Script ZHPFix
FirewallRaz
EmptyPrefetch
EmptyTemp
EmptyFlash



HKLM\SOFTWARE\B1696BA1DB3FAADF0C6A4C9613D0323F =>PUP.Optional.CrossRider
HKCU\SOFTWARE\B1696BA1DB3FAADF0C6A4C9613D0323F =>PUP.Optional.CrossRider
HKCU\SOFTWARE\undefined =>.Superfluous.Downloader
C:\Windows\Prefetch\BYTEFENCE.EXE-FAC31F78.pf =>.Superfluous.ByteFence
C:\Windows\Prefetch\QUOTEEX.EXE-8DEA0167.pf =>PUP.Optional.Graftor
C:\Users\Administrator\AppData\Roaming\Freshjob.exe =>Adware.Suspect
C:\Users\Administrator\AppData\Roaming\Kay-Plus.exe =>Adware.Suspect
[MD5.00000000000000000000000000000000] [APT] [TaskName] (...) -- Task To Run (.not file.) [0] (.Activate.) =>.Superfluous.Empty
[MD5.441829F2FD90CDD3A9B12B0CF6E363ED] [APT] [Meneght Nodifier] (.CHENGDU YIWO Tech Development Co., Ltd.) -- C:\Program Files\Lopchchatught\arevly.exe [343232] (.Activate.) =>.CHENGDU YIWO Tech Development Co., Ltd.®
[MD5.00000000000000000000000000000000] [APT] [Pritc] (...) -- C:\Users\Administrator\AppData\Local\Temp\00011268\casrss.exe (.not file.) [0] (.Activate.) =>.Superfluous.Empty
O39 - APT: ComputerZLite - (.???? (C) 2008-2015 www.ludashi.com.) -- C:\Windows\System32\Tasks\ComputerZLite [3418] =>.Qihoo 360 Software (Beijing) Company Limited®
O39 - APT: Pritc - (...) -- C:\Windows\System32\Tasks\Pritc [2974] (.Orphan.) =>.Superfluous.Orphan
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} Orphan =>.Microsoft Internet Explorer
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} . (.Microsoft Corporation - GrooveShellExtensions Module.) -- C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll =>.Microsoft Corporation®
O4 - HKLM\..\Run: [Wondershare Helper Compact.exe] C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (.not file.)
O4 - HKLM\..\Run: [NeroFilterCheck] . (.Nero AG - NeroCheck.) -- C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe =>.Nero AG®
O4 - HKLM\..\Run: [CNAP2 Launcher] . (.CANON INC. - Canon Advanced Printing Technology Printer.) -- C:\Windows\System32\spool\drivers\w32x86\3\CNAP2LAK.EXE =>.CANON INC.®
O4 - HKLM\..\Run: [app] . (. - uc.) -- C:\Program Files\sbqh\uc.exe
O4 - HKLM\..\Run: [GrooveMonitor] . (.Microsoft Corporation - GrooveMonitor Utility.) -- C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe =>.Microsoft Corporation®
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] . (.Nero AG - Nero Home.) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe =>.Nero AG®
O4 - HKCU\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\Internet Download Manager\IDMan.exe =>.Tonec Inc.
O4 - HKCU\..\Run: [eRclient] . (.eRmail Company, s. r. o. - eRmail Client Application.) -- C:\Users\Administrator\AppData\Roaming\eRclient\eRclient.exe
O4 - HKCU\..\Run: [DUP] C:\Program Files\DriverUpdaterPro\DriverUpdaterPro.exe (.not file.) =>.Superfluous.DriverUpdaterPro
O4 - HKCU\..\Run: [svchost0] . (. - uc.) -- C:\Program Files\sbqh\uc.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Windows Desktop Gadgets.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Windows Desktop Gadgets.) -- C:\Program Files\Windows Sidebar\sidebar.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-1495394455-1330258974-948738303-500\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] . (.Nero AG - Nero Home.) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe =>.Nero AG®
O4 - HKUS\S-1-5-21-1495394455-1330258974-948738303-500\..\Run: [IDMan] . (.Tonec Inc. - Internet Download Manager (IDM).) -- C:\Program Files\Internet Download Manager\IDMan.exe =>.Tonec Inc.
O4 - HKUS\S-1-5-21-1495394455-1330258974-948738303-500\..\Run: [eRclient] . (.eRmail Company, s. r. o. - eRmail Client Application.) -- C:\Users\Administrator\AppData\Roaming\eRclient\eRclient.exe
O4 - HKUS\S-1-5-21-1495394455-1330258974-948738303-500\..\Run: [DUP] C:\Program Files\DriverUpdaterPro\DriverUpdaterPro.exe (.not file.) =>.Superfluous.DriverUpdaterPro
O4 - HKUS\S-1-5-21-1495394455-1330258974-948738303-500\..\Run: [svchost0] . (. - uc.) -- C:\Program Files\sbqh\uc.exe
O4 - GS\CommonDesktop [Public]: Topaz Moment.lnk . (...) C:\Windows\Installer\{16A49E91-6EC2-453A-8B2C-889577AE5FC5}\_45D09841C60E2CF2F96CD4.exe
O42 - Logiciel: ?????? - (.???.) [HKLM] -- LdsLite =>.Qihoo 360 Software (Beijing) Company Limited®
HKLM\SOFTWARE\B1696BA1DB3FAADF0C6A4C9613D0323F =>PUP.Optional.CrossRider
HKCU\SOFTWARE\B1696BA1DB3FAADF0C6A4C9613D0323F =>PUP.Optional.CrossRider
O43 - CFD: 17/09/2016 - [] D -- C:\Users\Administrator\AppData\Local\Temp =>.Microsoft Corporation
O43 - CFD: 28/11/2015 - [0] SHD -- C:\Users\Administrator\AppData\Local\Temporary Internet Files =>.Microsoft Corporation
O43 - CFD: 17/09/2016 - [] D -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UC???
O45 - LFCP:[MD5.4AB0B8D89EBE123072EE3FF80E315480] 17/09/2016 A -- C:\Windows\Prefetch\BYTEFENCE.EXE-FAC31F78.pf =>.Superfluous.ByteFence
O45 - LFCP:[MD5.24248A40FE7224F81B3E1834B7236287] 17/09/2016 A -- C:\Windows\Prefetch\QUOTEEX.EXE-8DEA0167.pf =>PUP.Optional.Graftor
O61 - LFC: 2016/09/17 02:05:13 A . (..) -- C:\Users\Administrator\AppData\Roaming\Freshjob.exe [2148864]
O61 - LFC: 2016/09/17 02:05:13 A . (..) -- C:\Users\Administrator\AppData\Roaming\Kay-Plus.exe [2148864]
O61 - LFC: 2016/09/17 02:05:32 A . (..) -- C:\Users\Administrator\AppData\Roaming\Xxx-tone.bin [848565]
O61 - LFC: 2016/09/09 15:17:20 A . (.TODO: .) -- C:\Users\Administrator\AppData\Local\UCBrowser\User Data\Default\Extensions\pbnmnlipmkfkadfcdocgblonoccmolpe\3.0.1_0\bin\PPHelper\AchieveLib.dll [573952]
O61 - LFC: 2016/09/09 15:17:20 A . (..) -- C:\Users\Administrator\AppData\Local\UCBrowser\User Data\Default\Extensions\pbnmnlipmkfkadfcdocgblonoccmolpe\3.0.1_0\bin\PPHelper\ADBUtil.dll [95232]
O61 - LFC: 2016/09/09 15:17:20 A . (..) -- C:\Users\Administrator\AppData\Local\UCBrowser\User Data\Default\Extensions\pbnmnlipmkfkadfcdocgblonoccmolpe\3.0.1_0\bin\PPHelper\DeviceHelper.dll [479744]
O61 - LFC: 2016/09/09 15:17:20 A . (.????????????.) -- C:\Users\Administrator\AppData\Local\UCBrowser\User Data\Default\Extensions\pbnmnlipmkfkadfcdocgblonoccmolpe\3.0.1_0\bin\PPHelper\DriverInstallerX64.exe [41984]
O61 - LFC: 2016/09/09 15:17:20 A . (.????????????.) -- C:\Users\Administrator\AppData\Local\UCBrowser\User Data\Default\Extensions\pbnmnlipmkfkadfcdocgblonoccmolpe\3.0.1_0\bin\PPHelper\DriverInstallerX86.exe [43008]
O61 - LFC: 2016/09/09 15:17:20 A . (.(C) ????????????????????.) -- C:\Users\Administrator\AppData\Local\UCBrowser\User Data\Default\Extensions\pbnmnlipmkfkadfcdocgblonoccmolpe\3.0.1_0\bin\PPHelper\monconfigapi.dll [189952]
O61 - LFC: 2016/09/09 15:17:20 A . (.Guangzhou Teiron (C) 2013.) -- C:\Users\Administrator\AppData\Local\UCBrowser\User Data\Default\Extensions\pbnmnlipmkfkadfcdocgblonoccmolpe\3.0.1_0\bin\PPHelper\PPAdbServer.exe [688640]
O61 - LFC: 2016/09/09 15:17:20 A . (..) -- C:\Users\Administrator\AppData\Local\UCBrowser\User Data\Default\Extensions\pbnmnlipmkfkadfcdocgblonoccmolpe\3.0.1_0\bin\PPHelper\pplog.dll [371712]
O61 - LFC: 2016/09/15 13:47:10 A . (..) -- C:\Users\Administrator\AppData\Local\Clervagh\nacl_validation_cache.bin [200]
O61 - LFC: 2016/09/15 13:47:10 A . (..) -- C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\nacl_validation_cache.bin [200]
O87 - FAEL: "{720ABE76-3174-4210-818B-53D9ED17E920}" [In-None-P6-TRUE] .(...) -- C:\Users\Administrator\AppData\Local\Temp\is-SGEPO.tmp\download\MiniThunderPlatform.exe (.not file.)
O87 - FAEL: "{D8ECFBE2-D05B-44C1-B20D-133265FE32A8}" [In-None-P6-TRUE] .(...) -- C:\Program Files\LuDaShi\ComputerZTray.exe (.not file.)
O87 - FAEL: "{623FA7B6-C35E-48BE-B43A-26B2EC1CB03D}" [In-None-P17-TRUE] .(...) -- C:\Program Files\LuDaShi\ComputerZTray.exe (.not file.)
O87 - FAEL: "{F14223DC-F020-4307-BD88-4F5823F1DDC1}" [In-None-P6-TRUE] .(...) -- C:\Program Files\LuDaShi\Utils\mininews.exe (.not file.)
O87 - FAEL: "{C2AE7941-F226-4914-BD95-255DC6C7D991}" [In-None-P17-TRUE] .(...) -- C:\Program Files\LuDaShi\Utils\mininews.exe (.not file.)
O87 - FAEL: "{0054F6BF-4B3C-40F9-81DF-ACF97893B920}" [In-None-P17-TRUE] .(...) -- C:\Program Files\GreatMaker\MaohaWiFi\MaohaWifiSvr.exe (.not file.)