This topic is locked
Malwarebytes did not solve the problem...i cannot run safe mode with networking ..some downloads are stuck on 99 percent..otherwise computer behave ok .I can send diagnostic log...
~ Report of ZHPDiag v2015.6.4.54 - Nicolas Coolman (5/31/2015)
~ Launched by XXXX (6/20/2015 2:16:18 PM)
~ Facebook : https://www.facebook...nicolascoolman1
~ Web forum address : http://forum.nicolascoolman.fr
~ Translated by
~ Version State : New version available
~ White List : Activate by program
~ Elevation of privilege : OK
~ User Account Control : Not Found
---\\ Internet browsers
MSIE: Internet Explorer v8.0.6001.18702
MFIE: Mozilla Firefox 38.0.5
GCIE: Google Chrome v43.0.2357.124 (Defaut)
---\\ Windows product information
~ Langage: Anglais
Windows Automatic Updates : OK
Windows Genuine Advantage : OK
Microsoft Windows XP, 32-bit Service Pack 3 (Build 2600)
---\\ System protection software
Malwarebytes Anti-Malware version 2.1.6.1022
---\\ System optimization software
---\\ Sharing software PeerToPeer
---\\ Surveillance software
Adobe Flash Player 15 ActiveX
Adobe Reader XI
---\\ Information on the system
~ Processor: x86 Family 6 Model 15 Stepping 11, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3325.5 MB (41% free)
System Restore: Activé (Enable)
System drive C: has 704 GB (76%) free of 922 GB
---\\ Connection to the system mode
~ Computer Name: XXXX-0EA46F90D0
~ User Name: XXXX
~ All Users Names: XXXX, SUPPORT_388945a0, HelpAssistant, Guest, Administrator,
~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89
Logged in as Administrator
---\\ Environment variables
~ System Unit : C:\
~ %AppZHP% : C:\Documents and Settings\XXXX\Application Data\ZHP\
~ %AppData% : C:\Documents and Settings\XXXX\Application Data\
~ %Desktop% : C:\Documents and Settings\XXXX\Desktop\
~ %Favorites% : C:\Documents and Settings\XXXX\Favorites\
~ %LocalAppData% : C:\Documents and Settings\XXXX\Local Settings\Application Data\
~ %StartMenu% : C:\Documents and Settings\XXXX\Start Menu\
~ %Windir% : C:\WINDOWS\
~ %System% : C:\WINDOWS\system32\
---\\ Enumeration of the disk units
A: Floppy drive, Flash card reader, USB Key (Not Inserted)
C: Hard drive, Flash drive, Thumb drive (Free 704 Go of 922 Go)
D: CD-ROM drive (Not Inserted)
E: CD-ROM drive (Not Inserted)
F: Hard drive, Flash drive, Thumb drive (Free 377 Go of 941 Go)
G: CD-ROM drive (Free 0 Go of 0 Go)
I: Hard drive, Flash drive, Thumb drive (Free 560 Go of 699 Go)
J: CD-ROM drive (Free 0 Go of 0 Go)
---\\ State of the Windows Security Center
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: Modified =>Hijacker.Application
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Intl: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] XMLLookup: Modified
~ Security Center: 49 Legitimates Filtered in 00mn AMs
---\\ Search Generic System Files
[MD5.2BB75B7F548D82A099125D0C5971DE7D] - (.Microsoft Corporation - Windows Explorer.) (.2/12/2014 - 3:55:48 PM.) -- C:\WINDOWS\Explorer.exe [1033728]
[MD5.8AF91E4B4C1F5338EBE1548117304296] - (.Microsoft Corporation - Internet Extensions for Win32.) (.3/6/2014 - 7:59:23 PM.) -- C:\WINDOWS\system32\wininet.dll [920064]
[MD5.4A83111AA75D8A26AB0EABC03CFC95E0] - (.Microsoft Corporation - Windows NT Logon Application.) (.2/12/2014 - 3:56:28 PM.) -- C:\WINDOWS\system32\Winlogon.exe [509440]
[MD5.F6B7B1ECD7B41736BDB6FF4B092BCB79] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.2/12/2014 - 3:55:42 PM.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496]
[MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.4/13/2008 - 10:10:32 PM.) -- C:\WINDOWS\system32\Drivers\atapi.sys [96512]
[MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.4/14/2008 - 1:00:00 PM.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744]
[MD5.4B0A100EAF5C49EF3CCA8C641431EACC] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.2/12/2014 - 3:55:44 PM.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [62976]
[MD5.D45926117EB9FA946A6AF572FBE1CAA3] - (.Microsoft Corporation - FIPS Crypto Driver.) (.4/14/2008 - 1:00:00 PM.) -- C:\WINDOWS\system32\Drivers\Fips.sys [44544]
[MD5.3FCC124B6E08EE0E9351F717DD136939] - (.Windows ® Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.6/16/2010 - 4:59:42 PM.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [138752]
[MD5.4A0B06AA8943C1E332520F7440C0AA30] - (.Microsoft Corporation - i8042 Port Driver.) (.4/14/2008 - 1:00:00 PM.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [52480]
[MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.4/14/2008 - 1:00:00 PM.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [42112]
[MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.4/14/2008 - 1:00:00 PM.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [152832]
[MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.4/14/2008 - 1:00:00 PM.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [75264]
[MD5.FB2FCCC70F7174C7BF64F48E96D3ADF4] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.2/12/2014 - 3:55:57 PM.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [457856]
[MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.4/14/2008 - 1:00:00 PM.) -- C:\WINDOWS\system32\Drivers\netBT.sys [162816]
[MD5.4C51D5275AE8A16999EDFE7E647D00DE] - (.Microsoft Corporation - NT File System Driver.) (.11/18/2008 - 4:02:08 PM.) -- C:\WINDOWS\system32\Drivers\ntfs.sys [576384]
[MD5.5575FAF8F97CE5E713D108C2A58D7C7C] - (.Microsoft Corporation - Parallel Port Driver.) (.2/12/2014 - 4:00:21 PM.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80128]
[MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.4/14/2008 - 1:00:00 PM.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328]
[MD5.47EA20320E3D6FDC7B7BB22B2B881CA6] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.9/4/2009 - 3:43:46 PM.) -- C:\WINDOWS\system32\Drivers\rdpdr.sys [195712]
[MD5.F828DD7E1419B6653894A8F97A0094C5] - (.Microsoft Corporation - Redbook Audio Filter Driver.) (.4/14/2008 - 12:10:28 AM.) -- C:\WINDOWS\system32\Drivers\redbook.sys [57600]
[MD5.4C8FCB5CC53AAB716D810740FE59D025] - (.Microsoft Corporation - Volume Shadow Copy Driver.) (.4/14/2008 - 1:00:00 PM.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [52352]
~ Generic Processes: Scanned in 00mn AMs
---\\ Hidden files state (Hidden/Total)
~ Mes images (My Pictures) : 2/245
~ Mes musiques (My Musics) : 1/9
~ Mes Videos (My Videos) : 1/2
~ Mes Favoris (My Favorites) : 1/9
~ Mes Documents (My Documents) : 2/5585
~ Mon Bureau (My Desktop) : 1/52
~ Menu demarrer (Programs) : 1/86
~ Hidden Files: Scanned in 02mn AMs
---\\ Process running
[MD5.9D35F4CD788ED5FF8CC22F89317E7C83] - (.IObit - Advanced SystemCare Service.) -- C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe [878368] [PID.1016]
[MD5.805310DDD49C3B8F9CA759040F676A5F] - (.ATI Technologies Inc. - ATI External Event Utility EXE Module.) -- C:\WINDOWS\system32\Ati2evxx.exe [614400] [PID.1104]
[MD5.03CA51525DEA925DB51B2F1727D10D7D] - (.BitTorrent Inc. - µTorrent.) -- C:\Documents and Settings\XXXX\Application Data\uTorrent\uTorrent.exe [1769824] [PID.332] =>P2P.BitTorrent
[MD5.6B73E94F9FE82D45781B8C8A09483082] - (.Apple Inc. - YSLoader.exe.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [43336] [PID.540]
[MD5.DB5BEA73EDAF19AC68B2C0FAD0F92B1A] - (.Apple Inc. - Bonjour Service.) -- C:\Program Files\Bonjour\mDNSResponder.exe [390504] [PID.1480]
[MD5.BEFF149A82F78B648046108EB9D28893] - (.IObit - Product Updater.) -- C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2151200] [PID.304]
[MD5.09B32CA2265397A6FADB3AB34F34CA9A] - (.No owner - MA_CMIDI USB MIDI Installer Service.) -- C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe [94208] [PID.1576]
[MD5.67785D54BCECA5683607542997AE3A70] - (.Native Instruments GmbH - NIHardwareService.) -- C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [4595064] [PID.660]
[MD5.EF9978C1D89C88727DB2AAA75B5104E7] - (.Nalpeiron Ltd. - This service enables products that use the.) -- C:\WINDOWS\system32\nlssrv32.exe [71280] [PID.204]
[MD5.F7B2140AE98B068A6F0FD19685570279] - (.Vimicro - Vimicro.) -- C:\WINDOWS\VMSNAP3.exe [122880] [PID.3796]
[MD5.A08A6D194884DFC35C619F8A5E1FFFBD] - (.No owner - Real-time Protector.) -- C:\Program Files\IObit\Advanced SystemCare 7\RealTimeProtector.exe [1120032] [PID.3440]
[MD5.32498E50D40C37E874CB25D9624D7B74] - (...) -- C:\Program Files\Calibre2\calibre.exe [249856] [PID.2400]
[MD5.4547360EB0D90804B3AD080CE1D1D814] - (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe [813896] [PID.4004]
[MD5.12E2FC1F74265881402DE856D01EFFFE] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8214016] [PID.12484]
~ Processes Running: Scanned in 01mn AMs
---\\ Google Chrome, Start,Search,Extensions (G0,G1,G2)
C:\Documents and Settings\XXXX\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences
---\\ Google Chrome Extension Folder
~ Google Lines Browser: 22 Legitimates Filtered in 00mn AMs
---\\ Mozilla Firefox,Plugins,Start,Search,Extensions (P2,M0,M1,M2,M3)
M2 - MFEP: prefs.js [XXXX - 8ssyqsaa.default\[email protected]] [] Segurança do navegador Avira v1.4.9 (..)
M2 - MFEP: prefs.js [XXXX - 8ssyqsaa.default\[email protected]] [] Advanced SystemCare Surfing Protection v1.0 (..)
M2 - MFEP: Extension [XXXX - 8ssyqsaa.default] [email protected]
M2 - MFEP: Extension [XXXX - 8ssyqsaa.default] [email protected]
M2 - MFEP: Extension [XXXX - 8ssyqsaa.default] [email protected]
M2 - MFEP: Extension [XXXX - 8ssyqsaa.default] [email protected]
P2 - FPN:Firefox Plugin Navigator . (...) -- C:\Program Files\Mozilla Firefox\browser\searchplugins\ddg.xml
~ Firefox Browser: 24 Legitimates Filtered in 00mn AMs
---\\ Internet Explorer Extensions, Start, Search (R4,R3,R0,R1)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yandex.ru
~ IE Browser: 11 Legitimates Filtered in 00mn AMs
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
~ Proxy management: Scanned in 00mn AMs
---\\ Line Analysis F0, F1, F2, F3 - IniFiles, Auto loading programs
F2 - REG:system.ini: USERINIT=C:\WINDOWS\System32\Userinit.exe,
F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Keys: Scanned in 00mn AMs
---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (21)
~ Hosts File: Scanned in 00mn AMs
---\\ Internet Explorer toolbars (O3)
O3 - Toolbar: ExplorerWnd Helper - [HKLM]{10921475-03CE-4E04-90CE-E2E7EF20C814} . (.IObit - Uninstall for explorer.) -- C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll
O3 - Toolbar: Яндекс.Бар - [HKLM]{91397D20-1446-11D4-8AF4-0040CA1127B6} . (.ООО «ЯНДЕКС» - Яндекс.Бар для Microsoft Internet Explorer.) -- C:\Program Files\Yandex\YandexBarIE\yndbar.dll
O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Orphan key
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{91397D20-1446-11D4-8AF4-0040CA1127B6} Orphan key
~ Toolbar: Scanned in 00mn AMs
---\\ Auto loading programs from Registry and folders (O4)
O4 - HKLM\..\Run: [{8467e01f-0496-42ce-b247-88ef205b4880}] . (.Avira Operations GmbH & Co. KG - Avira.) -- C:\Documents and Settings\All Users\Application Data\Package Cache\{8467e01f-0496-42ce-b247-88ef205b4880}\Avira.OE.Setup.Bundle.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKCU\..\Run: [uTorrent] . (.BitTorrent Inc. - µTorrent.) -- C:\Documents and Settings\XXXX\Application Data\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - HKCU\..\Run: [AdobeBridge] Orphan key
O4 - HKCU\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\.DEFAULT\..\Run: [AviraSpeedup] C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe (.not file.)
O4 - HKUS\S-1-5-18\..\Run: [AviraSpeedup] C:\Program Files\Avira\AviraSpeedup\avira_system_speedup.exe (.not file.)
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] . (.Microsoft Corporation - Microsoft Narrator.) -- C:\WINDOWS\system32\Narrator.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] . (.Microsoft Corporation - Microsoft Narrator.) -- C:\WINDOWS\system32\Narrator.exe
O4 - HKUS\S-1-5-21-1177238915-1035525444-682003330-1003\..\Run: [uTorrent] . (.BitTorrent Inc. - µTorrent.) -- C:\Documents and Settings\XXXX\Application Data\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - HKUS\S-1-5-21-1177238915-1035525444-682003330-1003\..\Run: [AdobeBridge] Orphan key
O4 - HKUS\S-1-5-21-1177238915-1035525444-682003330-1003\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
~ Application: Scanned in 00mn AMs
---\\ Extra buttons on main IE button toolbar, or extra items in IE 'Tools' menu (O9)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\OFFICE11\REFBARH.ICO
O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -- Orphan key
~ IE Extra Buttons: Scanned in 00mn AMs
---\\ Reset Web Settings' hijack (O14)
O14 - IERESET.INF: SAFESITE_VALUE=SAFESITE_VALUE="ie.search.msn.com"
~ IE Paramètres WEB: Scanned in 00mn AMs
---\\ Site in Trusted Zone (O15)
O15 - Trusted Zone: [HKCU\...\Domains] *.dell.com
~ IE Zone Confiance: Scanned in 00mn AMs
---\\ Lop.com/Domain Hijackers (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{354D136D-1AED-4840-AC9D-9520BD7C409E}: DhcpNameServer = 8.8.8.8 8.8.4.4
O17 - HKLM\System\CCS\Services\Tcpip\..\{354D136D-1AED-4840-AC9D-9520BD7C409E}: DhcpDomain = skknet.net
O17 - HKLM\System\CS1\Services\Tcpip\..\{354D136D-1AED-4840-AC9D-9520BD7C409E}: DhcpNameServer = 8.8.8.8 8.8.4.4
O17 - HKLM\System\CS1\Services\Tcpip\..\{354D136D-1AED-4840-AC9D-9520BD7C409E}: DhcpDomain = skknet.net
O17 - HKLM\System\CS2\Services\Tcpip\..\{354D136D-1AED-4840-AC9D-9520BD7C409E}: DhcpNameServer = 8.8.8.8 8.8.4.4
O17 - HKLM\System\CS2\Services\Tcpip\..\{354D136D-1AED-4840-AC9D-9520BD7C409E}: DhcpDomain = skknet.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 8.8.8.8 8.8.4.4
~ Domain: Scanned in 00mn AMs
---\\ Extra protocols (O18)
O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} . (.Microsoft Corporation - WIA Scripting Layer.) -- C:\WINDOWS\system32\wiascr.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn AMs
---\\ AppInit_DLLs Registry value Autorun (O20)
O20 - Winlogon Notify: AtiExtEvent . (.ATI Technologies Inc. - ATI External Event Utility DLL Module.) -- C:\WINDOWS\system32\Ati2evxx.dll
O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dll
O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dll
O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Offline Network Agent.) -- C:\WINDOWS\system32\cscdll.dll
O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\system32\dimsntfy.dll
O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - Secondary Logon Service Notification DLL.) -- C:\WINDOWS\system32\sclgntfy.dll
O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\WlNotify.dll
O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - Common DLL to receive Winlogon notification.) -- C:\WINDOWS\system32\wlnotify.dll
~ Winlogon: Scanned in 00mn AMs
---\\ SharedTaskScheduler (O22)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} . (.Microsoft Corporation - Shell Browser UI Library.) -- C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Browseui preloader - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Shell Browser UI Library.) -- C:\WINDOWS\system32\browseui.dll
~ STS/SSO: Scanned in 00mn AMs
---\\ Non Microsoft non disabled Windows XP/NT/2000 Services (O23)
O23 - Service: M-Audio Series II MIDI Installer (MA_CMIDI_InstallerService) . (.No owner - MA_CMIDI USB MIDI Installer Service.) - C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
~ Services: 12 Legitimates Filtered in 02mn AMs
---\\ Windows Active Desktop & MHTML Editor (O24)
O24 - Desktop Component 0: My Current Home Page - file:About:Home
O24 - Desktop General: BackupWallPaper - .(...) - C:\Documents and Settings\XXXX\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop General: WallPaper - .(...) - C:\Documents and Settings\XXXX\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
~ Desktop Component: 4 Legitimates Filtered in 00mn AMs
---\\ Task Planned Automatically (039)
O39 - APT: - (..) -- C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job [220]
O39 - APT: - (..) -- C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job [214]
O39 - APT: - (..) -- C:\WINDOWS\Tasks\shutdown.job [258]
~ Scheduled Task: 16 Legitimates Filtered in 00mn AMs
---\\ ActiveSetup Installed Components (O40)
O40 - ASIC: Installed Component - S-1-5-21-1177238915-1035525444-682003330-1003 - >{X9B49E34-C7CC-11D0-8953-00A0C90347FF} -- Not Hexadécimal CLSID
~ Active Setup: 20 Legitimates Filtered in 00mn AMs
---\\ Software installed (O42)
O42 - Logiciel: Ample Bass P version 1.0.0 - (.Ample Sound Technology Co., Ltd..) [HKLM] -- {9E12DB30-0896-11E4-9191-0800200C9A66}_is1
O42 - Logiciel: Any Wallpaper 1.1.1 - (.AnyUtils.) [HKLM] -- Any Wallpaper_is1
O42 - Logiciel: Aya Audio to MP3/WMA/AAC/MP2/WAV/OGG/M4A/AMR Audio Converter V1 - (.Aya Software.) [HKLM] -- Aya Audio to MP3/WMA/AAC/MP2/WAV/OGG/M4A/AMR Aud~232DB3A3_is1
O42 - Logiciel: Bulgarian (Phonetic) by Iliya Dankov - (.ILIYA DANKOV - www.dankov.hit.bg.) [HKLM] -- {57BA3105-8E44-45BD-BB3A-F0BD5EA0575B}
O42 - Logiciel: CoolEdit Pro - (.EKE58.) [HKLM] -- {0D2A50C4-8DE4-4A47-B6DD-F9F0CE24E269}
O42 - Logiciel: FlexType 2K - (...) [HKLM] -- FlexType 2K
O42 - Logiciel: MorphoX - (...) [HKCU] -- MorphoX
O42 - Logiciel: PSP VintageWarmer2 2.5.2 32bit - (.PSPaudioware.com.) [HKLM] -- PSP VintageWarmer2 2.5.2 32bit
O42 - Logiciel: Perfectly Clear Plugin 1.7.0 - (.Athentech.) [HKLM] -- Perfectly Clear Plugin
O42 - Logiciel: Phonetic Cyrillic for Windows 2000 v1.0 - (.5Group & Co..) [HKLM] -- BGPHO-WIN2K_is1
O42 - Logiciel: REmatrix - (.Overloud.) [HKLM] -- {FA90E0EB-2AF1-44E8-BBA0-7D151516995D}_is1
O42 - Logiciel: Service Installer II - (.Nalpeiron.) [HKLM] -- Service Installer II
O42 - Logiciel: Service Installer II - (.Nalpeiron.) [HKLM] -- {251D3D16-D48D-40E3-9B35-243274D64B78}
O42 - Logiciel: SoulSeek 157 NS 13e - (...) [HKLM] -- Soulseek2 =>P2P.SoulSeek
O42 - Logiciel: Spirit of Revenge - Cursed Castle Collectors Edition - (.LeeGT-Games.) [HKLM] -- Spirit of Revenge - Cursed Castle Collectors Edition
O42 - Logiciel: UmmyVideoDownloader - (...) [HKLM] -- {E028DBDA-EEE7-48A0-ADF7-D250589A02C5}_is1
O42 - Logiciel: Valve Exciter version 1.1.0 - (.AudioThing.) [HKLM] -- {7AF49065-7792-4BF8-BD39-BC50F2E3AA11}_is1
~ Logic: 40 Legitimates Filtered in 01mn AMs
---\\ HKCU & HKLM Software Keys
[HKCU\Software\Ample Sound]
[HKCU\Software\Anbo]
[HKCU\Software\DATECS ltd]
[HKCU\Software\O2D]
[HKCU\Software\PSP-audioware]
[HKCU\Software\Soulseek2] =>P2P.SoulSeek
[HKCU\Software\Yandex]
[HKLM\Software\DATECS ltd]
~ Key Software: 463 Legitimates Filtered in 01mn AMs
---\\ Contents of the Common Files folders (O43)
O43 - CFD: 6/6/2015 - 12:24:17 PM - [] ----D C:\Program Files\5Group
O43 - CFD: 10/28/2014 - 3:26:56 PM - [] ----D C:\Program Files\Ample Sound
O43 - CFD: 2/12/2015 - 1:31:52 AM - [] ----D C:\Program Files\AnyUtils
O43 - CFD: 10/8/2014 - 10:52:18 PM - [] ----D C:\Program Files\Aya Audio to Audio Converter
O43 - CFD: 6/19/2015 - 11:08:20 PM - [] ----D C:\Program Files\CursorMania
O43 - CFD: 6/15/2015 - 9:30:57 AM - [] ----D C:\Program Files\cyrillic
O43 - CFD: 6/6/2015 - 12:12:43 PM - [] ----D C:\Program Files\Datecs
O43 - CFD: 6/15/2015 - 9:31:06 AM - [] ----D C:\Program Files\Flex_utl
O43 - CFD: 6/19/2015 - 10:59:47 PM - [] ----D C:\Program Files\LeeGT-Games
O43 - CFD: 10/20/2014 - 6:49:19 PM - [] ----D C:\Program Files\Pro-53
O43 - CFD: 6/15/2015 - 9:30:57 AM - [] ----D C:\Program Files\Protype
O43 - CFD: 2/14/2015 - 11:43:41 PM - [] ----D C:\Program Files\RTEQ
O43 - CFD: 3/15/2015 - 10:26:20 AM - [] ----D C:\Program Files\SoulseekNS =>P2P.SoulSeek
O43 - CFD: 6/15/2015 - 9:31:06 AM - [] ----D C:\Program Files\standart
O43 - CFD: 11/6/2014 - 4:40:24 PM - [] ----D C:\Program Files\Yandex
O43 - CFD: 6/15/2015 - 9:00:43 AM - [] ----D C:\Documents and Settings\All Users\Application Data\ProductData
O43 - CFD: 4/16/2015 - 12:20:03 AM - [] ----D C:\Documents and Settings\All Users\Application Data\Soulseek =>P2P.SoulSeek
O43 - CFD: 11/6/2014 - 6:23:47 PM - [0] ----D C:\Documents and Settings\All Users\Application Data\SpeedBit
O43 - CFD: 11/6/2014 - 4:40:42 PM - [] ----D C:\Documents and Settings\All Users\Application Data\Yandex
O43 - CFD: 10/28/2014 - 4:39:42 PM - [] --H-D C:\Documents and Settings\All Users\Application Data\{3006A797-CDFA-44FC-98EF-155579E2CDBF}
O43 - CFD: 10/28/2014 - 4:48:10 PM - [] --H-D C:\Documents and Settings\All Users\Application Data\{3A409EC6-A047-4692-9F61-C2BBA9F5CA82}
O43 - CFD: 10/5/2014 - 7:30:50 PM - [0] ----D C:\Documents and Settings\All Users\Application Data\{3C5CBD7B-3D1D-411E-96C2-513FFCA84D2D}
O43 - CFD: 10/28/2014 - 4:49:46 PM - [] --H-D C:\Documents and Settings\All Users\Application Data\{56C5D4F0-9E6D-421F-AA70-A7EF727C1C69}
O43 - CFD: 10/28/2014 - 4:59:40 PM - [] --H-D C:\Documents and Settings\All Users\Application Data\{60143F1F-63C8-4CC1-A37B-28EB1FC6C10F}
O43 - CFD: 10/28/2014 - 4:45:50 PM - [] --H-D C:\Documents and Settings\All Users\Application Data\{6495CC1D-C10B-40C5-A92B-241A2B2C8D20}
O43 - CFD: 11/5/2014 - 12:23:21 AM - [] --H-D C:\Documents and Settings\All Users\Application Data\{70E22094-D034-40C3-89F7-AA970A0C0232}
O43 - CFD: 10/28/2014 - 4:45:24 PM - [] --H-D C:\Documents and Settings\All Users\Application Data\{9C588B44-42B6-434D-90BD-824BBB1F328A}
O43 - CFD: 10/28/2014 - 4:45:12 PM - [] --H-D C:\Documents and Settings\All Users\Application Data\{B49C92CB-1A73-4A41-A84C-5091582E7AA8}
O43 - CFD: 10/8/2014 - 11:03:30 PM - [] --H-D C:\Documents and Settings\All Users\Application Data\{E8674DB2-4487-4238-A191-4DD8B190B0BC}
O43 - CFD: 10/28/2014 - 4:45:37 PM - [] --H-D C:\Documents and Settings\All Users\Application Data\{F57C376F-E7ED-4527-9EE2-4D50799418BC}
O43 - CFD: 6/6/2015 - 12:24:17 PM - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\5Group
O43 - CFD: 10/28/2014 - 3:26:55 PM - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\Ample Sound
O43 - CFD: 2/12/2015 - 1:31:52 AM - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\AnyUtils
O43 - CFD: 11/5/2014 - 12:23:22 AM - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\Perfectly Clear Plugin
O43 - CFD: 10/11/2014 - 7:54:22 PM - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\PSPaudioware
O43 - CFD: 1/28/2015 - 12:06:12 AM - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\UmmyVideoDownloader
O43 - CFD: 11/6/2014 - 4:40:43 PM - [] ----D C:\Documents and Settings\All Users\Start Menu\Programs\Яндекс
O43 - CFD: 10/28/2014 - 3:32:01 PM - [] ----D C:\Documents and Settings\XXXX\Application Data\Ample Sound
O43 - CFD: 6/19/2015 - 8:12:50 PM - [] ----D C:\Documents and Settings\XXXX\Application Data\Graphium
O43 - CFD: 6/19/2015 - 6:28:25 PM - [] ----D C:\Documents and Settings\XXXX\Application Data\MysteryTag
O43 - CFD: 11/6/2014 - 6:17:22 PM - [] ----D C:\Documents and Settings\XXXX\Application Data\SpeedBit
O43 - CFD: 3/15/2015 - 10:28:10 AM - [] ----D C:\Documents and Settings\XXXX\Application Data\Ultra Fractal 5
O43 - CFD: 2/12/2015 - 1:14:24 AM - [0] ----D C:\Documents and Settings\XXXX\Application Data\WebacamSurveyor
O43 - CFD: 11/6/2014 - 4:40:44 PM - [] ----D C:\Documents and Settings\XXXX\Application Data\Yandex
O43 - CFD: 2/12/2015 - 1:31:55 AM - [] ----D C:\Documents and Settings\XXXX\Local Settings\Application Data\AnyUtils
O43 - CFD: 11/19/2014 - 6:38:13 PM - [] ----D C:\Documents and Settings\XXXX\Local Settings\Application Data\HiSuite
O43 - CFD: 4/27/2015 - 12:38:54 AM - [] ----D C:\Documents and Settings\XXXX\Local Settings\Application Data\UmmyVideoDownloader
O43 - CFD: 11/6/2014 - 4:40:48 PM - [] ----D C:\Documents and Settings\XXXX\Local Settings\Application Data\Yandex
O43 - CFD: 6/19/2015 - 6:22:41 PM - [] ----D C:\Documents and Settings\XXXX\Start Menu\Programs\Beyond the Invisible - Evening 1.0
O43 - CFD: 6/19/2015 - 6:06:57 PM - [] ----D C:\Documents and Settings\XXXX\Start Menu\Programs\Vampire Legends 2 - The Untold Story of Elizabeth Bathory CE
~ Program Folder: 366 Legitimates Filtered in 01mn AMs
---\\ Last modified or created files under Windows and System32 (O44)
O44 - LFC:[MD5.53DC1951A78FDEBFCAD28F6B4F682ACC] - 6/19/2015 - 4:39:35 PM ---A- . (...) -- C:\WINDOWS\system.ini [309]
O44 - LFC:[MD5.C06353363CE1FAD2128FA88B94CB3165] - 6/19/2015 - 4:39:35 PM ---A- . (...) -- C:\WINDOWS\win.ini [681]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 6/19/2015 - 7:32:42 PM ---A- . (...) -- C:\WINDOWS\Sti_Trace.log [0]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 6/20/2015 - 11:05:23 AM ---A- . (...) -- C:\asc_rdflag [0]
O44 - LFC:[MD5.F9C4FBBEF52308C5088767B74570FF8B] - 6/20/2015 - 12:40:54 PM ---A- . (...) -- C:\gqlv.exe [103140]
O44 - LFC:[MD5.7DA0B59442D5DD7CE2A9B0A8125A1252] - 6/20/2015 - 12:47:22 PM ---A- . (...) -- C:\WINDOWS\mlkumidi.log [19909]
O44 - LFC:[MD5.BA610CE795FC15D834578AF67B845519] - 6/20/2015 - 12:48:01 PM ---A- . (...) -- C:\WINDOWS\wiadebug.log [159]
O44 - LFC:[MD5.A83AE8DA3C03D508390ABE59F2706DD1] - 6/20/2015 - 12:48:03 PM ---A- . (...) -- C:\WINDOWS\wiaservc.log [52]
O44 - LFC:[MD5.B1008433D80F720EC10141B88C42B66B] - 6/20/2015 - 9:21:34 AM ---A- . (...) -- C:\JavaRa.log [412]
O44 - LFC:[MD5.9C26D3FBEDAF383359F7F5550D92A556] - 6/5/2015 - 2:26:01 PM ---A- . (...) -- C:\WINDOWS\OverlayXP.ini [20]
O44 - LFC:[MD5.0860F429B1A0276EE75FAFAB05FC9CA7] - 6/6/2015 - 11:09:33 AM ---A- . (...) -- C:\WINDOWS\system32\newdll.dll [45056]
~ Files: 25 Legitimates Filtered in 02mn AMs
---\\ Export authorized application key (O47)
O47 - AAKE:Key Export SP - "C:\Program Files\SoulseekNS\slsk.exe" [Enabled] .(..) -- C:\Program Files\SoulseekNS\slsk.exe =>P2P.SoulSeek
O47 - AAKE:Key Export SP - "C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" [Enabled] .(.Alcohol Soft Development Team.) -- C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe
O47 - AAKE:Key Export SP - "C:\Program Files\IObit\Advanced SystemCare 7\RealTimeProtector.exe" [Enabled] .(..) -- C:\Program Files\IObit\Advanced SystemCare 7\RealTimeProtector.exe
~ Keys Export: 25 Legitimates Filtered in 00mn AMs
---\\ Trojan Driver Search Data (HKLM)(TDSD) (O52)
O52 - TDSD: \drivers.desc\"mciqtz32.dll"="mciqtz32.dll" . (...) -- C:\WINDOWS\system32\mciqtz32.dll
~ TDSD: 28 Legitimates Filtered in 00mn AMs
---\\ ShareTools MSconfig StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\Praetorian [Key] . (.ООО «ЯНДЕКС» - Защитник Яндекс.) -- c:\documents and settings\xxxx\local settings\application data\yandex\updater\praetorian.exe
O53 - SMSR:HKLM\...\startupreg\uTorrent [Key] . (.BitTorrent Inc. - µTorrent.) -- c:\documents and settings\xxxx\application data\utorrent\utorrent.exe =>P2P.BitTorrent
~ SMSR Keys: 18 Legitimates Filtered in 00mn AMs
---\\ Microsoft Windows Policies System (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
~ MWPS: 7 Legitimates Filtered in 00mn AMs
---\\ System Drivers List (SDL) (O58)
O58 - SDL:6/15/2010 - 10:32:04 AM ---A- . (.Analog Devices, Inc. - High Definition Audio Function Driver.) -- C:\WINDOWS\system32\Drivers\ADIHdAud.sys [339456]
O58 - SDL:2/12/2014 - 3:59:49 PM ---A- . (.RAVISENT Technologies Inc. - CineMaster C 1.2 WDM Main Driver.) -- C:\WINDOWS\system32\Drivers\cinemst2.sys [262528]
O58 - SDL:7/26/2011 - 4:26:44 PM ---A- . (.Devguru Co., Ltd - Device Error Recovery SDK(x86).) -- C:\WINDOWS\system32\Drivers\dgderdrv.sys [20032]
O58 - SDL:9/4/2013 - 10:22:02 AM ---A- . (.CHENGDU YIWO Tech Development Co., Ltd - Disk Backup Driver.) -- C:\WINDOWS\system32\Drivers\eubakup.sys [52040]
O58 - SDL:9/4/2013 - 10:22:02 AM ---A- . (...) -- C:\WINDOWS\system32\Drivers\EUBKMON.sys [40776]
O58 - SDL:9/4/2013 - 10:22:02 AM ---A- . (.CHENGDU YIWO Tech Development Co., Ltd - Disk Access Driver.) -- C:\WINDOWS\system32\Drivers\eudskacs.sys [14920]
O58 - SDL:9/4/2013 - 10:22:02 AM ---A- . (.CHENGDU YIWO Tech Development Co., Ltd - Disk Backup Image Preview Driver.) -- C:\WINDOWS\system32\Drivers\EuFdDisk.sys [185800]
O58 - SDL:6/16/2010 - 4:59:42 PM ---A- . (.Windows ® Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) -- C:\WINDOWS\system32\Drivers\hdaudbus.sys [138752]
O58 - SDL:8/29/2012 - 12:49:20 PM ---A- . (.MusicLab, Inc. - MusicLab Virtual MIDI Device.) -- C:\WINDOWS\system32\Drivers\mlkumidi.sys [41536]
O58 - SDL:4/14/2008 - 1:00:00 PM ---A- . (.Parallel Technologies, Inc. - Parallel Technologies DirectParallel IO Library.) -- C:\WINDOWS\system32\Drivers\ptilink.sys [17792]
O58 - SDL:10/28/2014 - 2:33:57 PM ---A- . (.Duplex Secure Ltd. - SCSI Pass Through Direct Host.) -- C:\WINDOWS\system32\Drivers\sptd.sys [320120]
O58 - SDL:7/20/2011 - 9:46:04 AM ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG USB Composite Device Driver (MSS Ver.3).) -- C:\WINDOWS\system32\Drivers\ssudbus.sys [77624]
O58 - SDL:7/20/2011 - 9:46:04 AM ---A- . (.DEVGURU Co., LTD.(www.devguru.co.kr) - SAMSUNG Android Modem Device Driver (MSS Ver.3).) -- C:\WINDOWS\system32\Drivers\ssudmdm.sys [181432]
O58 - SDL:10/24/2007 - 9:47:26 AM ---A- . (.SIA Syncrosoft - SynasUSB.sys.) -- C:\WINDOWS\system32\Drivers\synasUSB.sys [23288]
O58 - SDL:8/16/2006 - 8:24:00 AM ---A- . (.MIDIMAN - USB11LDR.) -- C:\WINDOWS\system32\Drivers\USB11LDR.SYS [13504]
O58 - SDL:6/10/2014 - 9:50:24 PM ---A- . (.Apple, Inc. - Apple Mobile Device USB Driver.) -- C:\WINDOWS\system32\Drivers\usbaapl.sys [45056]
O58 - SDL:6/27/2005 - 3:39:28 PM ---A- . (.VM - Video streaming and Capture Device Driver.) -- C:\WINDOWS\system32\Drivers\usbVM31b.sys [94445]
O58 - SDL:2/12/2014 - 3:59:49 PM ---A- . (.RAVISENT Technologies Inc. - CineMaster C WDM DVD Minidriver.) -- C:\WINDOWS\system32\Drivers\vdmindvd.sys [58112]
O58 - SDL:4/14/2008 - 1:00:00 PM ---A- . (...) -- C:\WINDOWS\system32\ansi.sys [9029]
O58 - SDL:10/7/2014 - 9:58:40 PM ---A- . (...) -- C:\WINDOWS\system32\audcon.sys [2892]
O58 - SDL:4/14/2008 - 1:00:00 PM ---A- . (...) -- C:\WINDOWS\system32\country.sys [27097]
O58 - SDL:4/14/2008 - 1:00:00 PM ---A- . (...) -- C:\WINDOWS\system32\himem.sys [4768]
O58 - SDL:4/14/2008 - 1:00:00 PM ---A- . (...) -- C:\WINDOWS\system32\key01.sys [42809]
O58 - SDL:4/14/2008 - 1:00:00 PM ---A- . (...) -- C:\WINDOWS\system32\keyboard.sys [42537]
O58 - SDL:4/14/2008 - 1:00:00 PM ---A- . (...) -- C:\WINDOWS\system32\ntdos.sys [27866]
O58 - SDL:4/14/2008 - 1:00:00 PM ---A- . (...) -- C:\WINDOWS\system32\ntdos404.sys [29146]
O58 - SDL:4/14/2008 - 1:00:00 PM ---A- . (...) -- C:\WINDOWS\system32\ntdos411.sys [29370]
O58 - SDL:4/14/2008 - 1:00:00 PM ---A- . (...) -- C:\WINDOWS\system32\ntdos412.sys [29274]
O58 - SDL:4/14/2008 - 1:00:00 PM ---A- . (...) -- C:\WINDOWS\system32\ntdos804.sys [29146]
O58 - SDL:4/14/2008 - 1:00:00 PM ---A- . (...) -- C:\WINDOWS\system32\ntio.sys [33840]
O58 - SDL:4/14/2008 - 1:00:00 PM ---A- . (...) -- C:\WINDOWS\system32\ntio404.sys [34560]
O58 - SDL:4/14/2008 - 1:00:00 PM ---A- . (...) -- C:\WINDOWS\system32\ntio411.sys [35648]
O58 - SDL:4/14/2008 - 1:00:00 PM ---A- . (...) -- C:\WINDOWS\system32\ntio412.sys [35424]
O58 - SDL:4/14/2008 - 1:00:00 PM ---A- . (...) -- C:\WINDOWS\system32\ntio804.sys [34560]
O58 - SDL:9/30/2013 - 3:26:46 PM ----- . (...) -- C:\WINDOWS\system32\pwdrvio.sys [15688]
O58 - SDL:9/30/2013 - 3:26:44 PM ----- . (...) -- C:\WINDOWS\system32\pwdspio.sys [10320]
~ Drivers: 67 Legitimates Filtered in 02mn AMs
---\\ List all tools cleaner (LATC) (O63)
O63 - Logiciel: ZHPDiag 2015 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn AMs
---\\ List all legacy services(LALS) (O64)
O64 - Services: CurCS - 2/26/1746 - C:\WINDOWS\system32\drivers\slsis.sys (amsint32) .(...) - LEGACY_AMSINT32
O64 - Services: CurCS - 1/8/2007 - C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe (MA_CMIDI_InstallerService) .(.No owner - MA_CMIDI USB MIDI Installer Service.) - LEGACY_MA_CMIDI_INSTALLERSERVICE
~ Legacy: 167 Legitimates Filtered in 00mn AMs
---\\ File Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 10 Legitimates Filtered in 00mn AMs
---\\ Start Menu Internet (SMI) (O68)
O68 - StartMenuInternet: <chrome.exe> <>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn AMs
---\\ Search Browser Infection (SBI) (O69)
O69 - SBI: SearchScopes [HKCU] Moikrug - (Люди на Моем Круге) - http://moikrug.ru
O69 - SBI: SearchScopes [HKCU] Yandex [DefaultScope] - (Яндекс) - http://yandex.ru
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - () - http://search.live.com
O69 - SBI: SearchScopes [HKCU] {8F7AB32B-C552-40BD-9D20-D28986BDDC81} - (Google) - http://www.google.com
~ Keys: Scanned in 00mn AMs
---\\ Search Particular Root Folder (SPRF) (O84)
[MD5.AB89B4683F962A630A9146134321EDEB] [SPRF][10/16/2000] (...) -- C:\Program Files\Fdos.com [7202]
[MD5.1FCA66697340F05A283344CA2FA6C357] [SPRF][10/25/2000] (...) -- C:\Program Files\Flex2K.exe [206848]
[MD5.10D45E2DC219F7558A35942BE9FF2406] [SPRF][5/19/2002] (...) -- C:\Program Files\FType2K.exe [180224]
[MD5.02D74363AF9D746D020AF99E922FF446] [SPRF][5/13/2002] (...) -- C:\Program Files\Remove.exe [131072]
[MD5.F18E0BD7FF53A17207649A34DA91EA2A] [SPRF][10/18/2000] (...) -- C:\Program Files\SetupUtl.exe [86528]
[MD5.F26BB0994D473245641B256E829CEC0B] [SPRF][11/5/2009] (.Softube - Softube: Tube Delay.) -- C:\Program Files\Tube Delay.dll [9535488]
~ Files: 6 Legitimates Filtered in 00mn AMs
---\\ Search CLSID Registry Key (O101)
[HKCR\CLSID\{30E7F2A0-EC4C-11ce-8865-00805F742EF6}] (SpeedDial) =>PUP.SpeedDial
~ BCK: 5687 Legitimates Filtered in 09mn AMs
---\\ General States of Services not Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Auto 1/5/2012 153448 | (AxAutoMntSrv) . (.Alcohol Soft Development Team.) - C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe
SS - | Demand 4/14/2008 224768 | (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\system32\dmadmin.exe
SS - | Auto 9/26/2014 116648 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 9/26/2014 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 9/26/2014 267760 | (gusvc) . (.Google.) - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Demand 7/8/2014 553288 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SS - | Disabled 4/14/2015 1871160 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
SS - | Auto 4/14/2015 1080120 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
SS - | Demand 6/20/2015 148080 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Auto 12/11/2014 315496 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe
SS - | Demand 2/19/2010 517096 | (SwitchBoard) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
SS - | Demand 2/17/2015 5222720 | (wxpSvc) . (.Moonware Studios.) - C:\Program Files\webcamXP5\wService.exe
SR - | Auto 10/25/2013 878368 | (AdvancedSystemCareService7) . (.IObit.) - C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe
SR - | Auto 6/12/2014 43336 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 10/26/2010 614400 | (Ati HotKey Poller) . (.ATI Technologies Inc..) - C:\WINDOWS\system32\Ati2evxx.exe
SR - | Auto 8/30/2011 390504 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Auto 10/25/2013 2151200 | (LiveUpdateSvc) . (.IObit.) - C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe
SR - | Auto 1/8/2007 94208 | (MA_CMIDI_InstallerService) . (...) - C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
SR - | Auto 11/9/2012 4595064 | (NIHardwareService) . (.Native Instruments GmbH.) - C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
SR - | Auto 11/9/2012 71280 | (nlsX86cc) . (.Nalpeiron Ltd..) - C:\WINDOWS\system32\nlssrv32.exe
~ Services: Scanned in 10mn AMs
---\\ List of CD/DVD Emulators (MBR Hook)
O58 - SDL:10/28/2014 - 2:33:57 PM ---A- . (.Duplex Secure Ltd. - SCSI Pass Through Direct Host.) -- C:\WINDOWS\system32\Drivers\sptd.sys [320120]
~ Emulateurs: Scanned in 10mn AMs
---\\ Scan Additionnel (O88)
Database Version : 13008 - (5/31/2015)
Clés trouvées (Keys found) : 13
Valeurs trouvées (Values found) : 1
Dossiers trouvés (Folders found) : 2
Fichiers trouvés (Files found) : 4
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Soulseek2] =>P2P.SoulSeek^
[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\uTorrent] =>P2P.BitTorrent^
[HKLM\Software\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}] =>Toolbar.Agent
[HKLM\Software\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}] =>PUP.Whitesmoke
[HKLM\Software\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}] =>PUP.Whitesmoke
[HKLM\Software\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}] =>PUP.Babylon
[HKLM\Software\Classes\protector_dll.protectorbho.1] =>PUP.BProtector
[HKLM\Software\Classes\protector_dll.protectorbho] =>PUP.BProtector
[HKLM\Software\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}] =>PUP.Babylon
[HKLM\Software\Classes\AppID\secman.DLL] =>PUP.Babylon
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{91397D20-1446-11D4-8AF4-0040CA1127B6}] =>Toolbar.YandexFastDial
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{91397D20-1446-11D4-8AF4-0040CA1127B6}] =>Toolbar.YandexFastDial
[HKLM\Software\Classes\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}] =>Toolbar.YandexFastDial
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:uTorrent =>P2P.BitTorrent^
C:\Program Files\SoulseekNS =>P2P.SoulSeek^
C:\Documents and Settings\All Users\Application Data\Soulseek =>P2P.SoulSeek^
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: Modified =>Hijacker.Application^
C:\Documents and Settings\XXXX\Application Data\uTorrent\uTorrent.exe =>P2P.BitTorrent^
[HKCU\Software\Soulseek2] =>P2P.SoulSeek^
[HKCR\CLSID\{30E7F2A0-EC4C-11ce-8865-00805F742EF6}] (SpeedDial) =>PUP.SpeedDial^
~ Additionnel Scan: 508804 Items scanned in 27mn AMs
---\\ Additional information about modules
~ http://nicolascoolma...anagement-iepm/ =>.Internet Explorer, Proxy Management (R5)
~ http://nicolascoolma...lorer-toolbars/ =>.Internet Explorer toolbars (O3)
~ http://nicolascoolma...ar-le-registre/ =>.Auto loading programs from Registry and folders (O4)
~ AMI: 3 Legitimates Filtered in 00mn AMs
---\\ Summary of the detections found on your workstation
http://www.nicolascoolman.fr/blog/ =>Hijacker.Application
http://nicolascoolma...2-pup-speeddial =>PUP.SpeedDial
http://www.nicolascoolman.fr/blog/ =>Toolbar.Agent
http://nicolascoolma.../pup-whitesmoke =>PUP.Whitesmoke
http://nicolascoolman.fr/pup-babylon =>PUP.Babylon
http://nicolascoolma.../pup-bprotector =>PUP.BProtector
http://www.nicolascoolman.fr/blog/ =>Toolbar.YandexFastDial
~ MSI: 7 link(s) detected in 00mn AMs
~ 1196 Legitimates filtered by white list
End of the scan (617 lines in 06mn AMs)(0.4)
Sign In
Create Account
