Bonjour et merci de l'aide que vous pourriez m'apporter :
J'ai consulte enormement de forums reportoriant ce genre de probleme notamment
http://www.libellules.ch/phpBB2/virus-copertps-com-a-wscript-exe-t40900.html
et divers topics sur commentcamarche ...
Je suis dans un bureau, et toutes les cles et disques durs sont infectes si on les connecte ;
Je cherche donc une solution efficace ...
Avast bloque le virus a priori, des que l'on branche un usb mais le message est omnipresent
"Object: G:\autorun.inf (par exemple)
Infection: INF:AuotRun-EE [Trj]
Action: Moved to chest
Process: C:\Windows\System32\WScript.exe"
J'ai donc comme analyse ZHPDiag :
Rapport de ZHPDiag v2013.7.11.22 par Nicolas Coolman, Update du 12/07/2013
Run by HENRY at 12/07/2013 10:21:11
WebSite: http://nicolascoolman.webs.com
State : Your version is update.
WhiteList : Enable
High Elevated Privileges : OK
UAC : Deactivate by user
---\\ Web Browser
MSIE: Internet Explorer v10.0.9200.16635
GCIE: Google Chrome v28.0.1500.71 (Defaut)
---\\ Windows Product Information
~ Langage: Anglais
Windows 7 Business Edition, 32-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_COA_NSLP channel
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
---\\ System Protection
avast! Internet Security v8.0.1489.0
Spybot - Search & Destroy v2.1.20
Windows Defender W7
---\\ System Optimizer
---\\ Peer To Peer (P2P)
---\\ Software Update
---\\ System Information
~ Processor: x86 Family 6 Model 42 Stepping 7, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3242.5 MB (65% free)
System Restore: Activé (Enable)
System drive C: has 207 GB (81%) free of 254 GB
---\\ Logged in mode
~ Computer Name: HENRY-PC
~ User Name: HENRY
~ All Users Names: HENRY, Guest, Administrator,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator
---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Users\HENRY\AppData\Roaming\
~ %Desktop% : C:\Users\HENRY\Desktop\
~ %Favorites% : C:\Users\HENRY\Favorites\
~ %LocalAppData% : C:\Users\HENRY\AppData\Local\
~ %StartMenu% : C:\Users\HENRY\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\
---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 207 Go of 254 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 211 Go of 212 Go)
E:\ CD-ROM drive (Not Inserted)
F:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
G:\ Hard drive, Flash drive, Thumb drive (Free 124 Go of 932 Go)
---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
~ Security Center: 31 Legitimates Filtered in 00mn 00s
---\\ Search Generic System Files
[MD5.8B88EBBB05A0E56B7DCC708498C02B3E] - (.Microsoft Corporation - Windows Explorer.) (.25/02/2011 - 05:30:54.) -- C:\Windows\Explorer.exe [2616320]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Windows Start-Up Application.) (.14/07/2009 - 01:14:45.) -- C:\Windows\System32\Wininit.exe [96256]
[MD5.9BF7C7654EFD098EE3A27B49492A382A] - (.Microsoft Corporation - Internet Extensions for Win32.) (.11/06/2013 - 23:43:37.) -- C:\Windows\System32\wininet.dll [1767936]
[MD5.6D13E1406F50C66E2A95D97F22C47560] - (.Microsoft Corporation - Windows Logon Application.) (.20/11/2010 - 21:29:06.) -- C:\Windows\System32\Winlogon.exe [286720]
[MD5.E3AE23569749DE12D45BA3B489A036AE] - (.Microsoft Corporation - Software Licensing Library.) (.20/11/2010 - 21:29:24.) -- C:\Windows\System32\sppcomapi.dll [193536]
[MD5.9EBBBA55060F786F0FCAA3893BFA2806] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.25/04/2011 - 02:18:03.) -- C:\Windows\system32\Drivers\AFD.sys [338944]
[MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 01:26:15.) -- C:\Windows\system32\Drivers\atapi.sys [21584]
[MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 23:11:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656]
[MD5.BE167ED0FDB9C1FA1133953C18D5A6C9] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 21:29:03.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544]
[MD5.F024449C97EC1E464AAFFDA18593DB88] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 21:29:07.) -- C:\Windows\system32\Drivers\DfsC.sys [78336]
[MD5.9036377B8A6C15DC2EEC53E489D159B5] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 21:29:03.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544]
[MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - i8042 Port Driver.) (.13/07/2009 - 23:11:24.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896]
[MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.13/07/2009 - 23:54:29.) -- C:\Windows\system32\Drivers\IpNat.sys [101888]
[MD5.5D16C921E3671636C0EBA3BBAAC5FD25] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 02:17:22.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123904]
[MD5.280122DDCF04B378EDD1AD54D71C1E54] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 21:29:08.) -- C:\Windows\system32\Drivers\netBT.sys [187904]
[MD5.5E43D2B0EE64123D4880DFA6626DEFDE] - (.Microsoft Corporation - NT File System Driver.) (.12/04/2013 - 13:45:29.) -- C:\Windows\system32\Drivers\ntfs.sys [1211752]
[MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - Parallel Port Driver.) (.13/07/2009 - 23:45:35.) -- C:\Windows\system32\Drivers\Parport.sys [79360]
[MD5.D9F91EAFEC2815365CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13/07/2009 - 23:54:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848]
[MD5.B973FCFC50DC1434E1970A146F7E3885] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.20/11/2010 - 21:29:49.) -- C:\Windows\system32\Drivers\rdpdr.sys [133632]
[MD5.3E21C083B8A01CB70BA1F09303010FCE] - (.Microsoft Corporation - SMB Transport driver.) (.13/07/2009 - 23:53:41.) -- C:\Windows\system32\Drivers\smb.sys [71168]
[MD5.B459575348C20E8121D6039DA063C704] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 21:29:07.) -- C:\Windows\system32\Drivers\tdx.sys [74752]
[MD5.F497F67932C6FA693D7DE2780631CFE7] - (.Microsoft Corporation - Volume Shadow Copy Driver.) (.20/11/2010 - 21:29:03.) -- C:\Windows\system32\Drivers\volsnap.sys [245632]
~ Generic Processes: Scanned in 00mn 00s
---\\ Hidden files state (Hidden/Total)
~ Mes Favoris (My Favorites) : 1/23
~ Mes Documents (My Documents) : 1/13
~ Mon Bureau (My Desktop) : 1/8498
~ Menu demarrer (Programs) : 1/25
~ Hidden Files: Scanned in 00mn 12s
---\\ Running Processes
[MD5.38D198A2DD54A67120040566A38103BA] - (.Microsoft Corporation - GrooveMonitor Utility.) -- C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016] [PID.3324]
[MD5.9F594EE6836A7802EF0F53CCDB2D68A6] - (.D-Link Corp. - D-Link WLAN Application.) -- C:\Program Files\D-Link\DWA-125 revA\AirNCFG.exe [1074496] [PID.3748]
[MD5.3F11B20D12D89365D7721BDC860CE5F0] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe [4858968] [PID.3756]
[MD5.09E9425AD8C61664A37ED84B8B58BDCF] - (.Safer-Networking Ltd. - Spybot - Search & Destroy tray access.) -- C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [3830224] [PID.3948]
[MD5.25D14A2CBFB28A14C4564664F05376D3] - (.APN - Ask Toolbar Notifier.) -- C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1542608] [PID.4040] =>Toolbar.Ask
[MD5.D1AB72DB2BEDD2F255D35DA3DA0D4B16] - (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\Windows\System32\WScript.exe [141824] [PID.4080]
[MD5.815FD68F8A6AF88827232C2B94622970] - (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe [846288] [PID.912]
[MD5.2E0B0A051FFAA86E358465BB0880D453] - (.Microsoft Corporation - Windows Update.) -- C:\Windows\system32\wuauclt.exe [53784] [PID.3664]
[MD5.C0C9E6226F1BB310E74C4CEE37CC3443] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7700480] [PID.4988]
~ Processes Running: Scanned in 00mn 01s
---\\ Google Chrome, Start,Search,Extensions (G0,G1,G2)
C:\Users\HENRY\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [kiplfnciaokpcennlkldkdaeaaomamof] Torch Share v.1.0.0.3604, (Désactivé)
~ Google Browser: 13 Legitimates Filtered in 00mn 08s
---\\ Internet Explorer Extensions, Start, Search (R4,R3,R0,R1)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.search.ask.com
R3 - URLSearchHook: SearchHook Class - {D8278076-BC68-4484-9233-6E7F1628B56C} . (.Google Inc. - Google Update.) (No version) -- (.not file.)
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Google Inc. - Google Update.) (No version) -- (.not file.)
~ IE Browser: 10 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s
---\\ Line Analysis F0, F1, F2, F3 - IniFiles, Auto loading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s
---\\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21
---\\ Browser Helper Objects (O2)
O2 - BHO: Movies Toolbar (Dist. by Bandoo Media, Inc.) - {ec2bae47-25af-4ce9-9e78-10627a49c9ea} . (.Unknown owner - dtx Dynamic Link Library.) -- C:\Program Files\Movies Toolbar\Datamngr\SRTOOL~1\IE\searchresultsDx.dll =>Adware.Bandoo
~ BHO: 4 Legitimates Filtered in 00mn 00s
---\\ Internet Explorer toolbars (O3)
O3 - Toolbar: avast! Online Security - [HKLM]{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} . (.AVAST Software - IE Webrep plugin.) -- C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: Ask Toolbar - [HKLM]{42435041-352D-5637-00A7-7A786E7484D7} . (.APN LLC. - Passport.) -- C:\Program Files\AskPartnerNetwork\Toolbar\BCPA5-V7\Passport.dll =>Toolbar.Ask
O3 - Toolbar: Movies Toolbar (Dist. by Bandoo Media, Inc.) - [HKLM]{ec2bae47-25af-4ce9-9e78-10627a49c9ea} . (.Unknown owner - dtx Dynamic Link Library.) -- C:\Program Files\Movies Toolbar\Datamngr\SRTOOL~1\IE\searchresultsDx.dll =>Adware.Bandoo
~ Toolbar: Scanned in 00mn 00s
---\\ Auto loading programs from Registry and folders (O4)
O4 - HKLM\..\Run: [GrooveMonitor] . (.Microsoft Corporation - GrooveMonitor Utility.) -- C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
O4 - HKLM\..\Run: [D-Link D-Link DWA-125] . (.D-Link Corp. - D-Link WLAN Application.) -- C:\Program Files\D-Link\DWA-125 revA\AirNCFG.exe
O4 - HKLM\..\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe
O4 - HKLM\..\Run: [SDTray] . (.Safer-Networking Ltd. - Spybot - Search & Destroy tray access.) -- C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
O4 - HKLM\..\Run: [ApnTBMon] . (.APN - Ask Toolbar Notifier.) -- C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe =>Toolbar.Ask
O4 - HKCU\..\Run: [b66eb] . (...) -- C:\Users\HENRY\AppData\Roaming\a07\b66eb.js
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Windows Desktop Gadgets.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Windows Desktop Gadgets.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-21-766546738-3842285136-1558422802-1000\..\Run: [b66eb] . (...) -- C:\Users\HENRY\AppData\Roaming\a07\b66eb.js
~ Application: Scanned in 00mn 00s
---\\ Other User Links (O4)
O4 - GS\TaskBar: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O4 - GS\TaskBar: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\TaskBar: Torch.lnk . (.Torch Media Inc. - Torch.) -- C:\Users\HENRY\AppData\Local\Torch\Application\torch.exe
O4 - GS\TaskBar: Windows Explorer.lnk . (.Microsoft Corporation - Windows Explorer.) -- C:\Windows\explorer.exe
O4 - GS\TaskBar: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe
O4 - GS\Programs: iLivid.lnk . (.Bandoo Media Inc. - iLivid Download Manager.) -- C:\Users\HENRY\AppData\Local\iLivid\iLivid.exe =>Adware.Bandoo
O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Programs: Torch.lnk . (.Torch Media Inc. - Torch.) -- C:\Users\HENRY\AppData\Local\Torch\Application\torch.exe
O4 - GS\QuickLaunch: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch: iLivid.lnk . (.Bandoo Media Inc. - iLivid Download Manager.) -- C:\Users\HENRY\AppData\Local\iLivid\iLivid.exe =>Adware.Bandoo
O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch: Torch.lnk . (.Torch Media Inc. - Torch.) -- C:\Users\HENRY\AppData\Local\Torch\Application\torch.exe
O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Accessories: Private Character Editor.lnk . (.Microsoft Corporation - Private Character Editor.) -- C:\Windows\system32\eudcedit.exe
O4 - GS\SendTo: Fax Recipient.lnk . (.Microsoft Corporation - Microsoft Windows Fax and Scan.) -- C:\Windows\system32\WFS.exe
O4 - GS\Desktop: iLivid.lnk . (.Bandoo Media Inc. - iLivid Download Manager.) -- C:\Users\HENRY\AppData\Local\iLivid\iLivid.exe =>Adware.Bandoo
O4 - GS\Desktop: Torch.lnk . (.Torch Media Inc. - Torch.) -- C:\Users\HENRY\AppData\Local\Torch\Application\torch.exe
~ Global Startup: Scanned in 00mn 00s
---\\ Extra buttons on main IE button toolbar, or extra items in IE 'Tools' menu (O9)
O9 - Extra button: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft Office OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO
~ IE Extra Buttons: Scanned in 00mn 00s
---\\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - E-mail Naming Shim Provider.) -- C:\Windows\system32\napinsp.dll
~ Winsock: 6 Legitimates Filtered in 00mn 00s
---\\ Lop.com/Domain Hijackers (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{E33379F5-A026-4F8E-8CFA-AECF703CC89D}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{E33379F5-A026-4F8E-8CFA-AECF703CC89D}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{E33379F5-A026-4F8E-8CFA-AECF703CC89D}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s
---\\ Extra protocols (O18)
O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Microsoft (R) HTML Viewer.) -- C:\Windows\System32\mshtml.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.dll
~ Protocole Additionnel: Scanned in 00mn 00s
---\\ AppInit_DLLs Registry value Autorun (O20)
O20 - Winlogon Notify: SDWinLogon . (...) -- SDWinLogon.dll
~ Winlogon: Scanned in 00mn 00s
---\\ AppInit_DLLs Registry value Autorun (O20)
O20 - AppInit_DLLs: . (...) - C:\PROGRA~2\Wincert\WIN32C~1.dll
~ AppInit DLL: Scanned in 00mn 00s
---\\ non Microsoft non disabled Windows XP/NT/2000 Services (O23)
O23 - Service: Ask Update Service (APNMCP) . (.APN LLC. - APN Updater.) - C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
O23 - Service: Datamngr Coordinator (DatamngrCoordinator) . (.Bandoo Media Inc. - Datamngr Coordinator.) - C:\Program Files\Movies Toolbar\Datamngr\DatamngrCoordinator.exe =>Adware.Bandoo
O23 - Service: D_Link_DWA-125_WPS Service (D_Link_DWA-125_WPS) . (.Unknown owner - ANIWConnService.) - C:\Program Files\D-Link\DWA-125 revA\ANIWConnService.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) . (.Safer-Networking Ltd. - Windows Security Center integration..) - C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: Torch Crash Handler (TorchCrashHandler) . (.TorchMedia Inc. - TorchCrashHandler.) - C:\Users\HENRY\AppData\Local\Torch\Update\TorchCrashHandler.exe
~ Services: 9 Legitimates Filtered in 00mn 07s
---\\ Session Manager Key (AppCertDlls,KnownDLLs) (O36)
O36 - AppCertDlls: (x86) . (...) -- C:\Program Files\Movies Toolbar\Datamngr\apcrtldr.dll =>PUP.Datamngr
~ Keys: Scanned in 00mn 00s
---\\ Drivers launched at startup (O41)
O41 - Driver: (anodlwf) . (.Unknown owner - NDIS 6.0 Filter Driver.) - C:\Windows\System32\DRIVERS\anodlwf.sys
~ Drivers: 69 Legitimates Filtered in 00mn 00s
---\\ Software installed (O42)
O42 - Logiciel: Ask Toolbar - (.Ask Partner Network.) [HKLM] -- {42435041-352D-5637-00A7-A758B70C0100} =>Toolbar.Ask
O42 - Logiciel: Free PDF Tablet - (...) [HKLM] -- Free PDF Tablet
O42 - Logiciel: iLivid - (.Bandoo Media Inc.) [HKLM] -- iLivid =>Adware.Bandoo
~ Logic: 30 Legitimates Filtered in 00mn 00s
---\\ HKCU & HKLM Software Keys
[HKCU\Software\APN DTX]
[HKCU\Software\AskPartnerNetwork]
[HKCU\Software\Datamngr] =>PUP.Datamngr
[HKCU\Software\Free PDF Tablet]
[HKCU\Software\ilivid] =>Adware.Bandoo
[HKCU\Software\mtaskmgr]
[HKLM\Software\AskPartnerNetwork]
[HKLM\Software\Datamngr] =>PUP.Datamngr
~ Key Software: 78 Legitimates Filtered in 00mn 00s
---\\ Contents of the Common Files folders (O43)
O43 - CFD: 09/07/2013 - 15:02:12 - [8.654] ----D C:\Program Files\AskPartnerNetwork
O43 - CFD: 11/07/2013 - 11:39:33 - [0.045] -SH-D C:\Program Files\bf7
O43 - CFD: 11/07/2013 - 10:47:43 - [4.767] ----D C:\Program Files\GUM978D.tmp
O43 - CFD: 10/07/2013 - 15:19:43 - [16.529] ----D C:\Program Files\Movies Toolbar
O43 - CFD: 09/07/2013 - 14:59:07 - [0] ----D C:\ProgramData\APN
O43 - CFD: 09/07/2013 - 15:02:12 - [1.363] ----D C:\ProgramData\AskPartnerNetwork
O43 - CFD: 12/07/2013 - 10:22:00 - [0.005] ----D C:\ProgramData\Datamngr =>PUP.Datamngr
O43 - CFD: 12/07/2013 - 09:44:12 - [0.004] ----D C:\ProgramData\TorchCrashHandler
O43 - CFD: 07/07/2013 - 14:16:43 - [0.045] -SH-D C:\Users\HENRY\AppData\Roaming\a07
O43 - CFD: 11/07/2013 - 13:44:52 - [0.001] ----D C:\Users\HENRY\AppData\Roaming\Free PDF Tablet
O43 - CFD: 10/07/2013 - 16:22:07 - [0.000] ----D C:\Users\HENRY\AppData\Roaming\TFP
O43 - CFD: 10/07/2013 - 14:53:12 - [0.006] ----D C:\Users\HENRY\AppData\Local\AskPartnerNetwork
O43 - CFD: 10/07/2013 - 16:21:31 - [150.917] ----D C:\Users\HENRY\AppData\Local\iLivid =>Adware.Bandoo
~ Program Folder: 90 Legitimates Filtered in 00mn 12s
---\\ Last modified or created files under Windows and System32 (O44)
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 12/07/2013 - 09:42:42 RSHA- . (...) -- C:\IO.SYS [0]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 12/07/2013 - 09:42:42 RSHA- . (...) -- C:\MSDOS.SYS [0]
O44 - LFC:[MD5.6A939B22CF991EC4EC558027FDE3D1D1] - 06/07/2013 - 19:29:37 ---A- . (...) -- C:\Windows\sounder.his [1170]
O44 - LFC:[MD5.F8AF37885260F5BD5EC15C30344CB43D] - 06/07/2013 - 19:29:05 ---A- . (...) -- C:\Windows\hpntwksetup.ini [98]
O44 - LFC:[MD5.3FFBEE694566CADB0A64D8A1ACD7DBCE] - 06/07/2013 - 19:05:21 ---A- . (...) -- C:\Windows\System32\Drivers\aswSP.sys.sum [175]
O44 - LFC:[MD5.FAF091AA45A6A6CF3CF94FE065950956] - 06/07/2013 - 19:05:21 ---A- . (...) -- C:\Windows\System32\Drivers\aswSnx.sys.sum [175]
O44 - LFC:[MD5.1B79CAC4A1C904E51390035ED21A111B] - 06/07/2013 - 18:47:52 ---A- . (...) -- C:\Windows\System32\LuIntLog3.txt [378]
O44 - LFC:[MD5.B51B3BE3A469D86D33D288C938BD1841] - 06/07/2013 - 18:47:42 ---A- . (...) -- C:\Windows\System32\LuIntLog2.txt [378]
O44 - LFC:[MD5.44B67C36A56515A6C154A54588DBB951] - 06/07/2013 - 18:37:14 ---A- . (...) -- C:\Windows\System32\LuIntLog1.txt [378]
O44 - LFC:[MD5.64C6F2DACA812B38893E1166F4B584E6] - 06/07/2013 - 18:37:01 ---A- . (...) -- C:\Windows\System32\LuIntLog0.txt [378]
O44 - LFC:[MD5.E1666EEF9DEA997A81B6967429EE7BDB] - 06/07/2013 - 18:28:56 ---A- . (...) -- C:\Windows\IE10_main.log [21362]
O44 - LFC:[MD5.1FF56AC32B38A94C3C88497BD6E00C96] - 06/07/2013 - 18:05:45 ---A- . (...) -- C:\Windows\System32\ieuinit.inf [25185]
O44 - LFC:[MD5.9FC8C9978C75D21C0ED9D0DD7A1DCB42] - 06/07/2013 - 17:32:05 ---A- . (...) -- C:\Windows\System32\RaCoInst.log [3876]
O44 - LFC:[MD5.221494C29E9F4B6D02514CA29F2A3A4E] - 06/07/2013 - 17:31:26 ---A- . (...) -- C:\Windows\System32\RaCoInst.dat [14119]
O44 - LFC:[MD5.A00C7E982813B075D567436FB20F0504] - 06/07/2013 - 17:31:26 ---A- . (.Ralink Technology Corp. - Ralink 802.11n Wireless Adapter Driver.) -- C:\Windows\System32\Drivers\Dnetr28u.sys [1228864]
O44 - LFC:[MD5.F1FEFE8332330B94E54EC23116245144] - 06/07/2013 - 17:31:26 ---A- . (.Ralink Technology, Inc. - Ralink CoInstaller Dynamic Link Library.) -- C:\Windows\System32\RaCoInst.dll [238944]
O44 - LFC:[MD5.48E008CF2EDCF8FC91A9D3507865A51D] - 06/07/2013 - 17:31:26 ---A- . (.Unknown owner - NDIS 6.0 Filter Driver.) -- C:\Windows\System32\Drivers\anodlwf.sys [12800]
O44 - LFC:[MD5.2465EBC8CD6E412CDC1AB9FEF40BCAE6] - 06/07/2013 - 17:26:34 ---A- . (...) -- C:\Windows\win.ini [478]
O44 - LFC:[MD5.E531BCF5685D6ADB09795F64BA4811C5] - 06/07/2013 - 15:48:32 ---A- . (...) -- C:\Windows\TSSysprep.log [1355]
O44 - LFC:[MD5.0E180732183456E25C69640B004454CC] - 06/07/2013 - 15:46:43 ---A- . (...) -- C:\Windows\DtcInstall.log [2790]
~ Files: 358 Legitimates Filtered in 00mn 10s
---\\ Operations and functions at Windows Explorer startup (O46)
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~1\Office12\GR469A~1.DLL
~ ShellExecuteHooks: Scanned in 00mn 00s
---\\ Microsoft Windows Policies System (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s
---\\ Microsoft Windows Policies Explorer (MWPE) (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoWindowsUpdate"=
~ MWPE Keys: 1 Legitimates Filtered in 00mn 00s
---\\ System Drivers List (SDL) (O58)
O58 - SDL:[MD5.21E785EBD7DC90A06391141AAC7892FB] - 14/07/2009 - 01:26:15 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [422976]
O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 13/07/2009 - 21:40:41 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029]
~ Drivers: Scanned in 00mn 00s
---\\ List all tools cleaner (LATC) (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
~ ADS: Scanned in 00mn 00s
---\\ File Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 19 Legitimates Filtered in 00mn 00s
---\\ Start Menu Internet (SMI) (O68)
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: <Torch> <>[HKLM\..\Shell\open\Command] (.Not Key.)
O68 - StartMenuInternet: <Torch.3HLPD3ZQ6SPJZOTSQQIW6I4DUQ> <Torch>[HKLM\..\Shell\open\Command] (.Torch Media Inc. - Torch.) -- C:\Users\HENRY\AppData\Local\Torch\Application\torch.exe
~ Keys: Scanned in 00mn 00s
---\\ Search Browser Infection (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com
O69 - SBI: SearchScopes [HKCU] {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} - (Ask.com) - http://dts.search.ask.com
O69 - SBI: SearchScopes [HKCU] {BCBEEC4F-7CB0-4464-8630-4292C0453774} - (Ask Search) - http://www.search.ask.com
~ Keys: Scanned in 00mn 00s
---\\ Search Particular Root Folder (SPRF) (O84)
[MD5.09DAB2965692F2D5B75331951C7BDD51] [SPRF][03/02/2009] (.Autodesk, Inc. - Autodesk component.) -- C:\Users\HENRY\AppData\Local\Temp\AcDeltree.exe [161640]
[MD5.F6458218C78936638F67538EC87F6054] [SPRF][06/07/2013] (.Unknown owner - ANPD Helper DLL API library.) -- C:\Users\HENRY\AppData\Local\Temp\ANPDApi.dll [315392]
[MD5.709F9B25531A30FA9936B531F7633D01] [SPRF][10/07/2013] (...) -- C:\Users\HENRY\AppData\Local\Temp\apnuserid.dat [16]
[MD5.B6F0479AE87D244975439C6124592772] [SPRF][10/07/2013] (...) -- C:\Users\HENRY\AppData\Local\Temp\appid.dat [3]
[MD5.0D40F5B3A49419906360115514C5A068] [SPRF][06/07/2013] (...) -- C:\Users\HENRY\AppData\Local\Temp\chart_data.dat [20924]
[MD5.404F2391AB07E1BDAEF69E6E25CA3E12] [SPRF][20/05/2013] (.Ask.com - Offercast - APN Install Manager.) -- C:\Users\HENRY\AppData\Local\Temp\Offercast2802_IJBME_.exe [1093256]
[MD5.5A432A042DAE460ABE7199B758E8606C] [SPRF][27/10/2006] (.Microsoft Corporation - Office Source Engine.) -- C:\Users\HENRY\AppData\Local\Temp\ose00000.exe [145184]
[MD5.8CB22BDD0B7BA1AB13D742E22EED8DA2] [SPRF][10/07/2013] (...) -- C:\Users\HENRY\AppData\Local\Temp\sysid.dat [3]
[MD5.BDEE9D936EFB7C76DF778F45F1CF130D] [SPRF][10/07/2013] (...) -- C:\Users\HENRY\AppData\Local\Temp\trackid.dat [6]
[MD5.CC198634BCAEF99C50277CC81B14AB27] [SPRF][12/07/2013] (...) -- C:\Users\HENRY\Desktop\adwcleaner.exe [662345]
[MD5.1EC9CFB7C0309CC479D1C9ACB5744117] [SPRF][12/07/2013] (.Oleg N. Scherbakov - 7z Setup SFX.) -- C:\Users\HENRY\Desktop\JRT.exe [559306]
[MD5.E855AFA15E2A2D4245A61B92714AD512] [SPRF][12/07/2013] (...) -- C:\Users\HENRY\Desktop\UsbFix-7.129.exe [1030520]
[MD5.637D7E0E5EEA3331C5CA732792E50205] [SPRF][12/07/2013] (.Nicolas Coolman - ZHPDiag.) -- C:\Users\HENRY\Desktop\ZHPDiag2.exe [5705018]
[MD5.5918152F72762CD74E6BBB7495A7A14E] [SPRF][09/02/2009] (.Autodesk, Inc. - Autodesk i-drop control.) -- C:\Windows\Downloaded Program Files\IDropENU.dll [113816]
~ Files: Scanned in 00mn 00s
---\\ Firewall Active Exception List (FirewallRules) (O87)
O87 - FAEL: "TCP Query User{52216147-4D5F-4079-804A-2E0F84978765}C:\program files\spybot - search & destroy 2\sdupdate.exe" | In - Private - P6 - TRUE | .(.Safer-Networking Ltd. - Update.) -- C:\program files\spybot - search & destroy 2\sdupdate.exe
O87 - FAEL: "UDP Query User{33340FB3-E560-431C-ACD5-5E99EF115F96}C:\program files\spybot - search & destroy 2\sdupdate.exe" | In - Private - P17 - TRUE | .(.Safer-Networking Ltd..) -- C:\program files\spybot - search & destroy 2\sdupdate.exe
O87 - FAEL: "{896AE1CA-D3BE-4787-AF6A-042FADB1AFD1}" | In - Private - P6 - TRUE | .(.APN LLC - DtUser.) -- C:\Program Files\Movies Toolbar\Datamngr\SRTOOL~1\IE\dtUser.exe =>PUP.Datamngr
O87 - FAEL: "{1AFD12C8-98AD-47FA-A3AA-32F516AAC72C}" | In - Private - P17 - TRUE | .(.APN LLC - DtUser.) -- C:\Program Files\Movies Toolbar\Datamngr\SRTOOL~1\IE\dtUser.exe =>PUP.Datamngr
O87 - FAEL: "{625439BB-B79D-43E0-8E18-66928A210FDE}" | In - None - P17 - TRUE | .(.Torch Media Inc. - Torch Torrent.) -- C:\Users\HENRY\AppData\Local\Torch\Plugins\Torrent\TorchTorrent.exe
O87 - FAEL: "{8EDFF03E-5581-47BF-9DFA-B6EB4A17B887}" |In - None - P17 - TRUE | .(...) -- C:\Users\HENRY\AppData\Local\Torch\Plugins\Hola\hola_plugin.exe (.not file.)
O87 - FAEL: "{8D869769-5ED2-48FE-BE6A-710BF3D17CDD}" |In - None - P17 - TRUE | .(...) -- C:\Users\HENRY\AppData\Local\Torch\Plugins\Hola\hola_plugin_x64.exe (.not file.)
~ Firewall: 189 Legitimates Filtered in 00mn 00s
---\\ Additionnal Scan (O88)
Database Version : v2.12741 - (12/07/2013)
Clés trouvées (Keys found) : 18
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 3
Fichiers trouvés (Files found) : 0
[HKLM\Software\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}] =>Adware.Bandoo
[HKLM\Software\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}] =>Adware.Bandoo
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}] =>Adware.Bandoo
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}] =>Adware.Bandoo
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}] =>Adware.Bandoo
[HKLM\Software\Classes\CLSID\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}] =>Adware.Bandoo
[HKLM\Software\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}] =>Adware.Bandoo
[HKLM\Software\Classes\SearchQUIEHelper.DNSGuard] =>Adware.Bandoo
[HKLM\Software\Classes\SearchQUIEHelper.DNSGuard.1] =>Adware.Bandoo
[HKCU\Software\APN DTX] =>Toolbar.Ask
[HKCU\Software\DataMngr] =>Adware.Bandoo
[HKLM\Software\DataMngr] =>Adware.Bandoo
[HKCU\Software\ilivid] =>Adware.Bandoo
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\iLivid] =>Adware.Bandoo
[HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls] =>Trojan.FakeAlert
[HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls] =>Trojan.FakeAlert
[HKCU\Software\AskPartnerNetwork] =>Toolbar.Ask
[HKLM\Software\AskPartnerNetwork] =>Toolbar.Ask
C:\Program Files\AskPartnerNetwork =>Toolbar.Ask
C:\ProgramData\AskPartnerNetwork =>Toolbar.Ask
C:\Users\HENRY\AppData\Local\AskPartnerNetwork =>Toolbar.Ask
~ Additionnel Scan: 242497 Items scanned in 00mn 17s
---\\ Product Upgrade Codes (O90)
O90 - PUC: "14053424D2537365007A7A857BC01000" . (.Ask Toolbar.) -- C:\Windows\Installer\{42435041-352D-5637-00A7-A758B70C0100}\ToolbarIcon.exe =>Toolbar.Ask
~ Update Products: 26 Legitimates Filtered in 00mn 00s
---\\ General States of Services not Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 17/06/2013 169632 | (APNMCP) . (.APN LLC..) - C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
SR - | Auto 09/05/2013 46808 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SR - | Auto 09/05/2013 137960 | (avast! Firewall) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\afwServ.exe
SR - | Auto 30/06/2013 3178496 | (DatamngrCoordinator) . (.Bandoo Media Inc..) - C:\Program Files\Movies Toolbar\Datamngr\DatamngrCoordinator.exe =>Adware.Bandoo
SR - | Auto 53248 | (D_Link_DWA-125_WPS) . (...) - C:\Program Files\D-Link\DWA-125 revA\ANIWConnService.exe
SS - | Demand 08/07/2013 651720 | (FLEXnet Licensing Service) . (.Macrovision Europe Ltd..) - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
SS - | Auto 11/07/2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 11/07/2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Auto 16/05/2013 1817560 | (SDScannerService) . (.Safer-Networking Ltd..) - C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
SR - | Auto 15/05/2013 171928 | (SDWSCService) . (.Safer-Networking Ltd..) - C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
SR - | Auto 08/07/2013 1205088 | (TorchCrashHandler) . (.TorchMedia Inc..) - C:\Users\HENRY\AppData\Local\Torch\Update\TorchCrashHandler.exe
SR - | Auto 14/07/2009 20992 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 14/07/2009 20992 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 01s
---\\ Malicius Software Information
~ http://nicolascoolman.webs.com/apps/blo ... oolbar-ask =>Toolbar.Ask
~ http://nicolascoolman.webs.com/apps/blo ... are-bandoo =>Adware.Bandoo
~ http://nicolascoolman.webs.com/apps/blo ... p-datamngr =>PUP.Datamngr
~ MSI: 3 link(s) detected in 00mn 01s
~ 1073 Legitimates filtered by white list
End of the scan (495 lines in 01mn 37s)(0)
Voici le premier scan (il ne s'agit pas de mon ordinateur personnel)
En esperant obtenir un suivi pour m'aider pour la suite
Merci encore et desole pour la lecture