~ ZHPDiag v2015.7.5.84 By Nicolas Coolman (2015\07\05) ~ Run by n (Administrator) (2015/07/08 06:55:06) ~ Site: http://www.nicolascoolman.fr ~ Facebook: https://www.facebook.com/nicolascoolman1 ~ State version: Version OK ~ Mode: Scan ~ Report: C:\Users\n\Desktop\ZHPDiag.txt ~ Report: C:\Users\n\AppData\Roaming\ZHP\ZHPDiag.txt ~ UAC: Activate ~ System startup: Normal (Normal boot) ~ Windows 8.1, 32-bit (Build 9600) ---\\ Windows Product Information (3) - 3s ~ Windows Server License Manager Script : OK ~ Licence Script File Génération : OK Windows Activation Technologies : KO ---\\ System protection software (2) - 1s Emsisoft Anti-Malware Malwarebytes Anti-Malware ÇáäÓÎÉ 2.1.8.1057 ---\\ System protection software (Superfluous) (1) - 1s ESET Online Scanner v3 ---\\ System optimization software (1) - 1s CCleaner v5.02 ---\\ Surveillance software (2) - 1s Adobe Flash Player 18 NPAPI Adobe Reader XI ---\\ Information on the system (6) - 0s ~ Operating System: x86 Family 6 Model 37 Stepping 5, GenuineIntel ~ Operating System: 32-bit ~ Boot mode: Normal (Normal boot) ~ Total physical RAM (KB): 3397456 ~ System Restore: Activé (Enable) ~ System drive C: has 24 GB free of 49 GB ---\\ Connection to the system mode (3) - 0s ~ Computer Name: M ~ User Name: n ~ Logged in as Administrator ---\\ Enumeration of the disk units (4) - 0s ~ Drive C: has 24 GB free of 49 GB (System) ~ Drive D: has 227 GB free of 299 GB ~ Drive E: has 169 GB free of 265 GB ~ Drive F: has 9 GB free of 99 GB ---\\ Search Generic System Files (22) - 1s [MD5.119E091B5386379BC5AA598BE9440C75] - (.Microsoft Corporation - Windows Explorer.) () -- C:\Windows\Explorer.exe [2088160] [MD5.BE1DAE43DFBCA94FB6B4157C1B16923E] - (.Microsoft Corporation - Windows host process (Rundll32).) () -- C:\Windows\System32\rundll32.exe [49664] [MD5.02BC073156B3097E94D63C4D609020DD] - (.Microsoft Corporation - Windows Start-Up Application.) () -- C:\Windows\System32\Wininit.exe [112640] [MD5.F89C2BDB6E385ED6CA2AC0085BB6643A] - (.Microsoft Corporation - Internet Extensions for Win32.) () -- C:\Windows\System32\wininet.dll [1789440] [MD5.70C57DC69D4A7D92D2CAC90C3AD16E6F] - (.Microsoft Corporation - Windows Logon Application.) () -- C:\Windows\System32\Winlogon.exe [459264] [MD5.BFB9E1202225113991F981D29BFB9029] - (.Microsoft Corporation - Software Licensing Library.) () -- C:\Windows\System32\sppcomapi.dll [438272] [MD5.2AF7DA157FFF947A507FCB4AB8BB4C7C] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) () -- C:\Windows\System32\drivers\AFD.sys [455168] [MD5.72FCAE2CE6DFEAB2AB072435017F3417] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) () -- C:\Windows\System32\drivers\atapi.sys [23392] [MD5.CE232BB0965C0C0B786C3F976CCBFB7D] - (.Microsoft Corporation - CD-ROM File System Driver.) () -- C:\Windows\System32\drivers\Cdfs.sys [73728] [MD5.E2FC132D48EA4E8B04432C33EFB77801] - (.Microsoft Corporation - SCSI CD-ROM Driver.) () -- C:\Windows\System32\drivers\Cdrom.sys [124928] [MD5.55758EBBC45E1628161121D7CFEAD4A1] - (.Microsoft Corporation - DFS Namespace Client Driver.) () -- C:\Windows\System32\drivers\DfsC.sys [102400] [MD5.A31901DE6A22EA67AB83AAF7036F98CC] - (.Microsoft Corporation - High Definition Audio Bus Driver.) () -- C:\Windows\System32\drivers\HDAudBus.sys [69632] [MD5.5043E69532392A43549E5D41E22638AA] - (.Microsoft Corporation - i8042 Port Driver.) () -- C:\Windows\System32\drivers\i8042prt.sys [82944] [MD5.FA6C94C754A566EA8A61D658932F32DE] - (.Microsoft Corporation - IP Network Address Translator.) () -- C:\Windows\System32\drivers\IpNat.sys [126976] [MD5.3225D40D8CBA74A79D3B10879A14755E] - (.Microsoft Corporation - Windows NT SMB Minirdr.) () -- C:\Windows\System32\drivers\MRxSmb.sys [333824] [MD5.BC242922B0D08F61CF7C87FD08FAFA8B] - (.Microsoft Corporation - MBT Transport driver.) () -- C:\Windows\System32\drivers\netBT.sys [218624] [MD5.BAFDB3519A9D1A6A0665A70696BA98D5] - (.Microsoft Corporation - NT File System Driver.) () -- C:\Windows\System32\drivers\ntfs.sys [1679704] [MD5.4F30970F15ADCC382544B31D5D7E368E] - (.Microsoft Corporation - Parallel Port Driver.) () -- C:\Windows\System32\drivers\Parport.sys [81408] [MD5.C51AB62AB41A2E8560D12472B204CC00] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) () -- C:\Windows\System32\drivers\Rasl2tp.sys [81920] [MD5.67E91843B0344411820A012063E876B2] - (.Microsoft Corporation - Microsoft RDP Device redirector.) () -- C:\Windows\System32\drivers\rdpdr.sys [143872] [MD5.DB0C184142CF9FA1746F598A16EE92B2] - (.Microsoft Corporation - TDI Translation Driver.) () -- C:\Windows\System32\drivers\tdx.sys [87040] [MD5.085918BF459BCB835CFC535BE7138539] - (.Microsoft Corporation - Volume Shadow Copy Driver.) () -- C:\Windows\System32\drivers\volsnap.sys [265048] ---\\ Process running (15) - 1s [MD5.C26041099A739D303752C100317A6383] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 341.6.) -- C:\Windows\System32\nvvsvc.exe [671552] [PID.956] [MD5.5EC71CC2DB68C7BD206C0D2B7029AF9E] - (.NVIDIA Corporation - NVIDIA User Experience Driver Component.) -- C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe [938184] [PID.1024] [MD5.C26041099A739D303752C100317A6383] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 341.6.) -- C:\Windows\System32\nvvsvc.exe [671552] [PID.1036] [MD5.5E793E82E1E2A1765B44CBD1A0D69638] - (.Baidu Inc. - Baidu Cleaner Service.) -- C:\Program Files\Baidu Cleaner\BCleanerSvc.exe [1697896] [PID.1048] [MD5.BBFD6BC7E79989B69F0998D0FEF4E6B8] - (.Emsisoft Ltd - Emsisoft Protection Service.) -- C:\Program Files\Emsisoft Anti-Malware\a2service.exe [5155576] [PID.1620] [MD5.8E06998A4ED01F1289D00F3EF0527409] - (.Baidu, Inc. - Baidu MoboMarket Service.) -- C:\Program Files\Baidu Security\MoboMarket\1.2.8.4379\bassvc.exe [208928] [PID.1228] [MD5.7172E394D61CE38BB4D862CBB2F28A74] - (.Baidu, Inc. - Baidu AndroidStore Helper.) -- C:\Program Files\Baidu Security\MoboMarket\1.2.8.4379\bas_helper.exe [2201632] [PID.516] [MD5.712D9E83EAEB157D5858F88BC1800780] - (.Alps Electric Co., Ltd. - HidMonitorSvc ????????.) -- C:\Program Files\DellTPad\HidMonitorSvc.exe [76120] [PID.2080] [MD5.9722B3D07A1DABB9C693EDE0200ABA06] - (.Alps Electric Co., Ltd. - Alps Pointing-device Driver.) -- C:\Program Files\DellTPad\Apoint.exe [571736] [PID.2288] [MD5.8FB1A3AB319F21CC8DB34198CB4A88E7] - (.Emsisoft Ltd - Emsisoft Real-Time Protection.) -- C:\Program Files\Emsisoft Anti-Malware\a2guard.exe [4923832] [PID.3772] [MD5.ADE3D7AD36CA238C6D58E5E93392D2F8] - (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\Internet Download Manager\IDMan.exe [3903056] [PID.3980] [MD5.22B79AE199B3E8ED5BC8C417A7ADD222] - (.Alps Electric Co., Ltd. - ApMsgFwd.) -- C:\Program Files\DellTPad\ApMsgFwd.exe [58160] [PID.3256] [MD5.45F947C8C98056539F9FCB1CD97A3C0B] - (.Alps Electric Co., Ltd. - Alps Pointing-device Driver.) -- C:\Program Files\DellTPad\hidfind.exe [55640] [PID.2200] [MD5.903B7CE46BDD519312D3832C96655B9C] - (.Alps Electric Co., Ltd. - Alps Pointing-device Driver for Windows.) -- C:\Program Files\DellTPad\ApntEx.exe [55640] [PID.2636] [MD5.E9C6EF9437ECB30911488F9313AD821A] - (.Tonec Inc. - Internet Download Manager agent for click m.) -- C:\Program Files\Internet Download Manager\IEMonitor.exe [269848] [PID.3592] ---\\ Mozilla Firefox,Plugins,Start,Search,Extensions (P2,M0,M1,M2,M3) (13) - 1s P2 - EXT: (...) -- C:\Program Files\Mozilla Firefox\browser\searchplugins\amazondotcom.xml P2 - EXT: (...) -- C:\Program Files\Mozilla Firefox\browser\searchplugins\bing.xml P2 - EXT: (...) -- C:\Program Files\Mozilla Firefox\browser\searchplugins\ddg.xml P2 - EXT: (...) -- C:\Program Files\Mozilla Firefox\browser\searchplugins\eBay.xml P2 - EXT: (...) -- C:\Program Files\Mozilla Firefox\browser\searchplugins\google.xml P2 - EXT: (...) -- C:\Program Files\Mozilla Firefox\browser\searchplugins\wikipedia-ar.xml P2 - EXT: (...) -- C:\Program Files\Mozilla Firefox\browser\searchplugins\yahoo.xml P2 - EXT: (.Mozilla - Default.) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (.Adobe Systems Incorporated.) -- C:\Windows\System32\Macromed\Flash\NPSWF32_18_0_0_194.dll P2 - FPN: [HKLM] [@foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp] - (...) -- C:\Program Files\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll P2 - FPN: [HKLM] [@foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf] - (...) -- C:\Program Files\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll P2 - FPN: [HKLM] [@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6] - (.Yahoo! Inc..) -- C:\Program Files\Yahoo!\Shared\npYState.dll P2 - FPN: [HKLM] [@qq.com/QQDownloadPlugin] - (.Tencent.) -- C:\Program Files\Tencent\QQDownload\Browser\751\npXFPlugin.dll =>Adware.TencentAddressBar ---\\ Internet Explorer Extensions, Start, Search (R4,R3,R0,R1) (8) - 0s R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/ R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/ R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} Orphean =>.Microsoft Internet Explorer R4 - HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,EnabledV9 = 0 ---\\ Internet Explorer, Proxy Management (R5) (3) - 0s R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ---\\ Line Analysis F0, F1, F2, F3 - IniFiles, Auto loading programs (3) - 0s F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe (.Microsoft Corporation.) F2 - REG:system.ini: Shell=C:\Windows\explorer.exe (.Microsoft Corporation.) F2 - REG:system.ini: VMApplet=C:\Windows\system32\SystemPropertiesPerformance.exe (.Microsoft Corporation.) ---\\ Hosts file redirection (O1) (1) - 0s ~ Le fichier hôte est sain (The hosts file is clean) (21) ---\\ Browser Helper Object (BHO) (O2) (4) - 0s O2 - BHO: QQCycloneHelper - {00000000-12C9-4305-82F9-43058F20E8D2} . (...) -- C:\Program Files\Tencent\QQDownload\QQIEHelper01.dll (.not file.) =>Adware.TencentAddressBar O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} . (.Internet Download Manager, Tonec Inc. - IDM Browser Helper Object.) -- C:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} (Orphean) O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} (Orphean) ---\\ Auto loading programs from Registry and folders (O4) (9) - 0s O4 - HKLM\..\Run: [emsisoft anti-malware] . (.Emsisoft Ltd - Emsisoft Real-Time Protection.) -- c:\program files\emsisoft anti-malware\a2guard.exe O4 - HKCU\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\Internet Download Manager\IDMan.exe O4 - HKUS\.DEFAULT\..\Run: [Bitdefender Wallet Agent] C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe (.not file.) O4 - HKUS\.DEFAULT\..\Run: [Bitdefender Wallet] C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe (.not file.) O4 - HKUS\.DEFAULT\..\Run: [Bitdefender Wallet Application Agent] C:\Program Files\Bitdefender\Bitdefender\bdapppassmgr.exe (.not file.) O4 - HKUS\S-1-5-18\..\Run: [Bitdefender Wallet Agent] C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe (.not file.) O4 - HKUS\S-1-5-18\..\Run: [Bitdefender Wallet] C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe (.not file.) O4 - HKUS\S-1-5-18\..\Run: [Bitdefender Wallet Application Agent] C:\Program Files\Bitdefender\Bitdefender\bdapppassmgr.exe (.not file.) O4 - HKUS\S-1-5-21-3334498701-2302894869-3536220445-1001\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\Internet Download Manager\IDMan.exe ---\\ Lop.com/Domain Hijackers (O17) (4) - 0s O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 8.8.8.8,8.8.4.4 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 8.8.8.8,8.8.4.4 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1 ---\\ Non Microsoft non disabled Windows XP/NT/2000 Services (O23) (8) - 0s O23 - Service: Emsisoft Protection Service (a2AntiMalware) . (.Emsisoft Ltd - Emsisoft Protection Service.) - C:\Program Files\Emsisoft Anti-Malware\a2service.exe O23 - Service: @oem25.inf,%HidMonitor.SvcDisp%;Alps HID Monitor Service (ApHidMonitorService) . (.Alps Electric Co., Ltd. - HidMonitorSvc ????????.) - C:\Program Files\DellTPad\HidMonitorSvc.exe O23 - Service: Baidu MoboMarket Service (BASSVC) . (.Baidu, Inc. - Baidu MoboMarket Service.) - C:\Program Files\Baidu Security\MoboMarket\1.2.8.4379\bassvc.exe O23 - Service: Baidu Cleaner Service (BCleanerSvc) . (.Baidu Inc. - Baidu Cleaner Service.) - C:\Program Files\Baidu Cleaner\BCleanerSvc.exe O23 - Service: ESET Service (ekrn) . (...) - C:\Program Files\ESET\ESET Smart Security\ekrn.exe (.not file.) O23 - Service: (MBAMScheduler) . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) - C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe O23 - Service: (MBAMService) . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) . (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 341.6.) - C:\Windows\System32\nvvsvc.exe ---\\ Task Planned Automatically (O39) (24) - 3s [MD5.1234A12B71DAE034E45C714AE5A54412] [APT] [Adobe Flash Player Updater] (.Adobe Systems Incorporated.) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [268976] [MD5.3E04F1E482357B1FC8B088197C3D9FF8] [APT] [Adobe online update program] (.Adobe Systems Incorporated.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152] [MD5.4E8C983215115036C46841FFB51562A1] [APT] [AutoKMSCustom] (.CODYQX4.) -- C:\Windows\AutoKMS\AutoKMS.exe [2820608] =>HackTool.AutoKMS [MD5.7428ECBD27D4AD75DCACC30AC5ABCA07] [APT] [AutoPico Daily Restart] (.@ByELDI.) -- C:\Program Files\KMSpico\AutoPico.exe [963264] =>PUA.KMSpico [MD5.00000000000000000000000000000000] [APT] [avast! Emergency Update] (.@ByELDI.) -- C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [Baidu PC Faster Service] (.@ByELDI.) -- C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFasterSvc.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [Baidu PC Faster Update] (.@ByELDI.) -- C:\Program Files\Baidu Security\PC Faster\4.0.0.0\Updater.exe (.not file.) [0] [MD5.9A1F3AEA8D61AA67D90F1B336C00984E] [APT] [CCleanerSkipUAC] (.Piriform Ltd.) -- C:\Program Files\CCleaner\CCleaner.exe [5496600] [MD5.506708142BC63DABA64F2D3AD1DCD5BF] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe [116648] [MD5.506708142BC63DABA64F2D3AD1DCD5BF] [APT] [GoogleUpdateTaskMachineUA] (.Google Inc..) -- C:\Program Files\Google\Update\GoogleUpdate.exe [116648] [MD5.00000000000000000000000000000000] [APT] [SparkUpdater] (.Google Inc..) -- C:\Program Files\baidu\Spark\SparkUpdate.exe (.not file.) [0] [MD5.00000000000000000000000000000000] [APT] [TuneUpUtilities_Task_BkGndMaintenance2013] (.Google Inc..) -- C:\Program Files\TuneUp Utilities 2014\OneClick.exe (.not file.) [0] O39 - APT:Automatic Planified Task - (...) -- C:\Windows\Tasks\ASC8_SkipUac_n.job [226] O39 - APT:Automatic Planified Task - (...) -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0400836b82d35.job [894] O39 - APT:Automatic Planified Task - (...) -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d08f015a11158a.job [894] O39 - APT:Automatic Planified Task - (...) -- C:\Windows\Tasks\Uninstaller_SkipUac_n.job [262] O39 - APT: AutoKMSCustom - (.CODYQX4.) -- C:\Windows\System32\Tasks\AutoKMSCustom [3238] =>HackTool.AutoKMS O39 - APT: AutoPico Daily Restart - (.@ByELDI.) -- C:\Windows\System32\Tasks\AutoPico Daily Restart [3356] =>PUA.KMSpico O39 - APT: avast! Emergency Update - (.@ByELDI.) -- C:\Windows\System32\Tasks\avast! Emergency Update [4182] O39 - APT: Baidu PC Faster Service - (.@ByELDI.) -- C:\Windows\System32\Tasks\Baidu PC Faster Service [3624] O39 - APT: Baidu PC Faster Update - (.@ByELDI.) -- C:\Windows\System32\Tasks\Baidu PC Faster Update [3676] O39 - APT:Automatic Planified Task - (...) -- C:\Windows\System32\Tasks\{24CFC712-87A3-4F69-9717-6F26E3B4E23E} [3130] O39 - APT:Automatic Planified Task - (...) -- C:\Windows\System32\Tasks\{408B46CF-001E-4185-BD06-E82B6A75A9E7} [3202] O39 - APT:Automatic Planified Task - (...) -- C:\Windows\System32\Tasks\{B4129328-5E0A-4976-A857-DE1D22CC3685} [3196] ---\\ Software installed (O42) (35) - 5s O42 - Logiciel: Adobe Flash Player 11 ActiveX & Plugin - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player ActiveX O42 - Logiciel: Adobe Flash Player 18 NPAPI - (.Adobe Systems Incorporated.) [HKLM] -- Adobe Flash Player NPAPI O42 - Logiciel: Baidu Cleaner - (.Baidu Inc..) [HKLM] -- Baidu Cleaner O42 - Logiciel: Baidu PC Faster - (.Baidu, Inc..) [HKLM] -- Baidu PC Faster 5.1.0.0 O42 - Logiciel: CCleaner - (.Piriform.) [HKLM] -- CCleaner O42 - Logiciel: Cheat Engine 6.3 - (.Cheat Engine.) [HKLM] -- Cheat Engine 6.3_is1 O42 - Logiciel: Combined Community Codec Pack BETA 2015-05-04 - (.CCCP Project.) [HKLM] -- Combined Community Codec Pack_is1 O42 - Logiciel: ESET Online Scanner v3 - (...) [HKLM] -- ESET Online Scanner O42 - Logiciel: Google Chrome - (.Google Incý.ý.) [HKLM] -- Google Chrome O42 - Logiciel: Internet Download Manager - (.Tonec Inc..) [HKLM] -- Internet Download Manager O42 - Logiciel: Malwarebytes Anti-Malware ÇáäÓÎÉ 2.1.8.1057 - (.Malwarebytes Corporation.) [HKLM] -- Malwarebytes Anti-Malware_is1 O42 - Logiciel: Mozilla Firefox 39.0 (x86 ar) - (.Mozilla.) [HKLM] -- Mozilla Firefox 39.0 (x86 ar) O42 - Logiciel: Mozilla Maintenance Service - (.Mozilla.) [HKLM] -- MozillaMaintenanceService O42 - Logiciel: Supercopier 4.0.1.13 - (.Supercopier.) [HKLM] -- Supercopier O42 - Logiciel: TAP-Windows 9.9.2 - (...) [HKLM] -- TAP-Windows O42 - Logiciel: KMPlayer (remove only) - (.PandoraTV.) [HKLM] -- The KMPlayer O42 - Logiciel: UltraISO Premium V9.62 - (...) [HKLM] -- UltraISO_is1 O42 - Logiciel: Winamp - (.Nullsoft, Inc.) [HKLM] -- Winamp O42 - Logiciel: WinRAR 5.11 (32-bit) - (.win.rar GmbH.) [HKLM] -- WinRAR archiver O42 - Logiciel: Yahoo! Messenger - (.Yahoo! Inc..) [HKLM] -- Yahoo! Messenger O42 - Logiciel: Your Uninstaller! 7 - (.URSoft, Inc..) [HKLM] -- YU2010_is1 O42 - Logiciel: Aegisub 3.2.1 - (.Aegisub Team.) [HKLM] -- {24BC8B57-716C-444F-B46B-A3349B9164C5}_is1 O42 - Logiciel: Emsisoft Anti-Malware - (.Emsisoft Ltd..) [HKLM] -- {5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1 O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM] -- {60EC980A-BDA2-4CB6-A427-B07A5498B4CA} O42 - Logiciel: KMSpico v10 Beta 1 - (...) [HKLM] -- {8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1 =>PUA.KMSpico O42 - Logiciel: ImageShack Uploader 2.2.0 - (.ImageShack Corp..) [HKLM] -- {8BCD7AE7-F713-4D50-BAB9-7839B9386870} O42 - Logiciel: Dell Touchpad - (.ALPS ELECTRIC CO., LTD..) [HKLM] -- {9F72EF8B-AEC9-4CA5-B483-143980AFD6FD} O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM] -- {A92DAB39-4E2C-4304-9AB6-BC44E68B55E2} O42 - Logiciel: Adobe Reader XI (11.0.11) - (.Adobe Systems Incorporated.) [HKLM] -- {AC76BA86-7AD7-1033-7B44-AB0000000001} O42 - Logiciel: NVIDIA nView 141.00 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView O42 - Logiciel: NVIDIA Update 11.10.13 - (.NVIDIA Corporation.) [HKLM] -- {B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update O42 - Logiciel: MegaDownloader 1.3 - (.Andres_age.) [HKLM] -- {C12C2297-65A4-4E64-9AE1-29F0D947FDA0}}_is1 O42 - Logiciel: DkZ Studio - (.abScroll (c) 2005.) [HKLM] -- {F656DC79-013A-4683-8692-B938FC00B941} O42 - Logiciel: Dropbox - (.Dropbox, Inc..) [HKCU] -- Dropbox O42 - Logiciel: µTorrent - (.BitTorrent Inc..) [HKCU] -- uTorrent ---\\ HKCU & HKLM Software Keys (112) - 5s HKLM\SOFTWARE\Adobe HKLM\SOFTWARE\AdwCleaner HKLM\SOFTWARE\Aegisub HKLM\SOFTWARE\AGEIA Technologies HKLM\SOFTWARE\Alps HKLM\SOFTWARE\Apple Computer, Inc. HKLM\SOFTWARE\Baidu HKLM\SOFTWARE\Baidu Cleaner HKLM\SOFTWARE\Baidu Security HKLM\SOFTWARE\Baidu_Drp_pos HKLM\SOFTWARE\BitDefender Parental Control HKLM\SOFTWARE\Bywifi =>Spyware.Bywifi HKLM\SOFTWARE\CDDB HKLM\SOFTWARE\CloudOpt HKLM\SOFTWARE\Combined-Community-Codec-Pack HKLM\SOFTWARE\CoreCodec HKLM\SOFTWARE\CyberLink HKLM\SOFTWARE\EasyBoot Systems HKLM\SOFTWARE\Emsi Software GmbH HKLM\SOFTWARE\EnigmaSoftwareGroup =>PUP.EnigmaSoftware HKLM\SOFTWARE\ESET HKLM\SOFTWARE\Foxit Software HKLM\SOFTWARE\g3n-h@ckm@n HKLM\SOFTWARE\Google HKLM\SOFTWARE\HaaliMkx HKLM\SOFTWARE\InstalledOptions HKLM\SOFTWARE\Intel HKLM\SOFTWARE\Internet Download Manager HKLM\SOFTWARE\IObit HKLM\SOFTWARE\Khronos HKLM\SOFTWARE\KMPlayer HKLM\SOFTWARE\KONAMIPES6 HKLM\SOFTWARE\Licenses HKLM\SOFTWARE\Macromedia HKLM\SOFTWARE\Malwarebytes' Anti-Malware HKLM\SOFTWARE\MediaFire HKLM\SOFTWARE\MegaDownloader HKLM\SOFTWARE\Mozilla HKLM\SOFTWARE\mozilla.org HKLM\SOFTWARE\MozillaPlugins HKLM\SOFTWARE\NVIDIA Corporation HKLM\SOFTWARE\ODBC HKLM\SOFTWARE\Piriform HKLM\SOFTWARE\RegisteredApplications HKLM\SOFTWARE\Synaptics HKLM\SOFTWARE\sysinternals HKLM\SOFTWARE\TAP-Windows HKLM\SOFTWARE\TechSmith HKLM\SOFTWARE\Tencent =>Adware.TencentAddressBar HKLM\SOFTWARE\TuneUp HKLM\SOFTWARE\TypingMaster Inc HKLM\SOFTWARE\Volatile HKLM\SOFTWARE\WinRAR HKLM\SOFTWARE\yahoo HKCU\SOFTWARE\Adobe HKCU\SOFTWARE\Akeo Consulting HKCU\SOFTWARE\Alps HKCU\SOFTWARE\AppDataLow HKCU\SOFTWARE\AvramovicWebSolutions HKCU\SOFTWARE\Baidu HKCU\SOFTWARE\Baidu Cleaner HKCU\SOFTWARE\Baidu Security HKCU\SOFTWARE\Bitdefender HKCU\SOFTWARE\BitTorrent HKCU\SOFTWARE\Bywifi =>Spyware.Bywifi HKCU\SOFTWARE\Cheat Engine HKCU\SOFTWARE\CoreAAC HKCU\SOFTWARE\CyberLink HKCU\SOFTWARE\Device Doctor HKCU\SOFTWARE\DownloadManager HKCU\SOFTWARE\Dropbox HKCU\SOFTWARE\drpsu HKCU\SOFTWARE\DRPSu Updater HKCU\SOFTWARE\EasyBoot Systems HKCU\SOFTWARE\ESET HKCU\SOFTWARE\Foxit Software HKCU\SOFTWARE\Gabest HKCU\SOFTWARE\Google HKCU\SOFTWARE\Haali HKCU\SOFTWARE\ImageShack HKCU\SOFTWARE\ImageShack Corp. HKCU\SOFTWARE\Intel HKCU\SOFTWARE\KMPlayer HKCU\SOFTWARE\LAV HKCU\SOFTWARE\Licenses HKCU\SOFTWARE\Lunascape Corporation HKCU\SOFTWARE\Macromedia HKCU\SOFTWARE\MCAFEE HKCU\SOFTWARE\MediaFire HKCU\SOFTWARE\Mozilla HKCU\SOFTWARE\MozillaPlugins HKCU\SOFTWARE\MPC-HC HKCU\SOFTWARE\Netscape HKCU\SOFTWARE\NVIDIA Corporation HKCU\SOFTWARE\ODBC HKCU\SOFTWARE\PC App Store HKCU\SOFTWARE\Piriform HKCU\SOFTWARE\PolySoft HKCU\SOFTWARE\QtProject HKCU\SOFTWARE\RegisteredApplications HKCU\SOFTWARE\Sysinternals HKCU\SOFTWARE\TechSmith HKCU\SOFTWARE\Tencent =>Adware.TencentAddressBar HKCU\SOFTWARE\Trolltech HKCU\SOFTWARE\TuneUp HKCU\SOFTWARE\Ultracopier HKCU\SOFTWARE\URSoft HKCU\SOFTWARE\Winamp HKCU\SOFTWARE\WinRAR HKCU\SOFTWARE\yahoo HKCU\SOFTWARE\ZebHelpProcess Helper HKCU\SOFTWARE\AppDataLow\Software ---\\ Contents of the Common Files folders (O43) (216) - 6s O43 - CFD: 2015/06/10 15:59:57 - [] D -- C:\Program Files\Adobe O43 - CFD: 2014/10/12 21:33:21 - [] D -- C:\Program Files\Aegisub O43 - CFD: 2014/08/14 02:07:52 - [] D -- C:\Program Files\Avramovic Web Solutions O43 - CFD: 2015/07/08 00:53:49 - [] D -- C:\Program Files\Baidu Cleaner O43 - CFD: 2014/10/31 15:53:53 - [] D -- C:\Program Files\Baidu Security O43 - CFD: 2014/09/12 05:43:10 - [] D -- C:\Program Files\Baidu-Security-2014-4.4.4.80971 O43 - CFD: 2015/02/02 03:36:01 - [] D -- C:\Program Files\CCleaner O43 - CFD: 2015/07/01 08:48:28 - [] D -- C:\Program Files\Cheat Engine 6.3 O43 - CFD: 2015/06/01 21:03:44 - [] D -- C:\Program Files\Combined Community Codec Pack O43 - CFD: 2015/07/06 00:40:06 - [] D -- C:\Program Files\Common Files O43 - CFD: 2014/11/19 09:12:57 - [] D -- C:\Program Files\Comodo O43 - CFD: 2014/07/12 17:13:51 - [] D -- C:\Program Files\CPUID O43 - CFD: 2014/11/26 19:00:36 - [] D -- C:\Program Files\DellTPad O43 - CFD: 2014/07/05 23:47:31 - [] D -- C:\Program Files\DIFX O43 - CFD: 2014/11/03 04:59:03 - [] D -- C:\Program Files\DkZ Studio O43 - CFD: 2015/07/08 06:49:45 - [] D -- C:\Program Files\Emsisoft Anti-Malware O43 - CFD: 2014/07/09 05:24:02 - [] D -- C:\Program Files\Enigma Software Group =>PUP.EnigmaSoftware O43 - CFD: 2015/07/06 07:12:44 - [] D -- C:\Program Files\ESET O43 - CFD: 2015/03/31 08:59:53 - [] D -- C:\Program Files\GameTop.com O43 - CFD: 2014/07/30 03:23:25 - [] D -- C:\Program Files\Google O43 - CFD: 2014/08/14 02:20:08 - [] D -- C:\Program Files\ImageShack Uploader O43 - CFD: 2015/06/10 15:59:57 - [] HD -- C:\Program Files\InstallShield Installation Information O43 - CFD: 2015/05/28 11:16:16 - [] D -- C:\Program Files\Internet Download Manager O43 - CFD: 2014/11/21 03:11:20 - [] D -- C:\Program Files\Internet Explorer O43 - CFD: 2015/06/20 04:04:26 - [] D -- C:\Program Files\IObit O43 - CFD: 2014/09/12 06:22:42 - [] D -- C:\Program Files\Kepard O43 - CFD: 2015/07/02 22:12:42 - [] D -- C:\Program Files\KMSpico =>PUA.KMSpico O43 - CFD: 2015/05/16 09:16:57 - [] D -- C:\Program Files\KMSpicoPortable =>PUA.KMSpico O43 - CFD: 2015/06/27 05:43:52 - [] D -- C:\Program Files\Malwarebytes Anti-Malware O43 - CFD: 2015/06/16 20:58:19 - [] D -- C:\Program Files\MegaDownloader O43 - CFD: 2014/07/05 23:40:46 - [] D -- C:\Program Files\Microsoft Analysis Services O43 - CFD: 2014/12/18 05:03:53 - [] D -- C:\Program Files\Microsoft Office O43 - CFD: 2014/07/05 23:42:42 - [] D -- C:\Program Files\Microsoft Sync Framework O43 - CFD: 2014/11/26 18:34:36 - [] D -- C:\Program Files\Microsoft Visual Studio 8 O43 - CFD: 2014/07/05 23:42:42 - [] D -- C:\Program Files\Microsoft.NET O43 - CFD: 2015/07/05 14:54:53 - [] D -- C:\Program Files\Mozilla Firefox O43 - CFD: 2015/06/03 18:52:01 - [] D -- C:\Program Files\Mozilla Maintenance Service O43 - CFD: 2015/07/05 20:11:20 - [] D -- C:\Program Files\MS Toolkit O43 - CFD: 2014/07/31 11:57:13 - [] D -- C:\Program Files\MSBuild O43 - CFD: 2015/05/15 11:39:36 - [] D -- C:\Program Files\NVIDIA Corporation O43 - CFD: 2015/03/06 15:41:32 - [] D -- C:\Program Files\PC Faster O43 - CFD: 2014/07/31 11:57:13 - [] D -- C:\Program Files\Reference Assemblies O43 - CFD: 2014/07/05 23:47:28 - [] D -- C:\Program Files\STMicroelectronics O43 - CFD: 2014/12/15 06:51:23 - [] D -- C:\Program Files\Supercopier O43 - CFD: 2014/11/26 17:22:12 - [] D -- C:\Program Files\Synaptics O43 - CFD: 2015/05/16 05:43:47 - [] D -- C:\Program Files\TAP-Windows O43 - CFD: 2014/12/23 08:18:11 - [] D -- C:\Program Files\TechSmith O43 - CFD: 2014/11/18 04:01:49 - [] D -- C:\Program Files\TeRM!NaToR O43 - CFD: 2015/05/17 10:25:01 - [] D -- C:\Program Files\UltraISO O43 - CFD: 2015/05/16 10:15:00 - [] D -- C:\Program Files\Win - Tools 161 O43 - CFD: 2014/07/05 23:36:26 - [] D -- C:\Program Files\Winamp O43 - CFD: 2014/11/21 03:11:20 - [] D -- C:\Program Files\Windows Defender O43 - CFD: 2014/11/21 03:11:20 - [] D -- C:\Program Files\Windows Journal O43 - CFD: 2013/08/22 13:11:21 - [] D -- C:\Program Files\Windows Mail O43 - CFD: 2014/11/18 12:57:08 - [] D -- C:\Program Files\Windows Media Player O43 - CFD: 2014/11/18 12:57:13 - [] D -- C:\Program Files\Windows Multimedia Platform O43 - CFD: 2013/08/22 10:17:26 - [] D -- C:\Program Files\Windows NT O43 - CFD: 2013/08/22 13:11:21 - [] D -- C:\Program Files\Windows Photo Viewer O43 - CFD: 2014/11/18 12:57:08 - [] D -- C:\Program Files\Windows Portable Devices O43 - CFD: 2013/08/22 10:17:26 - [] SD -- C:\Program Files\Windows Sidebar O43 - CFD: 2015/07/04 21:19:44 - [] D -- C:\Program Files\WindowsApps O43 - CFD: 2013/08/22 10:17:26 - [] D -- C:\Program Files\WindowsPowerShell O43 - CFD: 2014/10/19 23:39:26 - [] D -- C:\Program Files\WinRAR O43 - CFD: 2014/07/05 23:40:11 - [] D -- C:\Program Files\Yahoo! O43 - CFD: 2015/02/21 07:44:57 - [] D -- C:\Program Files\Your Uninstaller! 7 O43 - CFD: 2013/08/22 10:17:27 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility O43 - CFD: 2013/08/22 13:13:01 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories O43 - CFD: 2014/11/18 12:57:41 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools O43 - CFD: 2015/07/08 00:55:08 - [0] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare 8 O43 - CFD: 2015/07/08 00:55:08 - [0] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Baidu Browser O43 - CFD: 2015/07/08 04:35:54 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Baidu Cleaner O43 - CFD: 2015/07/05 13:42:26 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Baidu PC Faster O43 - CFD: 2015/07/01 08:48:29 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 6.3 O43 - CFD: 2015/06/01 21:03:46 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Combined Community Codec Pack O43 - CFD: 2015/07/08 00:55:08 - [0] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Booster 2 O43 - CFD: 2015/07/06 05:13:18 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware O43 - CFD: 2014/07/30 03:29:28 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome O43 - CFD: 2014/08/14 02:20:08 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImageShack Uploader O43 - CFD: 2015/05/01 04:35:58 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Download Manager O43 - CFD: 2015/07/02 22:12:42 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico =>PUA.KMSpico O43 - CFD: 2013/08/22 10:17:27 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance O43 - CFD: 2015/06/27 05:43:52 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware O43 - CFD: 2015/06/16 20:58:19 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MegaDownloader O43 - CFD: 2014/12/18 05:05:03 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office O43 - CFD: 2014/07/05 23:44:16 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint O43 - CFD: 2015/07/08 00:55:08 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Smart Defrag 4 O43 - CFD: 2014/12/23 08:18:19 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SnagIt 8 O43 - CFD: 2015/06/14 20:08:11 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp O43 - CFD: 2014/11/18 12:57:41 - [] RD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools O43 - CFD: 2013/08/22 13:13:01 - [0] RHD -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC O43 - CFD: 2015/05/17 10:25:01 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltraISO O43 - CFD: 2014/07/05 23:35:51 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Winamp O43 - CFD: 2014/10/19 23:39:28 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR O43 - CFD: 2014/07/05 23:40:13 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yahoo! Messenger O43 - CFD: 2015/02/02 03:22:19 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Your Uninstaller! 7 O43 - CFD: 2014/12/21 00:41:03 - [] D -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\???? O43 - CFD: 2014/10/27 17:54:08 - [] D -- C:\ProgramData\Adobe O43 - CFD: 2013/08/22 09:23:42 - [0] SHD -- C:\ProgramData\Application Data O43 - CFD: 2015/02/04 01:19:40 - [] D -- C:\ProgramData\Baidu O43 - CFD: 2015/05/28 20:27:33 - [] D -- C:\ProgramData\Baidu Cleaner O43 - CFD: 2015/03/06 15:42:35 - [] D -- C:\ProgramData\Baidu Security O43 - CFD: 2014/07/08 02:58:03 - [] D -- C:\ProgramData\BDLogging O43 - CFD: 2014/10/18 16:00:37 - [] D -- C:\ProgramData\Bitdefender O43 - CFD: 2015/07/01 08:48:33 - [] D -- C:\ProgramData\BsrSvc_exe O43 - CFD: 2014/10/27 04:20:44 - [] HD -- C:\ProgramData\Common Files O43 - CFD: 2013/08/22 09:23:42 - [0] SHD -- C:\ProgramData\Desktop O43 - CFD: 2013/08/22 09:23:42 - [0] SHD -- C:\ProgramData\Documents O43 - CFD: 2014/08/17 18:13:05 - [] D -- C:\ProgramData\Emsisoft O43 - CFD: 2015/07/02 10:45:16 - [] D -- C:\ProgramData\ESET O43 - CFD: 2015/04/19 20:25:25 - [] D -- C:\ProgramData\GetRight O43 - CFD: 2014/07/05 23:37:41 - [0] D -- C:\ProgramData\IDM O43 - CFD: 2015/03/08 09:36:37 - [] D -- C:\ProgramData\IObit O43 - CFD: 2015/02/26 06:33:59 - [0] D -- C:\ProgramData\KONAMI O43 - CFD: 2014/10/17 18:39:26 - [] D -- C:\ProgramData\Malwarebytes O43 - CFD: 2014/12/12 02:40:53 - [] D -- C:\ProgramData\McAfee O43 - CFD: 2015/07/08 06:54:44 - [] SD -- C:\ProgramData\Microsoft O43 - CFD: 2014/11/26 18:47:47 - [] D -- C:\ProgramData\Microsoft Help O43 - CFD: 2014/07/25 05:11:55 - [] D -- C:\ProgramData\Microsoft Toolkit O43 - CFD: 2014/07/05 23:37:46 - [] D -- C:\ProgramData\Mozilla O43 - CFD: 2015/05/15 11:40:48 - [] D -- C:\ProgramData\NVIDIA O43 - CFD: 2014/07/05 23:41:03 - [] D -- C:\ProgramData\NVIDIA Corporation O43 - CFD: 2015/06/10 14:31:52 - [] D -- C:\ProgramData\Package Cache O43 - CFD: 2015/03/06 15:44:36 - [] D -- C:\ProgramData\PC Faster O43 - CFD: 2015/03/31 09:01:54 - [] D -- C:\ProgramData\Playrix Entertainment O43 - CFD: 2015/06/28 07:37:42 - [] D -- C:\ProgramData\ProductData O43 - CFD: 2013/08/22 13:13:01 - [] D -- C:\ProgramData\regid.1991-06.com.microsoft O43 - CFD: 2015/07/08 05:21:59 - [0] D -- C:\ProgramData\RpData O43 - CFD: 2013/08/22 09:23:42 - [0] SHD -- C:\ProgramData\Start Menu O43 - CFD: 2014/12/23 08:18:19 - [] D -- C:\ProgramData\TechSmith O43 - CFD: 2015/07/05 22:05:32 - [0] AD -- C:\ProgramData\TEMP O43 - CFD: 2013/08/22 09:23:42 - [0] SHD -- C:\ProgramData\Templates O43 - CFD: 2014/10/27 04:26:32 - [] D -- C:\ProgramData\TuneUp Software O43 - CFD: 2014/07/05 23:40:18 - [] D -- C:\ProgramData\Yahoo! O43 - CFD: 2015/02/23 04:38:00 - [0] D -- C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0} O43 - CFD: 2014/10/27 04:32:06 - [0] SHD -- C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} O43 - CFD: 2015/06/14 20:08:15 - [] D -- C:\Program Files\Common Files\Adobe O43 - CFD: 2014/10/18 15:59:37 - [] D -- C:\Program Files\Common Files\Bitdefender O43 - CFD: 2014/07/05 23:43:42 - [] D -- C:\Program Files\Common Files\DESIGNER O43 - CFD: 2015/05/17 10:24:57 - [] D -- C:\Program Files\Common Files\EZB Systems O43 - CFD: 2015/06/10 15:57:05 - [] D -- C:\Program Files\Common Files\InstallShield O43 - CFD: 2015/02/23 04:37:54 - [] D -- C:\Program Files\Common Files\IObit O43 - CFD: 2014/12/18 05:04:58 - [] D -- C:\Program Files\Common Files\microsoft shared O43 - CFD: 2014/07/05 23:35:42 - [] D -- C:\Program Files\Common Files\PX Storage Engine O43 - CFD: 2013/08/22 10:17:35 - [] D -- C:\Program Files\Common Files\Services O43 - CFD: 2014/12/18 05:03:57 - [] D -- C:\Program Files\Common Files\System O43 - CFD: 2014/07/09 05:23:42 - [] D -- C:\Program Files\Common Files\Wise Installation Wizard O43 - CFD: 2015/06/10 17:21:17 - [] D -- C:\Users\n\AppData\Roaming\Adobe O43 - CFD: 2014/10/12 22:32:54 - [] D -- C:\Users\n\AppData\Roaming\Aegisub O43 - CFD: 2015/02/23 04:38:11 - [] D -- C:\Users\n\AppData\Roaming\Apple Computer O43 - CFD: 2015/05/28 20:26:49 - [] D -- C:\Users\n\AppData\Roaming\Baidu Cleaner O43 - CFD: 2015/03/06 15:42:35 - [] D -- C:\Users\n\AppData\Roaming\Baidu Security O43 - CFD: 2014/07/28 05:03:20 - [] D -- C:\Users\n\AppData\Roaming\Device Doctor O43 - CFD: 2015/07/08 04:00:13 - [] D -- C:\Users\n\AppData\Roaming\DMCache O43 - CFD: 2014/12/23 16:34:39 - [] D -- C:\Users\n\AppData\Roaming\Dropbox O43 - CFD: 2014/10/18 16:22:37 - [0] D -- C:\Users\n\AppData\Roaming\DRPSu O43 - CFD: 2014/10/13 21:38:52 - [] D -- C:\Users\n\AppData\Roaming\EurekaLab s.a.s O43 - CFD: 2014/10/12 21:35:50 - [] D -- C:\Users\n\AppData\Roaming\fontconfig O43 - CFD: 2015/06/10 14:32:28 - [] D -- C:\Users\n\AppData\Roaming\Foxit Software O43 - CFD: 2015/04/19 20:25:25 - [] D -- C:\Users\n\AppData\Roaming\GetRight O43 - CFD: 2015/07/08 00:55:17 - [] D -- C:\Users\n\AppData\Roaming\IDM O43 - CFD: 2015/06/20 04:04:22 - [] D -- C:\Users\n\AppData\Roaming\IObit O43 - CFD: 2014/08/15 11:14:06 - [] D -- C:\Users\n\AppData\Roaming\Lunascape O43 - CFD: 2014/07/08 19:21:30 - [] D -- C:\Users\n\AppData\Roaming\Macromedia O43 - CFD: 2014/07/09 16:56:05 - [0] D -- C:\Users\n\AppData\Roaming\Media Player Classic O43 - CFD: 2014/12/23 08:30:31 - [] SD -- C:\Users\n\AppData\Roaming\Microsoft O43 - CFD: 2014/07/07 00:13:25 - [] D -- C:\Users\n\AppData\Roaming\Mozilla O43 - CFD: 2015/07/06 00:56:17 - [] D -- C:\Users\n\AppData\Roaming\MPC-HC O43 - CFD: 2014/10/12 21:44:20 - [] D -- C:\Users\n\AppData\Roaming\NVIDIA O43 - CFD: 2015/03/06 15:42:14 - [] D -- C:\Users\n\AppData\Roaming\PC Faster O43 - CFD: 2015/04/20 14:22:35 - [] D -- C:\Users\n\AppData\Roaming\ProductData O43 - CFD: 2014/07/08 00:43:53 - [0] D -- C:\Users\n\AppData\Roaming\QuickScan O43 - CFD: 2014/10/27 04:22:54 - [] D -- C:\Users\n\AppData\Roaming\TuneUp Software O43 - CFD: 2014/08/12 16:48:48 - [] D -- C:\Users\n\AppData\Roaming\TypingMaster7 O43 - CFD: 2014/07/09 04:24:29 - [] D -- C:\Users\n\AppData\Roaming\URSoft O43 - CFD: 2015/06/13 17:41:33 - [] D -- C:\Users\n\AppData\Roaming\uTorrent O43 - CFD: 2015/07/05 16:47:59 - [] D -- C:\Users\n\AppData\Roaming\Winamp O43 - CFD: 2014/07/08 16:25:47 - [] D -- C:\Users\n\AppData\Roaming\WinRAR O43 - CFD: 2015/02/09 20:59:23 - [] D -- C:\Users\n\AppData\Roaming\Yahoo! O43 - CFD: 2015/07/08 06:55:13 - [] D -- C:\Users\n\AppData\Roaming\ZHP O43 - CFD: 2015/05/28 17:30:54 - [] D -- C:\Users\n\AppData\Local\Adobe O43 - CFD: 2014/10/12 21:44:01 - [] D -- C:\Users\n\AppData\Local\Aegisub O43 - CFD: 2014/07/05 23:27:20 - [0] SHD -- C:\Users\n\AppData\Local\Application Data O43 - CFD: 2014/11/19 09:13:25 - [] D -- C:\Users\n\AppData\Local\Comodo O43 - CFD: 2014/12/27 08:15:16 - [0] D -- C:\Users\n\AppData\Local\Diagnostics O43 - CFD: 2014/12/15 20:37:14 - [] SHD -- C:\Users\n\AppData\Local\EmieSiteList O43 - CFD: 2014/12/15 20:37:14 - [] SHD -- C:\Users\n\AppData\Local\EmieUserList O43 - CFD: 2014/07/08 16:33:22 - [] D -- C:\Users\n\AppData\Local\Google O43 - CFD: 2014/07/05 23:27:20 - [0] SHD -- C:\Users\n\AppData\Local\History O43 - CFD: 2014/07/09 22:06:32 - [] D -- C:\Users\n\AppData\Local\Macromedia O43 - CFD: 2015/05/10 07:38:02 - [] D -- C:\Users\n\AppData\Local\MegaDownloader O43 - CFD: 2014/10/18 04:20:58 - [] D -- C:\Users\n\AppData\Local\Microsoft O43 - CFD: 2014/07/05 23:40:27 - [0] D -- C:\Users\n\AppData\Local\Microsoft Help O43 - CFD: 2014/07/07 00:13:25 - [] D -- C:\Users\n\AppData\Local\Mozilla O43 - CFD: 2014/07/05 23:29:09 - [] D -- C:\Users\n\AppData\Local\Packages O43 - CFD: 2014/07/08 03:06:18 - [] D -- C:\Users\n\AppData\Local\Programs O43 - CFD: 2014/12/23 08:18:11 - [] D -- C:\Users\n\AppData\Local\TechSmith O43 - CFD: 2015/07/08 06:55:04 - [] D -- C:\Users\n\AppData\Local\Temp O43 - CFD: 2014/07/05 23:27:20 - [0] SHD -- C:\Users\n\AppData\Local\Temporary Internet Files O43 - CFD: 2014/10/30 08:28:38 - [] D -- C:\Users\n\AppData\Local\TuneUp Software O43 - CFD: 2014/12/17 01:22:04 - [] D -- C:\Users\n\AppData\Local\VirtualStore O43 - CFD: 2013/08/22 10:17:27 - [] RD -- C:\Users\n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility O43 - CFD: 2013/08/22 10:17:27 - [] RD -- C:\Users\n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories O43 - CFD: 2014/07/05 23:27:41 - [] RD -- C:\Users\n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools O43 - CFD: 2015/05/28 20:26:34 - [] D -- C:\Users\n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Baidu Cleaner O43 - CFD: 2015/03/06 15:44:06 - [] D -- C:\Users\n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Baidu PC Faster O43 - CFD: 2014/12/10 16:19:01 - [] D -- C:\Users\n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox O43 - CFD: 2015/05/08 00:43:42 - [] D -- C:\Users\n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome O43 - CFD: 2015/05/01 04:35:58 - [] D -- C:\Users\n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Download Manager O43 - CFD: 2013/08/22 10:17:27 - [] D -- C:\Users\n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance O43 - CFD: 2014/12/31 18:06:50 - [] RD -- C:\Users\n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup O43 - CFD: 2014/12/15 04:59:12 - [] D -- C:\Users\n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Supercopier O43 - CFD: 2013/08/22 10:17:27 - [] RD -- C:\Users\n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools O43 - CFD: 2014/11/21 03:08:58 - [] D -- C:\Users\n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The KMPlayer O43 - CFD: 2014/10/19 23:39:28 - [] D -- C:\Users\n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR O43 - CFD: 2015/06/18 23:42:23 - [] D -- C:\Users\n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\þÊØÈíÞÇÊ Chrome O43 - CFD: 2014/12/21 00:41:03 - [] D -- C:\Users\n\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\???? ---\\ System Drivers List (SDL) (O58) (75) - 7s O58 - SDL:2015/07/06 22:22:04 A . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Windows\System32\drivers\04014D5F.sys [98520] O58 - SDL:2015/01/28 16:21:02 A . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Windows\System32\drivers\1BA33287.sys [114904] O58 - SDL:2015/07/06 13:23:41 A . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Windows\System32\drivers\20DB31DB.sys [98520] O58 - SDL:2015/07/07 21:20:24 A . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Windows\System32\drivers\2E906CCA.sys [98520] O58 - SDL:2013/08/22 07:33:26 A . (.LSI - LSI 3ware SCSI Storport Driver.) -- C:\Windows\System32\drivers\3ware.sys [86368] O58 - SDL:2013/08/22 07:33:25 A . (.PMC-Sierra - PMC-Sierra Storport Driver For SPC8x6G SAS.) -- C:\Windows\System32\drivers\adp80xx.sys [773472] O58 - SDL:2013/08/22 07:33:25 A . (.Advanced Micro Devices - AHCI 1.3 Device Driver.) -- C:\Windows\System32\drivers\amdsata.sys [72544] O58 - SDL:2013/08/22 07:33:26 A . (.AMD Technologies Inc. - AMD Technology AHCI Compatible Controller D.) -- C:\Windows\System32\drivers\amdsbs.sys [215392] O58 - SDL:2013/08/22 07:33:24 A . (.Advanced Micro Devices - Storage Filter Driver.) -- C:\Windows\System32\drivers\amdxata.sys [22880] O58 - SDL:2014/11/26 17:13:51 A . (.Alps Electric Co., Ltd. - Alps Touch Pad Driver.) -- C:\Windows\System32\drivers\Apfiltr.sys [469808] O58 - SDL:2013/08/22 07:33:26 A . (.PMC-Sierra, Inc. - Adaptec SAS RAID WS03 Driver.) -- C:\Windows\System32\drivers\arcsas.sys [101728] O58 - SDL:2013/08/13 01:25:32 A . (.Windows (R) Win 7 DDK provider - BCM Function 2 Device Driver.) -- C:\Windows\System32\drivers\bcmfn2.sys [16088] O58 - SDL:2015/03/31 08:14:18 A . (.Baidu, Inc. - Baidu Antivirus Hook Base.) -- C:\Windows\System32\drivers\Bhbase.sys [47408] O58 - SDL:2015/04/09 14:02:04 A . (.Baidu, Inc. - Baidu Antivirus Minifilter Driver.) -- C:\Windows\System32\drivers\BProtectEx.sys [113992] O58 - SDL:2013/10/10 18:31:14 A . (.Broadcom Corporation - Broadcom Credential Vault USB Driver.) -- C:\Windows\System32\drivers\cvusbdrv.sys [42720] O58 - SDL:2013/08/22 03:42:19 A . (.Intel Corporation - Intel(R) PRO/1000 Adapter NDIS 6 deserializ.) -- C:\Windows\System32\drivers\E1G60I32.sys [119296] O58 - SDL:2013/06/18 14:21:30 A . (.Intel Corporation - Intel(R) Gigabit Adapter NDIS 6.x driver.) -- C:\Windows\System32\drivers\e1i6332.sys [379904] O58 - SDL:2013/02/20 19:02:06 A . (.Intel Corporation - Intel(R) Gigabit Adapter NDIS 6.x driver.) -- C:\Windows\System32\drivers\e1k6332.sys [407400] O58 - SDL:2015/01/30 16:13:30 A . (.ESET - Epfw NDIS LightWeight Filter.) -- C:\Windows\System32\drivers\EpfwLWF.sys [37928] O58 - SDL:2015/03/24 00:17:08 A . (.Emsisoft GmbH - Emsisoft Anti-Malware Platform Protection.) -- C:\Windows\System32\drivers\epp32.sys [111368] O58 - SDL:2013/02/19 10:59:36 A . (.Intel Corporation - Intel(R) Management Engine Interface.) -- C:\Windows\System32\drivers\HECI.sys [49272] O58 - SDL:2013/08/22 07:33:29 A . (.Hewlett-Packard Company - Smart Array SAS/SATA Controller Media Drive.) -- C:\Windows\System32\drivers\HpSAMD.sys [56672] O58 - SDL:2015/05/29 19:13:02 A . (.REALiX(tm) - HWiNFO x86 Kernel Driver.) -- C:\Windows\System32\drivers\HWiNFO32.SYS [23840] O58 - SDL:2013/07/23 23:18:30 AC . (.Intel Corporation - Intel(R) Atom(TM) Processor GPIO Controller.) -- C:\Windows\System32\drivers\iaiogpio.sys [22016] O58 - SDL:2013/07/23 23:18:30 AC . (.Intel Corporation - Intel(R) Atom(TM) Processor I2C Controller.) -- C:\Windows\System32\drivers\iaioi2c.sys [61936] O58 - SDL:2013/09/20 14:42:34 A . (.Intel Corporation - Intel Rapid Storage Technology driver - x86.) -- C:\Windows\System32\drivers\iaStorA.sys [488808] O58 - SDL:2013/08/10 02:39:44 A . (.Intel Corporation - Intel Rapid Storage Technology driver (inbo.) -- C:\Windows\System32\drivers\iaStorAV.sys [524784] O58 - SDL:2013/08/22 07:33:29 A . (.Intel Corporation - Intel Matrix Storage Manager driver - ia32.) -- C:\Windows\System32\drivers\iaStorV.sys [333664] O58 - SDL:2015/05/20 14:55:54 A . (.Tonec Inc. - Internet Download Manager WFP Driver.) -- C:\Windows\System32\drivers\idmwfp.sys [123968] O58 - SDL:2010/02/26 14:31:24 A . (.Intel Corporation - Intel(R) Turbo Boost Technology Driver.) -- C:\Windows\System32\drivers\Impcd.sys [132480] O58 - SDL:2013/08/22 07:33:29 A . (.LSI Corporation - LSI Fusion-MPT SAS Driver (StorPort).) -- C:\Windows\System32\drivers\lsi_sas.sys [94048] O58 - SDL:2013/08/22 07:33:30 A . (.LSI Corporation - LSI SAS Gen2 Driver (StorPort).) -- C:\Windows\System32\drivers\lsi_sas2.sys [79712] O58 - SDL:2013/08/22 07:33:30 A . (.LSI Corporation - LSI SAS Gen3 Driver (StorPort).) -- C:\Windows\System32\drivers\lsi_sas3.sys [68960] O58 - SDL:2013/08/22 07:33:29 A . (.LSI Corporation - LSI SSS PCIe/Flash Driver (StorPort).) -- C:\Windows\System32\drivers\lsi_sss.sys [69472] O58 - SDL:2015/06/18 08:41:36 A . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Windows\System32\drivers\mbam.sys [23256] O58 - SDL:2015/06/18 08:41:42 A . (.Malwarebytes Corporation - Malwarebytes Chameleon Protection Driver.) -- C:\Windows\System32\drivers\mbamchameleon.sys [94936] O58 - SDL:2015/07/08 06:14:15 A . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Windows\System32\drivers\MBAMSwissArmy.sys [98520] O58 - SDL:2013/08/22 07:33:30 A . (.LSI Corporation - MEGASAS RAID Controller Driver for Windows.) -- C:\Windows\System32\drivers\megasas.sys [51552] O58 - SDL:2013/08/22 07:33:29 A . (.LSI Corporation, Inc. - LSI MegaRAID Software RAID Driver.) -- C:\Windows\System32\drivers\megasr.sys [464736] O58 - SDL:2013/08/22 07:33:32 A . (.Marvell Semiconductor, Inc. - Marvell Flash Controller Driver.) -- C:\Windows\System32\drivers\mvumis.sys [58208] O58 - SDL:2015/06/18 08:41:58 A . (.Malwarebytes Corporation - Malwarebytes Web Access Control.) -- C:\Windows\System32\drivers\mwac.sys [51928] O58 - SDL:2015/05/28 20:32:13 A . (.NT Kernel Resources - NDISRD helper driver.) -- C:\Windows\System32\drivers\ndisrd.sys [36896] O58 - SDL:2014/11/26 17:24:37 A . (.Intel Corporation - Intel® Wireless WiFi Link Driver.) -- C:\Windows\System32\drivers\NETwen00.sys [2678752] O58 - SDL:2015/02/21 06:41:54 A . (.Intel Corporation - Intel® Wireless WiFi Link Driver.) -- C:\Windows\System32\drivers\NETwen01.sys [2681104] O58 - SDL:2014/11/26 17:14:58 A . (.NVIDIA Corporation - NVIDIA HDMI Audio Driver.) -- C:\Windows\System32\drivers\nvhda32v.sys [162592] O58 - SDL:2015/05/15 11:38:59 A . (.NVIDIA Corporation - NVIDIA Windows Kernel Mode Driver, Version.) -- C:\Windows\System32\drivers\nvlddmkm.sys [10702024] O58 - SDL:2013/08/22 07:33:32 A . (.NVIDIA Corporation - NVIDIA® nForce(TM) RAID Driver.) -- C:\Windows\System32\drivers\nvraid.sys [120160] O58 - SDL:2013/08/22 07:33:33 A . (.NVIDIA Corporation - NVIDIA® nForce(TM) Sata Performance Driver.) -- C:\Windows\System32\drivers\nvstor.sys [141664] O58 - SDL:2010/08/25 08:11:08 A . (.REDC - RICOH PCIe SD/MMC Driver.) -- C:\Windows\System32\drivers\risdsne86.sys [57856] O58 - SDL:2013/08/22 10:16:47 A . (.Macrovision Corporation, Macrovision Europe Limited, - Macrovision SECURITY Driver.) -- C:\Windows\System32\drivers\secdrv.sys [20480] O58 - SDL:2013/08/22 07:32:56 A . (.Silicon Integrated Systems Corp. - SiS RAID Stor Miniport Driver.) -- C:\Windows\System32\drivers\sisraid2.sys [41312] O58 - SDL:2013/08/22 07:32:57 A . (.Silicon Integrated Systems - SiS AHCI Stor-Miniport Driver.) -- C:\Windows\System32\drivers\sisraid4.sys [79200] O58 - SDL:2015/06/28 08:51:24 A . (.Synaptics Incorporated - Synaptics SMBus Driver.) -- C:\Windows\System32\drivers\Smb_driver_Intel.sys [25840] O58 - SDL:2012/07/14 01:31:16 A . (.ST Microelectronics - Disk Class Filter Driver for Accelerometer.) -- C:\Windows\System32\drivers\stdcfltn.sys [17944] O58 - SDL:2013/08/22 07:32:57 A . (.Promise Technology, Inc. - Promise SuperTrak EX Series Driver for Wind.) -- C:\Windows\System32\drivers\stexstor.sys [26976] O58 - SDL:2013/08/06 08:08:14 A . (.STMicroelectronics - STM Accelerometer Device Driver.) -- C:\Windows\System32\drivers\ST_Accel.sys [66560] O58 - SDL:2013/08/22 14:40:22 A . (.The OpenVPN Project - TAP-Windows Virtual Network Driver.) -- C:\Windows\System32\drivers\tap0901.sys [35288] O58 - SDL:2013/08/22 07:33:00 A . (.VIA Technologies, Inc. - VIA Generic PCI IDE Bus Driver.) -- C:\Windows\System32\drivers\viaide.sys [18272] O58 - SDL:2013/08/22 07:33:01 A . (.VIA Technologies Inc.,Ltd - VIA RAID DRIVER FOR X86-32.) -- C:\Windows\System32\drivers\vsmraid.sys [148832] O58 - SDL:2013/08/22 07:33:01 A . (.VIA Corporation - VIA StorX RAID Controller Driver.) -- C:\Windows\System32\drivers\VSTXRAID.SYS [276832] O58 - SDL:2014/11/03 19:43:35 A . (...) -- C:\Windows\System32\ANSI.SYS [9029] O58 - SDL:2014/11/03 19:43:35 A . (...) -- C:\Windows\System32\country.sys [27097] O58 - SDL:2014/11/03 19:43:35 A . (...) -- C:\Windows\System32\HIMEM.SYS [4768] O58 - SDL:2014/11/03 19:43:36 A . (...) -- C:\Windows\System32\KEY01.SYS [42809] O58 - SDL:2014/11/03 19:43:36 A . (...) -- C:\Windows\System32\KEYBOARD.SYS [42537] O58 - SDL:2014/11/03 19:43:36 A . (...) -- C:\Windows\System32\NTDOS.SYS [27866] O58 - SDL:2014/11/03 19:43:35 A . (...) -- C:\Windows\System32\NTDOS404.SYS [29146] O58 - SDL:2014/11/03 19:43:35 A . (...) -- C:\Windows\System32\NTDOS411.SYS [29370] O58 - SDL:2014/11/03 19:43:35 A . (...) -- C:\Windows\System32\NTDOS412.SYS [29274] O58 - SDL:2014/11/03 19:43:35 A . (...) -- C:\Windows\System32\NTDOS804.SYS [29146] O58 - SDL:2014/11/03 19:43:37 A . (...) -- C:\Windows\System32\NTIO.SYS [33968] O58 - SDL:2014/11/03 19:43:35 A . (...) -- C:\Windows\System32\NTIO404.SYS [34688] O58 - SDL:2014/11/03 19:43:35 A . (...) -- C:\Windows\System32\NTIO411.SYS [35776] O58 - SDL:2014/11/03 19:43:35 A . (...) -- C:\Windows\System32\NTIO412.SYS [35552] O58 - SDL:2014/11/03 19:43:35 A . (...) -- C:\Windows\System32\NTIO804.SYS [34688] ---\\ Last modified or created user files (O61) (15) - 26s O61 - LFC: 2015/07/04 19:25:02 A . (.Avast Software s.r.o..) -- C:\Users\n\Desktop\avastclear.exe [5684904] O61 - LFC: 2015/07/06 05:08:29 A . (.Emsisoft Ltd..) -- C:\Users\n\Desktop\EmsisoftAntiMalwareSetup.exe [166954184] O61 - LFC: 2015/07/06 07:12:07 A . (.ESET.) -- C:\Users\n\Desktop\esetsmartinstaller_enu.exe [2870984] O61 - LFC: 2015/07/05 22:12:15 A . (.ESET.) -- C:\Users\n\Desktop\eset_smart_security_live_installer.exe [1661128] O61 - LFC: 2015/07/06 07:11:06 A . (.Kaspersky Lab ZAO.) -- C:\Users\n\Desktop\KVRT.exe [102934688] O61 - LFC: 2015/07/05 15:22:32 A . (..) -- C:\Users\n\Desktop\mos0wk1b.exe [166114712] O61 - LFC: 2015/07/08 03:58:44 A . (.SosVirus.) -- C:\Users\n\Desktop\Pre_Scan.exe [3317384] O61 - LFC: 2015/07/08 04:27:28 A . (.Tonec Inc..) -- C:\Users\n\AppData\Roaming\IDM\idmmzcc5\components2\idmcchandler2.dll [332824] O61 - LFC: 2015/07/08 04:27:28 A . (.Tonec Inc..) -- C:\Users\n\AppData\Roaming\IDM\idmmzcc5\components2\idmcchandler2_64.dll [460824] O61 - LFC: 2015/07/08 04:27:28 A . (.Tonec Inc..) -- C:\Users\n\AppData\Roaming\IDM\idmmzcc5\components2\idmmzcc.dll [34216] O61 - LFC: 2015/07/08 04:27:28 A . (.Tonec Inc..) -- C:\Users\n\AppData\Roaming\IDM\idmmzcc5\components2\idmmzcc64.dll [28512] O61 - LFC: 2015/07/08 04:27:28 A . (.Tonec Inc..) -- C:\Users\n\AppData\Roaming\IDM\idmmzcc5\components12\idmmzcc.dll [26648] O61 - LFC: 2015/07/08 04:27:28 A . (.Tonec Inc..) -- C:\Users\n\AppData\Roaming\IDM\idmmzcc5\components12\idmmzcc64.dll [31768] O61 - LFC: 2015/07/08 04:27:28 A . (.Tonec Inc..) -- C:\Users\n\AppData\Roaming\IDM\idmmzcc5\components\idmmzcc.dll [34216] O61 - LFC: 2015/07/08 06:34:24 A . (..) -- C:\Users\n\AppData\Local\Google\Chrome\User Data\ev_hashes_whitelist.bin [1113849] ---\\ File Associations Shell Spawning (O67) (9) - 0s O67 - Shell Spawning: <.bat> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.cpl> [HKLM\..\cplopen\Command] (.Microsoft Corporation - Windows Control Panel.) -- C:\Windows\System32\control.exe O67 - Shell Spawning: <.cmd> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.com> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.exe> [HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.html> [HKLM\..\open\Command] (...) -- C:\Program Files\baidu\Spark\Spark.exe O67 - Shell Spawning: <.js> [HKLM\..\open\Command] (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\Windows\System32\wscript.exe O67 - Shell Spawning: <.reg> [HKLM\..\open\Command] (.Microsoft Corporation - Registry Editor.) -- C:\Windows\regedit.exe O67 - Shell Spawning: <.scr> [HKLM\..\open\Command] (...) -- "%1" /S ---\\ Start Menu Internet (SMI) (O68) (16) - 0s O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- C:\Program Files\baidu\Spark\Spark.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files\Mozilla Firefox\firefox.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe O68 - StartMenuInternet: [HKLM\..\InstallInfo\ShowIconsCommand] (...) -- C:\Program Files\baidu\Spark\Spark.exe (.not file.) O68 - StartMenuInternet: [HKLM\..\InstallInfo\ShowIconsCommand] (.Mozilla Corporation - Firefox Helper.) -- C:\Program Files\Mozilla Firefox\uninstall\helper.exe O68 - StartMenuInternet: [HKLM\..\InstallInfo\ShowIconsCommand] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\InstallInfo\ShowIconsCommand] (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\Windows\System32\ie4uinit.exe O68 - StartMenuInternet: [HKLM\..\InstallInfo\ReinstallCommand] (...) -- C:\Program Files\baidu\Spark\Spark.exe (.not file.) O68 - StartMenuInternet: [HKLM\..\InstallInfo\ReinstallCommand] (.Mozilla Corporation - Firefox Helper.) -- C:\Program Files\Mozilla Firefox\uninstall\helper.exe O68 - StartMenuInternet: [HKLM\..\InstallInfo\ReinstallCommand] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\InstallInfo\ReinstallCommand] (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\Windows\System32\ie4uinit.exe O68 - StartMenuInternet: [HKLM\..\InstallInfo\HideIconsCommand] (...) -- C:\Program Files\baidu\Spark\Spark.exe (.not file.) O68 - StartMenuInternet: [HKLM\..\InstallInfo\HideIconsCommand] (.Mozilla Corporation - Firefox Helper.) -- C:\Program Files\Mozilla Firefox\uninstall\helper.exe O68 - StartMenuInternet: [HKLM\..\InstallInfo\HideIconsCommand] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: [HKLM\..\InstallInfo\HideIconsCommand] (.Microsoft Corporation - IE Per-User Initialization Utility.) -- C:\Windows\System32\ie4uinit.exe ---\\ Search Browser Infection (SBI) (O69) (1) - 8s O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com/ ---\\ Search Svchost Services (SSS) (O83) (34) - 1s O83 - Search Svchost Services: AeLookupSvc (AeLookupSvc) . (.Microsoft Corporation - Application Experience Service.) -- C:\Windows\System32\aelupsvc.dll [160768] O83 - Search Svchost Services: CertPropSvc (CertPropSvc) . (.Microsoft Corporation - Microsoft Smartcard Certificate Propagation.) -- C:\Windows\System32\certprop.dll [128512] O83 - Search Svchost Services: SCPolicySvc (SCPolicySvc) . (.Microsoft Corporation - Microsoft Smartcard Certificate Propagation.) -- C:\Windows\System32\certprop.dll [128512] O83 - Search Svchost Services: lanmanserver (lanmanserver) . (.Microsoft Corporation - Server Service DLL.) -- C:\Windows\System32\srvsvc.dll [244224] O83 - Search Svchost Services: gpsvc (gpsvc) . (.Microsoft Corporation - Group Policy Client.) -- C:\Windows\System32\gpsvc.dll [1165312] O83 - Search Svchost Services: IKEEXT (IKEEXT) . (.Microsoft Corporation - IKE extension.) -- C:\Windows\System32\IKEEXT.DLL [731648] O83 - Search Svchost Services: iphlpsvc (iphlpsvc) . (.Microsoft Corporation - Service that offers IPv6 connectivity over.) -- C:\Windows\System32\iphlpsvc.dll [795648] O83 - Search Svchost Services: seclogon (seclogon) . (.Microsoft Corporation - Secondary Logon Service DLL.) -- C:\Windows\System32\seclogon.dll [23040] O83 - Search Svchost Services: AppInfo (AppInfo) . (.Microsoft Corporation - Application Information Service.) -- C:\Windows\System32\appinfo.dll [88576] O83 - Search Svchost Services: msiscsi (msiscsi) . (.Microsoft Corporation - iSCSI Discovery service.) -- C:\Windows\System32\iscsiexe.dll [116224] O83 - Search Svchost Services: EapHost (EapHost) . (.Microsoft Corporation - Microsoft EAPHost service.) -- C:\Windows\System32\eapsvc.dll [91136] O83 - Search Svchost Services: schedule (schedule) . (.Microsoft Corporation - Task Scheduler Service.) -- C:\Windows\System32\schedsvc.dll [980480] O83 - Search Svchost Services: winmgmt (winmgmt) . (.Microsoft Corporation - WMI.) -- C:\Windows\System32\wbem\WMIsvc.dll [174592] O83 - Search Svchost Services: MMCSS (MMCSS) . (.Microsoft Corporation - Multimedia Class Scheduler Service.) -- C:\Windows\System32\mmcss.dll [73728] O83 - Search Svchost Services: browser (browser) . (.Microsoft Corporation - Computer Browser Service DLL.) -- C:\Windows\System32\browser.dll [105472] O83 - Search Svchost Services: ProfSvc (ProfSvc) . (.Microsoft Corporation - ProfSvc.) -- C:\Windows\System32\profsvc.dll [184832] O83 - Search Svchost Services: SessionEnv (SessionEnv) . (.Microsoft Corporation - Remote Desktop Configuration service.) -- C:\Windows\System32\SessEnv.dll [280576] O83 - Search Svchost Services: wercplsupport (wercplsupport) . (.Microsoft Corporation - Problem Reports and Solutions.) -- C:\Windows\System32\wercplsupport.dll [59392] O83 - Search Svchost Services: hkmsvc (hkmsvc) . (.Microsoft Corporation - Key Management Service.) -- C:\Windows\System32\KMSVC.DLL [75776] O83 - Search Svchost Services: Themes (Themes) . (.Microsoft Corporation - Windows Shell Theme Service Dll.) -- C:\Windows\System32\themeservice.dll [37376] O83 - Search Svchost Services: wlidsvc (wlidsvc) . (.Microsoft Corporation - Microsoft® Account Service.) -- C:\Windows\System32\wlidsvc.dll [1203200] O83 - Search Svchost Services: lfsvc (lfsvc) . (.Microsoft Corporation - Windows Location Framework Service.) -- C:\Windows\System32\GeofenceMonitorService.dll [357376] O83 - Search Svchost Services: BDESVC (BDESVC) . (.Microsoft Corporation - BDE Service.) -- C:\Windows\System32\bdesvc.dll [299008] O83 - Search Svchost Services: DsmSvc (DsmSvc) . (.Microsoft Corporation - Device Setup Manager.) -- C:\Windows\System32\DeviceSetupManager.dll [165376] O83 - Search Svchost Services: NcaSvc (NcaSvc) . (.Microsoft Corporation - Microsoft Network Connectivity Assistant Se.) -- C:\Windows\System32\NcaSvc.dll [141312] O83 - Search Svchost Services: Rasauto (Rasauto) . (.Microsoft Corporation - Remote Access AutoDial Manager.) -- C:\Windows\System32\rasauto.dll [93696] O83 - Search Svchost Services: Rasman (Rasman) . (.Microsoft Corporation - Remote Access Connection Manager.) -- C:\Windows\System32\rasmans.dll [457216] O83 - Search Svchost Services: Remoteaccess (Remoteaccess) . (.Microsoft Corporation - Dynamic Interface Manager.) -- C:\Windows\System32\mprdim.dll [177664] O83 - Search Svchost Services: SENS (SENS) . (.Microsoft Corporation - System Event Notification Service (SENS).) -- C:\Windows\System32\Sens.dll [54784] O83 - Search Svchost Services: Sharedaccess (Sharedaccess) . (.Microsoft Corporation - Microsoft NAT Helper Components.) -- C:\Windows\System32\ipnathlp.dll [380928] O83 - Search Svchost Services: Tapisrv (Tapisrv) . (.Microsoft Corporation - Microsoft® Windows(TM) Telephony Server.) -- C:\Windows\System32\tapisrv.dll [248320] O83 - Search Svchost Services: wuauserv (wuauserv) . (.Microsoft Corporation - Windows Update Agent.) -- C:\Windows\System32\wuaueng.dll [2767360] O83 - Search Svchost Services: BITS (BITS) . (.Microsoft Corporation - Background Intelligent Transfer Service.) -- C:\Windows\System32\qmgr.dll [801792] O83 - Search Svchost Services: ShellHWDetection (ShellHWDetection) . (.Microsoft Corporation - Windows Shell Services Dll.) -- C:\Windows\System32\shsvcs.dll [564736] ---\\ Firewall Active Exception List (FirewallRules) (O87) (4) - 1s O87 - FAEL: "{C29E22A9-9B47-40F4-800D-EFD6CF05B3CF}" [In-None-P6-TRUE] .(.@ByELDI - KMS GUI ELDI.) -- C:\Program Files\KMSpico\KMSELDI.exe =>PUA.KMSpico O87 - FAEL: "{27A96D93-4D63-4545-882C-4109FD574643}" [In-None-P17-TRUE] .(.@ByELDI - KMS GUI ELDI.) -- C:\Program Files\KMSpico\KMSELDI.exe =>PUA.KMSpico O87 - FAEL: "{E0C7FE50-1E6B-4799-9278-293DE5E92A95}" [In-None-P6-TRUE] .(.@ByELDI - Service_KMS.) -- C:\Program Files\KMSpico\Service_KMS.exe =>PUA.KMSpico O87 - FAEL: "{78D630D8-86B4-4DCC-A383-2FEFB0514FB6}" [In-None-P17-TRUE] .(.@ByELDI - Service_KMS.) -- C:\Program Files\KMSpico\Service_KMS.exe =>PUA.KMSpico ---\\ General States of Services not Microsoft (EGS) (SR=Running, SS=Stopped) (15) - 24s SR - Auto [2015/05/26 18:14:10] [ 5155576] Emsisoft Protection Service (a2AntiMalware) . (.Emsisoft Ltd.) - C:\Program Files\Emsisoft Anti-Malware\a2service.exe SS - Demand [2015/05/01 20:10:42] [ 81088] Adobe Acrobat Update Service (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe SS - Demand [2015/06/28 08:14:59] [ 268976] Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe SR - Auto [2014/11/26 17:13:53] [ 76120] @oem25.inf,%HidMonitor.SvcDisp%;Alps HID Monitor Service (ApHidMonitorService) . (.Alps Electric Co., Ltd..) - C:\Program Files\DellTPad\HidMonitorSvc.exe SR - Auto [2014/12/17 14:15:28] [ 208928] Baidu MoboMarket Service (BASSVC) . (.Baidu, Inc..) - C:\Program Files\Baidu Security\MoboMarket\1.2.8.4379\bassvc.exe SR - Auto [2015/05/25 11:05:08] [ 1697896] Baidu Cleaner Service (BCleanerSvc) . (.Baidu Inc..) - C:\Program Files\Baidu Cleaner\BCleanerSvc.exe SS - Demand [2015/05/28 20:29:58] [ 3147624] Baidu System Repair Tool Service (BsrSvc) . (.Baidu, Inc..) - C:\Program Files\Baidu Cleaner\System Repair\BsrSvc.exe SS - Demand [2014/07/30 03:23:23] [ 116648] ÎÏãÉ Google Update (gupdate) (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SS - Demand [2014/07/30 03:23:23] [ 116648] ÎÏãÉ Google Update (gupdatem) (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe SR - Auto [2015/06/18 08:39:46] [ 1871160] (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe SR - Auto [2015/06/18 08:39:50] [ 1133880] (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe SS - Demand [2015/07/05 14:03:32] [ 148136] Mozilla Maintenance Service (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe SR - Auto [2015/04/26 17:32:19] [ 671552] NVIDIA Display Driver Service (nvsvc) . (.NVIDIA Corporation.) - C:\Windows\System32\nvvsvc.exe SS - Demand [2015/05/13 10:05:47] [ 1714448] Baidu PC Faster Service 5.1.0.0 (PCFasterSvc_{PCFaster_5.1.0.0}) . (.Baidu, Inc..) - C:\Program Files\PC Faster\5.1.0.0\PCFasterSvc.exe SS - Demand [2014/10/05 14:38:06] [ 963264] Service KMSELDI (Service KMSELDI) . (.@ByELDI.) - C:\Program Files\KMSpico\Service_KMS.exe ---\\ Additional Scan (O88) (18) - 1s HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-12C9-4305-82F9-43058F20E8D2} =>Adware.TencentAddressBar C:\Windows\AutoKMS\AutoKMS.exe =>HackTool.AutoKMS C:\Program Files\KMSpico\AutoPico.exe =>PUA.KMSpico C:\Windows\System32\Tasks\AutoKMSCustom =>HackTool.AutoKMS C:\Windows\System32\Tasks\AutoPico Daily Restart =>PUA.KMSpico HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1 =>PUA.KMSpico HKLM\SOFTWARE\Bywifi =>Spyware.Bywifi HKLM\SOFTWARE\EnigmaSoftwareGroup =>PUP.EnigmaSoftware HKLM\SOFTWARE\Tencent =>Adware.TencentAddressBar HKCU\SOFTWARE\Bywifi =>Spyware.Bywifi HKCU\SOFTWARE\Tencent =>Adware.TencentAddressBar C:\Program Files\Enigma Software Group =>PUP.EnigmaSoftware C:\Program Files\KMSpico =>PUA.KMSpico C:\Program Files\KMSpicoPortable =>PUA.KMSpico C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico =>PUA.KMSpico C:\Program Files\KMSpico\KMSELDI.exe =>PUA.KMSpico C:\Program Files\KMSpico\Service_KMS.exe =>PUA.KMSpico HKLM\SYSTEM\CurrentControlSet\Services\Service KMSELDI =>PUA.KMSpico ---\\ Summary of the detections found on your workstation (5) - 0s http://www.nicolascoolman.fr/adware-tencentaddressbar/ =>Adware.TencentAddressBar http://www.nicolascoolman.fr/trojan-autokms/ =>HackTool.AutoKMS http://www.nicolascoolman.fr/pup-kmspico/ =>PUA.KMSpico http://www.nicolascoolman.fr/spyware-bywifi/ =>Spyware.Bywifi http://www.nicolascoolman.fr/blog =>PUP.EnigmaSoftware ~ End of the scan, 18665 items in 93 seconds (724)(0)()