Publicité
Publicité
Format du document : text/plain
Prévisualisation
~ Rapport de ZHPDiag v2013.10.13.35 - Nicolas Coolman (13/10/2013)
~ Lanc� par Eddy Zakri (14/10/2013 09:47:23)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance � la d�sinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activ�e par le programme
~ El�vation des Privil�ges : OK
~ User Account Control (UAC): Activate by user
---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16686
MFIE: Mozilla Firefox 23.0
GCIE: Google Chrome v30.0.1599.69 (Defaut)
---\\ Informations sur les produits Windows
~ Langage: Fran�ais
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
---\\ Logiciels de protection du syst�me
Microsoft Security Client v4.3.0215.0
ZoneAlarm Free Firewall v11.0.768.000
ZoneAlarm Security Toolbar v1.8.22.0 =>Toolbar.ZoneAlarm
Windows Defender W7
---\\ Logiciels d'optimisation du syst�me
CCleaner v4.01 =>Piriform Ltd
---\\ Logiciels de partage PeerToPeer
�Torrent v3.3.0.29126 =>P2P.�Torrent
---\\ Surveillance de Logiciels
Adobe Flash Player 11 Plugin
Adobe Reader X
---\\ Informations sur le syst�me
~ Processor: AMD64 Family 20 Model 2 Stepping 0, AuthenticAMD
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1642 MB (24% free)
System Restore: Activ� (Enable)
System drive C: has 118 GB (42%) free of 279 GB
---\\ Mode de connexion au syst�me
~ Computer Name: EDDIEZAKRI-HP
~ User Name: Eddy Zakri
~ All Users Names: Eddy Zakri, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Eddy Zakri\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Eddy Zakri\AppData\Roaming\
~ %Desktop% : C:\Users\Eddy Zakri\Desktop\
~ %Favorites% : C:\Users\Eddy Zakri\Favorites\
~ %LocalAppData% : C:\Users\Eddy Zakri\AppData\Local\
~ %StartMenu% : C:\Users\Eddy Zakri\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enum�ration des unit�s disques
C: Hard drive, Flash drive, Thumb drive (Free 118 Go of 279 Go)
D: Hard drive, Flash drive, Thumb drive (Free 2 Go of 15 Go)
E: Hard drive, Flash drive, Thumb drive (Free 1 Go of 4 Go)
F: CD-ROM drive (Not Inserted)
G: CD-ROM drive (Not Inserted)
I: CD-ROM drive (Not Inserted)
Q: Hard drive, Flash drive, Thumb drive (Free 0 Go of 0 Go)
---\\ Etat du Centre de S�curit� Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: 33 Legitimates Filtered in 00mn 00s
---\\ Recherche particuli�re de fichiers g�n�riques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.09/08/2011 - 20:34:59.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de d�marrage de Windows.) (.14/07/2009 - 01:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.AAFA952E774DDDB0956D3BDFAE5B5B99] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.10/08/2013 - 05:22:18.) -- C:\Windows\System32\wininet.dll [2241024]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d�ouverture de session Windows.) (.21/11/2010 - 03:24:29.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Biblioth�que de licences.) (.21/11/2010 - 03:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.1C7857B62DE5994A75B054A9FD4C3825] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/12/2011 - 03:59:24.) -- C:\Windows\system32\Drivers\AFD.sys [498688]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 01:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 23:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 03:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 03:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 03:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.13/07/2009 - 23:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 00:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.09/08/2011 - 20:39:20.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 03:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du syst�me de fichiers NT.) (.12/04/2013 - 14:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parall�le.) (.14/07/2009 - 00:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 03:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 00:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 03:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de clich� instantan� du volume.) (.21/11/2010 - 03:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 02s
---\\ Etat des fichiers cach�s (Cach�/Total)
~ Mes images (My Pictures) : 1/279
~ Mes musiques (My Musics) : 11/2331
~ Mes Videos (My Videos) : 1/2141
~ Mes Favoris (My Favorites) : 1/8
~ Mes Documents (My Documents) : 11/4641
~ Mon Bureau (My Desktop) : 11/92
~ Menu demarrer (Programs) : 1/65
~ Hidden Files: Scanned in 00mn 49s
---\\ Processus lanc�s
[MD5.97A57AEA49E0EC9D17BDD96A3CEEBEBC] - (...) -- C:\ProgramData\BitGuard\2.6.1694.246\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe [3032032] [PID.1860] =>PUP.BitGuard
[MD5.497F27E279C0F921E2130BB89C1CB5CA] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe [18705664] [PID.2716]
[MD5.226B7F3D5029B40BA3D3ECF04FBD32A6] - (.Pas de propri�taire - FM Application.) -- C:\Facemoi\facemoi.exe [82944] [PID.2984] =>PUP.Facemoi
[MD5.2781C31D26F39FCFF05A290120210A4F] - (...) -- C:\Program Files (x86)\InternetEverywhere\InternetEverywhere_Launcher.exe [637936] [PID.1180]
[MD5.A16852B04C0A5654B0B8DFD5E1A25718] - (.MagicISO, Inc. - MagicISO Virtual CD/DVD Manager.) -- C:\Program Files (x86)\MagicDisc\MagicDisc.exe [576000] [PID.3180]
[MD5.8192B2E274607D1D530F5C191698C544] - (.Hewlett-Packard Development Company, L.P. - HP Message Service.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944] [PID.3408]
[MD5.B7F55E2AE978D3D34F7876EE5D689AAE] - (.CyberLink - YouCam Mirage.) -- C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [136488] [PID.3588]
[MD5.A25F011CACB68FE3F8FC74A4FA7C8D7F] - (.Abine Inc. - ZoneAlarm Do Not Track Me Service.) -- C:\Program Files (x86)\Check Point Software Technologies LTD\zonealarm\AbineSDK\IE\DNTPService.exe [297336] [PID.1332]
[MD5.5397E32E882C0148CEC13D9EACFB7157] - (.Microsoft Corporation - Internet Low-Mic Utility Tool.) -- C:\Program Files (x86)\Internet Explorer\IELowutil.exe [222208] [PID.316]
[MD5.37287D98A1BF5D56AA729CEB9B27C6B1] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\IEXPLORE.exe [770648] [PID.4388]
[MD5.2176B4590387405E5F2405C3CEF0C02A] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8078848] [PID.1940]
~ Processes Running: Scanned in 00mn 03s
---\\ Google Chrome, D�marrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Eddy Zakri\AppData\Local\Google\Chrome\User Data\Default\Preferences
~ Google Browser: 0 Legitimates Filtered in 00mn 00s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\prefs.js
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\user.js
M3 - MFPP: Plugins - [Eddy Zakri] -- C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\searchplugins\babylon.xml =>Toolbar.Babylon
M3 - MFPP: Plugins - [Eddy Zakri] -- C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\searchplugins\delta.xml =>Toolbar.DeltaSearch
M3 - MFPP: Plugins - [Eddy Zakri] -- C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\searchplugins\softonic.xml =>Toolbar.Conduit
M3 - MFPP: Plugins - [Eddy Zakri] -- C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\searchplugins\zonealarm.xml
M2 - MFEP: prefs.js [Eddy Zakri - xhe9vf9l.default\ffxtlbr@delta.com] [] Delta Toolbar v1.5.0 (..) =>Toolbar.DeltaSearch
M2 - MFEP: prefs.js [Eddy Zakri - xhe9vf9l.default\plugin@getwebcake.com] [] WebCake v1.00.01 (..) =>Adware.WebCake
~ Firefox Browser: 10 Legitimates Filtered in 00mn 01s
---\\ Internet Explorer, D�marrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs,Tabs = http://search.softonic.com =>Toolbar.Conduit
~ IE Browser: 16 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21
---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: OKitSpace [64Bits] - {3543619C-D563-43f7-95EA-4DA7E1CC396A} . (...) -- C:\Users\Eddy Zakri\AppData\Roaming\okitspace\IE\OKitSpace.dll =>PUP.Onekit
O2 - BHO: delta Helper Object [64Bits] - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} . (.Delta-search.com - Pas de description.) -- C:\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll =>Toolbar.DeltaSearch
O2 - BHO: Softonic Helper Object [64Bits] - {E87806B5-E908-45FD-AF5E-957D83E58E68} . (.Softonic.com - Pas de description.) -- C:\Program Files (x86)\Softonic\Softonic\1.8.19.3\bh\Softonic.dll =>Toolbar.Conduit
O2 - BHO: (no name) [64Bits] - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} Cl� orpheline
~ BHO: 14 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Google Toolbar [64Bits] - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll =>Toolbar.Google
O3 - Toolbar\WebBrowser: (no name) [64Bits] - [HKCU]{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} Cl� orpheline
O3 - Toolbar\WebBrowser: (no name) [64Bits] - [HKCU]{D4027C7F-154A-4066-A1AD-4243D8127440} Cl� orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Dictionnaire le Littr�.lnk . (...) -- C:\Program Files (x86)\Dictionnaire le Littr� 2.0\Littre.exe
O4 - GS\Desktop [Public]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [Public]: HP Support Assistant.lnk . (.Hewlett-Packard Company - HP Support Assistant.) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe =>.Hewlett-Packard Co
O4 - GS\Desktop [Public]: Internet Everywhere.lnk . (...) -- C:\Program Files (x86)\InternetEverywhere\InternetEverywhere.exe
O4 - GS\Desktop [Public]: MobaMotiv.lnk . (.Mobatek - http://www.mobatek.net - MobaMotiv.) -- C:\Program Files (x86)\MobaMotiv\MobaMotiv.exe
O4 - GS\Desktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Desktop [Public]: WiMAX Connection Manager.lnk . (.HUAWEI - WiMAX Connection Manager.) -- C:\Program Files (x86)\WiMAX Connection Manager\WiMAX Connection Manager.exe
O4 - GS\Desktop [Public]: �Torrent.lnk . (.BitTorrent Inc. - �Torrent.) -- C:\Users\Eddy Zakri\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\QuickLaunch [Eddy Zakri]: Amazing Pyramids.lnk . (...) -- C:\Program Files (x86)\MyPlayCity.com\Amazing Pyramids\Amazing Pyramids.exe (.not file.)
O4 - GS\QuickLaunch [Eddy Zakri]: BitTorrent.lnk . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Eddy Zakri\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent
O4 - GS\QuickLaunch [Eddy Zakri]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Eddy Zakri]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch [Eddy Zakri]: �Torrent.lnk . (.BitTorrent Inc. - �Torrent.) -- C:\Users\Eddy Zakri\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\TaskBar [Eddy Zakri]: doPDF.lnk . (.Softland - doPDF Start Application.) -- C:\Program Files\Softland\doPDF 7\dopdf.exe
O4 - GS\Program [Eddy Zakri]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [Eddy Zakri]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SendTo [Eddy Zakri]: Evernote.lnk . (.Evernote Corp., 333 W Evelyn Ave. Mountain - Evernote.) -- C:\Program Files (x86)\Evernote\Evernote\Evernote.exe
O4 - GS\Desktop [Eddy Zakri]: 7zFM - Raccourci.lnk . (.Igor Pavlov - 7-Zip File Manager.) -- C:\Program Files (x86)\7-Zip\7zFM.exe
O4 - GS\Desktop [Eddy Zakri]: BitTorrent.lnk . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Eddy Zakri\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent
O4 - GS\Desktop [Eddy Zakri]: CVitae V4.lnk . (...) -- C:\Program Files (x86)\CVitaeV4\CVitae.exe
O4 - GS\Desktop [Eddy Zakri]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Eddy Zakri]: Le Grand Robert.lnk . (.Bureau Van Dijk � Dictionnaires Le Robert - Le Grand Robert de la langue fran�aise.) -- C:\Program Files (x86)\Le Grand Robert\grwin.exe
O4 - GS\Desktop [Eddy Zakri]: Speed - Raccourci.lnk . (...) -- C:\Users\Eddy Zakri\Videos\JEUX\Need for speed mw\Need for Speed Most Wanted\Speed.exe
O4 - GS\Desktop [Eddy Zakri]: Windows Update.lnk . (.Microsoft Corporation - Windows Update Application Launcher.) -- C:\Windows\system32\wuapp.exe
~ Global Startup: 88 Legitimates Filtered in 00mn 57s
---\\ Applications lanc�es au d�marrage du syt�me (O4)
O4 - GS\Startup [Public]: Launcher.lnk . (...) -- C:\Program Files (x86)\InternetEverywhere\InternetEverywhere_Launcher.exe
O4 - GS\Startup [Eddy Zakri]: MagicDisc.lnk . (.MagicISO, Inc. - MagicISO Virtual CD/DVD Manager.) -- C:\Program Files (x86)\MagicDisc\MagicDisc.exe
O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe =>.Realtek Semiconductor Corp
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe (.not file.)
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKCU\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe =>.Skype Technologies S.A.
O4 - HKCU\..\Run: [GM4IE] . (.Pas de propri�taire - FM Application.) -- C:\Facemoi\facemoi.exe =>PUP.Facemoi
O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe =>.DT Soft Ltd
O4 - HKCU\..\Run: [ares mod] C:\Program Files (x86)\AresMod\AresMod.exe (.not file.)
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst� Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe =>.Advanced Micro Devices, Inc
O4 - HKLM\..\Wow6432Node\Run: [HPConnectionManager] . (.Hewlett-Packard Development Company L.P. - HPCMDelayStart Application.) -- C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [Facemoi] . (.Pas de propri�taire - FM Application.) -- c:\Facemoi\facemoi.exe =>PUP.Facemoi
O4 - HKLM\..\Wow6432Node\Run: [HP Quick Launch] . (.Hewlett-Packard Development Company, L.P. - HP Message Service.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2116176242-1592332739-549678488-1001\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
O4 - HKUS\S-1-5-21-2116176242-1592332739-549678488-1001\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe =>.Skype Technologies S.A.
O4 - HKUS\S-1-5-21-2116176242-1592332739-549678488-1001\..\Run: [GM4IE] . (.Pas de propri�taire - FM Application.) -- C:\Facemoi\facemoi.exe =>PUP.Facemoi
O4 - HKUS\S-1-5-21-2116176242-1592332739-549678488-1001\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe =>.DT Soft Ltd
O4 - HKUS\S-1-5-21-2116176242-1592332739-549678488-1001\..\Run: [ares mod] C:\Program Files (x86)\AresMod\AresMod.exe (.not file.)
~ Application: Scanned in 00mn 00s
---\\ Boutons situ�s sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Skype Click to Call [64Bits] - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- c:\program files (x86)\skype\toolbars\internet explorer x64\icon.ico
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{0CA06509-E16A-4A8F-A131-518BC880B0EF}: DhcpNameServer = 41.206.65.1 213.136.109.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{85B64B98-FE35-44DF-9679-A46602EDBD80}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{B8AC1FC4-5E19-4932-AD4B-C881C93122AD}: DhcpNameServer = 213.136.96.157 213.136.96.37
O17 - HKLM\System\CCS\Services\Tcpip\..\{D2729A2E-A0FC-48F5-A571-61250EB4C284}: DhcpNameServer = 213.136.109.2 41.206.65.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{0CA06509-E16A-4A8F-A131-518BC880B0EF}: DhcpDomain = mtn.ci
O17 - HKLM\System\CCS\Services\Tcpip\..\{D2729A2E-A0FC-48F5-A571-61250EB4C284}: DhcpDomain = mtn.ci
O17 - HKLM\System\CS1\Services\Tcpip\..\{0CA06509-E16A-4A8F-A131-518BC880B0EF}: DhcpNameServer = 41.206.65.1 213.136.109.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{85B64B98-FE35-44DF-9679-A46602EDBD80}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{B8AC1FC4-5E19-4932-AD4B-C881C93122AD}: DhcpNameServer = 213.136.96.157 213.136.96.37
O17 - HKLM\System\CS1\Services\Tcpip\..\{D2729A2E-A0FC-48F5-A571-61250EB4C284}: DhcpNameServer = 213.136.109.2 41.206.65.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{0CA06509-E16A-4A8F-A131-518BC880B0EF}: DhcpDomain = mtn.ci
O17 - HKLM\System\CS1\Services\Tcpip\..\{D2729A2E-A0FC-48F5-A571-61250EB4C284}: DhcpDomain = mtn.ci
O17 - HKLM\System\CS2\Services\Tcpip\..\{0CA06509-E16A-4A8F-A131-518BC880B0EF}: DhcpNameServer = 41.206.65.1 213.136.109.2
O17 - HKLM\System\CS2\Services\Tcpip\..\{85B64B98-FE35-44DF-9679-A46602EDBD80}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{B8AC1FC4-5E19-4932-AD4B-C881C93122AD}: DhcpNameServer = 213.136.96.157 213.136.96.37
O17 - HKLM\System\CS2\Services\Tcpip\..\{D2729A2E-A0FC-48F5-A571-61250EB4C284}: DhcpNameServer = 213.136.109.2 41.206.65.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{0CA06509-E16A-4A8F-A131-518BC880B0EF}: DhcpDomain = mtn.ci
O17 - HKLM\System\CS2\Services\Tcpip\..\{D2729A2E-A0FC-48F5-A571-61250EB4C284}: DhcpDomain = mtn.ci
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non d�sactiv�s (O23)
O23 - Service: BitGuard (BitGuard) . (...) - C:\ProgramData\BitGuard\2.6.1694.246\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe =>PUP.BitGuard
O23 - Service: Software Updater (SrvUpdater) . (.Pas de propri�taire - Updater.) - C:\Program Files (x86)\SoftwareUpdater\UpdaterService.exe =>PUP.Eorezo
~ Services: 15 Legitimates Filtered in 01mn 30s
---\\ T�ches planifi�es en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\AmiUpdXp.job [376] =>PUP.Software.Updater
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\SpeedMaxPc Registration3.job [474] =>PUP.SpeedMaxPc
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\SpeedMaxPc Update3.job [432] =>PUP.SpeedMaxPc
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\SpeedMaxPc.job [410] =>PUP.SpeedMaxPc
[MD5.1C446DC37F6BA32799F5881D06488C3F] [APT] [AmiUpdXp] (.Amonetize ltd..) -- C:\Users\Eddy Zakri\AppData\Local\SwvUpdater\Updater.exe [307240] =>PUP.Software.Updater
[MD5.71D490C463014E4FB88B8CBA700B111E] [APT] [EPUpdater] (...) -- C:\Users\Eddy Zakri\AppData\Roaming\BabSolution\Shared\BabMaint.exe [4608] =>Hijacker.BabSolution
[MD5.00000000000000000000000000000000] [APT] [Go for FilesUpdate] (...) -- C:\Program Files (x86)\GoforFiles\GFFUpdater.exe (.not file.) [0] =>P2P.GoforFiles
[MD5.00000000000000000000000000000000] [APT] [SpeedMaxPc] (...) -- C:\Program Files (x86)\SpeedMaxPc\SpeedMaxPc\SpeedMaxPc.exe (.not file.) [0] =>PUP.SpeedMaxPc
[MD5.35DD2A44BA05F0D447520BB265E91810] [APT] [SpeedMaxPc Update3] (.SpeedMaxPc.) -- C:\Program Files (x86)\Common Files\SpeedMaxPc\UUS3\Update3.exe [654336] =>PUP.SpeedMaxPc
[MD5.00000000000000000000000000000000] [APT] [{79D44C1D-B978-4460-947A-026FE3243B51}] (...) -- C:\Users\Eddy Zakri\Downloads\Programs et Logiciels\avira_antivir_personal_en.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{7DF8493D-C336-4F3B-96FA-0F86FFDDA649}] (...) -- C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\uninstbb.exe (.not file.) [0] =>Toolbar.Babylon
[MD5.00000000000000000000000000000000] [APT] [{8BDF8CEE-3D48-427B-8001-D480C570C399}] (...) -- C:\Users\Eddy Zakri\Documents\VIDEO\JEUX\The Thing\Setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{AA66B93D-9CD4-4A10-92B4-4FA1DEEE342C}] (...) -- C:\Users\Eddy Zakri\Downloads\Programs et Logiciels\PVMsetup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{AC3D07B1-8E16-4828-889C-646C5F37EBBE}] (...) -- C:\Users\Eddy Zakri\Desktop\JEUX\Luxor 2\luxor 2 crackfix.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{D598D2C9-F5E7-4200-9CBA-C6423EF932C9}] (...) -- C:\Program Files (x86)\Micro Application\Conduite 3D\Desinst.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{EF667C87-8630-415E-8E87-DEEC06397D09}] (...) -- C:\Users\Eddy Zakri\Desktop\JEUX\my game\BEACHHEAD2000\SETUP.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{F6207134-3B73-493C-A42F-11A8FC1ADAF2}] (...) -- C:\Users\Eddy Zakri\Desktop\ne98spst.exe (.not file.) [0]
~ Scheduled Task: 45 Legitimates Filtered in 00mn 27s
---\\ Logiciels install�s (O42)
O42 - Logiciel: Ask Toolbar Updater - (.Ask.com.) [HKCU][64Bits] -- {79A765E1-C399-405B-85AF-466F52E918B0} =>Toolbar.Ask
O42 - Logiciel: BitGuard - (.MediaTechSoft Inc..) [HKLM][64Bits] -- {15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693} =>PUP.BitGuard
O42 - Logiciel: Delta Force - Black Hawk Down - (...) [HKLM][64Bits] -- {8FE54D21-8254-4CCF-AEE0-066496AE43F4}
O42 - Logiciel: Delta toolbar - (.Delta.) [HKLM][64Bits] -- delta =>Toolbar.DeltaSearch
O42 - Logiciel: Prompt Downloader - (...) [HKLM][64Bits] -- Prompt Downloader
O42 - Logiciel: WebCake 3.00 - (.WebCake LLC.) [HKLM][64Bits] -- {C4ED781C-7394-4906-AAFF-D6AB64FF7C38} =>Adware.WebCake
O42 - Logiciel: okitspace - (...) [HKLM][64Bits] -- okitspace =>PUP.Onekit
~ Logic: 162 Legitimates Filtered in 00mn 04s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\9538ddfbc6fbf43]
[HKCU\Software\BabSolution] =>Hijacker.BabSolution
[HKCU\Software\Babylon] =>Toolbar.Babylon
[HKCU\Software\Conduit] =>Toolbar.Conduit
[HKCU\Software\DataMngr_Toolbar] =>PUP.Datamngr
[HKCU\Software\Datamngr] =>PUP.Datamngr
[HKCU\Software\Delta]
[HKCU\Software\Media Get LLC] =>PUP.MediaGet
[HKCU\Software\PluginAddon]
[HKCU\Software\Prompt Downloader]
[HKCU\Software\Safe Browser]
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKCU\Software\SpeedMaxPc] =>PUP.SpeedMaxPc
[HKCU\Software\Yahoo]
[HKCU\Software\abhisoft]
[HKLM\Software\DataMngr] =>PUP.Datamngr
[HKLM\Software\Tarma Installer] =>PUP.Tarma
[HKLM\Software\Wow6432Node\9538ddfbc6fbf43]
[HKLM\Software\Wow6432Node\Babylon] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Conduit] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\DataMngr] =>PUP.Datamngr
[HKLM\Software\Wow6432Node\Delta]
[HKLM\Software\Wow6432Node\MarineAquarium3Free_57EI]
[HKLM\Software\Wow6432Node\SpeedMaxPc] =>PUP.SpeedMaxPc
[HKLM\Software\Wow6432Node\VBMZ]
~ Key Software: 293 Legitimates Filtered in 00mn 04s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 10/10/2013 - 17:43:07 - [0,121] ----D C:\Program Files (x86)\AresMod
O43 - CFD: 20/07/2013 - 14:16:12 - [2,336] ----D C:\Program Files (x86)\Delta
O43 - CFD: 30/06/2013 - 09:28:35 - [0,015] ----D C:\Program Files (x86)\MyPC Backup =>PUP.MyPCBackup
O43 - CFD: 30/06/2013 - 06:58:44 - [22,228] ----D C:\Program Files (x86)\Prompt Downloader
O43 - CFD: 07/08/2013 - 10:45:23 - [2,258] ----D C:\Program Files (x86)\Softonic =>Toolbar.Conduit
O43 - CFD: 06/08/2013 - 11:36:27 - [5,983] ----D C:\Program Files (x86)\Yahoo!
O43 - CFD: 12/09/2012 - 15:52:14 - [1,600] ----D C:\Program Files (x86)\Common Files\SpeedMaxPc =>PUP.SpeedMaxPc
O43 - CFD: 20/07/2013 - 14:15:23 - [0] ----D C:\ProgramData\Babylon =>Toolbar.Babylon
O43 - CFD: 12/10/2013 - 13:02:48 - [8,444] ----D C:\ProgramData\BitGuard =>PUP.BitGuard
O43 - CFD: 11/09/2013 - 12:52:39 - [0] ----D C:\ProgramData\Media Get LLC =>PUP.MediaGet
O43 - CFD: 12/09/2012 - 15:52:14 - [0,019] ----D C:\ProgramData\SpeedMaxPc =>PUP.SpeedMaxPc
O43 - CFD: 30/06/2013 - 06:58:16 - [2,732] ----D C:\ProgramData\Tarma Installer =>PUP.Tarma
O43 - CFD: 06/08/2013 - 11:34:35 - [0,005] ----D C:\ProgramData\Yahoo!
O43 - CFD: 20/07/2013 - 14:16:25 - [1,662] ----D C:\Users\Eddy Zakri\AppData\Roaming\BabSolution =>Hijacker.BabSolution
O43 - CFD: 20/07/2013 - 14:15:20 - [0,011] ----D C:\Users\Eddy Zakri\AppData\Roaming\Babylon =>Toolbar.Babylon
O43 - CFD: 20/07/2013 - 14:16:08 - [0,259] ----D C:\Users\Eddy Zakri\AppData\Roaming\Delta
O43 - CFD: 22/09/2013 - 12:49:12 - [0,308] ----D C:\Users\Eddy Zakri\AppData\Roaming\File Scout
O43 - CFD: 10/10/2013 - 17:43:42 - [0,267] ----D C:\Users\Eddy Zakri\AppData\Roaming\okitspace =>PUP.Onekit
O43 - CFD: 07/08/2013 - 10:45:01 - [0,259] ----D C:\Users\Eddy Zakri\AppData\Roaming\Softonic =>Toolbar.Conduit
O43 - CFD: 02/08/2012 - 21:27:57 - [0] ----D C:\Users\Eddy Zakri\AppData\Roaming\SpeedMaxPc =>PUP.SpeedMaxPc
O43 - CFD: 05/08/2013 - 20:59:12 - [0,002] ----D C:\Users\Eddy Zakri\AppData\Roaming\Yahoo!
O43 - CFD: 25/09/2012 - 13:05:51 - [0,008] ----D C:\Users\Eddy Zakri\AppData\Roaming\{90140011-0066-040C-0000-0000000FF1CE}
O43 - CFD: 20/07/2013 - 14:15:29 - [0,018] ----D C:\Users\Eddy Zakri\AppData\Local\Ares Mod
O43 - CFD: 30/06/2013 - 06:58:44 - [0] ----D C:\Users\Eddy Zakri\AppData\Local\Prompt Downloader
O43 - CFD: 30/06/2013 - 06:57:47 - [0,295] ----D C:\Users\Eddy Zakri\AppData\Local\SwvUpdater =>PUP.Software.Updater
O43 - CFD: 12/10/2013 - 11:29:15 - [0,001] ----D C:\Users\Eddy Zakri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard =>PUP.BitGuard
O43 - CFD: 30/06/2013 - 06:58:44 - [0,002] ----D C:\Users\Eddy Zakri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Prompt Downloader
O43 - CFD: 11/09/2013 - 18:16:25 - [0,007] ----D C:\Users\Eddy Zakri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Video Related Programs
~ 746 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 1029 Legitimates Filtered in 04mn 36s
---\\ Derniers fichiers modifi�s ou cr�es sous Windows et System32 (O44)
O44 - LFC:[MD5.5A1906B623625C26FB70645ACA95BCF4] - 14/10/2013 - 09:52:50 --HA- . (...) -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [32064]
O44 - LFC:[MD5.5A1906B623625C26FB70645ACA95BCF4] - 14/10/2013 - 09:52:50 --HA- . (...) -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [32064]
O44 - LFC:[MD5.5A1906B623625C26FB70645ACA95BCF4] - 14/10/2013 - 09:52:50 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [32064]
O44 - LFC:[MD5.5A1906B623625C26FB70645ACA95BCF4] - 14/10/2013 - 09:52:50 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [32064]
~ Files: 23 Legitimates Filtered in 00mn 48s
---\\ Cl� de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{04b37eca-0255-11e2-906c-2c768ae73fbe}\AutoRun\command. (...) -- G:\AutoRun.exe (.not file.)
O51 - MPSK:{495b37f8-3ac4-11e2-b8b9-2c768ae73fbe}\AutoRun\command. (...) -- G:\.\Setup.exe (.not file.)
O51 - MPSK:{7e0f21eb-4901-11e2-bbff-2c768ae73fbe}\AutoRun\command. (...) -- G:\Setup.exe (.not file.)
O51 - MPSK:{7f601ac8-2257-11e2-9f31-2c768ae73fbe}\AutoRun\command. (...) -- G:\.\Setup.exe (.not file.)
O51 - MPSK:{9ce2fb93-2904-11e3-85bc-2c768ae73fbe}\AutoRun\command. (...) -- H:\iStudio.exe (.not file.)
O51 - MPSK:{a57d510c-9c0d-11e1-ad32-2c768ae73fbe}\AutoRun\command. (...) -- I:\autorun\autorun.exe (.not file.)
~ Keys: Scanned in 00mn 00s
---\\ Enum�ration des cl�s de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 20 Legitimates Filtered in 00mn 00s
---\\ Enum�ration des cl�s de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 4 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du syst�me (SDL) (O58)
O58 - SDL:[MD5.46571ED73AE84469DCA53081D33CF3C8] - 10/06/2013 - 19:45:12 ---A- . (.DT Soft Ltd - DAEMON Tools Virtual Bus Driver.) -- C:\Windows\System32\Drivers\dtsoftbus01.sys [283200]
O58 - SDL:[MD5.F572B7467B5CB4FA8FB6319575902E41] - 08/01/2013 - 14:21:06 ---A- . (.Huawei Tech. Co., Ltd. - HUAWEI USB Smart Card Driver.) -- C:\Windows\SysWOW64\drivers\ewdcsc.sys [32768]
~ Drivers: 20 Legitimates Filtered in 00mn 02s
---\\ Liste des outils de d�sinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 19 Legitimates Filtered in 00mn 00s
---\\ Menu de d�marrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.admin", false); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.aflt", "babsst"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.autoRvrt", "false"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.dfltLng", "fr"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.excTlbr", false); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.id", "bec68cc20000000000009439e57898f3"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.instlDay", "15674"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.instlRef", "na"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.prtnrId", "babylon"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.tlbrId", "irhnew"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "http://search.babylon.com/?babsrc=TB_def&mntrId=bec68cc20000000000009439e57898[...] =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.vrsn", "1.8.3.8"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.vrsni", "1.8.3.8"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar_i.babExt", ""); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar_i.babTrack", "affID=17425&tt=281112_lng"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar_i.newTab", false); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar_i.smplGrp", "none"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar_i.srcExt", "def"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.3.820:37:31"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.asktb.ff-original-keyword-url", "");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.admin", false);
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.aflt", "babsst");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.autoRvrt", "false");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.dfltLng", "fr");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.excTlbr", false);
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.ffxUnstlRst", true);
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.id", "bec68cc20000000000009439e57898f3");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.instlDay", "15906");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.instlRef", "sst");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.newTab", false);
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.prdct", "delta");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.prtnrId", "delta");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.rvrt", "false");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.smplGrp", "none");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.tlbrId", "base");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.tlbrSrchUrl", "");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.vrsn", "1.8.21.5");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.vrsnTs", "1.8.21.514:16:15");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.vrsni", "1.8.21.5");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta_i.babExt", "");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta_i.babTrack", "affID=120695&tsp=4949");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta_i.srcExt", "ss");
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {0C79A1C0-477D-44DD-8E58-878E3311465C} [DefaultScope] - (Search By ZoneAlarm) - http://search.zonealarm.com
O69 - SBI: SearchScopes [HKCU] {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} - (Delta Search) - http://www1.delta-search.com =>Toolbar.DeltaSearch
O69 - SBI: SearchScopes [HKCU] {2fa28606-de77-4029-af96-b231e3b8f827} - (Ask.com) - http://eu.ask.com
O69 - SBI: SearchScopes [HKCU] {4DAB80A5-7A3E-4CDD-AE89-D146AA010275} - (Ask Search) - http://websearch.ask.com =>Toolbar.Ask
O69 - SBI: SearchScopes [HKCU] {96CE4CCC-8A77-4A55-B495-1DB2673B7D73} - (Propositions de recherche Amazon.fr) - http://www.amazon.fr
O69 - SBI: SearchScopes [HKCU] {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} - (Search Results) - http://dts.search-results.com =>PUP.SearchResults
O69 - SBI: SearchScopes [HKCU] {B1A0897C-2EA0-488B-901B-71C323DD78C0} - (Search the web (Softonic)) - http://search.softonic.com =>Adware.IMBooster
O69 - SBI: SearchScopes [HKCU] {b7fca997-d0fb-4fe0-8afd-255e89cf9671} - (Yahoo) - http://fr.search.yahoo.com
O69 - SBI: SearchScopes [HKCU] {d43b3890-80c7-4010-a95d-1e77b5924dc3} - (Wikipedia) - http://fr.wikipedia.org
O69 - SBI: SearchScopes [HKCU] {D944BB61-2E34-4DBF-A683-47E505C587DC} - (eBay) - http://rover.ebay.com
~ Keys: Scanned in 00mn 00s
---\\ Recherche particuli�re � la racine du syst�me (SPRF) (O84)
[MD5.F2A14501C58CAAF65D169A12BE452B3D] [SPRF][12/09/2012] (...) -- C:\ProgramData\ntuser.dat [262144]
~ Files: 1 Legitimates Filtered in 00mn 00s
---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "TCP Query User{05462040-2A87-4993-A326-9CF8C838A6DA}C:\program files (x86)\aresmod\aresmod.exe" |In - Public - P6 - TRUE | .(...) -- C:\program files (x86)\aresmod\aresmod.exe (.not file.)
O87 - FAEL: "UDP Query User{731E59C5-F5DD-43CA-8759-7C26E4BC4337}C:\program files (x86)\aresmod\aresmod.exe" |In - Public - P17 - TRUE | .(...) -- C:\program files (x86)\aresmod\aresmod.exe (.not file.)
O87 - FAEL: "{F707704B-4A26-44BC-A858-596B991FDBBD}" |In - None - P6 - TRUE | .(...) -- C:\Users\Eddy Zakri\AppData\Local\MediaGet2\mediaget.exe (.not file.) =>PUP.MediaGet
O87 - FAEL: "{3DEA7EA5-6F06-4F03-9A8D-A4BD818E2A3B}" |In - None - P17 - TRUE | .(...) -- C:\Users\Eddy Zakri\AppData\Local\MediaGet2\mediaget.exe (.not file.) =>PUP.MediaGet
O87 - FAEL: "TCP Query User{8A88D29C-9281-41DD-8C08-D7A518AE0AD0}C:\users\eddy zakri\videos\jeux\007\bond_ded.exe" | In - Public - P6 - TRUE | .(...) -- C:\users\eddy zakri\videos\jeux\007\bond_ded.exe
O87 - FAEL: "UDP Query User{E621D580-DDDE-44AF-B86A-99083E094302}C:\users\eddy zakri\videos\jeux\007\bond_ded.exe" | In - Public - P17 - TRUE | .(...) -- C:\users\eddy zakri\videos\jeux\007\bond_ded.exe
~ Firewall: 186 Legitimates Filtered in 00mn 04s
---\\ Export de cl�s de registre al�atoires (O91)
[HKCU\Software\9538ddfbc6fbf43\2.6.1519.190\upd]:="upd=1"
[HKCU\Software\9538ddfbc6fbf43\2.6.1673.238\upd]:="upd=1"
[HKCU\Software\9538ddfbc6fbf43\2.6.1694.246\upd]:="upd="
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:dllName="BrowserDefender.dll" =>Hijacker.Eazel
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:exeName="BrowserDefender.exe" =>Hijacker.Eazel
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:folderName="BrowserDefender" =>Hijacker.Eazel
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:guid="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}"
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:serviceName="BrowserDefendert" =>Hijacker.Eazel
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:version="2.6.1339.144"
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:dllName="BrowserDefender.dll" =>Hijacker.Eazel
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:exeName="BrowserDefender.exe" =>Hijacker.Eazel
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:folderName="BrowserDefender" =>Hijacker.Eazel
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:guid="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}"
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:serviceName="BrowserDefendert" =>Hijacker.Eazel
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:version="2.6.1519.190"
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:dllName="BitGuard.dll" =>PUP.BitGuard
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:exeName="BitGuard.exe" =>PUP.BitGuard
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:folderName="BitGuard" =>PUP.BitGuard
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:guid="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}"
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:serviceName="BitGuard" =>PUP.BitGuard
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:version="2.6.1673.238"
[HKCU\Software\9538ddfbc6fbf43]:version="2.6.1694.246"
[HKLM\Software\Wow6432Node\9538ddfbc6fbf43]:version="2.6.1694.246"
~ Export Key Software: Scanned in 00mn 00s
---\\ Etat g�n�ral des services not Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 10/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 14/10/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 18/11/2009 98208 | (AERTFilters) . (.Andrea Electronics Corporation.) - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
SR - | Auto 06/07/2011 204288 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 05/07/2011 365568 | (AMD FUEL Service) . (.Advanced Micro Devices, Inc..) - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
SR - | Auto 08/10/2013 3032032 | (BitGuard) . (...) - C:\ProgramData\BitGuard\2.6.1694.246\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe =>PUP.BitGuard
SR - | Auto 10/07/1658 0 | (ezSharedSvc) . (.EasyBits Software AS.) - C:\Windows\System32\ezSharedSvcHost.exe =>.EasyBits Software AS
SS - | Demand 12/10/2010 206072 | (GamesAppService) . (.WildTangent, Inc..) - C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe
SS - | Auto 04/05/2012 136176 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 04/05/2012 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 15/02/2013 194032 | (gusvc) . (.Google.) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SR - | Auto 27/09/2012 86528 | (HP Support Assistant Service) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe =>.Hewlett-Packard Co
SR - | Auto 11/10/2010 346168 | (HPClientSvc) . (.Hewlett-Packard Company.) - C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
SS - | Demand 14/06/2011 1098296 | (hpCMSrv) . (.Hewlett-Packard Development Company L.P..) - C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe
SR - | Auto 06/09/2012 197536 | (HPDrvMntSvc.exe) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
SR - | Demand 06/09/2012 1001376 | (hpqwmiex) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
SR - | Auto 05/03/2012 35200 | (HPWMISVC) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
SR - | Auto 27/12/2010 1817088 | (IconMan_R) . (.Realsil Microelectronics Inc..) - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
SR - | Auto 16/08/2012 347120 | (InternetEverywhere_Service) . (...) - C:\Program Files (x86)\InternetEverywhere\InternetEverywhere_Service.exe
SS - | Demand 30/07/2013 117656 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SR - | Auto 02/10/2012 3064000 | (Skype C2C Service) . (.Skype Technologies S.A..) - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
SS - | Auto 08/01/2013 161536 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SR - | Auto 26/09/2013 32256 | (SrvUpdater) . (...) - C:\Program Files (x86)\SoftwareUpdater\UpdaterService.exe =>PUP.Eorezo
SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SS - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 01mn 38s
---\\ Scan Additionnel (O88)
Database Version : 12946 - (13/10/2013)
Cl�s trouv�es (Keys found) : 180
Valeurs trouv�es (Values found) : 4
Dossiers trouv�s (Folders found) : 21
Fichiers trouv�s (Files found) : 32
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3543619C-D563-43F7-95EA-4DA7E1CC396A}] =>PUP.Onekit^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}] =>Toolbar.DeltaSearch^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E87806B5-E908-45FD-AF5E-957D83E58E68}] =>Toolbar.Conduit^
[HKLM\SYSTEM\CurrentControlSet\Services\BitGuard] =>PUP.BitGuard^
[HKLM\SYSTEM\CurrentControlSet\Services\SrvUpdater] =>PUP.Eorezo^
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}] =>Toolbar.Ask^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}] =>PUP.BitGuard^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\delta] =>Toolbar.DeltaSearch^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}] =>Adware.WebCake^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\okitspace] =>PUP.Onekit^
[HKLM\Software\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}] =>Toolbar.Babylon
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9}] =>Toolbar.Babylon
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}] =>Toolbar.Babylon
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}] =>Toolbar.Babylon
[HKLM\Software\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}] =>Toolbar.Babylon
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype
[HKLM\Software\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype
[HKLM\Software\Microsoft\Internet Explorer\extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}] =>Adware.Bandoo
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}] =>Adware.Bandoo
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}] =>Adware.Bandoo
[HKLM\Software\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}] =>PUP.Software.Updater
[HKLM\Software\Wow6432Node\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}] =>PUP.Software.Updater
[HKLM\Software\Classes\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476}] =>PUP.Software.Updater
[HKLM\Software\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}] =>Toolbar.Babylon
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKLM\Software\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKLM\Software\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}] =>Adware.CDNHelper
[HKLM\Software\Wow6432Node\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}] =>Adware.CDNHelper
[HKLM\Software\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}] =>Toolbar.Babylon
[HKLM\Software\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}] =>Toolbar.Babylon
[HKLM\Software\Classes\Interface\{EFDCAF05-D29C-4D4D-9836-8CDCD606A6B2}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\Interface\{EFDCAF05-D29C-4D4D-9836-8CDCD606A6B2}] =>Toolbar.Babylon
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}] =>Toolbar.ZoneAlarm
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}] =>Toolbar.ZoneAlarm
[HKLM\Software\Classes\AppID\escort.dll] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\escortapp.dll] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\escorteng.dll] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\esrv.EXE] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASMANCS] =>Toolbar.Bing
[HKLM\Software\Classes\escort.escortIEPane] =>PUP.Funmoods
[HKLM\Software\Classes\escort.escortIEPane.1] =>PUP.Funmoods
[HKLM\Software\Classes\S] =>Toolbar.Agent
[HKLM\Software\Classes\Updater.AmiUpd] =>PUP.Software.Updater
[HKLM\Software\Classes\Updater.AmiUpd.1] =>PUP.Software.Updater
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater] =>Toolbar.Ask
[HKCU\Software\DataMngr] =>Adware.Bandoo
[HKLM\Software\DataMngr] =>Adware.Bandoo
[HKLM\Software\Wow6432Node\DataMngr] =>Adware.Bandoo
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Softonic] =>Toolbar.Conduit
[HKCU\Software\SpeedMaxPc] =>PUP.SpeedMaxPc
[HKLM\Software\Wow6432Node\SpeedMaxPc] =>PUP.SpeedMaxPc
[HKLM\Software\Tarma Installer] =>PUP.Tarma
[HKLM\Software\Wow6432Node\Microsoft\Tracing\Babylon_RASAPI32] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Tracing\Babylon_RASMANCS] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Tracing\MyBabylontb_RASAPI32] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Tracing\MyBabylontb_RASMANCS] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Tracing\SearchquMediaBar_RASAPI32] =>Adware.Bandoo
[HKLM\Software\Wow6432Node\Microsoft\Tracing\SearchquMediaBar_RASMANCS] =>Adware.Bandoo
[HKLM\Software\Wow6432Node\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32] =>Adware.Bandoo
[HKLM\Software\Wow6432Node\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS] =>Adware.Bandoo
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96}] =>PUP.Software.Updater
[HKLM\Software\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}] =>Toolbar.Conduit
[HKLM\Software\Classes\AppID\{B15F118E-AF21-45E8-A809-29FDD7362565}] =>PUP.Funmoods
[HKLM\Software\Classes\TypeLib\{B15F118E-AF21-45E8-A809-29FDD7362565}] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\{B15F118E-AF21-45E8-A809-29FDD7362565}] =>PUP.Funmoods
[HKLM\Software\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}] =>PUP.Funmoods
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}] =>Toolbar.Conduit
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9CF034EA-7B46-48D3-8895-8A14B32AE445}] =>Toolbar.Conduit
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}] =>Toolbar.DeltaSearch
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}] =>Toolbar.Conduit
[HKLM\Software\Classes\TypeLib\{11D9E165-B8C1-4734-A56C-BC4FCACA966B}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\softonic] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm Security Toolbar] =>Toolbar.ZoneAlarm
[HKLM\Software\Classes\Prod.cap] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASAPI32] =>Toolbar.Bing
[HKLM\Software\Wow6432Node\VBMZ] =>Toolbar.Conduit
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings] =>PUP.BProtector
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{82E1477C-B154-48D3-9891-33D83C26BCD3}] =>PUP.Funmoods
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{82E1477C-B154-48D3-9891-33D83C26BCD3}] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85}] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D}] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\TypeLib\{4599D05A-D545-4069-BB42-5895B4EAE05B}] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\delta.deltaappCore] =>PUP.Funmoods
[HKLM\Software\Classes\delta.deltaappCore.1] =>PUP.Funmoods
[HKLM\Software\Classes\delta.deltadskBnd] =>PUP.Funmoods
[HKLM\Software\Classes\delta.deltadskBnd.1] =>PUP.Funmoods
[HKLM\Software\Classes\ScriptHost.Tool.1] =>Toolbar.Agent
[HKLM\Software\Classes\ScriptHost.Tool] =>Toolbar.Agent
[HKLM\Software\Classes\TypeLib\{5C9A2304-70A5-11D5-AFB0-0050DAC67890}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{C3F058A9-407D-4CD1-8F66-B75605B54B69}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{C3F058A9-407D-4CD1-8F66-B75605B54B69}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{8911483C-C00A-4183-9FBC-6C9C00946C15}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{8911483C-C00A-4183-9FBC-6C9C00946C15}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{5C9A230D-70A5-11D5-AFB0-0050DAC67890}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{5C9A230D-70A5-11D5-AFB0-0050DAC67890}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{0BF91075-F457-4A8B-99EF-140B52D2F22A}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{0BF91075-F457-4A8B-99EF-140B52D2F22A}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{37425600-CB21-49A0-8659-476FBAB0F8E8}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{37425600-CB21-49A0-8659-476FBAB0F8E8}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{431FB0E5-2CBB-4602-9FE6-F1D64488ADD7}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{431FB0E5-2CBB-4602-9FE6-F1D64488ADD7}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Google\Chrome\Extensions\dppahnkclbmppnmcoifolpjmeppoakfb] =>PUP.Facemoi
[HKLM\Software\Classes\AppID\{6536801B-F50C-449B-9476-093DFD3789E3}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{6536801B-F50C-449B-9476-093DFD3789E3}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\SoftwareUpdater] =>Hijacker.Eazel
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdater] =>Hijacker.Eazel
[HKLM\Software\Classes\AppID\BabylonHelper.EXE] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Google\Chrome\Extensions\fjoijdanhaiflhibkljeklcghcmmfffh] =>Adware.WebCake
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}] =>Toolbar.Yahoo
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}] =>Toolbar.Yahoo
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}] =>Toolbar.Yahoo
[HKLM\Software\Wow6432Node\Microsoft\Tracing\WebCakeDesktop_RASAPI32] =>Adware.WebCake
[HKLM\Software\Wow6432Node\Microsoft\Tracing\WebCakeDesktop_RASMANCS] =>Adware.WebCake
[HKLM\Software\Classes\delta.deltaHlpr] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\delta.deltaHlpr.1] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\esrv.deltaESrvc] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\esrv.deltaESrvc.1] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\AppID\escorTlbr.DLL] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\delta.deltaappCore] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\delta.deltaappCore.1] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\delta.deltadskBnd] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\delta.deltadskBnd.1] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\delta.deltaHlpr] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\delta.deltaHlpr.1] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\esrv.deltaESrvc] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\esrv.deltaESrvc.1] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\escort.escortIEPane] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\escort.escortIEPane.1] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\escort.DLL] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\escortApp.DLL] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\escortEng.DLL] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\escorTlbr.DLL] =>PUP.Funmoods
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{2318C2B1-4965-11d4-9B18-009027A5CD4F} =>Toolbar.Google^
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:GM4IE =>PUP.Facemoi^
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:Facemoi =>PUP.Facemoi^
[HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]:{D4027C7F-154A-4066-A1AD-4243D8127440} =>Toolbar.Avira
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\ffxtlbr@delta.com =>Toolbar.DeltaSearch^
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\plugin@getwebcake.com =>Adware.WebCake^
C:\Program Files (x86)\MyPC Backup =>PUP.MyPCBackup^
C:\Program Files (x86)\Softonic =>Toolbar.Conduit^
C:\Program Files (x86)\Common Files\SpeedMaxPc =>PUP.SpeedMaxPc^
C:\ProgramData\Babylon =>Toolbar.Babylon^
C:\ProgramData\BitGuard =>PUP.BitGuard^
C:\ProgramData\Media Get LLC =>PUP.MediaGet^
C:\ProgramData\SpeedMaxPc =>PUP.SpeedMaxPc^
C:\ProgramData\Tarma Installer =>PUP.Tarma^
C:\Users\Eddy Zakri\AppData\Roaming\BabSolution =>Hijacker.BabSolution^
C:\Users\Eddy Zakri\AppData\Roaming\Babylon =>Toolbar.Babylon^
C:\Users\Eddy Zakri\AppData\Roaming\okitspace =>PUP.Onekit^
C:\Users\Eddy Zakri\AppData\Roaming\Softonic =>Toolbar.Conduit^
C:\Users\Eddy Zakri\AppData\Roaming\SpeedMaxPc =>PUP.SpeedMaxPc^
C:\Users\Eddy Zakri\AppData\Local\SwvUpdater =>PUP.Software.Updater^
C:\Users\Eddy Zakri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard =>PUP.BitGuard^
C:\Users\Eddy Zakri\AppData\Local\RavenBleuSA =>Adware.Gabpath
C:\Users\Eddy Zakri\AppData\LocalLow\BabylonToolbar =>Toolbar.Babylon
C:\Users\Eddy Zakri\AppData\Local\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde =>Toolbar.DeltaSearch
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\Extensions\ffxtlbr@delta.com =>PUP.Funmoods
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\bprotector_extensions.sqlite =>PUP.BProtector
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\bprotector_prefs.js =>PUP.BProtector
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\SearchPlugins\zonealarm.xml =>Toolbar.ZoneAlarm
C:\ProgramData\BitGuard\2.6.1694.246\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe =>PUP.BitGuard^
C:\Facemoi\facemoi.exe =>PUP.Facemoi^
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\searchplugins\babylon.xml =>Toolbar.Babylon^
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\searchplugins\delta.xml =>Toolbar.DeltaSearch^
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\searchplugins\softonic.xml =>Toolbar.Conduit^
C:\Users\Eddy Zakri\AppData\Roaming\okitspace\IE\OKitSpace.dll =>PUP.Onekit^
C:\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll =>Toolbar.DeltaSearch^
C:\Program Files (x86)\Softonic\Softonic\1.8.19.3\bh\Softonic.dll =>Toolbar.Conduit^
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll =>Toolbar.Google^
c:\Facemoi\facemoi.exe =>PUP.Facemoi^
C:\Program Files (x86)\SoftwareUpdater\UpdaterService.exe =>PUP.Eorezo^
C:\Windows\Tasks\AmiUpdXp.job =>PUP.Software.Updater^
C:\Windows\Tasks\SpeedMaxPc Registration3.job =>PUP.SpeedMaxPc^
C:\Windows\Tasks\SpeedMaxPc Update3.job =>PUP.SpeedMaxPc^
C:\Windows\Tasks\SpeedMaxPc.job =>PUP.SpeedMaxPc^
C:\Users\Eddy Zakri\AppData\Local\SwvUpdater\Updater.exe =>PUP.Software.Updater^
C:\Users\Eddy Zakri\AppData\Roaming\BabSolution\Shared\BabMaint.exe =>Hijacker.BabSolution^
C:\Program Files (x86)\Common Files\SpeedMaxPc\UUS3\Update3.exe =>PUP.SpeedMaxPc^
[HKCU\Software\BabSolution] =>Hijacker.BabSolution^
[HKCU\Software\Babylon] =>Toolbar.Babylon^
[HKCU\Software\Conduit] =>Toolbar.Conduit^
[HKCU\Software\DataMngr_Toolbar] =>PUP.Datamngr^
[HKCU\Software\Datamngr] =>PUP.Datamngr^
[HKCU\Software\Media Get LLC] =>PUP.MediaGet^
[HKLM\Software\Wow6432Node\Babylon] =>Toolbar.Babylon^
[HKLM\Software\Wow6432Node\Conduit] =>Toolbar.Conduit^
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:dllName="BrowserDefender.dll" =>Hijacker.Eazel^
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:dllName="BrowserDefender.dll" =>Hijacker.Eazel^
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:dllName="BitGuard.dll" =>PUP.BitGuard^
~ Additionnel Scan: 303036 Items scanned in 04mn 52s
---\\ R�capitulatif des d�tections trouv�es sur votre station
~ http://nicolascoolman.webs.com/apps/blog/show/32979753-pup-bitguard =>PUP.BitGuard
~ http://nicolascoolman.webs.com/apps/blog/show/28426583-pup-facemoi =>PUP.Facemoi
~ http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon =>Toolbar.Babylon
~ http://nicolascoolman.webs.com/apps/blog/show/27875657-toolbar-deltasearch =>Toolbar.DeltaSearch
~ http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit
~ http://nicolascoolman.webs.com/apps/blog/show/27285539-adware-webcake =>Adware.WebCake
~ http://nicolascoolman.webs.com/apps/blog/show/33456961-pup-onekit =>PUP.OneKit
~ http://nicolascoolman.webs.com/apps/blog/show/32384220-toolbar-google =>Toolbar.Google
~ http://nicolascoolman.webs.com/apps/blog/show/27469224-pup-eorezo =>PUP.EoRezo
~ http://nicolascoolman.webs.com/apps/blog/show/32713686-pup-software-updater =>PUP.Software.Updater
~ http://nicolascoolman.webs.com/apps/blog/show/28947219-pup-speedmaxpc =>PUP.SpeedMaxPc
~ http://nicolascoolman.webs.com/apps/blog/show/26678994-hijacker-babsolution =>Hijacker.BabSolution
~ http://nicolascoolman.webs.com/apps/blog/show/28927746-toolbar-ask =>Toolbar.Ask
~ http://nicolascoolman.webs.com/apps/blog/show/27583992-pup-datamngr =>PUP.Datamngr
~ http://nicolascoolman.webs.com/apps/blog/show/28151468-pup-mediaget =>PUP.MediaGet
~ http://nicolascoolman.webs.com/apps/blog/show/29637859-toolbar-tarma =>PUP.Tarma
~ http://nicolascoolman.webs.com/apps/blog/show/32174815-pup-mypcbackup =>PUP.MyPCBackup
~ http://nicolascoolman.webs.com/apps/blog/show/30319724-pup-searchresults =>PUP.SearchResults
~ http://nicolascoolman.webs.com/apps/blog/show/26684723-adware-imbooster =>Adware.IMBooster
~ http://nicolascoolman.webs.com/apps/blog/show/27161672-hijacker-eazel =>Hijacker.Eazel
~ http://nicolascoolman.webs.com/apps/blog/show/30898245-toolbar-skype =>Toolbar.Skype
~ http://nicolascoolman.webs.com/apps/blog/show/26611092-adware-bandoo =>Adware.Bandoo
~ http://nicolascoolman.webs.com/apps/blog/show/31536787-toolbar-bing =>Toolbar.Bing
~ http://nicolascoolman.webs.com/apps/blog/show/27630986-pup-funmoods =>PUP.Funmoods
~ http://nicolascoolman.webs.com/apps/blog/show/28133096-pup-bprotector =>PUP.BProtector
~ http://nicolascoolman.webs.com/apps/blog/show/30268689-toolbar-yahoo =>Toolbar.Yahoo
~ http://nicolascoolman.webs.com/apps/blog/show/28419247-toolbar-avira =>Toolbar.Avira
~ http://nicolascoolman.webs.com/apps/blog/show/27254456-adware-gabpath =>Adware.Gabpath
~ MSI: 28 link(s) detected in 04mn 53s
~ 2077 Legitimates filtered by white list
End of the scan (883 lines in 17mn 21s)(0)
~ Lanc� par Eddy Zakri (14/10/2013 09:47:23)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance � la d�sinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activ�e par le programme
~ El�vation des Privil�ges : OK
~ User Account Control (UAC): Activate by user
---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16686
MFIE: Mozilla Firefox 23.0
GCIE: Google Chrome v30.0.1599.69 (Defaut)
---\\ Informations sur les produits Windows
~ Langage: Fran�ais
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
---\\ Logiciels de protection du syst�me
Microsoft Security Client v4.3.0215.0
ZoneAlarm Free Firewall v11.0.768.000
ZoneAlarm Security Toolbar v1.8.22.0 =>Toolbar.ZoneAlarm
Windows Defender W7
---\\ Logiciels d'optimisation du syst�me
CCleaner v4.01 =>Piriform Ltd
---\\ Logiciels de partage PeerToPeer
�Torrent v3.3.0.29126 =>P2P.�Torrent
---\\ Surveillance de Logiciels
Adobe Flash Player 11 Plugin
Adobe Reader X
---\\ Informations sur le syst�me
~ Processor: AMD64 Family 20 Model 2 Stepping 0, AuthenticAMD
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1642 MB (24% free)
System Restore: Activ� (Enable)
System drive C: has 118 GB (42%) free of 279 GB
---\\ Mode de connexion au syst�me
~ Computer Name: EDDIEZAKRI-HP
~ User Name: Eddy Zakri
~ All Users Names: Eddy Zakri, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\Eddy Zakri\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Eddy Zakri\AppData\Roaming\
~ %Desktop% : C:\Users\Eddy Zakri\Desktop\
~ %Favorites% : C:\Users\Eddy Zakri\Favorites\
~ %LocalAppData% : C:\Users\Eddy Zakri\AppData\Local\
~ %StartMenu% : C:\Users\Eddy Zakri\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enum�ration des unit�s disques
C: Hard drive, Flash drive, Thumb drive (Free 118 Go of 279 Go)
D: Hard drive, Flash drive, Thumb drive (Free 2 Go of 15 Go)
E: Hard drive, Flash drive, Thumb drive (Free 1 Go of 4 Go)
F: CD-ROM drive (Not Inserted)
G: CD-ROM drive (Not Inserted)
I: CD-ROM drive (Not Inserted)
Q: Hard drive, Flash drive, Thumb drive (Free 0 Go of 0 Go)
---\\ Etat du Centre de S�curit� Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: 33 Legitimates Filtered in 00mn 00s
---\\ Recherche particuli�re de fichiers g�n�riques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.09/08/2011 - 20:34:59.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de d�marrage de Windows.) (.14/07/2009 - 01:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.AAFA952E774DDDB0956D3BDFAE5B5B99] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.10/08/2013 - 05:22:18.) -- C:\Windows\System32\wininet.dll [2241024]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d�ouverture de session Windows.) (.21/11/2010 - 03:24:29.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Biblioth�que de licences.) (.21/11/2010 - 03:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.1C7857B62DE5994A75B054A9FD4C3825] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/12/2011 - 03:59:24.) -- C:\Windows\system32\Drivers\AFD.sys [498688]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 01:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 23:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 03:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 03:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 03:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.13/07/2009 - 23:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 00:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.09/08/2011 - 20:39:20.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 03:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du syst�me de fichiers NT.) (.12/04/2013 - 14:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parall�le.) (.14/07/2009 - 00:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 03:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 00:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 03:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de clich� instantan� du volume.) (.21/11/2010 - 03:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 02s
---\\ Etat des fichiers cach�s (Cach�/Total)
~ Mes images (My Pictures) : 1/279
~ Mes musiques (My Musics) : 11/2331
~ Mes Videos (My Videos) : 1/2141
~ Mes Favoris (My Favorites) : 1/8
~ Mes Documents (My Documents) : 11/4641
~ Mon Bureau (My Desktop) : 11/92
~ Menu demarrer (Programs) : 1/65
~ Hidden Files: Scanned in 00mn 49s
---\\ Processus lanc�s
[MD5.97A57AEA49E0EC9D17BDD96A3CEEBEBC] - (...) -- C:\ProgramData\BitGuard\2.6.1694.246\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe [3032032] [PID.1860] =>PUP.BitGuard
[MD5.497F27E279C0F921E2130BB89C1CB5CA] - (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe [18705664] [PID.2716]
[MD5.226B7F3D5029B40BA3D3ECF04FBD32A6] - (.Pas de propri�taire - FM Application.) -- C:\Facemoi\facemoi.exe [82944] [PID.2984] =>PUP.Facemoi
[MD5.2781C31D26F39FCFF05A290120210A4F] - (...) -- C:\Program Files (x86)\InternetEverywhere\InternetEverywhere_Launcher.exe [637936] [PID.1180]
[MD5.A16852B04C0A5654B0B8DFD5E1A25718] - (.MagicISO, Inc. - MagicISO Virtual CD/DVD Manager.) -- C:\Program Files (x86)\MagicDisc\MagicDisc.exe [576000] [PID.3180]
[MD5.8192B2E274607D1D530F5C191698C544] - (.Hewlett-Packard Development Company, L.P. - HP Message Service.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944] [PID.3408]
[MD5.B7F55E2AE978D3D34F7876EE5D689AAE] - (.CyberLink - YouCam Mirage.) -- C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [136488] [PID.3588]
[MD5.A25F011CACB68FE3F8FC74A4FA7C8D7F] - (.Abine Inc. - ZoneAlarm Do Not Track Me Service.) -- C:\Program Files (x86)\Check Point Software Technologies LTD\zonealarm\AbineSDK\IE\DNTPService.exe [297336] [PID.1332]
[MD5.5397E32E882C0148CEC13D9EACFB7157] - (.Microsoft Corporation - Internet Low-Mic Utility Tool.) -- C:\Program Files (x86)\Internet Explorer\IELowutil.exe [222208] [PID.316]
[MD5.37287D98A1BF5D56AA729CEB9B27C6B1] - (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\IEXPLORE.exe [770648] [PID.4388]
[MD5.2176B4590387405E5F2405C3CEF0C02A] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8078848] [PID.1940]
~ Processes Running: Scanned in 00mn 03s
---\\ Google Chrome, D�marrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Eddy Zakri\AppData\Local\Google\Chrome\User Data\Default\Preferences
~ Google Browser: 0 Legitimates Filtered in 00mn 00s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\prefs.js
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\user.js
M3 - MFPP: Plugins - [Eddy Zakri] -- C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\searchplugins\babylon.xml =>Toolbar.Babylon
M3 - MFPP: Plugins - [Eddy Zakri] -- C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\searchplugins\delta.xml =>Toolbar.DeltaSearch
M3 - MFPP: Plugins - [Eddy Zakri] -- C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\searchplugins\softonic.xml =>Toolbar.Conduit
M3 - MFPP: Plugins - [Eddy Zakri] -- C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\searchplugins\zonealarm.xml
M2 - MFEP: prefs.js [Eddy Zakri - xhe9vf9l.default\ffxtlbr@delta.com] [] Delta Toolbar v1.5.0 (..) =>Toolbar.DeltaSearch
M2 - MFEP: prefs.js [Eddy Zakri - xhe9vf9l.default\plugin@getwebcake.com] [] WebCake v1.00.01 (..) =>Adware.WebCake
~ Firefox Browser: 10 Legitimates Filtered in 00mn 01s
---\\ Internet Explorer, D�marrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs,Tabs = http://search.softonic.com =>Toolbar.Conduit
~ IE Browser: 16 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21
---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: OKitSpace [64Bits] - {3543619C-D563-43f7-95EA-4DA7E1CC396A} . (...) -- C:\Users\Eddy Zakri\AppData\Roaming\okitspace\IE\OKitSpace.dll =>PUP.Onekit
O2 - BHO: delta Helper Object [64Bits] - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} . (.Delta-search.com - Pas de description.) -- C:\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll =>Toolbar.DeltaSearch
O2 - BHO: Softonic Helper Object [64Bits] - {E87806B5-E908-45FD-AF5E-957D83E58E68} . (.Softonic.com - Pas de description.) -- C:\Program Files (x86)\Softonic\Softonic\1.8.19.3\bh\Softonic.dll =>Toolbar.Conduit
O2 - BHO: (no name) [64Bits] - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} Cl� orpheline
~ BHO: 14 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: Google Toolbar [64Bits] - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll =>Toolbar.Google
O3 - Toolbar\WebBrowser: (no name) [64Bits] - [HKCU]{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} Cl� orpheline
O3 - Toolbar\WebBrowser: (no name) [64Bits] - [HKCU]{D4027C7F-154A-4066-A1AD-4243D8127440} Cl� orpheline
~ Toolbar: Scanned in 00mn 00s
---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Dictionnaire le Littr�.lnk . (...) -- C:\Program Files (x86)\Dictionnaire le Littr� 2.0\Littre.exe
O4 - GS\Desktop [Public]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [Public]: HP Support Assistant.lnk . (.Hewlett-Packard Company - HP Support Assistant.) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe =>.Hewlett-Packard Co
O4 - GS\Desktop [Public]: Internet Everywhere.lnk . (...) -- C:\Program Files (x86)\InternetEverywhere\InternetEverywhere.exe
O4 - GS\Desktop [Public]: MobaMotiv.lnk . (.Mobatek - http://www.mobatek.net - MobaMotiv.) -- C:\Program Files (x86)\MobaMotiv\MobaMotiv.exe
O4 - GS\Desktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Desktop [Public]: WiMAX Connection Manager.lnk . (.HUAWEI - WiMAX Connection Manager.) -- C:\Program Files (x86)\WiMAX Connection Manager\WiMAX Connection Manager.exe
O4 - GS\Desktop [Public]: �Torrent.lnk . (.BitTorrent Inc. - �Torrent.) -- C:\Users\Eddy Zakri\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\QuickLaunch [Eddy Zakri]: Amazing Pyramids.lnk . (...) -- C:\Program Files (x86)\MyPlayCity.com\Amazing Pyramids\Amazing Pyramids.exe (.not file.)
O4 - GS\QuickLaunch [Eddy Zakri]: BitTorrent.lnk . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Eddy Zakri\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent
O4 - GS\QuickLaunch [Eddy Zakri]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Eddy Zakri]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch [Eddy Zakri]: �Torrent.lnk . (.BitTorrent Inc. - �Torrent.) -- C:\Users\Eddy Zakri\AppData\Roaming\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\TaskBar [Eddy Zakri]: doPDF.lnk . (.Softland - doPDF Start Application.) -- C:\Program Files\Softland\doPDF 7\dopdf.exe
O4 - GS\Program [Eddy Zakri]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [Eddy Zakri]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SendTo [Eddy Zakri]: Evernote.lnk . (.Evernote Corp., 333 W Evelyn Ave. Mountain - Evernote.) -- C:\Program Files (x86)\Evernote\Evernote\Evernote.exe
O4 - GS\Desktop [Eddy Zakri]: 7zFM - Raccourci.lnk . (.Igor Pavlov - 7-Zip File Manager.) -- C:\Program Files (x86)\7-Zip\7zFM.exe
O4 - GS\Desktop [Eddy Zakri]: BitTorrent.lnk . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Eddy Zakri\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent
O4 - GS\Desktop [Eddy Zakri]: CVitae V4.lnk . (...) -- C:\Program Files (x86)\CVitaeV4\CVitae.exe
O4 - GS\Desktop [Eddy Zakri]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Eddy Zakri]: Le Grand Robert.lnk . (.Bureau Van Dijk � Dictionnaires Le Robert - Le Grand Robert de la langue fran�aise.) -- C:\Program Files (x86)\Le Grand Robert\grwin.exe
O4 - GS\Desktop [Eddy Zakri]: Speed - Raccourci.lnk . (...) -- C:\Users\Eddy Zakri\Videos\JEUX\Need for speed mw\Need for Speed Most Wanted\Speed.exe
O4 - GS\Desktop [Eddy Zakri]: Windows Update.lnk . (.Microsoft Corporation - Windows Update Application Launcher.) -- C:\Windows\system32\wuapp.exe
~ Global Startup: 88 Legitimates Filtered in 00mn 57s
---\\ Applications lanc�es au d�marrage du syt�me (O4)
O4 - GS\Startup [Public]: Launcher.lnk . (...) -- C:\Program Files (x86)\InternetEverywhere\InternetEverywhere_Launcher.exe
O4 - GS\Startup [Eddy Zakri]: MagicDisc.lnk . (.MagicISO, Inc. - MagicISO Virtual CD/DVD Manager.) -- C:\Program Files (x86)\MagicDisc\MagicDisc.exe
O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe =>.Realtek Semiconductor Corp
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe (.not file.)
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKCU\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
O4 - HKCU\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe =>.Skype Technologies S.A.
O4 - HKCU\..\Run: [GM4IE] . (.Pas de propri�taire - FM Application.) -- C:\Facemoi\facemoi.exe =>PUP.Facemoi
O4 - HKCU\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe =>.DT Soft Ltd
O4 - HKCU\..\Run: [ares mod] C:\Program Files (x86)\AresMod\AresMod.exe (.not file.)
O4 - HKLM\..\Wow6432Node\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst� Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe =>.Advanced Micro Devices, Inc
O4 - HKLM\..\Wow6432Node\Run: [HPConnectionManager] . (.Hewlett-Packard Development Company L.P. - HPCMDelayStart Application.) -- C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [Facemoi] . (.Pas de propri�taire - FM Application.) -- c:\Facemoi\facemoi.exe =>PUP.Facemoi
O4 - HKLM\..\Wow6432Node\Run: [HP Quick Launch] . (.Hewlett-Packard Development Company, L.P. - HP Message Service.) -- C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2116176242-1592332739-549678488-1001\..\Run: [msnmsgr] . (.Microsoft Corporation - Windows Live Messenger.) -- C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
O4 - HKUS\S-1-5-21-2116176242-1592332739-549678488-1001\..\Run: [Skype] . (.Skype Technologies S.A. - Skype.) -- C:\Program Files (x86)\Skype\Phone\Skype.exe =>.Skype Technologies S.A.
O4 - HKUS\S-1-5-21-2116176242-1592332739-549678488-1001\..\Run: [GM4IE] . (.Pas de propri�taire - FM Application.) -- C:\Facemoi\facemoi.exe =>PUP.Facemoi
O4 - HKUS\S-1-5-21-2116176242-1592332739-549678488-1001\..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe =>.DT Soft Ltd
O4 - HKUS\S-1-5-21-2116176242-1592332739-549678488-1001\..\Run: [ares mod] C:\Program Files (x86)\AresMod\AresMod.exe (.not file.)
~ Application: Scanned in 00mn 00s
---\\ Boutons situ�s sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Skype Click to Call [64Bits] - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- c:\program files (x86)\skype\toolbars\internet explorer x64\icon.ico
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{0CA06509-E16A-4A8F-A131-518BC880B0EF}: DhcpNameServer = 41.206.65.1 213.136.109.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{85B64B98-FE35-44DF-9679-A46602EDBD80}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{B8AC1FC4-5E19-4932-AD4B-C881C93122AD}: DhcpNameServer = 213.136.96.157 213.136.96.37
O17 - HKLM\System\CCS\Services\Tcpip\..\{D2729A2E-A0FC-48F5-A571-61250EB4C284}: DhcpNameServer = 213.136.109.2 41.206.65.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{0CA06509-E16A-4A8F-A131-518BC880B0EF}: DhcpDomain = mtn.ci
O17 - HKLM\System\CCS\Services\Tcpip\..\{D2729A2E-A0FC-48F5-A571-61250EB4C284}: DhcpDomain = mtn.ci
O17 - HKLM\System\CS1\Services\Tcpip\..\{0CA06509-E16A-4A8F-A131-518BC880B0EF}: DhcpNameServer = 41.206.65.1 213.136.109.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{85B64B98-FE35-44DF-9679-A46602EDBD80}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{B8AC1FC4-5E19-4932-AD4B-C881C93122AD}: DhcpNameServer = 213.136.96.157 213.136.96.37
O17 - HKLM\System\CS1\Services\Tcpip\..\{D2729A2E-A0FC-48F5-A571-61250EB4C284}: DhcpNameServer = 213.136.109.2 41.206.65.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{0CA06509-E16A-4A8F-A131-518BC880B0EF}: DhcpDomain = mtn.ci
O17 - HKLM\System\CS1\Services\Tcpip\..\{D2729A2E-A0FC-48F5-A571-61250EB4C284}: DhcpDomain = mtn.ci
O17 - HKLM\System\CS2\Services\Tcpip\..\{0CA06509-E16A-4A8F-A131-518BC880B0EF}: DhcpNameServer = 41.206.65.1 213.136.109.2
O17 - HKLM\System\CS2\Services\Tcpip\..\{85B64B98-FE35-44DF-9679-A46602EDBD80}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{B8AC1FC4-5E19-4932-AD4B-C881C93122AD}: DhcpNameServer = 213.136.96.157 213.136.96.37
O17 - HKLM\System\CS2\Services\Tcpip\..\{D2729A2E-A0FC-48F5-A571-61250EB4C284}: DhcpNameServer = 213.136.109.2 41.206.65.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{0CA06509-E16A-4A8F-A131-518BC880B0EF}: DhcpDomain = mtn.ci
O17 - HKLM\System\CS2\Services\Tcpip\..\{D2729A2E-A0FC-48F5-A571-61250EB4C284}: DhcpDomain = mtn.ci
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s
---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ Liste des services NT non Microsoft et non d�sactiv�s (O23)
O23 - Service: BitGuard (BitGuard) . (...) - C:\ProgramData\BitGuard\2.6.1694.246\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe =>PUP.BitGuard
O23 - Service: Software Updater (SrvUpdater) . (.Pas de propri�taire - Updater.) - C:\Program Files (x86)\SoftwareUpdater\UpdaterService.exe =>PUP.Eorezo
~ Services: 15 Legitimates Filtered in 01mn 30s
---\\ T�ches planifi�es en automatique (O39)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\AmiUpdXp.job [376] =>PUP.Software.Updater
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\SpeedMaxPc Registration3.job [474] =>PUP.SpeedMaxPc
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\SpeedMaxPc Update3.job [432] =>PUP.SpeedMaxPc
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\SpeedMaxPc.job [410] =>PUP.SpeedMaxPc
[MD5.1C446DC37F6BA32799F5881D06488C3F] [APT] [AmiUpdXp] (.Amonetize ltd..) -- C:\Users\Eddy Zakri\AppData\Local\SwvUpdater\Updater.exe [307240] =>PUP.Software.Updater
[MD5.71D490C463014E4FB88B8CBA700B111E] [APT] [EPUpdater] (...) -- C:\Users\Eddy Zakri\AppData\Roaming\BabSolution\Shared\BabMaint.exe [4608] =>Hijacker.BabSolution
[MD5.00000000000000000000000000000000] [APT] [Go for FilesUpdate] (...) -- C:\Program Files (x86)\GoforFiles\GFFUpdater.exe (.not file.) [0] =>P2P.GoforFiles
[MD5.00000000000000000000000000000000] [APT] [SpeedMaxPc] (...) -- C:\Program Files (x86)\SpeedMaxPc\SpeedMaxPc\SpeedMaxPc.exe (.not file.) [0] =>PUP.SpeedMaxPc
[MD5.35DD2A44BA05F0D447520BB265E91810] [APT] [SpeedMaxPc Update3] (.SpeedMaxPc.) -- C:\Program Files (x86)\Common Files\SpeedMaxPc\UUS3\Update3.exe [654336] =>PUP.SpeedMaxPc
[MD5.00000000000000000000000000000000] [APT] [{79D44C1D-B978-4460-947A-026FE3243B51}] (...) -- C:\Users\Eddy Zakri\Downloads\Programs et Logiciels\avira_antivir_personal_en.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{7DF8493D-C336-4F3B-96FA-0F86FFDDA649}] (...) -- C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\uninstbb.exe (.not file.) [0] =>Toolbar.Babylon
[MD5.00000000000000000000000000000000] [APT] [{8BDF8CEE-3D48-427B-8001-D480C570C399}] (...) -- C:\Users\Eddy Zakri\Documents\VIDEO\JEUX\The Thing\Setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{AA66B93D-9CD4-4A10-92B4-4FA1DEEE342C}] (...) -- C:\Users\Eddy Zakri\Downloads\Programs et Logiciels\PVMsetup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{AC3D07B1-8E16-4828-889C-646C5F37EBBE}] (...) -- C:\Users\Eddy Zakri\Desktop\JEUX\Luxor 2\luxor 2 crackfix.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{D598D2C9-F5E7-4200-9CBA-C6423EF932C9}] (...) -- C:\Program Files (x86)\Micro Application\Conduite 3D\Desinst.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{EF667C87-8630-415E-8E87-DEEC06397D09}] (...) -- C:\Users\Eddy Zakri\Desktop\JEUX\my game\BEACHHEAD2000\SETUP.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{F6207134-3B73-493C-A42F-11A8FC1ADAF2}] (...) -- C:\Users\Eddy Zakri\Desktop\ne98spst.exe (.not file.) [0]
~ Scheduled Task: 45 Legitimates Filtered in 00mn 27s
---\\ Logiciels install�s (O42)
O42 - Logiciel: Ask Toolbar Updater - (.Ask.com.) [HKCU][64Bits] -- {79A765E1-C399-405B-85AF-466F52E918B0} =>Toolbar.Ask
O42 - Logiciel: BitGuard - (.MediaTechSoft Inc..) [HKLM][64Bits] -- {15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693} =>PUP.BitGuard
O42 - Logiciel: Delta Force - Black Hawk Down - (...) [HKLM][64Bits] -- {8FE54D21-8254-4CCF-AEE0-066496AE43F4}
O42 - Logiciel: Delta toolbar - (.Delta.) [HKLM][64Bits] -- delta =>Toolbar.DeltaSearch
O42 - Logiciel: Prompt Downloader - (...) [HKLM][64Bits] -- Prompt Downloader
O42 - Logiciel: WebCake 3.00 - (.WebCake LLC.) [HKLM][64Bits] -- {C4ED781C-7394-4906-AAFF-D6AB64FF7C38} =>Adware.WebCake
O42 - Logiciel: okitspace - (...) [HKLM][64Bits] -- okitspace =>PUP.Onekit
~ Logic: 162 Legitimates Filtered in 00mn 04s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\9538ddfbc6fbf43]
[HKCU\Software\BabSolution] =>Hijacker.BabSolution
[HKCU\Software\Babylon] =>Toolbar.Babylon
[HKCU\Software\Conduit] =>Toolbar.Conduit
[HKCU\Software\DataMngr_Toolbar] =>PUP.Datamngr
[HKCU\Software\Datamngr] =>PUP.Datamngr
[HKCU\Software\Delta]
[HKCU\Software\Media Get LLC] =>PUP.MediaGet
[HKCU\Software\PluginAddon]
[HKCU\Software\Prompt Downloader]
[HKCU\Software\Safe Browser]
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKCU\Software\SpeedMaxPc] =>PUP.SpeedMaxPc
[HKCU\Software\Yahoo]
[HKCU\Software\abhisoft]
[HKLM\Software\DataMngr] =>PUP.Datamngr
[HKLM\Software\Tarma Installer] =>PUP.Tarma
[HKLM\Software\Wow6432Node\9538ddfbc6fbf43]
[HKLM\Software\Wow6432Node\Babylon] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Conduit] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\DataMngr] =>PUP.Datamngr
[HKLM\Software\Wow6432Node\Delta]
[HKLM\Software\Wow6432Node\MarineAquarium3Free_57EI]
[HKLM\Software\Wow6432Node\SpeedMaxPc] =>PUP.SpeedMaxPc
[HKLM\Software\Wow6432Node\VBMZ]
~ Key Software: 293 Legitimates Filtered in 00mn 04s
---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 10/10/2013 - 17:43:07 - [0,121] ----D C:\Program Files (x86)\AresMod
O43 - CFD: 20/07/2013 - 14:16:12 - [2,336] ----D C:\Program Files (x86)\Delta
O43 - CFD: 30/06/2013 - 09:28:35 - [0,015] ----D C:\Program Files (x86)\MyPC Backup =>PUP.MyPCBackup
O43 - CFD: 30/06/2013 - 06:58:44 - [22,228] ----D C:\Program Files (x86)\Prompt Downloader
O43 - CFD: 07/08/2013 - 10:45:23 - [2,258] ----D C:\Program Files (x86)\Softonic =>Toolbar.Conduit
O43 - CFD: 06/08/2013 - 11:36:27 - [5,983] ----D C:\Program Files (x86)\Yahoo!
O43 - CFD: 12/09/2012 - 15:52:14 - [1,600] ----D C:\Program Files (x86)\Common Files\SpeedMaxPc =>PUP.SpeedMaxPc
O43 - CFD: 20/07/2013 - 14:15:23 - [0] ----D C:\ProgramData\Babylon =>Toolbar.Babylon
O43 - CFD: 12/10/2013 - 13:02:48 - [8,444] ----D C:\ProgramData\BitGuard =>PUP.BitGuard
O43 - CFD: 11/09/2013 - 12:52:39 - [0] ----D C:\ProgramData\Media Get LLC =>PUP.MediaGet
O43 - CFD: 12/09/2012 - 15:52:14 - [0,019] ----D C:\ProgramData\SpeedMaxPc =>PUP.SpeedMaxPc
O43 - CFD: 30/06/2013 - 06:58:16 - [2,732] ----D C:\ProgramData\Tarma Installer =>PUP.Tarma
O43 - CFD: 06/08/2013 - 11:34:35 - [0,005] ----D C:\ProgramData\Yahoo!
O43 - CFD: 20/07/2013 - 14:16:25 - [1,662] ----D C:\Users\Eddy Zakri\AppData\Roaming\BabSolution =>Hijacker.BabSolution
O43 - CFD: 20/07/2013 - 14:15:20 - [0,011] ----D C:\Users\Eddy Zakri\AppData\Roaming\Babylon =>Toolbar.Babylon
O43 - CFD: 20/07/2013 - 14:16:08 - [0,259] ----D C:\Users\Eddy Zakri\AppData\Roaming\Delta
O43 - CFD: 22/09/2013 - 12:49:12 - [0,308] ----D C:\Users\Eddy Zakri\AppData\Roaming\File Scout
O43 - CFD: 10/10/2013 - 17:43:42 - [0,267] ----D C:\Users\Eddy Zakri\AppData\Roaming\okitspace =>PUP.Onekit
O43 - CFD: 07/08/2013 - 10:45:01 - [0,259] ----D C:\Users\Eddy Zakri\AppData\Roaming\Softonic =>Toolbar.Conduit
O43 - CFD: 02/08/2012 - 21:27:57 - [0] ----D C:\Users\Eddy Zakri\AppData\Roaming\SpeedMaxPc =>PUP.SpeedMaxPc
O43 - CFD: 05/08/2013 - 20:59:12 - [0,002] ----D C:\Users\Eddy Zakri\AppData\Roaming\Yahoo!
O43 - CFD: 25/09/2012 - 13:05:51 - [0,008] ----D C:\Users\Eddy Zakri\AppData\Roaming\{90140011-0066-040C-0000-0000000FF1CE}
O43 - CFD: 20/07/2013 - 14:15:29 - [0,018] ----D C:\Users\Eddy Zakri\AppData\Local\Ares Mod
O43 - CFD: 30/06/2013 - 06:58:44 - [0] ----D C:\Users\Eddy Zakri\AppData\Local\Prompt Downloader
O43 - CFD: 30/06/2013 - 06:57:47 - [0,295] ----D C:\Users\Eddy Zakri\AppData\Local\SwvUpdater =>PUP.Software.Updater
O43 - CFD: 12/10/2013 - 11:29:15 - [0,001] ----D C:\Users\Eddy Zakri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard =>PUP.BitGuard
O43 - CFD: 30/06/2013 - 06:58:44 - [0,002] ----D C:\Users\Eddy Zakri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Prompt Downloader
O43 - CFD: 11/09/2013 - 18:16:25 - [0,007] ----D C:\Users\Eddy Zakri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Video Related Programs
~ 746 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 1029 Legitimates Filtered in 04mn 36s
---\\ Derniers fichiers modifi�s ou cr�es sous Windows et System32 (O44)
O44 - LFC:[MD5.5A1906B623625C26FB70645ACA95BCF4] - 14/10/2013 - 09:52:50 --HA- . (...) -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [32064]
O44 - LFC:[MD5.5A1906B623625C26FB70645ACA95BCF4] - 14/10/2013 - 09:52:50 --HA- . (...) -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [32064]
O44 - LFC:[MD5.5A1906B623625C26FB70645ACA95BCF4] - 14/10/2013 - 09:52:50 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [32064]
O44 - LFC:[MD5.5A1906B623625C26FB70645ACA95BCF4] - 14/10/2013 - 09:52:50 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [32064]
~ Files: 23 Legitimates Filtered in 00mn 48s
---\\ Cl� de registre Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{04b37eca-0255-11e2-906c-2c768ae73fbe}\AutoRun\command. (...) -- G:\AutoRun.exe (.not file.)
O51 - MPSK:{495b37f8-3ac4-11e2-b8b9-2c768ae73fbe}\AutoRun\command. (...) -- G:\.\Setup.exe (.not file.)
O51 - MPSK:{7e0f21eb-4901-11e2-bbff-2c768ae73fbe}\AutoRun\command. (...) -- G:\Setup.exe (.not file.)
O51 - MPSK:{7f601ac8-2257-11e2-9f31-2c768ae73fbe}\AutoRun\command. (...) -- G:\.\Setup.exe (.not file.)
O51 - MPSK:{9ce2fb93-2904-11e3-85bc-2c768ae73fbe}\AutoRun\command. (...) -- H:\iStudio.exe (.not file.)
O51 - MPSK:{a57d510c-9c0d-11e1-ad32-2c768ae73fbe}\AutoRun\command. (...) -- I:\autorun\autorun.exe (.not file.)
~ Keys: Scanned in 00mn 00s
---\\ Enum�ration des cl�s de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 20 Legitimates Filtered in 00mn 00s
---\\ Enum�ration des cl�s de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 4 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du syst�me (SDL) (O58)
O58 - SDL:[MD5.46571ED73AE84469DCA53081D33CF3C8] - 10/06/2013 - 19:45:12 ---A- . (.DT Soft Ltd - DAEMON Tools Virtual Bus Driver.) -- C:\Windows\System32\Drivers\dtsoftbus01.sys [283200]
O58 - SDL:[MD5.F572B7467B5CB4FA8FB6319575902E41] - 08/01/2013 - 14:21:06 ---A- . (.Huawei Tech. Co., Ltd. - HUAWEI USB Smart Card Driver.) -- C:\Windows\SysWOW64\drivers\ewdcsc.sys [32768]
~ Drivers: 20 Legitimates Filtered in 00mn 02s
---\\ Liste des outils de d�sinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html>
~ FASS Keys: 19 Legitimates Filtered in 00mn 00s
---\\ Menu de d�marrage Internet (SMI) (O68)
O68 - StartMenuInternet:
O68 - StartMenuInternet:
O68 - StartMenuInternet:
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.admin", false); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.aflt", "babsst"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.autoRvrt", "false"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.dfltLng", "fr"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.excTlbr", false); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.id", "bec68cc20000000000009439e57898f3"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.instlDay", "15674"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.instlRef", "na"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.prtnrId", "babylon"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.tlbrId", "irhnew"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "http://search.babylon.com/?babsrc=TB_def&mntrId=bec68cc20000000000009439e57898[...] =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.vrsn", "1.8.3.8"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar.vrsni", "1.8.3.8"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar_i.babExt", ""); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar_i.babTrack", "affID=17425&tt=281112_lng"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar_i.newTab", false); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar_i.smplGrp", "none"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar_i.srcExt", "def"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.3.820:37:31"); =>Toolbar.Babylon
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.asktb.ff-original-keyword-url", "");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.admin", false);
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.aflt", "babsst");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.autoRvrt", "false");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.dfltLng", "fr");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.excTlbr", false);
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.ffxUnstlRst", true);
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.id", "bec68cc20000000000009439e57898f3");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.instlDay", "15906");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.instlRef", "sst");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.newTab", false);
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.prdct", "delta");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.prtnrId", "delta");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.rvrt", "false");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.smplGrp", "none");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.tlbrId", "base");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.tlbrSrchUrl", "");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.vrsn", "1.8.21.5");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.vrsnTs", "1.8.21.514:16:15");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta.vrsni", "1.8.21.5");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta_i.babExt", "");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta_i.babTrack", "affID=120695&tsp=4949");
O69 - SBI: prefs.js [Eddy Zakri - xhe9vf9l.default] user_pref("extensions.delta_i.srcExt", "ss");
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {0C79A1C0-477D-44DD-8E58-878E3311465C} [DefaultScope] - (Search By ZoneAlarm) - http://search.zonealarm.com
O69 - SBI: SearchScopes [HKCU] {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} - (Delta Search) - http://www1.delta-search.com =>Toolbar.DeltaSearch
O69 - SBI: SearchScopes [HKCU] {2fa28606-de77-4029-af96-b231e3b8f827} - (Ask.com) - http://eu.ask.com
O69 - SBI: SearchScopes [HKCU] {4DAB80A5-7A3E-4CDD-AE89-D146AA010275} - (Ask Search) - http://websearch.ask.com =>Toolbar.Ask
O69 - SBI: SearchScopes [HKCU] {96CE4CCC-8A77-4A55-B495-1DB2673B7D73} - (Propositions de recherche Amazon.fr) - http://www.amazon.fr
O69 - SBI: SearchScopes [HKCU] {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} - (Search Results) - http://dts.search-results.com =>PUP.SearchResults
O69 - SBI: SearchScopes [HKCU] {B1A0897C-2EA0-488B-901B-71C323DD78C0} - (Search the web (Softonic)) - http://search.softonic.com =>Adware.IMBooster
O69 - SBI: SearchScopes [HKCU] {b7fca997-d0fb-4fe0-8afd-255e89cf9671} - (Yahoo) - http://fr.search.yahoo.com
O69 - SBI: SearchScopes [HKCU] {d43b3890-80c7-4010-a95d-1e77b5924dc3} - (Wikipedia) - http://fr.wikipedia.org
O69 - SBI: SearchScopes [HKCU] {D944BB61-2E34-4DBF-A683-47E505C587DC} - (eBay) - http://rover.ebay.com
~ Keys: Scanned in 00mn 00s
---\\ Recherche particuli�re � la racine du syst�me (SPRF) (O84)
[MD5.F2A14501C58CAAF65D169A12BE452B3D] [SPRF][12/09/2012] (...) -- C:\ProgramData\ntuser.dat [262144]
~ Files: 1 Legitimates Filtered in 00mn 00s
---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "TCP Query User{05462040-2A87-4993-A326-9CF8C838A6DA}C:\program files (x86)\aresmod\aresmod.exe" |In - Public - P6 - TRUE | .(...) -- C:\program files (x86)\aresmod\aresmod.exe (.not file.)
O87 - FAEL: "UDP Query User{731E59C5-F5DD-43CA-8759-7C26E4BC4337}C:\program files (x86)\aresmod\aresmod.exe" |In - Public - P17 - TRUE | .(...) -- C:\program files (x86)\aresmod\aresmod.exe (.not file.)
O87 - FAEL: "{F707704B-4A26-44BC-A858-596B991FDBBD}" |In - None - P6 - TRUE | .(...) -- C:\Users\Eddy Zakri\AppData\Local\MediaGet2\mediaget.exe (.not file.) =>PUP.MediaGet
O87 - FAEL: "{3DEA7EA5-6F06-4F03-9A8D-A4BD818E2A3B}" |In - None - P17 - TRUE | .(...) -- C:\Users\Eddy Zakri\AppData\Local\MediaGet2\mediaget.exe (.not file.) =>PUP.MediaGet
O87 - FAEL: "TCP Query User{8A88D29C-9281-41DD-8C08-D7A518AE0AD0}C:\users\eddy zakri\videos\jeux\007\bond_ded.exe" | In - Public - P6 - TRUE | .(...) -- C:\users\eddy zakri\videos\jeux\007\bond_ded.exe
O87 - FAEL: "UDP Query User{E621D580-DDDE-44AF-B86A-99083E094302}C:\users\eddy zakri\videos\jeux\007\bond_ded.exe" | In - Public - P17 - TRUE | .(...) -- C:\users\eddy zakri\videos\jeux\007\bond_ded.exe
~ Firewall: 186 Legitimates Filtered in 00mn 04s
---\\ Export de cl�s de registre al�atoires (O91)
[HKCU\Software\9538ddfbc6fbf43\2.6.1519.190\upd]:="upd=1"
[HKCU\Software\9538ddfbc6fbf43\2.6.1673.238\upd]:="upd=1"
[HKCU\Software\9538ddfbc6fbf43\2.6.1694.246\upd]:="upd="
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:dllName="BrowserDefender.dll" =>Hijacker.Eazel
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:exeName="BrowserDefender.exe" =>Hijacker.Eazel
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:folderName="BrowserDefender" =>Hijacker.Eazel
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:guid="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}"
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:serviceName="BrowserDefendert" =>Hijacker.Eazel
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:version="2.6.1339.144"
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:dllName="BrowserDefender.dll" =>Hijacker.Eazel
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:exeName="BrowserDefender.exe" =>Hijacker.Eazel
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:folderName="BrowserDefender" =>Hijacker.Eazel
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:guid="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}"
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:serviceName="BrowserDefendert" =>Hijacker.Eazel
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:version="2.6.1519.190"
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:dllName="BitGuard.dll" =>PUP.BitGuard
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:exeName="BitGuard.exe" =>PUP.BitGuard
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:folderName="BitGuard" =>PUP.BitGuard
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:guid="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}"
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:serviceName="BitGuard" =>PUP.BitGuard
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:version="2.6.1673.238"
[HKCU\Software\9538ddfbc6fbf43]:version="2.6.1694.246"
[HKLM\Software\Wow6432Node\9538ddfbc6fbf43]:version="2.6.1694.246"
~ Export Key Software: Scanned in 00mn 00s
---\\ Etat g�n�ral des services not Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 10/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 14/10/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 18/11/2009 98208 | (AERTFilters) . (.Andrea Electronics Corporation.) - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
SR - | Auto 06/07/2011 204288 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe
SR - | Auto 05/07/2011 365568 | (AMD FUEL Service) . (.Advanced Micro Devices, Inc..) - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
SR - | Auto 08/10/2013 3032032 | (BitGuard) . (...) - C:\ProgramData\BitGuard\2.6.1694.246\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe =>PUP.BitGuard
SR - | Auto 10/07/1658 0 | (ezSharedSvc) . (.EasyBits Software AS.) - C:\Windows\System32\ezSharedSvcHost.exe =>.EasyBits Software AS
SS - | Demand 12/10/2010 206072 | (GamesAppService) . (.WildTangent, Inc..) - C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe
SS - | Auto 04/05/2012 136176 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 04/05/2012 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 15/02/2013 194032 | (gusvc) . (.Google.) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SR - | Auto 27/09/2012 86528 | (HP Support Assistant Service) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe =>.Hewlett-Packard Co
SR - | Auto 11/10/2010 346168 | (HPClientSvc) . (.Hewlett-Packard Company.) - C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
SS - | Demand 14/06/2011 1098296 | (hpCMSrv) . (.Hewlett-Packard Development Company L.P..) - C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe
SR - | Auto 06/09/2012 197536 | (HPDrvMntSvc.exe) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
SR - | Demand 06/09/2012 1001376 | (hpqwmiex) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
SR - | Auto 05/03/2012 35200 | (HPWMISVC) . (.Hewlett-Packard Development Company, L.P..) - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
SR - | Auto 27/12/2010 1817088 | (IconMan_R) . (.Realsil Microelectronics Inc..) - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
SR - | Auto 16/08/2012 347120 | (InternetEverywhere_Service) . (...) - C:\Program Files (x86)\InternetEverywhere\InternetEverywhere_Service.exe
SS - | Demand 30/07/2013 117656 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SR - | Auto 02/10/2012 3064000 | (Skype C2C Service) . (.Skype Technologies S.A..) - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
SS - | Auto 08/01/2013 161536 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SR - | Auto 26/09/2013 32256 | (SrvUpdater) . (...) - C:\Program Files (x86)\SoftwareUpdater\UpdaterService.exe =>PUP.Eorezo
SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SS - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 01mn 38s
---\\ Scan Additionnel (O88)
Database Version : 12946 - (13/10/2013)
Cl�s trouv�es (Keys found) : 180
Valeurs trouv�es (Values found) : 4
Dossiers trouv�s (Folders found) : 21
Fichiers trouv�s (Files found) : 32
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3543619C-D563-43F7-95EA-4DA7E1CC396A}] =>PUP.Onekit^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}] =>Toolbar.DeltaSearch^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E87806B5-E908-45FD-AF5E-957D83E58E68}] =>Toolbar.Conduit^
[HKLM\SYSTEM\CurrentControlSet\Services\BitGuard] =>PUP.BitGuard^
[HKLM\SYSTEM\CurrentControlSet\Services\SrvUpdater] =>PUP.Eorezo^
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}] =>Toolbar.Ask^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}] =>PUP.BitGuard^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\delta] =>Toolbar.DeltaSearch^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}] =>Adware.WebCake^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\okitspace] =>PUP.Onekit^
[HKLM\Software\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}] =>Toolbar.Babylon
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9}] =>Toolbar.Babylon
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}] =>Toolbar.Babylon
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}] =>Toolbar.Babylon
[HKLM\Software\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}] =>Toolbar.Babylon
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype
[HKLM\Software\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype
[HKLM\Software\Microsoft\Internet Explorer\extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}] =>Adware.Bandoo
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}] =>Adware.Bandoo
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}] =>Adware.Bandoo
[HKLM\Software\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}] =>PUP.Software.Updater
[HKLM\Software\Wow6432Node\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}] =>PUP.Software.Updater
[HKLM\Software\Classes\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476}] =>PUP.Software.Updater
[HKLM\Software\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}] =>Toolbar.Babylon
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKLM\Software\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKLM\Software\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}] =>Adware.CDNHelper
[HKLM\Software\Wow6432Node\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}] =>Adware.CDNHelper
[HKLM\Software\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}] =>Toolbar.Babylon
[HKLM\Software\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}] =>Toolbar.Babylon
[HKLM\Software\Classes\Interface\{EFDCAF05-D29C-4D4D-9836-8CDCD606A6B2}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\Interface\{EFDCAF05-D29C-4D4D-9836-8CDCD606A6B2}] =>Toolbar.Babylon
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}] =>Toolbar.ZoneAlarm
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59}] =>Toolbar.ZoneAlarm
[HKLM\Software\Classes\AppID\escort.dll] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\escortapp.dll] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\escorteng.dll] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\esrv.EXE] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASMANCS] =>Toolbar.Bing
[HKLM\Software\Classes\escort.escortIEPane] =>PUP.Funmoods
[HKLM\Software\Classes\escort.escortIEPane.1] =>PUP.Funmoods
[HKLM\Software\Classes\S] =>Toolbar.Agent
[HKLM\Software\Classes\Updater.AmiUpd] =>PUP.Software.Updater
[HKLM\Software\Classes\Updater.AmiUpd.1] =>PUP.Software.Updater
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater] =>Toolbar.Ask
[HKCU\Software\DataMngr] =>Adware.Bandoo
[HKLM\Software\DataMngr] =>Adware.Bandoo
[HKLM\Software\Wow6432Node\DataMngr] =>Adware.Bandoo
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Softonic] =>Toolbar.Conduit
[HKCU\Software\SpeedMaxPc] =>PUP.SpeedMaxPc
[HKLM\Software\Wow6432Node\SpeedMaxPc] =>PUP.SpeedMaxPc
[HKLM\Software\Tarma Installer] =>PUP.Tarma
[HKLM\Software\Wow6432Node\Microsoft\Tracing\Babylon_RASAPI32] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Tracing\Babylon_RASMANCS] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Tracing\MyBabylontb_RASAPI32] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Tracing\MyBabylontb_RASMANCS] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Tracing\SearchquMediaBar_RASAPI32] =>Adware.Bandoo
[HKLM\Software\Wow6432Node\Microsoft\Tracing\SearchquMediaBar_RASMANCS] =>Adware.Bandoo
[HKLM\Software\Wow6432Node\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32] =>Adware.Bandoo
[HKLM\Software\Wow6432Node\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS] =>Adware.Bandoo
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96}] =>PUP.Software.Updater
[HKLM\Software\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}] =>Toolbar.Conduit
[HKLM\Software\Classes\AppID\{B15F118E-AF21-45E8-A809-29FDD7362565}] =>PUP.Funmoods
[HKLM\Software\Classes\TypeLib\{B15F118E-AF21-45E8-A809-29FDD7362565}] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\{B15F118E-AF21-45E8-A809-29FDD7362565}] =>PUP.Funmoods
[HKLM\Software\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}] =>PUP.Funmoods
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}] =>Toolbar.Conduit
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9CF034EA-7B46-48D3-8895-8A14B32AE445}] =>Toolbar.Conduit
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}] =>Toolbar.DeltaSearch
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}] =>Toolbar.Conduit
[HKLM\Software\Classes\TypeLib\{11D9E165-B8C1-4734-A56C-BC4FCACA966B}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\softonic] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm Security Toolbar] =>Toolbar.ZoneAlarm
[HKLM\Software\Classes\Prod.cap] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASAPI32] =>Toolbar.Bing
[HKLM\Software\Wow6432Node\VBMZ] =>Toolbar.Conduit
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings] =>PUP.BProtector
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{82E1477C-B154-48D3-9891-33D83C26BCD3}] =>PUP.Funmoods
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{82E1477C-B154-48D3-9891-33D83C26BCD3}] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85}] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D}] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\TypeLib\{4599D05A-D545-4069-BB42-5895B4EAE05B}] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\delta.deltaappCore] =>PUP.Funmoods
[HKLM\Software\Classes\delta.deltaappCore.1] =>PUP.Funmoods
[HKLM\Software\Classes\delta.deltadskBnd] =>PUP.Funmoods
[HKLM\Software\Classes\delta.deltadskBnd.1] =>PUP.Funmoods
[HKLM\Software\Classes\ScriptHost.Tool.1] =>Toolbar.Agent
[HKLM\Software\Classes\ScriptHost.Tool] =>Toolbar.Agent
[HKLM\Software\Classes\TypeLib\{5C9A2304-70A5-11D5-AFB0-0050DAC67890}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{C3F058A9-407D-4CD1-8F66-B75605B54B69}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{C3F058A9-407D-4CD1-8F66-B75605B54B69}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{8911483C-C00A-4183-9FBC-6C9C00946C15}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{8911483C-C00A-4183-9FBC-6C9C00946C15}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{5C9A230D-70A5-11D5-AFB0-0050DAC67890}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{5C9A230D-70A5-11D5-AFB0-0050DAC67890}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{0BF91075-F457-4A8B-99EF-140B52D2F22A}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{0BF91075-F457-4A8B-99EF-140B52D2F22A}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{37425600-CB21-49A0-8659-476FBAB0F8E8}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{37425600-CB21-49A0-8659-476FBAB0F8E8}] =>Toolbar.Conduit
[HKLM\Software\Classes\Interface\{431FB0E5-2CBB-4602-9FE6-F1D64488ADD7}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\Interface\{431FB0E5-2CBB-4602-9FE6-F1D64488ADD7}] =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Google\Chrome\Extensions\dppahnkclbmppnmcoifolpjmeppoakfb] =>PUP.Facemoi
[HKLM\Software\Classes\AppID\{6536801B-F50C-449B-9476-093DFD3789E3}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{6536801B-F50C-449B-9476-093DFD3789E3}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\SoftwareUpdater] =>Hijacker.Eazel
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdater] =>Hijacker.Eazel
[HKLM\Software\Classes\AppID\BabylonHelper.EXE] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Google\Chrome\Extensions\fjoijdanhaiflhibkljeklcghcmmfffh] =>Adware.WebCake
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}] =>Toolbar.Yahoo
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}] =>Toolbar.Yahoo
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}] =>Toolbar.Yahoo
[HKLM\Software\Wow6432Node\Microsoft\Tracing\WebCakeDesktop_RASAPI32] =>Adware.WebCake
[HKLM\Software\Wow6432Node\Microsoft\Tracing\WebCakeDesktop_RASMANCS] =>Adware.WebCake
[HKLM\Software\Classes\delta.deltaHlpr] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\delta.deltaHlpr.1] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\esrv.deltaESrvc] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\esrv.deltaESrvc.1] =>Toolbar.DeltaSearch
[HKLM\Software\Classes\AppID\escorTlbr.DLL] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\delta.deltaappCore] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\delta.deltaappCore.1] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\delta.deltadskBnd] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\delta.deltadskBnd.1] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\delta.deltaHlpr] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\delta.deltaHlpr.1] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\esrv.deltaESrvc] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\esrv.deltaESrvc.1] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\escort.escortIEPane] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\escort.escortIEPane.1] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\escort.DLL] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\escortApp.DLL] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\escortEng.DLL] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\escorTlbr.DLL] =>PUP.Funmoods
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{2318C2B1-4965-11d4-9B18-009027A5CD4F} =>Toolbar.Google^
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:GM4IE =>PUP.Facemoi^
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:Facemoi =>PUP.Facemoi^
[HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]:{D4027C7F-154A-4066-A1AD-4243D8127440} =>Toolbar.Avira
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\ffxtlbr@delta.com =>Toolbar.DeltaSearch^
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\plugin@getwebcake.com =>Adware.WebCake^
C:\Program Files (x86)\MyPC Backup =>PUP.MyPCBackup^
C:\Program Files (x86)\Softonic =>Toolbar.Conduit^
C:\Program Files (x86)\Common Files\SpeedMaxPc =>PUP.SpeedMaxPc^
C:\ProgramData\Babylon =>Toolbar.Babylon^
C:\ProgramData\BitGuard =>PUP.BitGuard^
C:\ProgramData\Media Get LLC =>PUP.MediaGet^
C:\ProgramData\SpeedMaxPc =>PUP.SpeedMaxPc^
C:\ProgramData\Tarma Installer =>PUP.Tarma^
C:\Users\Eddy Zakri\AppData\Roaming\BabSolution =>Hijacker.BabSolution^
C:\Users\Eddy Zakri\AppData\Roaming\Babylon =>Toolbar.Babylon^
C:\Users\Eddy Zakri\AppData\Roaming\okitspace =>PUP.Onekit^
C:\Users\Eddy Zakri\AppData\Roaming\Softonic =>Toolbar.Conduit^
C:\Users\Eddy Zakri\AppData\Roaming\SpeedMaxPc =>PUP.SpeedMaxPc^
C:\Users\Eddy Zakri\AppData\Local\SwvUpdater =>PUP.Software.Updater^
C:\Users\Eddy Zakri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard =>PUP.BitGuard^
C:\Users\Eddy Zakri\AppData\Local\RavenBleuSA =>Adware.Gabpath
C:\Users\Eddy Zakri\AppData\LocalLow\BabylonToolbar =>Toolbar.Babylon
C:\Users\Eddy Zakri\AppData\Local\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde =>Toolbar.DeltaSearch
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\Extensions\ffxtlbr@delta.com =>PUP.Funmoods
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\bprotector_extensions.sqlite =>PUP.BProtector
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\bprotector_prefs.js =>PUP.BProtector
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\SearchPlugins\zonealarm.xml =>Toolbar.ZoneAlarm
C:\ProgramData\BitGuard\2.6.1694.246\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe =>PUP.BitGuard^
C:\Facemoi\facemoi.exe =>PUP.Facemoi^
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\searchplugins\babylon.xml =>Toolbar.Babylon^
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\searchplugins\delta.xml =>Toolbar.DeltaSearch^
C:\Users\Eddy Zakri\AppData\Roaming\Mozilla\Firefox\Profiles\xhe9vf9l.default\searchplugins\softonic.xml =>Toolbar.Conduit^
C:\Users\Eddy Zakri\AppData\Roaming\okitspace\IE\OKitSpace.dll =>PUP.Onekit^
C:\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll =>Toolbar.DeltaSearch^
C:\Program Files (x86)\Softonic\Softonic\1.8.19.3\bh\Softonic.dll =>Toolbar.Conduit^
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll =>Toolbar.Google^
c:\Facemoi\facemoi.exe =>PUP.Facemoi^
C:\Program Files (x86)\SoftwareUpdater\UpdaterService.exe =>PUP.Eorezo^
C:\Windows\Tasks\AmiUpdXp.job =>PUP.Software.Updater^
C:\Windows\Tasks\SpeedMaxPc Registration3.job =>PUP.SpeedMaxPc^
C:\Windows\Tasks\SpeedMaxPc Update3.job =>PUP.SpeedMaxPc^
C:\Windows\Tasks\SpeedMaxPc.job =>PUP.SpeedMaxPc^
C:\Users\Eddy Zakri\AppData\Local\SwvUpdater\Updater.exe =>PUP.Software.Updater^
C:\Users\Eddy Zakri\AppData\Roaming\BabSolution\Shared\BabMaint.exe =>Hijacker.BabSolution^
C:\Program Files (x86)\Common Files\SpeedMaxPc\UUS3\Update3.exe =>PUP.SpeedMaxPc^
[HKCU\Software\BabSolution] =>Hijacker.BabSolution^
[HKCU\Software\Babylon] =>Toolbar.Babylon^
[HKCU\Software\Conduit] =>Toolbar.Conduit^
[HKCU\Software\DataMngr_Toolbar] =>PUP.Datamngr^
[HKCU\Software\Datamngr] =>PUP.Datamngr^
[HKCU\Software\Media Get LLC] =>PUP.MediaGet^
[HKLM\Software\Wow6432Node\Babylon] =>Toolbar.Babylon^
[HKLM\Software\Wow6432Node\Conduit] =>Toolbar.Conduit^
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:dllName="BrowserDefender.dll" =>Hijacker.Eazel^
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:dllName="BrowserDefender.dll" =>Hijacker.Eazel^
[HKCU\Software\9538ddfbc6fbf43\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:dllName="BitGuard.dll" =>PUP.BitGuard^
~ Additionnel Scan: 303036 Items scanned in 04mn 52s
---\\ R�capitulatif des d�tections trouv�es sur votre station
~ http://nicolascoolman.webs.com/apps/blog/show/32979753-pup-bitguard =>PUP.BitGuard
~ http://nicolascoolman.webs.com/apps/blog/show/28426583-pup-facemoi =>PUP.Facemoi
~ http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon =>Toolbar.Babylon
~ http://nicolascoolman.webs.com/apps/blog/show/27875657-toolbar-deltasearch =>Toolbar.DeltaSearch
~ http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit
~ http://nicolascoolman.webs.com/apps/blog/show/27285539-adware-webcake =>Adware.WebCake
~ http://nicolascoolman.webs.com/apps/blog/show/33456961-pup-onekit =>PUP.OneKit
~ http://nicolascoolman.webs.com/apps/blog/show/32384220-toolbar-google =>Toolbar.Google
~ http://nicolascoolman.webs.com/apps/blog/show/27469224-pup-eorezo =>PUP.EoRezo
~ http://nicolascoolman.webs.com/apps/blog/show/32713686-pup-software-updater =>PUP.Software.Updater
~ http://nicolascoolman.webs.com/apps/blog/show/28947219-pup-speedmaxpc =>PUP.SpeedMaxPc
~ http://nicolascoolman.webs.com/apps/blog/show/26678994-hijacker-babsolution =>Hijacker.BabSolution
~ http://nicolascoolman.webs.com/apps/blog/show/28927746-toolbar-ask =>Toolbar.Ask
~ http://nicolascoolman.webs.com/apps/blog/show/27583992-pup-datamngr =>PUP.Datamngr
~ http://nicolascoolman.webs.com/apps/blog/show/28151468-pup-mediaget =>PUP.MediaGet
~ http://nicolascoolman.webs.com/apps/blog/show/29637859-toolbar-tarma =>PUP.Tarma
~ http://nicolascoolman.webs.com/apps/blog/show/32174815-pup-mypcbackup =>PUP.MyPCBackup
~ http://nicolascoolman.webs.com/apps/blog/show/30319724-pup-searchresults =>PUP.SearchResults
~ http://nicolascoolman.webs.com/apps/blog/show/26684723-adware-imbooster =>Adware.IMBooster
~ http://nicolascoolman.webs.com/apps/blog/show/27161672-hijacker-eazel =>Hijacker.Eazel
~ http://nicolascoolman.webs.com/apps/blog/show/30898245-toolbar-skype =>Toolbar.Skype
~ http://nicolascoolman.webs.com/apps/blog/show/26611092-adware-bandoo =>Adware.Bandoo
~ http://nicolascoolman.webs.com/apps/blog/show/31536787-toolbar-bing =>Toolbar.Bing
~ http://nicolascoolman.webs.com/apps/blog/show/27630986-pup-funmoods =>PUP.Funmoods
~ http://nicolascoolman.webs.com/apps/blog/show/28133096-pup-bprotector =>PUP.BProtector
~ http://nicolascoolman.webs.com/apps/blog/show/30268689-toolbar-yahoo =>Toolbar.Yahoo
~ http://nicolascoolman.webs.com/apps/blog/show/28419247-toolbar-avira =>Toolbar.Avira
~ http://nicolascoolman.webs.com/apps/blog/show/27254456-adware-gabpath =>Adware.Gabpath
~ MSI: 28 link(s) detected in 04mn 53s
~ 2077 Legitimates filtered by white list
End of the scan (883 lines in 17mn 21s)(0)