Répondre à : Noms de dossiers et fichiers transformés en raccourcis 2016-09-08T13:34:16+00:00
Greta_1
Participant
Nombre d'articles : 8

re,
voici le rapport.
Cordialement
Mohamed

~ Rapport de ZHPDiag v2014.4.13.25 – Nicolas Coolman (13/04/2014)
~ Lancé par PICASSO (14/04/2014 13:01:59)
~ Adresse du Site Web http://nicolascoolman.webs.com” onclick=”window.open(this.href);return false;
~ Forums gratuits d’Assistance à la désinfection : http://nicolascoolman.webs.com/apps/links/” onclick=”window.open(this.href);return false;
~ Traduit par Nicolas Coolman
~ Etat de la version :
~ Liste blanche : Activée par le programme
~ Elévation des Privilèges : OK
~ User Account Control (UAC): Activate by user

—\ Navigateurs Internet
MSIE: Internet Explorer v11.0.9600.16521
MFIE: Mozilla Firefox 7.0.1 (Defaut)
GCIE: Google Chrome v32.0.1700.107

—\ Informations sur les produits Windows
~ Langage: Français
Windows 7 Professional, 32-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
~ Windows Operating System – Windows(R) 7, OEM_COA_SLP channel
Windows ID Activation : OK
~ Windows Partial Key : 6X2FJ
Windows License : OK
~ Windows Remaining Initializations Number : 1
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

—\ Logiciels de protection du système
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft Security Client v4.5.0216.0
Windows Defender W7

—\ Logiciels d’optimisation du système

—\ Logiciels de partage PeerToPeer

—\ Surveillance de Logiciels
Adobe Flash Player 11 Plugin
Adobe Reader X

—\ Informations sur le système
~ Processor: x86 Family 6 Model 23 Stepping 10, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1919 MB (43% free)
System Restore: Activé (Enable)
System drive C: has 24 GB (47%) free of 50 GB

—\ Mode de connexion au système
~ Computer Name: PICASSO13
~ User Name: PICASSO
~ All Users Names: PICASSO, greta01, Administrateur,
~ Unselected Option: None
Logged in as Administrator

—\ Variables d’environnement
~ System Unit : C:
~ %AppZHP% : C:UsersPICASSOAppDataRoamingZHP
~ %AppData% : C:UsersPICASSOAppDataRoaming
~ %Desktop% : C:UsersPICASSODesktop
~ %Favorites% : C:UsersPICASSOFavorites
~ %LocalAppData% : C:UsersPICASSOAppDataLocal
~ %StartMenu% : C:UsersPICASSOAppDataRoamingMicrosoftWindowsStart Menu
~ %Windir% : C:Windows
~ %System% : C:WindowsSystem32

—\ Enumération des unités disques
C: Hard drive, Flash drive, Thumb drive (Free 24 Go of 50 Go)
D: CD-ROM drive (Not Inserted)
E: Hard drive, Flash drive, Thumb drive (Free 398 Go of 414 Go)
F: Floppy drive, Flash card reader, USB Key (Free 1 Go of 1 Go)

—\ Etat du Centre de Sécurité Windows
~ Security Center: 43 Legitimates Filtered in 00mn 00s

—\ Recherche particulière de fichiers génériques
[MD5.8B88EBBB05A0E56B7DCC708498C02B3E] – (.Microsoft Corporation – Explorateur Windows.) (.14/09/2011 – 18:58:34.) — C:WindowsExplorer.exe [2616320]
[MD5.B5C5DCAD3899512020D135600129D665] – (.Microsoft Corporation – Application de démarrage de Windows.) (.14/07/2009 – 02:14:45.) — C:WindowsSystem32Wininit.exe [96256]
[MD5.AAFEAB4FC9D70253F8C7E353E879E8A2] – (.Microsoft Corporation – Extensions Internet pour Win32.) (.01/03/2014 – 03:32:16.) — C:WindowsSystem32wininet.dll [1820160]
[MD5.6D13E1406F50C66E2A95D97F22C47560] – (.Microsoft Corporation – Application d’ouverture de session Windows.) (.20/11/2010 – 22:29:06.) — C:WindowsSystem32Winlogon.exe [286720]
[MD5.E3AE23569749DE12D45BA3B489A036AE] – (.Microsoft Corporation – Bibliothèque de licences.) (.20/11/2010 – 22:29:24.) — C:WindowsSystem32sppcomapi.dll [193536]
[MD5.F81BB7E487EDCEAB630A7EE66CF23913] – (.Microsoft Corporation – Ancillary Function Driver for WinSock.) (.14/09/2013 – 01:48:58.) — C:Windowssystem32DriversAFD.sys [338944]
[MD5.338C86357871C167A96AB976519BF59E] – (.Microsoft Corporation – ATAPI IDE Miniport Driver.) (.14/07/2009 – 02:26:15.) — C:Windowssystem32Driversatapi.sys [21584]
[MD5.77EA11B065E0A8AB902D78145CA51E10] – (.Microsoft Corporation – CD-ROM File System Driver.) (.14/07/2009 – 00:11:15.) — C:Windowssystem32DriversCdfs.sys [70656]
[MD5.BE167ED0FDB9C1FA1133953C18D5A6C9] – (.Microsoft Corporation – SCSI CD-ROM Driver.) (.20/11/2010 – 22:29:03.) — C:Windowssystem32DriversCdrom.sys [108544]
[MD5.F024449C97EC1E464AAFFDA18593DB88] – (.Microsoft Corporation – DFS Namespace Client Driver.) (.20/11/2010 – 22:29:07.) — C:Windowssystem32DriversDfsC.sys [78336]
[MD5.9036377B8A6C15DC2EEC53E489D159B5] – (.Microsoft Corporation – High Definition Audio Bus Driver.) (.20/11/2010 – 22:29:03.) — C:Windowssystem32DriversHDAudBus.sys [108544]
[MD5.F151F0BDC47F4A28B1B20A0818EA36D6] – (.Microsoft Corporation – Pilote de port i8042.) (.14/07/2009 – 00:11:24.) — C:Windowssystem32Driversi8042prt.sys [80896]
[MD5.A5FA468D67ABCDAA36264E463A7BB0CD] – (.Microsoft Corporation – IP Network Address Translator.) (.14/07/2009 – 00:54:29.) — C:Windowssystem32DriversIpNat.sys [101888]
[MD5.5D16C921E3671636C0EBA3BBAAC5FD25] – (.Microsoft Corporation – Windows NT SMB Minirdr.) (.27/04/2011 – 03:17:22.) — C:Windowssystem32DriversMRxSmb.sys [123904]
[MD5.280122DDCF04B378EDD1AD54D71C1E54] – (.Microsoft Corporation – MBT Transport driver.) (.20/11/2010 – 22:29:08.) — C:Windowssystem32DriversnetBT.sys [187904]
[MD5.5E43D2B0EE64123D4880DFA6626DEFDE] – (.Microsoft Corporation – Pilote du système de fichiers NT.) (.12/04/2013 – 14:45:29.) — C:Windowssystem32Driversntfs.sys [1211752]
[MD5.2EA877ED5DD9713C5AC74E8EA7348D14] – (.Microsoft Corporation – Pilote de port parallèle.) (.14/07/2009 – 00:45:35.) — C:Windowssystem32DriversParport.sys [79360]
[MD5.D9F91EAFEC2815365CBE6D167E4E332A] – (.Microsoft Corporation – RAS L2TP mini-port/call-manager driver.) (.14/07/2009 – 00:54:34.) — C:Windowssystem32DriversRasl2tp.sys [78848]
[MD5.B973FCFC50DC1434E1970A146F7E3885] – (.Microsoft Corporation – Microsoft RDP Device redirector.) (.20/11/2010 – 22:29:49.) — C:Windowssystem32Driversrdpdr.sys [133632]
[MD5.3E21C083B8A01CB70BA1F09303010FCE] – (.Microsoft Corporation – SMB Transport driver.) (.14/07/2009 – 00:53:41.) — C:Windowssystem32Driverssmb.sys [71168]
[MD5.B459575348C20E8121D6039DA063C704] – (.Microsoft Corporation – TDI Translation Driver.) (.20/11/2010 – 22:29:07.) — C:Windowssystem32Driverstdx.sys [74752]
[MD5.F497F67932C6FA693D7DE2780631CFE7] – (.Microsoft Corporation – Pilote de cliché instantané du volume.) (.20/11/2010 – 22:29:03.) — C:Windowssystem32Driversvolsnap.sys [245632]
~ Generic Processes: Scanned in 00mn 00s

—\ Etat des fichiers cachés (Caché/Total)
~ Mes Favoris (My Favorites) : 1/8
~ Mes Documents (My Documents) : 2/4
~ Mon Bureau (My Desktop) : 1/11
~ Menu demarrer (Programs) : 1/28
~ Hidden Files: Scanned in 00mn 00s

—\ Processus lancés
[MD5.4E5585800B561FBEF64B27425365A36F] – (.Mozilla Corporation – Firefox.) — C:Program FilesMozilla Firefoxfirefox.exe [924632] [PID.3172]
[MD5.83F4BA8B8CDA4F063AA2002955A508A9] – (.Mozilla Corporation – Plugin Container for Firefox.) — C:Program FilesMozilla Firefoxplugin-container.exe [16856] [PID.3368]
[MD5.BFF948019509B5BF3F9B6CEED2E2B8E3] – (.Microsoft Corporation – Microsoft Word.) — C:Program FilesMicrosoft OfficeOffice14WINWORD.exe [1422680] [PID.3432]
[MD5.08FECDE82830FA31E186E071D87CE86A] – (.Nicolas Coolman – ZHPDiag.) — C:Program FilesZHPDiagZHPDiag.exe [8212992] [PID.2088]
[MD5.A63DC5C2EA944E6657203E0C8EDEAF61] – (.Microsoft Corporation – COM Surrogate.) — C:Windowssystem32DllHost.exe [7168] [PID.3900]
~ Processes Running: Scanned in 00mn 00s

—\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
C:UsersPICASSOAppDataLocalGoogleChromeUser DataDefaultPreferences
G1 – GCS: Preference [User DataDefault] {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}”, “name”: “Google”, “keyword”: “google.com

—\ Liste des dossiers d’extension Google Chrome

~ Google Lines Browser: 2 Legitimates Filtered in 00mn 00s

—\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
C:UsersPICASSOAppDataRoamingMozillaFirefoxProfiles806ypywh.defaultprefs.js
~ Firefox Browser: 21 Legitimates Filtered in 00mn 00s

—\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R1 – HKCUSOFTWAREMicrosoftInternet ExplorerMain,Default_Page_URL = http://ts.fujitsu.com” onclick=”window.open(this.href);return false;
~ IE Browser: 11 Legitimates Filtered in 00mn 00s

—\ Internet Explorer, Proxy Management (R5)
R5 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyServer = no key
R5 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyEnable = 0
R5 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,MigrateProxy = 1
R5 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,EnableHttp1_1 = 1
R5 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s

—\ Analyse des lignes F0, F1, F2, F3 – IniFiles, Autoloading programs
F2 – REG:system.ini: USERINIT=C:Windowssystem32userinit.exe,
F2 – REG:system.ini: Shell=C:Windowsexplorer.exe
F2 – REG:system.ini: VMApplet=C:WindowsSystem32SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s

—\ Hosts file redirection (O1)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21

—\ Internet Explorer Toolbars (O3)
O3 – Toolbar: &Radio – [HKLM]{8E718888-423F-11D2-876E-00A0C9082467} . (.Microsoft Corporation – Contrôle ActiveX du Lecteur Windows Media.) — C:Program FilesANIMAGEASSIMO 2TBSystemmsdxm.ocx =>.Microsoft Corporation
O3 – ToolbarWebBrowser: (no name) – [HKCU]{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} Clé orpheline
~ Toolbar: Scanned in 00mn 00s

—\ Autres liens utilisateurs (O4)
O4 – GSDesktop [Public]: ASSIMO 2.lnk . (…) — C:WindowsInstaller{4EE02553-541A-40CE-A828-69E091AD58FD}NewShortcut4_4EE02553541A40CEA82869E091AD58FD.exe
O4 – GSDesktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation – Firefox.) — C:Program FilesMozilla Firefoxfirefox.exe
O4 – GSProgram [Public]: LaunchCenter.lnk . (.Fujitsu Technology Solutions – Fujitsu LaunchCenter.) — C:Program FilesFujitsuLaunchCenterLaunchCenter.exe
O4 – GSProgram [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation – Firefox.) — C:Program FilesMozilla Firefoxfirefox.exe
O4 – GSQuickLaunch [PICASSO]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation – Internet Explorer.) — C:Program FilesInternet Exploreriexplore.exe
O4 – GSTaskBar [PICASSO]: Mozilla Firefox.lnk . (.Mozilla Corporation – Firefox.) — C:Program FilesMozilla Firefoxfirefox.exe
O4 – GSProgram [PICASSO]: Internet Explorer.lnk . (.Microsoft Corporation – Internet Explorer.) — C:Program FilesInternet Exploreriexplore.exe
O4 – GSSystemTools [PICASSO]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation – Internet Explorer.) — C:Program FilesInternet Exploreriexplore.exe
O4 – GSDesktop [PICASSO]: COACH ADULTES Ecoute.lnk . (.MatchWare A/S – Mediator Runtime.) — C:COACH ADULTES EcouteMD8RNTM.exe
O4 – GSDesktop [PICASSO]: COACH ADULTES Mots.lnk . (.MatchWare A/S – Mediator Runtime.) — C:COACH ADULTES MotsMD8RNTM.exe
O4 – GSDesktop [PICASSO]: COACH ADULTES Pratique.lnk . (.MatchWare A/S – Mediator Runtime.) — C:COACH ADULTES PratiqueMD8RNTM.exe
O4 – GSDesktop [PICASSO]: COACH ADULTES Sens.lnk . (.MatchWare A/S – Mediator Runtime.) — C:COACH ADULTES SensMD8RNTM.exe
O4 – GSDesktop [PICASSO]: COACH ADULTES Textes.lnk . (.MatchWare A/S – Mediator Runtime.) — C:COACH ADULTES TextesMD8RNTM.exe
O4 – GSDesktop [PICASSO]: Google Chrome.lnk . (.Google Inc. – Google Chrome.) — C:UsersPICASSOAppDataLocalGoogleChromeApplicationchrome.exe
O4 – GSQuickLaunch [greta01]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation – Internet Explorer.) — C:Program FilesInternet Exploreriexplore.exe
O4 – GSTaskBar [greta01]: Internet Explorer.lnk . (.Microsoft Corporation – Internet Explorer.) — C:Program FilesInternet Exploreriexplore.exe
O4 – GSTaskBar [greta01]: Mozilla Firefox.lnk . (.Mozilla Corporation – Firefox.) — C:Program FilesMozilla Firefoxfirefox.exe
O4 – GSProgram [greta01]: Internet Explorer.lnk . (.Microsoft Corporation – Internet Explorer.) — C:Program FilesInternet Exploreriexplore.exe
O4 – GSSystemTools [greta01]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation – Internet Explorer.) — C:Program FilesInternet Exploreriexplore.exe
O4 – GSDesktop [greta01]: C2 2ème passage rendu final.lnk . (…) — C:UsersPICASSODownloadsC2 2ème passage rendu final.docx (.not file.)
O4 – GSDesktop [greta01]: COACH ADULTES Ecoute.lnk . (.MatchWare A/S – Mediator Runtime.) — C:COACH ADULTES EcouteMD8RNTM.exe
O4 – GSDesktop [greta01]: COACH ADULTES Mots.lnk . (.MatchWare A/S – Mediator Runtime.) — C:COACH ADULTES MotsMD8RNTM.exe
O4 – GSDesktop [greta01]: COACH ADULTES Pratique.lnk . (.MatchWare A/S – Mediator Runtime.) — C:COACH ADULTES PratiqueMD8RNTM.exe
O4 – GSDesktop [greta01]: COACH ADULTES Sens.lnk . (.MatchWare A/S – Mediator Runtime.) — C:COACH ADULTES SensMD8RNTM.exe
O4 – GSDesktop [greta01]: COACH ADULTES Textes.lnk . (.MatchWare A/S – Mediator Runtime.) — C:COACH ADULTES TextesMD8RNTM.exe
O4 – GSDesktop [greta01]: Google Chrome.lnk . (.Google Inc. – Google Chrome.) — C:UsersPICASSOAppDataLocalGoogleChromeApplicationchrome.exe
O4 – GSDesktop [greta01]: Internet Explorer.lnk . (.Microsoft Corporation – Internet Explorer.) — C:Program FilesInternet Exploreriexplore.exe
O4 – GSDesktop [greta01]: PICASSO13.lnk . (…) — E:PICASSO13
~ Global Startup: 84 Legitimates Filtered in 00mn 01s

—\ Applications lancées au démarrage du système (O4)
O4 – HKLM..Run: [RtHDVCpl] . (.Realtek Semiconductor – Gestionnaire audio HD Realtek.) — C:Program FilesRealtekAudioHDARtHDVCpl.exe =>.Realtek Semiconductor Corp
O4 – HKLM..Run: [DeskUpdateNotifier] . (.Fujitsu Technology Solutions – DeskUpdate Notifier.) — c:FujitsuProgramsDeskUpdateDeskUpdateNotifier.exe
O4 – HKLM..Run: [IgfxTray] . (.Intel Corporation – igfxTray Module.) — C:Windowssystem32igfxtray.exe
O4 – HKLM..Run: [HotKeysCmds] . (.Intel Corporation – hkcmd Module.) — C:Windowssystem32hkcmd.exe
O4 – HKLM..Run: [Persistence] . (.Intel Corporation – persistence Module.) — C:Windowssystem32igfxpers.exe
O4 – HKLM..Run: [Adobe ARM] . (.Adobe Systems Incorporated – Adobe Reader and Acrobat Manager.) — C:Program FilesCommon FilesAdobeARM1.0AdobeARM.exe =>.Adobe Systems Incorporated
O4 – HKLM..Run: [BCSSync] . (.Microsoft Corporation – Microsoft Office 2010 component.) — C:Program FilesMicrosoft OfficeOffice14BCSSync.exe =>.Microsoft Corporation
O4 – HKLM..Run: [MSC] . (.Microsoft Corporation – Microsoft Security Client User Interface.) — C:Program FilesMicrosoft Security Clientmsseces.exe
O4 – HKLM..RunOnce: [Malwarebytes Anti-Malware] . (.Malwarebytes Corporation – Malwarebytes Anti-Malware.) — C:Program FilesMalwarebytes’ Anti-Malwarembamgui.exe
O4 – HKCU..Run: [Google Update] . (.Google Inc. – Programme d’installation de Google.) — C:UsersPICASSOAppDataLocalGoogleUpdateGoogleUpdate.exe =>.Google Inc
O4 – HKCU..RunOnce: [FlashPlayerUpdate] . (.Adobe Systems, Inc. – Adobe® Flash® Player Installer/Uninstaller.) — C:Windowssystem32MacromedFlashFlashUtil11e_Plugin.exe
O4 – HKUSS-1-5-19..Run: [Sidebar] . (.Microsoft Corporation – Gadgets du Bureau Windows.) — C:Program FilesWindows SidebarSidebar.exe =>.Microsoft Corporation
O4 – HKUSS-1-5-20..Run: [Sidebar] . (.Microsoft Corporation – Gadgets du Bureau Windows.) — C:Program FilesWindows SidebarSidebar.exe =>.Microsoft Corporation
O4 – HKUSS-1-5-19..RunOnce: [mctadmin] . (.Microsoft Corporation – MCTAdmin.) — C:WindowsSystem32mctadmin.exe =>.Microsoft Corporation
O4 – HKUSS-1-5-20..RunOnce: [mctadmin] . (.Microsoft Corporation – MCTAdmin.) — C:WindowsSystem32mctadmin.exe =>.Microsoft Corporation
O4 – HKUSS-1-5-21-3794041088-267600481-4042947410-1000..Run: [Google Update] . (.Google Inc. – Programme d’installation de Google.) — C:UsersPICASSOAppDataLocalGoogleUpdateGoogleUpdate.exe =>.Google Inc
O4 – HKUSS-1-5-21-3794041088-267600481-4042947410-1000..RunOnce: [FlashPlayerUpdate] . (.Adobe Systems, Inc. – Adobe® Flash® Player Installer/Uninstaller.) — C:Windowssystem32MacromedFlashFlashUtil11e_Plugin.exe
~ Application: Scanned in 00mn 00s

—\ Boutons situés sur la barre d’outils principale d’Internet Explorer (O9)
O9 – Extra button: @C:Program FilesWindows LiveWriterWindowsLiveWriterShortcuts.dll,-1003 – {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} . (.Microsoft Corporation – Windows Live Writer Blog This Extension.) — C:Program FilesWindows LiveWriterWriterBrowserExtension.dll
O9 – Extra button: &Envoyer à OneNote – {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation – Microsoft OneNote Internet Explorer Add-in.) — C:Program FilesMICROS~3Office14ONBttnIE.dll =>.Microsoft Corporation
O9 – Extra button: Notes &liées OneNote – {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} . (.Microsoft Corporation – Microsoft OneNote Internet Explorer Add-in.) — C:Program FilesMICROS~3Office14ONBTTN~1.dll =>.Microsoft Corporation
~ IE Extra Buttons: Scanned in 00mn 00s

—\ Objets ActiveX (Downloaded Program Files)(O16)
O16 – DPF: {166B1BCA-3F9C-11CF-8075-444553540000} ((no name)) – http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab” onclick=”window.open(this.href);return false;
~ Objets ActiveX: Scanned in 00mn 00s

—\ Modification Domaine/Adresses DNS (O17)
O17 – HKLMSystemCCSServicesTcpip..{DAFC8A59-6DFE-4F45-8F7D-A2360126F95A}: NameServer = 86.64.145.140,84.103.237.140
O17 – HKLMSystemCS1ServicesTcpip..{DAFC8A59-6DFE-4F45-8F7D-A2360126F95A}: NameServer = 86.64.145.140,84.103.237.140
O17 – HKLMSystemCS2ServicesTcpip..{DAFC8A59-6DFE-4F45-8F7D-A2360126F95A}: NameServer = 86.64.145.140,84.103.237.140
~ Domain: Scanned in 00mn 00s

—\ Protocole additionnel (O18)
O18 – Handler: wlpg – {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (.Microsoft Corporation – Windows Live Album Download Protocol Handle.) — C:Program FilesWindows LivePhoto GalleryAlbumDownloadProtocolHandler.dll
O18 – Filter: text/xml – {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation – Microsoft Office XML MIME Filter.) — C:Program FilesCommon FilesMicrosoft SharedOFFICE14MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s

—\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 – Winlogon Notify: igfxcui . (.Intel Corporation – igfxdev Module.) — C:WindowsSystem32igfxdev.dll
~ Winlogon: Scanned in 00mn 00s

—\ Tâches planifiées en automatique (O39)
[MD5.00000000000000000000000000000000] [APT] [DeskUpdate] (…) — c:FujitsuProgramsDeskUpdateducmd.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [DeskUpdateStartup] (…) — c:FujitsuProgramsDeskUpdateducmd.exe (.not file.) [0]
~ Scheduled Task: 16 Legitimates Filtered in 00mn 03s

—\ Logiciels installés (O42)
O42 – Logiciel: ASSIMO 2 Lecture Ecriture version reseau – (.ANIMAGE.) [HKLM] — {4EE02553-541A-40CE-A828-69E091AD58FD}
O42 – Logiciel: COACH ADULTES Ecoute – (…) [HKLM] — COACH ADULTES Ecoute
O42 – Logiciel: COACH ADULTES Mots – (…) [HKLM] — COACH ADULTES Mots
O42 – Logiciel: COACH ADULTES Pratique – (…) [HKLM] — COACH ADULTES Pratique
O42 – Logiciel: COACH ADULTES Sens – (…) [HKLM] — COACH ADULTES Sens
O42 – Logiciel: COACH ADULTES Textes – (…) [HKLM] — COACH ADULTES Textes
O42 – Logiciel: Medias ASSIMO 2 – (.ANIMAGE.) [HKLM] — {C68EDB3B-50A6-4C8C-8393-07A9627C923F}
~ Logic: 18 Legitimates Filtered in 00mn 00s

—\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 – CFD: 25/09/2012 – 18:46:43 – [648,609] —-D C:Program FilesANIMAGE
O43 – CFD: 25/09/2012 – 18:57:24 – [0,001] —-D C:UsersPICASSOAppDataRoamingMicrosoftWindowsStart MenuProgramsASSIMO 2 Lecture Ecriture
O43 – CFD: 02/10/2012 – 19:15:07 – [0] —-D C:UsersPICASSOAppDataRoamingMicrosoftWindowsStart MenuProgramsCOACH ADULTES Ecoute
O43 – CFD: 02/10/2012 – 19:22:06 – [0] —-D C:UsersPICASSOAppDataRoamingMicrosoftWindowsStart MenuProgramsCOACH ADULTES Mots
O43 – CFD: 02/10/2012 – 19:36:47 – [0] —-D C:UsersPICASSOAppDataRoamingMicrosoftWindowsStart MenuProgramsCOACH ADULTES Sens
O43 – CFD: 02/10/2012 – 19:24:32 – [0] —-D C:UsersPICASSOAppDataRoamingMicrosoftWindowsStart MenuProgramsCOACH ADULTES Textes
~ Program Folder: 99 Legitimates Filtered in 00mn 01s

—\ Derniers fichiers modifiés ou crées sous Windows et System32 (O44)
O44 – LFC:[MD5.AAD583619FB33504347FFD6EA248A9DE] – 14/04/2014 – 10:03:38


. (…) — C:UsbFix [Scan 1] PICASSO13.txt [7322]
O44 – LFC:[MD5.6A419897B9EB37F7E269C1F99C3F8BFE] – 14/04/2014 – 10:05:13


. (…) — C:UsbFix [Listing 1] PICASSO13.txt [5797]
O44 – LFC:[MD5.1B9E421E4909BF9BF4C0E1C9EC04E6E4] – 14/04/2014 – 10:08:36


. (…) — C:UsbFix [Scan 2] PICASSO13.txt [7069]
O44 – LFC:[MD5.751074817CA1FC83F863D53CE400E4FC] – 14/04/2014 – 11:07:16 —A- . (…) — C:UsbFix [Clean 2] PICASSO13.txt [12175]
O44 – LFC:[MD5.751074817CA1FC83F863D53CE400E4FC] – 14/04/2014 – 11:14:40 —A- . (…) — C:UsbFix [Clean 2] PICASSO13_1.txt [12175]
~ Files: 14 Legitimates Filtered in 00mn 01s

—\ Opérations et fonctions au démarrage de Windows Explorer (O46)
O46 – SEH:ShellExecuteHooks – Groove GFS Stub Execution Hook – {B5A7F190-DDA6-4420-B3BA-52453494E6CD} – C:PROGRA~1MICROS~3Office14GROOVEEX.DLL
~ ShellExecuteHooks: Scanned in 00mn 00s

—\ Enumération des clés de registre PoliciesSystem (MWPS) (O55)
O55 – MWPS:[HKLM…PoliciesSystem] – “EnableUIADesktopToggle”=0
O55 – MWPS:[HKLM…PoliciesSystem] – “PromptOnSecureDesktop”=0
O55 – MWPS:[HKLM…PoliciesSystem] – “FilterAdministratorToken”=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s

—\ Liste des pilotes du système (SDL) (O58)
O58 – SDL:[MD5.0ED67910C8C326796FAA00B2BF6D9D3C] – 14/07/2009 – 02:20:28 —A- . (.Emulex – Storport Miniport Driver for LightPulse HBAs.) — C:WindowsSystem32Driverselxstor.sys [453712]
O58 – SDL:[MD5.C44E3C2BAB6837DB337DDEE7544736DB] – 13/07/2009 – 23:54:14 —A- . (.Hauppauge Computer Works, Inc. – Hauppauge WinTV 885 Consumer IR Driver for eHome.) — C:WindowsSystem32Drivershcw85cir.sys [26624]
O58 – SDL:[MD5.DB32D325C192B801DF274BFD12A7E72B] – 14/07/2009 – 02:19:04 —A- . (.Promise Technology – Promise SuperTrak EX Series Driver for Windows.) — C:WindowsSystem32Driversstexstor.sys [21072]
O58 – SDL:[MD5.8AAD333C876590293F72B315E162BCC7] – 13/07/2009 – 22:40:41 —A- . (…) — C:WindowsSystem32ANSI.SYS [9029]
O58 – SDL:[MD5.0FE9F16075C9ACB941C957B7C649176E] – 13/07/2009 – 22:40:44 —A- . (…) — C:WindowsSystem32country.sys [27097]
O58 – SDL:[MD5.E6BC0F98FECEF245A0010D350C1A0B9B] – 13/07/2009 – 22:40:40 —A- . (…) — C:WindowsSystem32HIMEM.SYS [4768]
O58 – SDL:[MD5.492090267B9608C62B956CD29BE3AFB7] – 13/07/2009 – 22:40:43 —A- . (…) — C:WindowsSystem32KEY01.SYS [42809]
O58 – SDL:[MD5.FBBCFEC1379C5C02D88A361993EDF1B8] – 13/07/2009 – 22:40:43 —A- . (…) — C:WindowsSystem32KEYBOARD.SYS [42537]
O58 – SDL:[MD5.FFFF296A08DBF2AC0126C62E3778AC0D] – 13/07/2009 – 22:40:23 —A- . (…) — C:WindowsSystem32NTDOS.SYS [27866]
O58 – SDL:[MD5.CF9ED169FF86D935E47999E82359E898] – 13/07/2009 – 22:40:31 —A- . (…) — C:WindowsSystem32NTDOS404.SYS [29146]
O58 – SDL:[MD5.03B945AC0481CD8BB161C3569D8ED1C3] – 13/07/2009 – 22:40:35 —A- . (…) — C:WindowsSystem32NTDOS411.SYS [29370]
O58 – SDL:[MD5.BBC957DC18C17CC027EB80B7C77F2AEA] – 13/07/2009 – 22:40:39 —A- . (…) — C:WindowsSystem32NTDOS412.SYS [29274]
O58 – SDL:[MD5.3CFFAEFFF23B0D208214A6D3061A5B1B] – 13/07/2009 – 22:40:27 —A- . (…) — C:WindowsSystem32NTDOS804.SYS [29146]
O58 – SDL:[MD5.2E4112FB7D1B76E11ADFD7487B5D0E95] – 13/07/2009 – 22:40:11 —A- . (…) — C:WindowsSystem32NTIO.SYS [33952]
O58 – SDL:[MD5.A98EBD4C2DF983665BF2D1AF49949974] – 13/07/2009 – 22:40:15 —A- . (…) — C:WindowsSystem32NTIO404.SYS [34672]
O58 – SDL:[MD5.3F7E6406EDEF197C5CAAB2240EEF6F48] – 13/07/2009 – 22:40:17 —A- . (…) — C:WindowsSystem32NTIO411.SYS [35776]
O58 – SDL:[MD5.3E64D681B776CC57BDC38A46D881F85B] – 13/07/2009 – 22:40:19 —A- . (…) — C:WindowsSystem32NTIO412.SYS [35536]
O58 – SDL:[MD5.D86B6435729231C171432B4E77801BDB] – 13/07/2009 – 22:40:13 —A- . (…) — C:WindowsSystem32NTIO804.SYS [34672]
~ Drivers: 16 Legitimates Filtered in 00mn 03s

—\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 – LFC: 14/04/2014 – 13:02:39 —A- . (…) — C:UsersPICASSODocumentsProcuration_Herve_Cano.doc [22016]
O61 – LFC: 14/04/2014 – 13:02:39 —A- . (…) — C:UsersPICASSODocumentsUsbFix [Scan 1] PICASSO13.txt [7322]
O61 – LFC: 14/04/2014 – 13:02:39 –HA- . (…) — C:UsersPICASSODocuments~$ocuration_Herve_Cano.doc [162]
~ Files: 9 Legitimates Filtered in 00mn 05s

—\ Liste des outils de désinfection (LATC) (O63)
O63 – Logiciel: UsbFix – (.El Desaparecido – http://www.usbfix.nethttp://www.sosvirus.net.) [HKLM] — Usbfix
O63 – Logiciel: ZHPDiag 2014 – (.Nicolas Coolman.) [HKLM] — ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s

—\ Menu de démarrage Internet (SMI) (O68)
O68 – StartMenuInternet: [HKLM..ShellopenCommand] (.Mozilla Corporation – Firefox.) — C:Program FilesMozilla Firefoxfirefox.exe
O68 – StartMenuInternet: [HKLM..ShellopenCommand] (.Google Inc. – Google Chrome.) — C:UsersPICASSOAppDataLocalGoogleChromeApplicationchrome.exe
O68 – StartMenuInternet: [HKLM..ShellopenCommand] (.Microsoft Corporation – Internet Explorer.) — C:Program FilesInternet Exploreriexplore.exe
~ Keys: Scanned in 00mn 00s

—\ Recherche des packages WindowsInstaller (WIS) (O93) (NTFS)
[MD5.D104FB026535E3D5D88ED705EB6EE122] [WIS][13/05/2003] (.DUFAYS Benoit – MediaASSIMO 2.) — C:WindowsInstaller16e508.msi [1796864]
~ WIS: 89 Legitimates Filtered in 00mn 06s

—\ Recherche de clés de registre Tracing (O100)
HKLMSOFTWAREMicrosoftTracingGoogleToolbarManager_C8CBFED7F00D3A8C_RASAPI32 =>Toolbar.Google
HKLMSOFTWAREMicrosoftTracingGoogleToolbarManager_C8CBFED7F00D3A8C_RASMANCS =>Toolbar.Google
~ BTK: 84 Legitimates Filtered in 00mn 00s

—\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SS – | Auto 19/10/2011 136176 | (gupdate) . (.Google Inc..) – C:Program FilesGoogleUpdateGoogleUpdate.exe
SS – | Demand 19/10/2011 136176 | (gupdatem) . (.Google Inc..) – C:Program FilesGoogleUpdateGoogleUpdate.exe
SS – | Demand 14/07/2009 20992 | C:Program FilesWindows Defendermpsvc.dll (WinDefend) . (.Microsoft Corporation.) – C:WindowsSystem32svchost.exe

SR – | Auto 18/12/2013 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) – C:Program FilesCommon FilesAdobeARM1.0armsvc.exe
SR – | Auto 11/03/2014 22216 | (MsMpSvc) . (.Microsoft Corporation.) – C:Program FilesMicrosoft Security ClientMsMpEng.exe
SR – | Auto 16/07/2009 935208 | (Nero BackItUp Scheduler 4.0) . (.Nero AG.) – C:Program FilesCommon FilesNeroNero BackItUp 4NBService.exe
SR – | Auto 14/07/2009 20992 | C:Windowssystem32HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) – C:WindowsSystem32svchost.exe
SR – | Auto 14/07/2009 20992 | C:WindowsSystem32wuaueng.dll (wuauserv) . (.Microsoft Corporation.) – C:WindowsSystem32svchost.exe

~ Services: Scanned in 00mn 07s

—\ Recherche d’infection sur le Master Boot Record (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net” onclick=”window.open(this.href);return false;
Run by PICASSO at 14/04/2014 13:03:09

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS intelide.sys PCIIDEX.SYS atapi.sys
1 ntkrnlpa!IofCallDriver[0x83236BBA] >> DeviceHarddisk0DR0[0x85D506A8]
kernel: MBR read successfully
user & kernel MBR OK

~ MBR: 13 Legitimates Filtered in 00mn 02s

—\ Recherche d’infection sur le Master Boot Record (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog” onclick=”window.open(this.href);return false;
Run by PICASSO at 14/04/2014 13:03:11

********* Dump file Name *********
C:PhysicalDisk0_MBR.bin

~ MBR: Scanned in 00mn 04s

—\ Scan Additionnel (O88)
Database Version : 13044 – (13/04/2014)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 0

~ Additionnel Scan: 221317 Items scanned in 00mn 20s

—\ Récapitulatif des détections trouvées sur votre station
~ MSI: 0 link(s) detected in 00mn 00s

~ 860 Legitimates filtered by white list
End of the scan (444 lines in 01mn 33s)(0)