~ Rapport de ZHPDiag v2015.5.13.48 - Nicolas Coolman  (13/05/2015)
~ Lancé par newjams25 (16/05/2015 23:27:51)
~ Facebook : https://www.facebook.com/nicolascoolman1
~ Adresse du Forum http://forum.nicolascoolman.fr
~ Traduit par Nicolas Coolman
~ Etat de la version : Version à jour.
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Deactivate by user


---\\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.17728
MFIE: Mozilla Firefox 37.0.2
GCIE: Google Chrome v42.0.2311.152 (Defaut)

---\\ Informations sur les produits Windows
~ Langage: Français
Windows Server License Manager Script : OK
~ Windows Operating System - Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Windows ID Activation : OK
~ Windows Partial Key : 9YQTR
Windows License : OK
~ Windows Remaining Initializations Number : 1
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)

---\\ Logiciels de protection du système
Trend Micro Titanium Internet Security v3.00
Windows Defender W7 (Deactivate)

---\\ Logiciels d'optimisation du système
CCleaner v3.22

---\\ Logiciels de partage PeerToPeer

---\\ Surveillance de Logiciels
Adobe Flash Player 17 NPAPI

---\\ Informations sur le système
~ Processor: Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 4002 MB (31% free)
System Restore: Activé (Enable)
System drive C: has 54 GB (29%) free of 186 GB

---\\ Mode de connexion au système
~ Computer Name: NEWJAMS25-PC
~ User Name: newjams25
~ All Users Names: UpdatusUser, newjams25, Mcx1-NEWJAMS25-PC, HomeGroupUser$, Administrateur, 
~ Unselected Option: None
Logged in as Administrator

---\\ Variables d'environnement
~ System Unit : C:\
~ %AppZHP% : C:\Users\newjams25\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\newjams25\AppData\Roaming\
~ %Desktop% : C:\Users\newjams25\Desktop\
~ %Favorites% : C:\Users\newjams25\Favorites\
~ %LocalAppData% : C:\Users\newjams25\AppData\Local\
~ %StartMenu% : C:\Users\newjams25\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 54 Go of 186 Go)
D: Hard drive, Flash drive, Thumb drive (Free 30 Go of 30 Go)
E: Hard drive, Flash drive, Thumb drive (Free 29 Go of 114 Go)
F: Floppy drive, Flash card reader, USB Key (Free 7 Go of 7 Go)
G: CD-ROM drive (Not Inserted)
H: Hard drive, Flash drive, Thumb drive (Free 1 Go of 4 Go)



---\\ Etat du Centre de Sécurité Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
~ Security Center: 47 Legitimates Filtered in 00mn 00s



---\\ Recherche particulière de fichiers génériques
[MD5.3C6AE8C6F08A3B38DBE2453681F11886] - (.Microsoft Corporation - Explorateur Windows.) (.19/08/2013 - 05:49:26.) -- C:\Windows\Explorer.exe [2713600]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Application de démarrage de Windows.) (.14/07/2009 - 02:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.77B35D0FC22A2D2EAC8D07C3F9784DBF] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.13/03/2015 - 03:45:57.) -- C:\Windows\System32\wininet.dll [2358784]
[MD5.8CEBD9D0A0A879CDE9F36F4383B7CAEA] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.17/07/2014 - 03:07:24.) -- C:\Windows\System32\Winlogon.exe [455168]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Bibliothèque de licences.) (.20/11/2010 - 14:27:28.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.FA886682CFC5D36718D3E436AACF10B9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.30/05/2014 - 07:45:52.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 02:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.14/07/2009 - 00:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 10:19:22.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 10:26:34.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 11:43:44.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Pilote de port i8042.) (.14/07/2009 - 00:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.14/07/2009 - 01:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27/04/2011 - 03:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 10:23:22.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.24/01/2014 - 03:37:55.) -- C:\Windows\system32\Drivers\ntfs.sys [1684928]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Pilote de port parallèle.) (.14/07/2009 - 01:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 11:52:36.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.14/07/2009 - 01:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.70988118145F5F10EF24720B97F35F65] - (.Microsoft Corporation - TDI Translation Driver.) (.11/11/2014 - 02:46:26.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.20/11/2010 - 14:34:04.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes:  Scanned in 00mn 00s



---\\ Etat des fichiers cachés (Caché/Total)
~ Mes images (My Pictures) : 4/25
~ Mes musiques (My Musics) : 4/552
~ Mes Videos (My Videos) : 2/26
~ Mes Favoris (My Favorites) : 1/24
~ Mes Documents (My Documents) : 2/3776
~ Mon Bureau (My Desktop) : 2/210
~ Menu demarrer (Programs) : 1/36
~ Hidden Files:  Scanned in 00mn 01s



---\\ Processus lancés
[MD5.18E5C2F937F9DEB8C282DF66A3761925] - (.ASUS - ASLDR Service.) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe   [84536] [PID.1444]
[MD5.E4B976BBA2661E8FCA283FC48F7EFBEE] - (.ASUS - SmartLogon Application.) -- C:\Program Files (x86)\ASUS\SmartLogon\smartlogon.exe   [653952] [PID.1576]
[MD5.7910158929571214A959D5A6D16DD9C0] - (.ASUS - GFNEXSrv.) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe   [96896] [PID.1660]
[MD5.8FA553E9AE69808D99C164733A0F9590] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe   [44808] [PID.1708]
[MD5.89D2706FCD45E33CECFBD46BCBAD7E16] - (.Microsoft Corporation - Tablet PC Input Panel Helper.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe   [10240] [PID.1944]
[MD5.C863272577DC93199F9A2D108468EDB9] - (.Pas de propriétaire - SaibSVC Application.) -- C:\Program Files (x86)\Roxio\BackOnTrack\App\SaibSVC.exe   [457200] [PID.2244]
[MD5.C245E08EC469A52A622EFDC9787A0DCC] - (.Adobe Systems Incorporated - Adobe Photoshop Elements 10.0 (component).) -- C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe   [169624] [PID.2276]
[MD5.C752A6902163B5E9C3554BA69A275F41] - (...) -- C:\Program Files (x86)\Roxio\BackOnTrack\App\BService.exe   [21488] [PID.2460]
[MD5.37DEB76A2CF005841C4E45DE2B94D84F] - (.ASUS - AsScrPro.) -- C:\Windows\AsScrPro.exe   [3058304] [PID.2496]
[MD5.57B4D34232852BFE4453BE571DF90D21] - (.CyberLink - CyberLink MediaLibray Service.) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe   [103720] [PID.2532]
[MD5.F4DCD4912B185C3AAEB92A7040832AD1] - (.Pas de propriétaire - ALU.) -- C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe   [51768] [PID.2704]
[MD5.5BB1F77C8AF725A15EC9366498D275BB] - (.ASUS - ATKOSD2.) -- C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe   [5732992] [PID.2804]
[MD5.D3F0452392C45081D8866A92C86D1C7C] - (.Flexera Software, Inc. - FLEXnet Connect Software Manager.) -- C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe   [324976] [PID.2900]
[MD5.2646A36ABFDC61325281E37894642F97] - (.xwidget.com - Widget Engine by xwidget.com.) -- C:\Program Files (x86)\XWidget\xwidget.exe   [1811968] [PID.2948]
[MD5.7D2C5F5A9DF7AE26B4E62E2D7032B96B] - (.ASUS - ACMON.) -- C:\Program Files (x86)\ASUS\Splendid\ACMON.exe   [82944] [PID.2996]
[MD5.8AE8A5F6EBB5F4DA33BB410FE229489C] - (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files (x86)\LOGICIEL 2012\Internet Download Manager\IDMan.exe   [3380632] [PID.2072]
[MD5.0BB8A77B544C70FE6599300D275B9D96] - (...) -- C:\Users\newjams25\AppData\Roaming\cacaoweb\cacaoweb.exe   [515888] [PID.2384]  =>PUP.CacaoWeb
[MD5.F5143A7CA66EB913B5463BED3D3DD8D2] - (.DT Soft Ltd - DAEMON Tools Shell Extensions Helper.) -- C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe   [3120448] [PID.2368]
[MD5.9445D3F5189547829CD6FCA75AE604A9] - (.Dexpot GbR - Dexpot - Virtual desktops for Windows.) -- C:\Users\newjams25\AppData\Local\Temp\Rar$EXa0.592\dexpot.exe   [1433600] [PID.2716]
[MD5.7DFCCC67990B6DE7F30F553A4E4612A4] - (...) -- C:\Program Files (x86)\RocketDock\RocketDock.exe   [495616] [PID.2724]
[MD5.83BB030C71C9727DCFB2737005772C4E] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe   [232264] [PID.3364]
[MD5.1F79342D9EB530A48742F651E570983A] - (.Microsoft Corporation - Updates Skype Click to Call.) -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe   [1390176] [PID.3812]
[MD5.E4938E0A376CF0B9D989EE5C0A146891] - (.Microsoft Corporation - Phone Number Recognition (PNR) module.) -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe   [1767520] [PID.3860]
[MD5.7EE22E13DEC8A6D18F4643C1EA34B0F0] - (.Virage Logic Corporation / Sonic Focus - ASUS_MATray.exe.) -- C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe   [984400] [PID.4080]
[MD5.79A3B950988F8D2B81906D0C0473158B] - (.ASUS - ATK Media.) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe   [170624] [PID.2712]
[MD5.5AEBF6FA9805C9101220AA4FB4FA17E7] - (.ASUS - HControlUser.) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe   [105016] [PID.2940]
[MD5.083649EF692A066880C9326020915AFE] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe   [4297136] [PID.3300]
[MD5.5C77CC45B8F4EA4A0A6248B29B0C1566] - (.Pas de propriétaire - CPMonitor Application.) -- C:\Program Files (x86)\Roxio 2012\5.0\CPMonitor.exe   [84464] [PID.3160]
[MD5.5B2278B3D19A5EA7FB7B9131F6967F5C] - (.Pas de propriétaire - Roxio Burn Launcher.) -- C:\Program Files (x86)\Roxio 2012\Roxio Burn\RoxioBurnLauncher.exe   [506352] [PID.4036]
[MD5.D658AB1B55127D18DCFBCAC8CAAEA522] - (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe   [49208] [PID.4140]
[MD5.16AFB34618E1286FF856DC600AC49C79] - (.Pas de propriétaire - DivX Update.) -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe   [1861968] [PID.4176]
[MD5.34084D25BE6F48D072AA54DE630438FD] - (.Oracle Corporation - Java Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe   [334896] [PID.4200]
[MD5.4AA7D01C34F81608CAC66ACD36BDA38E] - (.Pas de propriétaire - FrameFox Shop.) -- C:\Program Files (x86)\FrameFox\framefox.exe   [416256] [PID.4212]
[MD5.E99CD4524662A2DA7C73372C626669D8] - (.TeamViewer GmbH - TeamViewer 9.) -- C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe   [5261584] [PID.3560]
[MD5.A391896CD406E6377F5CEF31FDC12019] - (.ASUSTeK - ACEngSvr Module.) -- C:\Windows\SysWOW64\ACEngSvr.exe   [155648] [PID.5220]
[MD5.71C6A95A5F0CCC87298C4DD0F2C3635A] - (.Hewlett-Packard Company - LightScribe Service.) -- C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe   [73728] [PID.4436]
[MD5.FF402950220A952E45A18AC84382918B] - (.TeamViewer GmbH - TeamViewer 9.) -- C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe   [14453520] [PID.5368]
[MD5.BB2A2652A8B78628E155B0D7A22D7598] - (.TeamViewer GmbH - TeamViewer 9.) -- C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe   [229648] [PID.6684]
[MD5.8FDA65209157144C3E28809D75A47526] - (.MAGIX AG - Verzeichnisüberwachung und Hilfsaufgaben fü.) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe   [1858048] [PID.812]
[MD5.0803906D607A9B83184447B75B60ECC2] - (.Intel Corporation - Local Manageability Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe   [325656] [PID.5292]
[MD5.9D1CCE440552500DED3A62F9D779CDB4] - (.Nero AG - NeroUpdate.) -- C:\Program Files (x86)\Nero\Update\NASvc.exe   [503080] [PID.2604]
[MD5.D96DDEA6C699A99832E0186057801971] - (.NVIDIA Corporation - NVIDIA Settings Update Manager.) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe   [1997416] [PID.6436]
[MD5.EB79C6C91A99930015EF29AE7FA802D1] - (.Intel Corporation - User Notification Service.) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe   [2655768] [PID.6892]
[MD5.345B45BE09381D2011EB7F9AC11D8AC4] - (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe   [376944] [PID.5032]
[MD5.4B88BF95F7C40E2EDD2B924E0111C456] - (.Mozilla Corporation - Plugin Container for Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe   [267888] [PID.7068]
[MD5.66F6B3894132CC3D347CB85FBAE48D57] - (.Adobe Systems, Inc. - Adobe Flash Player 17.0 r0.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe   [1892528] [PID.6796]
[MD5.46769F961E4AB53D76A9E734867E0E54] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe   [8208896] [PID.7572]
~ Processes Running:  Scanned in 00mn 01s



---\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:\Users\newjams25\AppData\Local\Google\Chrome\User Data\Default\Preferences

---\\ Liste des dossiers d'extension Google Chrome
G2 - EXT: C:\Users\newjams25\AppData\Local\Google\Chrome\User Data\Default\Extensions\defdhglnppeioeflggkmglipcecffkhk [AutocompletePro plugin for chrome]  =>Adware.PredictAd
~ Google Lines Browser: 8 Legitimates Filtered in 00mn 00s



---\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions  (P2,M0,M1,M2,M3)
M2 - MFEP: RegExtension {C2564BE4-35C1-4056-979E-9AA26348BC72} . (...) -- C:\Program Files (x86)\LyricsLauncher\122.xpi (.not file.)  =>Adware.AddLyrics
M2 - MFEP: prefs.js [newjams25 - 47q75cgh.default-1424586693021\8C033D1B-0514-492c-A44B-6D802CC25673@jetpack] [] FrameFox Shop v2.0.0.0 (..)
M2 - MFEP: prefs.js [newjams25 - 47q75cgh.default-1424586693021\cacaoweb@cacaoweb.org] [] cacaoweb v1.0.34 (..)  =>PUP.CacaoWeb
M2 - MFEP: prefs.js [newjams25 - 47q75cgh.default-1424586693021\pavel.sherbakov@gmail.com] [] Speed Dial [FVD] - New Tab Page, Sync... v1.0.34 (..)  =>PUP.QuickShare
M2 - MFEP: Extension [newjams25 - 47q75cgh.default-1424586693021] 8C033D1B-0514-492c-A44B-6D802CC25673@jetpack
M2 - MFEP: Extension [newjams25 - 47q75cgh.default-1424586693021] adblockpopups@jessehakanen.net.xpi
M2 - MFEP: Extension [newjams25 - 47q75cgh.default-1424586693021] cacaoweb@cacaoweb.org  =>PUP.CacaoWeb
M2 - MFEP: Extension [newjams25 - 47q75cgh.default-1424586693021] jid0-HbNL9qqBkuuKRhJ9ncTonCky1HU@jetpack.xpi
M2 - MFEP: Extension [newjams25 - 47q75cgh.default-1424586693021] jid1-cHKBMlArKdIVEg@jetpack.xpi
M2 - MFEP: Extension [newjams25 - 47q75cgh.default-1424586693021] jid1-dwtFBkQjb3SIQp@jetpack.xpi
M2 - MFEP: Extension [newjams25 - 47q75cgh.default-1424586693021] jid1-TQvJxTBYHA8qXg@jetpack.xpi
M2 - MFEP: Extension [newjams25 - 47q75cgh.default-1424586693021] jid1-xKH0EoS44u1a2w@jetpack.xpi
M2 - MFEP: Extension [newjams25 - 47q75cgh.default-1424586693021] pavel.sherbakov@gmail.com
M2 - MFEP: Extension [newjams25 - 47q75cgh.default-1424586693021] searchyoutube@searchyoutube.fr.xpi
M2 - MFEP: Extension [newjams25 - 47q75cgh.default-1424586693021] YoutubeDownloader@PeterOlayev.com.xpi
M2 - MFEP: Extension [newjams25 - 47q75cgh.default-1424586693021] {b9bfaf1c-a63f-47cd-8b9a-29526ced9060}.xpi
M2 - MFEP: Extension [newjams25 - 47q75cgh.default-1424586693021] {F2C70981-7CDC-4c46-ACF3-41F18693E79E}.xpi
M2 - MFEP: Extension [newjams25 - 47q75cgh.default-1424586693021] {fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi
P2 - FPN:Firefox Plugin Navigator . (...) -- C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\ddg.xml
~ Firefox Browser: 42 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com  =>PUP.Istart
R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com  =>PUP.Istart
R0 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com  =>PUP.Istart
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com  =>PUP.Istart
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com  =>PUP.Istart
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com  =>PUP.Istart
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com  =>PUP.Istart
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com  =>PUP.Istart
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com  =>PUP.Istart
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchUrl,Default = http://feed.snap.do  =>Hijacker.SmartBar
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com  =>PUP.Istart
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com  =>PUP.Istart
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com  =>PUP.Istart
~ IE Browser: 25 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local>;*.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management:  Scanned in 00mn 00s



---\\ Analyse des lignes F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys:  Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (51)
~ Hosts File:  Scanned in 00mn 00s



---\\ Browser Helper Objects de navigateur (O2)
O2 - BHO: AcroIEHlprObj Class [64Bits] - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} . (.Pas de propriétaire - AcroIEHelper Module.) -- C:\Program Files (x86)\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SuggestMeYesBHO [64Bits] - {0FB6A909-6086-458F-BD92-1F8EE10042A0} . (.SimplyGen - AutocompletePro - Helps you search the web.) -- C:\Program Files (x86)\AutocompletePro\AutocompletePro.dll  =>Adware.PredictAd
O2 - BHO: CrossriderApp0035497 [64Bits] - {11111111-1111-1111-1111-110311541197} Clé orpheline  =>PUP.CrossRider
O2 - BHO: CrossriderApp0035499 [64Bits] - {11111111-1111-1111-1111-110311541199} Clé orpheline  =>PUP.CrossRider
O2 - BHO: CrossriderApp0044150 [64Bits] - {11111111-1111-1111-1111-110411411150} Clé orpheline  =>PUP.CrossRider
O2 - BHO: CrossriderApp0051680 [64Bits] - {11111111-1111-1111-1111-110511161180} Clé orpheline  =>PUP.CrossRider
~ BHO: 48 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer Toolbars (O3)
O3 - Toolbar: avast! WebRep - [HKLM]{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} . (.AVAST Software - avast! WebRep Plugin.) -- C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
~ Toolbar:  Scanned in 00mn 00s



---\\ Autres liens utilisateurs (O4)
O4 - GS\Desktop [Public]: YTD Video Downloader.lnk . (.GreenTree Applications SRL - YTD Video Downloader.)  -- C:\Program Files (x86)\GreenTree Applications\YTD Video Downloader\ytd.exe   =>PUP.GreenTreeApp
O4 - GS\Program [Public]: Webplayer.lnk . (...)  -- C:\Program Files (x86)\Webplayer\Webplayer.exe (.not file.)  =>Adware.SocialSkinz
O4 - GS\QuickLaunch [newjams25]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files (x86)\Internet Explorer\iexplore.exe http://www.istartsurf.com  =>PUP.Istart
O4 - GS\QuickLaunch [newjams25]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.)  -- C:\Users\newjams25\AppData\Roaming\uTorrent\uTorrent.exe   =>P2P.BitTorrent
O4 - GS\Program [newjams25]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files\Internet Explorer\iexplore.exe http://www.istartsurf.com  =>PUP.Istart
O4 - GS\SystemTools [newjams25]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files\Internet Explorer\iexplore.exe http://www.istartsurf.com  =>PUP.Istart
O4 - GS\Desktop [newjams25]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.)  -- C:\Users\newjams25\AppData\Roaming\uTorrent\uTorrent.exe   =>P2P.BitTorrent
~ Global Startup: 7 Legitimates Filtered in 00mn 04s



---\\ Applications lancées au démarrage du système (O4)
O4 - HKLM\..\Run: [VizorHtmlDialog.exe] . (.Trend Micro Inc. - Trend Titanium.) -- C:\Program Files\Trend Micro\Titanium\UIFramework\VizorHtmlDialog.exe 
O4 - HKLM\..\Run: [Trend Micro Client Framework] . (.Trend Micro Inc. - Trend Micro Client Session Agent Monitor.) -- C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe 
O4 - HKLM\..\Run: [Trend Micro Titanium] . (.Trend Micro Inc. - VizorShortCut Dynamic Link Library.) -- C:\Program Files\Trend Micro\Titanium\VizorShortCut.exe 
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe 
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe 
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe 
O4 - HKLM\..\Run: [RtHDVBg] . (.Realtek Semiconductor - HD Audio Background Process.) -- C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe 
O4 - HKLM\..\Run: [AmIcoSinglun64] . (.Alcor Micro Corp. - Single LUN Icon Utility for VID 058F PID 63.) -- C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe 
O4 - HKLM\..\Run: [ETDCtrl] C:\Program Files (x86)\Elantech\ETDCtrl.exe (.not file.) 
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] . (.Adobe Systems Incorporated - Adobe Updater Startup Utility.) -- C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe   =>.Adobe Systems Incorporated
O4 - HKLM\..\Run: [MacroKeyManager] WTMKM.exe 
O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Programme d'installation de Facebook.) -- C:\Users\newjams25\AppData\Local\Facebook\Update\FacebookUpdate.exe 
O4 - HKCU\..\Run: [ISUSPM] . (.Flexera Software, Inc. - FLEXnet Connect Software Manager.) -- C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe 
O4 - HKCU\..\Run: [Akamai NetSession Interface] . (.Akamai Technologies, Inc. - Akamai NetSession Client.) -- C:\Users\newjams25\AppData\Local\Akamai\netsession_win.exe 
O4 - HKCU\..\Run: [xwidget] . (.xwidget.com - Widget Engine by xwidget.com.) -- C:\Program Files (x86)\XWidget\xwidget.exe 
O4 - HKCU\..\Run: [Wunderlist] C:\Users\newjams25\AppData\Local\Apps\2.0\8Z9ZJMQ7.HG4\N8YXJDRX.9AB\wund..tion_45ec1bcecca77a53_0002.0000_764351e9af88762f\Wunderlist.exe (.not file.) 
O4 - HKCU\..\Run: [Hobbyist Software VLC Streamer] . (.Hobbyist Software - VLC Streamer Configuration.) -- C:\Program Files (x86)\Hobbyist Software\VLC Streamer\VLC Streamer Configuration.exe 
O4 - HKCU\..\Run: [LightScribe Control Panel] . (.Hewlett-Packard Company - Pas de description.) -- C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe 
O4 - HKCU\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files (x86)\LOGICIEL 2012\Internet Download Manager\IDMan.exe 
O4 - HKCU\..\Run: [uTorrent] . (.BitTorrent Inc. - µTorrent.) -- C:\Users\newjams25\AppData\Roaming\uTorrent\uTorrent.exe   =>P2P.BitTorrent
O4 - HKCU\..\Run: [cacaoweb] . (...) -- C:\Users\newjams25\AppData\Roaming\cacaoweb\cacaoweb.exe   =>PUP.CacaoWeb
O4 - HKCU\..\Run: [SearchProtection] C:\Users\newjams25\AppData\Roaming\Search Protection\SearchProtection.exe (.not file.)   =>PUP.SearchProtect
O4 - HKCU\..\Run: [Dexpot] . (.Dexpot GbR - Dexpot - Virtual desktops for Windows.) -- C:\Users\newjams25\AppData\Local\Temp\Rar$EXa0.592\dexpot.exe 
O4 - HKCU\..\Run: [RocketDock] . (...) -- C:\Program Files (x86)\RocketDock\RocketDock.exe 
O4 - HKCU\..\Run: [CAHeadless] Clé orpheline
O4 - HKCU\..\Run: [Sony PC Companion] . (.Sony - Sony PC Companion.) -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe 
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] . (.DT Soft Ltd - DAEMON Tools Pro Agent.) -- C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe 
O4 - HKCU\..\Run: [ToutBox.fr] . (...) -- C:\Program Files (x86)\ToutBox\ToutBox.exe 
O4 - HKLM\..\Wow6432Node\Run: [Nuance PDF Reader-reminder] . (.Nuance Communications, Inc. - Ereg.) -- C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe 
O4 - HKLM\..\Wow6432Node\Run: [ASUSWebStorage] . (.ecareme - AsusWebStorage.) -- C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe 
O4 - HKLM\..\Wow6432Node\Run: [SonicMasterTray] . (.Virage Logic Corporation / Sonic Focus - ASUS_MATray.exe.) -- C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe 
O4 - HKLM\..\Wow6432Node\Run: [ATKOSD2] . (.ASUS - ATKOSD2.) -- C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe 
O4 - HKLM\..\Wow6432Node\Run: [ATKMEDIA] . (.ASUS - ATK Media.) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe 
O4 - HKLM\..\Wow6432Node\Run: [HControlUser] . (.ASUS - HControlUser.) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe 
O4 - HKLM\..\Wow6432Node\Run: [Wireless Console 3] . (.ASUS - Wireless Console 3.) -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe 
O4 - HKLM\..\Wow6432Node\Run: [UpdateLBPShortCut] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe 
O4 - HKLM\..\Wow6432Node\Run: [UpdateP2GoShortCut] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe 
O4 - HKLM\..\Wow6432Node\Run: [avast] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastUI.exe 
O4 - HKLM\..\Wow6432Node\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe 
O4 - HKLM\..\Wow6432Node\Run: [RoxWatchTray] . (.Rovi Corporation - RoxMMTrayApp Module.) -- C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatchTray13.exe   =>.Sonic Solutions
O4 - HKLM\..\Wow6432Node\Run: [CPMonitor] . (.Pas de propriétaire - CPMonitor Application.) -- C:\Program Files (x86)\Roxio 2012\5.0\CPMonitor.exe 
O4 - HKLM\..\Wow6432Node\Run: [Desktop Disc Tool] . (.Pas de propriétaire - Roxio Burn Launcher.) -- C:\Program Files (x86)\Roxio 2012\Roxio Burn\RoxioBurnLauncher.exe   =>.Roxio
O4 - HKLM\..\Wow6432Node\Run: [SwitchBoard] . (.Adobe Systems Incorporated - SwitchBoard Server (32 bit).) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe 
O4 - HKLM\..\Wow6432Node\Run: [AdobeCS5ServiceManager] . (.Adobe Systems Incorporated - Adobe CS5 Service Manager.) -- C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe 
O4 - HKLM\..\Wow6432Node\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe   =>.Hewlett-Packard Co
O4 - HKLM\..\Wow6432Node\Run: [GrooveMonitor] . (.Microsoft Corporation - GrooveMonitor Utility.) -- C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe 
O4 - HKLM\..\Wow6432Node\Run: [stv_fr_4] Clé orpheline  =>PUP.Eorezo
O4 - HKLM\..\Wow6432Node\Run: [EaseUS EPM tray] . (.CHENGDU YIWO Tech Development Co., Ltd - EaseUS Partition Master Free Edition Applic.) -- C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.0\bin\EpmNews.exe 
O4 - HKLM\..\Wow6432Node\Run: [DivXMediaServer] . (.DivX, LLC - DivX Media Server Launcher.) -- C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe 
O4 - HKLM\..\Wow6432Node\Run: [DivXUpdate] . (.Pas de propriétaire - DivX Update.) -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe 
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe   =>.Oracle Corporation
O4 - HKLM\..\Wow6432Node\Run: [FrameFox Shop] . (.Pas de propriétaire - FrameFox Shop.) -- C:\Program Files (x86)\FrameFox\framefox.exe 
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe   =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe   =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe   =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe   =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2846524085-2324219363-2239751216-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets du Bureau Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe   =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2846524085-2324219363-2239751216-1000\..\Run: [ISUSPM] . (.Flexera Software, Inc. - FLEXnet Connect Software Manager.) -- C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe 
O4 - HKUS\S-1-5-21-2846524085-2324219363-2239751216-1000\..\Run: [RocketDock] . (...) -- C:\Program Files (x86)\RocketDock\RocketDock.exe 
O4 - HKUS\S-1-5-21-2846524085-2324219363-2239751216-1000\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe   =>.Microsoft Corporation
~ Application:  Scanned in 00mn 00s



---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)
O9 - Extra button: Skype Click to Call settings [64Bits] - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- c:\program files (x86)\skype\toolbars\internet explorer x64\icon.ico
~ IE Extra Buttons:  Scanned in 00mn 00s



---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} ((no name)) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
~ Objets ActiveX:  Scanned in 00mn 00s



---\\ Modification Domaine/Adresses DNS (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C60E9A0-CCD0-4DB1-87C3-40EE03A00FBB}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C60E9A0-CCD0-4DB1-87C3-40EE03A00FBB}: DhcpDomain = lan
O17 - HKLM\System\CS1\Services\Tcpip\..\{1C60E9A0-CCD0-4DB1-87C3-40EE03A00FBB}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{1C60E9A0-CCD0-4DB1-87C3-40EE03A00FBB}: DhcpDomain = lan
O17 - HKLM\System\CS2\Services\Tcpip\..\{1C60E9A0-CCD0-4DB1-87C3-40EE03A00FBB}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{1C60E9A0-CCD0-4DB1-87C3-40EE03A00FBB}: DhcpDomain = lan
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
~ Domain:  Scanned in 00mn 00s



---\\ Protocole additionnel (O18)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) -- 
O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll  =>.Microsoft Corporation
~ Protocole Additionnel:  Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon:  Scanned in 00mn 00s



---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 - AppInit_DLLs: . (...) - c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll (.not file.)  =>PUP.BitGuard
~ AppInit DLL:  Scanned in 00mn 00s



---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: (no name) [64Bits] - {F791A188-699D-4FD4-955A-EB59E89B1907} - (.not file.)
~ STS/SSO:  Scanned in 00mn 00s



---\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 - Service: Roxio SAIB Service (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) . (.Pas de propriétaire - SaibSVC Application.) - C:\Program Files (x86)\Roxio\BackOnTrack\App\SaibSVC.exe
O23 - Service: BOT4Service (BOT4Service) . (...) - C:\Program Files (x86)\Roxio\BackOnTrack\App\BService.exe
O23 - Service: BlueStacks Android Service (BstHdAndroidSvc) . (...) - C:\Program Files (x86)\BlueStacks\HD-Service.exe (.not file.)
O23 - Service: BlueStacks Log Rotator Service (BstHdLogRotatorSvc) . (...) - C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe (.not file.)
O23 - Service: Duuqu Update Service (dqupdate) (dqupdate) . (.Duuqu Group - Duuqu Installer.) - C:\Program Files (x86)\Duuqu\Update\DuuquUpdate.exe  =>PUP.Duuqu
O23 - Service: globalUpdate Update Service (globalUpdate) (globalUpdate) . (...) - C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe (.not file.)  =>PUP.GlobalUpdate
O23 - Service: Service KMSELDI (Service KMSELDI) . (.@ByELDI - Service_KMS.) - C:\Program Files\KMSpico\Service_KMS.exe  =>PUA.KMSpico
~ Services: 22 Legitimates Filtered in 00mn 09s



---\\ Tâches planifiées en automatique (O39)
[MD5.CCB2387238BC39C056DF01F3C9124BB6] [APT] [AutoPico Daily Restart] (.@ByELDI.) -- C:\Program Files\KMSpico\AutoPico.exe   [966848]  =>PUA.KMSpico
[MD5.136E913B1D3771B3535C3622C36B5E38] [APT] [DuuquUpdateTaskMachineCore] (.Duuqu Group.) -- C:\Program Files (x86)\Duuqu\Update\DuuquUpdate.exe   [98360]  =>PUP.Duuqu
[MD5.136E913B1D3771B3535C3622C36B5E38] [APT] [DuuquUpdateTaskMachineUA] (.Duuqu Group.) -- C:\Program Files (x86)\Duuqu\Update\DuuquUpdate.exe   [98360]  =>PUP.Duuqu
[MD5.10C7F833D6D01BB643E3A8F17C4AD144] [APT] [GoforFilesUpdate] (.http://goforfiles.com/.) -- C:\Program Files (x86)\GoforFiles Updater\GFFUpdater.exe   [985088]  =>P2P.GoforFiles
[MD5.00000000000000000000000000000000] [APT] [LaunchApp] (...) -- C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (.not file.)   [0]  =>PUP.MyPCBackup
[MD5.00000000000000000000000000000000] [APT] [wp_update] (...) -- C:\Users\newjams25\AppData\Roaming\~keaxqaz.exe (.not file.)   [0]  =>PUP.WpManager
[MD5.00000000000000000000000000000000] [APT] [YourFile Update] (...) -- C:\Program Files (x86)\YourFileDownloader\YourFileUpdater.exe (.not file.)   [0]  =>PUP.YourFileDownloader
[MD5.00000000000000000000000000000000] [APT] [{5209877A-1D76-486C-B1C5-990509E90907}] (...) -- C:\Users\newjams25\AppData\Local\Temp\Rar$EXa0.987\ezmb_b6.1\setup.exe (.not file.)   [0]
[MD5.00000000000000000000000000000000] [APT] [{BA6E9BD8-D17E-41E9-A3C6-48096E00522F}] (...) -- C:\Users\newjams25\Downloads\NetPass_2.0.exe (.not file.)   [0]
O39 - APT:  - (..) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater   [1002]
O39 - APT: DuuquUpdateTaskMachineCore - (.Duuqu Group.) -- C:\Windows\Tasks\DuuquUpdateTaskMachineCore.job   [890]  =>PUP.Duuqu
O39 - APT: DuuquUpdateTaskMachineCore - (.Duuqu Group.) -- C:\Windows\System32\Tasks\DuuquUpdateTaskMachineCore   [890]  =>PUP.Duuqu
O39 - APT: DuuquUpdateTaskMachineUA - (.Duuqu Group.) -- C:\Windows\Tasks\DuuquUpdateTaskMachineUA.job   [894]  =>PUP.Duuqu
O39 - APT: DuuquUpdateTaskMachineUA - (.Duuqu Group.) -- C:\Windows\System32\Tasks\DuuquUpdateTaskMachineUA   [894]  =>PUP.Duuqu
O39 - APT:  - (..) -- C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2846524085-2324219363-2239751216-1001Core   [1090]
O39 - APT:  - (..) -- C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2846524085-2324219363-2239751216-1001UA   [1112]
O39 - APT:  - (..) -- C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job   [906]  =>PUP.GlobalUpdate
O39 - APT:  - (..) -- C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore   [906]  =>PUP.GlobalUpdate
O39 - APT:  - (..) -- C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job   [910]  =>PUP.GlobalUpdate
O39 - APT:  - (..) -- C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA   [910]  =>PUP.GlobalUpdate
O39 - APT:  - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore   [1070]
O39 - APT:  - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA   [1074]
~ Scheduled Task: 90 Legitimates Filtered in 00mn 03s



---\\ Pilotes lancés au démarrage du système (O41)
O41 - Driver:  (HWiNFO32) . (.REALiX(tm) - HWiNFO AMD64 Kernel Driver.) - C:\Windows\sysWOW64\drivers\HWiNFO64A.sys
~ Drivers: 84 Legitimates Filtered in 00mn 00s



---\\ Logiciels installés (O42)
O42 - Logiciel: Cling Clang - (.Cling Clang.) [HKLM][64Bits] -- Cling Clang  =>PUP.ClingClang
O42 - Logiciel: FrameFox Shop 2.0.0.0 - (.The Team.) [HKLM][64Bits] -- {010BE806-614F-48F2-B83A-29DF45E6AC7D}
O42 - Logiciel: KMSpico - (...) [HKLM][64Bits] -- {8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1  =>PUA.KMSpico
O42 - Logiciel: MultiPassWord v2.0.1.5 - (.BLQ Software.com.) [HKLM][64Bits] -- {36406C86-239F-419F-90A6-36DDBF3F4837}_is1
O42 - Logiciel: Theme Resource Changer X64 v1.0 - (.Bad Ass Apps.) [HKLM][64Bits] -- Theme Resource Changer X64 v1.0
O42 - Logiciel: ToutBox - (.ToutBox.fr.) [HKLM][64Bits] -- {95EE05DA-2FDA-4A7C-9B62-941B2D482B2F}
O42 - Logiciel: WindowsMangerProtect20.0.0.502 - (.WindowsProtect LIMITED.) [HKLM][64Bits] -- WindowsMangerProtect  =>PUP.Fuyu
O42 - Logiciel: YoutubeAdblocker - (.YoutubeAdblocker.) [HKLM][64Bits] -- {4820778D-AB0D-6D18-C316-52A6A0E1D507}  =>PUP.YouTubeAdBlock
O42 - Logiciel: video MediaPlay-Air - (.enter.) [HKLM][64Bits] -- video MediaPlay-Air  =>PUP.CrossRider
~ Logic: 26 Legitimates Filtered in 00mn 01s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\10a3ff583a8855eb34d4dbc80531f951]  =>PUP.CrossRider
[HKCU\Software\592d6dde16eb815]  =>Hijacker.Eazel
[HKCU\Software\97335ed968c8d21501810d2516770677]  =>PUP.CrossRider
[HKCU\Software\AT HOME Développement]
[HKCU\Software\AutocompletePro]  =>Adware.PredictAd
[HKCU\Software\BabSolution]  =>Hijacker.BabSolution
[HKCU\Software\Conduit]  =>Toolbar.Conduit
[HKCU\Software\Duuqu]  =>PUP.Duuqu
[HKCU\Software\ERGOM DayOrganizer]
[HKCU\Software\FVDSuite]
[HKCU\Software\FVDToolbar]
[HKCU\Software\FileScout]  =>PUP.FileScout
[HKCU\Software\Football News App]
[HKCU\Software\GUPPY]
[HKCU\Software\Ice Apps]
[HKCU\Software\IncrediMail]
[HKCU\Software\InstalledBrowserExtensions]  =>PUP.BrowserExtensions
[HKCU\Software\Quisple Prestige]
[HKCU\Software\Softonic]  =>Toolbar.Conduit
[HKCU\Software\TutoTag]  =>PUP.AgenceExclusive
[HKCU\Software\YahooPartnerToolbar]
[HKCU\Software\cacaoweb]  =>PUP.CacaoWeb
[HKCU\Software\freesofttoday]  =>Adware.FreeSoftToday
[HKLM\Software\InstalledBrowserExtensions]  =>PUP.BrowserExtensions
[HKLM\Software\Wow6432Node\592d6dde16eb815]  =>Hijacker.Eazel
[HKLM\Software\Wow6432Node\AGENCE-EXCLUSIVE]  =>PUP.AgenceExcusive
[HKLM\Software\Wow6432Node\Duuqu]  =>PUP.Duuqu
[HKLM\Software\Wow6432Node\FrameFox]
[HKLM\Software\Wow6432Node\InstUf]
[HKLM\Software\Wow6432Node\InstalledBrowserExtensions]  =>PUP.BrowserExtensions
[HKLM\Software\Wow6432Node\Jbz25]
[HKLM\Software\Wow6432Node\SupDp]  =>PUP.SupTab
[HKLM\Software\Wow6432Node\Totem]
[HKLM\Software\Wow6432Node\ToutBox]
[HKLM\Software\Wow6432Node\Tutorials]  =>PUP.AgenceExclusive
[HKLM\Software\Wow6432Node\Wpm]  =>PUP.WpManager
[HKLM\Software\Wow6432Node\free_soft_to_day]  =>Adware.FreeSoftToday
[HKLM\Software\Wow6432Node\free_soft_today]  =>Adware.FreeSoftToday
[HKLM\Software\Wow6432Node\supTab]  =>PUP.SupTab
[HKLM\Software\Wow6432Node\supWPM]  =>PUP.WpManager
~ Key Software: 477 Legitimates Filtered in 00mn 01s



---\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 26/01/2012 - 00:56:25 - [] ----D C:\Program Files (x86)\2
O43 - CFD: 12/08/2013 - 08:04:53 - [] ----D C:\Program Files (x86)\AutocompletePro  =>Adware.PredictAd
O43 - CFD: 14/08/2013 - 21:47:55 - [0] ----D C:\Program Files (x86)\Delta
O43 - CFD: 26/01/2012 - 11:44:10 - [] ----D C:\Program Files (x86)\doubleTwist 2.0
O43 - CFD: 21/10/2013 - 06:20:14 - [] ----D C:\Program Files (x86)\Duuqu  =>PUP.Duuqu
O43 - CFD: 08/05/2015 - 05:31:15 - [] ----D C:\Program Files (x86)\FrameFox
O43 - CFD: 06/02/2015 - 02:42:59 - [0] ----D C:\Program Files (x86)\GUM6E5C.tmp
O43 - CFD: 02/09/2013 - 21:55:32 - [] ----D C:\Program Files (x86)\Mediator1
O43 - CFD: 14/08/2013 - 19:34:10 - [] ----D C:\Program Files (x86)\My 7 CustoBox
O43 - CFD: 20/05/2012 - 11:11:08 - [] ----D C:\Program Files (x86)\priyatna.org
O43 - CFD: 31/12/2012 - 06:22:16 - [] ----D C:\Program Files (x86)\ProjectF - Your Menu
O43 - CFD: 12/05/2013 - 12:20:38 - [] ----D C:\Program Files (x86)\Reilly Labs
O43 - CFD: 13/04/2014 - 07:40:04 - [0] ----D C:\Program Files (x86)\saaVe netu  =>PUP.SaveNet
O43 - CFD: 13/04/2014 - 07:41:48 - [0] ----D C:\Program Files (x86)\SNT
O43 - CFD: 31/03/2013 - 19:50:21 - [] ----D C:\Program Files (x86)\Stuff Organizer
O43 - CFD: 23/02/2015 - 04:54:51 - [] ----D C:\Program Files (x86)\SupTab  =>PUP.SupTab
O43 - CFD: 07/05/2015 - 04:03:11 - [] ----D C:\Program Files (x86)\ToutBox
O43 - CFD: 11/03/2014 - 20:38:26 - [] ----D C:\Program Files (x86)\Uninstaller
O43 - CFD: 16/02/2015 - 19:52:37 - [] ----D C:\Program Files (x86)\video MediaPlay-Air  =>PUP.CrossRider
O43 - CFD: 21/08/2013 - 23:44:28 - [] ----D C:\Program Files (x86)\XWidget
O43 - CFD: 27/01/2012 - 10:37:18 - [0] ----D C:\Program Files (x86)\Ìîÿ ïðîãðàììà
O43 - CFD: 26/01/2012 - 11:44:10 - [] ----D C:\Program Files (x86)\Common Files\doubleTwist
O43 - CFD: 11/01/2014 - 22:43:07 - [] ----D C:\Program Files (x86)\Common Files\Totem Shared
O43 - CFD: 16/04/2014 - 03:21:23 - [] ----D C:\ProgramData\19ecc5cf5478a1c6
O43 - CFD: 09/08/2013 - 20:06:27 - [0] ----D C:\ProgramData\Babylon  =>PUP.Babylon
O43 - CFD: 25/12/2014 - 04:53:19 - [] ----D C:\ProgramData\IePluginServices  =>PUP.IePluginService
O43 - CFD: 13/04/2014 - 07:41:27 - [] ----D C:\ProgramData\InstallMate  =>PUP.Tarma
O43 - CFD: 24/03/2015 - 19:58:04 - [] ----D C:\ProgramData\License_LRC
O43 - CFD: 16/05/2015 - 00:24:35 - [] ----D C:\ProgramData\ProductData
O43 - CFD: 16/04/2014 - 03:23:13 - [0] ----D C:\ProgramData\saaVe netu  =>PUP.SaveNet
O43 - CFD: 13/04/2014 - 07:41:28 - [] ----D C:\ProgramData\SuperbApp
O43 - CFD: 16/08/2012 - 10:16:21 - [] ----D C:\ProgramData\uMedia
O43 - CFD: 03/08/2014 - 20:02:02 - [] ----D C:\ProgramData\WindowsMangerProtect  =>PUP.Fuyu
O43 - CFD: 11/03/2014 - 07:37:29 - [] ----D C:\ProgramData\WPM  =>PUP.WpManager
O43 - CFD: 19/07/2012 - 07:14:42 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AACD v4
O43 - CFD: 26/01/2012 - 11:44:10 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\doubleTwist
O43 - CFD: 06/03/2015 - 06:06:58 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Booster 2
O43 - CFD: 14/08/2013 - 19:34:05 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\My 7 CustoBox
O43 - CFD: 20/05/2012 - 11:11:09 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\priyatna.org
O43 - CFD: 31/03/2013 - 19:50:21 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stuff Organizer
O43 - CFD: 14/07/2009 - 09:44:38 - [0] R-H-D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC
O43 - CFD: 07/05/2015 - 04:03:13 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ToutBox.fr
O43 - CFD: 20/08/2013 - 19:22:36 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XWidget
O43 - CFD: 31/12/2012 - 06:22:16 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Your Menu
O43 - CFD: 19/07/2012 - 07:14:53 - [] ----D C:\Users\newjams25\AppData\Roaming\aacd
O43 - CFD: 12/03/2014 - 07:30:55 - [] ----D C:\Users\newjams25\AppData\Roaming\BabSolution  =>Hijacker.BabSolution
O43 - CFD: 16/05/2015 - 21:21:45 - [] ----D C:\Users\newjams25\AppData\Roaming\cacaoweb  =>PUP.CacaoWeb
O43 - CFD: 21/07/2012 - 19:39:13 - [] ----D C:\Users\newjams25\AppData\Roaming\ERGOM
O43 - CFD: 23/08/2012 - 21:31:24 - [] ----D C:\Users\newjams25\AppData\Roaming\IClaro  =>PUP.IClaro
O43 - CFD: 12/05/2013 - 12:23:15 - [] ----D C:\Users\newjams25\AppData\Roaming\ReillyLabs
O43 - CFD: 21/09/2012 - 19:15:55 - [] ----D C:\Users\newjams25\AppData\Roaming\Seas0nPass
O43 - CFD: 30/07/2014 - 03:35:32 - [] ----D C:\Users\newjams25\AppData\Roaming\SupTab  =>PUP.SupTab
O43 - CFD: 05/04/2014 - 05:51:39 - [] ----D C:\Users\newjams25\AppData\Roaming\VistaStyleBuilder
O43 - CFD: 11/03/2014 - 05:44:42 - [] ----D C:\Users\newjams25\AppData\Roaming\wp_update  =>PUP.WpManager
O43 - CFD: 01/01/2013 - 11:01:14 - [] ----D C:\Users\newjams25\AppData\Local\Digital_Distribution
O43 - CFD: 21/10/2013 - 06:20:13 - [] ----D C:\Users\newjams25\AppData\Local\Duuqu  =>PUP.Duuqu
O43 - CFD: 22/02/2015 - 19:44:20 - [] -SH-D C:\Users\newjams25\AppData\Local\EmieBrowserModeList
O43 - CFD: 14/05/2012 - 14:32:16 - [] ----D C:\Users\newjams25\AppData\Local\Films
O43 - CFD: 16/01/2013 - 21:08:02 - [] ----D C:\Users\newjams25\AppData\Local\Le_Pivert
O43 - CFD: 14/12/2014 - 18:37:34 - [] ----D C:\Users\newjams25\AppData\Local\Mega Limited
O43 - CFD: 20/07/2012 - 07:22:23 - [] ----D C:\Users\newjams25\AppData\Local\myCollections
O43 - CFD: 13/07/2014 - 08:11:20 - [0] ----D C:\Users\newjams25\AppData\Local\NCAPT
O43 - CFD: 28/12/2014 - 08:16:35 - [] ----D C:\Users\newjams25\AppData\Local\NYGC
O43 - CFD: 12/03/2014 - 22:05:34 - [] ----D C:\Users\newjams25\AppData\Local\Popcorn-Time
O43 - CFD: 31/03/2013 - 19:56:29 - [] ----D C:\Users\newjams25\AppData\Local\Stuff Organizer
O43 - CFD: 22/02/2013 - 20:03:30 - [0] ----D C:\Users\newjams25\AppData\Local\Temp7T113ZYUA4S
O43 - CFD: 16/05/2015 - 06:18:03 - [] ----D C:\Users\newjams25\AppData\Local\ToutBox.fr
O43 - CFD: 10/03/2015 - 04:04:20 - [] ----D C:\Users\newjams25\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MultiPassWord freeware
~ Program Folder: 487 Legitimates Filtered in 00mn 01s



---\\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 - LFC:[MD5.A54940F72EA866484984D2EA8FF4CC7D] - 15/05/2015 - 23:27:18 ---A- . (...) -- C:\Windows\System32\Drivers\RTAIODAT.DAT   [2014958]
O44 - LFC:[MD5.41A0C456B2911FCEDFF8708A68DAF5F7] - 16/05/2015 - 05:17:12 ---A- . (...) -- C:\Windows\Q-Dir.ini   [43569]
~ Files: 19 Legitimates Filtered in 00mn 07s



---\\ Derniers fichiers créés dans Windows Prefetcher (O45)
O45 - LFCP:[MD5.E3800769F5C90710CFCD808111C3F477] - 16/05/2015 - 05:25:00 ---A- - C:\Windows\Prefetch\DUUQUCRASHHANDLER.EXE-CA3B5323.pf  =>PUP.Duuqu
O45 - LFCP:[MD5.E831E0A53F3F5F88C449A1864FFB80C2] - 16/05/2015 - 22:25:00 ---A- - C:\Windows\Prefetch\DUUQUUPDATE.EXE-AAA01EF3.pf  =>PUP.Duuqu
O45 - LFCP:[MD5.999DBB5A6B0793D567F165F671612F33] - 12/05/2015 - 03:37:01 ---A- - C:\Windows\Prefetch\UTORRENT.EXE-115A368F.pf  =>P2P.µTorrent
~ Prefetcher: 3 Legitimates Filtered in 00mn 00s



---\\ Clé de registre Shell MountPoints2 (MPSK) (O51)
O51 - MPSK:{0ca7e521-c78c-11e3-8f74-b6bcb91375ff}\AutoRun\command. (...) -- I:\Installation.exe (.not file.)
O51 - MPSK:{9bc5f3d1-c3b4-11e4-b0f4-001f81000830}\AutoRun\command. (...) -- F:\Startme.exe (.not file.)
~ Keys:  Scanned in 00mn 00s



---\\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLinkedConnections"=1
~ MWPS: 17 Legitimates Filtered in 00mn 00s



---\\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 12 Legitimates Filtered in 00mn 00s



---\\ Liste des pilotes du système (SDL) (O58)
O58 - SDL:16/08/2012 - 09:06:30 ---A- . (.ITETech - AF9015 BDA Driver.) -- C:\Windows\System32\Drivers\AF15BDA.sys   [507392]
O58 - SDL:21/12/2009 - 10:43:00 ---A- . (.CSR, plc - Bluetooth A2DP Driver.) -- C:\Windows\System32\Drivers\bthav.sys   [78848]
O58 - SDL:13/08/2009 - 08:38:24 ---A- . (.CSR, plc - Bluetooth Remote Control Driver.) -- C:\Windows\System32\Drivers\BthAvrcp.sys   [29184]
O58 - SDL:20/03/2015 - 05:22:49 ---A- . (.DT Soft Ltd - DAEMON Tools Virtual Bus Driver.) -- C:\Windows\System32\Drivers\dtsoftbus01.sys   [271424]
O58 - SDL:14/07/2009 - 02:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys   [530496]
O58 - SDL:31/12/2010 - 11:30:10 ---A- . (.ELAN Microelectronics Corp. - ETD Kernel Center.) -- C:\Windows\System32\Drivers\ETD.sys   [138024]
O58 - SDL:10/06/2009 - 21:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys   [31232]
O58 - SDL:09/06/2011 - 16:50:58 ---A- . (.Tonec Inc. - Internet Download Manager WFP Driver.) -- C:\Windows\System32\Drivers\idmwfp.sys   [153248]
O58 - SDL:27/07/2011 - 19:48:14 ---A- . (.Windows (R) Codename Longhorn DDK provider - doubleTwist iPod Driver.) -- C:\Windows\System32\Drivers\iPodDrv.sys   [14952]
O58 - SDL:20/07/2009 - 10:29:40 ---A- . (.Pas de propriétaire - Keyboard Filter Driver.) -- C:\Windows\System32\Drivers\kbfiltr.sys   [15416]
O58 - SDL:08/03/2009 - 20:16:14 ---A- . (.Windows (R) Codename Longhorn DDK provider - Mouse Filter Driver.) -- C:\Windows\System32\Drivers\moufiltr.sys   [7680]
O58 - SDL:14/07/2009 - 02:45:55 ---A- . (.Promise Technology - Promise  SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys   [24656]
O58 - SDL:28/09/2012 - 10:32:56 ---A- . (.Apple, Inc. - Apple Mobile Device USB Driver.) -- C:\Windows\System32\Drivers\usbaapl64.sys   [53760]
O58 - SDL:26/08/2009 - 14:15:10 ---A- . (.Windows (R) Win 7 DDK provider - Virtual Hid Device.) -- C:\Windows\System32\Drivers\walvhid.sys   [7552]
O58 - SDL:07/03/2013 - 08:49:18 ---A- . (...) -- C:\Windows\System32\epmntdrv.sys   [17480]
O58 - SDL:07/03/2013 - 08:49:18 ---A- . (...) -- C:\Windows\System32\EuGdiDrv.sys   [9800]
O58 - SDL:06/03/2015 - 05:07:13 ---A- . (.REALiX(tm) - HWiNFO AMD64 Kernel Driver.) -- C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS   [26528]
O58 - SDL:07/03/2013 - 08:49:20 ---A- . (...) -- C:\Windows\SysWOW64\epmntdrv.sys   [13896]
O58 - SDL:07/03/2013 - 08:49:20 ---A- . (...) -- C:\Windows\SysWOW64\EuGdiDrv.sys   [9160]
~ Drivers: 100 Legitimates Filtered in 00mn 01s



---\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 - LFC: 10/05/2015 - 23:28:42 --HA- . (...) -- C:\Users\newjams25\Desktop\data des mot passe password aaz\{F828EF3485523073BBC222B9F1E63039887E799F34C062544C5E26DB5B4CDC7015558A59A9968664A4291F3A46B0D181734EA83FC09EC3B079BDC0D12CC2EF5B}.bin   [3]
O61 - LFC: 11/05/2015 - 23:28:42 ---A- . (...) -- C:\Users\newjams25\Downloads\instsf450.exe   [2174848]
O61 - LFC: 16/05/2015 - 23:28:38 ---A- . (...) -- C:\Users\newjams25\.gstreamer-0.10\registry.i686.bin   [323882]
O61 - LFC: 16/05/2015 - 23:28:39 ---A- . (...) -- C:\Users\newjams25\AppData\Local\Google\Chrome\User Data\ev_hashes_whitelist.bin   [1113849]
O61 - LFC: 16/05/2015 - 23:28:42 ---A- . (...) -- C:\Users\newjams25\Desktop\cacaoweb.exe   [515888]  =>PUP.CacaoWeb
O61 - LFC: 16/05/2015 - 23:28:42 ---A- . (...) -- C:\Users\newjams25\Downloads\AnyDesk.exe   [1344608]
~ 1747 Fichiers temporaires (Temporary files)
~ 386 Fichiers cookies (Cookies files)
~ Files: 11 Legitimates Filtered in 00mn 04s



---\\ Liste des outils de désinfection (LATC) (O63)
O63 - Logiciel: ZHPDiag 2015 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1  =>.Nicolas Coolman
~ ADS:  Scanned in 00mn 00s



---\\ Liste les services legacy du registre (LALS) (O64)
O64 - Services: CurCS - 27/07/2011 - C:\Windows\system32\drivers\iPodDrv.sys (iPodDrv)  .(.Windows (R) Codename Longhorn DDK provider - doubleTwist iPod Driver.) - LEGACY_IPODDRV
~ Legacy: 100 Legitimates Filtered in 00mn 00s



---\\ Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s



---\\ Menu de démarrage Internet (SMI) (O68)
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (...) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
~ Keys:  Scanned in 00mn 00s



---\\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} - (Trovi search) - http://www.trovi.com  =>Hijacker.TroviCom
O69 - SBI: SearchScopes [HKCU] {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} - (Search the web) - http://www.searchgol.com  =>Adware.IMBooster
O69 - SBI: SearchScopes [HKCU] {1DF46F06-FD57-4A7C-8272-50C72ECEDDA6} [DefaultScope] - (Yahoo) - http://fr.search.yahoo.com
O69 - SBI: SearchScopes [HKCU] {33BB0A4E-99AF-4226-BDF6-49120163DE86} - (istartsurf) - http://www.istartsurf.com  =>PUP.Istart
~ Keys:  Scanned in 00mn 00s



---\\ Enumère les fichiers Crack & Keygen (CKF) (O82)
C:\Users\newjams25\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_crackkeygengame.com_0.localstorage-journal  =>.Crack,Keygen
C:\Users\newjams25\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_crackkeygengame.com_0.localstorage-journal  =>.Crack,Keygen
E:\logiciels\Phone Copier 7.0.0.3270 Cracked^\Phone Copier 7.0.0.3270Cracked.rar  =>.Crack,Keygen
E:\logiciels\Phone Copier 7.0.0.3270 Cracked^\Torrent Downloaded From ExtraTorrent.com.txt  =>.Crack,Keygen
E:\logiciels\RescuePRO.Deluxe.v5.2.4.3\Keygen.exe  =>.Crack,Keygen
~ Files:  Scanned in 00mn 49s



---\\ Recherche particulière à la racine du système (SPRF) (O84)
[MD5.90E1D86D979B92738A47D7072CB22DA8] [SPRF][07/07/2010] (...) -- C:\ProgramData\FullRemove.exe   [131472]
[MD5.9A0D6D47AD618143B05C0EBCD659DACB] [SPRF][22/03/2013] (.Pas de propriétaire - AAZ-Change-Logo-System.) -- C:\Users\newjams25\Desktop\AAZ-Change-Logo-System.exe   [23709184]
[MD5.723210798AD0E5A6860411D098792CC2] [SPRF][07/01/2014] (.Pas de propriétaire - Outils Maj Antivirus Nash-Rescue.) -- C:\Users\newjams25\Desktop\AIO-Nash-Rescue-2013-v2.exe   [9956880]
[MD5.0BB8A77B544C70FE6599300D275B9D96] [SPRF][16/05/2015] (...) -- C:\Users\newjams25\Desktop\cacaoweb.exe   [515888]  =>PUP.CacaoWeb
[MD5.F97675B0946CEA9FBEB063ADA46DA63B] [SPRF][02/07/2014] (.Geek Uninstaller - Geek Unіnstaller.) -- C:\Users\newjams25\Desktop\geek.exe   [6187528]
[MD5.B67F8826C3B672E39C2106FCBEC9C07C] [SPRF][07/04/2014] (.Team-AAZ - Nashcap.) -- C:\Users\newjams25\Desktop\Nashcap.exe   [8159760]
[MD5.C4BC9ACDAE53C002BA045EC9645468BB] [SPRF][23/11/2013] (.Pas de propriétaire - Password Manager AAZ.) -- C:\Users\newjams25\Desktop\Password Manager AAZ.exe   [2482176]
[MD5.FCE23FBF8A4495ECC17CACFE11A2D544] [SPRF][25/03/2013] (.Inekman - Xtremsplit v1.2.) -- C:\Users\newjams25\Desktop\xtremsplit_xtremsplit_1.2_francais_14862.exe   [305664]
[MD5.65EED9EB55163823E1AE667BD2697A1A] [SPRF][19/12/2014] (.Pas de propriétaire - NYGC.) -- C:\Users\newjams25\Desktop\Youtube-Get-And-Convert.exe   [7947792]
~ Files: 13 Legitimates Filtered in 00mn 00s



---\\ Liste des exceptions du parefeu (FirewallRules) (O87)
O87 - FAEL: "{ABFB44E4-DFE5-4029-8933-42BDF43E4B58}" | In - None - P6 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\newjams25\AppData\Roaming\uTorrent\uTorrent.exe  =>P2P.BitTorrent
O87 - FAEL: "{322377AF-CA5C-44CD-B087-1BBDF68E472F}" | In - None - P17 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\newjams25\AppData\Roaming\uTorrent\uTorrent.exe  =>P2P.BitTorrent
~ Firewall: 2 Legitimates Filtered in 00mn 02s



---\\ Export de clés de registre aléatoires (O91)
[HKCU\Software\10a3ff583a8855eb34d4dbc80531f951]:US="@"
[HKCU\Software\592d6dde16eb815\2.6.1673.238\upd]:="upd=1"  =>Hijacker.Eazel
[HKCU\Software\592d6dde16eb815\2.6.1694.246\upd]:="upd=1"  =>Hijacker.Eazel
[HKCU\Software\592d6dde16eb815\2.7.1769.27\upd]:="upd="  =>Hijacker.Eazel
[HKCU\Software\592d6dde16eb815\2.7.1832.68\upd]:="upd="  =>Hijacker.Eazel
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:dllName="BrowserDefender.dll"  =>Hijacker.Eazel
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:exeName="BrowserDefender.exe"  =>Hijacker.Eazel
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:folderName="BrowserDefender"  =>Hijacker.Eazel
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:guid="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}"  =>Hijacker.Eazel
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:serviceName="BrowserDefendert"  =>PUA.BrowserDefendert
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:version="2.6.1519.190"  =>Hijacker.Eazel
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:dllName="BitGuard.dll"  =>PUP.BitGuard
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:exeName="BitGuard.exe"  =>PUP.BitGuard
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:folderName="BitGuard"  =>PUP.BitGuard
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:guid="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}"  =>Hijacker.Eazel
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:serviceName="BitGuard"  =>PUP.BitGuard
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:version="2.6.1673.238"  =>Hijacker.Eazel
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1694.246]:dllName="BitGuard.dll"  =>PUP.BitGuard
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1694.246]:exeName="BitGuard.exe"  =>PUP.BitGuard
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1694.246]:folderName="BitGuard"  =>PUP.BitGuard
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1694.246]:guid="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}"  =>Hijacker.Eazel
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1694.246]:serviceName="BitGuard"  =>PUP.BitGuard
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1694.246]:version="2.6.1694.246"  =>Hijacker.Eazel
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.7.1769.27]:SERVICE_NAME="BitGuard"  =>PUP.BitGuard
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.7.1769.27]:dllName="BitGuard.dll"  =>PUP.BitGuard
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.7.1769.27]:exeName="BitGuard.exe"  =>PUP.BitGuard
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.7.1769.27]:folderName="BitGuard"  =>PUP.BitGuard
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.7.1769.27]:guid="{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}"  =>Hijacker.Eazel
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.7.1769.27]:version="2.7.1769.27"  =>Hijacker.Eazel
[HKCU\Software\97335ed968c8d21501810d2516770677]:5702673368512820f82155c9e1d5e18a="TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNI
[HKCU\Software\97335ed968c8d21501810d2516770677]:US="@"
[HKCU\Software\97335ed968c8d21501810d2516770677]:a4a32fe0594d239b57a01bf6b404e44f="TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNI
[HKLM\Software\Wow6432Node\592d6dde16eb815] => Clé orpheline => Clé orpheline => Clé orpheline => Clé orpheline
~ Export Key Software:  Scanned in 00mn 00s



---\\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.90CDD56121998FD4EBBF73196B382A50] [WIS][14/08/2012] (.IClaro - IClaroInstaller.) -- C:\Windows\Installer\2dfab5f.msi   [182272]  =>PUP.IClaro
[MD5.8A37962EBCB8A2A15FDD097C87C6CCE2] [WIS][16/11/2013] (.Kreapixel - Webplayer.) -- C:\Windows\Installer\d73ffa3.msi   [21504]  =>Adware.SocialSkinz
~ WIS: 2 Legitimates Filtered in 00mn 02s



---\\ Recherche de clés de registre Tracing (O100)
HKLM\SOFTWARE\Microsoft\Tracing\DomaIQ10_RASAPI32  =>Adware.DomaIQ
HKLM\SOFTWARE\Microsoft\Tracing\DomaIQ10_RASMANCS  =>Adware.DomaIQ
HKLM\SOFTWARE\Microsoft\Tracing\InstTracker_RASAPI32  =>Adware.PredictAd
HKLM\SOFTWARE\Microsoft\Tracing\InstTracker_RASMANCS  =>Adware.PredictAd
HKLM\SOFTWARE\Microsoft\Tracing\MyPC Backup_RASAPI32  =>PUP.MyPCBackup
HKLM\SOFTWARE\Microsoft\Tracing\MyPC Backup_RASMANCS  =>PUP.MyPCBackup
HKLM\SOFTWARE\Microsoft\Tracing\NewPlayerUpdater_RASAPI32  =>Adware.NewPlayer
HKLM\SOFTWARE\Microsoft\Tracing\NewPlayerUpdater_RASMANCS  =>Adware.NewPlayer
HKLM\SOFTWARE\Microsoft\Tracing\Signup Wizard_RASAPI32  =>PUP.MyPCBackup
HKLM\SOFTWARE\Microsoft\Tracing\Signup Wizard_RASMANCS  =>PUP.MyPCBackup
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\addlyrics1018_RASAPI32  =>Adware.AddLyrics
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\addlyrics1018_RASMANCS  =>Adware.AddLyrics
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\ApnStub_RASAPI32  =>Toolbar.Ask
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\ApnStub_RASMANCS  =>Toolbar.Ask
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BabMaint_RASAPI32  =>Hijacker.BabSolution
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BabMaint_RASMANCS  =>Hijacker.BabSolution
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BingBar_RASAPI32  =>Toolbar.Bing
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BingBar_RASMANCS  =>Toolbar.Bing
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\boxore_RASAPI32  =>Adware.Boxore
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\boxore_RASMANCS  =>Adware.Boxore
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Bubble Dock AddonsUI_RASAPI32  =>PUP.BubbleDock
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Bubble Dock AddonsUI_RASMANCS  =>PUP.BubbleDock
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Bubble Dock BSetup_RASAPI32  =>PUP.BubbleDock
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Bubble Dock BSetup_RASMANCS  =>PUP.BubbleDock
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Bubble Dock Update_RASAPI32  =>PUP.BubbleDock
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Bubble Dock Update_RASMANCS  =>PUP.BubbleDock
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Bubble Dock_RASAPI32  =>PUP.BubbleDock
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Bubble Dock_RASMANCS  =>PUP.BubbleDock
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\ClingClang_RASAPI32  =>PUP.ClingClang
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\ClingClang_RASMANCS  =>PUP.ClingClang
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\FLVPlayerSetup_RASAPI32  =>PUP.FLVPlayer
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\FLVPlayerSetup_RASMANCS  =>PUP.FLVPlayer
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\GoforFiles_RASAPI32  =>P2P.GoforFiles
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\GoforFiles_RASMANCS  =>P2P.GoforFiles
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Iminent_0102-0d89a395_RASAPI32  =>Adware.IMBooster
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Iminent_0102-0d89a395_RASMANCS  =>Adware.IMBooster
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\KREAPIXEL_RASAPI32  =>Adware.SocialSkinz
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\KREAPIXEL_RASMANCS  =>Adware.SocialSkinz
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\LyricsLauncher_RASAPI32  =>Adware.AddLyrics
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\LyricsLauncher_RASMANCS  =>Adware.AddLyrics
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Media Finder_RASAPI32  =>PUP.MediaFinder
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Media Finder_RASMANCS  =>PUP.MediaFinder
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\MyDeltaTB_RASAPI32  =>Toolbar.DeltaSearch
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\MyDeltaTB_RASMANCS  =>Toolbar.DeltaSearch
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\NewPlayer_RASAPI32  =>Adware.NewPlayer
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\NewPlayer_RASMANCS  =>Adware.NewPlayer
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Pricora 1_RASAPI32  =>Adware.Pricora
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Pricora 1_RASMANCS  =>Adware.Pricora
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\silent_pricora_deltaArgs_FR_RASAPI32  =>Adware.Pricora
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\silent_pricora_deltaArgs_FR_RASMANCS  =>Adware.Pricora
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SnapDo_RASAPI32  =>Hijacker.SmartBar
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SnapDo_RASMANCS  =>Hijacker.SmartBar
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_pour_barcapture_RASAPI32  =>Toolbar.Conduit
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_pour_barcapture_RASMANCS  =>Toolbar.Conduit
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_pour_quantum-qr-generator_RASAPI32  =>Toolbar.Conduit
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_pour_quantum-qr-generator_RASMANCS  =>Toolbar.Conduit
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_pour_sweet-home-3d_RASAPI32  =>Toolbar.Conduit
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_pour_sweet-home-3d_RASMANCS  =>Toolbar.Conduit
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_pour_undercoverxp_RASAPI32  =>Toolbar.Conduit
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_pour_undercoverxp_RASMANCS  =>Toolbar.Conduit
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_pour_windows-7-boot-updater_RASAPI32  =>Toolbar.Conduit
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SoftonicDownloader_pour_windows-7-boot-updater_RASMANCS  =>Toolbar.Conduit
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\updateClingClang_RASAPI32  =>PUP.ClingClang
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\updateClingClang_RASMANCS  =>PUP.ClingClang
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\utilClingClang_RASAPI32  =>PUP.ClingClang
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\utilClingClang_RASMANCS  =>PUP.ClingClang
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\uTorrent_RASAPI32  =>P2P.µTorrent
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\uTorrent_RASMANCS  =>P2P.µTorrent
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\wp_update_RASAPI32  =>PUP.WpManager
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\wp_update_RASMANCS  =>PUP.WpManager
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooDesktop_RASAPI32  =>Adware.Yontoo
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooDesktop_RASMANCS  =>Adware.Yontoo
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-1584_RASAPI32  =>Adware.Yontoo
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\YontooSetup-S-1584_RASMANCS  =>Adware.Yontoo
~ BTK: 718 Legitimates Filtered in 00mn 01s



---\\ Recherche de clés de registre CLSID (O101)
[HKCR\CLSID\{11111111-1111-1111-1111-110311541197}] (Pricora 1.1)  =>Adware.Pricora
[HKCR\CLSID\{11111111-1111-1111-1111-110311541199}] (Pricora 2.0)  =>Adware.Pricora
[HKCR\CLSID\{11111111-1111-1111-1111-110411411150}] (MediaPlayerEnhance)  =>PUP.MediaPlayerEnhance
[HKCR\CLSID\{11111111-1111-1111-1111-110511161180}] (Feven Pro 1.1)  =>PUP.CrossRider
[HKCR\CLSID\{11111111-1111-1111-1111-110611171199}] (video MediaPlay-Air)  =>PUP.CrossRider
[HKCR\CLSID\{22222222-2222-2222-2222-220322542297}] (CrossriderApp0035497.Sandbox)  =>PUP.CrossRider
[HKCR\CLSID\{22222222-2222-2222-2222-220322542299}] (CrossriderApp0035499.Sandbox)  =>PUP.CrossRider
[HKCR\CLSID\{22222222-2222-2222-2222-220422412250}] (CrossriderApp0044150.Sandbox)  =>PUP.CrossRider
[HKCR\CLSID\{22222222-2222-2222-2222-220522162280}] (CrossriderApp0051680.Sandbox)  =>PUP.CrossRider
[HKCR\CLSID\{22222222-2222-2222-2222-220622172299}] (CrossriderApp0061799.Sandbox)  =>PUP.CrossRider
[HKCR\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}] (Browser Extensions)  =>PUP.Dealio
~ BCK: 4863 Legitimates Filtered in 00mn 12s



---\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 14/04/2015 268464 |  (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 17/09/2010 267480 |  (Amsp) . (.Trend Micro Inc..) - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
SS - | Auto 11/08/2012 55184 |  (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SS - | Disabled 14/07/2011 211440 |  (BOTService) . (.Rovi Corporation.) - C:\Program Files (x86)\Roxio\BackOnTrack\Instant Restore\BOTService.exe
SS - | Auto 22/07/1658 0 |  (BstHdAndroidSvc) . (...) - C:\Program Files (x86)\BlueStacks\HD-Service.exe
SS - | Auto 22/07/1658 0 |  (BstHdLogRotatorSvc) . (...) - C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
SS - | Auto 21/05/2014 774928 |  (BstHdUpdaterSvc) . (.BlueStack Systems, Inc..) - C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe
SS - | Auto 21/10/2013 98360 |  (dqupdate) . (.Duuqu Group.) - C:\Program Files (x86)\Duuqu\Update\DuuquUpdate.exe  =>PUP.Duuqu
SS - | Demand 21/10/2013 98360 |  (dqupdatem) . (.Duuqu Group.) - C:\Program Files (x86)\Duuqu\Update\DuuquUpdate.exe  =>PUP.Duuqu
SS - | Demand 26/04/2011 2702848 |  (FirebirdServerMAGIXInstance) . (.MAGIX®.) - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe
SS - | Auto 22/07/1658 0 |  (globalUpdate) . (...) - C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe  =>PUP.GlobalUpdate
SS - | Demand 22/07/1658 0 |  (globalUpdatem) . (...) - C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe  =>PUP.GlobalUpdate
SS - | Auto 06/02/2015 107848 |  (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 06/02/2015 107848 |  (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 16/08/2012 194032 |  (gusvc) . (.Google.) - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Demand 22/10/2004 73728 |  (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
SS - | Demand 23/04/2015 148080 |  (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Demand 13/07/2011 1095664 |  (RoxMediaDB13) . (.Rovi Corporation.) - C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxMediaDB13.exe
SS - | Auto 13/07/2011 340976 |  (RoxWatch12) . (.Rovi Corporation.) - C:\Program Files (x86)\Common Files\Roxio Shared\13.0\SharedCOM\RoxWatch13.exe
SS - | Demand 25/06/2010 117264 |  (rpcapd) . (.CACE Technologies, Inc..) - C:\Program Files (x86)\WinPcap\rpcapd.exe
SS - | Auto 23/10/2013 172192 |  (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe
SS - | Demand 04/02/2013 155824 |  (Sony PC Companion) . (.Avanquest Software.) - C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe
SS - | Demand 19/02/2010 517096 |  (SwitchBoard) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
SS - | Demand 22/07/1658 0 |  (WiFiPasswordService) . (...) - C:\Users\NEWJAM~1\AppData\Local\Temp\WiFiPasswordService.exe
SS - | Demand 14/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 09/02/2011 457200 |  (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269) . (...) - C:\Program Files (x86)\Roxio\BackOnTrack\App\SaibSVC.exe
SR - | Auto 01/09/2011 169624 |  (AdobeActiveFileMonitor10.0) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe
SR - | Auto 04/03/2011 379520 |  (AFBAgent) . (.ASUSTeK Computer Inc..) - C:\Windows\system32\FBAgent.exe
SR - | Auto 16/06/2009 84536 |  (ASLDRService) . (.ASUS.) - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
SR - | Auto 15/12/2009 96896 |  (ATKGFNEXSrv) . (.ASUS.) - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
SR - | Auto 30/10/2012 44808 |  (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SR - | Auto 30/08/2011 462184 |  (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Auto 15/07/2011 21488 |  (BOT4Service) . (...) - C:\Program Files (x86)\Roxio\BackOnTrack\App\BService.exe
SR - | Auto 23/01/2012 1858048 |  (Fabs) . (.MAGIX AG.) - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
SR - | Demand 20/06/2011 73728 |  (LightScribeService) . (.Hewlett-Packard Company.) - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
SR - | Auto 06/10/2010 325656 |  (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
SR - | Auto 04/05/2010 503080 |  (NAUpdate) . (.Nero AG.) - C:\Program Files (x86)\Nero\Update\NASvc.exe
SR - | Auto 05/06/2011 993896 |  (NVSvc) . (.NVIDIA Corporation.) - C:\Windows\System32\nvvsvc.exe
SR - | Auto 05/06/2011 1997416 |  (nvUpdatusService) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
SR - | Auto 04/12/2014 966336 |  (Service KMSELDI) . (.@ByELDI.) - C:\Program Files\KMSpico\Service_KMS.exe  =>PUA.KMSpico
SR - | Auto 09/04/2015 5261584 |  (TeamViewer9) . (.TeamViewer GmbH.) - C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
SR - | Demand 17/09/2010 241488 |  (TiMiniService) . (.Trend Micro Inc..) - C:\Program Files\Trend Micro\Titanium\TiMiniService.exe
SR - | Auto 06/10/2010 2655768 |  (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
SR - | Auto 22/07/1658 0 |  (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe  =>.Microsoft Corporation
SR - | Auto 14/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services:  Scanned in 00mn 12s



---\\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
Run by newjams25 at 16/05/2015 23:29:57
~ OS 64 not supported by MBR tool
~ MBR: 0 Legitimates Filtered in 00mn 00s



---\\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by newjams25 at 16/05/2015 23:29:59
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR:  Scanned in 00mn 02s



---\\ Scan Additionnel (O88)
Database Version : 13008 - (13/05/2015)
Clés trouvées (Keys found) : 136
Valeurs trouvées (Values found) : 9
Dossiers trouvés  (Folders found) : 22
Fichiers trouvés  (Files found) : 47

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0FB6A909-6086-458F-BD92-1F8EE10042A0}]   =>Adware.PredictAd^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311541197}]   =>PUP.CrossRider^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311541199}]   =>PUP.CrossRider^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110411411150}]   =>PUP.CrossRider^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110511161180}]   =>PUP.CrossRider^
[HKLM\SYSTEM\CurrentControlSet\Services\dqupdate) (dqupdate]   =>PUP.Duuqu^
[HKLM\SYSTEM\CurrentControlSet\Services\globalUpdate) (globalUpdate]   =>PUP.GlobalUpdate^
[HKLM\SYSTEM\CurrentControlSet\Services\Service KMSELDI]   =>PUA.KMSpico^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Cling Clang]   =>PUP.ClingClang^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1]   =>PUA.KMSpico^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\WindowsMangerProtect]   =>PUP.Fuyu^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}]   =>PUP.YouTubeAdBlock^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\video MediaPlay-Air]   =>PUP.CrossRider^
[HKLM\Software\Classes\TypeLib\{01bcb858-2f62-4f06-a8f4-48f927c15333}]   =>Adware.PredictAd
[HKLM\Software\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}]   =>PUP.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}]   =>PUP.Babylon
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9}]   =>PUP.Babylon
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0FB6A909-6086-458F-BD92-1F8EE10042A0}]   =>Adware.PredictAd
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0FB6A909-6086-458F-BD92-1F8EE10042A0}]   =>Adware.PredictAd
[HKLM\Software\Classes\CLSID\{0FB6A909-6086-458F-BD92-1F8EE10042A0}]   =>Adware.PredictAd
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0FB6A909-6086-458F-BD92-1F8EE10042A0}]   =>Adware.PredictAd
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]   =>PUP.V9Software
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]   =>PUP.V9Software
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]   =>PUP.V9Software
[HKLM\Software\Classes\AppID\{442f13bc-2031-42d5-9520-437f65271153}]   =>Adware.PredictAd
[HKLM\Software\Wow6432Node\Classes\AppID\{442f13bc-2031-42d5-9520-437f65271153}]   =>Adware.PredictAd
[HKLM\Software\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]   =>PUP.Babylon
[HKLM\Software\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]   =>PUP.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]   =>PUP.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Tracing\SnapDo_RASAPI32]   =>Hijacker.SmartBar
[HKLM\Software\Wow6432Node\Microsoft\Tracing\SnapDo_RASMANCS]   =>Hijacker.SmartBar
[HKLM\Software\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}]   =>PUP.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}]   =>PUP.Babylon
[HKLM\Software\Classes\Interface\{C9AE652B-8C99-4AC2-B556-8B501182874E}]   =>Parasite.Pugi
[HKLM\Software\Wow6432Node\Classes\Interface\{C9AE652B-8C99-4AC2-B556-8B501182874E}]   =>Parasite.Pugi
[HKLM\Software\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}]   =>PUP.Babylon
[HKLM\Software\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}]   =>PUP.Babylon
[HKLM\Software\Wow6432Node\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}]   =>PUP.Babylon
[HKLM\Software\Classes\Prod.cap]   =>PUP.ClaroSearch
[HKLM\Software\Classes\AppID\autocompletepro.dll]   =>Adware.PredictAd
[HKLM\Software\Classes\AppID\escort.dll]   =>PUP.Babylon
[HKLM\Software\Classes\AppID\escortapp.dll]   =>PUP.Babylon
[HKLM\Software\Classes\AppID\escorteng.dll]   =>PUP.Babylon
[HKLM\Software\Classes\AppID\esrv.EXE]   =>PUP.Babylon
[HKLM\Software\Wow6432Node\Microsoft\Tracing\YourFile_RASAPI32]   =>PUP.YourFileDownloader
[HKLM\Software\Wow6432Node\Google\Chrome\Extensions\defdhglnppeioeflggkmglipcecffkhk]   =>Adware.PredictAd
[HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASMANCS]   =>Toolbar.Bing
[HKLM\Software\Classes\escort.escortIEPane]   =>PUP.Funmoods
[HKLM\Software\Classes\escort.escortIEPane.1]   =>PUP.Funmoods
[HKLM\Software\Classes\SpeedUpMyPC]   =>PUP.SpeedUpMyPC
[HKLM\Software\Classes\suggestmeyes.suggestmeyesbho]   =>Adware.PredictAd
[HKLM\Software\Classes\suggestmeyes.suggestmeyesbho.1]   =>Adware.PredictAd
[HKLM\Software\Wow6432Node\Google\Chrome\Extensions\paoponfhfdfnjgddpnpjkambkcgdaaib]   =>PUP.Conduit
[HKLM\Software\Wow6432Node\Agence-Exclusive]   =>Spyware.AgenceExclusive
[HKCU\Software\AutocompletePro]   =>Adware.PredictAd
[HKCU\Software\cacaoweb]   =>PUP.CacaoWeb
[HKLM\Software\Wow6432Node\DataMngr]   =>Adware.Bandoo
[HKLM\Software\Wow6432Node\InstUf]   =>Adware.VirtualGirl
[HKLM\Software\Wow6432Node\Jbz25]   =>Adware.VirtualGirl
[HKCU\Software\Softonic]   =>PUP.Conduit
[HKLM\Software\Wow6432Node\Totem]   =>Adware.VirtualGirl
[HKLM\Software\Wow6432Node\Tutorials]   =>Spyware.AgenceExclusive
[HKCU\Software\FVDToolbar]   =>Toolbar.Agent
[HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASAPI32]   =>Toolbar.Bing
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375]   =>PUP.Tarma
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5]   =>PUP.Tarma
[HKCU\Software\Classes\MF]   =>PUP.MediaFinder
[HKLM\Software\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}]   =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}]   =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Microsoft\Tracing\apnstub_RASMANCS]   =>Toolbar.Ask
[HKLM\Software\Wow6432Node\Microsoft\Tracing\apnstub_RASAPI32]   =>Toolbar.Ask
[HKLM\Software\Classes\delta.deltaappCore]   =>PUP.Funmoods
[HKLM\Software\Classes\delta.deltaappCore.1]   =>PUP.Funmoods
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\175C300D9A9FB725484BA7DCEE4B56B8]   =>PUP.ClaroSearch
[HKLM\Software\Classes\Installer\Features\6F43FA474FCAC834C9E7AF30706BE054]   =>PUP.ClaroSearch
[HKLM\Software\Classes\Installer\Products\6F43FA474FCAC834C9E7AF30706BE054]   =>PUP.ClaroSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\6F43FA474FCAC834C9E7AF30706BE054]   =>PUP.ClaroSearch
[HKLM\Software\Wow6432Node\Classes\Installer\Features\6F43FA474FCAC834C9E7AF30706BE054]   =>PUP.ClaroSearch
[HKLM\Software\Wow6432Node\Classes\Installer\Products\6F43FA474FCAC834C9E7AF30706BE054]   =>PUP.ClaroSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E5C8B5FB7CB5DD447A0BAAAF637FBD77]   =>PUP.ClaroSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF96568971BEAC14B8815883832BD484]   =>PUP.ClaroSearch
[HKCU\Software\Microsoft\IClaroDirectory]   =>PUP.ClaroSearch
[HKCU\Software\AppDataLow\Software\Crossrider]   =>PUP.CrossRider
[HKCU\Software\InstalledBrowserExtensions\]   =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Microsoft\Tracing\boxore_RASAPI32]   =>Adware.Boxore
[HKLM\Software\Wow6432Node\Microsoft\Tracing\boxore_RASMANCS]   =>Adware.Boxore
[HKCU\Software\InstalledBrowserExtensions]   =>PUP.CrossRider
[HKLM\Software\InstalledBrowserExtensions]   =>PUP.CrossRider
[HKLM\Software\Wow6432Node\InstalledBrowserExtensions]   =>PUP.CrossRider
[HKLM\Software\Classes\Interface\{FD8F79A0-D2E2-4FA2-AEAF-393EAC8064F7}]   =>PUP.Babylon
[HKLM\Software\Wow6432Node\Classes\Interface\{FD8F79A0-D2E2-4FA2-AEAF-393EAC8064F7}]   =>PUP.Babylon
[HKLM\Software\Classes\CrossriderApp0061799.BHO]   =>PUP.CrossRider
[HKLM\Software\Classes\CrossriderApp0061799.BHO.1]   =>PUP.CrossRider
[HKLM\Software\Classes\CrossriderApp0061799.Sandbox]   =>PUP.CrossRider
[HKLM\Software\Classes\CrossriderApp0061799.Sandbox.1]   =>PUP.CrossRider
[HKLM\Software\Classes\FVDToolbar.CTBShow]   =>Toolbar.Conduit
[HKLM\Software\Classes\FVDToolbar.CTBShow.1]   =>Toolbar.Conduit
[HKLM\Software\Classes\FVDToolbar.CToolbarShower]   =>Toolbar.Conduit
[HKLM\Software\Classes\FVDToolbar.CToolbarShower.1]   =>Toolbar.Conduit
[HKLM\Software\Classes\CLSID\{11111111-1111-1111-1111-110311541197}]   =>PUP.CrossRider
[HKLM\Software\Classes\CLSID\{11111111-1111-1111-1111-110311541199}]   =>PUP.CrossRider
[HKLM\Software\Classes\CLSID\{11111111-1111-1111-1111-110411411150}]   =>PUP.CrossRider
[HKLM\Software\Classes\CLSID\{11111111-1111-1111-1111-110511161180}]   =>PUP.CrossRider
[HKLM\Software\Classes\CLSID\{11111111-1111-1111-1111-110611171199}]   =>PUP.CrossRider
[HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220322542297}]   =>PUP.CrossRider
[HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220322542299}]   =>PUP.CrossRider
[HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220422412250}]   =>PUP.CrossRider
[HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220522162280}]   =>PUP.CrossRider
[HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220622172299}]   =>PUP.CrossRider
[HKLM\Software\Classes\AppID\escorTlbr.DLL]   =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\CrossriderApp0061799.BHO]   =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Classes\CrossriderApp0061799.BHO.1]   =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Classes\CrossriderApp0061799.Sandbox]   =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Classes\CrossriderApp0061799.Sandbox.1]   =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Classes\delta.deltaappCore]   =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\delta.deltaappCore.1]   =>Toolbar.DeltaSearch
[HKLM\Software\Wow6432Node\Classes\escort.escortIEPane]   =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\escort.escortIEPane.1]   =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\FVDToolbar.CTBShow]   =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\FVDToolbar.CTBShow.1]   =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\FVDToolbar.CToolbarShower]   =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Classes\FVDToolbar.CToolbarShower.1]   =>Toolbar.Conduit
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011441179}]   =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Classes\CLSID\{11111111-1111-1111-1111-110611171199}]   =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220322542297}]   =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220322542299}]   =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220322792208}]   =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220422412250}]   =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220522162280}]   =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220622172299}]   =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Classes\AppID\escort.DLL]   =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\escortApp.DLL]   =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\escortEng.DLL]   =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Classes\AppID\escorTlbr.DLL]   =>PUP.Funmoods
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011441179}]   =>PUP.CrossRider
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CA0054A5AB3EFFE4CB5660E44A1E7DCC]   =>Adware.Boxore^
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:uTorrent   =>P2P.BitTorrent^
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:stv_fr_4   =>PUP.Eorezo^
C:\Users\newjams25\AppData\Roaming\Mozilla\Firefox\Profiles\47q75cgh.default-1424586693021\extensions\cacaoweb@cacaoweb.org   =>PUP.CacaoWeb^
C:\Users\newjams25\AppData\Roaming\Mozilla\Firefox\Profiles\47q75cgh.default-1424586693021\extensions\pavel.sherbakov@gmail.com   =>PUP.QuickShare^
C:\Program Files (x86)\AutocompletePro   =>Adware.PredictAd^
C:\Program Files (x86)\Duuqu   =>PUP.Duuqu^
C:\Program Files (x86)\saaVe netu   =>PUP.SaveNet^
C:\Program Files (x86)\SupTab   =>PUP.SupTab^
C:\Program Files (x86)\video MediaPlay-Air   =>PUP.CrossRider^
C:\ProgramData\Babylon   =>PUP.Babylon^
C:\ProgramData\IePluginServices   =>PUP.IePluginService^
C:\ProgramData\InstallMate   =>PUP.Tarma^
C:\ProgramData\saaVe netu   =>PUP.SaveNet^
C:\ProgramData\WindowsMangerProtect   =>PUP.Fuyu^
C:\ProgramData\WPM   =>PUP.WpManager^
C:\Users\newjams25\AppData\Roaming\BabSolution   =>Hijacker.BabSolution^
C:\Users\newjams25\AppData\Roaming\cacaoweb   =>PUP.CacaoWeb^
C:\Users\newjams25\AppData\Roaming\IClaro   =>PUP.IClaro^
C:\Users\newjams25\AppData\Roaming\SupTab   =>PUP.SupTab^
C:\Users\newjams25\AppData\Roaming\wp_update   =>PUP.WpManager^
C:\Users\newjams25\AppData\Local\Duuqu   =>PUP.Duuqu^
C:\Program Files (x86)\FrameFox   =>Toolbar.DeltaSearch
C:\Program Files (x86)\Common Files\Totem Shared   =>Adware.VirtualGirl
C:\Users\newjams25\AppData\Local\DirectDownloader   =>UP.DirectDownloader
C:\Users\newjams25\AppData\Roaming\cacaoweb\cacaoweb.exe   =>PUP.CacaoWeb^
C:\Users\newjams25\AppData\Roaming\Mozilla\Firefox\Profiles\47q75cgh.default-1424586693021\Extensions\cacaoweb@cacaoweb.org   =>PUP.CacaoWeb^
C:\Program Files\KMSpico\AutoPico.exe   =>PUA.KMSpico^
C:\Program Files (x86)\Duuqu\Update\DuuquUpdate.exe   =>PUP.Duuqu^
C:\Program Files (x86)\GoforFiles Updater\GFFUpdater.exe   =>P2P.GoforFiles^
C:\Windows\Tasks\DuuquUpdateTaskMachineCore.job   =>PUP.Duuqu^
C:\Windows\System32\Tasks\DuuquUpdateTaskMachineCore   =>PUP.Duuqu^
C:\Windows\Tasks\DuuquUpdateTaskMachineUA.job   =>PUP.Duuqu^
C:\Windows\System32\Tasks\DuuquUpdateTaskMachineUA   =>PUP.Duuqu^
C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job   =>PUP.GlobalUpdate^
C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore   =>PUP.GlobalUpdate^
C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job   =>PUP.GlobalUpdate^
C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA   =>PUP.GlobalUpdate^
[HKCU\Software\10a3ff583a8855eb34d4dbc80531f951]   =>PUP.CrossRider^
[HKCU\Software\97335ed968c8d21501810d2516770677]   =>PUP.CrossRider^
[HKCU\Software\BabSolution]   =>Hijacker.BabSolution^
[HKCU\Software\Conduit]   =>Toolbar.Conduit^
[HKCU\Software\Duuqu]   =>PUP.Duuqu^
[HKCU\Software\FileScout]   =>PUP.FileScout^
[HKCU\Software\TutoTag]   =>PUP.AgenceExclusive^
[HKCU\Software\freesofttoday]   =>Adware.FreeSoftToday^
[HKLM\Software\Wow6432Node\AGENCE-EXCLUSIVE]   =>PUP.AgenceExcusive^
[HKLM\Software\Wow6432Node\Duuqu]   =>PUP.Duuqu^
[HKLM\Software\Wow6432Node\SupDp]   =>PUP.SupTab^
[HKLM\Software\Wow6432Node\Wpm]   =>PUP.WpManager^
[HKLM\Software\Wow6432Node\free_soft_to_day]   =>Adware.FreeSoftToday^
[HKLM\Software\Wow6432Node\free_soft_today]   =>Adware.FreeSoftToday^
[HKLM\Software\Wow6432Node\supTab]   =>PUP.SupTab^
[HKLM\Software\Wow6432Node\supWPM]   =>PUP.WpManager^
C:\Users\newjams25\Desktop\cacaoweb.exe   =>PUP.CacaoWeb^
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1519.190]:dllName="BrowserDefender.dll"   =>Hijacker.Eazel^
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1673.238]:dllName="BitGuard.dll"   =>PUP.BitGuard^
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.6.1694.246]:dllName="BitGuard.dll"   =>PUP.BitGuard^
[HKCU\Software\592d6dde16eb815\history\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}2.7.1769.27]:SERVICE_NAME="BitGuard"   =>PUP.BitGuard^
C:\Windows\Installer\2dfab5f.msi   =>PUP.IClaro^
C:\Windows\Installer\d73ffa3.msi   =>Adware.SocialSkinz^
[HKCR\CLSID\{11111111-1111-1111-1111-110311541197}] (Pricora 1.1)   =>Adware.Pricora^
[HKCR\CLSID\{11111111-1111-1111-1111-110311541199}] (Pricora 2.0)   =>Adware.Pricora^
[HKCR\CLSID\{11111111-1111-1111-1111-110411411150}] (MediaPlayerEnhance)   =>PUP.MediaPlayerEnhance^
[HKCR\CLSID\{11111111-1111-1111-1111-110511161180}] (Feven Pro 1.1)   =>PUP.CrossRider^
[HKCR\CLSID\{11111111-1111-1111-1111-110611171199}] (video MediaPlay-Air)   =>PUP.CrossRider^
[HKCR\CLSID\{22222222-2222-2222-2222-220322542297}] (CrossriderApp0035497.Sandbox)   =>PUP.CrossRider^
[HKCR\CLSID\{22222222-2222-2222-2222-220322542299}] (CrossriderApp0035499.Sandbox)   =>PUP.CrossRider^
[HKCR\CLSID\{22222222-2222-2222-2222-220422412250}] (CrossriderApp0044150.Sandbox)   =>PUP.CrossRider^
[HKCR\CLSID\{22222222-2222-2222-2222-220522162280}] (CrossriderApp0051680.Sandbox)   =>PUP.CrossRider^
[HKCR\CLSID\{22222222-2222-2222-2222-220622172299}] (CrossriderApp0061799.Sandbox)   =>PUP.CrossRider^
[HKCR\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}] (Browser Extensions)   =>PUP.Dealio^
~ Additionnel Scan: 527729 Items scanned in 00mn 45s



---\\ Informations complémentaires sur les modules
~ http://nicolascoolman.fr/g2-google-chrome-extensions/  =>.Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
~ http://nicolascoolman.fr/r5-internet-explorer-proxy-management-iepm/  =>.Internet Explorer, Proxy Management (R5)
~ http://nicolascoolman.fr/o2-browser-helper-objects-de-navigateur/  =>.Browser Helper Objects de navigateur (O2)
~ http://nicolascoolman.fr/o3-internet-explorer-toolbars/  =>.Internet Explorer Toolbars (O3)
~ http://nicolascoolman.fr/o4-applications-demarrees-par-le-registre/  =>.Applications lancées au démarrage du système (O4)
~ http://nicolascoolman.fr/o51-mountpoints2-shell-key-mpsk/  =>.Clé de registre Shell MountPoints2 (MPSK) (O51)
~ AMI: 6 Legitimates Filtered in 00mn 00s



---\\ Récapitulatif des détections trouvées sur votre station
http://nicolascoolman.fr/pup-cacaoweb  =>PUP.CacaoWeb
http://nicolascoolman.fr/adware-predictad  =>Adware.PredictAd
http://nicolascoolman.fr/adware-addlyrics  =>Adware.AddLyrics
http://nicolascoolman.fr/pup-quickshare  =>PUP.QuickShare
http://www.nicolascoolman.fr/blog/  =>PUP.Istart
http://nicolascoolman.fr/hijacker-smartbar  =>Hijacker.SmartBar
http://nicolascoolman.fr/pup-crossrider  =>PUP.CrossRider
http://www.nicolascoolman.fr/blog/  =>PUP.GreenTreeApp
http://nicolascoolman.fr/adware-socialskinz  =>Adware.SocialSkinz
http://nicolascoolman.fr/pup-searchprotect  =>PUP.SearchProtect
http://nicolascoolman.fr/pup-eorezo  =>PUP.Eorezo
http://nicolascoolman.fr/pup-bitguard  =>PUP.BitGuard
http://nicolascoolman.fr/pup-duuqu  =>PUP.Duuqu
http://nicolascoolman.fr/pup-globalupdate  =>PUP.GlobalUpdate
http://nicolascoolman.fr/pup-kmspico  =>PUA.KMSpico
http://nicolascoolman.fr/pup-mypcbackup  =>PUP.MyPCBackup
http://nicolascoolman.fr/pup-wpmanager  =>PUP.WpManager
http://nicolascoolman.fr/pup-yourfiledownloader  =>PUP.YourFileDownloader
http://nicolascoolman.fr/pup-clingclang  =>PUP.ClingClang
http://www.nicolascoolman.fr/blog/  =>PUP.Fuyu
http://nicolascoolman.fr/35828469-pup-youtubeadblocker-  =>PUP.YouTubeAdBlock
http://nicolascoolman.fr/hijacker-eazel  =>Hijacker.Eazel
http://nicolascoolman.fr/hijacker-babsolution  =>Hijacker.BabSolution
http://nicolascoolman.fr/toolbar-conduit  =>Toolbar.Conduit
http://nicolascoolman.fr/pup-filescout  =>PUP.FileScout
http://www.nicolascoolman.fr/blog/  =>PUP.BrowserExtensions
http://nicolascoolman.fr/spyware-agenceexclusive  =>PUP.AgenceExclusive
http://nicolascoolman.fr/adware-freesofttoday  =>Adware.FreeSoftToday
http://www.nicolascoolman.fr/blog/  =>PUP.AgenceExcusive
http://nicolascoolman.fr/pup-suptab  =>PUP.SupTab
http://www.nicolascoolman.fr/blog/  =>PUP.SaveNet
http://nicolascoolman.fr/pup-babylon  =>PUP.Babylon
http://www.nicolascoolman.fr/blog/  =>PUP.IePluginService
http://nicolascoolman.fr/pup-tarma  =>PUP.Tarma
http://www.nicolascoolman.fr/blog/  =>PUP.IClaro
http://nicolascoolman.fr/hijacker-trovicom  =>Hijacker.TroviCom
http://nicolascoolman.fr/adware-imbooster  =>Adware.IMBooster
http://nicolascoolman.fr/pua-browserdefendert  =>PUA.BrowserDefendert
Clé orpheline => Clé orpheline => Clé orpheline => Clé orpheline
http://nicolascoolman.fr/adware-domaiq  =>Adware.DomaIQ
http://www.nicolascoolman.fr/blog/  =>Adware.NewPlayer
http://nicolascoolman.fr/toolbar-ask  =>Toolbar.Ask
http://nicolascoolman.fr/adware-boxore  =>Adware.Boxore
http://nicolascoolman.fr/pup-bubbledock  =>PUP.BubbleDock
http://www.nicolascoolman.fr/blog/  =>PUP.FLVPlayer
http://nicolascoolman.fr/pup-mediafinder  =>PUP.MediaFinder
http://nicolascoolman.fr/toolbar-deltasearch  =>Toolbar.DeltaSearch
http://nicolascoolman.fr/adware-pricora  =>Adware.Pricora
http://nicolascoolman.fr/adware-yontoo  =>Adware.Yontoo
http://www.nicolascoolman.fr/blog/  =>PUP.MediaPlayerEnhance
http://nicolascoolman.fr/pup-dealio  =>PUP.Dealio
http://nicolascoolman.fr/pup-v9software  =>PUP.V9Software
http://nicolascoolman.fr/parasite-pugi  =>Parasite.Pugi
http://nicolascoolman.fr/pup-clarosearch  =>PUP.ClaroSearch
http://nicolascoolman.fr/pup-funmoods  =>PUP.Funmoods
http://www.nicolascoolman.fr/blog/  =>PUP.SpeedUpMyPC
http://www.nicolascoolman.fr/blog/  =>PUP.Conduit
http://www.nicolascoolman.fr/blog/  =>Spyware.AgenceExclusive
http://nicolascoolman.fr/adware-bandoo  =>Adware.Bandoo
http://nicolascoolman.fr/adware-virtualgirl  =>Adware.VirtualGirl
http://www.nicolascoolman.fr/blog/  =>Toolbar.Agent
http://nicolascoolman.fr/28061330-pup-directdownloader  =>UP.DirectDownloader
~ MSI: 62 link(s) detected in 00mn 00s



~ 1516 Legitimates filtered by white list
End of the scan (1215 lines in 02mn 59s)(5.11)