~ Rapport de ZHPDiag v2014.3.2.6 - Nicolas Coolman (03/03/2014)
~ Lancé par foot (05/03/2014 15:52:13)
~ Adresse du Site Web http://nicolascoolman.webs.com
~ Forums gratuits d'Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user


---\\ Navigateurs Internet
MSIE: Internet Explorer v9.0.8112.16421
MFIE: Mozilla Firefox 26.0
GCIE: Google Chrome v33.0.1750.146 (Defaut)

---\\ Informations sur les produits Windows
~ Langage: Français
Windows Vista (TM) Home Basic, 32-bit Service Pack 2 (Build 6002)
Windows Server License Manager Script : OK
~ Vista, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 44MV3
Windows License : OK
Windows Automatic Updates : OK

---\\ Logiciels de protection du système
avast! Free Antivirus v9.0.2013
Malwarebytes Anti-Malware version 1.75.0.1300

---\\ Logiciels d'optimisation du système
CCleaner v2.33 =>Piriform Ltd

---\\ Logiciels de partage PeerToPeer
eMule

---\\ Surveillance de Logiciels
Adobe Flash Player 12 Plugin
Adobe Reader X

---\\ Informations sur le système
~ Processor: x86 Family 6 Model 15 Stepping 13, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 2038 MB (37% free)
System Restore: Activé (Enable)
System drive C: has 26 GB (18%) free of 142 GB

---\\ Mode de connexion au système
~ Computer Name: MIK
~ User Name: foot
~ All Users Names: foot, Administrateur,
~ Unselected Option: None
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\foot\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\foot\AppData\Roaming\
~ %Desktop% : C:\Users\foot\Desktop\
~ %Favorites% : C:\Users\foot\Favorites\
~ %LocalAppData% : C:\Users\foot\AppData\Local\
~ %StartMenu% : C:\Users\foot\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\WINDOWS\
~ %System% : C:\WINDOWS\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 26 Go of 142 Go)
D: Hard drive, Flash drive, Thumb drive (Free 1 Go of 7 Go)
E: CD-ROM drive (Not Inserted)
G: Floppy drive, Flash card reader, USB Key (Not Inserted)
H: Floppy drive, Flash card reader, USB Key (Not Inserted)
I: Floppy drive, Flash card reader, USB Key (Not Inserted)
J: Floppy drive, Flash card reader, USB Key (Not Inserted)



---\\ Etat du Centre de Sécurité Windows
~ Security Center: 50 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.D07D4C3038F3578FFCE1C0237F2A1253] - (.Microsoft Corporation - Explorateur Windows.) (.11/04/2009 - 07:27:36.) -- C:\WINDOWS\Explorer.exe [2926592]
[MD5.101BA3EA053480BB5D957EF37C06B5ED] - (.Microsoft Corporation - Application de démarrage de Windows.) (.19/01/2008 - 08:33:37.) -- C:\WINDOWS\System32\Wininit.exe [96768]
[MD5.679EAED8E703235BA81AA2E58F4E2D16] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.05/02/2014 - 09:50:39.) -- C:\WINDOWS\System32\wininet.dll [1129472]
[MD5.898E7C06A350D4A1A64A9EA264D55452] - (.Microsoft Corporation - Application d'ouverture de session Windows.) (.11/04/2009 - 07:28:13.) -- C:\WINDOWS\System32\Winlogon.exe [314368]
[MD5.3911B972B55FEA0478476B2E777B29FA] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.21/04/2011 - 14:58:27.) -- C:\WINDOWS\system32\Drivers\AFD.sys [273408]
[MD5.1F05B78AB91C9075565A9D8A4B880BC4] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.11/04/2009 - 07:32:26.) -- C:\WINDOWS\system32\Drivers\atapi.sys [19944]
[MD5.7ADD03E75BEB9E6DD102C3081D29840A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.19/01/2008 - 06:28:02.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [70144]
[MD5.6B4BFFB9BECD728097024276430DB314] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.11/04/2009 - 05:39:17.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [67072]
[MD5.622C41A07CA7E6DD91770F50D532CB6C] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.14/04/2011 - 15:59:03.) -- C:\WINDOWS\system32\Drivers\DfsC.sys [75264]
[MD5.062452B7FFD68C8C042A6261FE8DFF4A] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.11/04/2009 - 05:42:42.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [561152]
[MD5.22D56C8184586B7A1F6FA60BE5F5A2BD] - (.Microsoft Corporation - Pilote de port i8042.) (.19/01/2008 - 06:49:18.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [54784]
[MD5.8793643A67B42CEC66490B2A0CF92D68] - (.Microsoft Corporation - IP Network Address Translator.) (.19/01/2008 - 06:56:28.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [100864]
[MD5.1E94971C4B446AB2290DEB71D01CF0C2] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.29/04/2011 - 14:24:40.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [106496]
[MD5.ECD64230A59CBD93C85F1CD1CAB9F3F6] - (.Microsoft Corporation - MBT Transport driver.) (.11/04/2009 - 05:45:37.) -- C:\WINDOWS\system32\Drivers\netBT.sys [185856]
[MD5.2C1121F2B87E9A6B12485DF53CD848C7] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.03/03/2013 - 20:07:52.) -- C:\WINDOWS\system32\Drivers\ntfs.sys [1082232]
[MD5.0FA9B5055484649D63C303FE404E5F4D] - (.Microsoft Corporation - Pilote de port parallèle.) (.02/11/2006 - 09:51:30.) -- C:\WINDOWS\system32\Drivers\Parport.sys [79360]
[MD5.A214ADBAF4CB47DD2728859EF31F26B0] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.19/01/2008 - 06:56:34.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [76288]
[MD5.E8BD98D46F2ED77132BA927FCCB47D8B] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.02/11/2006 - 10:03:00.) -- C:\WINDOWS\system32\Drivers\rdpdr.sys [242688]
[MD5.7B75299A4D201D6A6533603D6914AB04] - (.Microsoft Corporation - SMB Transport driver.) (.11/04/2009 - 05:45:22.) -- C:\WINDOWS\system32\Drivers\smb.sys [66560]
[MD5.76B06EB8A01FC8624D699E7045303E54] - (.Microsoft Corporation - TDI Translation Driver.) (.11/04/2009 - 05:45:56.) -- C:\WINDOWS\system32\Drivers\tdx.sys [72192]
[MD5.786DB5771F05EF300390399F626BF30A] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.21/08/2012 - 12:47:42.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [224640]
~ Generic Processes: Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/2303
~ Mes musiques (My Musics) : 29/138
~ Mes Videos (My Videos) : 1/36
~ Mes Favoris (My Favorites) : 1/30
~ Mes Documents (My Documents) : 3/1070
~ Mon Bureau (My Desktop) : 1/184
~ Menu demarrer (Programs) : 1/14
~ Hidden Files: Scanned in 00mn 01s



---\\ Processus lancés
[MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.2824]
[MD5.0D392EDE3B97E0B3131B2F63EF1DB94E] - (.Microsoft Corporation - Windows Defender User Interface.) -- C:\Program Files\Windows Defender\MSASCui.exe [1008184] [PID.3520]
[MD5.9A4322EE420D6FACD4D4B1FF6CB856B1] - (.Hewlett-Packard Company - hpsysdrv.) -- C:\hp\support\hpsysdrv.exe [65536] [PID.3752]
[MD5.B1361669BDC6ED612C35B7C67ADA2240] - (.OsdMaestro - OsdMaestro main program.) -- C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe [118784] [PID.3884]
[MD5.361CD47DC5BD83EE24407903233B0D9A] - (.Realtek Semiconductor - HD Audio Control Panel.) -- C:\WINDOWS\RtHDVCpl.exe [4874240] [PID.4012]
[MD5.13E7CFE8E269ED15E7FC9C3EBBCB7E2B] - (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe [254696] [PID.4092]
[MD5.F6158734F1E24C6C510155CF0D363911] - (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe [295512] [PID.1520]
[MD5.71FC5102BBB5690E7CB94F46643D499B] - (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\System32\hkcmd.exe [166424] [PID.1404]
[MD5.C70EB732C5D8B81EFF69A9A1FE19C320] - (.Intel Corporation - persistence Module.) -- C:\WINDOWS\System32\igfxpers.exe [133656] [PID.1148]
[MD5.A78AAB0D2D70EF7DD56B7328AC502059] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3767096] [PID.2480]
[MD5.E5C8C4D80E65B47D0829F8D26A66BF9E] - (...) -- C:\Program Files\Mobogenie\DaemonProcess.exe [761536] [PID.2652] =>PUP.Mobogenie
[MD5.446E40E9FDBDBC9D30A3D0B0E1120E06] - (.Intel Corporation - igfxsrvc Module.) -- C:\Windows\system32\igfxsrvc.exe [256536] [PID.2680]
[MD5.009811BD21D0BD7BA5C7765565505764] - (.Hewlett-Packard - HP Advisor.) -- C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1644088] [PID.2736]
[MD5.0B729DBAE22BCEACB1FA39B19748EBDC] - (.Microsoft Corporation - Voisinage immédiat.) -- C:\WINDOWS\System32\p2phost.exe [192000] [PID.1112]
[MD5.33EF7A3E3B2004E9A225AF3D98D5BC21] - (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner.exe [1699128] [PID.2196] =>Piriform Ltd
[MD5.1EEA6C1B35191DC177EA83672B9C3FC0] - (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe [275568] [PID.5380]
[MD5.DDBE89226D55D694F1B7B3DD0C324640] - (.RealNetworks, Inc. - RealDownloader.) -- C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe [233048] [PID.5628]
[MD5.0DD74786D22EDFF0CE5B8E1B1E398618] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files\Mozilla Firefox\plugin-container.exe [18544] [PID.5292]
[MD5.0642800E69522E29B93EF4C6BE00D13E] - (.Adobe Systems, Inc. - Adobe Flash Player 12.0 r0.) -- C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_70.exe [1863560] [PID.5312]
[MD5.A623666C8A8EC9A57DCA07915A3F1EC6] - (.Microsoft Corporation - Sauvegarde Microsoft® Windows.) -- C:\Windows\system32\sdclt.exe [1169408] [PID.492]
[MD5.66EA3B698F9A7EA2DBF0E4B246B6C958] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8349696] [PID.4408]
[MD5.D53024C1355615B82DD1526B63623E61] - (...) -- C:\Program Files\Mobogenie\mgusb.exe [88256] [PID.2372] =>PUP.Mobogenie
[MD5.862BB4CBC05D80C5B45BE430E5EF872F] - (.Microsoft Corporation - Service de gestion des licences Microsoft.) -- C:\Windows\system32\SLsvc.exe [3408896] [PID.1328]
[MD5.CC42F104172B4A62793083D380867317] - (.AVAST Software - avast! Service.) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344] [PID.1736]
[MD5.B362181ED3771DC03B4141927C80F801] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [65432] [PID.1564]
[MD5.4FE5C6D40664AE07BE5105874357D2ED] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [57008] [PID.1748]
[MD5.05F52B38531615849410136B094B2347] - (.Bayer Healthcare LLC - Bayer Healthcare Service.) -- C:\Program Files\Bayer HealthCare SmartLaunch\bin\BayerHCService.exe [134584] [PID.2284]
[MD5.DB5BEA73EDAF19AC68B2C0FAD0F92B1A] - (.Apple Inc. - Bonjour Service.) -- C:\Program Files\Bonjour\mDNSResponder.exe [390504] [PID.2296]
[MD5.37427195F66A7FECF43CFF57FBC6385C] - (.Pas de propriétaire - Printer Communication System.) -- C:\Windows\system32\lxdncoms.exe [589824] [PID.2612]
[MD5.65085456FD9A74D7F1A999520C299ECB] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376] [PID.2668]
[MD5.E0D7732F2D2E24B2DB3F67B6750295B8] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512] [PID.2716]
[MD5.96EFEC24346A8EB1157E80523079ADDC] - (...) -- C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39056] [PID.2840]
[MD5.C7FBDD1ED42F82BFA35167A5C9803EA3] - (.Microsoft Corporation - PresentationFontCache.exe.) -- C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [43904] [PID.2692]
[MD5.E48B80F6614D4BEFA7768B960FFEF514] - (.Hewlett-Packard - HP Health Check Service.) -- c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [61440] [PID.5692]
[MD5.447FC81330CD96CA26459DB2E86C3630] - (.RealNetworks, Inc. - RealPlayer.) -- C:\Program Files\Real\RealPlayer\RealPlay.exe [501328] [PID.0]
~ Processes Running: Scanned in 00mn 01s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\foot\AppData\Local\Google\Chrome\User Data\Default\Preferences
G0 - GCSP: Preference [User Data\Default][HomePage] http://www.msn.com
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Wallet v.0.0.6.1 (Activé)
~ Google Browser: 13 Legitimates Filtered in 00mn 22s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\foot\AppData\Roaming\Mozilla\Firefox\Profiles\kj9vll58.default\prefs.js
M3 - MFPP: Plugins - [foot] -- C:\Users\foot\AppData\Roaming\Mozilla\Firefox\Profiles\kj9vll58.default\searchplugins\babylon.xml =>PUP.Babylon
M3 - MFPP: Plugins - [foot] -- C:\Users\foot\AppData\Roaming\Mozilla\Firefox\Profiles\kj9vll58.default\searchplugins\delta.xml =>Toolbar.DeltaSearch
M3 - MFPP: Plugins - [foot] -- C:\Program Files\Mozilla FireFox\searchplugins\Search_Results.xml =>PUP.SearchResults
M2 - MFEP: prefs.js [foot - kj9vll58.default\d019febe-eb2b-4057-a3f2-7def88f2c9cd@1cced8ec-0ffe-43ea-b4b2-fbce5de8e9a4.com] [] Plus-HD-4.9 v (..) =>Adware.PlusHD
~ Firefox Browser: 39 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\Userinit.exe,
F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 22



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: avast! Online Security - [HKLM]{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} . (.AVAST Software - IE Webrep plugin.) -- C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{DB8954F5-F2AF-4701-B43C-64AB2EA5CA61} Clé orpheline
~ Toolbar: Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: Complete Installation of Lexmark 2600 Series.LNK - Clé orpheline
O4 - GS\Desktop [Public]: eMule.lnk . (.http://www.emule-project.net - eMule.) -- C:\Program Files\eMule\Nouveau dossier\eMule\emule.exe
O4 - GS\Desktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O4 - GS\Desktop [Public]: PokerStars.fr.lnk . (.PokerStars - PokerStars Update.) -- C:\Program Files\PokerStars.FR\PokerStarsUpdate.exe
O4 - GS\Program [Public]: DVD Play.lnk . (.CyberLink Corp. - HP DVDPlay.) -- C:\Program Files\HP\DVDPlay\DVDPlay.exe
O4 - GS\Program [Public]: Ecouter la radio.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe =>.Microsoft Corporation
O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O4 - GS\QuickLaunch [foot]: Ecouter la radio.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe =>.Microsoft Corporation
O4 - GS\QuickLaunch [foot]: Google Chrome (2).lnk . (.Google Inc. - Google Chrome.) -- C:\Users\foot\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [foot]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\foot\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [foot]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch [foot]: Media Player Classic - Home Cinema.lnk . (.MPC-HC Team - Media Player Classic - Home Cinema.) -- C:\Program Files\Media Player Classic - Home Cinema\mpc-hc.exe
O4 - GS\QuickLaunch [foot]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O4 - GS\QuickLaunch [foot]: PokerStars.fr.lnk . (.PokerStars - PokerStars Update.) -- C:\Program Files\PokerStars.FR\PokerStarsUpdate.exe
O4 - GS\Program [foot]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [foot]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop [foot]: 07.Les.Aventures.De.Tintin.Le.Sceptre.D.Ottokar.FRENCH.DVDRIP.XVID-KzK [Bonne qualité, grande taille] - Raccourci.lnk . (...) -- C:\Users\foot\dzCache\Documents\FFOutput\07.Les.Aventures.De.Tintin.Le.Sceptre.D.Ottokar.FRENCH.DVDRIP.XVID-KzK [Bonne qualité, grande taille].avi
O4 - GS\Desktop [foot]: 16 Spiderman 1967 Dessins animés.29. Le vautour s’y plie - DVDRIP par pcrochet divx 6.2.5_converted_converted - Raccourci.lnk . (...) -- C:\Users\foot\dzCache\Documents\FFOutput\16 Spiderman 1967 Dessins animés.29. Le vautour s’y plie - DVDRIP par pcrochet divx 6.2.5_converted_converted.avi
O4 - GS\Desktop [foot]: 2012-07-31 anir et rayan - Raccourci.lnk . (...) -- C:\Users\foot\Pictures\2012-07-31 anir et rayan
O4 - GS\Desktop [foot]: ANIR ET NOE - Raccourci.lnk - Clé orpheline
O4 - GS\Desktop [foot]: ANNIVERSAIRE ANIR - Raccourci.lnk - Clé orpheline
O4 - GS\Desktop [foot]: CDBurnerXP.lnk . (.Canneverbe Limited - CDBurnerXP.) -- C:\Program Files\CDBurnerXP\cdbxpp.exe
O4 - GS\Desktop [foot]: Contrôleurs de jeu - Raccourci.lnk - Clé orpheline
O4 - GS\Desktop [foot]: Dessin animé-Spiderman 1967 Dessins animés - Le sorcier diabolique - Rippé par pcrochet Divx 6.1.1 - Raccourci.lnk . (...) -- C:\Users\foot\dzCache\Documents\FFOutput\Dessin animé-Spiderman 1967 Dessins animés - Le sorcier diabolique - Rippé par pcrochet Divx 6.1.1.avi
O4 - GS\Desktop [foot]: Fr - Dessins Animés - Spiderman - 04- Électro L'étincelle Humaine - 1972 - Raccourci.lnk . (...) -- C:\Users\foot\dzCache\Documents\FFOutput\Fr - Dessins Animés - Spiderman - 04- Électro L'étincelle Humaine - 1972.avi
O4 - GS\Desktop [foot]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\foot\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [foot]: Incoming - Raccourci (2).lnk . (...) -- C:\Program Files\music\Incoming
O4 - GS\Desktop [foot]: Incoming - Raccourci.lnk . (...) -- C:\Program Files\music\Incoming
O4 - GS\Desktop [foot]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop [foot]: Media Player Classic - Home Cinema.lnk . (.MPC-HC Team - Media Player Classic - Home Cinema.) -- C:\Program Files\Media Player Classic - Home Cinema\mpc-hc.exe
O4 - GS\Desktop [foot]: Mobogenie.lnk . (...) -- C:\Program Files\Mobogenie\Mobogenie.exe =>PUP.Mobogenie
O4 - GS\Desktop [foot]: PokerStars.fr.lnk . (.PokerStars - PokerStars Update.) -- C:\Program Files\PokerStars.FR\PokerStarsUpdate.exe
O4 - GS\Desktop [foot]: RocketPDF.lnk . (...) -- C:\Program Files\RocketPDF\RocketPDF.exe (.not file.)
O4 - GS\Desktop [foot]: SpeedanAlysis.lnk - Clé orpheline =>PUP.SpeedAnalysis
O4 - GS\Desktop [foot]: ZHPFix.lnk . (.Nicolas Coolman - ZHPDiag Setup.) -- C:\Program Files\ZHPDiag\ZHPFix\ZHPhep.exe =>.Nicolas Coolman
~ Global Startup: 91 Legitimates Filtered in 00mn 03s



---\\ Applications lancées au démarrage du sytème (O4)
O4 - HKLM\..\Run: [Windows Defender] . (.Microsoft Corporation - Windows Defender User Interface.) -- C:\Program Files\Windows Defender\MSASCui.exe
O4 - HKLM\..\Run: [hpsysdrv] . (.Hewlett-Packard Company - hpsysdrv.) -- c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [OsdMaestro] . (.OsdMaestro - OsdMaestro main program.) -- C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - HD Audio Control Panel.) -- C:\WINDOWS\RtHDVCpl.exe =>.Realtek Semiconductor Corp
O4 - HKLM\..\Run: [HP Health Check Scheduler] . (.Hewlett-Packard - HP Health Check Scheduler.) -- c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKLM\..\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe
O4 - HKLM\..\Run: [TkBellExe] . (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files\Real\RealPlayer\update\realsched.exe =>.RealNetworks, Inc
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Run: [AvastUI.exe] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
O4 - HKLM\..\Run: [mobilegeni daemon] . (...) -- C:\Program Files\Mobogenie\DaemonProcess.exe =>PUP.Mobogenie
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKCU\..\Run: [HPAdvisor] . (.Hewlett-Packard - HP Advisor.) -- C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
O4 - HKCU\..\Run: [ccleaner] . (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner.exe =>Piriform Ltd
O4 - HKCU\..\Run: [FileHippo.com] . (.FileHippo.com - FileHippo.com Update Checker.) -- C:\Program Files\FileHippo.com\UpdateChecker.exe
O4 - HKCU\..\Run: [Neuf Media Center] C:\Program Files\SFR\Media Center\MediaCenter.exe (.not file.)
O4 - HKCU\..\Run: [Super MP3 Download] C:\Program Files\SuperMp3Download\SuperMp3Download.exe (.not file.)
O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\foot\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc
O4 - HKCU\..\Run: [CollaborationHost] . (.Microsoft Corporation - Voisinage immédiat.) -- C:\Windows\system32\p2phost.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] Clé orpheline
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] Clé orpheline
O4 - HKUS\S-1-5-21-3370209625-2929641822-4270462028-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Volet Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-3370209625-2929641822-4270462028-1000\..\Run: [HPAdvisor] . (.Hewlett-Packard - HP Advisor.) -- C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
O4 - HKUS\S-1-5-21-3370209625-2929641822-4270462028-1000\..\Run: [ccleaner] . (.Piriform Ltd - CCleaner.) -- C:\Program Files\CCleaner\CCleaner.exe =>Piriform Ltd
O4 - HKUS\S-1-5-21-3370209625-2929641822-4270462028-1000\..\Run: [FileHippo.com] . (.FileHippo.com - FileHippo.com Update Checker.) -- C:\Program Files\FileHippo.com\UpdateChecker.exe
O4 - HKUS\S-1-5-21-3370209625-2929641822-4270462028-1000\..\Run: [Neuf Media Center] C:\Program Files\SFR\Media Center\MediaCenter.exe (.not file.)
O4 - HKUS\S-1-5-21-3370209625-2929641822-4270462028-1000\..\Run: [Super MP3 Download] C:\Program Files\SuperMp3Download\SuperMp3Download.exe (.not file.)
O4 - HKUS\S-1-5-21-3370209625-2929641822-4270462028-1000\..\Run: [Google Update] . (.Google Inc. - Programme d'installation de Google.) -- C:\Users\foot\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc
O4 - HKUS\S-1-5-21-3370209625-2929641822-4270462028-1000\..\Run: [CollaborationHost] . (.Microsoft Corporation - Voisinage immédiat.) -- C:\Windows\system32\p2phost.exe
~ Application: Scanned in 00mn 00s



---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} . (.Microsoft Corporation - Windows Live Messenger Companion core resources.) -- C:\Program Files\Windows Live\Companion\companionres.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} . (.Microsoft Corporation - Windows Live Writer Blog This Extension.) -- C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} ((no name)) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} ((no name)) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
~ Objets ActiveX: Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7754D77-8D0F-40C8-AEA7-2325366CF2E0}: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{F7754D77-8D0F-40C8-AEA7-2325366CF2E0}: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{F7754D77-8D0F-40C8-AEA7-2325366CF2E0}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{F7754D77-8D0F-40C8-AEA7-2325366CF2E0}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.254
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (.Microsoft Corporation - Windows Live Album Download Protocol Handle.) -- C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter: application/x-msdownload - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\WINDOWS\System32\mscoree.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\WINDOWS\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s



---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Bibliothèque de l'interface utilisateur du.) -- C:\WINDOWS\System32\browseui.dll
~ STS/SSO: Scanned in 00mn 00s



---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: BayerHealthcareService (BayerHealthcareService) . (.Bayer Healthcare LLC - Bayer Healthcare Service.) - C:\Program Files\Bayer HealthCare SmartLaunch\bin\BayerHCService.exe
O23 - Service: RealNetworks Downloader Resolver Service (RealNetworks Downloader Resolver Service) . (...) - C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
~ Services: 10 Legitimates Filtered in 00mn 08s



---\\ Tâches planifiées en automatique (O39)
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\Plus-HD-4.9-chromeinstaller.job [1948] =>Adware.PlusHD
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\Plus-HD-4.9-codedownloader.job [1216] =>Adware.PlusHD
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\Plus-HD-4.9-enabler.job [1116] =>Adware.PlusHD
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\Plus-HD-4.9-firefoxinstaller.job [2078] =>Adware.PlusHD
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\Plus-HD-4.9-updater.job [1314] =>Adware.PlusHD
[MD5.90A64787EF51413479E44E0669116CE1] [APT] [Plus-HD-4.9-chromeinstaller] (.Plus HD.) -- C:\Program Files\Plus-HD-4.9\Plus-HD-4.9-chromeinstaller.exe [832872] =>Adware.PlusHD
[MD5.5C6D3F84769CA34156392D4065700920] [APT] [Plus-HD-4.9-codedownloader] (.Plus HD.) -- C:\Program Files\Plus-HD-4.9\Plus-HD-4.9-codedownloader.exe [528232] =>Adware.PlusHD
[MD5.D2B48154D86135C93C744F4531AF7C95] [APT] [Plus-HD-4.9-enabler] (.Plus HD.) -- C:\Program Files\Plus-HD-4.9\Plus-HD-4.9-enabler.exe [348520] =>Adware.PlusHD
[MD5.61F935C026F0D50E7786616DB3598441] [APT] [Plus-HD-4.9-firefoxinstaller] (.Plus HD.) -- C:\Program Files\Plus-HD-4.9\Plus-HD-4.9-firefoxinstaller.exe [890728] =>Adware.PlusHD
[MD5.25081264BE938982FFB12BD438CAE340] [APT] [Plus-HD-4.9-updater] (.Plus HD.) -- C:\Program Files\Plus-HD-4.9\Plus-HD-4.9-updater.exe [358248] =>Adware.PlusHD
[MD5.00000000000000000000000000000000] [APT] [{00DAB01C-C463-443B-9A0F-285A3B21BDF9}] (...) -- C:\Users\foot\Downloads\wmp11-windowsxp-x86-FR-FR(2).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{0624A493-F8F7-4327-9194-130C2E7DBBE0}] (...) -- C:\Users\foot\Downloads\ToolsCleaner2.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{082B52B5-6CB7-4CD2-AD56-D38DFBBC5B09}] (...) -- C:\Users\foot\Downloads\vlc(2).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{26C172EB-51FE-4AF9-B140-61DEBA0DD98D}] (...) -- C:\Users\foot\Downloads\Flash_Disinfector.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{555ABE3E-8034-41F2-89C5-7A8D1BF185B2}] (...) -- C:\Program Files\eRightSoft\SUPER\Setup.exe (.not file.) [0]
[MD5.CD2F87B25BF7B09BD07252D8851A7BA6] [APT] [{58E27087-338F-4650-BD0A-65FFAA9DCC1A}] (...) -- C:\Program Files\VideoLAN\VLC\uninstall.exe [224460]
[MD5.00000000000000000000000000000000] [APT] [{5E926894-4E2A-44D7-852C-5F27BED40AF4}] (...) -- C:\Users\foot\Downloads\pf-setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{86D16FB2-C0DB-4EDB-95DA-F255210EA7F9}] (...) -- C:\Users\foot\Downloads\wmp11-windowsxp-x86-FR-FR.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{93FA79D7-2D86-4F0F-8713-A9089382ED91}] (...) -- C:\Users\foot\Downloads\Nero-6.6.1.15_fra.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{A00B26BF-55E2-424A-ACA4-834FDD554DD1}] (...) -- C:\Users\foot\Downloads\radio_fr_v2.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{D7275D01-74FD-4626-8F09-E3EC71B6B238}] (...) -- C:\Users\foot\Downloads\burrrn_package.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{E061BC4F-C9D1-4A8A-847A-09C31467D7C9}] (...) -- C:\Program Files\PokerStars\PokerStarsUninstall.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{EABD4A48-AFAA-4923-B153-C5ECE4F43368}] (...) -- C:\Users\foot\dzCache\Documents\telechargements\Update\r1puninst.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{F93A70CC-86EE-4ABC-811F-493BB9BF1966}] (...) -- C:\Users\foot\Downloads\eMule0.49c-Installer(2).exe (.not file.) [0]
~ Scheduled Task: 53 Legitimates Filtered in 00mn 05s



---\\ Logiciels installés (O42)
O42 - Logiciel: Plus-HD-4.9 - (.Plus HD.) [HKLM] -- Plus-HD-4.9 =>Adware.PlusHD
O42 - Logiciel: PokerStars.fr - (.PokerStars.fr.) [HKLM] -- PokerStars.fr
~ Logic: 14 Legitimates Filtered in 00mn 01s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\BabylonToolbar] =>PUP.Babylon
[HKCU\Software\BearShare] =>PUP.BearShare
[HKCU\Software\Cote dAzur Palace Casino]
[HKCU\Software\Cr_Installer] =>PUP.CrossRider
[HKCU\Software\Full Tilt Poker]
[HKCU\Software\IM]
[HKCU\Software\Iminent] =>Adware.IMBooster
[HKCU\Software\IncrediMail]
[HKCU\Software\InstalledBrowserExtensions] =>Adware.VidSaver
[HKCU\Software\PokerTrainer]
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKCU\Software\SweetIM] =>PUP.SweetIM
[HKCU\Software\YahooPartnerToolbar]
[HKCU\Software\iLivid] =>Adware.Bandoo
[HKLM\Software\Babylon] =>PUP.Babylon
[HKLM\Software\BearShareSRTB] =>PUP.BearShare
[HKLM\Software\Conduit] =>Toolbar.Conduit
[HKLM\Software\Cote dAzur Palace Casino]
[HKLM\Software\Datamngr] =>PUP.Datamngr
[HKLM\Software\Full Tilt Poker]
[HKLM\Software\Iminent] =>Adware.IMBooster
[HKLM\Software\Services x86] =>PUP.CrossRider
[HKLM\Software\SweetIM] =>PUP.SweetIM
[HKLM\Software\iLividSRTB] =>Adware.Bandoo
~ Key Software: 297 Legitimates Filtered in 00mn 01s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 16/07/2012 - 08:38:27 - [0,609] ----D C:\Program Files\Conduit
O43 - CFD: 08/05/2013 - 19:48:42 - [0,663] ----D C:\Program Files\Iminent =>Adware.IMBooster
O43 - CFD: 18/06/2010 - 17:14:11 - [1861,514] ----D C:\Program Files\music
O43 - CFD: 13/01/2014 - 13:17:33 - [5,594] ----D C:\Program Files\Plus-HD-4.9 =>Adware.PlusHD
O43 - CFD: 12/02/2014 - 13:43:08 - [139,511] ----D C:\Program Files\PokerStars.FR
O43 - CFD: 04/02/2014 - 12:55:43 - [0] ----D C:\Program Files\SweetPacks =>PUP.SweetIM
O43 - CFD: 08/05/2013 - 17:53:45 - [0] ----D C:\ProgramData\Babylon =>PUP.Babylon
O43 - CFD: 22/04/2013 - 17:26:22 - [0] ----D C:\ProgramData\boost_interprocess
O43 - CFD: 24/03/2013 - 00:09:03 - [0] ----D C:\ProgramData\Browser Manager
O43 - CFD: 22/04/2013 - 17:26:13 - [0,004] ----D C:\ProgramData\DD5
O43 - CFD: 17/02/2014 - 17:08:44 - [0,003] ----D C:\Users\foot\AppData\Roaming\newnext.me =>PUP.NextLive
O43 - CFD: 23/08/2013 - 18:53:47 - [0] ----D C:\Users\foot\AppData\Roaming\wam
O43 - CFD: 18/06/2010 - 16:57:58 - [2,677] ----D C:\Users\foot\AppData\Roaming\wam.04351C371E530C3762CBA45FA283ED972DCDEFB6.1
O43 - CFD: 16/07/2012 - 10:08:07 - [0] ----D C:\Users\foot\AppData\Local\Conduit
O43 - CFD: 02/03/2014 - 02:21:43 - [0] ----D C:\Users\foot\AppData\Local\genienext
O43 - CFD: 13/01/2014 - 11:45:56 - [0] ----D C:\Users\foot\AppData\Local\Plus-HD-4.9 =>Adware.PlusHD
O43 - CFD: 29/06/2010 - 18:29:30 - [159,968] ----D C:\Users\foot\AppData\Local\PokerStars
O43 - CFD: 15/02/2014 - 12:04:49 - [15,437] ----D C:\Users\foot\AppData\Local\PokerStars.FR
~ 3 Dossiers CLSID vides (CLSID Empty Folders)
~ Program Folder: 209 Legitimates Filtered in 00mn 04s



---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.32D487A8B2C273C4C0E90770EF1663B0] - 01/03/2014 - 13:49:18 ---A- - C:\WINDOWS\Prefetch\33.0.1750.117_32.0.1700.107_C-44FCC524.pf
O45 - LFCP:[MD5.6048DF409C0AC53BF4BCA531186A0945] - 02/03/2014 - 12:21:06 ---A- - C:\WINDOWS\Prefetch\GLUCOFACTS DELUXE SMART LAUNC-6DC087EB.pf
O45 - LFCP:[MD5.C537882843FA8B308422A0F2CBCEEC16] - 02/03/2014 - 12:22:25 ---A- - C:\WINDOWS\Prefetch\NDP451-KB2858725-X86-X64-ENU.-313AAD3D.pf
O45 - LFCP:[MD5.901C9565F6B498778E64CC708F01A046] - 02/03/2014 - 12:26:09 ---A- - C:\WINDOWS\Prefetch\BAYERHCSERVICE.EXE-E7D92973.pf
O45 - LFCP:[MD5.AC389B5807A011AC3BF51035B5987152] - 02/03/2014 - 12:29:00 ---A- - C:\WINDOWS\Prefetch\CNMSE8S.EXE-172E5D65.pf
O45 - LFCP:[MD5.1885631F668C5ADCAB2422951E29C947] - 02/03/2014 - 18:08:54 ---A- - C:\WINDOWS\Prefetch\IGFXCFG.EXE-C969DCE9.pf
O45 - LFCP:[MD5.7341591094A4635CF533C4B893514D55] - 02/03/2014 - 18:43:28 ---A- - C:\WINDOWS\Prefetch\REMENGINE.EXE-CA86924A.pf
O45 - LFCP:[MD5.515D48F7396F364E80BD4AF3FF673315] - 03/03/2014 - 12:01:17 ---A- - C:\WINDOWS\Prefetch\NDP45-KB2901126-X86.EXE-F59B1524.pf
O45 - LFCP:[MD5.F29286C4B7A6199ED119382A94256F21] - 03/03/2014 - 12:04:59 ---A- - C:\WINDOWS\Prefetch\NDP45-KB2898869-X86.EXE-B790BB65.pf
O45 - LFCP:[MD5.D578FBE506B746262CD5BCE8D05C78BB] - 03/03/2014 - 12:08:05 ---A- - C:\WINDOWS\Prefetch\NDP451-KB2858725-X86-X64-FRA.-C5516F02.pf
O45 - LFCP:[MD5.8048F3FE6EEC546C73188A636E2339CA] - 04/03/2014 - 12:42:40 ---A- - C:\WINDOWS\Prefetch\LXDNCOMS.EXE-9EACE90B.pf
O45 - LFCP:[MD5.54BE8452D97F4A247F7882DC195CC4FA] - 04/03/2014 - 13:29:03 ---A- - C:\WINDOWS\Prefetch\33.0.1750.146_33.0.1750.117_C-722A3B82.pf
O45 - LFCP:[MD5.9D28C0F9780F97B3F7971EE72A312E8F] - 04/03/2014 - 20:07:49 ---A- - C:\WINDOWS\Prefetch\HPHC.EXE-4C6EDC30.pf
O45 - LFCP:[MD5.71C00DCD251D6DD77611F697C01E46F9] - 04/03/2014 - 20:29:03 ---A- - C:\WINDOWS\Prefetch\PLUS-HD-4.9-FIREFOXINSTALLER.-DE7B80E9.pf =>Adware.PlusHD
O45 - LFCP:[MD5.E1E24B353089424540D9D629771DAD0A] - 04/03/2014 - 20:30:00 ---A- - C:\WINDOWS\Prefetch\PLUS-HD-4.9-CODEDOWNLOADER.EX-F1D54A5E.pf =>Adware.PlusHD
O45 - LFCP:[MD5.E35E63C8643F1B0B89519E1C1EE787D6] - 04/03/2014 - 20:30:00 ---A- - C:\WINDOWS\Prefetch\PLUS-HD-4.9-ENABLER.EXE-5C428BA1.pf =>Adware.PlusHD
O45 - LFCP:[MD5.53E8314CAD50F3F25F460ECD93555BAE] - 05/03/2014 - 00:43:12 ---A- - C:\WINDOWS\Prefetch\INSTUP.EXE-033E266D.pf
O45 - LFCP:[MD5.6207C67E3AC8BBE76D799EB40D628F94] - 05/03/2014 - 14:56:54 ---A- - C:\WINDOWS\Prefetch\WLXQUICKTIMECONTROLHOST.EXE-43313B7C.pf
O45 - LFCP:[MD5.3E655FC44DA79A857B2818F9DD74AE35] - 05/03/2014 - 15:51:59 ---A- - C:\WINDOWS\Prefetch\MGUSB.EXE-03B14200.pf
~ Prefetcher: 140 Legitimates Filtered in 00mn 01s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.F385467DF95D0A73775CB3B076B8B969] - 26/11/2013 - 11:57:21 ---A- . (...) -- C:\WINDOWS\System32\Drivers\aswRvrt.sys [49944]
O58 - SDL:[MD5.6488153ABD58C75FD21DB4F28C0D03C1] - 26/11/2013 - 11:57:07 ---A- . (.The OpenVPN Project - TAP-Windows Virtual Network Driver.) -- C:\WINDOWS\System32\Drivers\aswTap.sys [35272]
O58 - SDL:[MD5.1B0662514A68C3A42E60D240C5ABEF28] - 01/01/2014 - 13:21:21 ---A- . (...) -- C:\WINDOWS\System32\Drivers\aswVmm.sys [180248]
O58 - SDL:[MD5.E8F3F21A71720C84BCF423B80028359F] - 02/11/2006 - 10:51:34 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\WINDOWS\System32\Drivers\elxstor.sys [316520]
O58 - SDL:[MD5.BCED60D16156E428F8DF8CF27B0DF150] - 02/11/2006 - 10:50:07 ---A- . (.Integrated Technology Express, Inc. - ITE IT8211 ATA/ATAPI SCSI miniport.) -- C:\WINDOWS\System32\Drivers\iteatapi.sys [35944]
O58 - SDL:[MD5.06FA654504A498C30ADCA8BEC4E87E7E] - 02/11/2006 - 10:50:09 ---A- . (.Integrated Technology Express, Inc. - ITE IT8212 ATA RAID SCSI miniport.) -- C:\WINDOWS\System32\Drivers\iteraid.sys [35944]
O58 - SDL:[MD5.566C5FD480FDBCE3BA5CF9FBCFFAEA9A] - 09/10/2008 - 14:42:42 ---A- . (.Windows (R) Codename Longhorn DDK provider - KMWDFilter Driver from UASSOFT.COM.) -- C:\WINDOWS\System32\Drivers\KMWDFILTER.sys [17408]
O58 - SDL:[MD5.F92254B0BCFCD10CAAC7BCCC7CB7F467] - 12/11/2009 - 14:48:56 ---A- . (...) -- C:\WINDOWS\System32\Drivers\StarOpen.sys [7168]
O58 - SDL:[MD5.3CD4EA35A6221B85DCC25DAA46313F8D] - 02/11/2006 - 10:51:25 ---A- . (.ULi Electronics Inc. - ULi SATA Controller Driver.) -- C:\WINDOWS\System32\Drivers\uliahci.sys [235112]
O58 - SDL:[MD5.8514D0E5CD0534467C5FC61BE94A569F] - 02/11/2006 - 10:50:35 ---A- . (.Promise Technology, Inc. - Promise Ultra/Sata Series Driver for Win2003.) -- C:\WINDOWS\System32\Drivers\ulsata.sys [98408]
O58 - SDL:[MD5.38C3C6E62B157A6BC46594FADA45C62B] - 02/11/2006 - 10:50:45 ---A- . (.Promise Technology, Inc. - Promise SATAII150 Series Windows Drivers.) -- C:\WINDOWS\System32\Drivers\ulsata2.sys [115816]
O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 02/11/2006 - 08:09:42 ---A- . (...) -- C:\WINDOWS\System32\ANSI.SYS [9029]
O58 - SDL:[MD5.0FE9F16075C9ACB941C957B7C649176E] - 02/11/2006 - 08:09:45 ---A- . (...) -- C:\WINDOWS\System32\country.sys [27097]
O58 - SDL:[MD5.E6BC0F98FECEF245A0010D350C1A0B9B] - 02/11/2006 - 08:09:41 ---A- . (...) -- C:\WINDOWS\System32\HIMEM.SYS [4768]
O58 - SDL:[MD5.492090267B9608C62B956CD29BE3AFB7] - 02/11/2006 - 08:09:44 ---A- . (...) -- C:\WINDOWS\System32\KEY01.SYS [42809]
O58 - SDL:[MD5.FBBCFEC1379C5C02D88A361993EDF1B8] - 02/11/2006 - 08:09:44 ---A- . (...) -- C:\WINDOWS\System32\KEYBOARD.SYS [42537]
O58 - SDL:[MD5.FFFF296A08DBF2AC0126C62E3778AC0D] - 02/11/2006 - 08:09:29 ---A- . (...) -- C:\WINDOWS\System32\NTDOS.SYS [27866]
O58 - SDL:[MD5.CF9ED169FF86D935E47999E82359E898] - 02/11/2006 - 08:09:35 ---A- . (...) -- C:\WINDOWS\System32\NTDOS404.SYS [29146]
O58 - SDL:[MD5.03B945AC0481CD8BB161C3569D8ED1C3] - 02/11/2006 - 08:09:38 ---A- . (...) -- C:\WINDOWS\System32\NTDOS411.SYS [29370]
O58 - SDL:[MD5.BBC957DC18C17CC027EB80B7C77F2AEA] - 02/11/2006 - 08:09:40 ---A- . (...) -- C:\WINDOWS\System32\NTDOS412.SYS [29274]
O58 - SDL:[MD5.3CFFAEFFF23B0D208214A6D3061A5B1B] - 02/11/2006 - 08:09:31 ---A- . (...) -- C:\WINDOWS\System32\NTDOS804.SYS [29146]
O58 - SDL:[MD5.2E4112FB7D1B76E11ADFD7487B5D0E95] - 02/11/2006 - 08:09:20 ---A- . (...) -- C:\WINDOWS\System32\NTIO.SYS [33952]
O58 - SDL:[MD5.A98EBD4C2DF983665BF2D1AF49949974] - 02/11/2006 - 08:09:23 ---A- . (...) -- C:\WINDOWS\System32\NTIO404.SYS [34672]
O58 - SDL:[MD5.3F7E6406EDEF197C5CAAB2240EEF6F48] - 02/11/2006 - 08:09:24 ---A- . (...) -- C:\WINDOWS\System32\NTIO411.SYS [35776]
O58 - SDL:[MD5.3E64D681B776CC57BDC38A46D881F85B] - 02/11/2006 - 08:09:26 ---A- . (...) -- C:\WINDOWS\System32\NTIO412.SYS [35536]
O58 - SDL:[MD5.D86B6435729231C171432B4E77801BDB] - 02/11/2006 - 08:09:22 ---A- . (...) -- C:\WINDOWS\System32\NTIO804.SYS [34672]
~ Drivers: 15 Legitimates Filtered in 00mn 02s



---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 02/03/2014 - 15:53:51 ---A- . (...) -- C:\Users\foot\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.1.377\_platform_specific\win_x86\widevinecdmadapter.dll [113992]
O61 - LFC: 02/03/2014 - 15:54:49 ---A- . (...) -- C:\Users\foot\GLUCOFACTS Deluxe\.barracuda_rmi.info [76]
O61 - LFC: 02/03/2014 - 15:54:49 ---A- . (...) -- C:\Users\foot\GLUCOFACTS Deluxe\GlucofactsLogs.zip [951770]
O61 - LFC: 03/03/2014 - 15:53:52 ---A- . (...) -- C:\Users\foot\AppData\Local\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\33.0.1750.146\33.0.1750.146_33.0.1750.117_chrome_updater.exe [786136]
O61 - LFC: 04/03/2014 - 15:53:44 ---A- . (...) -- C:\Users\foot\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt [5]
O61 - LFC: 04/03/2014 - 15:53:50 ---A- . (...) -- C:\Users\foot\AppData\Local\Google\Chrome\User Data\Local State [62632]
O61 - LFC: 04/03/2014 - 15:53:51 ---A- . (...) -- C:\Users\foot\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.1.377\_platform_specific\win_x86\CdmAdapterVersion [13]
O61 - LFC: 05/03/2014 - 15:54:35 ---A- . (...) -- C:\Users\foot\AppData\Roaming\ZHP\Log.txt [39083] =>.Nicolas Coolman
O61 - LFC: 05/03/2014 - 15:54:35 ---A- . (...) -- C:\Users\foot\AppData\Roaming\ZHP\TestsZHPDiag.txt [2797] =>.Nicolas Coolman
O61 - LFC: 05/03/2014 - 15:54:35 ---A- . (...) -- C:\Users\foot\AppData\Roaming\ZHP\ZHPDiag.txt [63485] =>.Nicolas Coolman
O61 - LFC: 05/03/2014 - 15:54:35 ---A- . (...) -- C:\Users\foot\daemonprocess.txt [14676]
O61 - LFC: 05/03/2014 - 15:54:39 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\+youtube [514430]
O61 - LFC: 05/03/2014 - 15:54:39 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\105672438530291867387 [296762]
O61 - LFC: 05/03/2014 - 15:54:39 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\bXs3QVxDRFj [133476]
O61 - LFC: 05/03/2014 - 15:54:39 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\channels [456341]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\Greements_de_Fortune_Music_U_re_My_Love_2008_wmv_medium(1).mp4 [4567070]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\Greements_de_Fortune_Music_U_re_My_Love_2008_wmv_small(1).3gpp [1577653]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\Greements_de_Fortune_Music_U_re_My_Love_2008_wmv_small(1).mp4 [2723156]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\Greements_de_Fortune_Music_U_re_My_Love_2008_wmv_small.3gpp [3512825]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\UC-9-kyTW8ZkZNDHQJ6FgpwQ [294021]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\UC-d6Tbxsl5BMljHJWxmjV8g [759616]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\UC1ZbAhz9iRR_AT5XQHlkrnw [332933]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\UCEgdi0XIXXZ-qJOFPf4JSKw [482884]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\UCGjylN-4QCpn8XJ1uY-UOgA [184691]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\UCOpNcN46UbXVtpKMrmU4Abg [309006]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\UCUD4yDVyM54QpfqGJX4S7ng [396179]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\UCY30JRSgfhYXA6i6xX1erWg [397127]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\UCmzy72gDEpfXoFV9Xdtd0DQ [401797]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\UCoLrcjPV5PbUrUyXq5mjc_A [452008]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\UCpprdiXpqe_9ptggJJkHJWg [322124]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\comment [124619]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\comment(1) [124623]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\cookies [9670]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\funkyom9450 [70806]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\giacchina63 [70755]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\grooves63 [212470]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\jiinfo [13991]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\music [293855]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\signin [21350]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\signin(1) [21344]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\subscription_manager [59126]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\terms [47079]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\testtube [21366]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\upload [59066]
O61 - LFC: 05/03/2014 - 15:54:40 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\videos [129514]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch [124154]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(1) [126459]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(10) [125763]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(11) [121221]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(12) [125680]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(13) [124583]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(14) [138643]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(15) [121656]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(16) [118206]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(17) [124206]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(18) [139618]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(19) [122086]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(2) [128046]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(20) [128771]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(21) [124226]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(3) [123281]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(4) [118814]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(5) [129403]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(6) [121539]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(7) [126872]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(8) [122460]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch(9) [135761]
O61 - LFC: 05/03/2014 - 15:54:41 ---A- . (...) -- C:\Users\foot\dzCache\Documents\telechargements\watch_as3.swf [289612]
~ 5 Fichiers temporaires (Temporary files)
~ Files: 361 Legitimates Filtered in 01mn 13s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\foot\AppData\Local\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: <>[HKLM\..\Shell\open\Command] (.Not Key.)
~ Keys: Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.crossrider.bic", "143713684a1b09bbe404cf03fed04724"); =>PUP.CrossRider
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.admin", false);
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.aflt", "babsst srcExt=def");
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.autoRvrt", "false");
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.dfltLng", "en");
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.excTlbr", false);
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.ffxUnstlRst", true);
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.id", "ce57f0b7000000000000001e90601103");
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.instlDay", "15833");
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.instlRef", "sst");
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.newTab", false);
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.prdct", "delta");
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.prtnrId", "delta");
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.rvrt", "false");
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.smplGrp", "none");
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.tlbrId", "base");
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.tlbrSrchUrl", "");
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.vrsn", "1.8.16.16");
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.vrsnTs", "1.8.16.1618:54:20");
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("extensions.delta.vrsni", "1.8.16.16");
O69 - SBI: prefs.js [foot - kj9vll58.default] user_pref("weboftrust.search.ask.display", "Ask.com Web Search");
O69 - SBI: SearchScopes [HKCU] E805D7FBC346468E8D5D3F0FAC717ABF - (MyStart Search) - http://mystart.incredibar.com =>Adware.IncrediBar
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} - (Delta Search) - http://www2.delta-search.com =>Toolbar.DeltaSearch
O69 - SBI: SearchScopes [HKCU] {5A3F3271-2C20-41AB-AD64-3E9EFE38B3B2} - (Google) - http://www.google.fr
O69 - SBI: SearchScopes [HKCU] {9BB47C17-9C68-4BB3-B188-DD9AF0FD22} - (Search Results) - http://dts.search-results.com =>PUP.SearchResults
O69 - SBI: SearchScopes [HKCU] {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} - (Search Results) - http://dts.search-results.com =>PUP.SearchResults
O69 - SBI: SearchScopes [HKCU] {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} [DefaultScope] - (MyStart Search) - http://mystart.incredibar.com =>Adware.IncrediBar
O69 - SBI: SearchScopes [HKUS\.DEFAULT] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - () - http://search.live.com
O69 - SBI: SearchScopes [HKUS\S-1-5-18] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - () - http://search.live.com
~ Keys: Scanned in 00mn 00s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][21/03/2010] (...) -- C:\Users\foot\AppData\Roaming\wklnhst.dat [0]
[MD5.6E76BE10C88A00A124A903E155C4A1CE] [SPRF][30/07/2013] (.DownloadHelper - ConvertHelper Setup.) -- C:\Users\foot\Desktop\ConvertHelperSetup.exe [3782822]
[MD5.5CBD3DBC8A108830EA9762D4CB4FCEBD] [SPRF][05/09/2013] (.Tonec Inc. - Internet Download Manager installer.) -- C:\Users\foot\Desktop\idman617b8.exe [5248344]
[MD5.4EB4E7137B18BC6931B4E152204BD8E5] [SPRF][05/09/2013] (...) -- C:\Users\foot\Desktop\RealPlayer_fr-16.0.0.282.exe [7232]
~ Files: 10 Legitimates Filtered in 00mn 02s



---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{04F863E7-6AE5-4228-AFD5-13B737D0F23F}" |In - Private - P17 - FALSE | .(...) -- C:\Program Files\PhotoJoy\Bin\PjApp.exe (.not file.)
O87 - FAEL: "TCP Query User{854FBBCB-7E85-4D4A-B1C4-C5CF9A894803}C:\program files\nosibay\mon widget rmc\mon widget rmc.exe" |In - Private - P6 - TRUE | .(...) -- C:\program files\nosibay\mon widget rmc\mon widget rmc.exe (.not file.)
O87 - FAEL: "UDP Query User{9193C016-872F-4EBF-9463-B4CB7D48D964}C:\program files\nosibay\mon widget rmc\mon widget rmc.exe" |In - Private - P17 - TRUE | .(...) -- C:\program files\nosibay\mon widget rmc\mon widget rmc.exe (.not file.)
O87 - FAEL: "{938BC799-D59F-4EF1-B6B4-4D86D783F2C9}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe (.not file.)
O87 - FAEL: "{9010125D-6C60-4291-8D40-68D2071A1E93}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files\Lecteur CANALPLAY\CanalPlayer.exe (.not file.)
O87 - FAEL: "TCP Query User{85EA4B70-759D-452B-A91F-809182CF0131}C:\users\foot\appdata\roaming\nosibay\bubble dock\bubble dock.exe" |In - Private - P6 - TRUE | .(...) -- C:\users\foot\appdata\roaming\nosibay\bubble dock\bubble dock.exe (.not file.) =>PUP.BubbleDock
O87 - FAEL: "UDP Query User{84164376-1844-441D-A44C-3AD2CE6F070C}C:\users\foot\appdata\roaming\nosibay\bubble dock\bubble dock.exe" |In - Private - P17 - TRUE | .(...) -- C:\users\foot\appdata\roaming\nosibay\bubble dock\bubble dock.exe (.not file.) =>PUP.BubbleDock
O87 - FAEL: "TCP Query User{0BABB10B-5184-4E13-BBB7-2AE434CEC68F}C:\program files\bearshare applications\bearshare\bearshare.exe" |In - Public - P6 - TRUE | .(...) -- C:\program files\bearshare applications\bearshare\bearshare.exe (.not file.) =>PUP.BearShare
O87 - FAEL: "UDP Query User{F96DF82C-E169-41F7-8A7F-9755EC34997A}C:\program files\bearshare applications\bearshare\bearshare.exe" |In - Public - P17 - TRUE | .(...) -- C:\program files\bearshare applications\bearshare\bearshare.exe (.not file.) =>PUP.BearShare
O87 - FAEL: "{58D99F31-F9CE-4FA9-8723-6BEF2A30D2BE}" |In - Domain - P6 - TRUE | .(...) -- C:\Program Files\BearShare Applications\BearShare\BearShare.exe (.not file.) =>PUP.BearShare
O87 - FAEL: "{1090DF18-4F72-4381-8781-4CC15C2E9093}" |In - Domain - P17 - TRUE | .(...) -- C:\Program Files\BearShare Applications\BearShare\BearShare.exe (.not file.) =>PUP.BearShare
O87 - FAEL: "{B99CBE1D-E338-412D-B1A4-08E3CA1680DB}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files\BearShare Applications\BearShare\BearShare.exe (.not file.) =>PUP.BearShare
O87 - FAEL: "{903E529E-8280-4AFD-912B-E7A5856AE2B9}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files\BearShare Applications\BearShare\BearShare.exe (.not file.) =>PUP.BearShare
O87 - FAEL: "{B60313E6-681F-40D3-A2C5-81DC37A7B42B}" |In - Public - P6 - TRUE | .(...) -- C:\WINDOWS\System32\dmwu.exe (.not file.)
O87 - FAEL: "{7DC0544E-BB4A-4E51-8F35-3ADEE9A06B4D}" |In - Public - P17 - TRUE | .(...) -- C:\WINDOWS\System32\dmwu.exe (.not file.)
~ Firewall: 209 Legitimates Filtered in 00mn 02s



---\\ Export de clés de registre aléatoires (O91)
[HKLM\Software\853dbdee23cbe46] => Clé orpheline
~ Export Key Software: Scanned in 00mn 00s



---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.ED925AB61715A8C259B4E86A45B1DB54] [WIS][02/03/2014] (.Bayer HealthCare - GLUCOFACTS(TM) Deluxe Smart Launch.) -- C:\Windows\Installer\849fe.msi [1173504]
~ WIS: 90 Legitimates Filtered in 00mn 05s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 01/03/2014 257928 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 22/10/2004 73728 | (IDriverT) . (.Macrovision Corporation.) - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
SS - | Demand 05/12/2013 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Demand 11/05/2007 887544 | (RoxMediaDB9) . (.Sonic Solutions.) - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

SR - | Auto 18/12/2013 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 21/12/2012 57008 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 09/02/2014 50344 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
SR - | Auto 14/07/2012 134584 | (BayerHealthcareService) . (.Bayer Healthcare LLC.) - C:\Program Files\Bayer HealthCare SmartLaunch\bin\BayerHCService.exe
SR - | Auto 30/08/2011 390504 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Auto 24/05/2007 61440 | (HP Health Check Service) . (.Hewlett-Packard.) - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
SR - | Auto 28/11/2007 589824 | (lxdn_device) . (...) - C:\Windows\system32\lxdncoms.exe
SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
SR - | Auto 14/08/2013 39056 | (RealNetworks Downloader Resolver Service) . (...) - C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
SR - | Auto 19/01/2008 21504 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\WINDOWS\System32\svchost.exe
SR - | Auto 19/01/2008 21504 | C:\WINDOWS\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\WINDOWS\System32\svchost.exe

~ Services: Scanned in 00mn 06s



---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by foot at 05/03/2014 15:56:00

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS intelide.sys PCIIDEX.SYS atapi.sys
1 ntkrnlpa!IofCallDriver[0x82C80916] >> \Device\Harddisk0\DR0[0x85BF7338]
kernel: MBR read successfully
user & kernel MBR OK

~ MBR: 13 Legitimates Filtered in 00mn 02s



---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by foot at 05/03/2014 15:56:02

********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin

~ MBR: Scanned in 00mn 04s



---\\ Scan Additionnel (O88)
Database Version : 13031 - (03/03/2014)
Clés trouvées (Keys found) : 92
Valeurs trouvées (Values found) : 3
Dossiers trouvés (Folders found) : 14
Fichiers trouvés (Files found) : 18

[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Plus-HD-4.9] =>Adware.PlusHD^
[HKLM\Software\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}] =>Adware.Agent
[HKLM\Software\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}] =>Adware.IMBooster
[HKLM\Software\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}] =>Adware.IMBooster
[HKLM\Software\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}] =>Adware.IMBooster
[HKLM\Software\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}] =>Adware.IMBooster
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9}] =>PUP.Babylon
[HKLM\Software\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}] =>PUP.RewardsArcade
[HKLM\Software\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}] =>PUP.RewardsArcade
[HKLM\Software\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}] =>Adware.iWinArcade
[HKLM\Software\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}] =>PUP.RewardsArcade
[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}] =>Adware.IMBooster
[HKLM\Software\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}] =>PUP.RewardsArcade
[HKLM\Software\Classes\TypeLib\{8B3372D0-09F0-41A5-8D9B-134E148672FB}] =>Adware.PriceGong
[HKLM\Software\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}] =>PUP.RewardsArcade
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}] =>Adware.Bandoo
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}] =>Adware.Bandoo
[HKLM\Software\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}] =>PUP.RewardsArcade
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}] =>Adware.Bandoo
[HKLM\Software\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}] =>PUP.RewardsArcade
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}] =>Adware.IncrediBar
[HKLM\Software\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}] =>PUP.RewardsArcade
[HKLM\Software\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}] =>PUP.RewardsArcade
[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08}] =>Adware.IMBooster
[HKLM\Software\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}] =>PUP.RewardsArcade
[HKLM\Software\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}] =>PUP.RewardsArcade
[HKLM\Software\Classes\AppID\PriceGongIE.DLL] =>Adware.PriceGong
[HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\IMBoosterARP] =>Adware.IMBooster
[HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\pricegong] =>Adware.PriceGong
[HKLM\Software\Classes\PriceGongIE.PriceGongCtrl] =>Adware.PriceGong
[HKLM\Software\Classes\PriceGongIE.PriceGongCtrl.1] =>Adware.PriceGong
[HKCU\Software\BabylonToolbar] =>PUP.Babylon
[HKCU\Software\Cr_Installer] =>PUP.CrossRider
[HKLM\Software\DataMngr] =>Adware.Bandoo
[HKLM\Software\iLividSRTB] =>Adware.Bandoo
[HKCU\Software\ilivid] =>Adware.Bandoo
[HKCU\Software\Iminent] =>Adware.IMBooster
[HKLM\Software\Iminent] =>Adware.IMBooster
[HKCU\Software\AppDataLow\Software\PriceGong] =>Adware.PriceGong
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKCU\Software\SweetIM] =>PUP.SweetIM
[HKLM\Software\SweetIM] =>PUP.SweetIM
[HKLM\Software\Services x86] =>PUP.CrossRider
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP] =>Adware.IMBooster
[HKLM\Software\Classes\Prod.cap] =>PUP.Babylon
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375] =>PUP.Tarma
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5] =>PUP.Tarma
[HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}] =>Toolbar.Yahoo
[HKCU\Software\AppDataLow\Software\Crossrider] =>PUP.CrossRider
[HKCU\Software\InstalledBrowserExtensions\] =>PUP.CrossRider
[HKLM\Software\Classes\Installer\Features\4301AEBD288588A40833184CFEC0AF92] =>Adware.iWinArcade
[HKLM\Software\Classes\Installer\Products\4301AEBD288588A40833184CFEC0AF92] =>Adware.iWinArcade
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4301AEBD288588A40833184CFEC0AF92] =>Adware.iWinArcade
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\80F08842F9EA1BE4BA4922DA74CDB698] =>Adware.iWinArcade
[HKCU\Software\InstalledBrowserExtensions] =>PUP.CrossRider
[HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}] =>Toolbar.Yahoo
[HKLM\Software\Classes\CrossriderApp0045918.BHO] =>PUP.CrossRider
[HKLM\Software\Classes\CrossriderApp0045918.Sandbox] =>PUP.CrossRider
[HKLM\Software\Classes\CrossriderApp0045918.Sandbox.1] =>PUP.CrossRider
[HKLM\Software\Classes\Toolbar.CT1066435] =>Toolbar.Conduit
[HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220422592218}] =>PUP.CrossRider
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD22}] =>Adware.Bandoo^
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:mobilegeni daemon =>PUP.Mobogenie^
C:\Users\foot\AppData\Roaming\Mozilla\Firefox\Profiles\kj9vll58.default\extensions\d019febe-eb2b-4057-a3f2-7def88f2c9cd@1cced8ec-0ffe-43ea-b4b2-fbce5de8e9a4.com =>Adware.PlusHD^
C:\Program Files\Iminent =>Adware.IMBooster^
C:\Program Files\Plus-HD-4.9 =>Adware.PlusHD^
C:\Program Files\SweetPacks =>PUP.SweetIM^
C:\ProgramData\Babylon =>PUP.Babylon^
C:\Users\foot\AppData\Roaming\newnext.me =>PUP.NextLive^
C:\Users\foot\AppData\Local\Plus-HD-4.9 =>Adware.PlusHD^
C:\Program Files\BearShare Applications =>PUP.BearShare
C:\Program Files\Conduit =>Toolbar.Conduit
C:\ProgramData\Browser Manager =>PUP.Babylon
C:\Users\foot\AppData\Local\Conduit =>Toolbar.Conduit
C:\Users\foot\AppData\LocalLow\searchresultstb =>Toolbar.Agent
C:\Users\foot\AppData\LocalLow\Conduit =>Toolbar.Conduit
C:\Users\foot\AppData\LocalLow\PriceGong =>Adware.PriceGong
C:\Program Files\Mobogenie\DaemonProcess.exe =>PUP.Mobogenie^
C:\Program Files\Mobogenie\mgusb.exe =>PUP.Mobogenie^
C:\WINDOWS\Tasks\Plus-HD-4.9-chromeinstaller.job =>Adware.PlusHD^
C:\WINDOWS\Tasks\Plus-HD-4.9-codedownloader.job =>Adware.PlusHD^
C:\WINDOWS\Tasks\Plus-HD-4.9-enabler.job =>Adware.PlusHD^
C:\WINDOWS\Tasks\Plus-HD-4.9-firefoxinstaller.job =>Adware.PlusHD^
C:\WINDOWS\Tasks\Plus-HD-4.9-updater.job =>Adware.PlusHD^
C:\Program Files\Plus-HD-4.9\Plus-HD-4.9-chromeinstaller.exe =>Adware.PlusHD^
C:\Program Files\Plus-HD-4.9\Plus-HD-4.9-codedownloader.exe =>Adware.PlusHD^
C:\Program Files\Plus-HD-4.9\Plus-HD-4.9-enabler.exe =>Adware.PlusHD^
C:\Program Files\Plus-HD-4.9\Plus-HD-4.9-firefoxinstaller.exe =>Adware.PlusHD^
C:\Program Files\Plus-HD-4.9\Plus-HD-4.9-updater.exe =>Adware.PlusHD^
[HKCU\Software\BearShare] =>PUP.BearShare^
[HKCU\Software\iLivid] =>Adware.Bandoo^
[HKLM\Software\Babylon] =>PUP.Babylon^
[HKLM\Software\BearShareSRTB] =>PUP.BearShare^
[HKLM\Software\Conduit] =>Toolbar.Conduit^
[HKLM\Software\Datamngr] =>PUP.Datamngr^
~ Additionnel Scan: 265942 Items scanned in 00mn 44s



---\\ Récapitulatif des détections trouvées sur votre station
~ http://nicolascoolman.webs.com/apps/blog/show/41034005-pup-mobogenie =>PUP.Mobogenie
~ http://nicolascoolman.webs.com/apps/blog/show/26627369-toolbar-babylon =>PUP.Babylon
~ http://nicolascoolman.webs.com/apps/blog/show/27875657-toolbar-deltasearch =>Toolbar.DeltaSearch
~ http://nicolascoolman.webs.com/apps/blog/show/30319724-pup-searchresults =>PUP.SearchResults
~ http://nicolascoolman.webs.com/apps/blog/show/28138048-adware-plushd =>Adware.PlusHD
~ http://nicolascoolman.webs.com/apps/blog/show/28153012-pup-speedanalysis =>PUP.SpeedAnalysis
~ http://nicolascoolman.webs.com/apps/blog/show/26705717-pup-bearshare =>PUP.BearShare
~ http://nicolascoolman.webs.com/apps/blog/show/27583526-pup-crossrider =>PUP.CrossRider
~ http://nicolascoolman.webs.com/apps/blog/show/26684723-adware-imbooster =>Adware.IMBooster
~ http://nicolascoolman.webs.com/apps/blog/show/27557062-adware-vidsaver =>Adware.VidSaver
~ http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit
~ http://nicolascoolman.webs.com/apps/blog/show/29216159-pup-sweetim =>PUP.SweetIM
~ http://nicolascoolman.webs.com/apps/blog/show/26611092-adware-bandoo =>Adware.Bandoo
~ http://nicolascoolman.webs.com/apps/blog/show/27583992-pup-datamngr =>PUP.Datamngr
~ http://nicolascoolman.webs.com/apps/blog/show/40528410-pup-nextlive =>PUP.NextLive
~ http://nicolascoolman.webs.com/apps/blog/show/26898222-adware-incredibar =>Adware.Incredibar
~ http://nicolascoolman.webs.com/apps/blog/show/31746142-toolbar-bubbledock =>Toolbar.BubbleDock
~ http://nicolascoolman.webs.com/apps/blog/show/28000037-pup-rewardsarcade =>PUP.RewardsArcade
~ http://nicolascoolman.webs.com/apps/blog/show/28766471-adware-iwinarcade =>Adware.iWinArcade
~ http://nicolascoolman.webs.com/apps/blog/show/26666995-adware-pricegong =>Adware.PriceGong
~ http://nicolascoolman.webs.com/apps/blog/show/29637859-toolbar-tarma =>PUP.Tarma
~ MSI: 21 link(s) detected in 00mn 44s



~ 1704 Legitimates filtered by white list
End of the scan (867 lines in 04mn 34s)(0)