Virus UNKNOWN - DllName [ c:\windows\syswow64\iedkcs32.dll ]

Good evening,

Can you use this diagnostic software? It will help me assist you:

▶ Download ZHPDiag (by Nicolas Coolman)
▶ Run it (if you are on Windows Vista or Windows 7, do it by right-clicking --> Run as administrator)
▶ Let yourself be guided during the installation (be sure to check the box to create a shortcut on the Desktop). It will launch automatically at the end of the installation.
▶ Click on configure then on the icon representing a magnifying glass (“Default diagnostic with legitimate”) and accept the "full options report"
▶ The report can be found on your Desktop
▶ Go to this site, click on "Browse", select the ZHPDiag report and click on Send the file. Wait during the file upload, then copy/paste the link provided in your next response on the forum.

If you need help, follow this tutorial: http://www.sosvirus.net/canned-speech-zhpdiag-t712.html. Don't confuse ZHPFix and ZHPDiag!

See you soon
--
My knowledge rests on a book, my ignorance covers a library.

Voici le rapport. Si tu peux me dire quoi faire, je te remercie de ton aide. Merci à toi.

Report of ZHPDiag v2014.2.17.15 - Nicolas Coolman (02/17/2014)
~ Launched by fan (02/19/2014 11:24:51 PM)
~ Website Address https://nicolascoolman.webs.com/
~ Free Disinfection Assistance Forums: https://nicolascoolman.webs.com/
~ Translated by Nicolas Coolman
~ Version Status:
~ Whitelist: Disabled by user
~ Privilege Elevation: OK
~ User Account Control (UAC): Activated by user

---\\ Internet Browsers
MSIE: Internet Explorer v10.0.9200.16798 (Default)
GCIE: Google Chrome v31.0.1650.63

---\\ Windows Product Information
~ Language: French
Windows 8, 64-bit (Build 9200)
Windows Server License Manager Script: OK
~ ion: Windows(R) Operating System, OEM_DM channel
Windows ID Activation: OK
~ Windows Partial Key: B96BG
Windows License: OK
~ Windows Remaining Initializations Number: 999
Software Protection Service: OK
Windows Automatic Updates: OK
Windows Activation Technologies: OK

---\\ System Protection Software
Avira Free Antivirus v14.0.2.286
Malwarebytes Anti-Malware version 1.75.0.1300
Windows Defender W8

---\\ System Optimization Software

---\\ PeerToPeer Sharing Software

---\\ Software Monitoring
Adobe Flash Player 12 Plugin
Adobe Reader XI
Java 7 Update 51

---\\ System Information
~ Processor: AMD64 Family 20 Model 2 Stepping 0, AuthenticAMD
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3801 MB (64% free)
System Restore: Enabled
System drive C: has 162 GB (72%) free of 225 GB

---\\ System Connection Mode
~ Computer Name: FANNYDAVID
~ User Name: fan
~ All Users Names: HomeGroupUser$, fan, Administrator,
~ Unselected Option: None
Logged in as Administrator

---\\ Environment Variables
~ System Unit: C:\
~ %AppZHP%: C:\Users\fan\AppData\Roaming\ZHP\
~ %AppData%: C:\Users\fan\AppData\Roaming\
~ %Desktop%: C:\Users\fan\Desktop\
~ %Favorites%: C:\Users\fan\Favorites\
~ %LocalAppData%: C:\Users\fan\AppData\Local\
~ %StartMenu%: C:\Users\fan\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir%: C:\Windows\
~ %System%: C:\Windows\System32\

---\\ Enumeration of Disk Units
C: Hard drive, Flash drive, Thumb drive (Free 162 GB of 225 GB)
D: Hard drive, Flash drive, Thumb drive (Free 116 GB of 225 GB)
E: Floppy drive, Flash card reader, USB Key (Free 2 GB of 4 GB)
F: CD-ROM drive (Not Inserted)

---\\ Windows Security Center Status
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK
[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK
[HKLM\SYSTEM\CurrentControlSet\Services\COMSysApp] Type: OK
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime: OK
~ Security Center: 49 Scanned in 00mn 00s

---\\ Specific Search for Generic Files
[MD5.0E8E6463F81C80AFBED533E0F1F8895D] - (.Microsoft Corporation - Windows Explorer.) (.01/06/2013 - 12:34:21.) -- C:\Windows\Explorer.exe [2391280]
[MD5.FE9AB232B56A12224E8A3F3F9878C9A3] - (.Microsoft Corporation - Windows Startup Application.) (.26/07/2012 - 04:08:50.) -- C:\Windows\System32\Wininit.exe [132608]
[MD5.90860E913075B03369BEB7B0B510DC2F] - (.Microsoft Corporation - Internet Extensions for Win32.) (.01/02/2014 - 10:19:49.) -- C:\Windows\System32\wininet.dll [2241536]
[MD5.BCF2036A0DD579E47C008C133550283E] - (.Microsoft Corporation - Windows Logon Application.) (.11/10/2012 - 06:46:58.) -- C:\Windows\System32\Winlogon.exe [517120]
[MD5.9448F5740A037EC0C18F0E9177232DD0] - (.Microsoft Corporation - License Library.) (.26/07/2012 - 04:07:20.) -- C:\Windows\System32\sppcomapi.dll [273408]
[MD5.7C0E0EDF18D6CC565D7BFBB451709FA5] - (.Microsoft Corporation - Connection Function Driver for WinSock.) (.04/09/2013 - 04:11:23.) -- C:\Windows\system32\Drivers\AFD.sys [576512]
[MD5.A721FF570C2387E383BDDEA9632863C9] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.26/07/2012 - 06:00:48.) -- C:\Windows\system32\Drivers\atapi.sys [25840]
[MD5.990B1BABE6E81FB18E65A87EBEFB1772] - (.Microsoft Corporation - CD-ROM File System Driver.) (.26/07/2012 - 03:30:10.) -- C:\Windows\system32\Drivers\Cdfs.sys [108544]
[MD5.339BFF85D788268752DA8C9644B188EE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.26/07/2012 - 03:26:36.) -- C:\Windows\system32\Drivers\Cdrom.sys [174080]
[MD5.09D9EB9E7898F8E6561473A20CC808B9] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.26/07/2012 - 03:26:53.) -- C:\Windows\system32\Drivers\DfsC.sys [118784]
[MD5.7D87B5B6C7188D553E11B59DC7F0B111] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/09/2012 - 07:08:44.) -- C:\Windows\system32\Drivers\HDAudBus.sys [71168]
[MD5.C9E9CBF73AFFBFE3E801EFB516787BA3] - (.Microsoft Corporation - i8042 Port Driver.) (.26/07/2012 - 03:28:51.) -- C:\Windows\system32\Drivers\i8042prt.sys [112640]
[MD5.3969B9C218DD3FAA9F4ED2FFC3651C02] - (.Microsoft Corporation - IP Network Address Translator.) (.26/07/2012 - 03:23:01.) -- C:\Windows\system32\Drivers\IpNat.sys [145920]
[MD5.93179D48066918323628CB016D8C94DC] - (.Microsoft Corporation - SMB Minidriver Windows NT.) (.05/02/2013 - 23:29:09.) -- C:\Windows\system32\Drivers\MRxSmb.sys [370688]
[MD5.7CEC25C682D319D484630B3952C31A11] - (.Microsoft Corporation - MBT Transport driver.) (.26/07/2012 - 03:24:28.) -- C:\Windows\system32\Drivers\netBT.sys [331776]
[MD5.76929F4A69E425911A63B407E26C2589] - (.Microsoft Corporation - NT File System Driver.) (.02/02/2013 - 11:54:54.) -- C:\Windows\system32\Drivers\ntfs.sys [1933544]
[MD5.4563DAF8C6A740AD7F501E219BD10766] - (.Microsoft Corporation - Parallel Port Driver.) (.26/07/2012 - 03:29:53.) -- C:\Windows\system32\Drivers\Parport.sys [105984]
[MD5.A14D625C5AEE5FFE0F47D1A1D419FAAE] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.26/07/2012 - 03:23:17.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [124928]
[MD5.B2A3AD74FF2E2FFA73AF2567108231B3] - (.Microsoft Corporation - Microsoft RDP device redirector.) (.26/07/2012 - 03:25:18.) -- C:\Windows\system32\Drivers\rdpdr.sys [179712]
[MD5.73DC722CE5DF26D7638CE2446F2655C7] - (.Microsoft Corporation - TDI Translation Driver.) (.26/07/2012 - 06:26:47.) -- C:\Windows\system32\Drivers\tdx.sys [117248]
[MD5.78A5BBA3819FFFC62FFEC3E2220D102D] - (.Microsoft Corporation - Volume Snapshot Driver.) (.01/06/2013 - 12:26:33.) -- C:\Windows\system32\Drivers\volsnap.sys [327936]
~ Generic Processes: Scanned in 00mn 00s

---\\ Status of Hidden Files (Hidden/Total)
~ My Pictures: 2/266
~ My Musics: 7/8
My Videos: 2/2 (Modified)
~ My Favorites: 1/26
~ My Documents: 1/76
~ My Desktop: 1/247
~ Start Menu: 1/28
~ Hidden Files: Scanned in 00mn 00s

---\\ Running Processes
[MD5.280B64F6BFCEDE6D67D261EB808AA617] - (.Acer Incorporated - Hotkey Utility.) -- C:\Program Files (x86)\Packard Bell\Hotkey Utility\HotkeyUtility.exe [524944] [PID.3140]
[MD5.224F6B374852153C8C24BED141AE3A20] - (...) -- ysWOW64\rundll32.exe [0] [PID.3836]
[MD5.63A2D767B9261B4F33F97BF88F2FB197] - (.Hewlett-Packard Co. - HP Digital Imaging Monitor.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [276328] [PID.3892]
[MD5.DD231039B13EC2ABDE315D76E658EF0E] - (.Avira Operations GmbH & Co. KG - Antivirus System Tray Tool (Desktop).) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600] [PID.3900]
[MD5.BEFFB2D021E7FA9E92249F3997930A68] - (.Acer - ArcServer.) -- C:\Program Files (x86)\Acer Remote\ArcServer.exe [522144] [PID.3912]
[MD5.E650003C472935D7F5B01CF67490669C] - (.BitTorrent Inc. - BitTorrent.) -- C:\Users\fan\AppData\Roaming\BitTorrent\BitTorrent.exe [1126488] [PID.3952] =>P2P.BitTorrent
[MD5.0CED501E811F5C4745415FCC000CE043] - (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe [164864] [PID.1036]
[MD5.5EBBA07CFE002FF3DB1B0AAC33689913] - (.Glarysoft Ltd - Glary Utilities 4.) -- C:\Program Files (x86)\Glary Utilities 4\Integrator.exe [780064] [PID.4104]
[MD5.2FB757B35C94B1C1C65BA35E4E7EC0F2] - (.Hewlett-Packard Co. - HP CUE Status Root.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe [174952] [PID.4544]
[MD5.F9DFC08677FC9AC81DD5ACA5EE879E47] - (.Hewlett-Packard Co. - HP CUE Alert Popup Window Objects.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe [565096] [PID.4252]
[MD5.B2F0B501A7C017F21C4B4417623895BD] - (.Hewlett-Packard - GPCore COM object.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe [367976] [PID.4148]
[MD5.3AB2CCB32AB509609B2D9AEB567DA357] - (.Arovax - Arovax AntiSpyware.) -- C:\Program Files (x86)\Arovax AntiSpyware\arovaxantispyware.exe [1966080] [PID.5096]
[MD5.7C3459C721B53BA356E0B36D1FDC2E6C] - (.BrowserSafeguard - BrowserSafeguard.) -- C:\Users\fan\AppData\Local\BrowserSafeguard\BrowserSafeguard.exe [418304] [PID.5032] =>PUP.BrowserSafeguard
[MD5.77FBE53DE14794B84C352DD9D9D232DF] - (.Microsoft Corporation - TCP/IP Ping Command.) -- C:\Windows\SysWOW64\PING.exe [18432] [PID.2552]
[MD5.376A9B411BF8B77D5BF84B24D0C7DACD] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [863184] [PID.2292]
[MD5.AB44884BC129FC04D75A4649E0710203] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8338432] [PID.3156]
~ Processes Running: Scanned in 00mn 00s

---\\ Google Chrome, Startup, Search, Extensions (G0,G1,G2)
C:\Users\fan\AppData\Local\Google\Chrome\User Data\Default\Preferences
G1 - GCS: Preference [User Data\Default] None
G0 - GCSP: Preference [User Data\Default] , "http://www.google.comom=ild&uid=ST500DM002-1BD142_Z3THDTC0XXXXZ3THDTC0", "https://www.google.com/?gws_rd=ssl" "http://start.iminent.com/?appId=663BC760-46AE-461B-8671-40CDE1E24CA0", "http://search.conduit.com/?ctid=CT3318857&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SPB8A4DBB6-6596-4354-9FB5-B589DDF1843A&SSPV=", "http://start.mysearchdial.com/?f=1&a=tele0202ch&cd=2XzuyEtN2Y1L1QzuyB =>Adware.IMBooster
G2 - GCE: Preference [User Data\Default] [ahfgeienlihckogmohjhadlkjgocpleb] Google Store v.0.2 (Enabled)
G2 - GCE: Preference [User Data\Default] [ahmilhmcinpmpohfoiccaplbhgelbnim] Torntv V6.0 v.1.0.0 (Enabled) =>Hijacker.TornTV
G2 - GCE: Preference [User Data\Default] [blpcfgokakmgnkcojhhkbfbldkacnbeo] YouTube v.4.2.6 (Enabled)
G2 - GCE: Preference [User Data\Default] [coobgpohoikkiipiblmjeljniedjpjpf] Google Search v.0.0.0.20 (Enabled)
G2 - GCE: Preference [User Data\Default] [eemcgdkfndhakfknompkggombfjjjeno] Bookmark Manager v.0.1 (Enabled)
G2 - GCE: Preference [User Data\Default] [ennkphjdgehloodpbhlhldgbnhmacadg] Settings v.0.2 (Enabled)
G2 - GCE: Preference [User Data\Default] [gdidcmifanncidcpmndaenenhcgeaica] Application Findizer v.1.20, (Enabled)
G2 - GCE: Preference [User Data\Default] [gfdkimpbcpahaombhbimeihdjnejgicl] Feedback v.1.0 (Enabled)
G2 - GCE: Preference [User Data\Default] [jjflmfkjppbmejlfbhlpgjnomdoefkfa] Share With Care v.0.1 (Enabled)
G2 - GCE: Preference [User Data\Default] [lcnnhcneegeeojhgpfijnlnocjdmlaon] Value apps v.1.7.0.2, (Enabled) =>Toolbar.Conduit
G2 - GCE: Preference [User Data\Default] [mfehgcgbbipciphmccgaenjidiccnmng] Cloud Print v.0.1 (Enabled)
G2 - GCE: Preference [User Data\Default] [mgndgikekgjfcpckkfioiadnlibdjbkf] Chrome v.0.1 (Enabled)
G2 - GCE: Preference [User Data\Default] [nmmhkkegccagdldgiimedpiccmgmieda] Google Wallet v.0.0.6.1 (Enabled)
G2 - GCE: Preference [User Data\Default] [pjkljhegncpnkpknbcohdijeoejaedia] Gmail v.7 (Enabled)
~ Google Browser: 16 Scanned in 00mn 13s

---\\ Mozilla Firefox, Plugins, Startup, Search, Extensions (P2,M0,M1,M2,M3)
M3 - MFPP: Plugins - [fan] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\do-search.xml =>PUP.DoSearches
P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (...) -- C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll
P2 - FPN: [HKLM] [@videolan.org/vlc,version=2.1.3] - (.VideoLAN - VLC media player Web Plugin 2.1.3.) -- C:\Program Files\VideoLAN\VLC\npvlc.dll =>.VideoLAN
~ Firefox Browser: 3 Scanned in 00mn 00s

---\\ Internet Explorer, Startup, Search, URLSearchHook, Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com =>Adware.MyWebSearch
R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com =>Adware.MyWebSearch
R0 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com =>Adware.MyWebSearch
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = https://www.microsoft.com/fr-fr/
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.aartemis.com =>PUP.AArtemis
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.aartemis.com =>PUP.AArtemis
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs,Tabs = http://start.mysearchdial.com =>Adware.MyWebSearch
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.aartemis.com =>PUP.AArtemis
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.aartemis.com =>PUP.AArtemis
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk
R3 - URLSearchHook: Microsoft Url Search Hook [64Bits] - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Internet Browser.) (10.00.9200.16384 (win8_rtm.120725-1247)) -- C:\Windows\SysWOW64\ieframe.dll
~ IE Browser: 18 Scanned in 00mn 00s

---\\ Internet Explorer, Proxy Management (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <-loopback> =>Hijacker.Proxy
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:50471;https=127.0.0.1:50471 =>Hijacker.Proxy
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s

---\\ Analysis of lines F0, F1, F2, F3 - IniFiles, Autoloading programs
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s

---\\ Hosts file redirection (O1)
~ The hosts file is clean.
~