What is QuickShare? Solved

Question

Hello everyone I'm reaching out to someone who could help me  (QuickShare): I have this thing in "Add or Remove Programs." I've been told it's a virus, and I would like to know if that's true and how to remove it. I am on XP Thank you very much in advance.

lilidurhone · Accepted Answer

Hello  You must have installed potentially unwanted software   To avoid this kind of problem:  - Do not download any programs offered in ads or on suspicious sites. Note that some well-known sites like O1net, Softronic, Tuto4PC, etc. sometimes modify the programs offered for download to add adware ==> Always prefer downloading directly from the publisher's website.   - During the installation of a free program, read carefully and uncheck all additional programs that are offered, especially toolbars.  For your information, read these documents about Potentially Unwanted Programs and Toolbars; they are not mandatory  * Download this easy-to-use tool  http://general-changelog-team.fr/fr/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner (by Xplode) on your desktop.   * If there’s a problem with the first link, take it here https://www.commentcamarche.net/telecharger/securite/2759-adwcleaner/  * Run it (Under Vista/Seven/8, right-click on it, and select run as administrator); if you are on XP, double-click on it  * Click on search * Post the search report C:\Adwcleaner[R]  * Note that the search report is also saved under C:\Adwcleaner[R1]  -- If there is a problem, there is always a solution Don't forget to mark your subject as resolved :)

edelweiss2604 · Answer

Hello lilidurhone Thank you for replying so quickly. As agreed, I am posting the report from "AdwCleaner"  # AdwCleaner v2.301 - Report created on 06/03/2013 at 13:01:48 # Updated on 05/16/2013 by Xplode # Operating System: Microsoft Windows XP Service Pack 3 (32 bits) # Username: Maria - VICENTA-17B950C # Boot mode: Normal # Run from: C:\Documents and Settings\Maria\Desktop\AdwCleaner-2.301.exe # Option [Search]   ***** [Services] *****   ***** [Files / Folders] *****  Folder Present: C:\DOCUME~1\Maria\LOCALS~1\Temp\Smartbar Folder Present: C:\Documents and Settings\All Users\Application Data\Tarma Installer Folder Present: C:\Documents and Settings\Maria\Application Data\Mozilla\Firefox\Profiles\ykwx72uy.default\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433} Folder Present: C:\Documents and Settings\Maria\Application Data\SwvUpdater Folder Present: C:\Documents and Settings\Maria\Local Settings\Application Data\Smartbar File Present: C:\WINDOWS\Tasks\AmiUpdXp.job  ***** [Registry] *****  Key Present: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0} Key Present: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113} Key Present: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0} Key Present: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113} Key Present: HKCU\Software\SmartBar Key Present: HKCU\Software\SmartbarBackup Key Present: HKCU\Software\SmartbarLog Key Present: HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0} Key Present: HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209} Key Present: HKLM\SOFTWARE\Classes\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9} Key Present: HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E} Key Present: HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Key Present: HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358} Key Present: HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7} Key Present: HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301} Key Present: HKLM\SOFTWARE\Classes\IESmartBar.BandObjectAttribute Key Present: HKLM\SOFTWARE\Classes\IESmartBar.BHO Key Present: HKLM\SOFTWARE\Classes\IESmartBar.DockingPanel Key Present: HKLM\SOFTWARE\Classes\IESmartBar.IESmartBar Key Present: HKLM\SOFTWARE\Classes\IESmartBar.IESmartBarBandObject Key Present: HKLM\SOFTWARE\Classes\IESmartBar.SmartbarDisplayState Key Present: HKLM\SOFTWARE\Classes\IESmartBar.SmartbarMenuForm Key Present: HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} Key Present: HKLM\SOFTWARE\Classes\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476} Key Present: HKLM\SOFTWARE\Classes\Updater.AmiUpd Key Present: HKLM\SOFTWARE\Classes\Updater.AmiUpd.1 Key Present: HKLM\Software\Iminent Key Present: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} Key Present: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0} Key Present: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467 Key Present: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} Key Present: HKLM\SOFTWARE\Software Key Present: HKLM\Software\Tarma Installer Value Present: HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Browser Infrastructure Helper] Value Present: HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]  ***** [Browsers] *****  -\ Internet Explorer v8.0.6001.18702  [OK] The registry does not contain any illegitimate entries.  -\ Mozilla Firefox v [Unable to get version]  File: C:\Documents and Settings\Maria\Application Data\Mozilla\Firefox\Profiles\ykwx72uy.default\prefs.js  [OK] The file does not contain any illegitimate entries.  *************************  AdwCleaner[R14].txt - [4182 bytes] - [06/03/2013 13:01:48]  ########## EOF - C:\AdwCleaner[R14].txt - [4243 bytes] ##########

lilidurhone · Answer

Ok  Proceed to deletion  -- If there's a problem, there is always a solution Don't forget to mark your subject as resolved :)

edelweiss2604 · Answer

I just did it. I went back to "add and remove." It's still there. I tried to uninstall it, but it won't uninstall.

lilidurhone · Answer

* Download ZHPDiag (by Nicolas Coolman) https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html  * In case the first link doesn't work, click on the one below ftp://zebulon.fr/ZHPDiag2.exe  * Follow the instructions during the installation, it will start automatically at the end.  * Above all, don't forget to install its icon on the desktop; the icon looks like a parchment  * Click on the icon that represents a magnifying glass + (“Launch the diagnosis”)  * Save the report on your Desktop using the icon that looks like a floppy disk  * To host the report, click on the blue arrow which will direct you to Pjjoint to host this report.  * Click on Browse to find the report on your PC.  * The report is saved in C:\ZHP\ZHPDiag.txt  * Once you find the report, select it, and click on Open  * Click on send the file, then post the blue link they will provide you.  * If there are issues hosting on Pjoint, use cjoint instead  * For help http://www.pc-infopratique.com/forum-informatique/tutoriel-heberger-rapport-vt-67934.html  -- If there is a problem, there is always a solution Don't forget to mark your topic as resolved :)

edelweiss2604 · Answer

I hope I followed everything well and, above all, understood everything. Here it is:  https://pjjoint.malekal.com/files.php?id=ZHPDiag_20130603_h15x13r13c10v6

lilidurhone · Answer

Hello edelweiss  Watch out for the cracks!  I'm going to be quite harsh, but they need to go!  We will do a comprehensive scan to see if there are any other infections lurking around  * Download MalwareBytes' anti-malware to the desktop https://www.commentcamarche.net/telecharger/securite/14361-malwarebytes-anti-malware/  * Right-click on the Download_mbam-setup.exe icon to run it as admin to start the installation process  * If the firewall asks for permission for MalwareBytes to connect, accept  * Uncheck the trial version for MalwareBytes Pro  * It will update once done  * Go to the scan tab  * Select run a full scan  * Click on scan  * The scan starts  * At the end of the analysis, the message appears: The scan has completed normally.  * Click on view results to see the detected items  * Click OK to continue  * If any malware has been detected, click on view results  * Select all (or leave checked)  * Click on remove all  * MalwareBytes will destroy the files and registry keys and put a copy in quarantine  * MalwareBytes will open Notepad and copy the report there  * Restart the PC  * Once restarted, double-click on MalwareBytes  * Go to the report/log tab  * Click on it to display it, once displayed, click on edit  at the top of Notepad and then select all  * Go back to edit, then copy and return  to the forum in your reply  * Right-click in the reply box and paste  Good luck   -- If there is a problem, there is always a solution Don't forget to mark your topic as resolved :)

edelweiss2604 · Answer

and there you go, I did just as you told me  Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org  Database version: v2013.06.03.06  Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Maria :: VICENTA-17B950C [administrator]  03/06/2013 15:05:14 mbam-log-2013-06-03 (15-05-14).txt  Scan type: Full scan (C:\|) Scan options enabled: Memory | Startup | Registry | File system | Heuristic/Extra | Heuristic/Shuriken | PUP | PUM Scan options disabled: P2P Item(s) scanned: 281530 Elapsed time: 1 hour(s), 42 minute(s), 52 second(s)  Memory processes detected: 0 (No harmful items detected)  Memory modules detected: 0 (No harmful items detected)  Registry key(s) detected: 0 (No harmful items detected)  Registry value(s) detected: 0 (No harmful items detected)  Registry data item(s) detected: 0 (No harmful items detected)  Folder(s) detected: 0 (No harmful items detected)  File(s) detected: 1 C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\VQSE9CNO\upgrade[1].cab (PUP.Zwangi) -> Successfully quarantined and deleted.  (end)

lilidurhone · Answer

Super  Do a zhpdiag for me  -- If there is a problem, there is always a solution Don't forget to mark your topic as resolved :)

edelweiss2604 · Answer

I don't know if I sent two roooooooooooo oh my goodness If that's the case, I apologize.

edelweiss2604 · Answer

Hello Did you find anything on my latest report? The QuikShare is still in "add and remove." I tried to uninstall it and it's not working In any case, I want to thank you for your help since yesterday  Best regards edelweiss2604

edelweiss2604 · Answer

Sorry, I didn't do exactly like yesterday to send you the "zhpdiag" report  here is the link  https://pjjoint.malekal.com/files.php?id=ZHPDiag_20130604_n129e5l11c5

lilidurhone · Answer

Hello  I'm going to warn you that your cr@cks are going to break!  -- If there's a problem, there’s always a solution Don't forget to put your subject in resolved :)

edelweiss2604 · Answer

I don't see where I could have any cracks because I paid for my creation software But if you say so, I believe you; in any case, I haven't cracked anything or I don't remember at all.

edelweiss2604 · Answer

I would like to have the knowledge in computer science that you have  tell me one thing that the family XP is worth at the current time?

lilidurhone · Answer

Hello edelweiss Usage of zhpfix  Take your time and don't hesitate to let me know if you don't understand  Warning to those who pass by or read the custom script topic: do not reproduce on another computer!   * Disable the clean-up time of Avast (right-click on the orange ball > agent management > disable for 10 minutes)   * Copy only the lines indicated in bold below to the clipboard (highlight with the mouse then right-click to copy)   OPT:O4 - HKCU\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe OPT:O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe OPT:O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe OPT:O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe OPT:O4 - HKUS\S-1-5-21-1482476501-1844237615-1801674531-1004\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Software updater] . (...) -- C:\Documents and Settings\Maria\Application Data\FreeSoftwareUpdater\updater.exe =>PUP.Eorezo O4 - HKUS\S-1-5-21-1482476501-1844237615-1801674531-1004\..\Run: [Software updater] . (...) -- C:\Documents and Settings\Maria\Application Data\FreeSoftwareUpdater\updater.exe O23 - Service: Avira Scheduler (AntiVirSchedulerService) . (...) - C:\Program Files\Avira\AntiVir Desktop\sched.exe (.not file.) O23 - Service: Avira Real-time Protection (AntiVirService) . (...) - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (.not file.) O42 - Software: QuickShare - (.Linkury Inc..) [HKLM] -- {C7310710-42E5-4B6B-A838-795D7BD13542} =>PUP.QuickShare [HKLM\Software\IncrediMail] O43 - CFD: 29/07/2012 - 12:22:50 - [0,067] ----D C:\Documents and Settings\Maria\Local Settings\Application Data\Ares O43 - CFD: 08/11/2012 - 20:04:00 - [0,000] ----D C:\Documents and Settings\Maria\Local Settings\Application Data	uto4pc_fr_15 =>PUP.Eorezo O47 - AAKE:Key Export SP - "C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe" [Enabled] .(...) -- C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe (.not file.) =>PUP.SweetIM O47 - AAKE:Key Export SP - "C:\Program Files\AIM\aim.exe" [Enabled] .(...) -- C:\Program Files\AIM\aim.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Documents and Settings\Maria\My Documents\Ares\Ares.exe" [Enabled] .(...) -- C:\Documents and Settings\Maria\My Documents\Ares\Ares.exe (.not file.) O47 - AAKE:Key Export SP - "C:\Program Files\Ares\Ares.exe" [Enabled] .(...) -- C:\Program Files\Ares\Ares.exe (.not file.) O47 - AAKE:Key Export SP - "C:\WINDOWS\system32\dmwu.exe" [Enabled] .(...) -- C:\WINDOWS\system32\dmwu.exe (.not file.) [HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110011501160}] =>PUP.SpecialSavings [HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011501160}] =>PUP.CrossRider [HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011501160}] =>PUP.CrossRider [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011501160}] =>PUP.CrossRider SS - | Auto 0 | (AntiVirSchedulerService) . (...) - C:\Program Files\Avira\AntiVir Desktop\sched.exe SS - | Auto 0 | (AntiVirService) . (...) - C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\Program Files\PhotoFiltre Studio X\Plugins\eyecandy5000\Alien Skin Eye Candy 5.1 Nature\AlienSkin_Eye_Candy_5_NATURE_Incl_KeyGen-PARADOX\keygen.exe C:\Program Files\PhotoFiltre Studio X\Plugins\eyecandy5000\AlienSkin Eye Candy 5 Textures\keygen.exe C:\Program Files\PhotoFiltre Studio X\Plugins\eyecandy5000\keygen.exe C:\Program Files\PhotoFiltre Studio X\Plugins\eyecandy5000\Alien Skin Eye Candy 5.1 Nature\AlienSkin_Eye_Candy_5_NATURE_Incl_KeyGen-PARADOX\keygen.exe C:\Program Files\PhotoFiltre Studio X\Plugins\eyecandy5000\AlienSkin Eye Candy 5 Textures\keygen.exe C:\Program Files\PhotoFiltre Studio X\Plugins\eyecandy5000\keygen.exe O41 - Driver: (avipbb) . (. - .) - C:\WINDOWS\system32\DRIVERS\avipbb.sys (.not file.) O41 - Driver: (avkmgr) . (. - .) - C:\WINDOWS\system32\DRIVERS\avkmgr.sys (.not file.) Sysrestore EmptyTemp   * Launch ZHPFix (syringe icon) by double-clicking and then click OK  * You should see the lines above in the white box of ZHPFix, ensure that these are the correct lines.  * If the lines are not present, right-click in the box and click paste  * Click on the GO button to start the cleaning, and let the tool work.  * Restart the PC and post the report C:\ZHP\ZHPFixReport.txt   -- If there is a problem, there is always a solution Don't forget to mark your topic as resolved :)

edelweiss2604 · Answer

I don't see the "GO" button.

edelweiss2604 · Answer

here  ZHPFix Report 2013.5.24.2 by Nicolas Coolman, Update of 24/05/2013 Registry export file: Run by Maria at 04/06/2013 15:55:35 High Elevated Privileges: OK Windows XP Home Edition Service Pack 3 (Build 2600)  Empty Recycle Bin  ========== Software(s) ========== DELETE QuickShare  ========== Memory Processes ========== DELETE Memory Process: C:\Program Files\PhotoFiltre Studio X\Plugins\eyecandy5000\Alien Skin Eye Candy 5.1 Nature\AlienSkin_Eye_Candy_5_NATURE_Incl_KeyGen-PARADOX\keygen.exe DELETE Memory Process: C:\Program Files\PhotoFiltre Studio X\Plugins\eyecandy5000\keygen.exe  ========== Registry Key(s) ========== DELETE [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7310710-42E5-4B6B-A838-795D7BD13542}] DELETE Key: Service: AntiVirSchedulerService DELETE Key: Service: AntiVirService DELETE Key: HKLM\Software\IncrediMail DELETE Key: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110011501160} DELETE Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011501160} DELETE Key: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011501160} DELETE Key: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011501160} ABSENT Key: Service: AntiVirSchedulerService ABSENT Key: Service: AntiVirService DELETE Driver Key: avipbb DELETE Driver Key: avkmgr  ========== Registry Value(s) ========== DELETE RunValue: CTFMON.EXE ABSENT RunValue: CTFMON.EXE DELETE RunValue: Software updater ABSENT RunValue: Software updater DELETE AAKE KeyValue: C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe DELETE AAKE KeyValue: C:\Program Files\AIM\aim.exe DELETE AAKE KeyValue: C:\Documents and Settings\Maria\My Documents\Ares\Ares.exe DELETE AAKE KeyValue: C:\Program Files\Ares\Ares.exe DELETE AAKE KeyValue: C:\WINDOWS\system32\dmwu.exe  ========== Folder(s) ========== DELETE Folder: C:\Documents and Settings\Maria\Local Settings\Application Data\Ares DELETE Folder: C:\Documents and Settings\Maria\Local Settings\Application Data	uto4pc_fr_15 DELETE Windows Temporary  ========== File(s) ========== DELETE File: c:\documents and settings\maria\application data\freesoftwareupdater\updater.exe ABSENT File: c:\documents and settings\maria\application data\freesoftwareupdater\updater.exe ABSENT File: c:\program files\avira\antivir desktop\sched.exe ABSENT File: c:\program files\avira\antivir desktop\avguard.exe ABSENT File: c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe ABSENT File: c:\program files\aim\aim.exe ABSENT File: c:\documents and settings\maria\my documents\ares\ares.exe ABSENT File: c:\program files\ares\ares.exe ABSENT File: c:\windows\system32\dmwu.exe DELETE File: c:\program files\photofiltre studio x\plugins\eyecandy5000\alien skin eye candy 5.1 nature\alienskin_eye_candy_5_nature_incl_keygen-paradox\keygen.exe ABSENT Folder/File: c:\program files\photofiltre studio x\plugins\eyecandy5000\alienskin eye candy 5 textures\keygen.exe DELETE File: c:\program files\photofiltre studio x\plugins\eyecandy5000\keygen.exe DELETE Windows Temporary  ========== System Restore ========== System restore point created successfully   ========== Summary ========== 2: Memory Processes 12: Key(s) of the Registry 9: Value(s) of the Registry 3: Folder(s) 13: File(s) 1: Software(s) 1: System Restore   End of clean in 00mn 51s  ========== File path report ========== C:\ZHP\ZHPFix[R1].txt - 04/06/2013 15:55:36 [3715]

edelweiss2604 · Answer

Did you get it?

lilidurhone · Answer

Yes yes  Alright, one last little effort  I need a zhpdiag report to see if the fix worked  After that, we will still have updates to do  -- If there’s a problem, there’s always a solution Don't forget to mark your topic as resolved :)

edelweiss2604 · Answer

and here is

ZHPFix Report 2013.5.24.2 by Nicolas Coolman, Update of 05/24/2013
Registry export file:
Run by Maria at 06/04/2013 15:55:35
High Elevated Privileges: OK
Windows XP Home Edition Service Pack 3 (Build 2600)

Empty Recycle Bin

========== Software(s) ==========
REMOVE QuickShare

========== Memory Processes ==========
REMOVE Memory Process: C:\Program Files\PhotoFiltre Studio X\Plugins\eyecandy5000\Alien Skin Eye Candy 5.1 Nature\AlienSkin_Eye_Candy_5_NATURE_Incl_KeyGen-PARADOX\keygen.exe
REMOVE Memory Process: C:\Program Files\PhotoFiltre Studio X\Plugins\eyecandy5000\keygen.exe

========== Registry Key(s) ==========
REMOVE [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C7310710-42E5-4B6B-A838-795D7BD13542}]
REMOVE Key: Service: AntiVirSchedulerService
REMOVE Key: Service: AntiVirService
REMOVE Key: HKLM\Software\IncrediMail
REMOVE Key: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110011501160}
REMOVE Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011501160}
REMOVE Key: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011501160}
REMOVE Key: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011501160}
ABSENT Key: Service: AntiVirSchedulerService
ABSENT Key: Service: AntiVirService
REMOVE Driver Key: avipbb
REMOVE Driver Key: avkmgr

========== Registry Value(s) ==========
REMOVE RunValue: CTFMON.EXE
ABSENT RunValue: CTFMON.EXE
REMOVE RunValue: Software updater
ABSENT RunValue: Software updater
REMOVE AAKE KeyValue: C:\Program Files\SweetIM\Communicator\SweetPacksUpdateManager.exe
REMOVE AAKE KeyValue: C:\Program Files\AIM\aim.exe
REMOVE AAKE KeyValue: C:\Documents and Settings\Maria\My Documents\Ares\Ares.exe
REMOVE AAKE KeyValue: C:\Program Files\Ares\Ares.exe
REMOVE AAKE KeyValue: C:\WINDOWS\system32\dmwu.exe

========== Folder(s) ==========
REMOVE Folder: C:\Documents and Settings\Maria\Local Settings\Application Data\Ares
REMOVE Folder: C:\Documents and Settings\Maria\Local Settings\Application Data\tuto4pc_fr_15
REMOVE Windows Temp

========== File(s) ==========
REMOVE File: c:\documents and settings\maria\application data\freesoftwareupdater\updater.exe
ABSENT File: c:\documents and settings\maria\application data\freesoftwareupdater\updater.exe
ABSENT File: c:\program files\avira\antivir desktop\sched.exe
ABSENT File: c:\program files\avira\antivir desktop\avguard.exe
ABSENT File: c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe
ABSENT File: c:\program files\aim\aim.exe
ABSENT File: c:\documents and settings\maria\my documents\ares\ares.exe
ABSENT File: c:\program files\ares\ares.exe
ABSENT File: c:\windows\system32\dmwu.exe
REMOVE File: c:\program files\photofiltre studio x\plugins\eyecandy5000\alien skin eye candy 5.1 nature\alienskin_eye_candy_5_nature_incl_keygen-paradox\keygen.exe
ABSENT Folder/File: c:\program files\photofiltre studio x\plugins\eyecandy5000\alienskin eye candy 5 textures\keygen.exe
REMOVE File: c:\program files\photofiltre studio x\plugins\eyecandy5000\keygen.exe
REMOVE Windows Temp

========== System Restore ==========
System restore point created successfully

========== Summary ==========
2: Memory Processes
12: Registry Key(s)
9: Registry Value(s)
3: Folder(s)
13: File(s)
1: Software(s)
1: System Restore

End of clean in 00mn 51s

========== File report path ==========
C:\ZHP\ZHPFix[R1].txt - 06/04/2013 15:55:36 [3715]

lilidurhone · Answer

Not a zhpfix report, but a zhpdiag one!

* Then restart zhpdiag (parchment icon) as admin and click on the magnifying glass +

* Wait until the end of the analysis and then host the report as indicated in this tutorial http://www.pc-infopratique.com/forum-informatique/tutoriel-heberger-rapport-vt-67934.html

--
If there is a problem, there is always a solution
Don't forget to mark your topic as resolved :)

edelweiss2604 · Answer

https://pjjoint.malekal.com/files.php?id=ZHPDiag_20130604_c15o14t7r15j7

edelweiss2604 · Answer

Is this good?

lilidurhone · Answer

Yes, it's good :)

Uninstall

Adobe Reader X
Java 7 Update 15

They are absolutely outdated

Then download from CCM for Adobe Reader https://www.commentcamarche.net/telecharger/bureautique/2625-adobe-reader/

For Java, make sure to uncheck Ask during installation https://www.commentcamarche.net/telecharger/developpement/12917-java-runtime-environment/

Confirm the installation to me and then I'll let you go :D

--
If there is a problem, there is always a solution
Don't forget to mark your topic as resolved :)

edelweiss2604 · Answer

Here everything is installed. I went to "add and remove" and QuickShare is still there. I tried to uninstall it but there was no way.

edelweiss2604 · Answer

Anyway, I thank you infinitely for all the help you've given me. You're too good!
I won't let you go right away, lol!

I'm going to ask you another question. I know I'm not in the right forum for this question, but you're too good! Here’s my question:

I would like to know how come my computer (desktop brand Acer) has been reading memory cards (digital photos) until now, and now when I insert a "SanDisk" card, I go to "My Computer," I clicked on removable drive "G" like I used to, and it says "Insert a disk into the drive," even though I have inserted my card in the right place. I didn't have any issues until now.
You don't have to answer me if you don’t want to.

edelweiss2604 · Answer

Here is for the zhpdiag
https://pjjoint.malekal.com/files.php?id=ZHPDiag_20130604_d12d13f14c13t9

And no, it's still for the same computer, but I completely understand and I'll reopen another thread for that
Thank you if you can help me

lilidurhone · Answer

Hello

Yes!!

No more quickshare!

However, one thing intrigues me: why
are the updates outdated?

Windows Genuine Advantage: KO >Is your Windows legal?

--
If there is a problem, there is always a solution
Don't forget to mark your subject as resolved :)

edelweiss2604 · Answer

Oh yes, my Windows is completely legal.

edelweiss2604 · Answer

Yayyyyyyyyyyyyyyyyy no more QuickShare You're a genius
as for my memory card reader, I put another topic However, I think I put it in the same section "virus/Security"
it's going to be moved but you will find me, right? I trust you to find my question I'm going to put "Resolved" for that topic right away
You're a sweetheart, thank you a thousand times for your help

lilidurhone · Answer

Hello

For your topic, it has been moved to the Windows XP section

Wait before marking it as resolved :)

1) Uninstalling disinfecting tools
Download Delfix here https://www.commentcamarche.net/telecharger/securite/7111-delfix/

Run it as administrator (if you are on XP, double click on the downloaded file) and once on the interface, check the following boxes

- remove disinfecting tools
- purge system restore

Then click on Run and wait during the deletion process.

The report will be saved in the clipboard and on the hard drive (C:\DelFix.txt).
Post the report

2) Don't forget to update Java, Adobe Reader, and Flash Player for IE (Chrome already includes it)
A useful link to read https://www.commentcamarche.net/faq/13362-mettre-a-jour-son-pc-contre-les-failles-de-securite
Don't forget to keep Windows updated via Windows Update

3) To allow updates to your software, I recommend using Filehippo Update Checker

You can download it here https://www.commentcamarche.net/telecharger/utilitaires/9771-filehippo-app-manager/

For the installation of Filehippo, only uncheck putting the icon in the quick launch bar

4) To clean temporary files (be careful not to clean the registry), you can use CCleaner with a tutorial to configure it correctly (https://www.commentcamarche.net/telecharger/utilitaires/5647-ccleaner/
Download link https://www.commentcamarche.net/telecharger/utilitaires/5647-ccleaner/
You can also use the Windows disk cleaner
Don't forget to defragment your hard drive from time to time either through the utility or with third-party software such as Defraggler or Auslogics Disk Defrag

5) Secure your browsers, for example with WOT and Simple Adblock for Internet Explorer
To download WOT for IE, it's here https://chrome.google.com/webstore/detail/wot-web-of-trust-website/bhmmomiinigofkjcapegjjndpbikblnp
For Simple Adblock, it's here http://simple-adblock.com/downloadpage/ (click on Download Installer and not the link below!)
For Chrome (if you have Chrome)

WOT available here https://chrome.google.com/webstore/detail/wot-web-of-trust-website/bhmmomiinigofkjcapegjjndpbikblnp?hl=fr

Adblock available here https://www.commentcamarche.net/telecharger/web-internet/2555-adblock-plus-pour-chrome/

Download link for WOT on Firefox
https://addons.mozilla.org/fr/firefox/addon/wot-safe-browsing-tool/

Link to download Adblock +

https://addons.mozilla.org/fr/firefox/addon/adblock-plus/?src=ss

6) Be careful about what you download, where, and how
Avoid downloading from O1net, Tom's Guide, télécharger.com, and Softonic and similar sites as they repack software with potentially unwanted programs
To read
http://www.stoppublicites.fr/
https://www.malekal.com/adwares-pup-protection/

7) Why you should avoid downloading on P2P

The risks are high; the computer may become a zombie PC
A little reading regarding the dangers and risks
https://forum.malekal.com/viewtopic.php?t=3208&start=
https://forum.malekal.com/viewtopic.php?t=893&start=

8) Properly set up Avast

https://www.malekal.com/tutoriel-antivirus-avast/

That's it; if you think your topic is resolved, you can mark it as resolved

--
If there's a problem, there's always a solution
Don't forget to mark your topic as resolved :)

edelweiss2604 · Answer

Here is the report you asked for https://www.cjoint.com/?CFesDV9wxyZ  I have already marked it as "resolved." For me, it's done. What do you think?

edelweiss2604 · Answer

Thank you thank you sooooo much lilidurhone

What is QuickShare? - Page 2

Alcatel f685 trio black with answering machine

Texture issues in enshrouded

Old lullaby

Unable to connect to freebox os

Edit ad on leboncoin for free

Freebox wifi password

Computer tower that won't turn on

Blocked: are my messages still being delivered?

Video intercom inspector

Your computer can't use another display.