cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

~ Report of ZHPDiag v2015.5.25.52 - Nicolas Coolman (25/05/2015)
~ Launched by وسام (30/05/2015 18:48:39)
~ Facebook : https://www.facebook.com/nicolascoolman1
~ Web forum address : http://forum.nicolascoolman.fr
~ Translated by
~ Version State : New version available
~ White List : Activate by program
~ Elevation of privilege : OK
~ User Account Control : Activate by user


---\\ Internet browsers
MSIE: Internet Explorer v8.0.7600.16385
MFIE: Mozilla Firefox 30.0 (Defaut)
GCIE: Google Chrome v43.0.2357.81

---\\ Windows product information
~ Langage: Anglais
Windows Server License Manager Script : OK
~ Windows Operating System - Windows(R) 7, OEM_SLP channel
System Locked Preinstallation (OEM_SLP) : OK
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK
Windows 7 Ultimate, 32-bit (Build 7600)

---\\ System protection software
Avira Free Antivirus v14.0.3.350
Windows Defender W7 (Deactivate)

---\\ System optimization software

---\\ Sharing software PeerToPeer

---\\ Surveillance software
Adobe Flash Player 17 ActiveX

---\\ Information on the system
~ Processor: x86 Family 6 Model 15 Stepping 13, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 2038 MB (40% free)
System Restore: Activé (Enable)
System drive C: has 62 GB (79%) free of 78 GB

---\\ Connection to the system mode
~ Computer Name: وسام-PC
~ User Name: وسام
~ All Users Names: وسام, Guest, Administrator,
~ Unselected Option: None
Logged in as Administrator

---\\ Environment variables
~ System Unit : C:\
~ %AppZHP% : C:\Users\وسام\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\وسام\AppData\Roaming\
~ %Desktop% : C:\Users\وسام\Desktop\
~ %Favorites% : C:\Users\وسام\Favorites\
~ %LocalAppData% : C:\Users\وسام\AppData\Local\
~ %StartMenu% : C:\Users\وسام\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumeration of the disk units
C: Hard drive, Flash drive, Thumb drive (Free 62 Go of 78 Go)
D: Hard drive, Flash drive, Thumb drive (Free 47 Go of 71 Go)
E: CD-ROM drive (Not Inserted)



---\\ State of the Windows Security Center
~ Security Center: 38 Legitimates Filtered in 00mn 00s



---\\ Search Generic System Files
[MD5.2626FC9755BE22F805D3CFA0CE3EE727] - (.Microsoft Corporation - مستكشف Windows.) (.01/02/2010 - 16:59:29.) -- C:\Windows\Explorer.exe [2614272]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - ‎‎تطبيق بدء تشغيل Windows.) (.14/07/2009 - 01:14:45.) -- C:\Windows\System32\Wininit.exe [96256]
[MD5.F1C359CE656BD76F90E0E6C4BC04A4BE] - (.Microsoft Corporation - ملحقات إنترنت لـ Win32.) (.01/02/2010 - 16:59:40.) -- C:\Windows\System32\wininet.dll [977920]
[MD5.37CDB7E72EB66BA85A87CBE37E7F03FD] - (.Microsoft Corporation - تطبيق تسجيل دخول Windows.) (.01/02/2010 - 16:59:29.) -- C:\Windows\System32\Winlogon.exe [285696]
[MD5.58C94EAE54BF0C5E2B80B2E5E7744D4C] - (.Microsoft Corporation - مكتبة تراخيص البرامج.) (.14/07/2009 - 01:16:15.) -- C:\Windows\System32\sppcomapi.dll [193024]
[MD5.DDC040FDB01EF1712A6B13E52AFB104C] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.13/07/2009 - 23:12:38.) -- C:\Windows\system32\Drivers\AFD.sys [338944]
[MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14/07/2009 - 01:26:15.) -- C:\Windows\system32\Drivers\atapi.sys [21584]
[MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 23:11:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656]
[MD5.BA6E70AA0E6091BC39DE29477D866A77] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.13/07/2009 - 23:11:26.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544]
[MD5.8E09E52EE2E3CEB199EF3DD99CF9E3FB] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.13/07/2009 - 23:14:17.) -- C:\Windows\system32\Drivers\DfsC.sys [78336]
[MD5.717A2207FD6F13AD3E664C7D5A43C7BF] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.13/07/2009 - 23:50:56.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544]
[MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - برنامج تشغيل منفذ i8042.) (.13/07/2009 - 23:11:24.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896]
[MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.13/07/2009 - 23:54:29.) -- C:\Windows\system32\Drivers\IpNat.sys [101888]
[MD5.F4A054BE78AF7F410129C4B64B07DC9B] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.13/07/2009 - 23:14:26.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123392]
[MD5.DD52A733BF4CA5AF84562A5E2F963B91] - (.Microsoft Corporation - MBT Transport driver.) (.13/07/2009 - 23:12:21.) -- C:\Windows\system32\Drivers\netBT.sys [187904]
[MD5.3795DCD21F740EE799FB7223234215AF] - (.Microsoft Corporation - NT File System Driver.) (.14/07/2009 - 01:20:44.) -- C:\Windows\system32\Drivers\ntfs.sys [1210432]
[MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - برنامج تشغيل المنفذ المتوازي.) (.13/07/2009 - 23:45:35.) -- C:\Windows\system32\Drivers\Parport.sys [79360]
[MD5.D9F91EAFEC2815365CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13/07/2009 - 23:54:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848]
[MD5.C5FF95883FFEF704D50C40D21CFB3AB5] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.14/07/2009 - 00:02:58.) -- C:\Windows\system32\Drivers\rdpdr.sys [133120]
[MD5.3E21C083B8A01CB70BA1F09303010FCE] - (.Microsoft Corporation - SMB Transport driver.) (.13/07/2009 - 23:53:41.) -- C:\Windows\system32\Drivers\smb.sys [71168]
[MD5.CB39E896A2A83702D1737BFD402B3542] - (.Microsoft Corporation - TDI Translation Driver.) (.13/07/2009 - 23:12:11.) -- C:\Windows\system32\Drivers\tdx.sys [74240]
[MD5.58DF9D2481A56EDDE167E51B334D44FD] - (.Microsoft Corporation - برنامج تشغيل خدمة ملفات الظل الاحتياطية لوحدة التخزين.) (.14/07/2009 - 01:19:10.) -- C:\Windows\system32\Drivers\volsnap.sys [245328]
~ Generic Processes: Scanned in 00mn 00s



---\\ Hidden files state (Hidden/Total)
~ Mes images (My Pictures) : 0/0
~ Mes musiques (My Musics) : 0/0
~ Mes Videos (My Videos) : 0/0
~ Mes Favoris (My Favorites) : 1/51
~ Mes Documents (My Documents) : 1/9
~ Mon Bureau (My Desktop) : 1/28
~ Menu demarrer (Programs) : 1/102
~ Hidden Files: Scanned in 00mn 00s



---\\ Process running
[MD5.241B07FF7F5943B9C1BF3235F49AC1E1] - (.Avira Operations GmbH & Co. KG - Antivirus System Tray Tool (Desktop).) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744] [PID.2380]
[MD5.FF495F41852D7959022FFB43686E5962] - (.Cucusoft, Inc. - Cucusoft Net Guard.) -- C:\Program Files\Cucusoft\NetGuard\BandwidthGuard.exe [868352] [PID.2420]
[MD5.B0D917A6A690E4EA4112E39DB5428C08] - (.SoftPerfect Research - NetWorx Application (32-bit).) -- C:\Program Files\NetWorx\networx.exe [4577984] [PID.2452]
[MD5.01D1D02057AB364A9E47E92C63535FCA] - (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\Internet Download Manager\IDMan.exe [3882576] [PID.2492]
[MD5.BD95E822E7A958BBCA842D078426A151] - (.Tonec Inc. - Internet Download Manager agent for click m.) -- C:\Program Files\Internet Download Manager\IEMonitor.exe [269848] [PID.2868]
[MD5.85A9BBED7AD3CA869956399AA9F3F20A] - (.Hagel Technologies Ltd. - DU Meter Monitor.) -- C:\Program Files\DU Meter\DUMeter.exe [4245400] [PID.1760]
[MD5.C4EF32C1C0473392EF4204890AF8E457] - (.Google Inc. - Google Chrome.) -- C:\Users\وسام\AppData\Local\Google\Chrome\Application\chrome.exe [813896] [PID.3948]
[MD5.F6B0935B23E3C5B54DF33D3C180CA063] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8211968] [PID.2564]
[MD5.4D282B9C5BB05DF92C9F3977DFB9F916] - (.Avira Operations GmbH & Co. KG - Antivirus Host Framework Service.) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400] [PID.1500]
[MD5.65AF41A7A2C5B6693E1B4164E7632C3E] - (.Avira Operations GmbH & Co. KG - Antivirus Host Framework Service.) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400] [PID.1648]
[MD5.12461829627C6ED75DC2D7AF94097F70] - (.Cucusoft, Inc. - Cucusoft Auto Update Service.) -- C:\Program Files\Cucusoft\AutoUpdate\AutoUpdateSrvc.exe [44696] [PID.1752]
[MD5.C62FBA28888618418B377C9E72ED0DE5] - (.Cucusoft, Inc. - Cucusoft Net Guard Service 2012-04-21.) -- C:\Program Files\Cucusoft\NetGuard\BandwidthGuardSrvc.sys [223392] [PID.1892]
[MD5.3856D54FD710AB60B8C7A443BC625EAA] - (.Cucusoft, Inc. - Cucusoft SysMsg Proxy and Data Log Service.) -- C:\Program Files\Cucusoft\NetGuard\sysMsgProxySrvc.sys [255136] [PID.1916]
[MD5.6F1E9AB820B3DD8BD38C0190A206205D] - (.Avira Operations GmbH & Co. KG - AntiVir shadow copy service.) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe [431672] [PID.292]
[MD5.DAB48CB546A895C3FC6219F298CC6DD7] - (.Avira Operations GmbH & Co. KG - AntiVir WebGuard WFP Service.) -- C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1017424] [PID.944]
[MD5.6D7C8A951AF6AD6835C029B3CB88D333] - (.Microsoft Corporation - .NET Runtime Optimization Service.) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [104912] [PID.3664]
[MD5.F191DF810E6AAA0651A723EAE8D249A9] - (.Hagel Technologies Ltd. - DU Meter Service.) -- C:\Program Files\DU Meter\DUMeterSvc.exe [2385304] [PID.3476]
[MD5.4C287F9069FEDBD791178876EE9DE536] - (.Microsoft Corporation - ‎‎خدمة النظام الأساسي لحماية البرامج لـ Mic.) -- C:\Windows\system32\sppsvc.exe [3179520] [PID.2932]
~ Processes Running: Scanned in 00mn 00s



---\\ Google Chrome, Start,Search,Extensions (G0,G1,G2)
C:\Users\وسام\AppData\Local\Google\Chrome\User Data\Default\Preferences

---\\ Google Chrome Extension Folder
~ Google Lines Browser: 15 Legitimates Filtered in 00mn 00s



---\\ Mozilla Firefox,Plugins,Start,Search,Extensions (P2,M0,M1,M2,M3)
P2 - FPN:Firefox Plugin Navigator . (...) -- C:\Program Files\Mozilla Firefox\browser\searchplugins\wikipedia-ar.xml
~ Firefox Browser: 12 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer Extensions, Start, Search (R4,R3,R0,R1)
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (...) (No version) -- (.not file.)
~ IE Browser: 11 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Line Analysis F0, F1, F2, F3 - IniFiles, Auto loading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Hosts file redirection (O1)
~ Le fichier hôte est sain (The hosts file is clean) (21)
~ Hosts File: Scanned in 00mn 00s



---\\ Auto loading programs from Registry and folders (O4)
O4 - HKLM\..\Run: [avgnt] . (.Avira Operations GmbH & Co. KG - Antivirus System Tray Tool (Desktop).) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
O4 - HKLM\..\Run: [CucusoftNetGuard] . (.Cucusoft, Inc. - Cucusoft Net Guard.) -- C:\Program Files\Cucusoft\NetGuard\BandwidthGuard.exe
O4 - HKLM\..\Run: [NetWorx] . (.SoftPerfect Research - NetWorx Application (32-bit).) -- C:\Program Files\NetWorx\networx.exe
O4 - HKCU\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\Internet Download Manager\IDMan.exe
O4 - HKCU\..\Run: [DU Meter] . (.Hagel Technologies Ltd. - DU Meter Monitor.) -- C:\Program Files\DU Meter\DUMeter.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - ‎‎الأدوات الذكية على سطح المكتب لـ Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - ‎‎الأدوات الذكية على سطح المكتب لـ Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - ‎‎MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - ‎‎MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-244243773-2670198990-3670508953-1000\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\Internet Download Manager\IDMan.exe
O4 - HKUS\S-1-5-21-244243773-2670198990-3670508953-1000\..\Run: [DU Meter] . (.Hagel Technologies Ltd. - DU Meter Monitor.) -- C:\Program Files\DU Meter\DUMeter.exe
~ Application: Scanned in 00mn 00s



---\\ Lop.com/Domain Hijackers (O17)
O17 - HKLM\System\CCS\Services\Tcpip\..\{B759884E-C614-4F1E-B88E-0C1CB3EEC0C7}: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{B759884E-C614-4F1E-B88E-0C1CB3EEC0C7}: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{B759884E-C614-4F1E-B88E-0C1CB3EEC0C7}: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.254
~ Domain: Scanned in 00mn 00s



---\\ Extra protocols (O18)
O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - عارض Microsoft (R) HTML.) -- C:\Windows\System32\mshtml.dll
O18 - Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} . (.Microsoft Corporation - ملحقات OLE32 لـ Win32.) -- C:\Windows\system32\urlmon.dll
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Non Microsoft non disabled Windows XP/NT/2000 Services (O23)
O23 - Service: (CS_AutoUpdate) . (.Cucusoft, Inc. - Cucusoft Auto Update Service.) - C:\Program Files\Cucusoft\AutoUpdate\AutoUpdateSrvc.exe
~ Services: 5 Legitimates Filtered in 00mn 10s



---\\ Task Planned Automatically (039)
[MD5.592E610D4176CD23E83150A3285D1991] [APT] [{137E49D9-DF30-4F6A-A868-82E25A3370DD}] (...) -- D:\_shamela\setup.exe [456204]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater [830]
~ Scheduled Task: 15 Legitimates Filtered in 00mn 02s



---\\ Drivers launched at startup (O41)
O41 - Driver: (networx) . (.NetFilterSDK.com - NetFilter SDK TDI Hook Driver (WPP).) - C:\Windows\System32\drivers\networx.sys
O41 - Driver: (cFosSpeed) . (. - .) - C:\Windows\System32\DRIVERS\cfosspeed6.sys (.not file.)
~ Drivers: 79 Legitimates Filtered in 00mn 00s



---\\ Software installed (O42)
O42 - Logiciel: NetSpeedMonitor 2.5.4.0 x86 - (.Florian Gilles.) [HKLM] -- {86501894-E722-4385-A792-B7C2F28FAE7B}
~ Logic: 11 Legitimates Filtered in 00mn 00s



---\\ HKCU & HKLM Software Keys
[HKLM\Software\DVBDream]
~ Key Software: 85 Legitimates Filtered in 00mn 00s



---\\ Contents of the Common Files folders (O43)
O43 - CFD: 29/05/2015 - 15:48:22 - [] ----D C:\Program Files\Anoirsoft
O43 - CFD: 29/05/2015 - 11:33:02 - [] ----D C:\Program Files\NetSpeedMonitor
O43 - CFD: 29/05/2015 - 10:57:48 - [] -SH-D C:\ProgramData\سطح المكتب
O43 - CFD: 29/05/2015 - 10:57:48 - [] -SH-D C:\ProgramData\قائمة ابدأ
O43 - CFD: 14/07/2009 - 07:48:45 - [0] R-H-D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC
O43 - CFD: 30/05/2015 - 11:12:40 - [] ----D C:\Users\وسام\AppData\Roaming\NetSpeedMonitor
~ Program Folder: 96 Legitimates Filtered in 00mn 00s



---\\ Last modified or created files under Windows and System32 (O44)
O44 - LFC:[MD5.133A7EFFC160432AAFB623278D7E0D4B] - 19/05/2015 - 14:52:26 ---A- . (.NetFilterSDK.com - NetFilter SDK TDI Hook Driver (WPP).) -- C:\Windows\System32\Drivers\networx.sys [65000]
O44 - LFC:[MD5.BC24AF8FB85D34699DA25F7815A8453A] - 29/05/2015 - 07:40:22 ---A- . (...) -- C:\Windows\DtcInstall.log [1774]
O44 - LFC:[MD5.565EC97809D3CF65466E3FFD0B6E5424] - 29/05/2015 - 07:46:04 ---A- . (...) -- C:\Windows\TSSysprep.log [1313]
O44 - LFC:[MD5.68C5BEE33C98CAC31613B57F18C31028] - 29/05/2015 - 11:10:00 RSH-- . (...) -- C:\CWJOR [428503]
O44 - LFC:[MD5.F3D2F5563A73C560BC0895E8A750CBE6] - 30/05/2015 - 17:40:14 ---A- . (.No owner - Setup/Uninstall.) -- C:\Windows\isRS-000.tmp [766360]
O44 - LFC:[MD5.6DA5E09C4993AE3CC281BB3CA151D3CF] - 30/05/2015 - 17:45:55 ---A- . (...) -- C:\Windows\cFosSpeed_Setup_Log.txt [51220]
~ Files: 65 Legitimates Filtered in 00mn 02s



---\\ Latest files created in Windows Prefetcher (O45)
O45 - LFCP:[MD5.228950587714A419505ACAFB1254DA8E] - 29/05/2015 - 11:01:21 ---A- - C:\Windows\Prefetch\OFFERCAST_AVIRAV7_.EXE-B014E63D.pf =>Toolbar.Ask
~ Prefetcher: 1 Legitimates Filtered in 00mn 00s



---\\ Microsoft Windows Policies System (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s



---\\ System Drivers List (SDL) (O58)
O58 - SDL:14/07/2009 - 01:20:28 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [453712]
O58 - SDL:13/07/2009 - 22:54:14 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [26624]
O58 - SDL:01/10/2014 - 06:19:10 ---A- . (.Tonec Inc. - Internet Download Manager WFP Driver.) -- C:\Windows\System32\Drivers\idmwfp.sys [115240]
O58 - SDL:19/05/2015 - 14:52:26 ---A- . (.NetFilterSDK.com - NetFilter SDK TDI Hook Driver (WPP).) -- C:\Windows\System32\Drivers\networx.sys [65000]
O58 - SDL:14/11/2006 - 17:35:20 ---A- . (.REDC - RICOH XD SM Driver.) -- C:\Windows\System32\Drivers\rixdptsk.sys [37376]
O58 - SDL:25/02/2014 - 11:41:37 ---A- . (.Avira GmbH - AVIRA SnapShot Driver.) -- C:\Windows\System32\Drivers\ssmdrv.sys [28520]
O58 - SDL:14/07/2009 - 01:19:04 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [21072]
O58 - SDL:17/07/2009 - 06:24:53 ---A- . (.TechniSat Digital S.A. - TechniSat USB.) -- C:\Windows\System32\Drivers\UDST7000BDA.sys [433168]
O58 - SDL:13/07/2009 - 21:40:41 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029]
O58 - SDL:13/07/2009 - 21:40:44 ---A- . (...) -- C:\Windows\System32\country.sys [27097]
O58 - SDL:13/07/2009 - 21:40:40 ---A- . (...) -- C:\Windows\System32\HIMEM.SYS [4768]
O58 - SDL:13/07/2009 - 21:40:43 ---A- . (...) -- C:\Windows\System32\KEY01.SYS [42809]
O58 - SDL:13/07/2009 - 21:40:43 ---A- . (...) -- C:\Windows\System32\KEYBOARD.SYS [42537]
O58 - SDL:13/07/2009 - 21:40:23 ---A- . (...) -- C:\Windows\System32\NTDOS.SYS [27866]
O58 - SDL:13/07/2009 - 21:40:31 ---A- . (...) -- C:\Windows\System32\NTDOS404.SYS [29146]
O58 - SDL:13/07/2009 - 21:40:35 ---A- . (...) -- C:\Windows\System32\NTDOS411.SYS [29370]
O58 - SDL:13/07/2009 - 21:40:39 ---A- . (...) -- C:\Windows\System32\NTDOS412.SYS [29274]
O58 - SDL:13/07/2009 - 21:40:27 ---A- . (...) -- C:\Windows\System32\NTDOS804.SYS [29146]
O58 - SDL:13/07/2009 - 21:40:11 ---A- . (...) -- C:\Windows\System32\NTIO.SYS [33952]
O58 - SDL:13/07/2009 - 21:40:15 ---A- . (...) -- C:\Windows\System32\NTIO404.SYS [34672]
O58 - SDL:13/07/2009 - 21:40:17 ---A- . (...) -- C:\Windows\System32\NTIO411.SYS [35776]
O58 - SDL:13/07/2009 - 21:40:19 ---A- . (...) -- C:\Windows\System32\NTIO412.SYS [35536]
O58 - SDL:13/07/2009 - 21:40:13 ---A- . (...) -- C:\Windows\System32\NTIO804.SYS [34672]
~ Drivers: 70 Legitimates Filtered in 00mn 01s



---\\ Last modified or created user files (O61)
O61 - LFC: 29/05/2015 - 18:49:09 ---A- . (...) -- C:\Users\وسام\AppData\Local\Microsoft\Windows\1025\StructuredQuerySchema.bin [329766]
O61 - LFC: 30/05/2015 - 18:49:09 ---A- . (.Internet App Software.) -- C:\Users\وسام\Downloads\Programs\Speed TestInstaller.exe [687400]
~ 321 Fichiers temporaires (Temporary files)
~ 21 Fichiers cookies (Cookies files)
~ Files: 13 Legitimates Filtered in 00mn 00s



---\\ List all tools cleaner (LATC) (O63)
O63 - Logiciel: ZHPDiag 2015 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ List all legacy services(LALS) (O64)
O64 - Services: CurCS - 01/03/2013 - C:\Program Files\DU Meter\DUMETR32.sys (DUMeterDrv) .(.Hagel Technologies Ltd. - DU Meter network traffic accounting driver.) - LEGACY_DUMETERDRV
O64 - Services: CurCS - 01/10/2014 - C:\Windows\System32\DRIVERS\idmwfp.sys (IDMWFP) .(.Tonec Inc. - Internet Download Manager WFP Driver.) - LEGACY_IDMWFP
O64 - Services: CurCS - 15/02/1746 - C:\Users\7D60~1\AppData\Local\Temp\mbr.sys (mbr) .(...) - LEGACY_MBR
O64 - Services: CurCS - 19/05/2015 - C:\Windows\System32\drivers\networx.sys (networx) .(.NetFilterSDK.com - NetFilter SDK TDI Hook Driver (WPP).) - LEGACY_NETWORX
O64 - Services: CurCS - 13/07/2009 - C:\Windows\System32\Drivers\secdrv.sys (secdrv) .(.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) - LEGACY_SECDRV
O64 - Services: CurCS - 25/02/2014 - C:\Windows\System32\DRIVERS\ssmdrv.sys (ssmdrv) .(.Avira GmbH - AVIRA SnapShot Driver.) - LEGACY_SSMDRV
~ Legacy: 113 Legitimates Filtered in 00mn 00s



---\\ File Associations Shell Spawning (O67)
O67 - Shell Spawning: <.html> [HKLM\..\open\Command] (.Not Key.)
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s



---\\ Start Menu Internet (SMI) (O68)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s



---\\ Search Tracing Registry Key (O100)
HKLM\SOFTWARE\Microsoft\Tracing\Offercast_AVIRAV7__RASAPI32 =>Toolbar.Ask
HKLM\SOFTWARE\Microsoft\Tracing\Offercast_AVIRAV7__RASMANCS =>Toolbar.Ask
~ BTK: 50 Legitimates Filtered in 00mn 00s



---\\ General States of Services not Microsoft (EGS) (SR=Running, SS=Stopped)
SS - | Demand 29/05/2015 268464 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 06/06/2014 119408 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Demand 14/07/2009 20992 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 25/02/2014 440400 | (AntiVirSchedulerService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\sched.exe
SR - | Auto 25/02/2014 440400 | (AntiVirService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
SR - | Auto 25/02/2014 1017424 | (AntiVirWebService) . (.Avira Operations GmbH & Co. KG.) - C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe
SR - | Auto 17/07/2012 44696 | (CS_AutoUpdate) . (.Cucusoft, Inc..) - C:\Program Files\Cucusoft\AutoUpdate\AutoUpdateSrvc.exe
SR - | Auto 01/03/2013 2385304 | (DUMeterSvc) . (.Hagel Technologies Ltd..) - C:\Program Files\DU Meter\DUMeterSvc.exe
SR - | Auto 14/07/2009 20992 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 15s



---\\ Search Master Boot Record Infection (MBR)(O80)
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Run by وسام at 30/05/2015 18:49:40
device: opened successfully
user: MBR read successfully
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS halmacpi.dll PCIIDEX.SYS msahci.sys
1 ntkrnlpa!IofCallDriver[0x82847458] >> \Device\Harddisk0\DR0[0x8566A030]
kernel: MBR read successfully
user & kernel MBR OK
~ MBR: 36 Legitimates Filtered in 00mn 02s



---\\ Search Master Boot Record Infection (MBRCheck)(O80)
Written by ad13, http://ad13.geekstog
Run by وسام at 30/05/2015 18:49:42
********* Dump file Name *********
C:\PhysicalDisk0_MBR.bin
~ MBR: Scanned in 00mn 04s



---\\ Scan Additionnel (O88)
Database Version : 13008 - (25/05/2015)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 0

~ Additionnel Scan: 127944 Items scanned in 00mn 24s



---\\ Additional information about modules
~ http://nicolascoolman.fr/r5-internet-explorer-proxy-management-iepm/ =>.Internet Explorer, Proxy Management (R5)
~ http://nicolascoolman.fr/o4-applications-demarrees-par-le-registre/ =>.Auto loading programs from Registry and folders (O4)
~ AMI: 2 Legitimates Filtered in 00mn 00s



---\\ Summary of the detections found on your workstation
http://nicolascoolman.fr/toolbar-ask =>Toolbar.Ask
~ MSI: 1 link(s) detected in 00mn 00s



~ 671 Legitimates filtered by white list
End of the scan (416 lines in 01mn 29s)(0.8)

Publicité


Signaler le contenu de ce document

Publicité