re voici le rapport de ZHPDiag (il a pu finir sens se bloquer ouf)
~ Rapport de ZHPDiag v2013.10.5.15 - Nicolas Coolman (05/10/2013)
~ Lancé par ninie lolo (06/10/2013 12:00:23)
~ Adresse du Site Web
http://nicolascoolman.webs.com ~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user
---\\ Navigateurs Internet
MSIE: Internet Explorer v10.0.9200.16686
MFIE: Mozilla Firefox 24.0 (Defaut)
---\\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
---\\ Logiciels de protection du système
avast! Free Antivirus v8.0.1497.0
Malwarebytes Anti-Malware version 1.75.0.1300
Spybot - Search & Destroy v1.6.2
Windows Defender W7
---\\ Logiciels d'optimisation du système
CCleaner v3.00 =>Piriform Ltd
---\\ Surveillance de Logiciels
Adobe Flash Player 11 Plugin
Adobe Reader XI
Java 7 Update 40
Java 7 Update 25
---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 23 Stepping 10, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 4095 MB (66% free)
System Restore: Activé (Enable)
System drive C: has 87 GB (18%) free of 458 GB
---\\ Mode de connexion au système
~ Computer Name: NINIELOLO-PC
~ User Name: ninie lolo
~ All Users Names: ninie lolo, HomeGroupUser$, Administrateur,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator
---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\ninie lolo\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\ninie lolo\AppData\Roaming\
~ %Desktop% : C:\Users\ninie lolo\Desktop\
~ %Favorites% : C:\Users\ninie lolo\Favorites\
~ %LocalAppData% : C:\Users\ninie lolo\AppData\Local\
~ %StartMenu% : C:\Users\ninie lolo\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 87 Go of 458 Go)
D: Hard drive, Flash drive, Thumb drive (Free 458 Go of 458 Go)
E: CD-ROM drive (Not Inserted)
G: Floppy drive, Flash card reader, USB Key (Not Inserted)
H: Floppy drive, Flash card reader, USB Key (Not Inserted)
I: Floppy drive, Flash card reader, USB Key (Not Inserted)
J: Floppy drive, Flash card reader, USB Key (Not Inserted)
---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
~ Security Center: 31 Legitimates Filtered in 00mn 00s
---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.AAFA952E774DDDB0956D3BDFAE5B5B99] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.10/08/2013 - 06:22:18.) -- C:\Windows\System32\wininet.dll [2241024]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.1C7857B62DE5994A75B054A9FD4C3825] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/12/2011 - 04:59:24.) -- C:\Windows\system32\Drivers\AFD.sys [498688]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.12/04/2013 - 15:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s
---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 3/98
~ Mes musiques (My Musics) : 2/197
~ Mes Videos (My Videos) : 2/5
~ Mes Favoris (My Favorites) : 1/51
~ Mes Documents (My Documents) : 2/404
~ Mon Bureau (My Desktop) : 2/1529
~ Menu demarrer (Programs) : 1/106
~ Hidden Files: Scanned in 00mn 05s
---\\ Processus lancés
[MD5.896A1DB9A972AD2339C2E8569EC926D1] - (.Safer Networking Limited - System settings protector.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088] [PID.2204]
[MD5.CBC7D8E5416AD30CF16DC2FD4A6AA399] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe [4858968] [PID.3184]
[MD5.A9182CE59CFC56F9C1DDE8B3C0AE8378] - (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [274840] [PID.2168]
[MD5.DF4ECCA12FEB1586A02F1964569AC15B] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8049664] [PID.3472]
~ Processes Running: Scanned in 00mn 00s
---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\ninie lolo\AppData\Roaming\Mozilla\Firefox\Profiles\ep8ti82w.default\prefs.js
C:\Users\ninie lolo\AppData\Roaming\Mozilla\Firefox\Profiles\ep8ti82w.default\user.js
P2 - FPN: [HKCU] [@facebook.com/FBPlugin,version=1.0.3] - (.Pas de propriétaire - Provides additional functionality on Facebook. See
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s
---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s
---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:[MD5.286193DC28CFB4CEB8D378E20A0850A9] - 30/08/2013 - 08:48:10 ---A- . (...) -- C:\Windows\System32\Drivers\aswRvrt.sys [65336]
~ Drivers: 16 Legitimates Filtered in 00mn 01s
---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: Ad-Remover par C_XX - (.C_XX.) [HKLM] -- Ad-Remover
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
O63 - Logiciel: ZHPFix 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPFix_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s
---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\ninie lolo\AppData\Local\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: <>[HKLM\..\Shell\open\Command] (.Not Key.)
~ Keys: Scanned in 00mn 00s
---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.admin", false); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.aflt", "babsst"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.dfltLng", "en"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.excTlbr", false); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.id", "0cc8ba79000000000000002511a8d2d2"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.instlDay", "15655"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.instlRef", "sst"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.prtnrId", "babylon"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.tlbrId", "base"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "http://search.babylon.com/?babsrc=TB_ ... a79000000000000002511a8d2[...] =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.vrsn", "1.8.3.8"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar.vrsni", "1.8.3.8"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar_i.smplGrp", "none"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.3.811:28:44"); =>Toolbar.Babylon
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.admin", false);
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.aflt", "babsst");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.autoRvrt", "false");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.bbDpng", "1");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.cntry", "FR");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.dfltLng", "fr");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.excTlbr", false);
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.ffxUnstlRst", true);
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.hdrMd5", "F0AEEA90A7269FEA57E1508026F66C58");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.id", "0cc8ba79000000000000002511a8d2d2");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.instlDay", "15913");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.instlRef", "sst");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.lastVrsnTs", "1.8.22.016:24:44");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.newTab", false);
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.prdct", "delta");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.prtnrId", "delta");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.rvrt", "false");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.sg", "azb");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.smplGrp", "none");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.tlbrId", "base");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.tlbrSrchUrl", "");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.vrsn", "1.8.22.0");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.vrsnTs", "1.8.22.016:24:44");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta.vrsni", "1.8.22.0");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta_i.babExt", "");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta_i.babTrack", "affID=123884&tsp=4956");
O69 - SBI: prefs.js [ninie lolo - ep8ti82w.default] user_pref("extensions.delta_i.srcExt", "ss");
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) -
http://www.bing.com O69 - SBI: SearchScopes [HKCU] {67A2568C-7A0A-4EED-AECC-B5405DE63B64} - (Google) -
http://www.google.com O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Google) -
http://www.google.com O69 - SBI: SearchScopes [HKCU] {814C76CB-2623-43F4-AAD0-58A0E5190A20} - (Orange) -
http://r.orange.fr ~ Keys: Scanned in 00mn 00s
---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.EF994903FCE2CE3E2D57579B419FF4FC] [SPRF][19/07/2010] (...) -- C:\ProgramData\ezsidmv.dat [48]
[MD5.610F73168D34158BD1FCDA0842957326] [SPRF][09/03/2011] (...) -- C:\Users\ninie lolo\AppData\Roaming\wklnhst.dat [1082]
[MD5.5D04D875F415062F8BABD49656FF7D3A] [SPRF][26/09/2011] (.AbiSource Developers - Installer for AbiWord.) -- C:\Users\ninie lolo\Desktop\abiword-setup-2.8.6.exe [8335349]
[MD5.2E19857E9FFD395FAA6686959624297A] [SPRF][24/07/2012] (...) -- C:\Users\ninie lolo\Desktop\AmazonMP3DownloaderInstall.exe [1008760]
[MD5.DAF2D9AA422C3D065C6F4E8823644944] [SPRF][04/01/2013] (.Pas de propriétaire - Guiformat.) -- C:\Users\ninie lolo\Desktop\guiformat.exe [73728]
~ Files: 11 Legitimates Filtered in 00mn 00s
---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{9DFC832F-3C29-430D-BEF0-6D062CCEF1A6}" |In - Private - P6 - FALSE | .(...) -- C:\Users\ninie lolo\AppData\Local\Temp\ImInstaller\HiYo_Installer.exe (.not file.)
O87 - FAEL: "{7E0E19A6-23CE-41D9-8779-09A6F54DFF30}" |In - Private - P17 - FALSE | .(...) -- C:\Users\ninie lolo\AppData\Local\Temp\ImInstaller\HiYo_Installer.exe (.not file.)
O87 - FAEL: "{CEAD7C73-B586-466F-ADCA-F9531ACBD0C0}" |In - Private - P6 - TRUE | .(...) -- C:\Users\ninie lolo\AppData\Local\Akamai\netsession_win.exe (.not file.)
O87 - FAEL: "{4A015BFE-B386-4300-B084-363CC2228101}" |In - Private - P17 - TRUE | .(...) -- C:\Users\ninie lolo\AppData\Local\Akamai\netsession_win.exe (.not file.)
O87 - FAEL: "TCP Query User{BEC8282A-5CF3-49C3-B56E-A03D5F42683D}C:\users\ninie lolo\appdata\local\akamai\netsession_win.exe" |In - Public - P6 - TRUE | .(...) -- C:\users\ninie lolo\appdata\local\akamai\netsession_win.exe (.not file.)
O87 - FAEL: "UDP Query User{30D5EC8B-2335-49B4-8FFA-7B3BE29223ED}C:\users\ninie lolo\appdata\local\akamai\netsession_win.exe" |In - Public - P17 - TRUE | .(...) -- C:\users\ninie lolo\appdata\local\akamai\netsession_win.exe (.not file.)
O87 - FAEL: "TCP Query User{CBF660E7-2B43-4DA8-AB15-C34CC3ADF135}E:\tl-wpa281\utility\powerline scan.exe" |In - Private - P6 - TRUE | .(...) -- E:\tl-wpa281\utility\powerline scan.exe (.not file.)
O87 - FAEL: "UDP Query User{8BA37806-A9A7-4308-9755-9D8754C7F25C}E:\tl-wpa281\utility\powerline scan.exe" |In - Private - P17 - TRUE | .(...) -- E:\tl-wpa281\utility\powerline scan.exe (.not file.)
~ Firewall: 260 Legitimates Filtered in 00mn 03s
---\\ Enumère les codes produits des logiciels (PUC) (O90)
O90 - PUC: "532E1E0054BA59641A6570138149E94D" . (.HiYo.) -- C:\Windows\Installer\{00E1E235-AB45-4695-A156-073118949ED4}\ARPPRODUCTICON.exe
~ Update Products: 161 Legitimates Filtered in 00mn 00s
---\\ Export de clés de registre aléatoires (O91)
[HKCU\Software\5b558dd1e66deb48\2.6.1519.190\upd]:="upd=1"
[HKCU\Software\5b558dd1e66deb48\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:dllName="BrowserDefender.dll" =>Hijacker.Eazel
[HKCU\Software\5b558dd1e66deb48\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:exeName="BrowserDefender.exe" =>Hijacker.Eazel
[HKCU\Software\5b558dd1e66deb48\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:folderName="BrowserDefender" =>Hijacker.Eazel
[HKCU\Software\5b558dd1e66deb48\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:guid="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}"
[HKCU\Software\5b558dd1e66deb48\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:serviceName="BrowserDefendert" =>Hijacker.Eazel
[HKCU\Software\5b558dd1e66deb48\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:version="2.6.1339.144"
[HKCU\Software\5b558dd1e66deb48]:version="2.6.1519.190"
[HKLM\Software\Wow6432Node\5b558dd1e66deb48]:version="2.6.1519.190"
~ Export Key Software: Scanned in 00mn 00s
---\\ Etat général des services not Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 08/12/2008 169312 | (AdobeActiveFileMonitor7.0) . (.Adobe Systems Incorporated.) - c:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
SR - | Auto 11/05/2013 65640 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 21/09/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SR - | Auto 30/08/2013 46808 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SS - | Demand 10/07/1658 0 | (Boonty Games) . (...) - C:\Program Files (x86)\Common Files\BOONTY Shared\Service\Boonty.exe
SS - | Auto 10/07/1658 0 | (BrowserDefendert) . (...) - C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe =>Hijacker.Eazel
SS - | Demand 05/10/2009 651720 | (FLEXnet Licensing Service) . (.Macrovision Europe Ltd..) - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
SR - | Auto 29/05/2009 625184 | (ForceWare Intelligent Application Manager (IAM)) . (...) - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
SR - | Auto 04/06/2009 1150496 | (Greg_Service) . (.Acer Incorporated.) - C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe
SS - | Auto 29/01/2010 135664 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 29/01/2010 135664 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 15/08/2009 182768 | (gusvc) . (.Google.) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Demand 01/10/2013 118680 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Demand 28/07/2009 935208 | (Nero BackItUp Scheduler 4.0) . (.Nero AG.) - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
SR - | Auto 29/05/2009 207904 | (nSvcIp) . (...) - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
SR - | Auto 03/04/2010 159336 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe
SR - | Auto 08/08/2013 559552 | (ogmservice) . (.RealNetworks, Inc..) - C:\Program Files (x86)\Online Games Manager\ogmservice.exe
SS - | Auto 29/08/2013 1073160 | (Orange update Core Service) . (.Orange SA.) - C:\Program Files (x86)\Orange\OrangeUpdate\Service\OUCore.exe
SR - | Auto 14/07/2009 27136 | C:\Windows\system32\HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe
SR - | Auto 10/07/1658 0 | (PnkBstrA) . (...) - C:\Windows\system32\PnkBstrA.exe
SS - | Auto 13/07/2012 160944 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SR - | Auto 04/07/2009 240160 | (Updater Service) . (.Acer.) - C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
SR - | Auto 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 33s
---\\ Scan Additionnel (O88)
Database Version : 12942 - (05/10/2013)
Clés trouvées (Keys found) : 27
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 2
Fichiers trouvés (Files found) : 2
[HKLM\SYSTEM\CurrentControlSet\Services\BrowserDefendert] =>Hijacker.Eazel^
[HKLM\Software\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}] =>Toolbar.Ask
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A047FE02-C91C-41CB-898C-4ED21B86025A}] =>Toolbar.Orange
[HKLM\Software\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}] =>Toolbar.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\escort.dll] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\escortapp.dll] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\escorteng.dll] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\esrv.EXE] =>Toolbar.Babylon
[HKLM\Software\Classes\SearchBar.Client] =>Toolbar.Agent
[HKLM\Software\Wow6432Node\DataMngr] =>Adware.Bandoo
[HKLM\Software\Classes\Prod.cap] =>Toolbar.Babylon
[HKLM\Software\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}] =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1D970ED5-3EDA-438D-BFFD-715931E2775B}] =>Toolbar.Sorcim
[HKCU\Software\BI] =>Adware.MegaSearch
[HKLM\Software\Classes\AppID\escorTlbr.DLL] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\escort.DLL] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\escortApp.DLL] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\escortEng.DLL] =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\escorTlbr.DLL] =>PUP.Funmoods
C:\ProgramData\Babylon =>Toolbar.Babylon^
C:\ProgramData\BrowserDefender =>Hijacker.Eazel^
[HKCU\Software\5b558dd1e66deb48\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1339.144]:dllName="BrowserDefender.dll" =>Hijacker.Eazel^
C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe =>Hijacker.Eazel^
~ Additionnel Scan: 340691 Items scanned in 00mn 28s
---\\ Récapitulatif des détections trouvées sur votre station
~
http://nicolascoolman.webs.com/apps/b ... w/27161672-hijacker-eazel =>Hijacker.Eazel
~
http://nicolascoolman.webs.com/apps/b ... how/27583992-pup-datamngr =>PUP.Datamngr
~
http://nicolascoolman.webs.com/apps/b ... /26627369-toolbar-babylon =>Toolbar.Babylon
~
http://nicolascoolman.webs.com/apps/blog/show/28927746-toolbar-ask =>Toolbar.Ask
~
http://nicolascoolman.webs.com/apps/b ... ow/26611092-adware-bandoo =>Adware.Bandoo
~
http://nicolascoolman.webs.com/apps/b ... 75657-toolbar-deltasearch =>Toolbar.DeltaSearch
~
http://nicolascoolman.webs.com/apps/b ... 6919368-adware-megasearch =>Adware.MegaSearch
~
http://nicolascoolman.webs.com/apps/b ... how/27630986-pup-funmoods =>PUP.Funmoods
~ MSI: 8 link(s) detected in 00mn 29s
~ 3454 Legitimates filtered by white list
End of the scan (560 lines in 04mn 14s)(0)
Tous les messages (maxounette)
![Open in new window](javascript:CaricaFoto("http://i58.tinypic.com/30xajwk.jpg");)
