~ ZHPCleaner v2015.5.5.213 by Nicolas Coolman (06/05/2015) ~ Run by rouvroy (Administrator) (06/05/2015 11:03:49) ~ Forum : http://forum.nicolascoolman.fr ~ Facebook : https://www.facebook.com/nicolascoolman1 ~ State version : Version OK ~ Type : Scanner ~ Report : C:\Users\rouvroy\Desktop\ZHPCleaner.txt ~ Quarantine : C:\Users\rouvroy\AppData\Roaming\ZHP\ZHPCleaner_Quarantine.txt ~ UAC : Deactivate ~ Boot Mode : Normal (Normal boot) ~ Windows 7, 64-bit Service Pack 1 (Build 7601) ---\\ Service. (2) [S] TROUVÉ : TSDefenseBt (Adware.TencentAddressBar) [S] TROUVÉ : TSSysKit (Adware.TencentAddressBar) ---\\ Navigateur internet. (3) TROUVÉ fichier: C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\npQMExtensionsMozilla.dll [Tencent Technology (Shenzhen) Company Limited - QQPCMgr Mozilla Extenstion](Adware.TencentAddressBar) [757D320CED91219BE8ABE68D6B4C8CBB] TROUVÉ IE Params: HKLM64\SOFTWARE\Microsoft\Internet Explorer\MAIN\\Start Page [hxxp://www.oursurfing.com/?type=hp&ts=1430236889&from=amt&uid=WDCXWD6400AAKS-07A[...]] (Hijacker.OurSurfing) TROUVÉ fichier: C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\TSWebMon64.dat [Tencent - ????-?????](Adware.TencentAddressBar) [18566675ECC9D6F030346FB950504CF5] ---\\ Fichier hôte. (1) ~ Le fichier hôte est légitime. (21) ---\\ Tâche planifiée. (0) ~ Aucun élément malicieux trouvé. ---\\ Explorateur ( Dossiers, Fichiers ). (44) TROUVÉ fichier: C:\Users\rouvroy\AppData\Roaming\inst.exe (Adware.Pirrit) [16E53BFC96CE14021C0E07EB1C198478] TROUVÉ fichier: C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\QMUdisk64.sys [Tencent - QMUdiskKernel](Adware.TencentAddressBar) [BEF6127F4CA8B1144BD1D2164A175315] TROUVÉ fichier: C:\Windows\system32\Drivers\TAOAccelerator64.sys [Tencent - ????-TAO????????](Adware.TencentAddressBar) [] TROUVÉ fichier: C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\TS888x64.sys [Tencent - Tencent TS888 (??????????)](Adware.TencentAddressBar) [DA947B9CAE18C14C497D01417E242FBE] TROUVÉ fichier: C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\TSDefenseBT64.sys [Tencent - Tencent TSDefense Boot (??????????)](Adware.TencentAddressBar) [6416EFF7B5B704469B3B7AFB6665E71F] TROUVÉ fichier: C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\QQSysMonX64.sys [???? - ????-????](Adware.TencentAddressBar) [121012E27426F89D8A25D89004FBC49D] TROUVÉ fichier: C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\tscpm64.sys [???? - ????-????](Adware.TencentAddressBar) [37BD419B17C411B0521A71F3FADDEB64] TROUVÉ fichier: C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\TSSysKit64.sys [???? - ????-????](Adware.TencentAddressBar) [7D14649978DFC918C420CCDF6D191E51] TROUVÉ fichier: C:\Users\rouvroy\AppData\Roaming\inst.exe (Adware.GenericTask) [16E53BFC96CE14021C0E07EB1C198478] TROUVÉ dossier: C:\Program Files (x86)\Tencent\QQPCMgr (Adware.TencentAddressBar) TROUVÉ dossier: C:\Program Files (x86)\Tencent (Adware.TencentAddressBar) TROUVÉ dossier: C:\Program Files (x86)\Common Files\Tencent\QQDownload (Adware.TencentAddressBar) TROUVÉ dossier: C:\Program Files (x86)\Common Files\Tencent (Adware.TencentAddressBar) TROUVÉ dossier: C:\ProgramData\Tencent\Desktop (Adware.TencentAddressBar) TROUVÉ dossier: C:\ProgramData\Tencent\QQDownload (Adware.TencentAddressBar) TROUVÉ dossier: C:\ProgramData\Tencent\QQPCMgr (Adware.TencentAddressBar) TROUVÉ dossier: C:\ProgramData\Tencent\TSVulFw (Adware.TencentAddressBar) TROUVÉ dossier: C:\ProgramData\Tencent\TSVulFw_Cache (Adware.TencentAddressBar) TROUVÉ dossier: C:\ProgramData\Tencent\TXPltSafe (Adware.TencentAddressBar) TROUVÉ dossier: C:\ProgramData\Tencent\WechatBackup (Adware.TencentAddressBar) TROUVÉ dossier: C:\ProgramData\Tencent (Adware.TencentAddressBar) TROUVÉ dossier: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent\DeskUpdate (Adware.TencentAddressBar) TROUVÉ dossier: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent\Logs (Adware.TencentAddressBar) TROUVÉ dossier: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent\QQDownload (Adware.TencentAddressBar) TROUVÉ dossier: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent\QQPCMgr (Adware.TencentAddressBar) TROUVÉ dossier: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent\Tencentdl (Adware.TencentAddressBar) TROUVÉ dossier: C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Tencent (Adware.TencentAddressBar) TROUVÉ fichier: C:\Users\rouvroy\AppData\Roaming\GoodGameEmpire\td.ico (Adware.GoodGameEmpire) [8A3309D6CAE317950BC088F88447A881] TROUVÉ dossier: C:\Users\rouvroy\AppData\Roaming\Tencent\DeskUpdate (Adware.TencentAddressBar) TROUVÉ dossier: C:\Users\rouvroy\AppData\Roaming\Tencent\Logs (Adware.TencentAddressBar) TROUVÉ dossier: C:\Users\rouvroy\AppData\Roaming\Tencent\QMAndroidServer (Adware.TencentAddressBar) TROUVÉ dossier: C:\Users\rouvroy\AppData\Roaming\Tencent\QQDownload (Adware.TencentAddressBar) TROUVÉ dossier: C:\Users\rouvroy\AppData\Roaming\Tencent\QQPCMgr (Adware.TencentAddressBar) TROUVÉ dossier: C:\Users\rouvroy\AppData\Roaming\Tencent\Tencentdl (Adware.TencentAddressBar) TROUVÉ dossier: C:\Users\rouvroy\AppData\Roaming\Tencent\TXSSO (Adware.TencentAddressBar) TROUVÉ dossier: C:\Users\rouvroy\AppData\Roaming\GoodGameEmpire (Adware.GoodGameEmpire) TROUVÉ dossier: C:\Users\rouvroy\AppData\Roaming\Tencent (Adware.TencentAddressBar) TROUVÉ dossier: C:\Users\rouvroy\AppData\Local\Temp\Tencent\QQPCMgr (Adware.TencentAddressBar) TROUVÉ dossier: C:\Users\rouvroy\AppData\Local\Temp\Tencent (Adware.TencentAddressBar) TROUVÉ fichier: C:\Windows\SysWOW64\Drivers\TS888x64.sys [Tencent - Tencent TS888 (??????????)](Adware.TencentAddressBar) [DA947B9CAE18C14C497D01417E242FBE] TROUVÉ fichier: C:\ProgramData\Tencent\QQPCMgr\Quarantine\QMQuarantine.exe [Tencent - ????-????](Adware.TencentAddressBar) [C9F42E4DCDE6ECF0BD7073F4F746F5D1] TROUVÉ fichier: C:\ProgramData\Tencent\QQPCMgr\Quarantine\QMCommon.dll [Tencent - ????-???](Adware.TencentAddressBar) [9BC4D791A104B2A0623FDB9F4D7D4ED4] TROUVÉ fichier: C:\Users\rouvroy\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\GoodGameEmpire.lnk (Adware.GoodGameEmpire) [BEFD2587E67F955FCA32050FC82D8987] TROUVÉ dossier: C:\Users\rouvroy\AppData\Local\{DA398EEC-E400-4163-895F-221834CB3CCA} (Empty) ---\\ Base de Registres ( Clés, Valeurs, Données ). (43) TROUVÉ clé: [X64] HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@qq.com/QQPCMgr [QQPCMgr Detector] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B} [TSWebMon] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\Software\Classes\CLSID\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B} [?????????] (Adware.TencentAddressBar) TROUVÉ clé: HKLM\SYSTEM\CurrentControlSet\Services\QMUdisk [C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\QMUdisk64.sys] (Adware.TencentAddressBar) TROUVÉ clé: HKLM\SYSTEM\CurrentControlSet\Services\TAOAccelerator [C:\Windows\system32\Drivers\TAOAccelerator64.sys] (Adware.TencentAddressBar) TROUVÉ clé: HKLM\SYSTEM\CurrentControlSet\Services\TS888x64 [C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\TS888x64.sys] (Adware.TencentAddressBar) TROUVÉ clé: HKLM\SYSTEM\CurrentControlSet\Services\TSDefenseBt [C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\TSDefenseBT64.sys] (Adware.TencentAddressBar) TROUVÉ clé: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110211181110} [] (Adware.CrossRider) TROUVÉ clé: [X64] HKLM\SYSTEM\CurrentControlSet\Services\esgiguard [C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys (Not File)] (Crapware.SpyHunter) TROUVÉ clé: [X64] HKLM\SYSTEM\CurrentControlSet\Services\QMUdisk [C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\QMUdisk64.sys (Not File)] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SYSTEM\CurrentControlSet\Services\QQPCRTP ["C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\QQPCRTP.exe" -r (Not File)] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SYSTEM\CurrentControlSet\Services\QQSysMonX64 [C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\QQSysMonX64.sys (Not File)] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SYSTEM\CurrentControlSet\Services\TAOFrame ["C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\TAOFrame.exe" (Not File)] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SYSTEM\CurrentControlSet\Services\TS888x64 [C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\TS888x64.sys (Not File)] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SYSTEM\CurrentControlSet\Services\TSCPM [C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\tscpm64.sys (Not File)] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SYSTEM\CurrentControlSet\Services\TSDefenseBt [C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\TSDefenseBT64.sys (Not File)] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SYSTEM\CurrentControlSet\Services\TSSysKit [C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\TSSysKit64.sys (Not File)] (Adware.TencentAddressBar) TROUVÉ valeur: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\\HKLM64\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\\ QQPCTray ["C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\QQPCTray.exe" /regrun] (Adware.TencentAddressBar) TROUVÉ clé: HKEY_USERS\S-1-5-21-217880140-3183177948-3291838854-1001\Software\Tencent [] (Adware.TencentAddressBar) TROUVÉ clé: HKCU\Software\Tencent [] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SOFTWARE\Classes\Applications\iLividSetup-r197-n-bc (1).exe [] (Adware.Bandoo) TROUVÉ clé: [X64] HKLM\SOFTWARE\Classes\Applications\iLividSetup-r197-n-bc.exe [] (Adware.Bandoo) TROUVÉ clé: [X64] HKLM\SOFTWARE\Classes\Applications\iLividSetup-r338-n-bf.exe [] (Adware.Bandoo) TROUVÉ clé: [X64] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Registry Helper Service [] (PUP.RegistryHelper) TROUVÉ clé: [X64] HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\mbot_be_41 [] (Adware.CrossRider) TROUVÉ clé: [X64] HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\mbot_be_85 [] (Adware.CrossRider) TROUVÉ clé: [X64] HKLM\SOFTWARE\Wow6432Node\FFPluginHp [] (PUP.SweetSearch) TROUVÉ clé: [X64] HKLM\SOFTWARE\Wow6432Node\Tencent [] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{16EE6530-8649-4F42-A9E4-F6A3295AF975} [C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CE181DDB-468E-450F-9D2F-7F6B67766588} [C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar (Not File)] (PUP.Datamngr) TROUVÉ clé: [X64] HKLM\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}\InprocServer32 [C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\QMContextScan64.dll] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SOFTWARE\Classes\CLSID\{754DF2CE-51E8-4895-B53C-6381418B84AE}\InprocServer32 [C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\plugins\FileSmash\QMSoftExt64.dll] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SOFTWARE\Classes\CLSID\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}\InprocServer32 [C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\TSWebMon64.dat] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SOFTWARE\Classes\CLSID\{B7667919-3765-4815-A66D-98A09BE662D6}\InprocServer32 [C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\QMGCShellExt64.dll] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SOFTWARE\Classes\CLSID\{CBDECEF7-7A29-4cbf-A009-2673D82C7BF9}\InprocServer32 [C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\QMContextUninstall64.dll] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SOFTWARE\Classes\CLSID\{D4801E96-E7A1-45F6-B124-7A36DFB40B81}\InprocServer32 [C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\QMContextUninstall64.dll] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SOFTWARE\Classes\CLSID\{E52EB753-1F56-4DF7-BE53-2C314AC5F8A1}\InprocServer32 [C:\Program Files (x86)\Tencent\QQPCMgr\10.8.16208.227\QMContextScan64.dll] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E} [QMContextScanMenu Class] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SOFTWARE\Classes\CLSID\{754DF2CE-51E8-4895-B53C-6381418B84AE} [QQ Master Extention] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SOFTWARE\Classes\CLSID\{B7667919-3765-4815-A66D-98A09BE662D6} [PCMgr Garbage Cleaner ShellExtension] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SOFTWARE\Classes\CLSID\{CBDECEF7-7A29-4cbf-A009-2673D82C7BF9} [QMContextUninstallMenu Class] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SOFTWARE\Classes\CLSID\{D4801E96-E7A1-45F6-B124-7A36DFB40B81} [PSFactoryBuffer] (Adware.TencentAddressBar) TROUVÉ clé: [X64] HKLM\SOFTWARE\Classes\CLSID\{E52EB753-1F56-4DF7-BE53-2C314AC5F8A1} [PSFactoryBuffer] (Adware.TencentAddressBar) ---\\ Bilan de la réparation ~ Aucune réparation effectuée. ~ Ce navigateur est absent (Opera Software) ---\\ Statistiques ~ Items scannés : 68901 ~ Items trouvés : 152 ~ Items annulés : 0 ~ Items réparés : 0 End of clean at 11:13:06 =================== ZHPCleaner-[S]-06052015-11_13_06.txt