Publicité
Publicité
Format du document : text/plain
Prévisualisation
Rapport de ZHPDiag v2013.6.10.15 par Nicolas Coolman, Update du 10/06/2013
Run by Jon at 13/06/2013 19:43:06
WebSite: http://nicolascoolman.webs.com
State : Version � jour.
WhiteList : Enable
High Elevated Privileges : OK
UAC : Activate by user
---\\ Web Browser
MSIE: Internet Explorer v10.0.9200.16576
OPIE: Opera v12.15 (Defaut)
---\\ Windows Product Information
~ Langage: Fran�ais
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : RMV82
Windows License : OK
~ Windows Remaining Initializations Number : 4
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ System Protection
McAfee Security Scan Plus v3.0.318.3
Windows Defender W7
---\\ System Optimizer
---\\ Peer To Peer (P2P)
---\\ Software Update
Adobe Flash Player 11 Plugin
Adobe Reader 9.1.2 - Fran�ais
---\\ System Information
~ Processor: Intel64 Family 6 Model 37 Stepping 5, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3828 MB (53% free)
System Restore: Activ� (Enable)
System drive C: has 270 GB (59%) free of 451 GB
---\\ Logged in mode
~ Computer Name: JON-PC
~ User Name: Jon
~ All Users Names: UpdatusUser, Jon, HomeGroupUser$, Administrateur,
~ Unselected Option: None
Logged in as Administrator
---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Users\Jon\AppData\Roaming\
~ %Desktop% : C:\Users\Jon\Desktop\
~ %Favorites% : C:\Users\Jon\Favorites\
~ %LocalAppData% : C:\Users\Jon\AppData\Local\
~ %StartMenu% : C:\Users\Jon\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 270 Go of 451 Go)
D:\ CD-ROM drive (Not Inserted)
E:\ CD-ROM drive (Not Inserted)
F:\ CD-ROM drive (Not Inserted)
G:\ CD-ROM drive (Not Inserted)
H:\ CD-ROM drive (Not Inserted)
Q:\ Hard drive, Flash drive, Thumb drive (Free 0 Go of 0 Go)
---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: 29 Legitimates Filtered in 00mn 00s
---\\ Recherche particuli�re de fichiers g�n�riques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de d�marrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.27A9000C534AA9BADC9EE74940F50C6D] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.05/04/2013 - 07:52:14.) -- C:\Windows\System32\wininet.dll [2242048]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d�ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Biblioth�que de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.1C7857B62DE5994A75B054A9FD4C3825] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/12/2011 - 04:59:24.) -- C:\Windows\system32\Drivers\AFD.sys [498688]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du syst�me de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parall�le.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de clich� instantan� du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 01s
---\\ Etat des fichiers cach�s (Cach�/Total)
~ Mes images (My Pictures) : 1/880
~ Mes musiques (My Musics) : 1/4956
~ Mes Videos (My Videos) : 1/330
~ Mes Favoris (My Favorites) : 1/29
~ Mes Documents (My Documents) : 2/2561
~ Mon Bureau (My Desktop) : 3/1306
~ Menu demarrer (Programs) : 1/41
~ Hidden Files: Scanned in 00mn 17s
---\\ Processus lanc�s
[MD5.EBDD3032297EF6832A1D6D3AA6DC3537] - (.SoftThinks - Dell - Dell DataSafe Local Backup.) -- C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.exe [4259648] [PID.2596]
[MD5.CD4F7B90CB09831BCDEDE0A206CCDB35] - (.Pas de propri�taire - ST Service Scheduling.) -- C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.exe [2751808] [PID.2620]
[MD5.09890A2F032B138A74B5DF2C1233FB1D] - (.SoftThinks - Dell - DataSafe Update Launcher.) -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe [460096] [PID.2696]
[MD5.A358C6D2F299ACDE00D40C605BA5FEDC] - (.Pas de propri�taire - FF_Protection MFC Application.) -- C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [727664] [PID.4416]
[MD5.1542D48BEF0C07513453CDEF1577BB79] - (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe [691656] [PID.4436]
[MD5.51C8885B6A00904C0252704C9FB0F43A] - (.Renesas Electronics Corporation - USB 3.0 Monitor.) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288] [PID.4704]
[MD5.25107F58D1B8F60D67D1EE95798C0DE8] - (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696] [PID.4768]
[MD5.637E9EEA864CE9C5778E3C4358B1E0D1] - (.Pas de propri�taire - DataSafeOnline.) -- C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe [1807680] [PID.4792]
[MD5.BD713579A87D698E1F2158CE10E48130] - (.McAfee, Inc. - McAfee Security Scanner Scheduler.) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe [272248] [PID.4872]
[MD5.30293898C1A9DFBCFE38EB6A2F7D555A] - (.Creative Technology Ltd - WebcamDell2.exe.) -- C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [487562] [PID.5032]
[MD5.5AB1FEDB151D7B732B8C004A1E90ABCF] - (.Pas de propri�taire - Roxio Burn Launcher.) -- C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [518640] [PID.1424]
[MD5.C5520FEB7AD5F6E3692B6DE41F6A1A27] - (.Opera Software - Opera Internet Browser.) -- C:\Program Files (x86)\Opera\opera.exe [879456] [PID.4256]
[MD5.93DB1FF92B03D24738A71E6E4992DFD3] - (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552] [PID.1012]
[MD5.3A32FAFEEE290E6E6C058DE59EC4EC88] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [7478272] [PID.4124]
[MD5.0840ABBBDF438691EE65A20040635CBE] - (.Stardock Corporation - Dock Login Service.) -- C:\Program Files\Dell\DellDock\DockLogin.exe [155648] [PID.1192]
[MD5.1713D9DE407313138118D501B0E3C05B] - (...) -- C:\Windows\SysWOW64\PnkBstrA.exe [75136] [PID.2040]
[MD5.74EC60E20516AAA573BE74F31175270F] - (.SoftThinks SAS - SoftThinks Agent Service.) -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.exe [1692480] [PID.2028]
[MD5.C3CDDD18F43D44AB713CF8C4916F7696] - (.Microsoft Corporation - Microsoft Application Virtualization Virtua.) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [219496] [PID.2068]
[MD5.C6539A0CB1EBFF488D3D4B070C4F17F8] - (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [235624] [PID.2144]
[MD5.13693B6354DD6E72DC5131DA7D764B90] - (.Microsoft Corporation - Microsoft Application Virtualization Client.) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [508776] [PID.2904]
[MD5.72794D112CBAFF3BC0C29BF7350D4741] - (.Microsoft Corporation - Microsoft Office Client Virtualization Serv.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.exe [822624] [PID.3800]
[MD5.31A0E93CDF29007D6C6FFFB632F375ED] - (.Intel Corporation - IAStorDataSvc.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [13336] [PID.2120]
[MD5.23D990150D56B670A62B21B9ABDD45EE] - (.Intel Corporation - Local Manageability Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [325656] [PID.4836]
[MD5.6DF10645A794878776DC8F5338427388] - (.NVIDIA Corporation - NVIDIA Settings Update Manager.) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [1620584] [PID.4952]
[MD5.CBDEE152D73200EE49031A26310B9D3E] - (.Intel Corporation - User Notification Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2533400] [PID.5572]
~ Processes Running: Scanned in 00mn 02s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
P2 - FPN: [HKLM] [@mcafee.com/MSC,version=10] - (...) -- C:\Program Files\mcafee\msc\npMcSnFFPl64.dll
~ Firefox Browser: 4 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, D�marrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com
R3 - URLSearchHook: WinZipBar Toolbar [64Bits] - {50fafaf0-70a9-419d-a109-fa4b4ffd4e37} . (.Conduit Ltd. - Conduit Toolbar.) (6.4.0.0) -- C:\Program Files (x86)\WinZipBar\prxtbWinZ.dll =>Toolbar.Conduit
~ IE Browser: 17 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21
---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: WinZipBar [64Bits] - {50fafaf0-70a9-419d-a109-fa4b4ffd4e37} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files (x86)\WinZipBar\prxtbWinZ.dll =>Toolbar.Conduit
~ BHO: 8 Legitimates Filtered in 00mn 00s
---\\ Applications d�marr�es par registre & par dossier (O4)
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe (.not file.)
O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
O4 - HKLM\..\Run: [RtHDVBg] . (.Realtek Semiconductor - HD Audio Background Process.) -- C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
O4 - HKLM\..\Run: [NVHotkey] . (.NVIDIA Corporation - NVIDIA Hotkey Service, Version 259.39.) -- C:\Windows\system32\nvHotkey.dll
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [IntelWireless] . (.Intel(R) Corporation - Intel(R) PROSet/Wireless Framework.) -- C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
O4 - HKLM\..\Run: [QuickSet] . (.Dell Inc. - QuickSet.) -- c:\Program Files\Dell\QuickSet\QuickSet.exe
O4 - HKLM\..\Run: [FreeFallProtection] . (.Pas de propri�taire - FF_Protection MFC Application.) -- C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe
O4 - HKLM\..\Wow6432Node\Run: [NUSB3MON] . (.Renesas Electronics Corporation - USB 3.0 Monitor.) -- c:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
O4 - HKLM\..\Wow6432Node\Run: [IAStorIcon] . (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe
O4 - HKLM\..\Wow6432Node\Run: [Dell DataSafe Online] . (.Pas de propri�taire - DataSafeOnline.) -- C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
O4 - HKLM\..\Wow6432Node\Run: [mcui_exe] . (.McAfee, Inc. - McAfee Security Center.) -- C:\Program Files\McAfee.com\Agent\mcagent.exe
O4 - HKLM\..\Wow6432Node\Run: [Dell Webcam Central] . (.Creative Technology Ltd - WebcamDell2.exe.) -- C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
O4 - HKLM\..\Wow6432Node\Run: [RoxWatchTray] . (.Sonic Solutions - RoxMMTrayApp Module.) -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe
O4 - HKLM\..\Wow6432Node\Run: [Desktop Disc Tool] . (.Pas de propri�taire - Roxio Burn Launcher.) -- C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
O4 - HKLM\..\Wow6432Node\Run: [DellSupportCenter] C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (.not file.)
O4 - HKLM\..\Wow6432Node\Run: [H2O] C:\Program Files (x86)\SyncroSoft\Pos\H2O\cledx.exe (.not file.)
O4 - HKLM\..\Wow6432Node\Run: [HBLiteSA] . (.Pinball Corporation. - Hotbar Search Assistant.) -- C:\Program Files (x86)\HBLite\bin\11.0.342.0\HBLiteSA.exe =>Adware.HotBar
O4 - HKLM\..\Wow6432Node\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] . (.Dell - Update Client for Dell DataSafe Local Backu.) -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe
O4 - HKLM\..\Wow6432Node\RunOnce: [Launcher] . (.Softthinks - VistaLauncher.) -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-21-4143903921-1717393621-435963149-1001\..\Run: [DAEMON Tools Lite] . (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe
~ Application: Scanned in 00mn 02s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Accessories: Private Character Editor.lnk . (.Microsoft Corporation - �diteur de caract�res priv�s.) -- C:\Windows\system32\eudcedit.exe
O4 - GS\SendTo: Fax Recipient.lnk . (.Microsoft Corporation - Microsoft Windows Fax and Scan.) -- C:\Windows\system32\WFS.exe
O4 - GS\Desktop: Cubase SX 3.lnk . (...) -- C:\Program Files (x86)\Steinberg\Cubase SX 3\Cubasesx3.exe (.not file.)
O4 - GS\Desktop: Jouer � Rayman Maternelle.lnk . (...) -- C:\Windows\UbiSoft\UbiSetup.exe (.not file.)
O4 - GS\TaskBar: Windows Explorer.lnk . (.Microsoft Corporation - Explorateur Windows.) -- C:\Windows\explorer.exe
O4 - GS\TaskBar: Windows Media Player.lnk . (.Microsoft Corporation - Lecteur Windows Media.) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SendTo: Skype.lnk . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O4 - GS\Desktop: Cubase 5.lnk . (.Steinberg Media Technologies - Cubase.) -- C:\Program Files (x86)\Steinberg\Cubase 5\Cubase5.exe
~ Global Startup: Scanned in 00mn 01s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{2ACEEDBA-E589-4A91-9102-C63B8A9BE12C}: NameServer = 0.0.0.0
O17 - HKLM\System\CCS\Services\Tcpip\..\{07C7E841-CE58-4255-AB76-896F39415428}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CCS\Services\Tcpip\..\{430EFD16-1B9B-448A-B392-C02C1D66E04D}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CS1\Services\Tcpip\..\{2ACEEDBA-E589-4A91-9102-C63B8A9BE12C}: NameServer = 0.0.0.0
O17 - HKLM\System\CS1\Services\Tcpip\..\{07C7E841-CE58-4255-AB76-896F39415428}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CS1\Services\Tcpip\..\{430EFD16-1B9B-448A-B392-C02C1D66E04D}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CS2\Services\Tcpip\..\{2ACEEDBA-E589-4A91-9102-C63B8A9BE12C}: NameServer = 0.0.0.0
O17 - HKLM\System\CS2\Services\Tcpip\..\{07C7E841-CE58-4255-AB76-896F39415428}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CS2\Services\Tcpip\..\{430EFD16-1B9B-448A-B392-C02C1D66E04D}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.240 212.27.40.241
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-cl�s Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-cl�s Winlogon Notify (autorun) (O20)
O20 - AppInit_DLLs: . (.NVIDIA Corporation - NVIDIA Compatible NVIDIA shim initializatio.) - C:\Windows\system32\nvinitx.dll
~ AppInit DLL: Scanned in 00mn 00s
---\\ T�ches planifi�es en automatique (O39)
[MD5.B1170C32975AF4DFB6824476CC79C2BB] [APT] [PCDEventLauncherTask] (.PC-Doctor, Inc..) -- C:\Program Files\My Dell\sessionchecker.exe [427088]
[MD5.72971F1381EB8FA85E875656FA023E23] [APT] [PCDoctorBackgroundMonitorTask] (.PC-Doctor, Inc..) -- C:\Program Files\My Dell\uaclauncher.exe [1182280]
[MD5.00000000000000000000000000000000] [APT] [{537DA72E-F416-4370-B2E5-F97E0C40C68A}] (...) -- C:\Users\Jon\Desktop\ALESIS_USB2_WIN32_2.9.13\Setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{D1C95544-D79B-4774-ADBC-6E2533F2A293}] (...) -- C:\Users\Jon\Documents\groupes\MAO\Steinberg Cubase 5.1 Portable\Cubase5.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{D30274B3-0A8B-4CEF-954E-8E9B2C2E5344}] (...) -- E:\Autorun.exe (.not file.) [0]
[MD5.2E7BC5B75DF9C7BC2A53A32964C2D899] [APT] [{DC01D5CD-FFB9-49F0-A3BA-58A75F538655}] (.InstallShield Software Corporation.) -- C:\Users\Jon\Documents\groupes\MAO\Programmes MAO\BBE Sonic maxiamzer DX Plug v1.0.0.1\BBE Sonic maxiamzer DX Plug v1.0.0.1\SETUP.exe [59904]
~ Scheduled Task: 8 Legitimates Filtered in 00mn 10s
---\\ Logiciels install�s (O42)
O42 - Logiciel: Addictive Drums - (...) [HKLM][64Bits] -- Addictive Drums
O42 - Logiciel: Alesis USB Audio driver - (...) [HKLM][64Bits] -- USB_AUDIO_DEusb-audio.deAlesis
O42 - Logiciel: CrazyLoader - (...) [HKLM][64Bits] -- CrazyLoader =>Adware.SPointer
O42 - Logiciel: Hotbar - (.Pinball Corporation..) [HKLM][64Bits] -- HBLiteSA =>Adware.HotBar
O42 - Logiciel: Mark Studio 1 1.2.1 - (.Overloud.) [HKLM][64Bits] -- {57B71859-24CC-4857-8A0D-B4B52E7729DD}_is1
O42 - Logiciel: Rayman Maternelle - (...) [HKLM][64Bits] -- Rayman Maternelle
O42 - Logiciel: Waves Complete VST RTAS TDM v7.1.16 - (...) [HKLM][64Bits] -- Waves Complete v7_is1
~ Logic: 149 Legitimates Filtered in 00mn 00s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\AppDataLow\Software\ConduitSearchScopes]
[HKCU\Software\AppDataLow\Toolbar]
[HKCU\Software\Waves MultiRack]
[HKCU\Software\XLN Audio]
[HKCU\Software\hblitesa] =>Adware.HotBar
[HKLM\Software\Wow6432Node\HBLite] =>Adware.HotBar
[HKLM\Software\Wow6432Node\MIDI Plugins]
[HKLM\Software\Wow6432Node\XLN Audio]
~ Key Software: 221 Legitimates Filtered in 00mn 00s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 17/01/2011 - 15:49:03 - [27,140] ----D C:\Program Files (x86)\CrazyLoader =>Adware.SPointer
O43 - CFD: 03/06/2011 - 19:43:32 - [-1831,378] ----D C:\Program Files (x86)\Data
O43 - CFD: 17/01/2011 - 15:42:45 - [1,298] ----D C:\Program Files (x86)\HBLite =>Adware.HotBar
O43 - CFD: 03/06/2011 - 19:33:31 - [0,531] ----D C:\Program Files (x86)\Miles
O43 - CFD: 14/06/2013 - 00:38:30 - [0,128] ----D C:\Program Files (x86)\OfferBox =>PUP.OfferBox
O43 - CFD: 03/06/2011 - 19:30:17 - [0] ----D C:\Program Files (x86)\saves
O43 - CFD: 19/01/2013 - 11:19:01 - [1890,650] ----D C:\Program Files (x86)\XLN Audio
O43 - CFD: 17/01/2011 - 15:42:45 - [0] ----D C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
O43 - CFD: 13/06/2013 - 16:26:25 - [0] ----D C:\ProgramData\Babylon =>Toolbar.Babylon
O43 - CFD: 13/06/2013 - 16:27:22 - [0,081] ----D C:\ProgramData\BrowserDefender
O43 - CFD: 26/09/2011 - 15:45:11 - [1,547] ----D C:\ProgramData\HBLiteSA =>Adware.HotBar
O43 - CFD: 19/01/2013 - 10:50:56 - [16,705] ----D C:\ProgramData\Markbass
O43 - CFD: 13/06/2013 - 16:27:48 - [0,168] ----D C:\ProgramData\Tarma Installer =>Toolbar.Tarma
O43 - CFD: 14/06/2013 - 00:38:29 - [0,016] ----D C:\Users\Jon\AppData\Roaming\BabSolution =>Hijacker.BabSolution
O43 - CFD: 13/06/2013 - 16:26:25 - [0,009] ----D C:\Users\Jon\AppData\Roaming\Babylon =>Toolbar.Babylon
O43 - CFD: 17/01/2011 - 15:48:59 - [0,003] ----D C:\Users\Jon\AppData\Roaming\CrazyLoader =>Adware.SPointer
O43 - CFD: 17/01/2011 - 15:42:45 - [0] ----D C:\Users\Jon\AppData\Roaming\HBLite =>Adware.HotBar
O43 - CFD: 19/01/2013 - 14:03:58 - [0] ----D C:\Users\Jon\AppData\Roaming\Nomad Factory
O43 - CFD: 13/06/2013 - 16:29:36 - [0,387] ----D C:\Users\Jon\AppData\Roaming\OfferBox =>PUP.OfferBox
O43 - CFD: 06/06/2013 - 13:46:28 - [14,343] ----D C:\Users\Jon\AppData\Roaming\REAPER
O43 - CFD: 14/06/2013 - 00:38:29 - [0] ----D C:\Users\Jon\AppData\Roaming\WebCake =>Adware.WebCake
O43 - CFD: 17/01/2011 - 15:47:47 - [0,004] ----D C:\Users\Jon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CrazyLoader =>Adware.SPointer
O43 - CFD: 09/01/2011 - 16:08:56 - [0] ----D C:\Users\Jon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documentation
O43 - CFD: 19/01/2013 - 10:48:20 - [0,002] ----D C:\Users\Jon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nomad Factory
~ 128 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 376 Legitimates Filtered in 00mn 52s
---\\ Derniers fichiers modifi�s ou cr�es sous Windows et System32 (O44)
O44 - LFC:[MD5.2D2CF3CB259FB70A269E05B7AE2C51C6] - 13/06/2013 - 18:01:16 ---A- . (...) -- C:\Windows\ntbtlog.txt [94540]
~ Files: 15 Legitimates Filtered in 02mn 05s
---\\ Derniers fichiers cr��s dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.93C7F18E37D12F1A2A7783ACD917F68E] - 11/06/2013 - 20:54:40 ---A- - C:\Windows\Prefetch\CUBASE5.EXE-2A2B56B1.pf
O45 - LFCP:[MD5.D42BF9724BDE54812E84317A6F7E48DF] - 12/06/2013 - 06:30:18 ---A- - C:\Windows\Prefetch\MCVSSHLD.EXE-A4C46442.pf
O45 - LFCP:[MD5.AFDD8CC39FE0BFF068298581C1C29008] - 12/06/2013 - 16:54:43 ---A- - C:\Windows\Prefetch\PCDRCUI.EXE-B3A31938.pf
O45 - LFCP:[MD5.F1BE514D8DBE8510D1EC40B13AD5F97E] - 13/06/2013 - 14:28:22 ---A- - C:\Windows\Prefetch\RPLAUNCH.EXE-E7F444A6.pf
O45 - LFCP:[MD5.C62FC150294B3936D85B9F8AC9E00853] - 13/06/2013 - 14:28:37 ---A- - C:\Windows\Prefetch\DSUPD.EXE-BADB1CF5.pf
O45 - LFCP:[MD5.64051D025C59EE235C273F73D759D7CF] - 13/06/2013 - 14:28:50 ---A- - C:\Windows\Prefetch\SETMUILANGUAGE.EXE-75C1693C.pf
O45 - LFCP:[MD5.76DBB0A5B8A72B73114A9C78C8574ED9] - 13/06/2013 - 14:29:05 ---A- - C:\Windows\Prefetch\DATASAFEONLINE.EXE-C37565CF.pf
O45 - LFCP:[MD5.26822CFA20FF29306098C8F00F39CFEB] - 13/06/2013 - 14:29:12 ---A- - C:\Windows\Prefetch\MCVSSHLD.EXE-BE0F6F46.pf
O45 - LFCP:[MD5.199BAB069687CC3F4669DC8E6176FFD5] - 13/06/2013 - 18:33:58 ---A- - C:\Windows\Prefetch\ROXMEDIADB12OEM.EXE-72CFB431.pf
~ Prefetcher: 141 Legitimates Filtered in 00mn 00s
---\\ MountPoints2 Shell Key (O51)
O51 - MPSK:{7c76cb61-73aa-11e1-9027-f04da262c0bf}\AutoRun\command. (...) -- G:\Setup.exe (.not file.)
O51 - MPSK:{ba9a95d0-7788-11e1-a3f4-f04da262c0bf}\AutoRun\command. (...) -- F:\Setup.exe (.not file.)
~ Keys: Scanned in 00mn 00s
---\\ Microsoft Windows Policies System (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s
---\\ Microsoft Windows Policies Explorer (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 5 Legitimates Filtered in 00mn 00s
---\\ Liste des Drivers Syst�me (O58)
O58 - SDL:[MD5.7A505465BBB1EB8B5AD4D76E8749383B] - 19/08/2010 - 23:05:18 ---A- . (.ST Microelectronics - Accelerometer Port I/O.) -- C:\Windows\System32\Drivers\Accelern.sys [27760]
O58 - SDL:[MD5.48156CCD87E8B2961D8D4EF4021F952F] - 31/08/2004 - 18:47:34 ---A- . (.Syncrosoft GmbH - SynUSB64.sys.) -- C:\Windows\SysWOW64\drivers\synUSB64.sys [21888]
~ Drivers: Scanned in 00mn 00s
---\\ Derniers fichiers modifi�s ou cr�es (Utilisateur) (O61)
O61 - LFC: 11/06/2013 - 20:54:32 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\mediabay.db [3665920]
O61 - LFC: 11/06/2013 - 20:54:47 ---A- C:\Users\Jon\AppData\Roaming\Waves Audio\Caches\C\Program Files (x86)\Waves\Plug-Ins\WavesAuthCache_7.1.3.3.xml [9957]
O61 - LFC: 11/06/2013 - 20:54:48 ---A- C:\Users\Jon\AppData\Roaming\Waves Audio\Preferences\WaveShell-VST3_Preferences_7.1.3 [151]
O61 - LFC: 11/06/2013 - 20:55:19 ---A- C:\Users\Jon\AppData\Roaming\Waves Audio\Caches\C\Program Files (x86)\Waves\Plug-Ins\WavesAuthCache_7.1.0.3.xml [9957]
O61 - LFC: 11/06/2013 - 20:55:19 ---A- C:\Users\Jon\AppData\Roaming\Waves Audio\Preferences\WaveShell-VST_Preferences_7.1.0 [149]
O61 - LFC: 11/06/2013 - 23:04:45 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\External Plugins.xml [79]
O61 - LFC: 11/06/2013 - 23:04:45 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Midi Devices.bin [13710]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Edit Modifiers.xml [2627]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\FileSysObserver.xml [1962]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\GuitarLib.xml [67095]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Key Commands.xml [195062]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\MediaDefaults.xml [28897]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Port Setup.xml [4793]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Presets\Chord Symbols.pxml [3414]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Presets\RAMPresets.xml [194957]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Presets\VstEqPreset.pxml [186178]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Quick Controls MIDI.xml [1074]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Score Custom Palettes.xml [3075]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Score Default Font.xml [253]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Score Setting Window.xml [158]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Vst2xBlacklist.xml [1695]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Vst2xPlugins.xml [597881]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Window Layouts.xml [194]
O61 - LFC: 11/06/2013 - 23:04:47 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\ContentManager.xml [13814]
O61 - LFC: 11/06/2013 - 23:04:47 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Defaults.xml [777964]
O61 - LFC: 11/06/2013 - 23:04:47 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Frame.xml [273]
O61 - LFC: 11/06/2013 - 23:04:47 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\VstPlugInfo.xml [253364]
O61 - LFC: 11/06/2013 - 23:04:47 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\scannedFolders.bin [34584]
O61 - LFC: 13/06/2013 - 15:27:19 ---A- C:\Users\Jon\AppData\Roaming\Babylon\log_file.txt [9097] =>Toolbar.Babylon
O61 - LFC: 13/06/2013 - 15:29:27 ---A- C:\Users\Jon\AppData\Roaming\OfferBox\http_app.offerbox.com\profile.sxe [5012] =>PUP.OfferBox
O61 - LFC: 13/06/2013 - 15:29:27 ---A- C:\Users\Jon\AppData\Roaming\OfferBox\http_app.offerbox.com\update.sxe [1207] =>PUP.OfferBox
O61 - LFC: 13/06/2013 - 15:29:27 ---A- C:\Users\Jon\AppData\Roaming\OfferBox\http_app.offerbox.com\update.xml [412] =>PUP.OfferBox
O61 - LFC: 13/06/2013 - 15:29:34 ---A- C:\Users\Jon\AppData\Roaming\OfferBox\http_app.offerbox.com\country.sxe [367510] =>PUP.OfferBox
O61 - LFC: 13/06/2013 - 15:29:37 ---A- C:\Users\Jon\AppData\Roaming\OfferBox\http_app.offerbox.com\extracountry.sxe [1866] =>PUP.OfferBox
O61 - LFC: 13/06/2013 - 15:33:21 ---A- C:\Users\Jon\AppData\Roaming\OfferBox\config.xml [2532] =>PUP.OfferBox
O61 - LFC: 13/06/2013 - 15:33:21 ---A- C:\Users\Jon\AppData\Roaming\OfferBox\http_app.offerbox.com\history.db [27648] =>PUP.OfferBox
~ 22 Fichiers temporaires (Temporary files)
~ Files: 88 Legitimates Filtered in 07mn 27s
---\\ Liste des outils de nettoyage (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
~ ADS: Scanned in 00mn 00s
---\\ Liste des services Legacy (O64)
O64 - Services: CurCS - 15/10/2011 - C:\Windows\System32\DRIVERS\mfenlfk.sys (mfenlfk) .(.McAfee, Inc. - McAfee NDIS Light Filter Driver.) - LEGACY_MFENLFK
~ Legacy: 83 Legitimates Filtered in 00mn 01s
---\\ Start Menu Internet (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Opera Software - Opera Internet Browser.) -- C:\Program Files (x86)\Opera\Opera.exe
~ Keys: Scanned in 00mn 00s
---\\ Search Browser Infection (O69)
O69 - SBI: SearchScopes [HKCU] {8E1A310A-C102-4F0B-B7DB-34A76AA25562} - (Google) - http://www.google.com
O69 - SBI: SearchScopes [HKCU] {afdbddaa-5d3f-42ee-b79c-185a7020515b} [DefaultScope] - (WinZipBar Customized Web Search) - http://search.conduit.com
~ Keys: Scanned in 00mn 00s
---\\ Crack & Keygen Files (O82)
C:\Users\Jon\Documents\groupes\MAO\Programmes MAO\Acid Pro 4.0 + Keygen + Manual\Acid Pro 4.0 (Build 215) -v187.exe
C:\Users\Jon\Documents\groupes\MAO\Programmes MAO\IK.Multimedia.AmpliTube.Fender.v1.0.VST.RTAS.Incl.KeyGen-DYNAMiCS\AmpliTube Fender\Install AmpliTube Fender.exe
C:\Users\Jon\Documents\groupes\MAO\Programmes MAO\Acid Pro 4.0 + Keygen + Manual\Acid Pro 4.0 (Build 215) -v187.exe
C:\Users\Jon\Documents\groupes\MAO\Programmes MAO\IK.Multimedia.AmpliTube.Fender.v1.0.VST.RTAS.Incl.KeyGen-DYNAMiCS\AmpliTube Fender\Install AmpliTube Fender.exe
~ Files: Scanned in 01mn 22s
---\\ Recherche particuliere � la racine de certains dossiers (O84)
[MD5.0CA73C4EC0E64416E5B1C2AB319D8A20] [SPRF][11/06/2013] (...) -- C:\ProgramData\9ejvol.bat [56]
[MD5.30639F0481CE3D60D0EAF9B62C062179] [SPRF][11/06/2013] (...) -- C:\ProgramData\9ejvol.reg [152]
[MD5.7FC9274BEF2567C7D315BFD3174C0D29] [SPRF][11/06/2013] (...) -- C:\ProgramData\lovje9.dat [159744]
[MD5.51138BEEA3E2C21EC44D0932C71762A8] [SPRF][11/06/2013] (.Microsoft Corporation - Windows host process (Rundll32).) -- C:\ProgramData\rundll32.exe [44544]
[MD5.2954D5486CBD37F9B20CC0C995DBDDD6] [SPRF][13/06/2013] (...) -- C:\Users\Jon\AppData\Local\Temp\dump.dat [2072576]
[MD5.AA223192DB5A9B419BA765759709C441] [SPRF][06/03/2008] (.Macrovision Corporation - Setup.exe.) -- C:\Users\Jon\AppData\Local\Temp\_is7D3A.exe [459400]
[MD5.AA223192DB5A9B419BA765759709C441] [SPRF][06/03/2008] (.Macrovision Corporation - Setup.exe.) -- C:\Users\Jon\AppData\Local\Temp\_isC467.exe [459400]
[MD5.AA223192DB5A9B419BA765759709C441] [SPRF][06/03/2008] (.Macrovision Corporation - Setup.exe.) -- C:\Users\Jon\AppData\Local\Temp\_isF5B.exe [459400]
[MD5.402D8FB182D0E28D8A8CE795BAB3CE1D] [SPRF][15/01/2011] (.Absolute Software Corp. - Computrace(R) LoJack for Laptops(R) Installer.) -- C:\Users\Jon\AppData\Roaming\LoJackSetup.exe [5943312]
[MD5.2637796F7486DF47046C451A1C5EB466] [SPRF][05/04/2013] (...) -- C:\Users\Jon\AppData\Roaming\msregsvv.dll [48]
[MD5.0FECB3FB879F3ED7AB5BB878D947E87A] [SPRF][19/01/2013] (.Propellerhead Software AB - ReWire.) -- C:\Users\Jon\AppData\Roaming\Rewire.dll [225280]
[MD5.D340FAF7C701118A4D74440CD9E80187] [SPRF][19/01/2013] (.Propellerhead Software AB - REX Shared library.) -- C:\Users\Jon\AppData\Roaming\REX Shared Library.dll [233472]
[MD5.01300E303C7A5426FC21C479CE3E1B18] [SPRF][13/06/2013] (...) -- C:\Users\Jon\Desktop\RogueKillerX64.exe [791040]
[MD5.D54278B3884D2861C0D4AA176653ED78] [SPRF][11/06/2013] (.Skype Technologies S.A. - Skype.) -- C:\Users\Jon\Desktop\SkypeSetup.exe [1491560]
[MD5.8EE509FEE63CB89AB1D763F644ACFED2] [SPRF][13/06/2013] (.Nicolas Coolman - ZHPDiag.) -- C:\Users\Jon\Desktop\ZHPDiag2.exe [5676095]
[MD5.3F35F68A1BE77502E424D478984D50F7] [SPRF][28/08/2004] (...) -- C:\Program Files (x86)\mss32.dll [368640]
~ Files: Scanned in 00mn 01s
---\\ Firewall Active Exception List (FirewallRules) (O87)
O87 - FAEL: "{3A29C691-2141-44E0-BB4D-75C14658F93E}" | In - Private - P6 - TRUE | .(.Vity - File Downloader.) -- C:\Program Files (x86)\CrazyLoader\crazyloader.exe =>Adware.SPointer
O87 - FAEL: "{350E2C1D-CC05-4D33-82B7-6446771E10F0}" | In - Private - P17 - TRUE | .(.Vity - File Downloader.) -- C:\Program Files (x86)\CrazyLoader\crazyloader.exe =>Adware.SPointer
O87 - FAEL: "{BB04C948-E546-4F95-BDFB-9EC38084AA60}" |In - Public - P6 - TRUE | .(...) -- C:\Program Files (x86)\Eidos\Batman Arkham Asylum\Binaries\ShippingPC-BmGame.exe (.not file.)
O87 - FAEL: "{794F37C6-344B-430A-A362-16EF7B4D951C}" |In - Public - P17 - TRUE | .(...) -- C:\Program Files (x86)\Eidos\Batman Arkham Asylum\Binaries\ShippingPC-BmGame.exe (.not file.)
~ Firewall: 255 Legitimates Filtered in 00mn 03s
---\\ Scan Additionnel (O88)
Database Version : v2.12437 - (10/06/2013)
Cl�s trouv�es (Keys found) : 39
Valeurs trouv�es (Values found) : 0
Dossiers trouv�s (Folders found) : 19
Fichiers trouv�s (Files found) : 0
[HKLM\Software\Classes\Interface\{30B15818-E110-4527-9C05-46ACE5A3460D}] =>Adware.ClickPotato
[HKLM\Software\Wow6432Node\Classes\Interface\{30B15818-E110-4527-9C05-46ACE5A3460D}] =>Adware.ClickPotato
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4D1EC4CA-4B92-4324-B8F8-C9A6ED06A8AE}] =>Adware.Hotbar
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4E674574-3F0B-491d-8AE3-F90B43A34FD6}] =>Adware.Hotbar
[HKLM\Software\Classes\Interface\{618aad04-921f-44c2-be38-c0818af69861}] =>Adware.Hotbar
[HKLM\Software\Wow6432Node\Classes\Interface\{618aad04-921f-44c2-be38-c0818af69861}] =>Adware.Hotbar
[HKLM\Software\Classes\TypeLib\{6F098504-CDB1-420F-A2E6-DDC0B835FEDF}] =>Adware.Hotbar
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7}] =>Adware.Softomate
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}] =>Toolbar.Conduit
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{b5d2ed96-62f9-4c2c-956d-e425b1f67337}] =>Adware.Hotbar
[HKLM\Software\Wow6432Node\Classes\Interface\{b5d2ed96-62f9-4c2c-956d-e425b1f67337}] =>Adware.Hotbar
[HKLM\Software\Classes\Interface\{d3a412e8-1e4b-47d2-9b12-f88291f5afbb}] =>Adware.Hotbar
[HKLM\Software\Wow6432Node\Classes\Interface\{d3a412e8-1e4b-47d2-9b12-f88291f5afbb}] =>Adware.Hotbar
[HKLM\Software\Classes\HBLiteAx.Info] =>Adware.ShopperReports
[HKLM\Software\Classes\HBLiteAx.Info.1] =>Adware.ShopperReports
[HKLM\Software\Classes\HBLiteAX.UserProfiles] =>Adware.ShopperReports
[HKLM\Software\Classes\HBLiteAX.UserProfiles.1] =>Adware.ShopperReports
[HKLM\Software\Classes\Installer\Features\0E9201899CF73FC4BA93F631631229A1] =>Toolbar.Agent
[HKLM\Software\Classes\Installer\Products\0E9201899CF73FC4BA93F631631229A1] =>Toolbar.Agent
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\0E9201899CF73FC4BA93F631631229A1] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Classes\Installer\Features\0E9201899CF73FC4BA93F631631229A1] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Classes\Installer\Products\0E9201899CF73FC4BA93F631631229A1] =>Toolbar.Agent
[HKCU\Software\AppDataLow\Software\ConduitSearchScopes] =>Toolbar.Conduit
[HKLM\Software\CrazyLoader] =>Adware.SPointer
[HKCU\Software\AppDataLow\Toolbar] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{981029E0-7FC9-4CF3-AB39-6F133621921A}] =>Toolbar.Agent
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\CrazyLoader] =>Adware.SPointer
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\daemon tools toolbar] =>Toolbar.Agent
[HKCU\Software\JavaSoft\Prefs\crazyloader] =>Adware.SPointer
[HKLM\Software\Classes\Toolbar.CT3106777] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Toolbar.CT3106777] =>Toolbar.Conduit
C:\Program Files (x86)\Conduit =>Toolbar.Conduit
C:\Program Files (x86)\Crazyloader =>Adware.SPointer
C:\Program Files (x86)\DAEMON Tools Toolbar =>Toolbar.Agent
C:\Program Files (x86)\HBLite =>Adware.Hotbar
C:\Program Files (x86)\OfferBox =>PUP.OfferBox
C:\Program Files (x86)\Optimizer Pro =>PUP.OptimizerPro
C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 =>Adware.Seekmo
C:\ProgramData\Babylon =>Toolbar.Babylon
C:\ProgramData\HBLiteSA =>Adware.Hotbar
C:\ProgramData\BrowserDefender =>Hijacker.Eazel
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotbar =>Adware.Hotbar
C:\Users\Jon\AppData\Roaming\Babylon =>Toolbar.Babylon
C:\Users\Jon\AppData\Roaming\Crazyloader =>Adware.SPointer
C:\Users\Jon\AppData\Roaming\HBLite =>Adware.Hotbar
C:\Users\Jon\AppData\Roaming\OfferBox =>PUP.OfferBox
C:\Users\Jon\AppData\Roaming\BabSolution =>Hijacker.BabSolution
C:\Users\Jon\AppData\Roaming\WebCake =>Adware.WebCake
C:\Users\Jon\AppData\Local\Conduit =>Toolbar.Conduit
C:\Users\Jon\AppData\LocalLow\Conduit =>Toolbar.Conduit
~ Additionnel Scan: 241968 Items scanned in 00mn 22s
---\\ Product Upgrade Codes (O90)
O90 - PUC: "5AD4353088F2E8B49A8748B979E9B1F8" . (.TuxGuitar.) -- C:\Windows\Installer\{03534DA5-2F88-4B8E-A978-849B979E1B8F}\icon.exe
O90 - PUC: "B6BB246AD1AC2414D84D13C8F3D38C43" . (.Rome - Total War(TM).) -- C:\Windows\Installer\{A642BB6B-CA1D-4142-8DD4-318C3F3DC834}\ARPPRODUCTICON.exe
O90 - PUC: "B719B23553285AF4EB6346A3B80B355A" . (.Steinberg REVerence Content 01.) -- C:\Windows\Installer\{532B917B-8235-4FA5-BE36-643A8BB053A5}\VSTSound.ico
~ Update Products: 97 Legitimates Filtered in 00mn 00s
---\\ Etat g�n�ral des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 12/06/2013 256904 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 17/11/2009 98208 | (AERTFilters) . (.Andrea Electronics Corporation.) - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
SR - | Auto 09/06/2009 155648 | (DockLoginService) . (.Stardock Corporation.) - C:\Program Files\Dell\DellDock\DockLogin.exe
SR - | Auto 05/03/2010 1425168 | (EvtEng) . (.Intel(R) Corporation.) - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
SR - | Auto 04/03/2010 13336 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
SR - | Auto 01/07/2010 325656 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
SS - | Demand 05/02/2013 235216 | (McComponentHostService) . (.McAfee, Inc..) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe
SR - | Auto 27/01/2011 249936 | (McMPFSvc) . (.McAfee, Inc..) - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
SR - | Auto 27/01/2011 249936 | (mcmscsvc) . (.McAfee, Inc..) - C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe
SR - | Auto 27/01/2011 249936 | (McNaiAnn) . (.McAfee, Inc..) - C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe
SR - | Auto 27/01/2011 249936 | (McNASvc) . (.McAfee, Inc..) - C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe
SS - | Demand 18/10/2011 502032 | (McODS) . (.McAfee, Inc..) - C:\Program Files\mcafee\VirusScan\mcods.exe
SS - | Disabled 27/01/2011 249936 | (McOobeSv) . (.McAfee, Inc..) - C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe
SR - | Auto 27/01/2011 249936 | (McProxy) . (.McAfee, Inc..) - C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe
SR - | Auto 18/10/2011 199272 | (McShield) . (.McAfee, Inc..) - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
SR - | Auto 18/10/2011 208536 | (mfefire) . (.McAfee, Inc..) - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
SR - | Auto 18/10/2011 161168 | (mfevtp) . (.McAfee, Inc..) - C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
SS - | Demand 340240 | (MyWiFiDHCPDNS) . (...) - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
SR - | Auto 12/08/2010 159336 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe
SR - | Auto 12/08/2010 1620584 | (nvUpdatusService) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
SR - | Auto 0 | (PnkBstrA) . (...) - C:\Windows\system32\PnkBstrA.exe
SR - | Auto 05/03/2010 831760 | (RegSrvc) . (.Intel(R) Corporation.) - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
SS - | Demand 04/09/2010 1116656 | (RoxMediaDB12OEM) . (.Sonic Solutions.) - C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe
SS - | Auto 04/09/2010 219632 | (RoxWatch12) . (.Sonic Solutions.) - C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe
SR - | Auto 18/08/2011 1692480 | (SftService) . (.SoftThinks SAS.) - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.exe
SS - | Auto 13/07/2012 160944 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SR - | Auto 12/08/2010 235624 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
SS - | Demand 26/08/2010 74392 | (stllssvr) . (.MicroVision Development, Inc..) - C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
SS - | Demand 02/11/2009 126352 | (TurboBoost) . (.Intel(R) Corporation.) - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
SR - | Auto 01/07/2010 2533400 | (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 17s
---\\ Recherche Master Boot Record Infection (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by Jon at 13/06/2013 19:59:22
device: opened successfully
user: error reading MBR
Disk trace:
error: Read Descripteur non valide
kernel: error reading MBR
~ MBR: 9 Legitimates Filtered in 00mn 02s
---\\ Recherche Master Boot Record Infection (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Jon at 13/06/2013 19:59:24
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 04s
~ 1560 Legitimates filtered by white list
End of the scan (638 lines in 16mn 18s)(4)
Run by Jon at 13/06/2013 19:43:06
WebSite: http://nicolascoolman.webs.com
State : Version � jour.
WhiteList : Enable
High Elevated Privileges : OK
UAC : Activate by user
---\\ Web Browser
MSIE: Internet Explorer v10.0.9200.16576
OPIE: Opera v12.15 (Defaut)
---\\ Windows Product Information
~ Langage: Fran�ais
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : RMV82
Windows License : OK
~ Windows Remaining Initializations Number : 4
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ System Protection
McAfee Security Scan Plus v3.0.318.3
Windows Defender W7
---\\ System Optimizer
---\\ Peer To Peer (P2P)
---\\ Software Update
Adobe Flash Player 11 Plugin
Adobe Reader 9.1.2 - Fran�ais
---\\ System Information
~ Processor: Intel64 Family 6 Model 37 Stepping 5, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3828 MB (53% free)
System Restore: Activ� (Enable)
System drive C: has 270 GB (59%) free of 451 GB
---\\ Logged in mode
~ Computer Name: JON-PC
~ User Name: Jon
~ All Users Names: UpdatusUser, Jon, HomeGroupUser$, Administrateur,
~ Unselected Option: None
Logged in as Administrator
---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Users\Jon\AppData\Roaming\
~ %Desktop% : C:\Users\Jon\Desktop\
~ %Favorites% : C:\Users\Jon\Favorites\
~ %LocalAppData% : C:\Users\Jon\AppData\Local\
~ %StartMenu% : C:\Users\Jon\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 270 Go of 451 Go)
D:\ CD-ROM drive (Not Inserted)
E:\ CD-ROM drive (Not Inserted)
F:\ CD-ROM drive (Not Inserted)
G:\ CD-ROM drive (Not Inserted)
H:\ CD-ROM drive (Not Inserted)
Q:\ Hard drive, Flash drive, Thumb drive (Free 0 Go of 0 Go)
---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: 29 Legitimates Filtered in 00mn 00s
---\\ Recherche particuli�re de fichiers g�n�riques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de d�marrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.27A9000C534AA9BADC9EE74940F50C6D] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.05/04/2013 - 07:52:14.) -- C:\Windows\System32\wininet.dll [2242048]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d�ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Biblioth�que de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.1C7857B62DE5994A75B054A9FD4C3825] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/12/2011 - 04:59:24.) -- C:\Windows\system32\Drivers\AFD.sys [498688]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du syst�me de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parall�le.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de clich� instantan� du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 01s
---\\ Etat des fichiers cach�s (Cach�/Total)
~ Mes images (My Pictures) : 1/880
~ Mes musiques (My Musics) : 1/4956
~ Mes Videos (My Videos) : 1/330
~ Mes Favoris (My Favorites) : 1/29
~ Mes Documents (My Documents) : 2/2561
~ Mon Bureau (My Desktop) : 3/1306
~ Menu demarrer (Programs) : 1/41
~ Hidden Files: Scanned in 00mn 17s
---\\ Processus lanc�s
[MD5.EBDD3032297EF6832A1D6D3AA6DC3537] - (.SoftThinks - Dell - Dell DataSafe Local Backup.) -- C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.exe [4259648] [PID.2596]
[MD5.CD4F7B90CB09831BCDEDE0A206CCDB35] - (.Pas de propri�taire - ST Service Scheduling.) -- C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.exe [2751808] [PID.2620]
[MD5.09890A2F032B138A74B5DF2C1233FB1D] - (.SoftThinks - Dell - DataSafe Update Launcher.) -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe [460096] [PID.2696]
[MD5.A358C6D2F299ACDE00D40C605BA5FEDC] - (.Pas de propri�taire - FF_Protection MFC Application.) -- C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [727664] [PID.4416]
[MD5.1542D48BEF0C07513453CDEF1577BB79] - (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe [691656] [PID.4436]
[MD5.51C8885B6A00904C0252704C9FB0F43A] - (.Renesas Electronics Corporation - USB 3.0 Monitor.) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288] [PID.4704]
[MD5.25107F58D1B8F60D67D1EE95798C0DE8] - (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696] [PID.4768]
[MD5.637E9EEA864CE9C5778E3C4358B1E0D1] - (.Pas de propri�taire - DataSafeOnline.) -- C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe [1807680] [PID.4792]
[MD5.BD713579A87D698E1F2158CE10E48130] - (.McAfee, Inc. - McAfee Security Scanner Scheduler.) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe [272248] [PID.4872]
[MD5.30293898C1A9DFBCFE38EB6A2F7D555A] - (.Creative Technology Ltd - WebcamDell2.exe.) -- C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [487562] [PID.5032]
[MD5.5AB1FEDB151D7B732B8C004A1E90ABCF] - (.Pas de propri�taire - Roxio Burn Launcher.) -- C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [518640] [PID.1424]
[MD5.C5520FEB7AD5F6E3692B6DE41F6A1A27] - (.Opera Software - Opera Internet Browser.) -- C:\Program Files (x86)\Opera\opera.exe [879456] [PID.4256]
[MD5.93DB1FF92B03D24738A71E6E4992DFD3] - (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248552] [PID.1012]
[MD5.3A32FAFEEE290E6E6C058DE59EC4EC88] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [7478272] [PID.4124]
[MD5.0840ABBBDF438691EE65A20040635CBE] - (.Stardock Corporation - Dock Login Service.) -- C:\Program Files\Dell\DellDock\DockLogin.exe [155648] [PID.1192]
[MD5.1713D9DE407313138118D501B0E3C05B] - (...) -- C:\Windows\SysWOW64\PnkBstrA.exe [75136] [PID.2040]
[MD5.74EC60E20516AAA573BE74F31175270F] - (.SoftThinks SAS - SoftThinks Agent Service.) -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.exe [1692480] [PID.2028]
[MD5.C3CDDD18F43D44AB713CF8C4916F7696] - (.Microsoft Corporation - Microsoft Application Virtualization Virtua.) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [219496] [PID.2068]
[MD5.C6539A0CB1EBFF488D3D4B070C4F17F8] - (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [235624] [PID.2144]
[MD5.13693B6354DD6E72DC5131DA7D764B90] - (.Microsoft Corporation - Microsoft Application Virtualization Client.) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [508776] [PID.2904]
[MD5.72794D112CBAFF3BC0C29BF7350D4741] - (.Microsoft Corporation - Microsoft Office Client Virtualization Serv.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.exe [822624] [PID.3800]
[MD5.31A0E93CDF29007D6C6FFFB632F375ED] - (.Intel Corporation - IAStorDataSvc.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [13336] [PID.2120]
[MD5.23D990150D56B670A62B21B9ABDD45EE] - (.Intel Corporation - Local Manageability Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [325656] [PID.4836]
[MD5.6DF10645A794878776DC8F5338427388] - (.NVIDIA Corporation - NVIDIA Settings Update Manager.) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [1620584] [PID.4952]
[MD5.CBDEE152D73200EE49031A26310B9D3E] - (.Intel Corporation - User Notification Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2533400] [PID.5572]
~ Processes Running: Scanned in 00mn 02s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
P2 - FPN: [HKLM] [@mcafee.com/MSC,version=10] - (...) -- C:\Program Files\mcafee\msc\npMcSnFFPl64.dll
~ Firefox Browser: 4 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, D�marrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com
R3 - URLSearchHook: WinZipBar Toolbar [64Bits] - {50fafaf0-70a9-419d-a109-fa4b4ffd4e37} . (.Conduit Ltd. - Conduit Toolbar.) (6.4.0.0) -- C:\Program Files (x86)\WinZipBar\prxtbWinZ.dll =>Toolbar.Conduit
~ IE Browser: 17 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21
---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: WinZipBar [64Bits] - {50fafaf0-70a9-419d-a109-fa4b4ffd4e37} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files (x86)\WinZipBar\prxtbWinZ.dll =>Toolbar.Conduit
~ BHO: 8 Legitimates Filtered in 00mn 00s
---\\ Applications d�marr�es par registre & par dossier (O4)
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe (.not file.)
O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
O4 - HKLM\..\Run: [RtHDVBg] . (.Realtek Semiconductor - HD Audio Background Process.) -- C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
O4 - HKLM\..\Run: [NVHotkey] . (.NVIDIA Corporation - NVIDIA Hotkey Service, Version 259.39.) -- C:\Windows\system32\nvHotkey.dll
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [IntelWireless] . (.Intel(R) Corporation - Intel(R) PROSet/Wireless Framework.) -- C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
O4 - HKLM\..\Run: [QuickSet] . (.Dell Inc. - QuickSet.) -- c:\Program Files\Dell\QuickSet\QuickSet.exe
O4 - HKLM\..\Run: [FreeFallProtection] . (.Pas de propri�taire - FF_Protection MFC Application.) -- C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe
O4 - HKLM\..\Wow6432Node\Run: [NUSB3MON] . (.Renesas Electronics Corporation - USB 3.0 Monitor.) -- c:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
O4 - HKLM\..\Wow6432Node\Run: [IAStorIcon] . (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe
O4 - HKLM\..\Wow6432Node\Run: [Dell DataSafe Online] . (.Pas de propri�taire - DataSafeOnline.) -- C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe
O4 - HKLM\..\Wow6432Node\Run: [mcui_exe] . (.McAfee, Inc. - McAfee Security Center.) -- C:\Program Files\McAfee.com\Agent\mcagent.exe
O4 - HKLM\..\Wow6432Node\Run: [Dell Webcam Central] . (.Creative Technology Ltd - WebcamDell2.exe.) -- C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
O4 - HKLM\..\Wow6432Node\Run: [RoxWatchTray] . (.Sonic Solutions - RoxMMTrayApp Module.) -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe
O4 - HKLM\..\Wow6432Node\Run: [Desktop Disc Tool] . (.Pas de propri�taire - Roxio Burn Launcher.) -- C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
O4 - HKLM\..\Wow6432Node\Run: [DellSupportCenter] C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe (.not file.)
O4 - HKLM\..\Wow6432Node\Run: [H2O] C:\Program Files (x86)\SyncroSoft\Pos\H2O\cledx.exe (.not file.)
O4 - HKLM\..\Wow6432Node\Run: [HBLiteSA] . (.Pinball Corporation. - Hotbar Search Assistant.) -- C:\Program Files (x86)\HBLite\bin\11.0.342.0\HBLiteSA.exe =>Adware.HotBar
O4 - HKLM\..\Wow6432Node\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] . (.Dell - Update Client for Dell DataSafe Local Backu.) -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe
O4 - HKLM\..\Wow6432Node\RunOnce: [Launcher] . (.Softthinks - VistaLauncher.) -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-21-4143903921-1717393621-435963149-1001\..\Run: [DAEMON Tools Lite] . (.DT Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe
~ Application: Scanned in 00mn 02s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Accessories: Private Character Editor.lnk . (.Microsoft Corporation - �diteur de caract�res priv�s.) -- C:\Windows\system32\eudcedit.exe
O4 - GS\SendTo: Fax Recipient.lnk . (.Microsoft Corporation - Microsoft Windows Fax and Scan.) -- C:\Windows\system32\WFS.exe
O4 - GS\Desktop: Cubase SX 3.lnk . (...) -- C:\Program Files (x86)\Steinberg\Cubase SX 3\Cubasesx3.exe (.not file.)
O4 - GS\Desktop: Jouer � Rayman Maternelle.lnk . (...) -- C:\Windows\UbiSoft\UbiSetup.exe (.not file.)
O4 - GS\TaskBar: Windows Explorer.lnk . (.Microsoft Corporation - Explorateur Windows.) -- C:\Windows\explorer.exe
O4 - GS\TaskBar: Windows Media Player.lnk . (.Microsoft Corporation - Lecteur Windows Media.) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SendTo: Skype.lnk . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe
O4 - GS\Desktop: Cubase 5.lnk . (.Steinberg Media Technologies - Cubase.) -- C:\Program Files (x86)\Steinberg\Cubase 5\Cubase5.exe
~ Global Startup: Scanned in 00mn 01s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{2ACEEDBA-E589-4A91-9102-C63B8A9BE12C}: NameServer = 0.0.0.0
O17 - HKLM\System\CCS\Services\Tcpip\..\{07C7E841-CE58-4255-AB76-896F39415428}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CCS\Services\Tcpip\..\{430EFD16-1B9B-448A-B392-C02C1D66E04D}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CS1\Services\Tcpip\..\{2ACEEDBA-E589-4A91-9102-C63B8A9BE12C}: NameServer = 0.0.0.0
O17 - HKLM\System\CS1\Services\Tcpip\..\{07C7E841-CE58-4255-AB76-896F39415428}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CS1\Services\Tcpip\..\{430EFD16-1B9B-448A-B392-C02C1D66E04D}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CS2\Services\Tcpip\..\{2ACEEDBA-E589-4A91-9102-C63B8A9BE12C}: NameServer = 0.0.0.0
O17 - HKLM\System\CS2\Services\Tcpip\..\{07C7E841-CE58-4255-AB76-896F39415428}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CS2\Services\Tcpip\..\{430EFD16-1B9B-448A-B392-C02C1D66E04D}: DhcpNameServer = 212.27.40.240 212.27.40.241
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.27.40.240 212.27.40.241
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-cl�s Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s
---\\ Valeur de Registre AppInit_DLLs et sous-cl�s Winlogon Notify (autorun) (O20)
O20 - AppInit_DLLs: . (.NVIDIA Corporation - NVIDIA Compatible NVIDIA shim initializatio.) - C:\Windows\system32\nvinitx.dll
~ AppInit DLL: Scanned in 00mn 00s
---\\ T�ches planifi�es en automatique (O39)
[MD5.B1170C32975AF4DFB6824476CC79C2BB] [APT] [PCDEventLauncherTask] (.PC-Doctor, Inc..) -- C:\Program Files\My Dell\sessionchecker.exe [427088]
[MD5.72971F1381EB8FA85E875656FA023E23] [APT] [PCDoctorBackgroundMonitorTask] (.PC-Doctor, Inc..) -- C:\Program Files\My Dell\uaclauncher.exe [1182280]
[MD5.00000000000000000000000000000000] [APT] [{537DA72E-F416-4370-B2E5-F97E0C40C68A}] (...) -- C:\Users\Jon\Desktop\ALESIS_USB2_WIN32_2.9.13\Setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{D1C95544-D79B-4774-ADBC-6E2533F2A293}] (...) -- C:\Users\Jon\Documents\groupes\MAO\Steinberg Cubase 5.1 Portable\Cubase5.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{D30274B3-0A8B-4CEF-954E-8E9B2C2E5344}] (...) -- E:\Autorun.exe (.not file.) [0]
[MD5.2E7BC5B75DF9C7BC2A53A32964C2D899] [APT] [{DC01D5CD-FFB9-49F0-A3BA-58A75F538655}] (.InstallShield Software Corporation.) -- C:\Users\Jon\Documents\groupes\MAO\Programmes MAO\BBE Sonic maxiamzer DX Plug v1.0.0.1\BBE Sonic maxiamzer DX Plug v1.0.0.1\SETUP.exe [59904]
~ Scheduled Task: 8 Legitimates Filtered in 00mn 10s
---\\ Logiciels install�s (O42)
O42 - Logiciel: Addictive Drums - (...) [HKLM][64Bits] -- Addictive Drums
O42 - Logiciel: Alesis USB Audio driver - (...) [HKLM][64Bits] -- USB_AUDIO_DEusb-audio.deAlesis
O42 - Logiciel: CrazyLoader - (...) [HKLM][64Bits] -- CrazyLoader =>Adware.SPointer
O42 - Logiciel: Hotbar - (.Pinball Corporation..) [HKLM][64Bits] -- HBLiteSA =>Adware.HotBar
O42 - Logiciel: Mark Studio 1 1.2.1 - (.Overloud.) [HKLM][64Bits] -- {57B71859-24CC-4857-8A0D-B4B52E7729DD}_is1
O42 - Logiciel: Rayman Maternelle - (...) [HKLM][64Bits] -- Rayman Maternelle
O42 - Logiciel: Waves Complete VST RTAS TDM v7.1.16 - (...) [HKLM][64Bits] -- Waves Complete v7_is1
~ Logic: 149 Legitimates Filtered in 00mn 00s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\AppDataLow\Software\ConduitSearchScopes]
[HKCU\Software\AppDataLow\Toolbar]
[HKCU\Software\Waves MultiRack]
[HKCU\Software\XLN Audio]
[HKCU\Software\hblitesa] =>Adware.HotBar
[HKLM\Software\Wow6432Node\HBLite] =>Adware.HotBar
[HKLM\Software\Wow6432Node\MIDI Plugins]
[HKLM\Software\Wow6432Node\XLN Audio]
~ Key Software: 221 Legitimates Filtered in 00mn 00s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 17/01/2011 - 15:49:03 - [27,140] ----D C:\Program Files (x86)\CrazyLoader =>Adware.SPointer
O43 - CFD: 03/06/2011 - 19:43:32 - [-1831,378] ----D C:\Program Files (x86)\Data
O43 - CFD: 17/01/2011 - 15:42:45 - [1,298] ----D C:\Program Files (x86)\HBLite =>Adware.HotBar
O43 - CFD: 03/06/2011 - 19:33:31 - [0,531] ----D C:\Program Files (x86)\Miles
O43 - CFD: 14/06/2013 - 00:38:30 - [0,128] ----D C:\Program Files (x86)\OfferBox =>PUP.OfferBox
O43 - CFD: 03/06/2011 - 19:30:17 - [0] ----D C:\Program Files (x86)\saves
O43 - CFD: 19/01/2013 - 11:19:01 - [1890,650] ----D C:\Program Files (x86)\XLN Audio
O43 - CFD: 17/01/2011 - 15:42:45 - [0] ----D C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
O43 - CFD: 13/06/2013 - 16:26:25 - [0] ----D C:\ProgramData\Babylon =>Toolbar.Babylon
O43 - CFD: 13/06/2013 - 16:27:22 - [0,081] ----D C:\ProgramData\BrowserDefender
O43 - CFD: 26/09/2011 - 15:45:11 - [1,547] ----D C:\ProgramData\HBLiteSA =>Adware.HotBar
O43 - CFD: 19/01/2013 - 10:50:56 - [16,705] ----D C:\ProgramData\Markbass
O43 - CFD: 13/06/2013 - 16:27:48 - [0,168] ----D C:\ProgramData\Tarma Installer =>Toolbar.Tarma
O43 - CFD: 14/06/2013 - 00:38:29 - [0,016] ----D C:\Users\Jon\AppData\Roaming\BabSolution =>Hijacker.BabSolution
O43 - CFD: 13/06/2013 - 16:26:25 - [0,009] ----D C:\Users\Jon\AppData\Roaming\Babylon =>Toolbar.Babylon
O43 - CFD: 17/01/2011 - 15:48:59 - [0,003] ----D C:\Users\Jon\AppData\Roaming\CrazyLoader =>Adware.SPointer
O43 - CFD: 17/01/2011 - 15:42:45 - [0] ----D C:\Users\Jon\AppData\Roaming\HBLite =>Adware.HotBar
O43 - CFD: 19/01/2013 - 14:03:58 - [0] ----D C:\Users\Jon\AppData\Roaming\Nomad Factory
O43 - CFD: 13/06/2013 - 16:29:36 - [0,387] ----D C:\Users\Jon\AppData\Roaming\OfferBox =>PUP.OfferBox
O43 - CFD: 06/06/2013 - 13:46:28 - [14,343] ----D C:\Users\Jon\AppData\Roaming\REAPER
O43 - CFD: 14/06/2013 - 00:38:29 - [0] ----D C:\Users\Jon\AppData\Roaming\WebCake =>Adware.WebCake
O43 - CFD: 17/01/2011 - 15:47:47 - [0,004] ----D C:\Users\Jon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CrazyLoader =>Adware.SPointer
O43 - CFD: 09/01/2011 - 16:08:56 - [0] ----D C:\Users\Jon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documentation
O43 - CFD: 19/01/2013 - 10:48:20 - [0,002] ----D C:\Users\Jon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nomad Factory
~ 128 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 376 Legitimates Filtered in 00mn 52s
---\\ Derniers fichiers modifi�s ou cr�es sous Windows et System32 (O44)
O44 - LFC:[MD5.2D2CF3CB259FB70A269E05B7AE2C51C6] - 13/06/2013 - 18:01:16 ---A- . (...) -- C:\Windows\ntbtlog.txt [94540]
~ Files: 15 Legitimates Filtered in 02mn 05s
---\\ Derniers fichiers cr��s dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.93C7F18E37D12F1A2A7783ACD917F68E] - 11/06/2013 - 20:54:40 ---A- - C:\Windows\Prefetch\CUBASE5.EXE-2A2B56B1.pf
O45 - LFCP:[MD5.D42BF9724BDE54812E84317A6F7E48DF] - 12/06/2013 - 06:30:18 ---A- - C:\Windows\Prefetch\MCVSSHLD.EXE-A4C46442.pf
O45 - LFCP:[MD5.AFDD8CC39FE0BFF068298581C1C29008] - 12/06/2013 - 16:54:43 ---A- - C:\Windows\Prefetch\PCDRCUI.EXE-B3A31938.pf
O45 - LFCP:[MD5.F1BE514D8DBE8510D1EC40B13AD5F97E] - 13/06/2013 - 14:28:22 ---A- - C:\Windows\Prefetch\RPLAUNCH.EXE-E7F444A6.pf
O45 - LFCP:[MD5.C62FC150294B3936D85B9F8AC9E00853] - 13/06/2013 - 14:28:37 ---A- - C:\Windows\Prefetch\DSUPD.EXE-BADB1CF5.pf
O45 - LFCP:[MD5.64051D025C59EE235C273F73D759D7CF] - 13/06/2013 - 14:28:50 ---A- - C:\Windows\Prefetch\SETMUILANGUAGE.EXE-75C1693C.pf
O45 - LFCP:[MD5.76DBB0A5B8A72B73114A9C78C8574ED9] - 13/06/2013 - 14:29:05 ---A- - C:\Windows\Prefetch\DATASAFEONLINE.EXE-C37565CF.pf
O45 - LFCP:[MD5.26822CFA20FF29306098C8F00F39CFEB] - 13/06/2013 - 14:29:12 ---A- - C:\Windows\Prefetch\MCVSSHLD.EXE-BE0F6F46.pf
O45 - LFCP:[MD5.199BAB069687CC3F4669DC8E6176FFD5] - 13/06/2013 - 18:33:58 ---A- - C:\Windows\Prefetch\ROXMEDIADB12OEM.EXE-72CFB431.pf
~ Prefetcher: 141 Legitimates Filtered in 00mn 00s
---\\ MountPoints2 Shell Key (O51)
O51 - MPSK:{7c76cb61-73aa-11e1-9027-f04da262c0bf}\AutoRun\command. (...) -- G:\Setup.exe (.not file.)
O51 - MPSK:{ba9a95d0-7788-11e1-a3f4-f04da262c0bf}\AutoRun\command. (...) -- F:\Setup.exe (.not file.)
~ Keys: Scanned in 00mn 00s
---\\ Microsoft Windows Policies System (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s
---\\ Microsoft Windows Policies Explorer (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 5 Legitimates Filtered in 00mn 00s
---\\ Liste des Drivers Syst�me (O58)
O58 - SDL:[MD5.7A505465BBB1EB8B5AD4D76E8749383B] - 19/08/2010 - 23:05:18 ---A- . (.ST Microelectronics - Accelerometer Port I/O.) -- C:\Windows\System32\Drivers\Accelern.sys [27760]
O58 - SDL:[MD5.48156CCD87E8B2961D8D4EF4021F952F] - 31/08/2004 - 18:47:34 ---A- . (.Syncrosoft GmbH - SynUSB64.sys.) -- C:\Windows\SysWOW64\drivers\synUSB64.sys [21888]
~ Drivers: Scanned in 00mn 00s
---\\ Derniers fichiers modifi�s ou cr�es (Utilisateur) (O61)
O61 - LFC: 11/06/2013 - 20:54:32 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\mediabay.db [3665920]
O61 - LFC: 11/06/2013 - 20:54:47 ---A- C:\Users\Jon\AppData\Roaming\Waves Audio\Caches\C\Program Files (x86)\Waves\Plug-Ins\WavesAuthCache_7.1.3.3.xml [9957]
O61 - LFC: 11/06/2013 - 20:54:48 ---A- C:\Users\Jon\AppData\Roaming\Waves Audio\Preferences\WaveShell-VST3_Preferences_7.1.3 [151]
O61 - LFC: 11/06/2013 - 20:55:19 ---A- C:\Users\Jon\AppData\Roaming\Waves Audio\Caches\C\Program Files (x86)\Waves\Plug-Ins\WavesAuthCache_7.1.0.3.xml [9957]
O61 - LFC: 11/06/2013 - 20:55:19 ---A- C:\Users\Jon\AppData\Roaming\Waves Audio\Preferences\WaveShell-VST_Preferences_7.1.0 [149]
O61 - LFC: 11/06/2013 - 23:04:45 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\External Plugins.xml [79]
O61 - LFC: 11/06/2013 - 23:04:45 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Midi Devices.bin [13710]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Edit Modifiers.xml [2627]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\FileSysObserver.xml [1962]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\GuitarLib.xml [67095]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Key Commands.xml [195062]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\MediaDefaults.xml [28897]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Port Setup.xml [4793]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Presets\Chord Symbols.pxml [3414]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Presets\RAMPresets.xml [194957]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Presets\VstEqPreset.pxml [186178]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Quick Controls MIDI.xml [1074]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Score Custom Palettes.xml [3075]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Score Default Font.xml [253]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Score Setting Window.xml [158]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Vst2xBlacklist.xml [1695]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Vst2xPlugins.xml [597881]
O61 - LFC: 11/06/2013 - 23:04:46 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Window Layouts.xml [194]
O61 - LFC: 11/06/2013 - 23:04:47 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\ContentManager.xml [13814]
O61 - LFC: 11/06/2013 - 23:04:47 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Defaults.xml [777964]
O61 - LFC: 11/06/2013 - 23:04:47 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\Frame.xml [273]
O61 - LFC: 11/06/2013 - 23:04:47 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\VstPlugInfo.xml [253364]
O61 - LFC: 11/06/2013 - 23:04:47 ---A- C:\Users\Jon\AppData\Roaming\Steinberg\Cubase 5\scannedFolders.bin [34584]
O61 - LFC: 13/06/2013 - 15:27:19 ---A- C:\Users\Jon\AppData\Roaming\Babylon\log_file.txt [9097] =>Toolbar.Babylon
O61 - LFC: 13/06/2013 - 15:29:27 ---A- C:\Users\Jon\AppData\Roaming\OfferBox\http_app.offerbox.com\profile.sxe [5012] =>PUP.OfferBox
O61 - LFC: 13/06/2013 - 15:29:27 ---A- C:\Users\Jon\AppData\Roaming\OfferBox\http_app.offerbox.com\update.sxe [1207] =>PUP.OfferBox
O61 - LFC: 13/06/2013 - 15:29:27 ---A- C:\Users\Jon\AppData\Roaming\OfferBox\http_app.offerbox.com\update.xml [412] =>PUP.OfferBox
O61 - LFC: 13/06/2013 - 15:29:34 ---A- C:\Users\Jon\AppData\Roaming\OfferBox\http_app.offerbox.com\country.sxe [367510] =>PUP.OfferBox
O61 - LFC: 13/06/2013 - 15:29:37 ---A- C:\Users\Jon\AppData\Roaming\OfferBox\http_app.offerbox.com\extracountry.sxe [1866] =>PUP.OfferBox
O61 - LFC: 13/06/2013 - 15:33:21 ---A- C:\Users\Jon\AppData\Roaming\OfferBox\config.xml [2532] =>PUP.OfferBox
O61 - LFC: 13/06/2013 - 15:33:21 ---A- C:\Users\Jon\AppData\Roaming\OfferBox\http_app.offerbox.com\history.db [27648] =>PUP.OfferBox
~ 22 Fichiers temporaires (Temporary files)
~ Files: 88 Legitimates Filtered in 07mn 27s
---\\ Liste des outils de nettoyage (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
~ ADS: Scanned in 00mn 00s
---\\ Liste des services Legacy (O64)
O64 - Services: CurCS - 15/10/2011 - C:\Windows\System32\DRIVERS\mfenlfk.sys (mfenlfk) .(.McAfee, Inc. - McAfee NDIS Light Filter Driver.) - LEGACY_MFENLFK
~ Legacy: 83 Legitimates Filtered in 00mn 01s
---\\ Start Menu Internet (O68)
O68 - StartMenuInternet:
O68 - StartMenuInternet:
~ Keys: Scanned in 00mn 00s
---\\ Search Browser Infection (O69)
O69 - SBI: SearchScopes [HKCU] {8E1A310A-C102-4F0B-B7DB-34A76AA25562} - (Google) - http://www.google.com
O69 - SBI: SearchScopes [HKCU] {afdbddaa-5d3f-42ee-b79c-185a7020515b} [DefaultScope] - (WinZipBar Customized Web Search) - http://search.conduit.com
~ Keys: Scanned in 00mn 00s
---\\ Crack & Keygen Files (O82)
C:\Users\Jon\Documents\groupes\MAO\Programmes MAO\Acid Pro 4.0 + Keygen + Manual\Acid Pro 4.0 (Build 215) -v187.exe
C:\Users\Jon\Documents\groupes\MAO\Programmes MAO\IK.Multimedia.AmpliTube.Fender.v1.0.VST.RTAS.Incl.KeyGen-DYNAMiCS\AmpliTube Fender\Install AmpliTube Fender.exe
C:\Users\Jon\Documents\groupes\MAO\Programmes MAO\Acid Pro 4.0 + Keygen + Manual\Acid Pro 4.0 (Build 215) -v187.exe
C:\Users\Jon\Documents\groupes\MAO\Programmes MAO\IK.Multimedia.AmpliTube.Fender.v1.0.VST.RTAS.Incl.KeyGen-DYNAMiCS\AmpliTube Fender\Install AmpliTube Fender.exe
~ Files: Scanned in 01mn 22s
---\\ Recherche particuliere � la racine de certains dossiers (O84)
[MD5.0CA73C4EC0E64416E5B1C2AB319D8A20] [SPRF][11/06/2013] (...) -- C:\ProgramData\9ejvol.bat [56]
[MD5.30639F0481CE3D60D0EAF9B62C062179] [SPRF][11/06/2013] (...) -- C:\ProgramData\9ejvol.reg [152]
[MD5.7FC9274BEF2567C7D315BFD3174C0D29] [SPRF][11/06/2013] (...) -- C:\ProgramData\lovje9.dat [159744]
[MD5.51138BEEA3E2C21EC44D0932C71762A8] [SPRF][11/06/2013] (.Microsoft Corporation - Windows host process (Rundll32).) -- C:\ProgramData\rundll32.exe [44544]
[MD5.2954D5486CBD37F9B20CC0C995DBDDD6] [SPRF][13/06/2013] (...) -- C:\Users\Jon\AppData\Local\Temp\dump.dat [2072576]
[MD5.AA223192DB5A9B419BA765759709C441] [SPRF][06/03/2008] (.Macrovision Corporation - Setup.exe.) -- C:\Users\Jon\AppData\Local\Temp\_is7D3A.exe [459400]
[MD5.AA223192DB5A9B419BA765759709C441] [SPRF][06/03/2008] (.Macrovision Corporation - Setup.exe.) -- C:\Users\Jon\AppData\Local\Temp\_isC467.exe [459400]
[MD5.AA223192DB5A9B419BA765759709C441] [SPRF][06/03/2008] (.Macrovision Corporation - Setup.exe.) -- C:\Users\Jon\AppData\Local\Temp\_isF5B.exe [459400]
[MD5.402D8FB182D0E28D8A8CE795BAB3CE1D] [SPRF][15/01/2011] (.Absolute Software Corp. - Computrace(R) LoJack for Laptops(R) Installer.) -- C:\Users\Jon\AppData\Roaming\LoJackSetup.exe [5943312]
[MD5.2637796F7486DF47046C451A1C5EB466] [SPRF][05/04/2013] (...) -- C:\Users\Jon\AppData\Roaming\msregsvv.dll [48]
[MD5.0FECB3FB879F3ED7AB5BB878D947E87A] [SPRF][19/01/2013] (.Propellerhead Software AB - ReWire.) -- C:\Users\Jon\AppData\Roaming\Rewire.dll [225280]
[MD5.D340FAF7C701118A4D74440CD9E80187] [SPRF][19/01/2013] (.Propellerhead Software AB - REX Shared library.) -- C:\Users\Jon\AppData\Roaming\REX Shared Library.dll [233472]
[MD5.01300E303C7A5426FC21C479CE3E1B18] [SPRF][13/06/2013] (...) -- C:\Users\Jon\Desktop\RogueKillerX64.exe [791040]
[MD5.D54278B3884D2861C0D4AA176653ED78] [SPRF][11/06/2013] (.Skype Technologies S.A. - Skype.) -- C:\Users\Jon\Desktop\SkypeSetup.exe [1491560]
[MD5.8EE509FEE63CB89AB1D763F644ACFED2] [SPRF][13/06/2013] (.Nicolas Coolman - ZHPDiag.) -- C:\Users\Jon\Desktop\ZHPDiag2.exe [5676095]
[MD5.3F35F68A1BE77502E424D478984D50F7] [SPRF][28/08/2004] (...) -- C:\Program Files (x86)\mss32.dll [368640]
~ Files: Scanned in 00mn 01s
---\\ Firewall Active Exception List (FirewallRules) (O87)
O87 - FAEL: "{3A29C691-2141-44E0-BB4D-75C14658F93E}" | In - Private - P6 - TRUE | .(.Vity - File Downloader.) -- C:\Program Files (x86)\CrazyLoader\crazyloader.exe =>Adware.SPointer
O87 - FAEL: "{350E2C1D-CC05-4D33-82B7-6446771E10F0}" | In - Private - P17 - TRUE | .(.Vity - File Downloader.) -- C:\Program Files (x86)\CrazyLoader\crazyloader.exe =>Adware.SPointer
O87 - FAEL: "{BB04C948-E546-4F95-BDFB-9EC38084AA60}" |In - Public - P6 - TRUE | .(...) -- C:\Program Files (x86)\Eidos\Batman Arkham Asylum\Binaries\ShippingPC-BmGame.exe (.not file.)
O87 - FAEL: "{794F37C6-344B-430A-A362-16EF7B4D951C}" |In - Public - P17 - TRUE | .(...) -- C:\Program Files (x86)\Eidos\Batman Arkham Asylum\Binaries\ShippingPC-BmGame.exe (.not file.)
~ Firewall: 255 Legitimates Filtered in 00mn 03s
---\\ Scan Additionnel (O88)
Database Version : v2.12437 - (10/06/2013)
Cl�s trouv�es (Keys found) : 39
Valeurs trouv�es (Values found) : 0
Dossiers trouv�s (Folders found) : 19
Fichiers trouv�s (Files found) : 0
[HKLM\Software\Classes\Interface\{30B15818-E110-4527-9C05-46ACE5A3460D}] =>Adware.ClickPotato
[HKLM\Software\Wow6432Node\Classes\Interface\{30B15818-E110-4527-9C05-46ACE5A3460D}] =>Adware.ClickPotato
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4D1EC4CA-4B92-4324-B8F8-C9A6ED06A8AE}] =>Adware.Hotbar
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4E674574-3F0B-491d-8AE3-F90B43A34FD6}] =>Adware.Hotbar
[HKLM\Software\Classes\Interface\{618aad04-921f-44c2-be38-c0818af69861}] =>Adware.Hotbar
[HKLM\Software\Wow6432Node\Classes\Interface\{618aad04-921f-44c2-be38-c0818af69861}] =>Adware.Hotbar
[HKLM\Software\Classes\TypeLib\{6F098504-CDB1-420F-A2E6-DDC0B835FEDF}] =>Adware.Hotbar
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7}] =>Adware.Softomate
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}] =>Toolbar.Conduit
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{b5d2ed96-62f9-4c2c-956d-e425b1f67337}] =>Adware.Hotbar
[HKLM\Software\Wow6432Node\Classes\Interface\{b5d2ed96-62f9-4c2c-956d-e425b1f67337}] =>Adware.Hotbar
[HKLM\Software\Classes\Interface\{d3a412e8-1e4b-47d2-9b12-f88291f5afbb}] =>Adware.Hotbar
[HKLM\Software\Wow6432Node\Classes\Interface\{d3a412e8-1e4b-47d2-9b12-f88291f5afbb}] =>Adware.Hotbar
[HKLM\Software\Classes\HBLiteAx.Info] =>Adware.ShopperReports
[HKLM\Software\Classes\HBLiteAx.Info.1] =>Adware.ShopperReports
[HKLM\Software\Classes\HBLiteAX.UserProfiles] =>Adware.ShopperReports
[HKLM\Software\Classes\HBLiteAX.UserProfiles.1] =>Adware.ShopperReports
[HKLM\Software\Classes\Installer\Features\0E9201899CF73FC4BA93F631631229A1] =>Toolbar.Agent
[HKLM\Software\Classes\Installer\Products\0E9201899CF73FC4BA93F631631229A1] =>Toolbar.Agent
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\0E9201899CF73FC4BA93F631631229A1] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Classes\Installer\Features\0E9201899CF73FC4BA93F631631229A1] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Classes\Installer\Products\0E9201899CF73FC4BA93F631631229A1] =>Toolbar.Agent
[HKCU\Software\AppDataLow\Software\ConduitSearchScopes] =>Toolbar.Conduit
[HKLM\Software\CrazyLoader] =>Adware.SPointer
[HKCU\Software\AppDataLow\Toolbar] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{981029E0-7FC9-4CF3-AB39-6F133621921A}] =>Toolbar.Agent
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\CrazyLoader] =>Adware.SPointer
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\daemon tools toolbar] =>Toolbar.Agent
[HKCU\Software\JavaSoft\Prefs\crazyloader] =>Adware.SPointer
[HKLM\Software\Classes\Toolbar.CT3106777] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Toolbar.CT3106777] =>Toolbar.Conduit
C:\Program Files (x86)\Conduit =>Toolbar.Conduit
C:\Program Files (x86)\Crazyloader =>Adware.SPointer
C:\Program Files (x86)\DAEMON Tools Toolbar =>Toolbar.Agent
C:\Program Files (x86)\HBLite =>Adware.Hotbar
C:\Program Files (x86)\OfferBox =>PUP.OfferBox
C:\Program Files (x86)\Optimizer Pro =>PUP.OptimizerPro
C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 =>Adware.Seekmo
C:\ProgramData\Babylon =>Toolbar.Babylon
C:\ProgramData\HBLiteSA =>Adware.Hotbar
C:\ProgramData\BrowserDefender =>Hijacker.Eazel
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotbar =>Adware.Hotbar
C:\Users\Jon\AppData\Roaming\Babylon =>Toolbar.Babylon
C:\Users\Jon\AppData\Roaming\Crazyloader =>Adware.SPointer
C:\Users\Jon\AppData\Roaming\HBLite =>Adware.Hotbar
C:\Users\Jon\AppData\Roaming\OfferBox =>PUP.OfferBox
C:\Users\Jon\AppData\Roaming\BabSolution =>Hijacker.BabSolution
C:\Users\Jon\AppData\Roaming\WebCake =>Adware.WebCake
C:\Users\Jon\AppData\Local\Conduit =>Toolbar.Conduit
C:\Users\Jon\AppData\LocalLow\Conduit =>Toolbar.Conduit
~ Additionnel Scan: 241968 Items scanned in 00mn 22s
---\\ Product Upgrade Codes (O90)
O90 - PUC: "5AD4353088F2E8B49A8748B979E9B1F8" . (.TuxGuitar.) -- C:\Windows\Installer\{03534DA5-2F88-4B8E-A978-849B979E1B8F}\icon.exe
O90 - PUC: "B6BB246AD1AC2414D84D13C8F3D38C43" . (.Rome - Total War(TM).) -- C:\Windows\Installer\{A642BB6B-CA1D-4142-8DD4-318C3F3DC834}\ARPPRODUCTICON.exe
O90 - PUC: "B719B23553285AF4EB6346A3B80B355A" . (.Steinberg REVerence Content 01.) -- C:\Windows\Installer\{532B917B-8235-4FA5-BE36-643A8BB053A5}\VSTSound.ico
~ Update Products: 97 Legitimates Filtered in 00mn 00s
---\\ Etat g�n�ral des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 12/06/2013 256904 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 17/11/2009 98208 | (AERTFilters) . (.Andrea Electronics Corporation.) - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
SR - | Auto 09/06/2009 155648 | (DockLoginService) . (.Stardock Corporation.) - C:\Program Files\Dell\DellDock\DockLogin.exe
SR - | Auto 05/03/2010 1425168 | (EvtEng) . (.Intel(R) Corporation.) - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
SR - | Auto 04/03/2010 13336 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
SR - | Auto 01/07/2010 325656 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
SS - | Demand 05/02/2013 235216 | (McComponentHostService) . (.McAfee, Inc..) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe
SR - | Auto 27/01/2011 249936 | (McMPFSvc) . (.McAfee, Inc..) - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
SR - | Auto 27/01/2011 249936 | (mcmscsvc) . (.McAfee, Inc..) - C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe
SR - | Auto 27/01/2011 249936 | (McNaiAnn) . (.McAfee, Inc..) - C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe
SR - | Auto 27/01/2011 249936 | (McNASvc) . (.McAfee, Inc..) - C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe
SS - | Demand 18/10/2011 502032 | (McODS) . (.McAfee, Inc..) - C:\Program Files\mcafee\VirusScan\mcods.exe
SS - | Disabled 27/01/2011 249936 | (McOobeSv) . (.McAfee, Inc..) - C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe
SR - | Auto 27/01/2011 249936 | (McProxy) . (.McAfee, Inc..) - C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe
SR - | Auto 18/10/2011 199272 | (McShield) . (.McAfee, Inc..) - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
SR - | Auto 18/10/2011 208536 | (mfefire) . (.McAfee, Inc..) - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
SR - | Auto 18/10/2011 161168 | (mfevtp) . (.McAfee, Inc..) - C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
SS - | Demand 340240 | (MyWiFiDHCPDNS) . (...) - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
SR - | Auto 12/08/2010 159336 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe
SR - | Auto 12/08/2010 1620584 | (nvUpdatusService) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
SR - | Auto 0 | (PnkBstrA) . (...) - C:\Windows\system32\PnkBstrA.exe
SR - | Auto 05/03/2010 831760 | (RegSrvc) . (.Intel(R) Corporation.) - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
SS - | Demand 04/09/2010 1116656 | (RoxMediaDB12OEM) . (.Sonic Solutions.) - C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe
SS - | Auto 04/09/2010 219632 | (RoxWatch12) . (.Sonic Solutions.) - C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe
SR - | Auto 18/08/2011 1692480 | (SftService) . (.SoftThinks SAS.) - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.exe
SS - | Auto 13/07/2012 160944 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SR - | Auto 12/08/2010 235624 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
SS - | Demand 26/08/2010 74392 | (stllssvr) . (.MicroVision Development, Inc..) - C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
SS - | Demand 02/11/2009 126352 | (TurboBoost) . (.Intel(R) Corporation.) - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
SR - | Auto 01/07/2010 2533400 | (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 17s
---\\ Recherche Master Boot Record Infection (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by Jon at 13/06/2013 19:59:22
device: opened successfully
user: error reading MBR
Disk trace:
error: Read Descripteur non valide
kernel: error reading MBR
~ MBR: 9 Legitimates Filtered in 00mn 02s
---\\ Recherche Master Boot Record Infection (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Jon at 13/06/2013 19:59:24
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 04s
~ 1560 Legitimates filtered by white list
End of the scan (638 lines in 16mn 18s)(4)