---\\ Navigateurs Internet MSIE: Internet Explorer v MFIE: Mozilla Firefox 26.0 (Defaut)

Transcription

1 ~ Rapport de ZHPDiag v Nicolas Coolman (25/01/2014) ~ Lancé par mireille (28/01/ :53:43) ~ Adresse du Site Web ~ Forums gratuits d'assistance à la désinfection : ~ Traduit par Nicolas Coolman ~ Etat de la version : ~ Liste blanche : Activée par le programme ~ Elévation des Privilèges : OK ~ User Account Control (UAC): Activate by user ---\\ Navigateurs Internet MSIE: Internet Explorer v MFIE: Mozilla Firefox 26.0 (Defaut) ---\\ Informations sur les produits Windows ~ Langage: Français Windows 7 Professional, 32-bit Service Pack 1 (Build 7601) Windows Server License Manager Script : OK ~ Windows(R) 7, OEM_COA_NSLP channel Windows ID Activation : OK ~ Windows Partial Key : RPBD9 Windows License : OK ~ Windows Remaining Initializations Number : 5 Software Protection Service (Protection logicielle) : OK Windows Automatic Updates : OK Windows Activation Technologies : OK ---\\ Logiciels de protection du système avast! Free Antivirus v Malwarebytes Anti-Malware version Norton Internet Security v Windows Defender W7 ---\\ Logiciels d'optimisation du système CCleaner v4.09 =>Piriform Ltd ---\\ Logiciels de partage PeerToPeer ---\\ Surveillance de Logiciels Adobe Flash Player 12 Plugin Adobe Reader XI Java 7 Update \\ Informations sur le système ~ Processor: x86 Family 6 Model 23 Stepping 6, GenuineIntel ~ Operating System: 32 Bits Boot mode: Normal (Normal boot) Total RAM: 3039 MB (68% free) System Restore: Activé (Enable) System drive C: has 178 GB (80%) free of 221 GB ---\\ Mode de connexion au système ~ Computer Name: PC-DE-MIREILLE ~ User Name: mireille ~ All Users Names: mireille, HomeGroupUser$, Administrateur, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\\ Variables d'environnement ~ System Unit : C:\ ~ %AppZHP% : C:\Users\mireille\AppData\Roaming\ZHP\ ~ %AppData% : C:\Users\mireille\AppData\Roaming\ ~ %Desktop% : C:\Users\mireille\Desktop\ ~ %Favorites% : C:\Users\mireille\Favorites\ ~ %LocalAppData% : C:\Users\mireille\AppData\Local\ ~ %StartMenu% : C:\Users\mireille\AppData\Roaming\Microsoft\Windows\Start Menu\

2 ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ZHPDiag.txt ---\\ Enumération des unités disques C: Hard drive, Flash drive, Thumb drive (Free 178 Go of 221 Go) D: Hard drive, Flash drive, Thumb drive (Free 11 Go of 12 Go) E: CD-ROM drive (Not Inserted) ---\\ Etat du Centre de Sécurité Windows [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowNetConn: Modified ~ Security Center: 50 Legitimates Filtered in 00mn 00s ---\\ Recherche particulière de fichiers génériques [MD5.8B88EBBB05A0E56B7DCC708498C02B3E] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011-6:30:54.) -- C:\Windows\Explorer.exe [ ] [MD5.B5C5DCAD D D665] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009-2:14:45.) -- C:\Windows\System32\Wininit.exe [96256] [MD5.927FA6456AD6D7630F D2FD16B] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.26/11/2013-7:33:33.) -- C:\Windows\System32\wininet.dll [ ] [MD5.6D13E1406F50C66E2A95D97F22C47560] - (.Microsoft Corporation - Application d ouverture de session Windows.) (.20/11/ :17:54.) -- C:\Windows\System32\Winlogon.exe [286720] [MD5.E3AE DE12D45BA3B489A036AE] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/ :21:24.) -- C:\Windows\System32\sppcomapi.dll [193536] [MD5.F81BB7E487EDCEAB630A7EE66CF23913] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.14/09/2013-1:48:58.) -- C:\Windows\system32\Drivers\AFD.sys [338944] [MD5.338C C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009-2:26:15.) -- C:\Windows\system32\Drivers\atapi.sys [21584] [MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009-0:11:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656] [MD5.BE167ED0FDB9C1FA C18D5A6C9] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010-9:38:10.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544] [MD5.F024449C97EC1E464AAFFDA18593DB88] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010-9:42:32.) -- C:\Windows\system32\Drivers\DfsC.sys [78336] [MD B8A6C15DC2EEC53E489D159B5] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/ :59:29.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544] [MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009-0:11:24.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896] [MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009-0:54:29.) -- C:\Windows\system32\Drivers\IpNat.sys [101888] [MD5.5D16C921E C0EBA3BBAAC5FD25] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011-3:17:22.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123904] [MD DDCF04B378EDD1AD54D71C1E54] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010-9:39:44.) -- C:\Windows\system32\Drivers\netBT.sys [187904] [MD5.5E43D2B0EE64123D4880DFA6626DEFDE] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/ :45:29.) -- C:\Windows\system32\Drivers\ntfs.sys [ ] [MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009-0:45:35.) -- C:\Windows\system32\Drivers\Parport.sys [79360]

3 [MD5.D9F91EAFEC CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.14/07/2009-0:54:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848] [MD5.B973FCFC50DC1434E1970A146F7E3885] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.20/11/ :24:46.) -- C:\Windows\system32\Drivers\rdpdr.sys [133632] [MD5.3E21C083B8A01CB70BA1F FCE] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009-0:53:41.) -- C:\Windows\system32\Drivers\smb.sys [71168] [MD5.B C20E8121D6039DA063C704] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010-9:39:17.) -- C:\Windows\system32\Drivers\tdx.sys [74752] [MD5.F497F67932C6FA693D7DE CFE7] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/ :30:16.) -- C:\Windows\system32\Drivers\volsnap.sys [245632] ~ Generic Processes: Scanned in 00mn 00s ---\\ Etat des fichiers cachés (Caché/Total) ~ Mes musiques (My Musics) : 168/713 ~ Mes Videos (My Videos) : 1/5704 ~ Mes Favoris (My Favorites) : 1/32 ~ Mes Documents (My Documents) : 2/5700 ~ Mon Bureau (My Desktop) : 1/32 ~ Menu demarrer (Programs) : 1/78 ~ Hidden Files: Scanned in 00mn 02s ---\\ Processus lancés [MD5.8CB896C573FD15AE8B13180DA53E93D2] - (.Hewlett-Packard Development Company, L.P. - HPWAMain Module.) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [488752] [PID.3636] [MD5.A78AAB0D2D70EF7DD56B7328AC502059] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe [ ] [PID.3644] [MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336] [PID.3780] [MD5.1EDC4865C8003A B1] - (.Pas de propriétaire - HpqToaster Module.) -- C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe [685360] [PID.3304] [MD5.CA25CAEEBDBE25D F684F8] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [ ] [PID.2776] ~ Processes Running: Scanned in 00mn 00s ---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3) C:\Users\mireille\AppData\Roaming\Mozilla\Firefox\Profiles\6msgzmkt.default \prefs.js C:\Users\mireille\AppData\Roaming\Mozilla\Firefox\Profiles\6msgzmkt.default \user.js M3 - MFPP: Plugins - [mireille] -- C:\Program Files\Mozilla FireFox\searchplugins\SearchResults.xml M2 - MFEP: prefs.js [mireille - 6msgzmkt.default \{210249CE-F888-11DD-B868-4CB456D89593}] [] OpenDownload² v3.5.1 (..) P2 - FPN: [HKLM] [@messenger.yahoo.com/yahoomessengerstateplugin;version= ] - (...) -- C:\Program Files\Yahoo!\Shared\npYState.dll (.not file.) P2 - FPN: [HKCU] [@talk.google.com/googletalkplugin] - (...) -- C:\Users\mireille\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (.not file.) P2 - FPN: [HKCU] [@talk.google.com/o1dplugin] - (...) -- C:\Users\mireille\AppData\Roaming\Mozilla\plugins\npo1d.dll (.not file.) ~ Firefox Browser: 28 Legitimates Filtered in 00mn 00s

4 ---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4) R3 - URLSearchHook: SimilarSites - {FE69C007-C452-4d3e-86D2-1730DF8BC871}. (...) (No version) -- (.not file.) R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}. (...) (No version) -- (.not file.) R3 - URLSearchHook: DVDVideoSoftTB Toolbar - {872b5b88-9db bdd0-ac189557e5f5}. (...) (No version) -- (.not file.) R3 - URLSearchHook: (no name) - {8e5025c2-8ea3-430d-80b8-a a6d}. (...) (No version) -- (.not file.) ~ IE Browser: 20 Legitimates Filtered in 00mn 00s ---\\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe ~ Keys: Scanned in 00mn 00s ---\\ Hosts file redirection (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 04s ~ Nombre de lignes (Lines number): \\ Internet Explorer Toolbars (O3) O3 - Toolbar: PDF Architect Toolbar - [HKLM]{25A3A431-30BB-47C8-AD6A-E F}. (.pdfforge GmbH - PDF Architect Toolbar.) -- C:\Program Files\PDF Architect\PDFIEPlugin.dll O3 - Toolbar: avast! Online Security - [HKLM]{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F}. (.AVAST Software - IE Webrep plugin.) -- C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll O3 - Toolbar\WebBrowser: (no name) - [HKCU]{21FA44EF-376D-4D53-9B0F-8A89D } Clé orpheline O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B D4-9B A5CD4F} Clé orpheline O3 - Toolbar\WebBrowser: (no name) - [HKCU]{872B5B88-9DB BDD0-AC189557E5F5} Clé orpheline O3 - Toolbar\WebBrowser: (no name) - [HKCU]{EEE6C35B DC-9C C79847} Clé orpheline ~ Toolbar: Scanned in 00mn 00s ---\\ Autres liens utilisateurs (O4) O4 - GS\Program [Public]: Inkscape.lnk. (.inkscape.org - Inkscape.) --

5 C:\Program Files\Inkscape\inkscape.exe O4 - GS\Program [Public]: KeePass 2.lnk. (.Dominik Reichl - KeePass.) -- C:\Program Files\KeePass Password Safe 2\KeePass.exe O4 - GS\Program [Public]: Mozilla Firefox.lnk. (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O4 - GS\QuickLaunch [mireille]: Inkscape.lnk. (.inkscape.org - Inkscape.) -- C:\Program Files\Inkscape\inkscape.exe O4 - GS\QuickLaunch [mireille]: KeePass 2.lnk. (.Dominik Reichl - KeePass.) -- C:\Program Files\KeePass Password Safe 2\KeePass.exe O4 - GS\QuickLaunch [mireille]: Launch Internet Explorer Browser.lnk. (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\QuickLaunch [mireille]: Mozilla Firefox.lnk. (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O4 - GS\Program [mireille]: Internet Explorer.lnk. (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\SystemTools [mireille]: Internet Explorer (No Add-ons).lnk. (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe =>Hijacker.Qvo6 O4 - GS\SendTo [mireille]: MediaInfo.lnk. (...) -- C:\Program Files\K-Lite Codec Pack\Tools\mediainfo.exe O4 - GS\Desktop [mireille]: AD-R.lnk. (...) -- C:\Program Files\Ad-Remover\main.exe O4 - GS\Desktop [mireille]: gimp-2.8.exe.lnk. (.Spencer Kimball, Peter Mattis and the GIMP - GNU Image Manipulation Program.) -- C:\Program Files\GIMP 2\bin\gimp-2.8.exe O4 - GS\Desktop [mireille]: Inkscape.lnk. (.inkscape.org - Inkscape.) -- C:\Program Files\Inkscape\inkscape.exe O4 - GS\Desktop [mireille]: KeePass 2.lnk. (.Dominik Reichl - KeePass.) -- C:\Program Files\KeePass Password Safe 2\KeePass.exe O4 - GS\Desktop [mireille]: mireillemdp.ods.lnk. (...) -- C:\Users\mireille\Videos\Documents\A-MIREILLE\MDP\mireillemdp.ods O4 - GS\Program [mireille]: Programmes.lnk. (...) -- C:\Program Files O4 - GS\Desktop [mireille]: revenus-depenses2014.ods.lnk. (...) -- C:\Users\mireille\Videos\Documents\A-MIREILLE\BUDGET\revenus-depenses2014.ods O4 - GS\Desktop [mireille]: Temp - Raccourci.lnk. (...) -- C:\Windows\Temp O4 - GS\QuickLaunch [Administrateur]: Facture Facile.lnk. (...) -- C:\Facture_Facile\Facture Facile.exe (.not file.) O4 - GS\TaskBar [Administrateur]: Internet Explorer.lnk. (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Program [Administrateur]: Internet Explorer.lnk. (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\SystemTools [Administrateur]: Internet Explorer (No Add-ons).lnk. (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O4 - GS\Desktop [Administrateur]: AD-R.lnk. (...) -- C:\Program Files\Ad-Remover\main.exe O4 - GS\Desktop [Administrateur]: Gadwin PrintScreen.lnk. (.Gadwin Systems, Inc - Gadwin PrintScreen.) -- C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe O4 - GS\Desktop [Administrateur]: SimpleOCR.lnk. (...) -- C:\Program Files\SimpleOCR\Bin\SimpleOCR.exe ~ Global Startup: 94 Legitimates Filtered in 00mn 00s ---\\ Applications lancées au démarrage du sytème (O4) O4 - GS\Startup [mireille]: wkcalrem.lnk. (...) -- C:\Program Files\Microsoft Works\WkCalRem.exe (.not file.) O4 - HKLM\..\Run: [hpwirelessassistant]. (.Hewlett-Packard Development Company, L.P. - HPWAMain Module.) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [AvastUI.exe]. (.AVAST Software - avast! Antivirus.) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe O4 - HKLM\..\Run: [mobilegeni daemon] C:\Program Files\Mobogenie\DaemonProcess.exe (.not file.) =>PUP.Mobogenie

6 O4 - HKLM\..\Run: [Adobe ARM]. (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated O4 - HKLM\..\Run: [SunJavaUpdateSched]. (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation O4 - HKLM\..\Run: [KeePass 2 PreLoad]. (.Dominik Reichl - KeePass.) -- C:\Program Files\KeePass Password Safe 2\KeePass.exe O4 - HKCU\..\Run: [Google Update]. (.Google Inc. - Programme d'installation de Google.) -- C:\Users\mireille\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc O4 - HKUS\S \..\Run: [Sidebar]. (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation O4 - HKUS\S \..\Run: [Sidebar]. (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe =>.Microsoft Corporation O4 - HKUS\S \..\RunOnce: [mctadmin]. (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation O4 - HKUS\S \..\RunOnce: [mctadmin]. (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation O4 - HKUS\S \..\Run: [Google Update]. (.Google Inc. - Programme d'installation de Google.) -- C:\Users\mireille\AppData\Local\Google\Update\GoogleUpdate.exe =>.Google Inc ~ Application: Scanned in 00mn 00s ---\\ Boutons situés sur la barre d'outils principale d'internet Explorer (O9) O9 - Extra button: Launch WinHTTrack - {36ECAF F84-092E-AFF36D6C7040}. (.Pas de propriétaire - WinHTTrackIEBar Module.) -- C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra button: SimilarSites - {807DF5E0-4EF7-48a8-A F3E29FFA9}. (...) -- C:\Program Files\SimilarSites\hotbtn.ico O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5}. (...) -- C:\Program Files\Skype\Toolbars\Internet Explorer\icon.ico ~ IE Extra Buttons: Scanned in 00mn 00s ---\\ Objets ActiveX (Downloaded Program Files)(O16) O16 - DPF: Microsoft XML Parser for Java - (Microsoft XML Parser for Java) - (.not file.) - C:\Windows\Java\classes\xmldso.cab ~ Objets ActiveX: Scanned in 00mn 00s ---\\ Modification Domaine/Adresses DNS (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{064AF3CD-D230-4D9A-B9F4-48B46561A2EF}: DhcpNameServer = O17 - HKLM\System\CCS\Services\Tcpip\..\{659BF724-9F70-48A8-8F88-2EFAC9067F51}: DhcpNameServer = O17 - HKLM\System\CS1\Services\Tcpip\..\{064AF3CD-D230-4D9A-B9F4-48B46561A2EF}: DhcpNameServer = O17 - HKLM\System\CS1\Services\Tcpip\..\{659BF724-9F70-48A8-8F88-2EFAC9067F51}: DhcpNameServer = O17 - HKLM\System\CS2\Services\Tcpip\..\{064AF3CD-D230-4D9A-B9F4-48B46561A2EF}: DhcpNameServer = O17 - HKLM\System\CS2\Services\Tcpip\..\{659BF724-9F70-48A8-8F88-2EFAC9067F51}: DhcpNameServer = O17 - HKLM\System\CS3\Services\Tcpip\..\{00B06D99-506F-4BA7-B94C FBAEB}: DhcpNameServer = O17 - HKLM\System\CS3\Services\Tcpip\..\{031DFFC D4D-A1CC-A D}: DhcpNameServer = O17 - HKLM\System\CS3\Services\Tcpip\..\{064AF3CD-D230-4D9A-B9F4-48B46561A2EF}: DhcpNameServer = O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = ~ Domain: Scanned in 00mn 00s

7 ---\\ Protocole additionnel (O18) O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B}. (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation O18 - Filter: application/x-msdownload - {1E66F26B-79EE-11D C04F79ED0D}. (.Microsoft Corporation - Microsoft.NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation ~ Protocole Additionnel: Scanned in 00mn 00s ---\\ Liste des services NT non Microsoft et non désactivés (O23) O23 - Service: WinZiper service (winzipersvc). (.Taiwan Shui Mu Chih Ching Technology Limite - update service.) - C:\Program Files\WinZipper\winzipersvc.exe ~ Services: 13 Legitimates Filtered in 00mn 03s ---\\ Enumération Active Desktop & MHTML Editor (O24) O24 - Default MHTML Editor: Last -.(...) - C:\Program Files\Microsoft Office\Office12\WINWORD.exe (.not file.) ~ Desktop Component: 4 Legitimates Filtered in 00mn 00s ---\\ Tâches planifiées en automatique (O39) O39 - APT:Automatic Planified Task - C:\Windows\Tasks\{ E B9-B56E-BE57B0F59F9A}.job [336] O39 - APT:Automatic Planified Task - C:\Windows\Tasks\{2C7BA2CB-FDD2-46EF-819D-6A7F2D3295A0}.job [572] O39 - APT:Automatic Planified Task - C:\Windows\Tasks\{5E383D17-1DE6-433C-A47A-BF2254DF6F96}.job [572] O39 - APT:Automatic Planified Task - C:\Windows\Tasks\{8651B6BD-92CE-4026-B61F-4EEDAC5985F3}.job [550] O39 - APT:Automatic Planified Task - C:\Windows\Tasks\{8FFAF E86-B646-20BFDBF26B45}.job [572] O39 - APT:Automatic Planified Task - C:\Windows\Tasks\{A91CEB98-C425-4BDB-BA ADD9A542}.job [564] O39 - APT:Automatic Planified Task - C:\Windows\Tasks\{BA4E7019-A73A A5-B5E156FA1084}.job [572] ~ Scheduled Task: 34 Legitimates Filtered in 00mn 02s ---\\ Logiciels installés (O42) O42 - Logiciel: SimilarSites - (.SimilarSites.) [HKLM] -- SimilarSites O42 - Logiciel: Update Manager for SweetPacks (.SweetIM Technologies Ltd..) [HKLM] -- {EA8FA6BE-29BE-4AF F83215EB0} ~ Logic: 34 Legitimates Filtered in 00mn 00s ---\\ HKCU & HKLM Software Keys [HKCU\Software\IM] [HKCU\Software\OrdiSoft ] [HKCU\Software\SearchCore for Browsers] =>Adware.SearchCore [HKCU\Software\YahooPartnerToolbar] [HKCU\Software\softonicToolbar] =>Toolbar.Conduit [HKLM\Software\Babylon] =>PUP.Babylon [HKLM\Software\MyAVI] [HKLM\Software\Tarma Installer] =>PUP.Tarma [HKLM\Software\V9] [HKLM\Software\WNLT] =>Adware.IncrediBar [HKLM\Software\asmwsoft]

8 [HKLM\Software\deskSvc] [HKLM\Software\eSafeSecControl] =>PUP.eSafeSecurity ~ Key Software: 370 Legitimates Filtered in 00mn 00s ---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 18/01/ :39:02 - [10,357] ----D C:\Program Files\Free Screenshot Capture O43 - CFD: 6/01/ :59:46 - [3,789] ----D C:\Program Files\MyVideoConverter O43 - CFD: 27/07/ :56:12 - [0,980] ----D C:\Program Files\PDFsvg O43 - CFD: 6/01/ :15:15 - [0,654] ----D C:\Program Files\SimilarSites O43 - CFD: 5/11/ :38:52 - [1,758] ----D C:\Program Files\SweetIM O43 - CFD: 3/11/ :47:26 - [0] ----D C:\ProgramData\boost_interprocess O43 - CFD: 15/01/ :40:02 - [0,697] ----D C:\ProgramData\eSafe =>PUP.eSafeSecurity O43 - CFD: 6/01/ :15:16 - [0] ----D C:\ProgramData\SimilarSites O43 - CFD: 5/11/ :38:55 - [0] ----D C:\ProgramData\SweetIM O43 - CFD: 17/09/ :18:19 - [3,784] ----D C:\ProgramData\Tarma Installer =>PUP.Tarma O43 - CFD: 15/01/ :39:26 - [0] -SH-D C:\ProgramData\{01BD4FC9-2F A62E-774BB7E9D308} O43 - CFD: 27/12/2009-2:07:59 - [0] --H-D C:\ProgramData\{BC9FCCF7-E B-8C9B-55C9A39A7CA9} O43 - CFD: 28/01/ :30:09 - [2,677] ----D C:\Users\mireille\AppData\Roaming\iSafe =>Trojan.Staser O43 - CFD: 6/01/ :15:03 - [0,517] ----D C:\Users\mireille\AppData\Roaming\SimilarSites O43 - CFD: 17/01/ :05:04 - [1,224] ----D C:\Users\mireille\AppData\Local\genienext O43 - CFD: 26/05/ :38:16 - [11,104] ----D C:\Users\mireille\AppData\Local\{E47147F5-BF3C-41FE-9D DEFAF} O43 - CFD: 25/09/ :47:13 - [11,067] ----D C:\Users\mireille\AppData\Local\{EC607B1F-126C-4BF7-A945-BDDFF853B025} O43 - CFD: 18/01/ :39:03 - [0,003] ----D C:\Users\mireille\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Free Screenshot Capture ~ Program Folder: 302 Legitimates Filtered in 00mn 02s ---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44) O44 - LFC:[MD5.5A5CFF37F1BD0F86B9BDAAD7A ] - 15/01/ :47:37 R-HA-. (...) -- C:\Windows\WindowsShell.Manifest [749] O44 - LFC:[MD5.26B0F12F9A4C267AF5B2DA35F87A6EFA] - 16/01/ :54:15 ---A-. (...) -- C:\Windows\System32\DOErrors.log [52] O44 - LFC:[MD5.45FD65C8AF055924E7A9FB9C0D5CDC97] - 17/01/ :37:12 ---A-. (...) -- C:\Ad-Report-SCAN[1].txt [43761] O44 - LFC:[MD5.B3DC4E41805C1F1F054043B09D5A921E] - 19/01/2014-0:19:02 ---A-. (...) -- C:\Ad-Report-SCAN[2].txt [43827] O44 - LFC:[MD5.36F7101A9377BD2124D74D53375F8FDC] - 19/01/2014-0:21:10 ---A-. (...) -- C:\Ad-Report-CLEAN[1].txt [43724] O44 - LFC:[MD5.713D3CCEEEC1CEAE946786ABD93B8EF5] - 19/01/2014-0:28:47 ---A-. (...) -- C:\Ad-Report-CLEAN[2].txt [42968] O44 - LFC:[MD5.88DD2F1F60E520FF324A291A947A76E4] - 21/01/ :37:19 ---A-. (...) -- C:\Ad-Report-CLEAN[3].txt [43035] O44 - LFC:[MD5.CF4A2F359E5B F6A48497F3] - 21/01/ :42:04 ---A-. (...) -- C:\Ad-Report-SCAN[3].txt [43056] O44 - LFC:[MD5.C4FB5F D1CB35466] - 21/01/ :43:29 ---A-. (...) -- C:\Ad-Report-CLEAN[4].txt [43168] O44 - LFC:[MD5.00DC5DDF0E01BE406F97B7D7C3B203CF] - 22/01/ :57:25 ---A-. (...) -- C:\Ad-Report-CLEAN[5].txt [43235] O44 - LFC:[MD5.CDEDE FF1A4DCE FD7] - 23/01/ :42:38 ---A-. (...) -- C:\Ad-Report-CLEAN[6].txt [43302] O44 - LFC:[MD5.B81E43215A00E152FBE27EE8D2CDCD4F] - 25/01/ :42:01 ---A-. (...) -- C:\Ad-Report-CLEAN[7].txt [43369]

9 O44 - LFC:[MD5.394B4D D86D A2A2E86E] - 26/01/ :31:43 ---A-. (...) -- C:\Windows\System32\CNC1751D.TBL [63744] O44 - LFC:[MD5.8A82490DBD2906BAEEA9BBA40D43EE26] - 27/01/2014-9:34:31 ---A-. (...) -- C:\Ad-Report-CLEAN[8].txt [43436] O44 - LFC:[MD5.7B90A56D7AA3FD F8A56] - 28/01/ :34:07 ---A-. (...) -- C:\Ad-Report-CLEAN[9].txt [43504] ~ Files: 57 Legitimates Filtered in 00mn 01s ---\\ Clé de registre Shell MountPoints2 (MPKS) (O51) O51 - MPSK:{1788c3d4-cce7-11e2-a a385fa5}\AutoRun\command. (...) -- O51 - MPSK:{1c92c0cc-04c5-11df-828b-00235a385fa5}\AutoRun\command. (...) -- H:\LaunchU3.exe (.not file.) O51 - MPSK:{6058d816-d444-11df-a5b a385fa5}\AutoRun\command. (...) -- F:\setup_vmc_lite.exe (.not file.) O51 - MPSK:{635e3b5a-c7c8-11e2-8cb a385fa5}\AutoRun\command. (...) -- F:\setup_vmc_lite.exe (.not file.) O51 - MPSK:{635e3b5d-c7c8-11e2-8cb a385fa5}\AutoRun\command. (...) -- F:\setup_vmc_lite.exe (.not file.) O51 - MPSK:{720d898f-c886-11e2-9bdd-00235a385fa5}\AutoRun\command. (...) -- O51 - MPSK:{720d89a8-c886-11e2-9bdd-00235a385fa5}\AutoRun\command. (...) -- O51 - MPSK:{720d89c2-c886-11e2-9bdd-00235a385fa5}\AutoRun\command. (...) -- O51 - MPSK:{81548e0e-c19c-11e0-8cbd-00235a385fa5}\AutoRun\command. (...) -- F:\setup_vmc_lite.exe (.not file.) O51 - MPSK:{81548e11-c19c-11e0-8cbd-00235a385fa5}\AutoRun\command. (...) -- F:\setup_vmc_lite.exe (.not file.) O51 - MPSK:{8bfc9764-dbe4-11e0-889b-00235a385fa5}\AutoRun\command. (...) -- O51 - MPSK:{8bfc9782-dbe4-11e0-889b-00235a385fa5}\AutoRun\command. (...) -- O51 - MPSK:{9475a23c-d467-11e0-896b-00235a385fa5}\AutoRun\command. (...) -- F:\setup_vmc_lite.exe (.not file.) O51 - MPSK:{9475a240-d467-11e0-896b-00235a385fa5}\AutoRun\command. (...) -- F:\setup_vmc_lite.exe (.not file.) O51 - MPSK:{9ec9ffe6-c638-11e2-84a a385fa5}\AutoRun\command. (...) -- H:\setup_vmc_lite.exe (.not file.) O51 - MPSK:{c35ac807-08ee-11e a385fa5}\AutoRun\command. (...) -- F:\LaunchU3.exe (.not file.) O51 - MPSK:{d1f2e88a-091d-11e1-a a385fa5}\AutoRun\command. (...) -- O51 - MPSK:{d1f2e89b-091d-11e1-a a385fa5}\AutoRun\command. (...) -- O51 - MPSK:{f467fd52-c82e-11e2-a a385fa5}\AutoRun\command. (...) -- F:\autorun.exe (.not file.) O51 - MPSK:{f467fd8b-c82e-11e2-a692-00a0c }\AutoRun\command. (...) -- O51 - MPSK:{f467fdbc-c82e-11e2-a692-00a0c }\AutoRun\command. (...) -- O51 - MPSK:{f467fdce-c82e-11e2-a692-00a0c }\AutoRun\command. (...) -- O51 - MPSK:{f467fdda-c82e-11e2-a692-00a0c }\AutoRun\command. (...) -- O51 - MPSK:{f467fdf0-c82e-11e2-a692-00a0c }\AutoRun\command. (...) -- O51 - MPSK:{f467fe57-c82e-11e2-a692-00a0c }\AutoRun\command. (...) -- O51 - MPSK:{fad4eb9a-cc19-11e2-ba a385fa5}\AutoRun\command. (...) -- ~ Keys: Scanned in 00mn 00s ---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)

10 O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0 O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 ~ MWPS: 16 Legitimates Filtered in 00mn 00s ---\\ Liste des pilotes du système (SDL) (O58) O58 - SDL:[MD5.F385467DF95D0A73775CB3B076B8B969] - 22/12/ :59:42 ---A-. (...) -- C:\Windows\System32\Drivers\aswRvrt.sys [49944] O58 - SDL:[MD5.1B A68C3A42E60D240C5ABEF28] - 22/12/ :59:42 ---A-. (...) -- C:\Windows\System32\Drivers\aswVmm.sys [180248] O58 - SDL:[MD5.0ED67910C8C326796FAA00B2BF6D9D3C] - 14/07/2009-2:20:28 ---A-. (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [453712] O58 - SDL:[MD5.6C B31F873D85B25E00BEB984] - 29/04/2008-2:54:58 ---A-. (.ENE TECHNOLOGY INC. - ENE CIR Driver for ehome.) -- C:\Windows\System32\Drivers\enecir.sys [54784] O58 - SDL:[MD5.C44E3C2BAB6837DB337DDEE DB] - 13/07/ :54:14 ---A-. (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for ehome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [26624] O58 - SDL:[MD5.8AAD333C F72B315E162BCC7] - 13/07/ :40:41 ---A-. (...) -- C:\Windows\System32\ANSI.SYS [9029] O58 - SDL:[MD5.0FE9F16075C9ACB941C957B7C649176E] - 13/07/ :40:44 ---A-. (...) -- C:\Windows\System32\country.sys [27097] O58 - SDL:[MD5.E6BC0F98FECEF245A0010D350C1A0B9B] - 13/07/ :40:40 ---A-. (...) -- C:\Windows\System32\HIMEM.SYS [4768] O58 - SDL:[MD B9608C62B956CD29BE3AFB7] - 13/07/ :40:43 ---A-. (...) -- C:\Windows\System32\KEY01.SYS [42809] O58 - SDL:[MD5.FBBCFEC1379C5C02D88A361993EDF1B8] - 13/07/ :40:43 ---A-. (...) -- C:\Windows\System32\KEYBOARD.SYS [42537] O58 - SDL:[MD5.FFFF296A08DBF2AC0126C62E3778AC0D] - 13/07/ :40:23 ---A-. (...) -- C:\Windows\System32\NTDOS.SYS [27866] O58 - SDL:[MD5.CF9ED169FF86D935E47999E82359E898] - 13/07/ :40:31 ---A-. (...) -- C:\Windows\System32\NTDOS404.SYS [29146] O58 - SDL:[MD5.03B945AC0481CD8BB161C3569D8ED1C3] - 13/07/ :40:35 ---A-. (...) -- C:\Windows\System32\NTDOS411.SYS [29370] O58 - SDL:[MD5.BBC957DC18C17CC027EB80B7C77F2AEA] - 13/07/ :40:39 ---A-. (...) -- C:\Windows\System32\NTDOS412.SYS [29274] O58 - SDL:[MD5.3CFFAEFFF23B0D208214A6D3061A5B1B] - 13/07/ :40:27 ---A-. (...) -- C:\Windows\System32\NTDOS804.SYS [29146] O58 - SDL:[MD5.2E4112FB7D1B76E11ADFD7487B5D0E95] - 13/07/ :40:11 ---A-. (...) -- C:\Windows\System32\NTIO.SYS [33952] O58 - SDL:[MD5.A98EBD4C2DF983665BF2D1AF ] - 13/07/ :40:15 ---A-. (...) -- C:\Windows\System32\NTIO404.SYS [34672] O58 - SDL:[MD5.3F7E6406EDEF197C5CAAB2240EEF6F48] - 13/07/ :40:17 ---A-. (...) -- C:\Windows\System32\NTIO411.SYS [35776] O58 - SDL:[MD5.3E64D681B776CC57BDC38A46D881F85B] - 13/07/ :40:19 ---A-. (...) -- C:\Windows\System32\NTIO412.SYS [35536] O58 - SDL:[MD5.D86B C171432B4E77801BDB] - 13/07/ :40:13 ---A-. (...) -- C:\Windows\System32\NTIO804.SYS [34672] ~ Drivers: 16 Legitimates Filtered in 00mn 00s ---\\ Liste des outils de désinfection (LATC) (O63) O63 - Logiciel: Ad-Remover par C_XX - (.C_XX.) [HKLM] -- Ad-Remover O63 - Logiciel: ZHPDiag (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman ~ ADS: Scanned in 00mn 00s ---\\ Associations Shell Spawning (O67) O67 - Shell Spawning: <.exe> <exefile>[hkcu\..\open\command] (.Not Key.) ~ FASS Keys: 11 Legitimates Filtered in 00mn 00s

11 ---\\ Menu de démarrage Internet (SMI) (O68) O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- c:\program files\mozilla firefox\firefox.exe O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- c:\program files\internet explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69) user_pref("ct searchfromaddressbarurl", " rce[...] user_pref("ct http facebook_conduitapps_com.app_win_features", "cmvzaxphymxlptasahnjcm9sbd0wlhzzy3jvbgw9mcx0axrszwjhcj0xl[...] user_pref("ct installid", "conduitinstaller.exe"); =>Adware.Bloson user_pref("ct installtype", "conduitnsisintegration"); user_pref("smartbar.conduithomepageslist", ""); =>Hijacker.SmartBar user_pref("smartbar.conduitsearchenginelist", "01NET.com Customized Web Search"); =>Hijacker.SmartBar user_pref("smartbar.conduitsearchurllist", " rce=2&q[...] =>Hijacker.SmartBar user_pref("smartbar.searchfromaddressbarsavedurl", " user_pref("extensions.crossrider.bic", "143478e03dc ab57b d"); =>PUP.CrossRider user_pref("sweetim.toolbar.userselectedsavesettings", "true"); user_pref("sweetim.toolbar.visibility.visibilityguardlastunhide", " "); user_pref("sweetim.toolbar.visibility.enable", "true"); user_pref("sweetim.toolbar.visibility.intervaldays", "7"); user_pref("sweetim.toolbar.cargo", " "); user_pref("sweetim.toolbar.cda.disableoveride.enable", "true"); user_pref("sweetim.toolbar.cda.hideoveride.enable", "true"); user_pref("sweetim.toolbar.cda.removeoveride.enable", "true"); user_pref("sweetim.toolbar.cda.returnvalue", "hide"); user_pref("sweetim.toolbar.dialogs.0.enable", "true"); user_pref("sweetim.toolbar.dialogs.0.handler", "chrome://sim_toolbar_package/content/optionsdialog-handler.js"); user_pref("sweetim.toolbar.dialogs.0.height", "335"); user_pref("sweetim.toolbar.dialogs.0.id", "id_options_dialog");

12 user_pref("sweetim.toolbar.dialogs.0.title", "$string.config.label;"); user_pref("sweetim.toolbar.dialogs.0.url", " version[...] user_pref("sweetim.toolbar.dialogs.0.width", "761"); user_pref("sweetim.toolbar.dialogs.1.enable", "true"); user_pref("sweetim.toolbar.dialogs.1.handler", "chrome://sim_toolbar_package/content/exampledialog-handler.js"); user_pref("sweetim.toolbar.dialogs.1.height", "300"); user_pref("sweetim.toolbar.dialogs.1.id", "id_example_dialog"); user_pref("sweetim.toolbar.dialogs.1.title", "Example (unit-test) dialog"); user_pref("sweetim.toolbar.dialogs.1.url", "chrome://sim_toolbar_package/content/exampledialog.html"); user_pref("sweetim.toolbar.dialogs.1.width", "500"); user_pref("sweetim.toolbar.dialogs.2.enable", "true"); user_pref("sweetim.toolbar.dialogs.2.handler", "chrome://sim_toolbar_package/content/cdadialog-handler.js"); user_pref("sweetim.toolbar.dialogs.2.height", "150"); user_pref("sweetim.toolbar.dialogs.2.id", "id_dialog_hide_disable_remove"); user_pref("sweetim.toolbar.dialogs.2.title", "Option Dialog"); user_pref("sweetim.toolbar.dialogs.2.url", " user_pref("sweetim.toolbar.dialogs.2.width", "530"); user_pref("sweetim.toolbar.dnscatch.domain-blacklist", ".*.sweetim.com/.*.*.facebook.com/.*.*.google.com/.*.*.google.co.in/.*.[...] user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0"); user_pref("sweetim.toolbar.keywordurlguard.enable", "true"); user_pref("sweetim.toolbar.logger.consolehandler.minreportlevel", "7"); user_pref("sweetim.toolbar.logger.filehandler.filename", "ff-toolbar.log"); user_pref("sweetim.toolbar.logger.filehandler.maxfilesize", "200000"); user_pref("sweetim.toolbar.logger.filehandler.minreportlevel", "7"); user_pref("sweetim.toolbar.mode.debug", "false"); user_pref("sweetim.toolbar.newtab.created", "true");

13 user_pref("sweetim.toolbar.newtab.enable", "true"); user_pref("sweetim.toolbar.previous.browser.startup.homepage", " user_pref("sweetim.toolbar.rc.url", " go;"); user_pref("sweetim.toolbar.scripts.0.addcontextdiv", "true"); user_pref("sweetim.toolbar.scripts.0.callback", "simverification"); user_pref("sweetim.toolbar.scripts.0.domain-blacklist", ""); user_pref("sweetim.toolbar.scripts.0.domain-whitelist", " apps.)?facebook\\.com.*"); user_pref("sweetim.toolbar.scripts.0.elementid", "id_script_sim_fb"); user_pref("sweetim.toolbar.scripts.0.enable", "true"); user_pref("sweetim.toolbar.scripts.0.id", "id_script_fb"); user_pref("sweetim.toolbar.scripts.0.url", " user_pref("sweetim.toolbar.scripts.1.addcontextdiv", "true"); user_pref("sweetim.toolbar.scripts.1.callback", "simverification"); user_pref("sweetim.toolbar.scripts.1.domain-blacklist", ""); user_pref("sweetim.toolbar.scripts.1.domain-whitelist", " apps.)?facebook\\.com.*"); user_pref("sweetim.toolbar.scripts.1.elementid", "id_script_sim_fb"); user_pref("sweetim.toolbar.scripts.1.enable", "false"); user_pref("sweetim.toolbar.scripts.1.id", "id_script_fb_https"); user_pref("sweetim.toolbar.scripts.1.url", " user_pref("sweetim.toolbar.scripts.2.addcontextdiv", "false"); user_pref("sweetim.toolbar.scripts.2.callback", ""); user_pref("sweetim.toolbar.scripts.2.domain-blacklist", ".*.google..*.*.bing..*.*.live..*.*.msn..*.*.yahoo..*.*.youtube.com.*[...] user_pref("sweetim.toolbar.scripts.2.domain-whitelist", ""); user_pref("sweetim.toolbar.scripts.2.elementid", "id_predict_include_script"); user_pref("sweetim.toolbar.scripts.2.enable", "false"); user_pref("sweetim.toolbar.scripts.2.id", "id_script_prad"); user_pref("sweetim.toolbar.scripts.2.url", "

14 user_pref("sweetim.toolbar.search.history.capacity", "10"); user_pref("sweetim.toolbar.searchguard.enable", "false"); user_pref("sweetim.toolbar.searchguard.initialized_by_rc", "true"); user_pref("sweetim.toolbar.simapp_id", "{ E-1EC0-11E2-B1B A385FA5}"); user_pref("sweetim.toolbar.urls.homepage", " 35A385F[...] user_pref("sweetim.toolbar.version", " "); O69 - SBI: SearchScopes [HKCU] ${searchclsid} - (@ieframe.dll,-12512) - O69 - SBI: SearchScopes [HKCU] {0216A0A2-A4B9-3B C53CA40D7E8} - (Google) - O69 - SBI: SearchScopes [HKCU] {04FC935A-31AE-4E8C-B81C-05CC04792EAD} - (Yahoo! Search) - O69 - SBI: SearchScopes [HKCU] {0633EE93-D f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - O69 - SBI: SearchScopes [HKCU] {161168C D5-81A4-0875CCC7F9A3} - (Kelkoo) - O69 - SBI: SearchScopes [HKCU] {3612FE B978-E82DC1D7D1A6} - (Funmoods) - =>PUP.Funmoods O69 - SBI: SearchScopes [HKCU] {9D5BD C BB4186A30F31} - (Bing) - O69 - SBI: SearchScopes [HKCU] {AB02C3C3-E39B-4083-AA9B-7C2071D2B73F} - (Yahoo!) - ~ Keys: Scanned in 00mn 00s ---\\ Recherche particulière à la racine du système (SPRF) (O84) [MD5.97DD C7E8E0DC38351CD07B5F] [SPRF][22/04/2013] (...) -- C:\Users\mireille\AppData\Roaming\wklnhst.dat [4408] [MD C E845BD1EB4340] [SPRF][19/12/2013] (...) -- C:\Program Files\7z922.exe [ ] [MD5.0BE46620F6C1A3B604AB4E D] [SPRF][21/05/2010] (...) -- C:\Program Files\setup.exe [460088] [MD5.B91FE1536AB4D680DDD77469EA3FD4BF] [SPRF][19/12/2013] (...) -- C:\Program Files\vlc win32.exe [ ] [MD FB395954B2638F BAC63] [SPRF][19/12/2013] (...) -- C:\Program Files\wrar501.exe [ ] ~ Files: 6 Legitimates Filtered in 00mn 00s ---\\ Liste des exceptions du parefeu (FirewallRules) (O87) O87 - FAEL: "{4A65DFC4-08DD-47B1-85FF-9F6D0127A22F}" In - Public - P6 - TRUE.(...) -- C:\Windows\System32\dmwu.exe O87 - FAEL: "{432BB9DF-7FD3-47AD-A815-EEF3801D8DAD}" In - Public - P17 - TRUE.(...) -- C:\Windows\System32\dmwu.exe O87 - FAEL: "TCP Query User{E37493F8-C5FE-44CF-BE19-A6D716132D7A}E:\programmation\qtchat\release\qtchat.exe" In - Public - P6 - TRUE.(...) -- E:\programmation\qtchat\release\qtchat.exe (.not file.) O87 - FAEL: "UDP Query User{ CF A16074A94}E:\programmation\qtchat\release\qtchat.exe" In - Public - P17 - TRUE.(...) -- E:\programmation\qtchat\release\qtchat.exe (.not file.) ~ Firewall: 1036 Legitimates Filtered in 00mn 10s

15 ---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS) [MD5.5DE888E9D265586DE818D263542C5632] [WIS][16/01/2014] (.pdfforge GmbH - PDF Architect Installer.) -- C:\Windows\Installer\11bddac.msi [ ] [MD5.5DADE740D278032E2D56BF5CA3BA88AB] [WIS][7/03/2013] (.Research In Motion Ltd. - Blank Project Template.) -- C:\Windows\Installer\30eccf.msi [ ] [MD5.A3AEEC9A9B6984F2E22B90FDC9A23AB8] [WIS][19/12/2013] (.Skype Technologies S.A. - Skype.) -- C:\Windows\Installer\ msi [ ] [MD5.8C141F7E6E294BFC40CCC098F565C411] [WIS][15/01/2014] (.AVG - AVG PC TuneUp 2014.) -- C:\Windows\Installer\a7c6e0.msi [ ] [MD5.6683E8DFD68A973E317F B] [WIS][18/09/2012] (.iwesoft - Free Screenshot Capture Package.) -- C:\Windows\Installer\b7a653.msi [ ] [MD5.BD1D8314AE461D468C4AA4B12FE1CB2C] [WIS][6/07/2009] (.DeviceManagementQFolder - DeviceManagementQFolder.) -- C:\Windows\Installer\ddacd.msi [121344] [MD5.05D5A4ED04580E18EB3A37EA8CC1AC18] [WIS][6/07/2009] (.esupportqfolder - esupportqfolder.) -- C:\Windows\Installer\ddaf1.msi [121344] [MD5.E037B0FFF077511E9AE4C18EB59489B9] [WIS][6/07/2009] (.MPM - MPM.) -- C:\Windows\Installer\ddb2f.msi [193024] [MD F076810F13823DADF218E8413] [WIS][6/07/2009] (.DocumentViewerQFolder - DocumentViewerQFolder.) -- C:\Windows\Installer\ddb35.msi [121344] ~ WIS: 84 Legitimates Filtered in 00mn 02s ---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped) SS - Demand 25/01/ (AdobeFlashPlayerUpdateSvc). (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe SS - Demand 2/03/ (AESTFilters). (.Andrea Electronics Corporation.) - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_ ff \aestsrv.exe SS - Demand 18/01/ (Blackberry Device Manager). (.Research In Motion Limited.) - C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe SS - Demand 3/04/ (Com4QLBEx). (.Hewlett-Packard Development Company, L.P..) - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe SS - Auto 14/07/ C:\Windows\System32\ezsvc7.dll (ezsharedsvc). (.EasyBits Sofware AS.) - C:\Windows\system32\svchost.exe SS - Demand 5/05/ (GameConsoleService). (.WildTangent, Inc..) - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe SS - Auto 18/03/ (hpsrv). (.Hewlett-Packard Corporation.) - C:\Windows\System32\Hpservice.exe SS - Demand 14/11/ (IDriverT). (.Macrovision Corporation.) - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe SS - Demand 9/06/ (LightScribeService). (.Hewlett-Packard Company.) - C:\Program Files\Common Files\LightScribe\LSSrvc.exe SS - Demand 5/12/ (MozillaMaintenance). (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe SS - Auto 23/10/ (SkypeUpdate). (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe SR - Auto 21/12/ (AdobeARMservice). (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe SR - Auto 28/01/ (avast! Antivirus). (.AVAST Software.) - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe SR - Auto 16/06/ (HP Health Check Service). (.Hewlett-Packard.) - c:\program Files\Hewlett-Packard\HP Health Check\hphc_service.exe SR - Demand 14/07/ C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll (hpqcxs08). (.Hewlett-Packard Co..) - C:\Windows\system32\svchost.exe SR - Auto 14/07/ C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll (hpqddsvc). (.Hewlett-Packard Co..) - C:\Windows\system32\svchost.exe SR - Demand 1/05/ (hpqwmiex). (.Hewlett-Packard Development Company, L.P..) - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe SR - Auto 3/10/ (nvsvc). (.NVIDIA Corporation.) -

16 C:\Windows\System32\nvvsvc.exe SR - Auto 8/04/ (PDF Architect Helper Service). (.pdfforge GmbH.) - C:\Program Files\PDF Architect\HelperService.exe SR - Auto 8/04/ (PDF Architect Service). (.pdfforge GmbH.) - C:\Program Files\PDF Architect\ConversionService.exe SR - Auto 6/10/ (Recovery Service for Windows). (...) - C:\Program Files\SMINST\BLService.exe SR - Auto 2/10/ (Skype C2C Service). (.Skype Technologies S.A..) - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe SR - Auto 23/03/ (STacSV). (.IDT, Inc..) - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_ ff \STacSV.exe SR - Auto 17/12/ (TeamViewer9). (.TeamViewer GmbH.) - C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe SR - Auto 14/07/ C:\Program Files\Windows Defender\mpsvc.dll (WinDefend). (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SR - Auto 23/08/ (winzipersvc). (.Taiwan Shui Mu Chih Ching Technology Limite.) - C:\Program Files\WinZipper\winzipersvc.exe SR - Auto 14/07/ C:\Windows\System32\wuaueng.dll (wuauserv). (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe ~ Services: Scanned in 00mn 02s ---\\ Scan Additionnel (O88) Database Version : (25/01/2014) Clés trouvées (Keys found) : 83 Valeurs trouvées (Values found) : 3 Dossiers trouvés (Folders found) : 10 Fichiers trouvés (Files found) : 4 [HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{EA8FA6BE-29BE-4AF F83215EB0}] ^ [HKLM\Software\Classes\AppID\{EA28B360-05E0-4F F1D8D3C}] =>PUP.Funmoods [HKLM\Software\Classes\Interface\{1B730ACF-26A3-447B AEE0EB72CC}] =>Adware.Bandoo [HKLM\Software\Classes\CLSID\{3C F874-49F5-B338-4F214A2EE0B1}] =>Adware.iWinArcade [HKLM\Software\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}] =>Adware.Bandoo [HKLM\Software\Classes\CLSID\{7E84186E-B5DE A66-6E49C6B511B4}] =>Adware.Yontoo [HKLM\Software\Classes\CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}] =>Adware.Yontoo [HKLM\Software\Classes\AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}] =>PUP.Funmoods [HKLM\Software\Classes\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}] =>PUP.Funmoods [HKLM\Software\Classes\CLSID\{ F-621A01D54AD7}] =>Adware.Agent [HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2421}] =>Toolbar.Conduit [HKLM\Software\Classes\AppID\{BDB F-4EAF-B541-F8DE92DD98DB}] =>Adware.CDNHelper [HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4 BDF-B EDDD0C3AE}] =>Adware.Yontoo [HKLM\Software\Classes\CLSID\{E46C8196-B634-44a1-AF6E-957C64278AB1}] =>PUP.Babylon [HKLM\Software\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}] =>Adware.Yontoo [HKLM\Software\Microsoft\Tracing\BingBar_RASMANCS] =>Toolbar.Bing [HKLM\Software\Classes\burn4free project] =>Adware.Burn4Free [HKLM\Software\Classes\esrv.funmoodsESrvc] =>PUP.Funmoods [HKLM\Software\Classes\esrv.funmoodsESrvc.1] =>PUP.Funmoods [HKLM\Software\Google\Chrome\Extensions\ehdmaehkiiampolokajdcelladmnopgp]

17 =>Toolbar.Agent [HKCU\Software\AppDataLow\Software\searchqutoolbar] =>Adware.Bandoo [HKLM\Software\Classes\Installer\Features\EB6AF8AEEB922FA F13812E50B] [HKLM\Software\Classes\Installer\Products\EB6AF8AEEB922FA F13812E50B] [HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S \Prod ucts\eb6af8aeeb922fa f13812e50b] [HKLM\Software\Tarma Installer] =>PUP.Tarma [HKLM\Software\WNLT] =>Adware.IncrediBar [HKLM\Software\Microsoft\Tracing\MyBabylontb_RASAPI32] =>PUP.Babylon [HKLM\Software\Microsoft\Tracing\MyBabylontb_RASMANCS] =>PUP.Babylon [HKLM\Software\Microsoft\Tracing\SearchquMediaBar_RASAPI32] =>Adware.Bandoo [HKLM\Software\Microsoft\Tracing\SearchquMediaBar_RASMANCS] =>Adware.Bandoo [HKLM\Software\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32] =>Adware.Bandoo [HKLM\Software\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS] =>Adware.Bandoo [HKLM\Software\Classes\AppID\{7ABBFE1C-E485-44AA-8F B4124D}] =>PUP.Funmoods [HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ }] =>Adware.VidSaver [HKLM\Software\Classes\Prod.cap] =>PUP.Babylon [HKLM\Software\Microsoft\Tracing\BingBar_RASAPI32] =>Toolbar.Bing [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FE69C007-C452-4d3e-86 D2-1730DF8BC871}] =>Toolbar.Agent [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FE69C007-C452-4d3e -86D2-1730DF8BC871}] =>Toolbar.Agent [HKLM\Software\Classes\CLSID\{FE69C007-C452-4d3e-86D2-1730DF8BC871}] =>Toolbar.Agent [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD 6A-E F}] =>Toolbar.Agent [HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8 -AD6A-E F}] =>Toolbar.Agent [HKLM\Software\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E F}] =>Toolbar.Agent [HKLM\Software\Google\Chrome\Extensions\hidjnkeodmholilgafgdlgmgggbhnigl] =>Adware.SimilarSites [HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4 EFB-9B ECA05670}] =>Toolbar.Yahoo [HKLM\Software\Microsoft\Internet Explorer\extensions\{807DF5E0-4EF7-48a8-A F3E29FFA9}] =>Adware.SimilarSites [HKLM\Software\Classes\CLSID\{872B5B88-9DB BDD0-AC189557E5F5}] =>Toolbar.DVDVideoSoft [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\desksvc] =>Hijacker.22find [HKLM\Software\Classes\Interface\{A36BCB13-778D-4A40-99C1-D686086D268F}] =>Toolbar.SimilarSites [HKLM\Software\eSafeSecControl] =>PUP.eSafeSecurity [HKLM\Software\Microsoft\Tracing\ConduitInstaller_RASAPI32] =>Toolbar.Conduit [HKLM\Software\Microsoft\Tracing\ConduitInstaller_RASMANCS] =>Toolbar.Conduit onents\464aa55239c100f32af2d438eddc0f47] =>Adware.IMBooster onents\5652ba3d5fb98ae31b337bf0af939856] =>Adware.IMBooster onents\86eb95e1afcbabe3db9eccc669b99494] =>Adware.IMBooster [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\eSafeSvc] =>PUP.eSafeSecurity [HKLM\Software\delta-homesSoftware] =>Toolbar.DeltaSearch [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc] =>PUP.eSafeSecurity [HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-1 1D2-892F D4F88}] =>Toolbar.Yahoo [HKCU\Software\AppDataLow\{1146AC44-2F B4FD-889BC837521F}] =>PUP.OptimizerPro

18 [HKLM\Software\{1146AC44-2F B4FD-889BC837521F}] =>PUP.OptimizerPro [HKLM\Software\Classes\CLSID\{1AA D9-4F99-9A55-D0FBFBE7ECD3}] =>Adware.BrowseFox [HKLM\Software\Microsoft\Tracing\apnstub_RASAPI32] =>Toolbar.Ask [HKLM\Software\Microsoft\Tracing\apnstub_RASMANCS] =>Toolbar.Ask [HKLM\Software\Microsoft\Tracing\askpartnercobrandingtool_rasapi32] =>Toolbar.Ask [HKLM\Software\Microsoft\Tracing\askpartnercobrandingtool_rasmancs] =>Toolbar.Ask [HKLM\Software\Microsoft\Tracing\AskInstallChecker_RASAPI32] =>Toolbar.Ask [HKLM\Software\Microsoft\Tracing\AskInstallChecker_RASMANCS] =>Toolbar.Ask [HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{ }] =>PUP.CrossRider [HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ }] =>PUP.CrossRider [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{ }] =>PUP.CrossRider onents\12bf94bd06c95f343a b9556a] ^ onents\2124d8a8cf720fd af560228e] ^ onents\27a325aced8ca4743a adb] ^ onents\350d17402bd84234eaf7d32f08172d7c] ^ onents\3ee8c5f419057e1478a654868cee60b5] ^ onents\4735d908d66e1ba46b6c2d7185a12b2b] ^ onents\76d8378e2ddaed a631f6e3bf0] ^ onents\9a001b259db7d694e818be29b973992c] ^ onents\bae2ec163c6a68a e0e7e199d] ^ onents\c06c6662fa5b e4a ] ^ onents\ceeb3e14abe b0fd762e18f7c6] ^ onents\ed1b5e9a3bdb51349bf96e842c062d98] ^ onents\fecbc2bc14da6cd459bd59a ] ^ [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:mobilegeni daemon =>PUP.Mobogenie^ [HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks]:{8E5025C2-8EA3-430D-80B8-A A6D} =>Toolbar.Agent C:\Program Files\SweetIM ^ C:\ProgramData\eSafe =>PUP.eSafeSecurity^ C:\ProgramData\SweetIM ^ C:\ProgramData\Tarma Installer =>PUP.Tarma^ C:\Users\mireille\AppData\Roaming\iSafe =>Trojan.Staser^ C:\Program Files\SimilarSites =>Adware.SimilarSites C:\ProgramData\SimilarSites =>Adware.SimilarSites C:\Users\mireille\AppData\Roaming\SimilarSites =>Adware.SimilarSites C:\Users\mireille\AppData\LocalLow\searchquband =>Adware.Bandoo C:\Users\mireille\AppData\Roaming\Mozilla\Firefox\Profiles\6msgzmkt.default \Smartbar =>Hijacker.SmartBar C:\Program Files\Mozilla Firefox\searchplugins\SearchResults.xml =>Toolbar.Agent [HKCU\Software\SearchCore for Browsers] =>Adware.SearchCore^ [HKCU\Software\softonicToolbar] =>Toolbar.Conduit^ [HKLM\Software\Babylon] =>PUP.Babylon^ ~ Additionnel Scan: Items scanned in 00mn 23s

19 ---\\ Récapitulatif des détections trouvées sur votre station ~ =>Hijacker.Qvo6 ~ =>PUP.Mobogenie ~ ~ =>Adware.SearchCore ~ =>Toolbar.Conduit ~ =>PUP.Babylon ~ =>PUP.Tarma ~ =>Adware.Incredibar ~ =>PUP.eSafeSecurity ~ =>Trojan.Staser ~ =>Adware.Bloson ~ =>Hijacker.SmartBar ~ =>PUP.CrossRider ~ =>PUP.Funmoods ~ =>Adware.Bandoo ~ =>Adware.iWinArcade ~ =>Adware.Yontoo ~ =>Adware.VidSaver ~ =>Adware.SimilarSites ~ =>Hijacker.22Find ~ =>Adware.IMBooster ~ =>Toolbar.DeltaSearch ~ =>PUP.OptimizerPro ~ =>Adware.BrowseFox ~ =>Toolbar.Ask ~ MSI: 25 link(s) detected in 00mn 23s ~ 2226 Legitimates filtered by white list End of the scan (751 lines in 01mn 11s)(0)