clé usb infectée par virus créant des raccourcis 2014-09-14T21:11:08+00:00

SOSVirus : Dépannage PC Gratuit Support Aide à la désinfection – Forum Virus Sécurité clé usb infectée par virus créant des raccourcis

  • Auteur
    Messages
  • bunchie93
    Post count: 0

    Bonsoir,
    Ma clé usb a été infectée sur les ordinateurs à mon travail et des fichiers et dossiers ont été transformés en raccourcis et quand je mets la clé sur mon ordi, AVG me signale des virus et ne me propose que la suppression alors que j’ai besoin de ces fichiers.

    J’ai utilisé usb fix mais un seul fichier a été détecté alors qu’il y en a plusieurs.

    Rapport d’Usb fix

    [spoiler:3i28tx27]############################## | UsbFix V 7.182 | [Recherche]

    Utilisateur: ismail1973 (Administrateur) # SAMSUNG
    Mis à jour le 14/09/2014 par El Desaparecido – SosVirus
    Lancé à 21:32:48 | 14/09/2014

    Site Web : http://www.usbfix.net/
    Changelog : http://www.usbfix.net/maj/
    Assistance : https://www.sosvirus.net/aide-nettoyage-pc/
    Upload Malware : https://www.sosvirus.net/upload_malware.php
    Détection en Live : http://comment-supprimer.fr/
    Contact : http://www.usbfix.net/contact/

    ################## | System information |

    MB: SAMSUNG ELECTRONICS CO., LTD. (RV410/RV510/S3510/E3510)
    CPU: Celeron(R) Dual-Core CPU T3500 @ 2.10GHz
    GC: Mobile Intel(R) 4 Series Express Chipset Family
    RAM -> [Total : 2009 Mo | Free : 442 Mo]
    Bios: Phoenix Technologies Ltd.
    Boot: Normal boot

    OS: Microsoft™ Windows 7 Home Premium (6.1.7601 64-Bit) Service Pack 1
    WB: Internet Explorer : 9.00.8112.16450
    WB: Google Chrome : 37.0.2062.120

    ################## | Security Information |

    AV: AVG Internet Security 2014 [Actif |A jour]
    AS: Windows Defender [(!) Désactivé |A jour]
    AS: AVG Internet Security 2014 [Actif |A jour]
    FW: AVG Internet Security 2014 [Actif]
    AS: Malwarebytes Anti-Malware : 2.0.2.1012
    FW: Windows Firewall [Actif]
    SC: Security Center [Actif]
    WU: Windows Update [Actif]

    ################## | Disk Information |

    C: (%SystemDrive%) -> Disque fixe # 279 Go (136 Go libre(s) – 49%) [compresser] # NTFS
    G: -> Disque amovible # 15 Go (12 Go libre(s) – 80%) [] # FAT32

    ################## | Regedit Run |

    F2 – HKLM..Winlogon : [Shell] explorer.exe
    F2 – [x64] HKLM..Winlogon : [Shell] explorer.exe
    F2 – HKLM..Winlogon : [Userinit] userinit.exe
    F2 – [x64] HKLM..Winlogon : [Userinit] C:Windowssystem32userinit.exe,
    04 – HKCU..Run : [cacaoweb] “C:Usersismail1973AppDataRoamingcacaowebcacaoweb.exe” -noplayer
    04 – HKLM..Run : [Adobe ARM] “C:Program Files (x86)Common FilesAdobeARM1.0AdobeARM.exe”
    04 – HKLM..Run : [HP Software Update] C:Program Files (x86)HPHP Software UpdateHPWuSchd2.exe
    04 – HKLM..Run : [EaseUS EPM tray] C:Program Files (x86)EaseUSEaseUS Partition Master 9.2.2binEpmNews.exe
    04 – HKLM..Run : [mobilegeni daemon] C:Program Files (x86)MobogenieDaemonProcess.exe
    04 – HKLM..Run : [Microsoft Default Manager] “C:Program Files (x86)MicrosoftSearch Enhancement PackDefault ManagerDefMgr.exe” -resume
    04 – HKLM..Run : [UCam_Menu] “C:Program Files (x86)CyberLinkYouCamMUITransferMUIStartMenu.exe” “C:Program Files (x86)CyberLinkYouCam” UpdateWithCreateOnce “SoftwareCyberLinkYouCam2.0”
    04 – HKLM..Run : [AVG_UI] “C:Program Files (x86)AVGAVG2014avgui.exe” /TRAYONLY
    04 – HKLM..Run : [hpqSRMon] C:Program Files (x86)HPDigital ImagingbinhpqSRMon.exe
    04 – HKLM..Run : [SunJavaUpdateSched] “C:Program Files (x86)Common FilesJavaJava Updatejusched.exe”
    04 – [x64] HKLM..Run : [RtHDVCpl] C:Program FilesRealtekAudioHDARAVCpl64.exe -s
    04 – [x64] HKLM..Run : [IgfxTray] C:Windowssystem32igfxtray.exe
    04 – [x64] HKLM..Run : [HotKeysCmds] C:Windowssystem32hkcmd.exe
    04 – [x64] HKLM..Run : [Persistence] C:Windowssystem32igfxpers.exe
    04 – HKUS-1-5-19..Run : [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /autoRun
    04 – HKUS-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0..Run : [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /autoRun
    04 – HKUS-1-5-20..Run : [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /autoRun
    04 – HKUS-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0..Run : [Sidebar] %ProgramFiles%Windows SidebarSidebar.exe /autoRun
    04 – HKUS-1-5-21-2052373595-2782729040-2076756327-1000..Run : [cacaoweb] “C:Usersismail1973AppDataRoamingcacaowebcacaoweb.exe” -noplayer
    04 – HKUS-1-5-21-2052373595-2782729040-2076756327-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0..Run : [cacaoweb] “C:Usersismail1973AppDataRoamingcacaowebcacaoweb.exe” -noplayer
    04 – HKUS-1-5-19..RunOnce : [mctadmin] C:WindowsSystem32mctadmin.exe
    04 – HKUS-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0..RunOnce : [mctadmin] C:WindowsSystem32mctadmin.exe
    04 – HKUS-1-5-20..RunOnce : [mctadmin] C:WindowsSystem32mctadmin.exe
    04 – HKUS-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0..RunOnce : [mctadmin] C:WindowsSystem32mctadmin.exe

    ################## | Recherche générique |

    ################## | Registre |

    ################## | UsbFix – Information |

    Info : Comment supprimer l'infection des raccourcis sur USB ? (Video)
    Info : L'infection des raccourcis USB, c'est quoi ?

    ################## | Hijack |

    ################## | E.O.F | https://www.sosvirus.net/ | http://www.usbfix.net/ |[/spoiler:3i28tx27]

    Rapport de ZHPDiag

    [spoiler:3i28tx27]~ Rapport de ZHPDiag v2014.8.28.125 – Nicolas Coolman (28/08/2014)
    ~ Lancé par ismail1973 (14/09/2014 22:19:05)
    ~ Adresse du Site Web http://nicolascoolman.fr” onclick=”window.open(this.href);return false;
    ~ Adresse du Forum http://forum.nicolascoolman.fr” onclick=”window.open(this.href);return false;
    ~ Traduit par Nicolas Coolman
    ~ Etat de la version :
    ~ Liste blanche : Activée par le programme
    ~ Elévation des Privilèges : OK
    ~ User Account Control (UAC):

    —\ Navigateurs Internet
    MSIE: Internet Explorer v9.0.8112.16421
    GCIE: Google Chrome v37.0.2062.120 (Defaut)

    —\ Informations sur les produits Windows
    ~ Langage: Français
    Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)
    Windows Server License Manager Script : OK
    ~ Windows Operating System – Windows(R) 7, OEM_SLP channel
    System Locked Preinstallation (OEM_SLP) : OK
    Windows ID Activation : OK
    ~ Windows Partial Key : 2BT4J
    Windows License : OK
    ~ Windows Remaining Initializations Number : 4
    Software Protection Service (Protection logicielle) : OK
    Windows Automatic Updates : OK
    Windows Activation Technologies : OK

    —\ Logiciels de protection du système
    AVG 2014 v14.0.4015
    Malwarebytes Anti-Malware version 2.0.2.1012
    Windows Defender W7 (Deactivate)

    —\ Logiciels d'optimisation du système

    —\ Logiciels de partage PeerToPeer

    —\ Surveillance de Logiciels
    Adobe Flash Player 15 Plugin
    Adobe Reader XI

    —\ Informations sur le système
    ~ Processor: Intel64 Family 6 Model 23 Stepping 10, GenuineIntel
    ~ Operating System: 64 Bits
    Boot mode: Normal (Normal boot)
    Total RAM: 2008 MB (34% free)
    System Restore: Activé (Enable)
    System drive C: has 136 GB (48%) free of 279 GB

    —\ Mode de connexion au système
    ~ Computer Name: SAMSUNG
    ~ User Name: ismail1973
    ~ All Users Names: ismail1973, HomeGroupUser$, Administrateur,
    ~ Unselected Option: None
    Logged in as Administrator

    —\ Variables d'environnement
    ~ System Unit : C:
    ~ %AppZHP% : C:Usersismail1973AppDataRoamingZHP
    ~ %AppData% : C:Usersismail1973AppDataRoaming
    ~ %Desktop% : C:Usersismail1973Desktop
    ~ %Favorites% : C:Usersismail1973Favorites
    ~ %LocalAppData% : C:Usersismail1973AppDataLocal
    ~ %StartMenu% : C:Usersismail1973AppDataRoamingMicrosoftWindowsStart Menu
    ~ %Windir% : C:Windows
    ~ %System% : C:WindowsSystem32

    —\ Enumération des unités disques
    C: Hard drive, Flash drive, Thumb drive (Free 136 Go of 279 Go)
    E: CD-ROM drive (Not Inserted)
    G: Floppy drive, Flash card reader, USB Key (Free 12 Go of 15 Go)
    Q: Hard drive, Flash drive, Thumb drive (Free 0 Go of 0 Go)

    —\ Etat du Centre de Sécurité Windows
    [HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer] NoActiveDesktopChanges: Modified
    ~ Security Center: 41 Legitimates Filtered in 00mn 00s

    —\ Recherche particulière de fichiers génériques
    [MD5.332FEAB1435662FC6C672E25BEB37BE3] – (.Microsoft Corporation – Explorateur Windows.) (.25/02/2011 – 07:19:30.) — C:WindowsExplorer.exe [2871808]
    [MD5.94355C28C1970635A31B3FE52EB7CEBA] – (.Microsoft Corporation – Application de démarrage de Windows.) (.14/07/2009 – 02:39:52.) — C:WindowsSystem32Wininit.exe [129024]
    [MD5.3D165C53E40236A68B7102D1A622D4E0] – (.Microsoft Corporation – Internet Extensions for Win32.) (.24/08/2012 – 11:21:18.) — C:WindowsSystem32wininet.dll [1392128]
    [MD5.88AB9B72B4BF3963A0DE0820B4B0B06C] – (.Microsoft Corporation – Application d’ouverture de session Windows.) (.15/05/2014 – 02:31:37.) — C:WindowsSystem32Winlogon.exe [455168]
    [MD5.067FA52BFB59A56110A12312EF9AF243] – (.Microsoft Corporation – Bibliothèque de licences.) (.20/11/2010 – 14:27:26.) — C:WindowsSystem32sppcomapi.dll [232448]
    [MD5.FA886682CFC5D36718D3E436AACF10B9] – (.Microsoft Corporation – Ancillary Function Driver for WinSock.) (.24/07/2014 – 14:46:08.) — C:Windowssystem32DriversAFD.sys [497152]
    [MD5.02062C0B390B7729EDC9E69C680A6F3C] – (.Microsoft Corporation – ATAPI IDE Miniport Driver.) (.14/07/2009 – 02:52:21.) — C:Windowssystem32Driversatapi.sys [24128]
    [MD5.B8BD2BB284668C84865658C77574381A] – (.Microsoft Corporation – CD-ROM File System Driver.) (.14/07/2009 – 00:19:47.) — C:Windowssystem32DriversCdfs.sys [92160]
    [MD5.F036CE71586E93D94DAB220D7BDF4416] – (.Microsoft Corporation – SCSI CD-ROM Driver.) (.20/11/2010 – 10:19:21.) — C:Windowssystem32DriversCdrom.sys [147456]
    [MD5.9BB2EF44EAA163B29C4A4587887A0FE4] – (.Microsoft Corporation – DFS Namespace Client Driver.) (.20/11/2010 – 10:26:32.) — C:Windowssystem32DriversDfsC.sys [102400]
    [MD5.97BFED39B6B79EB12CDDBFEED51F56BB] – (.Microsoft Corporation – High Definition Audio Bus Driver.) (.20/11/2010 – 11:43:43.) — C:Windowssystem32DriversHDAudBus.sys [122368]
    [MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] – (.Microsoft Corporation – Pilote de port i8042.) (.14/07/2009 – 00:19:57.) — C:Windowssystem32Driversi8042prt.sys [105472]
    [MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] – (.Microsoft Corporation – IP Network Address Translator.) (.14/07/2009 – 01:10:03.) — C:Windowssystem32DriversIpNat.sys [116224]
    [MD5.A5D9106A73DC88564C825D317CAC68AC] – (.Microsoft Corporation – Windows NT SMB Minirdr.) (.27/04/2011 – 03:40:40.) — C:Windowssystem32DriversMRxSmb.sys [158208]
    [MD5.09594D1089C523423B32A4229263F068] – (.Microsoft Corporation – MBT Transport driver.) (.20/11/2010 – 10:23:20.) — C:Windowssystem32DriversnetBT.sys [261632]
    [MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] – (.Microsoft Corporation – Pilote du système de fichiers NT.) (.11/04/2014 – 02:38:40.) — C:Windowssystem32Driversntfs.sys [1684928]
    [MD5.0086431C29C35BE1DBC43F52CC273887] – (.Microsoft Corporation – Pilote de port parallèle.) (.14/07/2009 – 01:00:41.) — C:Windowssystem32DriversParport.sys [97280]
    [MD5.471815800AE33E6F1C32FB1B97C490CA] – (.Microsoft Corporation – RAS L2TP mini-port/call-manager driver.) (.20/11/2010 – 11:52:35.) — C:Windowssystem32DriversRasl2tp.sys [129536]
    [MD5.548260A7B8654E024DC30BF8A7C5BAA4] – (.Microsoft Corporation – SMB Transport driver.) (.14/07/2009 – 01:09:09.) — C:Windowssystem32Driverssmb.sys [93184]
    [MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] – (.Microsoft Corporation – TDI Translation Driver.) (.20/11/2010 – 10:21:56.) — C:Windowssystem32Driverstdx.sys [119296]
    [MD5.0D08D2F3B3FF84E433346669B5E0F639] – (.Microsoft Corporation – Pilote de cliché instantané du volume.) (.20/11/2010 – 14:34:02.) — C:Windowssystem32Driversvolsnap.sys [295808]
    ~ Generic Processes: Scanned in 00mn 00s

    —\ Etat des fichiers cachés (Caché/Total)
    ~ Mes images (My Pictures) : 2/6889
    ~ Mes musiques (My Musics) : 1/188
    ~ Mes Videos (My Videos) : 2/36
    ~ Mes Favoris (My Favorites) : 1/48
    ~ Mes Documents (My Documents) : 3/3691
    ~ Mon Bureau (My Desktop) : 2/39
    ~ Menu demarrer (Programs) : 1/28
    ~ Hidden Files: Scanned in 00mn 02s

    —\ Processus lancés
    [MD5.B54921381A950C8215FB363B485C432B] – (.Hewlett-Packard Co. – HP Digital Imaging Monitor.) — C:Program Files (x86)HPDigital Imagingbinhpqtra08.exe [270336] [PID.2564]
    [MD5.C637FC4638A96165256B28D38DE7B953] – (.Hewlett-Packard – hpwuSchd Application.) — C:Program Files (x86)HPHP Software Updatehpwuschd2.exe [49208] [PID.4204]
    [MD5.4536D8FD8F0DDC38BAFD0575120C568F] – (.Samsung Electronics Co., Ltd. – Easy Display Manager.) — C:Program Files (x86)SamsungEasy Display Managerdmhkcore.exe [862064] [PID.4516]
    [MD5.361B0893A5C6741F347568A3232D2822] – (.AVG Technologies CZ, s.r.o. – AVG User Interface.) — C:Program Files (x86)AVGAVG2014avgui.exe [5188112] [PID.4596]
    [MD5.72860972F8196EBB3C896F53D2B95470] – (.Hewlett-Packard – HpqSRmon.) — C:Program Files (x86)HPDigital ImagingbinHpqSRmon.exe [150528] [PID.4608]
    [MD5.308F2EE28005510DE616409148CF077B] – (.Oracle Corporation – Java(TM) Update Scheduler.) — C:Program Files (x86)Common FilesJavaJava Updatejusched.exe [256896] [PID.4616]
    [MD5.F16EEA6CCA9D8A7D1193AE80E43FBBC7] – (.Hewlett-Packard Co. – HP CUE Status Root.) — C:Program Files (x86)HPDigital ImagingbinhpqSTE08.exe [168960] [PID.5004]
    [MD5.8A9FACCB684500829F7D0BCC67B386CC] – (.Hewlett-Packard Co. – HP CUE Alert Popup Window Objects.) — C:Program Files (x86)HPDigital Imagingbinhpqbam08.exe [559104] [PID.5048]
    [MD5.883008A9B5BFF94A153D99DBA54CB5C1] – (.Hewlett-Packard – GPCore COM object.) — C:Program Files (x86)HPDigital Imagingbinhpqgpc01.exe [362496] [PID.4100]
    [MD5.AC08A03D7E579E2903925736E7AB48F2] – (.Google Inc. – Google Chrome.) — C:Program Files (x86)GoogleChromeApplicationchrome.exe [852808] [PID.644]
    [MD5.2381AE1E0E72423C80B5B5E13B070074] – (.SEC – Samsung Recovery Solution 5.) — C:Program Files (x86)SamsungSamsung Recovery Solution 5WCScheduler.exe [4382312] [PID.5736]
    [MD5.E71335321BC3C5C46B041F8C2063F17B] – (.SAMSUNG Electronics – SSCKbdHk.) — C:Program Files (x86)SamsungSamsung Support CenterSSCKbdHk.exe [3398736] [PID.3220]
    [MD5.B8C44BF5A86B4662458F4AA8F901C94B] – (.Samsung Electronics – Samsung Update Plus Background.) — C:Program Files (x86)SamsungSamsung Update PlusSUPBackground.exe [2782064] [PID.892]
    [MD5.33BF80A2291C54DC7D7601CDEF63138E] – (.Nicolas Coolman – ZHPDiag.) — C:Program Files (x86)ZHPDiagZHPDiag.exe [8099328] [PID.5408]
    [MD5.B362181ED3771DC03B4141927C80F801] – (.Adobe Systems Incorporated – Adobe Acrobat Update Service.) — C:Program Files (x86)Common FilesAdobeARM1.0armsvc.exe [65432] [PID.1620]
    [MD5.1E7B74C93D85B1BFE3A291D62DD4DB29] – (.AVG Technologies CZ, s.r.o. – AVG Firewall Service.) — C:Program Files (x86)AVGAVG2014avgfws.exe [1417160] [PID.1640]
    [MD5.B6E2D865C5936A4FEE68F11E97DF6B82] – (.AVG Technologies CZ, s.r.o. – AVG Identity Protection Service.) — C:Program Files (x86)AVGAVG2014avgidsagent.exe [3242000] [PID.1684]
    [MD5.D7CBEEA4500BFDC63E99B06A1C512BE8] – (.AVG Technologies CZ, s.r.o. – AVG Watchdog Service.) — C:Program Files (x86)AVGAVG2014avgwdsvc.exe [289328] [PID.1704]
    [MD5.595F362A7C2F64304EFC77C72E7B9F84] – (.Hewlett-Packard Company – SolutionsFrameworkService.) — C:Program Files (x86)HpCommonHPSupportSolutionsFrameworkService.exe [78088] [PID.1880]
    [MD5.397D14958D6C9C2B365469A857B2AC4E] – (.Google Inc. – Google Crash Handler.) — C:Program Files (x86)GoogleUpdate1.3.24.15GoogleCrashHandler.exe [230792] [PID.2648]
    [MD5.39B1D0A636A400304565D4521FAD6D77] – (.Microsoft Corporation – Microsoft Application Virtualization Virtua.) — C:Program Files (x86)Microsoft Application Virtualization Clientsftvsa.exe [207528] [PID.2340]
    [MD5.77C5A741A7452812F278EF2C18478862] – (.Microsoft Corporation – Microsoft Application Virtualization Client.) — C:Program Files (x86)Microsoft Application Virtualization Clientsftlist.exe [523944] [PID.3200]
    [MD5.FD557A50A65E44041CD2FCEF4BEB04DB] – (.Microsoft Corporation – Microsoft Office Client Virtualization Serv.) — C:Program Files (x86)Common FilesMicrosoft SharedVirtualization HandlerCVHSVC.exe [822504] [PID.3340]
    ~ Processes Running: Scanned in 00mn 00s

    —\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
    C:Usersismail1973AppDataLocalGoogleChromeUser DataDefaultPreferences
    G0 – GCSP: Preference [User DataDefault][HomePage] http://www.search.ask.com” onclick=”window.open(this.href);return false;

    —\ Liste des dossiers d'extension Google Chrome
    ~ Google Lines Browser: 2 Legitimates Filtered in 00mn 59s

    —\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
    C:Usersismail1973AppDataRoamingMozillaFirefoxProfilesvjk6jvac.defaultprefs.js
    P2 – FPN: [HKCU] [@lightspark.github.com/Lightspark;version=1] – (…) — C:Program Files (x86)Lightspark 0.5.3-gitnplightsparkplugin.dll (.not file.)
    ~ Firefox Browser: 4 Legitimates Filtered in 00mn 00s

    —\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
    R1 – HKLMSOFTWAREWow6432NodeMicrosoftInternet ExplorerAboutURLs,Tabs = about:newtab
    ~ IE Browser: 20 Legitimates Filtered in 00mn 00s

    —\ Internet Explorer, Proxy Management (R5)
    R5 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyServer = no key
    R5 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyEnable = 0
    R5 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,MigrateProxy = 1
    R5 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,EnableHttp1_1 = 1
    R5 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyHttp1.1 = 1
    R5 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,AutoConfigProxy = wininet.dll
    ~ Proxy management: Scanned in 00mn 00s

    —\ Analyse des lignes F0, F1, F2, F3 – IniFiles, Autoloading programs
    F2 – REG:system.ini: USERINIT=C:Windowssystem32userinit.exe,
    F2 – REG:system.ini: Shell=C:Windowsexplorer.exe
    F2 – REG:system.ini: VMApplet=C:WindowsSystem32SystemPropertiesPerformance.exe
    ~ Keys: Scanned in 00mn 00s

    —\ Hosts file redirection (O1)
    ~ Le fichier hôte est sain (The hosts file is clean) (50)
    ~ Hosts File: Scanned in 00mn 00s

    —\ Browser Helper Objects de navigateur (O2)
    O2 – BHO: W2PBrowser Browser Helper [64Bits] – {AA609D72-8482-4076-8991-8CDAE5B93BCB} . (…) — C:Program FilesSamsung AnyWeb PrintW2PBrowser.dll
    O2 – BHO: HP Smart BHO Class [64Bits] – {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} Clé orpheline
    ~ BHO: 8 Legitimates Filtered in 00mn 04s

    —\ Internet Explorer Toolbars (O3)
    O3 – ToolbarWebBrowser: (no name) – [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Clé orpheline
    ~ Toolbar: Scanned in 00mn 00s

    —\ Applications lancées au démarrage du système (O4)
    O4 – HKLM..Run: [RtHDVCpl] . (.Realtek Semiconductor – Gestionnaire audio HD Realtek.) — C:Program FilesRealtekAudioHDARAVCpl64.exe =>.Realtek Semiconductor Corp
    O4 – HKLM..Run: [IgfxTray] . (.Intel Corporation – igfxTray Module.) — C:Windowssystem32igfxtray.exe
    O4 – HKLM..Run: [HotKeysCmds] . (.Intel Corporation – hkcmd Module.) — C:Windowssystem32hkcmd.exe
    O4 – HKLM..Run: [Persistence] . (.Intel Corporation – persistence Module.) — C:Windowssystem32igfxpers.exe
    O4 – HKLM..Wow6432NodeRun: [Adobe ARM] . (.Adobe Systems Incorporated – Adobe Reader and Acrobat Manager.) — C:Program Files (x86)Common FilesAdobeARM1.0AdobeARM.exe =>.Adobe Systems Incorporated
    O4 – HKLM..Wow6432NodeRun: [HP Software Update] . (.Hewlett-Packard – hpwuSchd Application.) — C:Program Files (x86)HPHP Software UpdateHPWuSchd2.exe =>.Hewlett-Packard Co
    O4 – HKLM..Wow6432NodeRun: [startertv_fr_5] C:Program Files (x86)HPHP Software UpdateHPWuSchd2.exe =>Adware.StarterTV
    O4 – HKLM..Wow6432NodeRun: [tuto4pc_fr_46] C:Program Files (x86)HPHP Software UpdateHPWuSchd2.exe =>PUP.AgenceExclusive
    O4 – HKLM..Wow6432NodeRun: [EaseUS EPM tray] C:Program Files (x86)EaseUSEaseUS Partition Master 9.2.2binEpmNews.exe (.not file.)
    O4 – HKLM..Wow6432NodeRun: [Microsoft Default Manager] . (.Microsoft Corporation – Microsoft Default Manager.) — C:Program Files (x86)MicrosoftSearch Enhancement PackDefault ManagerDefMgr.exe =>.Microsoft Corporation
    O4 – HKLM..Wow6432NodeRun: [UCam_Menu] . (.CyberLink Corp. – MUI StartMenu Application.) — C:Program Files (x86)CyberLinkYouCamMUITransferMUIStartMenu.exe
    O4 – HKLM..Wow6432NodeRun: [AVG_UI] . (.AVG Technologies CZ, s.r.o. – AVG User Interface.) — C:Program Files (x86)AVGAVG2014avgui.exe
    O4 – HKLM..Wow6432NodeRun: [hpqSRMon] . (.Hewlett-Packard – HpqSRmon.) — C:Program Files (x86)HPDigital ImagingbinhpqSRMon.exe
    O4 – HKLM..Wow6432NodeRun: [SunJavaUpdateSched] . (.Oracle Corporation – Java(TM) Update Scheduler.) — C:Program Files (x86)Common FilesJavaJava Updatejusched.exe =>.Oracle Corporation
    O4 – HKUSS-1-5-19..Run: [Sidebar] . (.Microsoft Corporation – Gadgets du Bureau Windows.) — C:Program Files (x86)Windows SidebarSidebar.exe =>.Microsoft Corporation
    O4 – HKUSS-1-5-20..Run: [Sidebar] . (.Microsoft Corporation – Gadgets du Bureau Windows.) — C:Program Files (x86)Windows SidebarSidebar.exe =>.Microsoft Corporation
    O4 – HKUSS-1-5-19..RunOnce: [mctadmin] . (.Microsoft Corporation – MCTAdmin.) — C:WindowsSystem32mctadmin.exe =>.Microsoft Corporation
    O4 – HKUSS-1-5-20..RunOnce: [mctadmin] . (.Microsoft Corporation – MCTAdmin.) — C:WindowsSystem32mctadmin.exe =>.Microsoft Corporation
    ~ Application: Scanned in 00mn 04s

    —\ Modification Domaine/Adresses DNS (O17)
    O17 – HKLMSystemCCSServicesTcpip..{A1D16C5A-9975-4BF2-A2B7-6436FC618867}: DhcpNameServer = 192.168.0.254
    O17 – HKLMSystemCS1ServicesTcpip..{A1D16C5A-9975-4BF2-A2B7-6436FC618867}: DhcpNameServer = 192.168.0.254
    O17 – HKLMSystemCS2ServicesTcpip..{A1D16C5A-9975-4BF2-A2B7-6436FC618867}: DhcpNameServer = 192.168.0.254
    O17 – HKLMSystemCCSServicesTcpipParameters: DhcpNameServer = 192.168.0.254
    ~ Domain: Scanned in 00mn 00s

    —\ Protocole additionnel (O18)
    O18 – Handler: wlpg [64Bits] – {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (…) —
    O18 – Filter: application/x-msdownload [64Bits] – {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation – Microsoft .NET Runtime Execution Engine.) — C:WindowsSystem32mscoree.dll =>.Microsoft Corporation
    ~ Protocole Additionnel: Scanned in 00mn 00s

    —\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
    O20 – Winlogon Notify: igfxcui . (.Intel Corporation – igfxdev Module.) — C:WindowsSystem32igfxdev.dll
    ~ Winlogon: Scanned in 00mn 00s

    —\ Tâches planifiées en automatique (O39)
    [MD5.00000000000000000000000000000000] [APT] [{44CE13CA-130A-4FCD-8A5A-B934D4F1E664}] (…) — C:Usersismail1973AppDataLocalTempTemp1_alphabet.exe.zipalphabet.exe (.not file.) [0]
    [MD5.00000000000000000000000000000000] [APT] [{4B8EEBEC-C8CA-4F03-8499-9D999133FDC1}] (…) — C:Program Files (x86)Free BeloteFreeBelote.exe (.not file.) [0]
    [MD5.00000000000000000000000000000000] [APT] [{5464E227-0BB2-4418-9878-2EA59257C652}] (…) — E:Setup.exe (.not file.) [0]
    [MD5.00000000000000000000000000000000] [APT] [{55585AB9-64B9-4D66-BC0B-75DDE544FAF5}] (…) — C:Program FilesBitdefenderBitdefender 2013seccenter.exe (.not file.) [0]
    [MD5.00000000000000000000000000000000] [APT] [{6D9CAC89-21A6-4185-9898-C1EF1A18E7F8}] (…) — C:Usersismail1973AppDataLocalTempShortcut_BundleSweetIMSetup-1-.exe (.not file.) [0] =>PUP.SweetIM
    [MD5.00000000000000000000000000000000] [APT] [{9BA348C5-B355-4657-A711-944D5EAEEA91}] (…) — C:Program FilesBitdefenderBitdefender 2013seccenter.exe (.not file.) [0]
    [MD5.00000000000000000000000000000000] [APT] [{C2F89777-AF8C-4FE7-852D-AA64D03003BC}] (…) — C:Usersismail1973DesktopIE9-Windows7-x64-fra.exe (.not file.) [0]
    [MD5.00000000000000000000000000000000] [APT] [{C30ABA9E-AC0F-4A4B-919B-E99D980DD482}] (…) — C:Usersismail1973Downloadsoccupations_and_places (2).exe (.not file.) [0]
    [MD5.00000000000000000000000000000000] [APT] [{DE45A7FD-0484-4019-8452-91AB0D47770B}] (…) — C:Program Files (x86)sweetpacks bundle uninstalleruninstaller.exe (.not file.) [0] =>PUP.SweetIM
    [MD5.00000000000000000000000000000000] [APT] [{FA09C771-7CFB-4782-953C-86A06D80BBBF}] (…) — C:Usersismail1973AppDataLocalTempTemp1_alphabet.exe (.not file.) [0]
    O39 – APT: – (..) — C:WindowsSystem32TasksAdobe Flash Player Updater [1002]
    O39 – APT: – (..) — C:WindowsSystem32TasksGoogleUpdateTaskMachineCore [1072]
    O39 – APT: – (..) — C:WindowsSystem32TasksGoogleUpdateTaskMachineUA [1076]
    ~ Scheduled Task: 35 Legitimates Filtered in 00mn 06s

    —\ HKCU & HKLM Software Keys
    [HKLMSoftwareWEDL] =>PUP.weDownloadManager
    [HKLMSoftwareWow6432NodeSOSVirus]
    [HKLMSoftwareWow6432NodeTUTO-4PC] =>PUP.AgenceExclusive
    [HKLMSoftwareWow6432NodeWEDL] =>PUP.weDownloadManager
    ~ Key Software: 308 Legitimates Filtered in 00mn 01s

    —\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
    O43 – CFD: 27/07/2013 – 03:21:13 – [0] —-D C:Program Files (x86)majtuto4pc_fr_a2 =>PUP.AgenceExclusive
    O43 – CFD: 24/01/2013 – 20:37:53 – [] —-D C:ProgramDataboost_interprocess
    O43 – CFD: 19/07/2013 – 19:46:07 – [] -SH-D C:ProgramData{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
    O43 – CFD: 28/08/2014 – 15:18:59 – [0] —-D C:Usersismail1973AppDataRoamingT1F0D1F2W1G1I1F1T1Q
    O43 – CFD: 24/03/2013 – 21:09:00 – [] —-D C:Usersismail1973AppDataRoaming{90140011-0066-040C-0000-0000000FF1CE}
    O43 – CFD: 09/02/2013 – 01:37:59 – [] —-D C:Usersismail1973AppDataLocalblekkotb_001 =>Toolbar.Blekko
    ~ 2 Dossier CLSID vide (CLSID Empty Folder)
    ~ Program Folder: 209 Legitimates Filtered in 00mn 01s

    —\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
    O55 – MWPS:[HKLM…PoliciesSystem] – “EnableUIADesktopToggle”=0
    O55 – MWPS:[HKLM…PoliciesSystem] – “FilterAdministratorToken”=0
    ~ MWPS: 16 Legitimates Filtered in 00mn 00s

    —\ Enumération des clés de registre PoliciesExplorer (MWPE) (O56)
    O56 – MWPE:[HKLM…policiesExplorer] – “NoActiveDesktopChanges”=1
    ~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s

    —\ Liste des pilotes du système (SDL) (O58)
    O58 – SDL:05/08/2006 – 17:21:04 —A- . (.ALWIL Software – avast! Base Kernel-Mode Device Driver for Windows NT/2000/XP.) — C:WindowsSystem32Driversaavmker4.sys [24920]
    O58 – SDL:05/08/2006 – 17:25:42 —A- . (.ALWIL Software – avast! File System Filter Driver for Windows XP.) — C:WindowsSystem32Driversaswmon2.sys [75608]
    O58 – SDL:14/07/2009 – 02:47:48 —A- . (.Emulex – Storport Miniport Driver for LightPulse HBAs.) — C:WindowsSystem32Driverselxstor.sys [530496]
    O58 – SDL:10/08/2010 – 03:01:56 —A- . (.ELAN Microelectronics Corp. – ETD Kernel Center.) — C:WindowsSystem32DriversETD.sys [111616]
    O58 – SDL:10/06/2009 – 21:31:59 —A- . (.Hauppauge Computer Works, Inc. – Hauppauge WinTV 885 Consumer IR Driver for eHome.) — C:WindowsSystem32Drivershcw85cir.sys [31232]
    O58 – SDL:29/05/2010 – 21:29:50 —A- . (.Windows (R) Codename Longhorn DDK provider – Universal Serial Bus Camera Driver.) — C:WindowsSystem32Driversjl2005c.sys [77992]
    O58 – SDL:14/07/2009 – 02:45:55 —A- . (.Promise Technology – Promise SuperTrak EX Series Driver for Windows.) — C:WindowsSystem32Driversstexstor.sys [24656]
    O58 – SDL:13/12/2012 – 12:50:36 —A- . (.Apple, Inc. – Apple Mobile Device USB Driver.) — C:WindowsSystem32Driversusbaapl64.sys [54784]
    O58 – SDL:17/03/2011 – 02:12:51 —A- . (.Windows (R) 2003 DDK 3790 provider – Generic Port I/O for Win64.) — C:WindowsSysWOW64driversrtport.sys [15144]
    ~ Drivers: 72 Legitimates Filtered in 00mn 28s

    —\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
    O61 – LFC: 14/09/2014 – 22:23:19 —A- . (…) — C:Usersismail1973Desktopadwcleaner_3.310.exe [1373475]
    ~ 561 Fichiers temporaires (Temporary files)
    ~ 3 Fichiers cookies (Cookies files)
    ~ Files: 8 Legitimates Filtered in 01mn 33s

    —\ Liste des outils de désinfection (LATC) (O63)
    O63 – Logiciel: UsbFix – (.El Desaparecido – http://www.usbfix.net” onclick=”window.open(this.href);return false; – https://www.sosvirus.net.)” onclick=”window.open(this.href);return false; [HKLM] — Usbfix
    O63 – Logiciel: ZHPDiag 2014 – (.Nicolas Coolman.) [HKLM] — ZHPDiag_is1 =>.Nicolas Coolman
    ~ ADS: Scanned in 00mn 00s

    —\ Associations Shell Spawning (O67)
    O67 – Shell Spawning: < .html> [HKCU..openCommand] (.Not Key.)
    ~ FASS Keys: 11 Legitimates Filtered in 00mn 00s

    —\ Menu de démarrage Internet (SMI) (O68)
    O68 – StartMenuInternet: [HKLM..ShellopenCommand] (.Google Inc. – Google Chrome.) — C:Program Files (x86)GoogleChromeApplicationchrome.exe
    O68 – StartMenuInternet: [HKLM..ShellopenCommand] (.Microsoft Corporation – Internet Explorer.) — C:Program Files (x86)Internet Exploreriexplore.exe
    ~ Keys: Scanned in 00mn 00s

    —\ Recherche d'infection sur les navigateurs internet (SBI) (O69)
    O69 – SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} – (Bing) – http://www.bing.com” onclick=”window.open(this.href);return false;
    ~ Keys: Scanned in 00mn 00s

    —\ Recherche particulière à la racine du système (SPRF) (O84)
    [MD5.679EE05CFC4E4B05DF55E572CE04F621] [SPRF][26/07/2013] (…) — C:ProgramData1374801838.bdinstall.bin [590212]
    [MD5.325EC1EE688519C58E55B5D92772A8D6] [SPRF][26/07/2013] (…) — C:ProgramData1374803035.bdinstall.bin [383766]
    [MD5.89EC4C16A27E08EDA6DD35FA7E83412B] [SPRF][26/07/2013] (…) — C:ProgramData1374803161.bdinstall.bin [57815]
    [MD5.DCCABBEBD6B0790F8891F343C82F32CD] [SPRF][26/07/2013] (…) — C:ProgramData1374803396.bdinstall.bin [223784]
    [MD5.0EAAFD09ED4CF11206359908D193BE12] [SPRF][26/07/2013] (…) — C:ProgramData1374862668.bdinstall.bin [446330]
    [MD5.003E8D1779D422A98288D63AB7714015] [SPRF][26/07/2013] (…) — C:ProgramData1374864097.bdinstall.bin [223921]
    [MD5.DF5A7D290A0BBFAF67F6B6EBF5930A97] [SPRF][04/10/2012] (…) — C:ProgramDatantuser.dat [262144]
    [MD5.1B151CCE618BE06C22B55FD4B502B75E] [SPRF][14/09/2014] (…) — C:Usersismail1973Desktopadwcleaner_3.310.exe [1373475]
    ~ Files: 12 Legitimates Filtered in 00mn 07s

    —\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
    [MD5.9D46A5F17F05429700507885F3680915] [WIS][26/10/2013] (.Kreapixel – Webplayer.) — C:WindowsInstaller22cb787.msi [21504] =>Adware.SocialSkinz
    ~ WIS: 1 Legitimates Filtered in 00mn 38s

    —\ Recherche de clés de registre Tracing (O100)
    HKLMSOFTWAREMicrosoftTracingBackupStack_RASAPI32 =>PUP.MyPCBackup
    HKLMSOFTWAREMicrosoftTracingBackupStack_RASMANCS =>PUP.MyPCBackup
    HKLMSOFTWAREMicrosoftTracingDomaIQ10_RASAPI32 =>Adware.DomaIQ
    HKLMSOFTWAREMicrosoftTracingDomaIQ10_RASMANCS =>Adware.DomaIQ
    HKLMSOFTWAREMicrosoftTracingMyPC Backup_RASAPI32 =>PUP.MyPCBackup
    HKLMSOFTWAREMicrosoftTracingMyPC Backup_RASMANCS =>PUP.MyPCBackup
    HKLMSOFTWAREMicrosoftTracingSignup Wizard_RASAPI32 =>PUP.JDIBackup
    HKLMSOFTWAREMicrosoftTracingSignup Wizard_RASMANCS =>PUP.JDIBackup
    HKLMSOFTWAREMicrosoftTracingupdateBrowseFox_RASAPI32 =>Adware.BrowseFox
    HKLMSOFTWAREMicrosoftTracingupdateBrowseFox_RASMANCS =>Adware.BrowseFox
    HKLMSOFTWAREWow6432NodeMicrosoftTracingAllin1ConvertCrxSetup_RASAPI32 =>Adware.Allin1Convert
    HKLMSOFTWAREWow6432NodeMicrosoftTracingAllin1ConvertCrxSetup_RASMANCS =>Adware.Allin1Convert
    HKLMSOFTWAREWow6432NodeMicrosoftTracingamt_qvo6_RASAPI32 =>Hijacker.Qvo6
    HKLMSOFTWAREWow6432NodeMicrosoftTracingamt_qvo6_RASMANCS =>Hijacker.Qvo6
    HKLMSOFTWAREWow6432NodeMicrosoftTracingAnti-phishing Domain Advisor uninstall_RASAPI32 =>Adware.PUP.VisicomAntiPhishing
    HKLMSOFTWAREWow6432NodeMicrosoftTracingAnti-phishing Domain Advisor uninstall_RASMANCS =>Adware.PUP.VisicomAntiPhishing
    HKLMSOFTWAREWow6432NodeMicrosoftTracingAVG-Secure-Search-Update_0614t_RASAPI32 =>Toolbar.AVGSearch
    HKLMSOFTWAREWow6432NodeMicrosoftTracingAVG-Secure-Search-Update_0614t_RASMANCS =>Toolbar.AVGSearch
    HKLMSOFTWAREWow6432NodeMicrosoftTracingAVG-Secure-Search-Update_0814avt_RASAPI32 =>Toolbar.AVGSearch
    HKLMSOFTWAREWow6432NodeMicrosoftTracingAVG-Secure-Search-Update_0814avt_RASMANCS =>Toolbar.AVGSearch
    HKLMSOFTWAREWow6432NodeMicrosoftTracingAVG-Secure-Search-Update_RASAPI32 =>Toolbar.AVGSearch
    HKLMSOFTWAREWow6432NodeMicrosoftTracingAVG-Secure-Search-Update_RASMANCS =>Toolbar.AVGSearch
    HKLMSOFTWAREWow6432NodeMicrosoftTracingblekkotb_001Tb_1_RASAPI32 =>Toolbar.Blekko
    HKLMSOFTWAREWow6432NodeMicrosoftTracingblekkotb_001Tb_1_RASMANCS =>Toolbar.Blekko
    HKLMSOFTWAREWow6432NodeMicrosoftTracingBundleSweetIMSetup-1-_RASAPI32 =>PUP.SweetIM
    HKLMSOFTWAREWow6432NodeMicrosoftTracingBundleSweetIMSetup-1-_RASMANCS =>PUP.SweetIM
    HKLMSOFTWAREWow6432NodeMicrosoftTracingdeskSvc_RASAPI32 =>Hijacker.22Find
    HKLMSOFTWAREWow6432NodeMicrosoftTracingdeskSvc_RASMANCS =>Hijacker.22Find
    HKLMSOFTWAREWow6432NodeMicrosoftTracingHDvid Codec V1-codedownloader_RASAPI32 =>PUP.HDVidCodec
    HKLMSOFTWAREWow6432NodeMicrosoftTracingHDvid Codec V1-codedownloader_RASMANCS =>PUP.HDVidCodec
    HKLMSOFTWAREWow6432NodeMicrosoftTracingHDvid Codec V1-updater_RASAPI32 =>PUP.HDVidCodec
    HKLMSOFTWAREWow6432NodeMicrosoftTracingHDvid Codec V1-updater_RASMANCS =>PUP.HDVidCodec
    HKLMSOFTWAREWow6432NodeMicrosoftTracingiMeshMediaBar_RASAPI32 =>PUP.iMesh
    HKLMSOFTWAREWow6432NodeMicrosoftTracingiMeshMediaBar_RASMANCS =>PUP.iMesh
    HKLMSOFTWAREWow6432NodeMicrosoftTracingInstall_BubbleDock_RASAPI32 =>PUP.BubbleDock
    HKLMSOFTWAREWow6432NodeMicrosoftTracingInstall_BubbleDock_RASMANCS =>PUP.BubbleDock
    HKLMSOFTWAREWow6432NodeMicrosoftTracinginstall_eMule0_RASAPI32 =>P2P.eMule
    HKLMSOFTWAREWow6432NodeMicrosoftTracinginstall_eMule0_RASMANCS =>P2P.eMule
    HKLMSOFTWAREWow6432NodeMicrosoftTracingLollipopInstaller_RASAPI32 =>Adware.Lollipop
    HKLMSOFTWAREWow6432NodeMicrosoftTracingLollipopInstaller_RASMANCS =>Adware.Lollipop
    HKLMSOFTWAREWow6432NodeMicrosoftTracingOptimizer_Pro_RASAPI32 =>PUP.OptimizerPro
    HKLMSOFTWAREWow6432NodeMicrosoftTracingOptimizer_Pro_RASMANCS =>PUP.OptimizerPro
    HKLMSOFTWAREWow6432NodeMicrosoftTracingPCRegistryShield_RASAPI32 =>Rogue.PCRegistryShield
    HKLMSOFTWAREWow6432NodeMicrosoftTracingPCRegistryShield_RASMANCS =>Rogue.PCRegistryShield
    HKLMSOFTWAREWow6432NodeMicrosoftTracingPricora-chromeinstaller_RASAPI32 =>Adware.Pricora
    HKLMSOFTWAREWow6432NodeMicrosoftTracingPricora-chromeinstaller_RASMANCS =>Adware.Pricora
    HKLMSOFTWAREWow6432NodeMicrosoftTracingPricora-codedownloader_RASAPI32 =>Adware.Pricora
    HKLMSOFTWAREWow6432NodeMicrosoftTracingPricora-codedownloader_RASMANCS =>Adware.Pricora
    HKLMSOFTWAREWow6432NodeMicrosoftTracingPricora-updater_RASAPI32 =>Adware.Pricora
    HKLMSOFTWAREWow6432NodeMicrosoftTracingPricora-updater_RASMANCS =>Adware.Pricora
    HKLMSOFTWAREWow6432NodeMicrosoftTracingQtraxInstaller_RASAPI32 =>P2P.Qtrax
    HKLMSOFTWAREWow6432NodeMicrosoftTracingQtraxInstaller_RASMANCS =>P2P.Qtrax
    HKLMSOFTWAREWow6432NodeMicrosoftTracingSetupDataMngr_iMesh_RASAPI32 =>PUP.iMesh
    HKLMSOFTWAREWow6432NodeMicrosoftTracingSetupDataMngr_iMesh_RASMANCS =>PUP.iMesh
    HKLMSOFTWAREWow6432NodeMicrosoftTracingSpam Free Search Bar uninstall_RASAPI32 =>Spyware.SpamFreeSearch
    HKLMSOFTWAREWow6432NodeMicrosoftTracingSpam Free Search Bar uninstall_RASMANCS =>Spyware.SpamFreeSearch
    HKLMSOFTWAREWow6432NodeMicrosoftTracingupt4pc_fr_46_RASAPI32 =>PUP.Eorezo
    HKLMSOFTWAREWow6432NodeMicrosoftTracingupt4pc_fr_46_RASMANCS =>PUP.Eorezo
    HKLMSOFTWAREWow6432NodeMicrosoftTracingVAFPlayer_RASAPI32 =>PUP.VAFPlayer
    HKLMSOFTWAREWow6432NodeMicrosoftTracingVAFPlayer_RASMANCS =>PUP.VAFPlayer
    HKLMSOFTWAREWow6432NodeMicrosoftTracingWajamUpdaterV3_RASAPI32 =>PUP.Wajam
    HKLMSOFTWAREWow6432NodeMicrosoftTracingWajamUpdaterV3_RASMANCS =>PUP.Wajam
    HKLMSOFTWAREWow6432NodeMicrosoftTracingWajam_Installer_RASAPI32 =>PUP.Wajam
    HKLMSOFTWAREWow6432NodeMicrosoftTracingWajam_Installer_RASMANCS =>PUP.Wajam
    ~ BTK: 810 Legitimates Filtered in 00mn 02s

    —\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
    SS – | Demand 11/09/2014 267440 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) – C:WindowsSysWOW64MacromedFlashFlashPlayerUpdateService.exe
    SS – | Auto 04/11/2011 136176 | (gupdate) . (.Google Inc..) – C:Program Files (x86)GoogleUpdateGoogleUpdate.exe
    SS – | Demand 04/11/2011 136176 | (gupdatem) . (.Google Inc..) – C:Program Files (x86)GoogleUpdateGoogleUpdate.exe
    SS – | Demand 09/08/2010 166704 | (Samsung UPD Service) . (.Samsung Electronics CO., LTD..) – C:WindowsSystem32SUPDSvc.exe
    SS – | Auto 23/10/2013 172192 | (SkypeUpdate) . (.Skype Technologies.) – C:Program Files (x86)SkypeUpdaterUpdater.exe
    SS – | Demand 14/07/2009 27136 | C:Program Files (x86)Windows Defendermpsvc.dll (WinDefend) . (.Microsoft Corporation.) – C:WindowsSystem32svchost.exe
    SR – | Auto 21/12/2013 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) – C:Program Files (x86)Common FilesAdobeARM1.0armsvc.exe
    SR – | Auto 25/08/2014 1417160 | (avgfws) . (.AVG Technologies CZ, s.r.o..) – C:Program Files (x86)AVGAVG2014avgfws.exe
    SR – | Auto 25/08/2014 3242000 | (AVGIDSAgent) . (.AVG Technologies CZ, s.r.o..) – C:Program Files (x86)AVGAVG2014avgidsagent.exe
    SR – | Auto 25/08/2014 289328 | (avgwd) . (.AVG Technologies CZ, s.r.o..) – C:Program Files (x86)AVGAVG2014avgwdsvc.exe
    SR – | Demand 14/07/2009 27136 | C:Program Files (x86)HPDigital Imagingbinhpqcxs08.dll (hpqcxs08) . (.Hewlett-Packard Co..) – C:WindowsSystem32svchost.exe
    SR – | Auto 14/07/2009 27136 | C:Program Files (x86)HPDigital Imagingbinhpqddsvc.dll (hpqddsvc) . (.Hewlett-Packard Co..) – C:WindowsSystem32svchost.exe
    SR – | Auto 14/07/2009 27136 | C:Usersismail1973AppDataLocalTemp7zS5CF1HPSLPSVC64.dll (HPSLPSVC) . (.Hewlett-Packard Co..) – C:WindowsSystem32svchost.exe
    SR – | Auto 26/08/2014 78088 | (HPSupportSolutionsFrameworkService) . (.Hewlett-Packard Company.) – C:Program Files (x86)HpCommonHPSupportSolutionsFrameworkService.exe
    SR – | Auto 14/07/2009 27136 | C:Windowssystem32HPZinw12.dll (Net Driver HPZ12) . (.Hewlett-Packard.) – C:WindowsSystem32svchost.exe
    SR – | Auto 14/07/2009 27136 | C:Windowssystem32HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) – C:WindowsSystem32svchost.exe
    SR – | Auto 10/07/1658 0 | (WMPNetworkSvc) . (…) – C:Program Files (x86)Windows Media Playerwmpnetwk.exe =>.Microsoft Corporation
    SR – | Auto 14/07/2009 27136 | C:WindowsSystem32wuaueng.dll (wuauserv) . (.Microsoft Corporation.) – C:WindowsSystem32svchost.exe
    ~ Services: Scanned in 00mn 21s

    —\ Recherche d'infection sur le Master Boot Record (MBR)(O80)
    Run by ismail1973 at 14/09/2014 22:27:01
    ~ OS 64 not supported by MBR tool
    ~ MBR: 0 Legitimates Filtered in 00mn 00s

    —\ Recherche d'infection sur le Master Boot Record (MBRCheck)(O80)
    Written by ad13, http://ad13.geekstog” onclick=”window.open(this.href);return false;
    Run by ismail1973 at 14/09/2014 22:27:03
    ********* Dump file Name *********
    C:PhysicalDisk0_MBR.bin
    ~ MBR: Scanned in 00mn 02s

    —\ Scan Additionnel (O88)
    Database Version : 13026 – (28/08/2014)
    Clés trouvées (Keys found) : 8
    Valeurs trouvées (Values found) : 1
    Dossiers trouvés (Folders found) : 6
    Fichiers trouvés (Files found) : 4

    [HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{493CCB71-DCAD-4257-9F08-8750F63BD792}] =>Toolbar.Agent
    [HKLMSoftwareWow6432NodeMicrosoftWindowsCurrentVersionExtPreApproved{493CCB71-DCAD-4257-9F08-8750F63BD792}] =>Toolbar.Agent
    [HKLMSoftwareMicrosoftTracingupdateBrowseFox_RASMANCS] =>Adware.BrowseFox
    [HKLMSoftwareMicrosoftTracingupdateBrowseFox_RASAPI32] =>Adware.BrowseFox
    [HKLMSoftwareClassesInterface{03480F0D-7897-4FC0-86D8-18B6FF450D2A}] =>Adware.MapsGalaxy
    [HKLMSoftwareClassesInterface{09B8C335-1622-42C7-8650-A79D56551343}] =>Adware.MapsGalaxy
    [HKLMSoftwareWow6432NodeGoogleChromeExtensionshggpkhijoeadmdfmlbdepfbngmhaldci] =>PUP.DealPly
    [HKLMSoftwareWow6432NodeMicrosoftWindowsCurrentVersionExtPreApproved{11111111-1111-1111-1111-110011221158}] =>PUP.CrossRider
    [HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun]:startertv_fr_5 =>Adware.StarterTV^
    C:Program Files (x86)majtuto4pc_fr_a2 =>PUP.AgenceExclusive^
    C:Usersismail1973AppDataLocalblekkotb_001 =>Toolbar.Blekko^
    C:ProgramDataSoftware =>Adware.Boxore
    C:Usersismail1973AppDataLocalGoogleChromeUser DataDefaultExtensionsmocblcnaofikinigmceddfghppkkjbog =>Adware.SmileyBar
    C:Usersismail1973AppDataLocalGoogleChromeUser DataDefaultExtensionsamfclgbdpgndipgoegfpkkgobahigbcl =>PUP.QuickShare
    C:Usersismail1973AppDataLocalGoogleChromeUser DataDefaultExtensionskpepfkjapeclaafmhoelccknpfedainn =>Adware.Downware
    [HKLMSoftwareWEDL] =>PUP.weDownloadManager^
    [HKLMSoftwareWow6432NodeTUTO-4PC] =>PUP.AgenceExclusive^
    [HKLMSoftwareWow6432NodeWEDL] =>PUP.weDownloadManager^
    C:WindowsInstaller22cb787.msi =>Adware.SocialSkinz^
    ~ Additionnel Scan: 282860 Items scanned in 01mn 05s

    —\ Informations complémentaires sur les modules
    ~ http://nicolascoolman.fr/g0-page-de-demarrage-google-chrome/” onclick=”window.open(this.href);return false; =>.Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
    ~ http://nicolascoolman.fr/r5-internet-explorer-proxy-management-iepm/” onclick=”window.open(this.href);return false; =>.Internet Explorer, Proxy Management (R5)
    ~ http://nicolascoolman.fr/o2-browser-helper-objects-de-navigateur/” onclick=”window.open(this.href);return false; =>.Browser Helper Objects de navigateur (O2)
    ~ http://nicolascoolman.fr/o3-internet-explorer-toolbars/” onclick=”window.open(this.href);return false; =>.Internet Explorer Toolbars (O3)
    ~ http://nicolascoolman.fr/o4-applications-demarrees-par-le-registre/” onclick=”window.open(this.href);return false; =>.Applications lancées au démarrage du système (O4)
    ~ AMI: 5 Legitimates Filtered in 00mn 00s

    —\ Récapitulatif des détections trouvées sur votre station
    http://nicolascoolman.fr/adware-startertv” onclick=”window.open(this.href);return false; =>Adware.StarterTV
    http://nicolascoolman.fr/spyware-agenceexclusive” onclick=”window.open(this.href);return false; =>PUP.AgenceExclusive
    http://nicolascoolman.fr/pup-sweetim” onclick=”window.open(this.href);return false; =>PUP.SweetIM
    http://nicolascoolman.fr/pup-wedownloadmanager” onclick=”window.open(this.href);return false; =>PUP.weDownloadManager
    http://nicolascoolman.fr/32164901-toolbar-blekko” onclick=”window.open(this.href);return false; =>Toolbar.Blekko
    http://nicolascoolman.fr/adware-socialskinz” onclick=”window.open(this.href);return false; =>Adware.SocialSkinz
    http://nicolascoolman.fr/pup-mypcbackup” onclick=”window.open(this.href);return false; =>PUP.MyPCBackup
    http://nicolascoolman.fr/adware-domaiq” onclick=”window.open(this.href);return false; =>Adware.DomaIQ
    http://nicolascoolman.fr/adware-browsefox” onclick=”window.open(this.href);return false; =>Adware.BrowseFox
    http://nicolascoolman.fr/adware-allin1convert” onclick=”window.open(this.href);return false; =>Adware.Allin1Convert
    http://nicolascoolman.fr/hijacker-qvo6” onclick=”window.open(this.href);return false; =>Hijacker.Qvo6
    http://nicolascoolman.fr/hijacker-22find” onclick=”window.open(this.href);return false; =>Hijacker.22Find
    http://nicolascoolman.fr/pup-hdvidcodec” onclick=”window.open(this.href);return false; =>PUP.HDVidCodec
    http://nicolascoolman.fr/pup-imesh” onclick=”window.open(this.href);return false; =>PUP.iMesh
    http://nicolascoolman.fr/pup-bubbledock” onclick=”window.open(this.href);return false; =>PUP.BubbleDock
    http://nicolascoolman.fr/adware-lollipop” onclick=”window.open(this.href);return false; =>Adware.Lollipop
    http://nicolascoolman.fr/pup-optimizerpro” onclick=”window.open(this.href);return false; =>PUP.OptimizerPro
    http://nicolascoolman.fr/rogue-pcregistryshield” onclick=”window.open(this.href);return false; =>Rogue.PCRegistryShield
    http://nicolascoolman.fr/adware-pricora” onclick=”window.open(this.href);return false; =>Adware.Pricora
    http://nicolascoolman.fr/33386243-spyware-spamfreesearch” onclick=”window.open(this.href);return false; =>Spyware.SpamFreeSearch
    http://nicolascoolman.fr/pup-eorezo” onclick=”window.open(this.href);return false; =>PUP.Eorezo
    http://nicolascoolman.fr/pup-vafplayer” onclick=”window.open(this.href);return false; =>PUP.VAFPlayer
    http://nicolascoolman.fr/pup-wajam” onclick=”window.open(this.href);return false; =>PUP.Wajam
    http://nicolascoolman.fr/adware-mapsgalaxy” onclick=”window.open(this.href);return false; =>Adware.MapsGalaxy
    http://nicolascoolman.fr/pup-dealply” onclick=”window.open(this.href);return false; =>PUP.DealPly
    http://nicolascoolman.fr/pup-crossrider” onclick=”window.open(this.href);return false; =>PUP.CrossRider
    http://nicolascoolman.fr/adware-boxore” onclick=”window.open(this.href);return false; =>Adware.Boxore
    http://nicolascoolman.fr/adware-smileybar” onclick=”window.open(this.href);return false; =>Adware.SmileyBar
    http://nicolascoolman.fr/pup-quickshare” onclick=”window.open(this.href);return false; =>PUP.QuickShare
    http://nicolascoolman.fr/adware-downware” onclick=”window.open(this.href);return false; =>Adware.Downware
    ~ MSI: 30 link(s) detected in 00mn 00s

    ~ 874 Legitimates filtered by white list
    End of the scan (556 lines in 09mn 04s)(0)[/spoiler:3i28tx27]

    J’ai aussi un rapport de Adwcleaner et Malwarebytes mais si je les mets le message a trop de caractères.
    Merci d’avance pour votre aide.

  • Photo du profil de g3n-h@ckm@ng3n-h@ckm@n
    Admin bbPress
    Post count: 8314

    salut ton pc est une poubelle numérique mais pas d’infection usb visible

    • Désactive ton antivirus le temps du téléchargement et de l’utilisation.
    • Télécharge AdsFix sur ton bureau.
      Note : Enregistrer votre travail avant de continuer !
    • Lance AdsFix
    • Pour un pc assez infecté , il peut mettre plusieurs secondes à se charger
    • Inscrit ton pays
    • Clique sur Nettoyer , après l’avoir débloqué dans les options

      Note : Patiente le temps du scan
    • Laisse travailler l’outil même s’il te parait bloqué
    • Si l’outil détecte un proxy que tu ne connais pas clic sur : “Supprimer le proxy
    • Héberge le rapport C:AdsFix_date_heure.txt sur SOSUpload puis donne le lien obtenu.

    Aide:

  • bunchie93
    Post count: 0

    J’ai lancé Adsfix mais à 80 % il se bloque. Je l’ai laissé toute la nuit et çà n’a pas bougé. Je l’ai stoppé et je l’ai relancé ce matin mais il rebloque à 80%.

  • Photo du profil de g3n-h@ckm@ng3n-h@ckm@n
    Admin bbPress
    Post count: 8314

    salut il ya écrit quoi sous la barre de progression quand il bloque ?

  • bunchie93
    Post count: 0

    [ismail1973|Firefox|Prefs.js]

  • Photo du profil de g3n-h@ckm@ng3n-h@ckm@n
    Admin bbPress
    Post count: 8314

    ok retélécharge-le ca devrait passer

  • bunchie93
    Post count: 0

    Bonjour,
    J’ai désinstallé puis réinstallé le logiciel et il s’arrête encore à 80 % avec les mêmes choses écrites sous la barre de progression. En plus, j’avais besoin d’ouvrir des docs word et open office et je ne peux plus le faire quand faisant clique droit “ouvrir avec…” alors qu’avant je n’avais pas ce problème.

Le sujet ‘clé usb infectée par virus créant des raccourcis’ est fermé à de nouvelles réponses.