - CFD: 26/07/2012 - 10:13:01 - [0,209] ----D C:\Program Files (x86)\Windows Portable Devices
O43 - CFD: 26/07/2012 - 10:12:59 - [0] -SH-D C:\Program Files (x86)\Windows Sidebar
O43 - CFD: 02/08/2013 - 23:45:59 - [4,131] ----D C:\Program Files (x86)\WinRAR
O43 - CFD: 16/08/2013 - 22:35:58 - [16,467] ----D C:\Program Files (x86)\ZHPDiag
O43 - CFD: 02/04/2013 - 21:41:46 - [0,091] ----D C:\Program Files (x86)\Common Files\CyberLink
O43 - CFD: 02/04/2013 - 21:33:10 - [2,009] ----D C:\Program Files (x86)\Common Files\InstallShield
O43 - CFD: 02/04/2013 - 21:31:29 - [15,982] ----D C:\Program Files (x86)\Common Files\Microsoft Shared
O43 - CFD: 02/04/2013 - 21:40:58 - [1,416] ----D C:\Program Files (x86)\Common Files\Nikon
O43 - CFD: 02/04/2013 - 21:33:55 - [0,185] ----D C:\Program Files (x86)\Common Files\postureAgent
O43 - CFD: 26/07/2012 - 10:13:01 - [0,003] ----D C:\Program Files (x86)\Common Files\Services
O43 - CFD: 27/07/2013 - 12:27:41 - [0,595] ----D C:\Program Files (x86)\Common Files\Symantec Shared
O43 - CFD: 29/07/2013 - 22:53:26 - [9,406] ----D C:\Program Files (x86)\Common Files\System
O43 - CFD: 02/04/2013 - 21:50:28 - [0] ----D C:\Program Files (x86)\Common Files\Windows Live
O43 - CFD: 02/04/2013 - 21:41:07 - [2,558] ----D C:\ProgramData\Apple
O43 - CFD: 26/07/2012 - 09:22:08 - [0] --H-D C:\ProgramData\Application Data
O43 - CFD: 27/07/2013 - 10:46:37 - [0] --H-D C:\ProgramData\Bureau
O43 - CFD: 27/07/2013 - 12:09:49 - [0,212] ----D C:\ProgramData\CyberLink
O43 - CFD: 26/07/2012 - 09:22:08 - [0] --H-D C:\ProgramData\Desktop
O43 - CFD: 26/07/2012 - 09:22:08 - [0] --H-D C:\ProgramData\Documents
O43 - CFD: 16/08/2013 - 14:15:47 - [0,304] ----D C:\ProgramData\eSafe
O43 - CFD: 27/07/2013 - 10:57:12 - [6,722] ----D C:\ProgramData\Hewlett-Packard
O43 - CFD: 02/04/2013 - 21:47:09 - [0,108] ----D C:\ProgramData\install_clap
O43 - CFD: 02/04/2013 - 21:33:54 - [0,073] ----D C:\ProgramData\Intel
O43 - CFD: 27/07/2013 - 10:46:37 - [0] --H-D C:\ProgramData\Menu Démarrer
O43 - CFD: 28/07/2013 - 18:54:49 - [-2028,892] -S--D C:\ProgramData\Microsoft
O43 - CFD: 02/04/2013 - 21:50:33 - [0] ----D C:\ProgramData\Microsoft SkyDrive
O43 - CFD: 27/07/2013 - 10:46:37 - [0] --H-D C:\ProgramData\Modèles
O43 - CFD: 27/07/2013 - 10:59:31 - [282,665] ----D C:\ProgramData\Norton
O43 - CFD: 02/04/2013 - 21:51:33 - [1,160] ----D C:\ProgramData\NortonInstaller
O43 - CFD: 02/04/2013 - 21:30:33 - [0,000] ----D C:\ProgramData\NVIDIA
O43 - CFD: 02/04/2013 - 21:28:41 - [2,144] ----D C:\ProgramData\NVIDIA Corporation
O43 - CFD: 31/07/2013 - 20:39:32 - [0,039] ----D C:\ProgramData\PRICache
O43 - CFD: 02/04/2013 - 21:34:24 - [7,075] ----D C:\ProgramData\Ralink Driver
O43 - CFD: 26/07/2012 - 11:45:49 - [0,001] ----D C:\ProgramDataegid.1991-06.com.microsoft
O43 - CFD: 26/07/2012 - 09:22:08 - [0] --H-D C:\ProgramData\Start Menu
O43 - CFD: 07/08/2013 - 19:22:11 - [2,735] ----D C:\ProgramData\Tarma Installer  =>Toolbar.Tarma
O43 - CFD: 02/04/2013 - 21:47:34 - [2,164] ----D C:\ProgramData\Temp
O43 - CFD: 26/07/2012 - 09:22:08 - [0] --H-D C:\ProgramData\Templates
O43 - CFD: 01/08/2013 - 22:44:53 - [307,345] ----D C:\ProgramData\WildTangent
O43 - CFD: 02/04/2013 - 21:35:06 - [39,643] ----D C:\ProgramData\{9BF4D58B-C6D6-467B-BC5A-FD0C1278F4AF}
O43 - CFD: 05/08/2013 - 19:54:31 - [1,063] ----D C:\Users\Loïc\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z
O43 - CFD: 27/07/2013 - 11:01:18 - [0] ----D C:\Users\Loïc\AppData\Roaming\Adobe
O43 - CFD: 05/08/2013 - 19:54:26 - [0,091] ----D C:\Users\Loïc\AppData\Roaming\DSite
O43 - CFD: 05/08/2013 - 19:54:21 - [1,614] ----D C:\Users\Loïc\AppData\Roaming\eIntaller
O43 - CFD: 07/08/2013 - 20:02:55 - [29,525] ----D C:\Users\Loïc\AppData\Roaming\GrabIt
O43 - CFD: 27/07/2013 - 13:36:24 - [1,712] ----D C:\Users\Loïc\AppData\Roaming\Hewlett-Packard
O43 - CFD: 27/07/2013 - 11:28:00 - [0,002] ----D C:\Users\Loïc\AppData\Roaming\Macromedia
O43 - CFD: 27/07/2013 - 11:01:35 - [1,719] -S--D C:\Users\Loïc\AppData\Roaming\Microsoft
O43 - CFD: 16/08/2013 - 22:05:46 - [1,034] ----D C:\Users\Loïc\AppData\Roaming\Movdap
O43 - CFD: 05/08/2013 - 20:05:51 - [0,037] ----D C:\Users\Loïc\AppData\Roaming\Mp3tag
O43 - CFD: 02/08/2013 - 23:49:25 - [2,433] ----D C:\Users\Loïc\AppData\Roaming	or
O43 - CFD: 13/08/2013 - 23:17:11 - [0,119] ----D C:\Users\Loïc\AppData\Roaming\vlc
O43 - CFD: 11/08/2013 - 22:38:36 - [0,521] ----D C:\Users\Loïc\AppData\Roaming\Web Cake  =>Adware.WebCake
O43 - CFD: 01/08/2013 - 22:44:58 - [3,640] ----D C:\Users\Loïc\AppData\Roaming\WildTangent
O43 - CFD: 02/08/2013 - 23:46:10 - [0,000] ----D C:\Users\Loïc\AppData\Roaming\WinRAR
O43 - CFD: 27/07/2013 - 10:58:52 - [0] ----D C:\Users\Loïc\AppData\Local\Application Data
O43 - CFD: 27/07/2013 - 12:10:21 - [1,579] ----D C:\Users\Loïc\AppData\Local\Apps
O43 - CFD: 27/07/2013 - 11:00:05 - [6,234] ----D C:\Users\Loïc\AppData\Local\assembly
O43 - CFD: 27/07/2013 - 12:10:38 - [0] ----D C:\Users\Loïc\AppData\Local\Deployment
O43 - CFD: 27/07/2013 - 11:20:20 - [1,542] ----D C:\Users\Loïc\AppData\Local\Diagnostics
O43 - CFD: 07/08/2013 - 19:22:09 - [0,000] ----D C:\Users\Loïc\AppData\Local\eorezo  =>PUP.Eorezo
O43 - CFD: 27/07/2013 - 12:10:58 - [735,802] ----D C:\Users\Loïc\AppData\Local\Google
O43 - CFD: 02/08/2013 - 23:36:59 - [0,003] ----D C:\Users\Loïc\AppData\Local\Hewlett-Packard
O43 - CFD: 27/07/2013 - 10:58:52 - [0] ----D C:\Users\Loïc\AppData\Local\Historique
O43 - CFD: 14/08/2013 - 22:13:18 - [506,979] ----D C:\Users\Loïc\AppData\Local\Microsoft
O43 - CFD: 31/07/2013 - 20:39:33 - [749,491] ----D C:\Users\Loïc\AppData\Local\Packages
O43 - CFD: 27/07/2013 - 11:00:24 - [0,039] ----D C:\Users\Loïc\AppData\Local\Power2Go8
O43 - CFD: 07/08/2013 - 19:22:04 - [0] ----D C:\Users\Loïc\AppData\Local\Programs
O43 - CFD: 16/08/2013 - 22:36:19 - [56,282] ----D C:\Users\Loïc\AppData\Local\Temp
O43 - CFD: 27/07/2013 - 10:58:52 - [0] ----D C:\Users\Loïc\AppData\Local\Temporary Internet Files
O43 - CFD: 27/07/2013 - 10:59:25 - [0] ----D C:\Users\Loïc\AppData\Local\VirtualStore
O43 - CFD: 26/07/2012 - 10:13:00 - [0,004] R---D C:\Users\Loïc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
O43 - CFD: 26/07/2012 - 10:13:00 - [0,001] R---D C:\Users\Loïc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
O43 - CFD: 31/07/2013 - 20:39:36 - [0,000] R---D C:\Users\Loïc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
O43 - CFD: 26/07/2012 - 10:13:00 - [0,000] ----D C:\Users\Loïc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
O43 - CFD: 31/07/2013 - 20:39:36 - [0,000] R---D C:\Users\Loïc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
O43 - CFD: 26/07/2012 - 10:13:00 - [0,005] R---D C:\Users\Loïc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
~ Program Folder: 114 Scanned in 00mn 11s



---\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.AA96E587B18EE61C94DC3C6C8B08EF03] - 16/08/2013 - 20:49:14 ---A- . (...) -- C:\Windows\WindowsUpdate.log   [1632893]
O44 - LFC:[MD5.DE4496E9BCBD03A25CBB9CBCC45DB329] - 16/08/2013 - 09:59:58 -S-A- . (...) -- C:\Windows\bootstat.dat   [67584]
O44 - LFC:[MD5.89741FD208706704C41DCEBD96DF6A06] - 15/08/2013 - 12:20:56 ---A- . (...) -- C:\Windows\SysNative\perfc009.dat   [143646]
O44 - LFC:[MD5.03D7EF77E2D5066715AC2B2056CD370B] - 15/08/2013 - 12:20:56 ---A- . (...) -- C:\Windows\SysNative\perfc00C.dat   [170570]
O44 - LFC:[MD5.59A6414C45A2C62F21772E9BC2314CBF] - 15/08/2013 - 12:20:56 ---A- . (...) -- C:\Windows\SysNative\perfh009.dat   [697824]
O44 - LFC:[MD5.E94A50A75D71FCF5C6E4BE3CE53986D6] - 15/08/2013 - 12:20:56 ---A- . (...) -- C:\Windows\SysNative\perfh00C.dat   [789076]
O44 - LFC:[MD5.89741FD208706704C41DCEBD96DF6A06] - 15/08/2013 - 12:20:56 RSHAD . (...) -- C:\Windows\System32\perfc009.dat   [143646]
O44 - LFC:[MD5.03D7EF77E2D5066715AC2B2056CD370B] - 15/08/2013 - 12:20:56 RSHAD . (...) -- C:\Windows\System32\perfc00C.dat   [170570]
O44 - LFC:[MD5.59A6414C45A2C62F21772E9BC2314CBF] - 15/08/2013 - 12:20:56 RSHAD . (...) -- C:\Windows\System32\perfh009.dat   [697824]
O44 - LFC:[MD5.E94A50A75D71FCF5C6E4BE3CE53986D6] - 15/08/2013 - 12:20:56 RSHAD . (...) -- C:\Windows\System32\perfh00C.dat   [789076]
O44 - LFC:[MD5.9BE8DF2910CEC265FFBD6BA2C61D3784] - 15/08/2013 - 12:20:55 ---A- . (...) -- C:\Windows\SysNative\PerfStringBackup.INI   [1797530]
O44 - LFC:[MD5.9BE8DF2910CEC265FFBD6BA2C61D3784] - 15/08/2013 - 12:20:55 ---A- . (...) -- C:\Windows\System32\PerfStringBackup.INI   [1797530]
O44 - LFC:[MD5.B30DCBAEA0D6432ADB6282357343B9BF] - 15/08/2013 - 12:15:04 ---A- . (...) -- C:\Windows\PFRO.log   [10756]
O44 - LFC:[MD5.6021421B802C92B07C0DC54EB5884520] - 14/08/2013 - 20:56:07 ---A- . (...) -- C:\Windows\setupact.log   [26960]
O44 - LFC:[MD5.19AEF9DE6A175C85DFF87C0ED0AB5386] - 13/08/2013 - 20:06:20 ---A- . (.Microsoft Corporation - Outil de suppression de logiciels malveilla.) -- C:\Windows\SysNative\MRT.exe   [78161360]
O44 - LFC:[MD5.19AEF9DE6A175C85DFF87C0ED0AB5386] - 13/08/2013 - 20:06:20 RSHAD . (.Microsoft Corporation - Outil de suppression de logiciels malveilla.) -- C:\Windows\System32\MRT.exe   [78161360]
O44 - LFC:[MD5.6BDCC68E85A386414E4E028DEB768350] - 13/08/2013 - 19:57:24 ---A- . (.Microsoft Corporation - Runtime d'appel de procédure distante.) -- C:\Windows\SysNativepcrt4.dll   [1314816]
O44 - LFC:[MD5.6BDCC68E85A386414E4E028DEB768350] - 13/08/2013 - 19:57:24 ---A- . (.Microsoft Corporation - Runtime d'appel de procédure distante.) -- C:\Windows\System32pcrt4.dll   [1314816]
O44 - LFC:[MD5.1794C43A000A47D92B3304FC1E3E512A] - 13/08/2013 - 19:57:23 RSHAD . (.Microsoft Corporation - Pilote TCP/IP.) -- C:\Windows\System32\Drivers	cpip.sys   [2233168]
O44 - LFC:[MD5.FD47DF026B32969B8A68721A0243E8EE] - 13/08/2013 - 19:57:12 RSHAD . (.Microsoft Corporation - Microsoft antimalware boot driver.) -- C:\Windows\System32\Drivers\WdBoot.sys   [36288]
O44 - LFC:[MD5.5F425D842DD6ADE9F95A51A0616AFAD7] - 13/08/2013 - 19:57:12 RSHAD . (.Microsoft Corporation - Microsoft antimalware file system filter dr.) -- C:\Windows\System32\Drivers\WdFilter.sys   [247216]
O44 - LFC:[MD5.E4C853E60734B3F6067B7F17FC178E8E] - 13/08/2013 - 19:57:10 ---A- . (.Microsoft Corporation - Bibliothèque de thèmes Ux Microsoft.) -- C:\Windows\SysNative\uxtheme.dll   [915968]
O44 - LFC:[MD5.E4C853E60734B3F6067B7F17FC178E8E] - 13/08/2013 - 19:57:10 ---A- . (.Microsoft Corporation - Bibliothèque de thèmes Ux Microsoft.) -- C:\Windows\System32\uxtheme.dll   [915968]
O44 - LFC:[MD5.BBFE238B22F808C88AF039EF83BABAD6] - 13/08/2013 - 19:57:10 ---A- . (.Microsoft Corporation - Windows User Experience Session Initializat.) -- C:\Windows\SysNative\UXInit.dll   [53760]
O44 - LFC:[MD5.BBFE238B22F808C88AF039EF83BABAD6] - 13/08/2013 - 19:57:10 ---A- . (.Microsoft Corporation - Windows User Experience Session Initializat.) -- C:\Windows\System32\UXInit.dll   [53760]
O44 - LFC:[MD5.04DE09B1E287F6DC5C7FD655B6E84AB9] - 13/08/2013 - 19:57:09 ---A- . (.Microsoft Corporation - JScript Proxy Auto-Configuration.) -- C:\Windows\SysNative\jsproxy.dll   [53760]
O44 - LFC:[MD5.04DE09B1E287F6DC5C7FD655B6E84AB9] - 13/08/2013 - 19:57:09 ---A- . (.Microsoft Corporation - JScript Proxy Auto-Configuration.) -- C:\Windows\System32\jsproxy.dll   [53760]
O44 - LFC:[MD5.3A2FD42F11CD325A4ACAFE7FB0EEA83A] - 13/08/2013 - 19:57:09 ---A- . (.Microsoft Corporation - Microsoft® MSHTML Typelib.) -- C:\Windows\SysNative\mshtml.tlb   [2706432]
O44 - LFC:[MD5.3A2FD42F11CD325A4ACAFE7FB0EEA83A] - 13/08/2013 - 19:57:09 ---A- . (.Microsoft Corporation - Microsoft® MSHTML Typelib.) -- C:\Windows\System32\mshtml.tlb   [2706432]
O44 - LFC:[MD5.622C7C8D39609FCEACE3508715D48C7F] - 13/08/2013 - 19:57:09 ---A- . (.Microsoft Corporation - Traitement de RunOnce complet avec interfac.) -- C:\Windows\SysNative\iernonce.dll   [39936]
O44 - LFC:[MD5.622C7C8D39609FCEACE3508715D48C7F] - 13/08/2013 - 19:57:09 ---A- . (.Microsoft Corporation - Traitement de RunOnce complet avec interfac.) -- C:\Windows\System32\iernonce.dll   [39936]
O44 - LFC:[MD5.6C8BDC9F16943D626DFE8A987BCCFD20] - 13/08/2013 - 19:57:09 ---A- . (.Microsoft Corporation - Utilitaire d'initialisation d'Internet Expl.) -- C:\Windows\SysNative\ie4uinit.exe   [51712]
O44 - LFC:[MD5.6C8BDC9F16943D626DFE8A987BCCFD20] - 13/08/2013 - 19:57:09 RSHAD . (.Microsoft Corporation - Utilitaire d'initialisation d'Internet Expl.) -- C:\Windows\System32\ie4uinit.exe   [51712]
O44 - LFC:[MD5.AC155DD9BD1E6D3B740826A4D1C68AAE] - 13/08/2013 - 19:57:08 ---A- . (.Microsoft Corporation - Extensions Internet pour Win32.) -- C:\Windows\SysNative\wininet.dll   [2241024]
O44 - LFC:[MD5.AC155DD9BD1E6D3B740826A4D1C68AAE] - 13/08/2013 - 19:57:08 ---A- . (.Microsoft Corporation - Extensions Internet pour Win32.) -- C:\Windows\System32\wininet.dll   [2241024]
O44 - LFC:[MD5.289C5E0A386E7B6CA9539D66D15E22CC] - 13/08/2013 - 19:57:08 ---A- . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\Windows\SysNative\urlmon.dll   [1365504]
O44 - LFC:[MD5.289C5E0A386E7B6CA9539D66D15E22CC] - 13/08/2013 - 19:57:08 ---A- . (.Microsoft Corporation - Extensions OLE32 pour Win32.) -- C:\Windows\System32\urlmon.dll   [1365504]
O44 - LFC:[MD5.D8CC9A20C517A54678363C4C77B930A4] - 13/08/2013 - 19:57:08 ---A- . (.Microsoft Corporation - IE Sysprep Provider.) -- C:\Windows\SysNative\iesysprep.dll   [136704]
O44 - LFC:[MD5.D8CC9A20C517A54678363C4C77B930A4] - 13/08/2013 - 19:57:08 ---A- . (.Microsoft Corporation - IE Sysprep Provider.) -- C:\Windows\System32\iesysprep.dll   [136704]
O44 - LFC:[MD5.963B29E0EFB20D66436214DB7C43D7F7] - 13/08/2013 - 19:57:08 ---A- . (.Microsoft Corporation - IOD Version Map.) -- C:\Windows\SysNative\iesetup.dll   [67072]
O44 - LFC:[MD5.963B29E0EFB20D66436214DB7C43D7F7] - 13/08/2013 - 19:57:08 ---A- . (.Microsoft Corporation - IOD Version Map.) -- C:\Windows\System32\iesetup.dll   [67072]
O44 - LFC:[MD5.8C12653BEA781902AA60E4A855A55D5C] - 13/08/2013 - 19:57:08 ---A- . (.Microsoft Corporation - Microsoft Feeds Manager.) -- C:\Windows\SysNative\msfeeds.dll   [603136]
O44 - LFC:[MD5.8C12653BEA781902AA60E4A855A55D5C] - 13/08/2013 - 19:57:08 ---A- . (.Microsoft Corporation - Microsoft Feeds Manager.) -- C:\Windows\System32\msfeeds.dll   [603136]
O44 - LFC:[MD5.677A1C1B0F254EC918D84A7FE29274CA] - 13/08/2013 - 19:57:07 ---A- . (.Microsoft Corporation - Navigateur Internet.) -- C:\Windows\SysNative\ieframe.dll   [15405056]
O44 - LFC:[MD5.677A1C1B0F254EC918D84A7FE29274CA] - 13/08/2013 - 19:57:07 ---A- . (.Microsoft Corporation - Navigateur Internet.) -- C:\Windows\System32\ieframe.dll   [15405056]
O44 - LFC:[MD5.16FE878530FDFC9AB08B7FFC32335958] - 13/08/2013 - 19:57:06 ---A- . (.Microsoft Corporation - Microsoft (R) JScript.) -- C:\Windows\SysNative\jscript.dll   [855552]
O44 - LFC:[MD5.16FE878530FDFC9AB08B7FFC32335958] - 13/08/2013 - 19:57:06 ---A- . (.Microsoft Corporation - Microsoft (R) JScript.) -- C:\Windows\System32\jscript.dll   [855552]
O44 - LFC:[MD5.396889142BD839DB8A055A0BE0AD2F79] - 13/08/2013 - 19:57:05 ---A- . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\SysNative\mshtml.dll   [19239424]
O44 - LFC:[MD5.396889142BD839DB8A055A0BE0AD2F79] - 13/08/2013 - 19:57:05 ---A- . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll   [19239424]
O44 - LFC:[MD5.5A7FA01EEC393A3E0D0F3EBAA1FD959E] - 13/08/2013 - 19:56:58 ---A- . (.Microsoft Corporation - Microsoft (R) JScript.) -- C:\Windows\SysNative\jscript9.dll   [3958784]
O44 - LFC:[MD5.5A7FA01EEC393A3E0D0F3EBAA1FD959E] - 13/08/2013 - 19:56:58 ---A- . (.Microsoft Corporation - Microsoft (R) JScript.) -- C:\Windows\System32\jscript9.dll   [3958784]
O44 - LFC:[MD5.65546D87F7A78AB31841A536456CB94D] - 13/08/2013 - 19:56:58 ---A- . (.Microsoft Corporation - Utilitaire à l'exécution pour Internet Expl.) -- C:\Windows\SysNative\iertutil.dll   [2647040]
O44 - LFC:[MD5.65546D87F7A78AB31841A536456CB94D] - 13/08/2013 - 19:56:58 ---A- . (.Microsoft Corporation - Utilitaire à l'exécution pour Internet Expl.) -- C:\Windows\System32\iertutil.dll   [2647040]
O44 - LFC:[MD5.F68F697F5B4E74217159C38FFFD37964] - 13/08/2013 - 19:56:41 ---A- . (.Microsoft Corporation - Application Reputation APIs Dll.) -- C:\Windows\SysNative\apprepapi.dll   [124416]
O44 - LFC:[MD5.F68F697F5B4E74217159C38FFFD37964] - 13/08/2013 - 19:56:41 ---A- . (.Microsoft Corporation - Application Reputation APIs Dll.) -- C:\Windows\System32\apprepapi.dll   [124416]
O44 - LFC:[MD5.B6FCC2BB7D1044EA0FC4B573951BE8DC] - 13/08/2013 - 19:56:41 ---A- . (.Microsoft Corporation - Crypto API32.) -- C:\Windows\SysNative\crypt32.dll   [1889280]
O44 - LFC:[MD5.B6FCC2BB7D1044EA0FC4B573951BE8DC] - 13/08/2013 - 19:56:41 ---A- . (.Microsoft Corporation - Crypto API32.) -- C:\Windows\System32\crypt32.dll   [1889280]
O44 - LFC:[MD5.74466D77EE8588C04B95AE9DBC693EF8] - 13/08/2013 - 19:56:41 ---A- . (.Microsoft Corporation - Microsoft Trust Verification APIs.) -- C:\Windows\SysNative\wintrust.dll   [337408]
O44 - LFC:[MD5.74466D77EE8588C04B95AE9DBC693EF8] - 13/08/2013 - 19:56:41 ---A- . (.Microsoft Corporation - Microsoft Trust Verification APIs.) -- C:\Windows\System32\wintrust.dll   [337408]
O44 - LFC:[MD5.5CE2742F063731EC10C1B2EE386A2C08] - 13/08/2013 - 19:56:41 ---A- . (.Microsoft Corporation - Services de chiffrement.) -- C:\Windows\SysNative\cryptsvc.dll   [68096]
O44 - LFC:[MD5.E4E889A9CA3E8CCEE6FB5D1B4F94296F] - 13/08/2013 - 19:56:

2011N2 · Answer

Re,

Héberge-le comme demandé stp. :)

Gabriel.

lk1979 · Answer

ok, comment je fais ? (tu vois mon niveau !)

2011N2 · Answer

Re,

C'est dit dans le tuto, comme ceci^^ http://www.forum-entraide-informatique.com/support/cjoint-com-tutoriel-t2939.html

Gabriel.

lk1979 · Answer

https://www.cjoint.com/?3HqwZMdOg09

2011N2 · Answer

Re,

Ok. :)

Ton ordinateur est infecté par des PUPs/LPIs.

Les PUPs/LPIs (Logiciels Potentiellement Indésirables) sont des programmes indésirables qui généralement, affichent des publicités et installent des barres d'outils (toolbars). Ils s'installent en même temps que l'installation d'autres logiciels, en général, gratuits.
Ils modifient les paramètres des navigateurs (page de démarrage et de recherche).
Afin d'éviter cela, il faut donc faire attention lors de l'installation des logiciels (surtout ceux gratuits), et ne pas installer les modules complémentaires proposés avec ceux-là (en décochant les cases, souvent pré-cochées). Il est également fortement conseillé de télécharger les logiciels sur le site de l'éditeur (et non Softonic, 01Net, etc... qui incluent dans leurs installations ce genre de programmes néfastes).

Nous allons nous occuper de les éradiquer.

- Télécharge AdwCleaner (d'Xplode) sur ton bureau.
- Lance le, clique sur [Recherche] puis patiente le temps du scan.
- Une fois le scan fini, un rapport s'ouvrira. Poste moi son contenu dans ta prochaine réponse.

Note : Le rapport est également sauvegardé sous C:\AdwCleaner[R1].txt

Un tutoriel sur AdwCleaner est disponible ici : http://www.forum-entraide-informatique.com/support/adwcleaner-tutoriel-t875.html

Gabriel.

lk1979 · Answer

voilà

https://www.cjoint.com/?3HqxaQOjJnh

2011N2 · Answer

Re,

Ok, passe le en suppression et poste moi le rapport obtenu après le redémarrage du PC.

Gabriel.

lk1979 · Answer

https://www.cjoint.com/?3HqxhKv54Nf

2011N2 · Answer

Re,

Nickel, fais ceci maintenant : http://www.forum-entraide-informatique.com/support/malwarebytes-anti-malware-mbam-tutoriel-t6.html

Tu pourras donc garder ce logiciel.

Gabriel.

lk1979 · Answer

je ne sais pas ce que tu vois dans le rapport, mais pour moi ça va mieux, plus de mots verts !
donc pour moi pb résolu sauf si tu vois autre chose.
merci bcp

2011N2 · Answer

Re,

Ok super, mais il y a surement des restes, donc continue à suivre mes consignes (donc MBAM dans mon précédent message).

Gabriel.

lk1979 · Answer

MBAM fini, 31 éléments supprimés.
encore merci !

2011N2 · Answer

Re,

Tu n'as pas le rapport ? :)
Car tu vois, cela signifie bien qu'il y a encore des restes, si on ne les enlève pas tous il est possible que l'infection revienne.

Gabriel.

lk1979 · Answer

non je l'ai déjà effacé.
j'ai sélectionné et supprimé les 31 éléments indiqués (des PUPs apparemment)
je vais faire tourner une autre analyse voir ce que ça donne et je t'envoie le fichier si tu veux.

2011N2 · Answer

Re,

Non pas la peine, fais moi un nouveau ZHPDiag. :)

Gabriel.

lk1979 · Answer

et voilà
https://www.cjoint.com/?3HraExdPks0

2011N2 · Answer

Re,

Tu peux refaire en cliquant sur Configurer, puis sur la loupe la plus à droite (diagnostic full options) ?

Merci,

Gabriel.

lk1979 · Answer

https://www.cjoint.com/?3HraJAoDPfM

Mots en verts soulignés deux fois ouvrant une fenêtre de pub

27 réponses

Discussions similaires

Newsletters