Report of ZHPDiag v1.27.1864 by Nicolas Coolman, Updated on 04/08/2011
Run by Administrator on 11/04/2011 17:51:01
Website: http://www.premiumorange.com/zeb-help-process/zhpdiag.html
---\\ Web Browser
MSIE: Internet Explorer v7.0.5730.13 (Default)
MFIE: Mozilla Firefox v3.6.16 (fr)
GCIE: Google Chrome v10.0.648.204
---\\ System Information
Windows XP Professional Service Pack 3 (Build 2600)
Processor: x86 Family 15 Model 6 Stepping 5, GenuineIntel
Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 1023 MB (42% free)
System Restore: Enabled
System drive C: has 23 GB (59%) free of 39 GB
---\\ Logged in mode
Computer Name: SWEET-98B9CB2C5
User Name: Administrator
All Users Names: SUPPORT_388945a0, HelpAssistant, Administrator,
Unselected Option: O45,O61,O62,O65,O66,O82
Logged in as Administrator
---\\ Environment Variables
%AppData%=C:\Documents and Settings\Administrator\Application Data
%LocalAppData%=C:\Documents and Settings\Administrator\Local Settings\Application Data
%StartMenu%=C:\Documents and Settings\Administrator\Start Menu
---\\ DOS/Devices
C:\ Hard drive, Flash drive, Thumb drive (Free 23 GB of 39 GB)
D:\ Hard drive, Flash drive, Thumb drive (Free 171 GB of 194 GB)
E:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
F:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
G:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
H:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
I:\ CD-ROM drive (Not Inserted)
J:\ CD-ROM drive (Not Inserted)
K:\ CD-ROM drive (Not Inserted)
---\\ Security Center & Tools Informations
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK
---\\ Search Generic System Files
[MD5.BFBBBFE0913E6C9706F97598A6588B8F] - (.Microsoft Corporation - Windows Explorer.) (.27/09/2008 11:24:52.) -- C:\WINDOWS\Explorer.exe [1573888]
[MD5.90B16FF3ACEC94B95BA95AA686442A47] - (.Microsoft Corporation - Internet Extensions for Win32.) (.27/09/2008 11:27:20.) -- C:\WINDOWS\system32\wininet.dll [879616]
[MD5.4BB6301D634C857A5089E8B24C5555E4] - (.Microsoft Corporation - Windows NT Logon Application.) (.27/09/2008 11:27:21.) -- C:\WINDOWS\system32\Winlogon.exe [593408]
[MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.27/09/2008 02:58:26.) -- C:\WINDOWS\system32\drivers\atapi.sys [96512]
[MD5.A0857C97770034FD2AF17DC4014B5ABD] - (.Microsoft Corporation - NT File System Driver.) (.22/04/2008 14:45:52.) -- C:\WINDOWS\system32\drivers\ntfs.sys [576384]
---\\ Running Processes
[MD5.ACB544D7254F366DFB48F380BC36CD25] - (.AVAST Software - avast! Service.) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [40384]
[MD5.B0844D746C47FB20CA50ED0BAD09065C] - (.Realtek Semiconductor Corp. - Realtek HD Audio Control Panel.) -- C:\WINDOWS\RTHDCPL.EXE [16861184]
[MD5.35DCD380D4D579D8B8EA91D5D8AE444C] - (.Microsoft Corporation - GrooveMonitor Utility.) -- C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [33648]
[MD5.9F3287A1CAF6E365ED2B39BB8D44B0EA] - (.Elaborate Bytes AG - Virtual CloneDrive Daemon.) -- C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [52168]
[MD5.68A553BDFA855C4F1074696682FCDEB6] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe [141600]
[MD5.F9C1D3C8E9B2AC49A38DEFCB567CD494] - (.H+H Software GmbH - Virtual CD - Player.) -- C:\Program Files\HHVcdV7Sys\VC7Play.exe [233472]
[MD5.BF98AF55736FB805FC208B89A09E0C4F] - (.Andreas Eliasson (EliasAE) - WinMover executable.) -- C:\Program Files\WinMover\WinMover.exe [10240]
[MD5.4B5AE15E5C73EB4DC8DBEC2788230D41] - (.Apple Inc. - Apple Mobile Device Service.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [144672]
[MD5.3F56903E124E820AEECE6D471583C6C1] - (.Apple Inc. - Bonjour Service.) -- C:\Program Files\Bonjour\mDNSResponder.exe [238888]
[MD5.472A00D2183C9E5EDB3E076272741812] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 169.2.) -- C:\WINDOWS\system32\nvsvc32.exe [155716]
[MD5.9D84376931440F3679BEEF2A414FA493] - (.HP - PML Driver.) -- C:\WINDOWS\system32\HPZipm12.exe [69632]
[MD5.3F908508F8C3A037816397D858D9545E] - (.H+H Software GmbH - Virtual CD - Management Service.) -- C:\Program Files\HHVcdV7Sys\VC7SecS.exe [102400]
[MD5.7A3611564FCE7C8BE50B03F58CB3EB7D] - (.Apple Inc. - iPodService Module (32-bit).) -- C:\Program Files\iPod\bin\iPodService.exe [545568]
[MD5.453B783EAEC289407002AE37752D229D] - (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe [1004088]
[MD5.6C1B31F5C16E03153F0037AC6C451FFD] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe [2838912]
[MD5.62BB79160F86CD962F312C68C6239BFD] - (.Microsoft Corporation - Windows Update.) -- C:\WINDOWS\system32\wuauclt.exe [53472]
[MD5.EF72FAC68AB0E12A97B8860FD867AEDD] - (...) -- C:\Documents and Settings\Administrator\joaaxeh.exe [188416]
[MD5.EFA551863AD71A69690A3685145FD378] - (...) -- C:\WINDOWS\system32\rundll32.exe [32256]
[MD5.A758DE4E77CB8F7D80CF8C98F8E8DCD5] - (.Jordan Russell - 8N Setup Self-Extractor.) -- C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Lqx.exe [131072]
[MD5.CB587899B3A13B6EB334EB24FA21C719] - (.Jordan Russell - Lb Setup Self-Extractor 7D.) -- C:\WINDOWS\Ljuvua.exe [129024]
[MD5.FB784E1B24CD06EEC019F26EF79527AC] - (.Nicolas Coolman - Diagnostic Tool.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [642560]
---\\ Mozilla Firefox,Plugins,Start,Search,Extensions (P2,M0,M1,M2,M3)
M3 - MFPP: Plugins - [Administrator] -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mteietq8.default\searchplugins\askcom.xml
M3 - MFPP: Plugins - [Administrator] -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\mteietq8.default\searchplugins\MyFunCards_3v.xml
M3 - MFPP: Plugins - [Administrator] -- C:\Program Files\Mozilla FireFox\searchplugins\amazon-france.xml
M3 - MFPP: Plugins - [Administrator] -- C:\Program Files\Mozilla FireFox\searchplugins\cnrtl-tlfi-fr.xml
M3 - MFPP: Plugins - [Administrator] -- C:\Program Files\Mozilla FireFox\searchplugins\eBay-france.xml
M3 - MFPP: Plugins - [Administrator] -- C:\Program Files\Mozilla FireFox\searchplugins\google.xml
M3 - MFPP: Plugins - [Administrator] -- C:\Program Files\Mozilla FireFox\searchplugins\MediaDICO-fr.xml
M3 - MFPP: Plugins - [Administrator] -- C:\Program Files\Mozilla FireFox\searchplugins\wikipedia-fr.xml
M3 - MFPP: Plugins - [Administrator] -- C:\Program Files\Mozilla FireFox\searchplugins\yahoo-france.xml
P2 - FPN:Firefox Plugin Navigator . (.mozilla.org - Default Plug-in.) -- C:\Program Files\Mozilla Firefox\Plugins\npnul32.dll
P2 - FPN:Firefox Plugin Navigator . (.Microsoft Corporation - Office Plugin for Netscape Navigator.) -- C:\Program Files\Mozilla Firefox\Plugins\NPOFF12.DLL
P2 - FPN:Firefox Plugin Navigator . (.Adobe Systems Inc. - Adobe PDF Plug-In For Firefox and Netscape.) -- C:\Program Files\Mozilla Firefox\Plugins\nppdf32.dll
P2 - FPN:Firefox Plugin Navigator . (.RealNetworks, Inc. - RealPlayer(tm) LiveConnect-Enabled Plug-In.) -- C:\Program Files\Mozilla Firefox\Plugins\nppl3260.dll
P2 - FPN:Firefox Plugin Navigator . (.Apple Inc. - The QuickTime Plugin allows you to view a wide variety of multimedia c.) -- C:\Program Files\Mozilla Firefox\Plugins\npqtplugin.dll
P2 - FPN:Firefox Plugin Navigator . (.Apple Inc. - The QuickTime Plugin allows you to view a wide variety of multimedia c.) -- C:\Program Files\Mozilla Firefox\Plugins\npqtplugin2.dll
P2 - FPN:Firefox Plugin Navigator . (.Apple Inc. - The QuickTime Plugin allows you to view a wide variety of multimedia c.) -- C:\Program Files\Mozilla Firefox\Plugins\npqtplugin3.dll
P2 - FPN:Firefox Plugin Navigator . (.Apple Inc. - The QuickTime Plugin allows you to view a wide variety of multimedia c.) -- C:\Program Files\Mozilla Firefox\Plugins\npqtplugin4.dll
P2 - FPN:Firefox Plugin Navigator . (.Apple Inc. - The QuickTime Plugin allows you to view a wide variety of multimedia c.) -- C:\Program Files\Mozilla Firefox\Plugins\npqtplugin5.dll
P2 - FPN:Firefox Plugin Navigator . (.RealNetworks, Inc. - 6.0.12.46.) -- C:\Program Files\Mozilla Firefox\Plugins\nprpjplug.dll
P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (.Unknown owner - No comment.) -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
P2 - FPN: [HKLM] [@adobe.com/ShockwavePlayer] - (.Adobe Systems, Inc. - Adobe Shockwave for Director Netscape plug-in, version 11.0.) -- C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
P2 - FPN: [HKLM] [@Apple.com/iTunes,version=1.0] - (.Unknown owner - No comment.) -- C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
P2 - FPN: [HKLM] [@Microsoft.com/NpCtrl,version=1.0] - (.Microsoft Corporation - 1.0.30716.0.) -- C:\Program Files\Microsoft Silverlight\npctrl.1.0.30716.0.dll
P2 - FPN: [HKLM] [@microsoft.com/WLPG,version=14.0.8117.0416] - (.Microsoft Corporation - NPWLPG.) -- C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
P2 - FPN: [HKLM] [@MyFunCards_3v.com/Plugin] - (.Unknown owner - No comment.) -- C:\Program Files\MyFunCards_3v\bar\1.bin\NP3vStub.dll (.not file.)
P2 - FPN: [HKLM] [@real.com/nppl3260;version=6.0.11.2852] - (.RealNetworks, Inc. - RealPlayer(tm) LiveConnect-Enabled Plug-In.) -- C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll
P2 - FPN: [HKLM] [@real.com/nppl3260;version=6.0.12.46] - (.RealNetworks, Inc. - RealPlayer(tm) LiveConnect-Enabled Plug-In.) -- C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll
P2 - FPN: [HKLM] [@real.com/nprpjplug;version=6.0.12.1662] - (.RealNetworks, Inc. - 6.0.12.46.) -- C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll
P2 - FPN: [HKLM] [@real.com/nprpjplug;version=6.0.12.46] - (.RealNetworks, Inc. - 6.0.12.46.) -- C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll
P2 - FPN: [HKLM] [@tools.google.com/Google Update;version=8] - (.Unknown owner - No comment.) -- C:\Program Files\Google\Update\1.2.183.39\npGoogleOneClick8.dll (.not file.)
M0 - MFSP: prefs.js [Administrator - mteietq8.default]
https://hp.mywebsearch.com/mywebsearch/index.html M2 - MFEP: prefs.js [Administrator - mteietq8.default\foxmarks@kei.com] [] Xmarks v (.Todd Agulnick.)
M2 - MFEP: prefs.js [Administrator - mteietq8.default\info@priceblink.com] [] PriceBlink v2.1 (.Omnivision Media, LLC.)
M2 - MFEP: prefs.js [Administrator - mteietq8.default\snaplinks@snaplinks.net] [] Snap Links (EladKarako Mod) v0.0.7.1 (.Omnivision Media, LLC.)
M2 - MFEP: prefs.js [Administrator - mteietq8.default\toolbar@ask.com] [] LimeWire Toolbar v3.6.12.178 (.Ask.com.)
M2 - MFEP: prefs.js [Administrator - mteietq8.default\vinceturk@gmail.com] [] KwiClick v2.7.0.788 (.KwiClick, LLC.)
M2 - MFEP: prefs.js [Administrator - mteietq8.default\{33e0daa6-3af3-d8b5-6752-10e949c61516}] [] Complitly - Speed up your search with your personal search suggestions tool v1.1 (.SimplyGen Ltd..)
M2 - MFEP: prefs.js [Administrator - mteietq8.default\{44d0a1b4-9c90-4f86-ac92-8680b5d6549e}] [] Gmail Notifier v0.6.4.2 (.Doron Rosenberg.)
M2 - MFEP: prefs.js [Administrator - mteietq8.default\{4be68a18-deba-49e0-9e09-ee7796f3b62a}] [] Billeo v2.1.1.1 (.Billeo, Inc..)
M2 - MFEP: prefs.js [Administrator - mteietq8.default\{635abd67-4fe9-1b23-4f01-e679fa7484c1}] [yahoo.ytff] Yahoo! Toolbar v2.1.1.20091029021655 (.Yahoo!.)
M2 - MFEP: prefs.js [Administrator - mteietq8.default\{77b819fa-95ad-4f2c-ac7c-486b356188a9}] [] IE Tab v1.5.20090525 (.Hong Jen Yee (PCMan).)
M2 - MFEP: prefs.js [Administrator - mteietq8.default\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}] [dwhelper] DownloadHelper v4.8 (.Michel Gutierrez.)
M2 - MFEP: prefs.js [Administrator - mteietq8.default\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}] [adblockplus] Adblock Plus v1.2.2 (.Wladimir Palant.)
M2 - MFEP: prefs.js [Administrator - mteietq8.default\{DDC359D1-844A-42a7-9AA1-88A850A938A8}] [] DownThemAll! v1.1.10 (.Federico Parodi, Stefano Verna, Nils Maier.)
M2 - MFEP: prefs.js [Administrator - mteietq8.default\{e001c731-5e37-4538-a5cb-8168736a2360}] [bitdefender] BitDefender QuickScan v1.1.10 (.BitDefender R&D Team.)
M2 - MFEP: prefs.js [Administrator - mteietq8.default\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}] [greasemonkey] Greasemonkey v0.8.20100408.6 (.Aaron Boodman;
http://youngpup.net/ ---\\ Google Chrome, Start, Search, Extensions (G0,G1,G2)
G1 - GCS: Preference [User Data\Default] None
G0 - GCSP: Preference [User Data\Default][HomePage]
https://www.google.com/?gws_rd=ssl ---\\ Internet Explorer Extensions, Start, Search (R4,R3,R0,R1)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main, Start Page =
https://www.msn.com/fr-fr R0 - HKLM\Software\Microsoft\Internet Explorer\Main, Start Page =
https://www.msn.com/fr-fr R0 - HKUS\S-1-5-21-507921405-1645522239-1801674531-500\Software\Microsoft\Internet Explorer\Main, Start Page =
https://www.msn.com/fr-fr R1 - HKCU\Software\Microsoft\Internet Explorer\Main, Search Page =
https://www.microsoft.com/fr-fr/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main, Default_Page_URL =
https://www.microsoft.com/fr-fr/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main, Default_Search_URL =
https://www.microsoft.com/fr-fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main, Search Page =
https://www.microsoft.com/fr-fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main, Default_Page_URL =
https://www.microsoft.com/fr-fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main, Default_Search_URL =
https://www.microsoft.com/fr-fr/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main, Extensions Off Page = about:noadd-ons
R1 - HKLM\Software\Microsoft\Internet Explorer\Main, Security Risk Page = about:securityrisk
R1 - HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant =
https://www.google.com/?gws_rd=ssl R1 - HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant =
https://www.bing.com/?toHttps=1&redig=17DBE7D168544FA98200E890A8051984 R1 - HKUS\S-1-5-21-507921405-1645522239-1801674531-500\Software\Microsoft\Internet Explorer\Main, Search Page =
https://www.microsoft.com/fr-fr/ R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} . (.Ask.com - Ask.com Toolbar.) (5.6.12.178) -- C:\Program Files\Ask.com\GenericAskToolbar.dll
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Internet Explorer.) (7.00.6000.20861 (vista_ldr.080618-1506)) -- C:\WINDOWS\system32\ieframe.dll
R4 - HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter, Enabled = 2
---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings, ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings, ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings, ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings, MigrateProxy = 1
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings, EnableHttp1_1 = 1
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings, AutoConfigProxy = wininet.dll
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings, ProxyHttp1.1 = 1
---\\ ---\\ Changed inifile Value, Mapped to Registry (F2)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe,
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
---\\ Browser Helper Objects (O2)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} . (.Adobe Systems Incorporated - Adobe PDF Helper for Internet Explorer.) -- C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} Orphean Key
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} . (.Microsoft Corporation - GrooveShellExtensions Module.) -- C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} . (.Sun Microsystems, Inc. - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Assistant Help Program - {9030D464-4C02-4ABF-8ECC-5164760863C6} . (.Microsoft Corporation - WindowsLiveLogin.dll.) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO -