ZHPDiag a écrit:Rapport de ZHPDiag v2013.5.13.114 par Nicolas Coolman, Update du 13/05/2013
Run by Choupinou at 14/05/2013 21:22:10
State :
WhiteList : Enable
High Elevated Privileges : OK
UAC : Activate by user


---\\ Web Browser
MSIE: Internet Explorer v10.0.9200.16521
MFIE: Mozilla Firefox 19.0.2
GCIE: Google Chrome v26.0.1410.64 (Defaut)

---\\ Windows Product Information
~ Langage: Français
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows(R) 7, OEM_COA_SLP channel
Windows ID Activation : OK
~ Windows Partial Key : VGYHV
Windows License : OK
~ Windows Remaining Initializations Number : 4
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ System Protection
Bitdefender Total Security 2013 v16.26.0.1739
Windows Defender W7

---\\ System Optimizer

---\\ Peer To Peer (P2P)

---\\ Software Update
Adobe Flash Player 11 Plugin
Adobe Reader XI
Java 7 Update 17

---\\ System Information
~ Processor: AMD64 Family 16 Model 4 Stepping 3, AuthenticAMD
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 8189 MB (72% free)
System Restore: Activé (Enable)
System drive C: has 148 GB (65%) free of 226 GB

---\\ Logged in mode
~ Computer Name: PUPPIE_S
~ User Name: Choupinou
~ All Users Names: UpdatusUser, Other user, Choupinou, Administrateur,
~ Unselected Option: None
Logged in as Administrator

---\\ Environnement Variables
~ System Unit : C:\
~ %AppData% : C:\Users\Choupinou\AppData\Roaming\
~ %Desktop% : C:\Users\Choupinou\Desktop\
~ %Favorites% : C:\Users\Choupinou\Favorites\
~ %LocalAppData% : C:\Users\Choupinou\AppData\Local\
~ %StartMenu% : C:\Users\Choupinou\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 148 Go of 226 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 88 Go of 227 Go)
E:\ CD-ROM drive (Not Inserted)
F:\ CD-ROM drive (Not Inserted)
G:\ Floppy drive, Flash card reader, USB Key (Free 1 Go of 4 Go)
H:\ CD-ROM drive (Not Inserted)
J:\ Hard drive, Flash drive, Thumb drive (Free 164 Go of 298 Go)
L:\ CD-ROM drive (Not Inserted)



---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: 27 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Explorateur Windows.) (.25/02/2011 - 07:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.69F1D418B4C4EC23033D598E4CBC6B73] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.13/03/2013 - 09:00:25.) -- C:\Windows\System32\wininet.dll [2240512]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.20/11/2010 - 14:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.1C7857B62DE5994A75B054A9FD4C3825] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.28/12/2011 - 04:59:24.) -- C:\Windows\system32\Drivers\AFD.sys [498688]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.E453ACF4E7D44E5530B5D5F2B9CA8563] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.31/08/2012 - 19:19:35.) -- C:\Windows\system32\Drivers\ntfs.sys [1659760]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 10:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 1/2
~ Mes Favoris (My Favorites) : 1/33
~ Mes Documents (My Documents) : 1/159
~ Mon Bureau (My Desktop) : 1/706
~ Menu demarrer (Programs) : 1/36
~ Hidden Files: Scanned in 00mn 01s



---\\ Processus lancés
[MD5.991AE39FB46C604486F6DC4E639C669F] - (.IObit - Game Box.) -- C:\Program Files (x86)\IObit\Game Booster\GameBox.exe [398680] [PID.2640]
[MD5.A49E60F4DE59665BBAEC0DC80DFA6825] - (.TeamSpeak Systems GmbH - TeamSpeak 3 Client.) -- D:\Yoann\Divers\Teamspeak\TS3\ts3client_win32.exe [9424872] [PID.3704]
[MD5.8DB5C01FEF78154E7DCAA38E20EE9D18] - (.Thorvald Natvig - Mumble - Low-latency VoIP client.) -- D:\Yoann\Divers\Mumble\mumble.exe [3465384] [PID.6032]
[MD5.BF2F2717C13A4BD4FD73F2788534E86B] - (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [917400] [PID.4784]
[MD5.4E9592BB2C100E571F82640E59E9ECD5] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1312720] [PID.5472]
[MD5.8DEA9B1919CD66DD2B4D4B8C13B335EC] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [7335424] [PID.5620]
[MD5.3927397AC60D943DAF8808AFFED582B7] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65192] [PID.1872]
[MD5.3A2BDD76E7D2A5F40A7174793D1BA794] - (...) -- C:\Windows\SysWOW64\PnkBstrA.exe [75136] [PID.1424]
[MD5.27F1BE4A53441C9F1F48B9ADC145B0A5] - (...) -- C:\Windows\SysWOW64\PnkBstrB.exe [189248] [PID.2080]
~ Processes Running: Scanned in 00mn 00s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\Choupinou\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [dkejhbcdagodjdndmfnhaibnealjonei] Battlefield Play4Free v.1.0.80.2 (Désactivé)
G2 - GCE: Preference [User Data\Default] [gpdfjahpadlpfnfheehpddpcllihfkmm] Battlefield Heroes v.5.0.127.0 (Désactivé)
G2 - GCE: Preference [User Data\Default] [mlomiejdfkolichcflejclcbmpeaniij] Ghostery v.4.1.1 (Activé)
~ Google Browser: 17 Legitimates Filtered in 00mn 08s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:\Users\Choupinou\AppData\Roaming\Mozilla\Firefox\Profiles\61hkw9d1.default\prefs.js
C:\Users\Choupinou\AppData\Roaming\Mozilla\Firefox\Profiles\l78zxm41.default\prefs.js
C:\Users\Choupinou\AppData\Roaming\Mozilla\Firefox\Profiles\xmcd8k10.default\prefs.js
M2 - MFEP: prefs.js [Choupinou - l78zxm41.default\battlefieldheroespatcher@ea.com] [] Battlefield Heroes Updater v5.0.127.0 (..)
M2 - MFEP: prefs.js [Choupinou - l78zxm41.default\battlefieldplay4free@ea.com] [] Battlefield Play4Free v1.0.66.2 (..)
M2 - MFEP: prefs.js [Choupinou - l78zxm41.default\fdm_ffext@freedownloadmanager.org] [] Free Download Manager plugin v1.5.7.6 (..)
M2 - MFEP: prefs.js [Choupinou - l78zxm41.default\firefox@ghostery.com] [] Ghostery v2.9.4 (..)
M2 - MFEP: prefs.js [Choupinou - l78zxm41.default\{241aae70-0022-11de-87af-0800200c9a66}] [] Blue Fox v20.0.10.04.13 (..)
M2 - MFEP: prefs.js [Choupinou - l78zxm41.default\{2458abc0-f443-11dd-87af-0800200c9a66}] [] Bloody Red v20.0.10.04.13 (..)
M2 - MFEP: prefs.js [Choupinou - l78zxm41.default\{27c60876-b5c9-4335-b4f3-52b26782220c}] [] Malware Search v20.0.10.04.13 (..)
M2 - MFEP: prefs.js [Choupinou - l78zxm41.default\{3AF52343-6FC5-4f8e-AFE7-773054020BE9}] [] Vendetta Online Theme v1.2 (..)
M2 - MFEP: prefs.js [Choupinou - l78zxm41.default\{c8f71e5b-88f8-42a7-98bb-e4c506161de9}] [] AmbientFox v0.4 (..)
M2 - MFEP: prefs.js [Choupinou - l78zxm41.default\{e7348bc0-16f6-11de-8c30-0800200c9a66}] [] Pink Fox v15.0.25.04.12 (..)
~ Firefox Browser: 21 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Redirection du fichier Hosts (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Applications démarrées par registre & par dossier (O4)
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
O4 - HKLM\..\Run: [Bdagent] . (.Bitdefender - Bitdefender Agent.) -- C:\Program Files\Bitdefender\Bitdefender 2013\bdagent.exe
O4 - HKLM\..\Run: [GameBooster] . (.IObit - Game Booster.) -- C:\Program Files (x86)\IObit\Game Booster\GameBooster.exe
O4 - HKCU\..\Run: [RESTART_STICKY_NOTES] . (.Microsoft Corporation - Pense-bête.) -- C:\Windows\System32\StikyNot.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] . (.Adobe Systems Incorporated - Adobe® Flash® Player Installer/Uninstaller.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_7_700_169_Plugin.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-21-3736465492-3259607468-702120930-1000\..\Run: [RESTART_STICKY_NOTES] . (.Microsoft Corporation - Pense-bête.) -- C:\Windows\System32\StikyNot.exe
O4 - HKUS\S-1-5-21-3736465492-3259607468-702120930-1000\..\RunOnce: [FlashPlayerUpdate] . (.Adobe Systems Incorporated - Adobe® Flash® Player Installer/Uninstaller.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_7_700_169_Plugin.exe
~ Application: Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Accessories: Private Character Editor.lnk . (.Microsoft Corporation - Éditeur de caractères privés.) -- C:\Windows\system32\eudcedit.exe
O4 - GS\SendTo: Fax Recipient.lnk . (.Microsoft Corporation - Microsoft Windows Fax and Scan.) -- C:\Windows\system32\WFS.exe
O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SendTo: AVS Mobile Uploader.lnk . (...) -- C:\Program Files (x86)\Common Files\AVSMedia\MobileUploader\AVSMobileUploader.exe (.not file.)
O4 - GS\SendTo: AVS Video Burner.lnk . (...) -- C:\Program Files (x86)\Common Files\AVSMedia\BurnerService\AVSVideoBurner.exe (.not file.)
O4 - GS\SendTo: Evernote.lnk . (.Evernote Corp., 305 Walnut Street, Redwood - Evernote.) -- D:\Yoann\Divers\Evernote\Evernote.exe
O4 - GS\SendTo: Skype.lnk . (.Skype Technologies S.A. - Skype.) -- D:\Yoann\Divers\Skype\Phone\Skype.exe
O4 - GS\Desktop: 4chan.lnk . (...) -- D:\Yoann\4chan
O4 - GS\Desktop: Arret.lnk . (.Microsoft Corporation - Outil d’arrêt et d’annotation Windows.) -- C:\Windows\System32\shutdown.exe
O4 - GS\Desktop: Bitdefender Safepay.lnk . (...) -- C:\Program Files (x86)\Bitdefender\Bitdefender 2013\antispam32\obk.exe (.not file.)
O4 - GS\Desktop: Bitdefender Total Security 2013.lnk . (...) -- C:\Program Files (x86)\Bitdefender\Bitdefender 2013\seccenter.exe (.not file.)
O4 - GS\Desktop: CCleaner.exe - Raccourci.lnk . (.Piriform Ltd - CCleaner.) -- D:\Yoann\Divers\CCleaner\CCleaner.exe =>Piriform Ltd
O4 - GS\Desktop: Cour assembleur__Hacking.lnk . (...) -- D:\Yoann\Cour assembleur__Hacking
O4 - GS\Desktop: DayZ Commander.lnk . (.Dotjosh Studios, LLC - Pas de description.) -- D:\Yoann\Divers\DayzCommander\Current\DayZCommander.exe
O4 - GS\Desktop: Evernote.lnk . (.Evernote Corp., 305 Walnut Street, Redwood - Evernote.) -- D:\Yoann\Divers\Evernote\Evernote.exe
O4 - GS\Desktop: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop: Guild Wars.lnk . (.ArenaNet - Guild Wars Game Client.) -- J:\Jeux divers\GUILD WARS\Gw.exe
O4 - GS\Desktop: Gw2.lnk . (.ArenaNet - Guild Wars 2 Game Client.) -- D:\Guild Wars 2\Gw2.exe
O4 - GS\Desktop: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Desktop: KeePass.lnk . (.Dominik Reichl - KeePass Password Safe 1.22.) -- D:\Yoann\Divers\gestionnaire mot de passe\KeePass Password Safe\KeePass.exe
O4 - GS\Desktop: Microsoft Visual Studio 2010.lnk . (.Microsoft Corporation - Microsoft Visual Studio 2010.) -- D:\Visual Studio 2010\Common7\IDE\devenv.exe
O4 - GS\Desktop: MorphVOXPro.lnk . (.Screaming Bee - MorphVOX Pro.) -- D:\Yoann\Divers\MorphVOX pro\MorphVOXPro.exe
O4 - GS\Desktop: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Desktop: Neverwinter.lnk . (...) -- D:\NeverWinter\Cryptic Studios\Neverwinter.exe
O4 - GS\Desktop: Origin.lnk . (.Electronic Arts - Origin.) -- C:\Program Files (x86)\Origin\Origin.exe
O4 - GS\Programs: programmes.lnk . (...) -- D:\Yoann\programmes de base
O4 - GS\Desktop: qtcreator.exe.lnk . (...) -- D:\Yoann\Divers\QT\Tools\QtCreator\bin\qtcreator.exe
O4 - GS\Desktop: Redemarrer.lnk . (.Microsoft Corporation - Outil d’arrêt et d’annotation Windows.) -- C:\Windows\System32\shutdown.exe
O4 - GS\Desktop: Steam.lnk . (.Valve Corporation - Steam Client Bootstrapper (buildbot_winslav.) -- C:\Program Files (x86)\Steam\Steam.exe
O4 - GS\Desktop: TERA.lnk . (.Solid State Networks - TERA.) -- D:\TERA\TERA-Launcher.exe
O4 - GS\Desktop: The War Z.lnk . (.Arktos Entertainment Group - WarZ Launcher.) -- D:\Warz\The War Z\WarZlauncher.exe
O4 - GS\Desktop: TP Boulot.lnk . (...) -- D:\TP Boulot
O4 - GS\Desktop: VirtualBox.exe.lnk . (.Oracle Corporation - Oracle VM VirtualBox Manager.) -- D:\Yoann\Divers\Machine virtuelle\VirtualBox.exe
O4 - GS\Desktop: www - Raccourci.lnk . (...) -- D:\Yoann\wamp\www
O4 - GS\Desktop: Xilisoft Video Converter Ultimate.lnk . (...) -- D:\Yoann\Divers\Xilisoft\Video Converter Ultimate\vc.exe
~ Global Startup: Scanned in 00mn 04s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{BCD03999-FB76-4C83-8F33-B092925A7085}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{BCD03999-FB76-4C83-8F33-B092925A7085}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{BCD03999-FB76-4C83-8F33-B092925A7085}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll
O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 29/08/2012 - 19:29:16 - [0] ----D C:\Users\Choupinou\AppData\Roaming\Nouveau dossier
O43 - CFD: 12/03/2013 - 19:50:42 - [0,001] ----D C:\Users\Choupinou\AppData\Local\ACHelper
O43 - CFD: 12/03/2013 - 19:50:49 - [35,333] ----D C:\Users\Choupinou\AppData\Local\Akamai
O43 - CFD: 07/05/2013 - 10:47:26 - [0,002] ----D C:\Users\Choupinou\AppData\Local\RevoZ_Lewt_Locater
O43 - CFD: 12/03/2013 - 20:01:44 - [0,006] ----D C:\Users\Choupinou\AppData\Local\storage
O43 - CFD: 12/03/2013 - 20:03:19 - [0,007] ----D C:\Users\Choupinou\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Qt 5.0.1
~ Program Folder: 221 Legitimates Filtered in 00mn 17s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.6DA0F93EE0EC14B179DDE28532CA8610] - 13/05/2013 - 22:58:20 ---A- . (...) -- C:\bdlog.txt [77749]
O44 - LFC:[MD5.71AA795741226646F4B088FB3544FF64] - 13/05/2013 - 16:43:01 ---A- . (...) -- C:\Windows\ntbtlog.txt [201070]
O44 - LFC:[MD5.8126331FBD4ED29EB3B356F9C905064D] - 02/05/2013 - 09:47:57 ---A- . (...) -- C:\Windows\GVTDrv64.sys [30528]
~ Files: 21 Legitimates Filtered in 00mn 30s



---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.30973FDC5E454B3C7AC7C0A1B0EF2C5A] - 05/05/2013 - 01:54:55 ---A- - C:\Windows\Prefetch\NEVERWINTER.EXE-46844F40.pf
O45 - LFCP:[MD5.BDCE9C1ADD0E77A1CCBC29FD635E0D24] - 07/05/2013 - 09:46:58 ---A- - C:\Windows\Prefetch\REVOZ LEWT LOCATER.EXE-5717BAE7.pf
O45 - LFCP:[MD5.659FA670DACE594C639F1FF3236AF031] - 08/05/2013 - 10:22:29 ---A- - C:\Windows\Prefetch\GENPTCH.EXE-4C064A34.pf
O45 - LFCP:[MD5.5DD96B61A5069D98F90B5A792937821B] - 10/05/2013 - 14:50:40 ---A- - C:\Windows\Prefetch\MSBUILD.EXE-93EB9DCE.pf
O45 - LFCP:[MD5.8CCD756EE59043963F324553B2994D27] - 10/05/2013 - 14:50:41 ---A- - C:\Windows\Prefetch\MSPDBSRV.EXE-7CCDBEAF.pf
O45 - LFCP:[MD5.35F485FB03A055AA14604CE0A377B926] - 10/05/2013 - 14:54:00 ---A- - C:\Windows\Prefetch\VCPKGSRV.EXE-D9E71BDB.pf
O45 - LFCP:[MD5.AAEE445DA909528B69AC75584BE6CF0C] - 10/05/2013 - 14:56:09 ---A- - C:\Windows\Prefetch\CL.EXE-5C9023DD.pf
O45 - LFCP:[MD5.CFA06D21D669112A8A44DD50F2A7063A] - 10/05/2013 - 14:56:09 ---A- - C:\Windows\Prefetch\TRACKER.EXE-135B31F9.pf
O45 - LFCP:[MD5.B17BEA4C4A81458B7018F3F513E31054] - 10/05/2013 - 22:28:58 ---A- - C:\Windows\Prefetch\BDFVWIZ.EXE-B7048821.pf
O45 - LFCP:[MD5.7ECB9448F9D3D3312097CDEB54189BC1] - 13/05/2013 - 22:58:14 ---A- - C:\Windows\Prefetch\WLRMDR.EXE-A7C36FDD.pf
O45 - LFCP:[MD5.CC67F9DFEFE9F8A6D51A3C23D3827A74] - 14/05/2013 - 16:47:03 ---A- - C:\Windows\Prefetch\DAYZCOMMANDER.EXE-2BE70516.pf
O45 - LFCP:[MD5.2CDF4E3BF3BA5CFBB5F64A3F34E9F08B] - 14/05/2013 - 16:53:48 ---A- - C:\Windows\Prefetch\ARMA2OA.EXE-FC8A8188.pf
O45 - LFCP:[MD5.3A799ACD2682E96ED8B4AE7BDF3EAAB0] - 14/05/2013 - 16:56:45 ---A- - C:\Windows\Prefetch\BESERVICE.EXE-991187A8.pf
O45 - LFCP:[MD5.797BF5474ECC8AE1A9EF7C8827E36ED6] - 14/05/2013 - 18:45:25 ---A- - C:\Windows\Prefetch\BOOST.EXE-E305A078.pf
O45 - LFCP:[MD5.0D1CA79563D9444FD94DBD945C5A1F9C] - 14/05/2013 - 18:49:41 ---A- - C:\Windows\Prefetch\AWESOMIUM_PROCESS.EXE-E7BBF366.pf
O45 - LFCP:[MD5.83C9F006FE23D362DB8A16C18B676B7C] - 14/05/2013 - 19:07:46 ---A- - C:\Windows\Prefetch\TERA.EXE-676BBF09.pf
O45 - LFCP:[MD5.61C2269EA66C8B0F705ED51C06EF7859] - 14/05/2013 - 19:07:53 ---A- - C:\Windows\Prefetch\TL.EXE-47D98980.pf
O45 - LFCP:[MD5.34D28992DDACDA33E3C6B48160A45FBF] - 14/05/2013 - 19:31:50 ---A- - C:\Windows\Prefetch\INSTALLER.EXE-FB682CC5.pf
~ Prefetcher: 119 Legitimates Filtered in 00mn 00s



---\\ MountPoints2 Shell Key (O51)
O51 - MPSK:{1e08e01a-a064-11e2-9df9-94de800199b3}\AutoRun\command. (...) -- G:\LaunchU3.exe (.not file.)
~ Keys: Scanned in 00mn 00s



---\\ Microsoft Windows Policies System (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s



---\\ Microsoft Windows Policies Explorer (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s



---\\ Liste des Drivers Système (O58)
O58 - SDL:[MD5.2F6B34B83843F0C5118B63AC634F5BF4] - 14/07/2009 - 02:52:21 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [491088]
~ Drivers: Scanned in 00mn 00s



---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 11/05/2013 - 13:28:11 ---A- C:\Users\Choupinou\AppData\Local\ArmA 2 OA\MPMissionsCache\__cur_mp.pbo [47245]
O61 - LFC: 11/05/2013 - 14:41:35 ---A- C:\Users\Choupinou\AppData\Local\ArmA 2 OA\ArmA2OA.bidmp [25536]
O61 - LFC: 11/05/2013 - 14:41:36 ---A- C:\Users\Choupinou\AppData\Local\ArmA 2 OA\ArmA2OA.mdmp [9787201]
O61 - LFC: 13/05/2013 - 17:18:09 ---A- C:\Users\Choupinou\AppData\Local\ArmA 2 OA\squads\IDF\IDFxml.paa [48598]
O61 - LFC: 14/05/2013 - 16:54:25 ---A- C:\Users\Choupinou\AppData\Local\ArmA 2 OA\BattlEye\BEClient.dll [180224]
O61 - LFC: 14/05/2013 - 16:55:19 ---A- C:\Users\Choupinou\AppData\Local\Google\Chrome\User Data\PepperFlash\11.7.700.202\manifest.json [2054]
O61 - LFC: 14/05/2013 - 16:55:19 ---A- C:\Users\Choupinou\AppData\Local\Google\Chrome\User Data\PepperFlash\11.7.700.202\pepflashplayer.dll [13136776]
O61 - LFC: 14/05/2013 - 18:43:24 ---A- C:\Users\Choupinou\AppData\Local\ArmA 2 OA\arma2oa.RPT [2671444]
O61 - LFC: 14/05/2013 - 18:43:35 ---A- C:\Users\Choupinou\Documents\ArmA 2 Other Profiles\Puppie%20%3a3\Puppie%20%3a3.vars.ArmA2OAProfile [80]
O61 - LFC: 14/05/2013 - 18:43:39 ---A- C:\Users\Choupinou\Documents\ArmA 2 Other Profiles\Puppie%20%3a3\Puppie%20%3a3.ArmA2OAProfile [3190]
O61 - LFC: 14/05/2013 - 18:43:39 ---A- C:\Users\Choupinou\Documents\ArmA 2\ArmA2OA.cfg [486]
O61 - LFC: 14/05/2013 - 20:05:07 ---A- C:\Users\Choupinou\AppData\Roaming\TERA\launcher\live\dc7aefb7d4b20af8e3e4a8ac86c60088adb0e4df.settings [243]
O61 - LFC: 14/05/2013 - 20:13:12 ---A- C:\Users\Choupinou\AppData\Local\DayZCommander\settings.xml [16925]
O61 - LFC: 14/05/2013 - 20:15:48 ---A- C:\Users\Choupinou\AppData\Local\Google\Chrome\User Data\Certificate Revocation Lists [271526]
O61 - LFC: 14/05/2013 - 20:23:47 ---A- C:\Users\Choupinou\AppData\Local\Google\Chrome\User Data\Local State [42407]
~ 2 Fichiers temporaires (Temporary files)
~ Files: 125 Legitimates Filtered in 00mn 48s



---\\ Liste des outils de nettoyage (O63)
O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1
O63 - Logiciel: RSIT - (.random/random.)
~ ADS: Scanned in 00mn 00s



---\\ File Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 19 Legitimates Filtered in 00mn 00s



---\\ Start Menu Internet (O68)
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s



---\\ Search Browser Infection (O69)
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.illimitux_backup_http", "");
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.illimitux_backup_port", 0);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.illimitux_backup_referer", 2);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.illimitux_backup_type", 5);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_firsttime_4.0_", false);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_mu_auto", "");
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_pref_auto", true);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_pref_box", true);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_pref_captcha", true);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_pref_divx", true);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_pref_embed", true);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_pref_proxy", true);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_pref_pt_4s", true);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_pref_pt_captcha", true);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_pref_pt_mp", true);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_pref_pt_mu", true);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_pref_pt_mv", true);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_pref_pt_rs", true);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_pref_pt_rs1", true);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_pref_pt_zs", true);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_pref_referer", true);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_pref_rs", true);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_pref_tab", true);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.ilx_pref_zapmu", true);
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("extensions.illimitux.locale", "fr");
O69 - SBI: prefs.js [Choupinou - l78zxm41.default] user_pref("weboftrust.search.ask.display", "Ask.com Web Search");
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com
~ Keys: Scanned in 00mn 00s



---\\ Crack & Keygen Files (O82)


---\\ Recherche particuliere à la racine de certains dossiers (O84)
[MD5.6E2A2BA18408768FD837EC0626678A20] [SPRF][12/03/2013] (...) -- C:\ProgramData\1363114435.bdinstall.bin [467829]
[MD5.062D8119120B58D409062DE043862C02] [SPRF][28/05/2012] (...) -- C:\Users\Choupinou\AppData\Roaming\wklnhst.dat [242]
~ Files: Scanned in 00mn 00s



---\\ Scan Additionnel (O88)
Database Version : v2.12091 - (13/05/2013)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 0

~ Additionnel Scan: 248799 Items scanned in 00mn 13s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SR - | Auto 18/12/2012 65192 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SS - | Demand 0 | C:\Windows\System32\AppleChargerSrv.exe (AppleChargerSrv) . (...) - c:\system32\AppleChargerSrv.exe
SS - | Disabled 08/04/2013 69392 | (BdDesktopParental) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender 2013\bdparentalservice.exe
SS - | Demand 53248 | (BEService) . (...) - C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
SS - | Auto 12/03/2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 12/03/2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SR - | Auto 08/02/2013 8704 | (HiPatchService) . (.Hi-Rez Studios.) - D:\Smite\HiPatchService.exe
SS - | Demand 30/08/2011 160256 | (ICCS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
SS - | Demand 04/04/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
SS - | Demand 05/02/2013 428928 | (maconfservice) . (.CybelSoft.) - C:\Program Files\ma-config.com\x64\maconfservice.exe
SS - | Demand 10/02/2013 877856 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe
SS - | Disabled 10/02/2013 1266464 | (nvUpdatusService) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
SR - | Auto 0 | (PnkBstrA) . (...) - C:\Windows\system32\PnkBstrA.exe
SR - | Auto 0 | (PnkBstrB) . (...) - C:\Windows\system32\PnkBstrB.exe
SS - | Auto 25/06/2012 95184 | (SafeBox) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe
SS - | Auto 28/02/2013 161384 | (SkypeUpdate) . (.Skype Technologies.) - D:\Yoann\Divers\Skype\Updater\Updater.exe
SS - | Demand 29/03/2013 543656 | (Steam Client Service) . (.Valve Corporation.) - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
SS - | Disabled 09/02/2013 383264 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
SS - | Demand 06/03/2013 3560288 | (TeamViewer8) . (.TeamViewer GmbH.) - D:\Yoann\Divers\TeamViewer\Version8\TeamViewer_Service.exe
SR - | Auto 08/04/2013 68856 | (UPDATESRV) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender 2013\updatesrv.exe
SR - | Auto 08/05/2013 1646792 | (VSSERV) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender 2013\vsserv.exe
SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SS - | Disabled 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 01s



---\\ Recherche Master Boot Record Infection (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
~ MBR: 1 Legitimates Filtered in 00mn 02s



---\\ Recherche Master Boot Record Infection (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by Choupinou at 14/05/2013 21:27:01

********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 04s



~ 1301 Legitimates filtered by white list
End of the scan (472 lines in 04mn 50s)(2)

Tous les rapports demandés sans aucune exception doivent être postés en lien et dans la même réponse (si il y en a plusieurs) en utilisant cet hébergeur de fichiers

• Les marque-pages,
• L'historique de navigation,
• Les mots de passe,
• Les cookies,
• Les informations auto-complétées de formulaires Web.

• Télécharge Delfix (d'Xplode) sur ton bureau.
• Coche Supprimer les outils de désinfection
• Coche Purger la restauration système
• Clique sur Exécuter
  
  

• Windows Update ( http://www.windowsupdate.com/ ) parfaitement à jour (catégories critique, Services Pack et Services Release)
• Antivirus bien paramétré et mis à jour régulièrement (quotidiennement s'il le faut) avec un scan complet régulier (journalier s'il le faut).
• Une attitude prudente vis à vis de la navigation (pas de sites douteux : cracks, warez, sexe...) et vis à vis de la messagerie (fichiers joints aux messages doivent être scannés avant d'être ouverts)
• Une attitude vigilante (être à l'affût d'un fonctionnement inhabituel de son système)
• Scan hebdomadaire avec un antimalware
• Console Java bien à jour
• Ajoute à Firefox ces trois extensions :
  
  • Pour bloquer les publicités Adblock Plus
  • Pour bloquer les Scripts Java indésirables NoScipt
  • Pour connaître la fiabilité des sites visités Wot
• Ajoute à Chrome pour bloquer les publicités Adblock Plus pour Chrome
• Un nettoyeur de fichiers devenus inutiles comme Ccleaner
  Tuto pour Ccleaner

• Les toolbars ce n'est pas obligatoire Lien
• Les antispywares gratuits ça sers à rien Lien
• Quelques idées reçues Lien
• Les dangers des cracks Lien
• Reconnaître les Pups (programmes potentiellement indésirables) Lien