~ Report of ZHPDiag v2014.3.28.35 - Nicolas Coolman (28/03/2014) ~ Launched by CLIENT (28/03/2014 19:37:09) ~ Web site address : http://nicolascoolman.webs.com ~ Free support forums for disinfection : http://nicolascoolman.webs.com/apps/links/ ~ Translated by ~ Version State : ~ White List : Activate by program ~ Elevation of privilege : OK ~ User Account Control : Deactivate by program ---\\ Internet browsers MSIE: Internet Explorer v11.0.9600.16476 MFIE: Mozilla Firefox 28.0 (Defaut) ---\\ Windows product information ~ Langage: Anglais Windows 8.1 Pro, 64-bit (Build 9600) Windows Server License Manager Script : OK ~ ion : Windows(R) Operating System, VOLUME_KMSCLIENT channel Windows ID Activation : OK ~ Windows Partial Key : 9D6T9 Windows License : OK ~ Windows Remaining Initializations Number : 998 Software Protection Service (Protection logicielle) : OK Windows Automatic Updates : OK Windows Activation Technologies : OK ---\\ System protection software Malwarebytes Anti-Malware version 2.00.0.1000 Windows Defender W8 ---\\ System optimization software ---\\ Sharing software PeerToPeer ---\\ Surveillance software Adobe Flash Player 12 Plugin Adobe Reader 9.1 ---\\ Information on the system ~ Processor: Intel64 Family 6 Model 60 Stepping 3, GenuineIntel ~ Operating System: 64 Bits Boot mode: Normal (Normal boot) Total RAM: 12239 MB (79% free) System Restore: Activé (Enable) System drive C: has 1818 GB (97%) free of 1863 GB ---\\ Connection to the system mode ~ Computer Name: ADMIN ~ User Name: CLIENT ~ All Users Names: Jantrouve, HomeGroupUser$, Guest, CLIENT, Administrator, ~ Unselected Option: O45,O61,O62,O65,O66,O80,O82,O89 Logged in as Administrator ---\\ Environment variables ~ System Unit : C:\ ~ %AppZHP% : C:\Users\CLIENT\AppData\Roaming\ZHP\ ~ %AppData% : C:\Users\CLIENT\AppData\Roaming\ ~ %Desktop% : C:\Users\CLIENT\Desktop\ ~ %Favorites% : C:\Users\CLIENT\Favorites\ ~ %LocalAppData% : C:\Users\CLIENT\AppData\Local\ ~ %StartMenu% : C:\Users\CLIENT\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\\ Enumeration of the disk units C: Hard drive, Flash drive, Thumb drive (Free 1818 Go of 1863 Go) D: Floppy drive, Flash card reader, USB Key (Not Inserted) E: Floppy drive, Flash card reader, USB Key (Not Inserted) F: Floppy drive, Flash card reader, USB Key (Not Inserted) G: Floppy drive, Flash card reader, USB Key (Not Inserted) H: CD-ROM drive (Not Inserted) I: Hard drive, Flash drive, Thumb drive (Free 377 Go of 931 Go) ---\\ State of the Windows Security Center [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified ~ Security Center: 40 Legitimates Filtered in 00mn 00s ---\\ Search Generic System Files [MD5.63DC38C3E4564B2405D562855643ABA2] - (.Microsoft Corporation - Explorateur Windows.) (.14/12/2013 - 23:10:54.) -- C:\Windows\Explorer.exe [2328872] [MD5.48CFA7BE561A7BE144C29BB912055016] - (.Microsoft Corporation - Application de démarrage de Windows.) (.22/08/2013 - 04:58:29.) -- C:\Windows\System32\Wininit.exe [144384] [MD5.9B6678DB9C6A232C5A84D2FDFFF8B0E1] - (.Microsoft Corporation - Extensions Internet pour Win32.) (.14/12/2013 - 23:11:25.) -- C:\Windows\System32\wininet.dll [2334208] [MD5.7C94FDA3809015B8F2208D2E1C221F17] - (.Microsoft Corporation - Application d’ouverture de session Windows.) (.22/08/2013 - 04:55:08.) -- C:\Windows\System32\Winlogon.exe [564736] [MD5.2F18065618E39AA2E656EE737B71E791] - (.Microsoft Corporation - Bibliothèque de licences.) (.22/08/2013 - 05:39:40.) -- C:\Windows\System32\sppcomapi.dll [447488] [MD5.239268BAB58EAE9A3FF4E08334C00451] - (.Microsoft Corporation - Pilote de fonction connexe pour WinSock.) (.22/08/2013 - 08:25:35.) -- C:\Windows\system32\Drivers\AFD.sys [567296] [MD5.74B14192CF79A72F7536B27CB8814FBD] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.22/08/2013 - 07:43:41.) -- C:\Windows\system32\Drivers\atapi.sys [26464] [MD5.2FA6510E33F7DEFEC03658B74101A9B9] - (.Microsoft Corporation - CD-ROM File System Driver.) (.22/08/2013 - 06:40:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [88576] [MD5.C6796EA22B513E3457514D92DCDB1A3D] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.22/08/2013 - 03:46:35.) -- C:\Windows\system32\Drivers\Cdrom.sys [164352] [MD5.5DB26D7E0216D0BF364A81D3829AD7B9] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.22/08/2013 - 06:38:00.) -- C:\Windows\system32\Drivers\DfsC.sys [134656] [MD5.03909BDBFF0DCACCABF2B2D4ADEE44DC] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.22/08/2013 - 06:38:38.) -- C:\Windows\system32\Drivers\HDAudBus.sys [78336] [MD5.84CFC5EFA97D0C965EDE1D56F116A541] - (.Microsoft Corporation - Pilote de port i8042.) (.22/08/2013 - 06:39:15.) -- C:\Windows\system32\Drivers\i8042prt.sys [107520] [MD5.E23D32BAF152FBE35F18C6A2AB8EF271] - (.Microsoft Corporation - IP Network Address Translator.) (.29/09/2013 - 23:14:15.) -- C:\Windows\system32\Drivers\IpNat.sys [141824] [MD5.6129EDB793A4255B1E2FB41773AC9D9A] - (.Microsoft Corporation - Minirdr SMB Windows NT.) (.29/09/2013 - 23:14:11.) -- C:\Windows\system32\Drivers\MRxSmb.sys [404992] [MD5.0217532E19A748F0E5D569307363D5FD] - (.Microsoft Corporation - MBT Transport driver.) (.22/08/2013 - 06:37:02.) -- C:\Windows\system32\Drivers\netBT.sys [282624] [MD5.4412D565C0278C401575E11072C7DCE3] - (.Microsoft Corporation - Pilote du système de fichiers NT.) (.22/08/2013 - 08:25:41.) -- C:\Windows\system32\Drivers\ntfs.sys [2011488] [MD5.764B1121867B2D9B31C491668AC72B2B] - (.Microsoft Corporation - Pilote de port parallèle.) (.22/08/2013 - 06:40:02.) -- C:\Windows\system32\Drivers\Parport.sys [94208] [MD5.BBB6272B7F46C4640A8CDB8A70C3450F] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.22/08/2013 - 06:35:51.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [120832] [MD5.680C1DAE268B6FB67FA21B389A8B79EF] - (.Microsoft Corporation - Redirecteur de périphérique de Microsoft RDP.) (.29/09/2013 - 22:54:34.) -- C:\Windows\system32\Drivers\rdpdr.sys [195584] [MD5.FFF28F9F6823EB1756C60F1649560BBF] - (.Microsoft Corporation - TDI Translation Driver.) (.22/08/2013 - 08:25:35.) -- C:\Windows\system32\Drivers\tdx.sys [107520] [MD5.9F9CE33B50611A1C61A46B8911E0B30B] - (.Microsoft Corporation - Pilote de cliché instantané du volume.) (.22/08/2013 - 07:39:15.) -- C:\Windows\system32\Drivers\volsnap.sys [312160] ~ Generic Processes: Scanned in 00mn 00s ---\\ Hidden files state (Hidden/Total) ~ Mes Favoris (My Favorites) : 1/3 ~ Mes Documents (My Documents) : 2/5 ~ Mon Bureau (My Desktop) : 1/7 ~ Menu demarrer (Programs) : 1/21 ~ Hidden Files: Scanned in 00mn 00s ---\\ Process running [MD5.EE316C8D7C1B99412F2C8F1C64268182] - (.NVIDIA Corporation - NVIDIA GeForce Experience Backend.) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144] [PID.3464] [MD5.0FE0EDF01CEA3BEB2E65A904BB87525E] - (.Adobe Systems Inc. - AcroTray.) -- C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe [640376] [PID.4412] [MD5.80227D3008348055D85BFAB5FF001586] - (.Intel Corporation - IAStorIcon.) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286192] [PID.4624] [MD5.8E556A72D54F7E3B7844AB9217F02DD7] - (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [275568] [PID.3332] [MD5.B978AE0D4FB1AFDFDEDBF45A2B3B6183] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8178176] [PID.3388] ~ Processes Running: Scanned in 00mn 00s ---\\ Mozilla Firefox,Plugins,Start,Search,Extensions (P2,M0,M1,M2,M3) C:\Users\CLIENT\AppData\Roaming\Mozilla\Firefox\Profiles\qa5q644l.default\prefs.js M0 - MFSP: prefs.js [CLIENT - qa5q644l.default] http://www.default-search.net?sid=476&aid=114&itype=n&ver=11471&tm=300&src=hmp ~ Firefox Browser: 3 Legitimates Filtered in 00mn 00s ---\\ Internet Explorer, Proxy Management (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\\ Line Analysis F0, F1, F2, F3 - IniFiles, Auto loading programs F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe ~ Keys: Scanned in 00mn 00s ---\\ Hosts file redirection (O1) ~ Le fichier hosts est sain (The hosts file is clean). ~ Hosts File: Scanned in 00mn 00s ~ Nombre de lignes (Lines number): 21 ---\\ Other User Links (O4) O4 - GS\Desktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O4 - GS\Program [Public]: Desktop.lnk - Orphan key O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O4 - GS\TaskBar [Jantrouve]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O4 - GS\Program [Jantrouve]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\SendTo [Jantrouve]: Bluetooth File Transfer.LNK . (.Microsoft Corporation - No Comment.) -- C:\Windows\System32\fsquirt.exe O4 - GS\TaskBar [CLIENT]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O4 - GS\Program [CLIENT]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O4 - GS\SendTo [CLIENT]: Bluetooth File Transfer.LNK . (.Microsoft Corporation - No Comment.) -- C:\Windows\System32\fsquirt.exe ~ Global Startup: 45 Legitimates Filtered in 00mn 00s ---\\ Auto loading programs from Registry and folders (O4) O4 - HKLM\..\Run: [IAStorIcon] . (.Intel Corporation - Delayed launcher.) -- C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe O4 - HKLM\..\Run: [RTHDVCPL] . (.Realtek Semiconductor - Gestionnaire audio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe =>.Realtek Semiconductor Corp O4 - HKLM\..\Run: [RtHDVBg] . (.Realtek Semiconductor - HD Audio Background Process.) -- C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe O4 - HKLM\..\Run: [NvBackend] . (.NVIDIA Corporation - NVIDIA GeForce Experience Backend.) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe O4 - HKCU\..\Run: [DellSystemDetect] . (.Dell - Dell System Detect.) -- C:\Users\CLIENT\AppData\Local\Apps\2.0\61HT8WC3.0P7\ZAJA3TE4.O8Z\dell..tion_0f612f649c4a10af_0005.0006_f9e15713f5aac8ac\DellSystemDetect.exe O4 - HKLM\..\Wow6432Node\Run: [GrooveMonitor] . (.Microsoft Corporation - GrooveMonitor Utility.) -- C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe O4 - HKLM\..\Wow6432Node\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe O4 - HKLM\..\Wow6432Node\Run: [AdobeCS4ServiceManager] . (.Adobe Systems Incorporated - Adobe CS4 Service Manager.) -- C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe O4 - HKLM\..\Wow6432Node\Run: [Adobe Acrobat Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe O4 - HKLM\..\Wow6432Node\Run: [Acrobat Assistant 8.0] . (.Adobe Systems Inc. - AcroTray.) -- C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe O4 - HKLM\..\Wow6432Node\Run: [Adobe_ID0ENQBO] . (.Adobe Systems Incorporated - Adobe Version Cue CS4.) -- C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4Tray.exe =>.Adobe Systems Incorporated O4 - HKUS\S-1-5-21-3706585746-2803259063-1415726013-1001\..\Run: [DellSystemDetect] . (.Dell - Dell System Detect.) -- C:\Users\CLIENT\AppData\Local\Apps\2.0\61HT8WC3.0P7\ZAJA3TE4.O8Z\dell..tion_0f612f649c4a10af_0005.0006_f9e15713f5aac8ac\DellSystemDetect.exe ~ Application: Scanned in 00mn 00s ---\\ Site in Trusted Zone (O15) O15 - Trusted Zone: [HKCU\...\Domains] *.dell.com ~ IE Zone Confiance: Scanned in 00mn 00s ---\\ Lop.com/Domain Hijackers (O17) O17 - HKLM\System\CCS\Services\Tcpip\..\{5C757D6D-D338-4F1A-AD8A-829AD4CCB873}: DhcpNameServer = 192.168.15.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{5C757D6D-D338-4F1A-AD8A-829AD4CCB873}: DhcpNameServer = 192.168.15.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.15.1 ~ Domain: Scanned in 00mn 00s ---\\ Extra protocols (O18) O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visionneuse HTML Microsoft (R).) -- C:\Windows\System32\mshtml.dll =>.Microsoft Corporation O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.dll =>.Microsoft Corporation ~ Protocole Additionnel: Scanned in 00mn 00s ---\\ HKCU & HKLM Software Keys [HKCU\Software\Linkey] [HKLM\Software\Wow6432Node\SystemK] ~ Key Software: 221 Legitimates Filtered in 00mn 00s ---\\ Contents of the Common Files folders (O43) O43 - CFD: 28/03/2014 - 15:45:10 - [0,174] ----D C:\Program Files (x86)\Linkey O43 - CFD: 28/03/2014 - 15:35:44 - [3,104] ----D C:\Program Files (x86)\Settings Manager ~ Program Folder: 101 Legitimates Filtered in 00mn 00s ---\\ Last modified or created files under Windows and System32 (O44) O44 - LFC:[MD5.DAA6AAD525D12F8985695B882301336F] - 24/03/2014 - 14:56:26 ---A- . (...) -- C:\Windows\win.ini [167] O44 - LFC:[MD5.F7DE9002BE1ED5D9F6B45F0057DE2A8C] - 25/03/2014 - 11:47:48 ---A- . (...) -- C:\Windows\wininit.ini [110] O44 - LFC:[MD5.FB3E116968B7A1642BC7B22ACC68D29D] - 25/03/2014 - 12:55:40 ---A- . (...) -- C:\Windows\System32\nvcoproc.bin [3310693] O44 - LFC:[MD5.D46D074B8BF3F42AB0820C49AD760823] - 25/03/2014 - 14:44:28 ---A- . (...) -- C:\AVScanner.ini [426] O44 - LFC:[MD5.9A34F0C1FD0DA039554B577C82019441] - 26/03/2014 - 15:29:56 ---A- . (...) -- C:\Windows\System32\Drivers\rtwavesEFX.dat [30273] O44 - LFC:[MD5.D5780215BD17CC411C54F5D4BC6CD1F1] - 26/03/2014 - 15:29:56 ---A- . (...) -- C:\Windows\System32\Drivers\rtwavesMFX.dat [10643] O44 - LFC:[MD5.4B29094391996376B369CFD8D49CE434] - 26/03/2014 - 17:32:36 ---A- . (...) -- C:\Windows\System32\Drivers\RTAIODAT.DAT [626293] O44 - LFC:[MD5.D364ED2E8CA42D79EDFE8B3BB878E22D] - 26/03/2014 - 17:32:36 ---A- . (.Waves Audio - MaxxAudioVienna2.) -- C:\Windows\System32\MaxxAudioVienna264.dll [194816] O44 - LFC:[MD5.709041B0125EC06F351BE7F6BC5DA1F0] - 26/03/2014 - 17:32:37 ---A- . (...) -- C:\Windows\System32\Drivers\rtvienna.dat [5694760] O44 - LFC:[MD5.FD6CC699BD9BE090D6E96C06CA960AE4] - 26/03/2014 - 17:32:53 ---A- . (...) -- C:\Windows\System32\Drivers\rtwavesmapro.dat [463760] O44 - LFC:[MD5.FE3422EDDA0E2580DF8D0F8B18DA8552] - 26/03/2014 - 17:32:53 ---A- . (...) -- C:\Windows\System32\Drivers\rtwavesmaprocap.dat [19501] O44 - LFC:[MD5.F2ED8D7665256DB2CD113F90C65D835E] - 26/03/2014 - 17:32:53 ---A- . (...) -- C:\Windows\System32\Drivers\rtwavesskdy.dat [849522] O44 - LFC:[MD5.1CF071D5E92F2F23804C88154B7C0D96] - 27/03/2014 - 13:33:52 ---A- . (...) -- C:\WinUpdateFix.txt [1209] O44 - LFC:[MD5.33F8C0E6D73C7177B4EA560191DB6C2D] - 28/03/2014 - 13:38:16 ---A- . (...) -- C:\Windows\System32\prfc0416.dat [159358] O44 - LFC:[MD5.B636BCBAD8AE56549F4E249D774720FB] - 28/03/2014 - 13:38:16 ---A- . (...) -- C:\Windows\System32\prfh0416.dat [785582] ~ Files: 123 Legitimates Filtered in 00mn 00s ---\\ Local Security Authority-LSA Deny (O48) ~ LSA: 3 Legitimates Filtered in 00mn 00s ---\\ Safe Boot Control (O49) O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\hitmanpro37.sys . (...) -- C:\Windows\System32\Drivers\hitmanpro37.sys (.not file.) O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\hitmanpro37.sys . (...) -- C:\Windows\System32\Drivers\hitmanpro37.sys (.not file.) ~ CSB: 19 Legitimates Filtered in 00mn 00s ---\\ Image File Execution Options (IFEO) (O50) O50 - IFEO:Image File Execution Options - bpsvc.exe - tasklist.exe O50 - IFEO:Image File Execution Options - stinst32.exe - tasklist.exe O50 - IFEO:Image File Execution Options - stinst64.exe - tasklist.exe ~ IFEO: Scanned in 00mn 00s ---\\ Microsoft Windows Policies System (MWPS) (O55) O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 ~ MWPS: 17 Legitimates Filtered in 00mn 00s ---\\ Microsoft Windows Policies Explorer (MWPE) (O56) O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1 ~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s ---\\ System Drivers List (SDL) (O58) O58 - SDL:[MD5.C1ABB0F7E3BEA48A0417BDF6FF14AB21] - 12/08/2013 - 18:25:46 ---A- . (.Windows (R) Win 7 DDK provider - BCM Function 2 Device Driver.) -- C:\Windows\System32\Drivers\bcmfn2.sys [17624] O58 - SDL:[MD5.366DEA74BBA65B362BCCFC6FC2ADFD8B] - 22/08/2013 - 07:43:32 ---A- . (.Promise Technology, Inc. - Promise SuperTrak EX Series Driver for Windows x64.) -- C:\Windows\System32\Drivers\stexstor.sys [31072] O58 - SDL:[MD5.3C32FF010F869BC184DF71290477384E] - 12/02/2014 - 11:09:00 ---A- . (.The OpenVPN Project - TAP-Windows Virtual Network Driver.) -- C:\Windows\System32\Drivers\tap0901.sys [40664] ~ Drivers: 17 Legitimates Filtered in 00mn 00s ---\\ List all tools cleaner (LATC) (O63) O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman ~ ADS: Scanned in 00mn 00s ---\\ Start Menu Internet (SMI) (O68) O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\\ Search Browser Infection (SBI) (O69) O69 - SBI: prefs.js [CLIENT - qa5q644l.default] user_pref("weboftrust.search.ask.display", "Ask.com Web Search"); ~ Keys: Scanned in 00mn 00s ---\\ Search Particular Root Folder (SPRF) (O84) [MD5.4C601D281C0E18A57425C6C81FDCAE9D] [SPRF][02/11/2008] (...) -- C:\Users\CLIENT\Desktop\Adobe Master Collection CS4 Keygenerator.exe [94208] [MD5.DF06DC5837316EA78746E3F790A950ED] [SPRF][28/03/2014] (...) -- C:\Users\CLIENT\Desktop\adwcleaner.exe [1950720] ~ Files: 2 Legitimates Filtered in 00mn 00s ---\\ General States of Services not Microsoft (EGS) (SR=Running, SS=Stopped) SS - | Demand 15/08/2008 284016 | (Adobe Version Cue CS4) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe =>.Adobe Systems Incorporated SS - | Demand 25/03/2014 257928 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe SS - | Demand 25/03/2014 655624 | (FLEXnet Licensing Service) . (.Acresso Software Inc..) - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe SS - | Demand 25/03/2014 1038088 | (FLEXnet Licensing Service 64) . (.Acresso Software Inc..) - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe SS - | Demand 10/12/2012 803872 | (Intel(R) Capability Licensing Service TCP IP Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe SS - | Demand 15/03/2014 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe SS - | Auto 22/08/2013 37768 | C:\Windows\system32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 17/11/2009 98208 | (AERTFilters) . (.Andrea Electronics Corporation.) - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe SR - | Auto 29/08/2012 208384 | (AtherosSvc) . (.Atheros Commnucations.) - C:\Windows\System32\AdminService.exe SR - | Auto 28/03/2014 127752 | (HitmanProScheduler) . (.SurfRight B.V..) - C:\Program Files\HitmanPro\hmpsched.exe SR - | Auto 06/02/2013 15344 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe SR - | Auto 10/12/2012 732160 | (Intel(R) Capability Licensing Service Interface) . (.Intel(R) Corporation.) - C:\Program Files\Intel\iCLS Client\HeciServer.exe SR - | Auto 31/01/2013 129336 | (Intel(R) ME Service) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe SR - | Auto 31/01/2013 167736 | (jhi_service) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe SR - | Auto 31/01/2013 364856 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe SR - | Auto 20/01/2014 1593632 | (NvNetworkService) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe SR - | Auto 20/01/2014 16939296 | (NvStreamSvc) . (.NVIDIA Corporation.) - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe SR - | Auto 09/08/2013 920864 | (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\system32\nvvsvc.exe SR - | Auto 18/06/2013 246488 | (RtkAudioService) . (.Realtek Semiconductor.) - C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe SR - | Auto 09/08/2013 414496 | (Stereo Service) . (.NVIDIA Corporation.) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe SR - | Demand 10/07/1658 0 | (WdNisSvc) . (...) - C:\Program Files (x86)\Windows Defender\NisSrv.exe SR - | Auto 10/07/1658 0 | (WinDefend) . (...) - C:\Program Files (x86)\Windows Defender\MsMpEng.exe SR - | Auto 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation ~ Services: Scanned in 00mn 01s ---\\ Scan Additionnel (O88) Database Version : 13031 - (28/03/2014) Clés trouvées (Keys found) : 0 Valeurs trouvées (Values found) : 0 Dossiers trouvés (Folders found) : 0 Fichiers trouvés (Files found) : 0 ~ Additionnel Scan: 374989 Items scanned in 00mn 08s ~ 943 Legitimates filtered by white list End of the scan (355 lines in 00mn 16s)(0)