Rapport de ZHPFix 2017.06.13.1 par Nicolas Coolman, Update du 13/06/2017 Fichier d'export Registre : Run by Ben at 29/07/2017 19:41:37 High Elevated Privileges : OK Windows 7 Ultimate Edition, 64-bit Service Pack 1 (Build 7601) Recycle Bin emptied (00mn 10s) ========== Registry keys ========== REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\1916A2AF346D399F50313C393200F14140456616 REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\2A83E9020591A55FC6DDAD3FB102794C52B24E70 REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\2B84BFBB34EE2EF949FE1CBE30AA026416EB2216 REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\305F8BD17AA2CBC483A4C41B19A39A0C75DA39D6 REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\367D4B3B4FCBBC0B767B2EC0CDB2A36EAB71A4EB REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\3A850044D8A195CD401A680C012CB0A3B5F8DC08 REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\40AA38731BD189F9CDB5B9DC35E2136F38777AF4 REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\43D9BCB568E039D073A74A71D8511F7476089CC3 REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\471C949A8143DB5AD5CDF1C972864A2504FA23C9 REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\51C3247D60F356C7CA3BAF4C3F429DAC93EE7B74 REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\5DE83EE82AC5090AEA9D6AC4E7A6E213F946E179 REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\61793FCBFA4F9008309BBA5FF12D2CB29CD4151A REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6 REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\63FEAE960BAA91E343CE2BD8B71798C76BDB77D0 REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\6431723036FD26DEA502792FA595922493030F97 REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD78375931 REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\80962AE4D6C5B442894E95A13E4A699E07D694CF REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\86E817C81A5CA672FE000F36F878C19518D6F844 REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\8E5BD50D6AE686D65252F843A9D4B96D197730AB REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\9845A431D51959CAF225322B4A4FE9F223CE6D15 REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\B533345D06F64516403C00DA03187D3BFEF59156 REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\B86E791620F759F17B8D25E38CA8BE32E7D5EAC2 REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\C060ED44CBD881BD0EF86C0BA287DDCF8167478C REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\CEA586B2CE593EC7D939898337C57814708AB2BE REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\D018B62DC518907247DF50925BB09ACF4A5CB3AD REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\F8A54E03AADC5692B850496A4C4630FFEAA29D83 REMOVES: HKLM\Software\Microsoft\SystemCertificates\Disallowed\Certificates\FA6660A94AB45F6A88C0D7874D89A863D74DEE97 Basis of registers IFEO branch non-infected ! ========== Registry values ========== ABSENT value Standard Profile: FirewallRaz : ABSENT value Domain Profile: FirewallRaz : REMOVES: FirewallRaz (None) : {2628E40E-02FB-464E-8CF7-A9C73D2FDB2C} REMOVES: FirewallRaz (None) : {2449415C-D4B6-4DCA-BB6B-372A4A96091E} REMOVES: FirewallRaz (None) : {05B08754-D704-4511-ABA4-63B343E1641C} REMOVES: FirewallRaz (None) : {3D4C15FA-CF1E-4648-9D74-C725A5E4AB20} REMOVES: FirewallRaz (None) : {938EBEA5-0D1F-4F6E-8867-2757766B6FE9} REMOVES: FirewallRaz (None) : {A160F15C-7498-4AD4-886F-E396C4F3EDCC} REMOVES: FirewallRaz (Private) : TCP Query User{5A780DAB-3646-444A-8778-2AA643830540}C:\users\ben\appdata\local\popcorn-time\nw.exe REMOVES: FirewallRaz (Private) : UDP Query User{51912AC9-B6A1-42BD-8FA3-4867FFF4FB71}C:\users\ben\appdata\local\popcorn-time\nw.exe REMOVES: FirewallRaz (Private) : TCP Query User{1A4B27A1-760C-4227-996B-989DDE8CC84F}C:\users\ben\downloads\compressed\zerobundle-v0.1.1\zerobundle\python\python.exe REMOVES: FirewallRaz (Private) : UDP Query User{3201CE58-9FB2-44F2-9CAC-30B37DF1C4EE}C:\users\ben\downloads\compressed\zerobundle-v0.1.1\zerobundle\python\python.exe REMOVES: FirewallRaz (Public) : TCP Query User{3DC9E976-6C98-479E-ABB2-BEE036BB7685}C:\users\ben\appdata\local\popcorn-time\nw.exe REMOVES: FirewallRaz (Public) : UDP Query User{461B8B19-7D00-4119-9F05-992EC0BAA6AC}C:\users\ben\appdata\local\popcorn-time\nw.exe REMOVES: FirewallRaz (Private) : TCP Query User{1CA860AB-7C98-4396-9610-AD9310736BE7}C:\users\ben\appdata\local\popcorn-time\popcorn-time.exe REMOVES: FirewallRaz (Private) : UDP Query User{4C256831-E04C-439F-8139-7C927A3EF503}C:\users\ben\appdata\local\popcorn-time\popcorn-time.exe ========== Folders ========== REMOVES: c:\users\ben\appdata\local\popcorn-time REMOVES: c:\users\ben\appdata\roaming\microsoft\windows\start menu\programs\inetstat REMOVES: c:\users\ben\appdata\roaming\microsoft\windows\start menu\programs\popcorn-time ========== Files ========== REMOVES: C:\Windows\Installer\462fa5.msi ========== HOSTS file ========== The Hosts file is not repaired, please disable your antivirus software. ========== System restore ========== The system successfully created restore point ========== Summary ========== 28 : Registry keys 16 : Registry values 3 : Folders 1 : Files 1 : HOSTS file 1 : System restore End of clean in 03mn 23s ========== Path to file report ========== C:\Users\Ben\AppData\Roaming\ZHP\ZHPFix[R1].txt - 29/07/2017 19:41:48 [5983]