~ ZHPCleaner v2017.6.26.105 by Nicolas Coolman (2017/06/26)
~ Run by benja_000 (Administrator) (02/07/2017 15:36:49)
~ Web: https://www.nicolascoolman.com
~ Blog: https://nicolascoolman.eu/
~ Facebook : https://www.facebook.com/nicolascoolman1
~ State version : Version OK
~ Certificate ZHPCleaner: Illegal
~ Type : Nettoyer
~ Report : C:\Users\benja_000\Desktop\ZHPCleaner.txt
~ Quarantine : C:\Users\benja_000\AppData\Roaming\ZHP\ZHPCleaner_Reg.txt
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
Windows 10 Home, 64-bit (Build 14393)


---\\ Service. (0)


---\\ Navigateur internet. (1)
SUPPRIMÉ donnée: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride [Bad : <-loopback>;] =>Hijacker.Proxy


---\\ Fichier hôte. (3)
REMPLACÉ: 35.156.90.191 authserver.mojang.com
REMPLACÉ: 35.156.90.191 sessionserver.mojang.com
~ Nombre de redirections trouvées 2/3


---\\ Tâche planifiée. (1)
SUPPRIMÉ tâche: [AutoPico Daily Restart] [C:\Program Files\KMSpico\AutoPico.exe (Not File) ] =>HackTool.KMSpico


---\\ Explorateur ( Dossiers, Fichiers ). (23)
DEPLACÉ fichier: C:\Program Files\KMSpico\Service_KMS.exe [@ByELDI - Service_KMS] =>HackTool.KMSpico
DEPLACÉ fichier: C:\WINDOWS\System32\drivers\{36ed28a4-ac0a-4653-91ff-10beb4246550}Gw64.sys [StdLib - StdLib] =>PUP.Optional.LinkiDoo
DEPLACÉ fichier^: C:\WINDOWS\System32\drivers\{6dd55e9a-3d06-4d70-b5e7-05fc3e0a3d66}Gw64.sys [StdLib - StdLib] =>PUP.Optional.LinkiDoo
DEPLACÉ fichier^: C:\WINDOWS\System32\drivers\{848705a5-8a27-403e-9b59-732d0608bcbc}Gw64.sys [StdLib - StdLib] =>PUP.Optional.LinkiDoo
DEPLACÉ fichier^: C:\WINDOWS\System32\drivers\{eb01aed1-bba3-4e72-8323-a77bb027b1d4}Gw64.sys [StdLib - StdLib] =>PUP.Optional.LinkiDoo
DEPLACÉ fichier**: C:\Program Files\KMSpico\AutoPico.exe [@ByELDI - AutoPico] =>HackTool.KMSpico
DEPLACÉ fichier**: C:\Windows\Prefetch\MEDIAGET.EXE-2AFE4C32.pf =>.Superfluous.MediaGet
DEPLACÉ fichier**: C:\Users\benja_000\Desktop\KMSpico - MrPlutani0m.exe [ - KMSpico Setup] =>HackTool.KMSpico
DEPLACÉ fichier**: C:\Users\benja_000\Downloads\Download_Right_Click_To_Necromance_downloader.exe [electoPod incorp. - ] =>.Superfluous.WebitarProduction
DEPLACÉ fichier**: C:\Users\benja_000\Downloads\KMSpico - MrPlutani0m.exe [ - KMSpico Setup] =>HackTool.KMSpico
DEPLACÉ fichier**: C:\Users\benja_000\AppData\Local\nsaF419.tmp [CMI Limited - Setup] =>.Superfluous.CMILimited
DEPLACÉ fichier**: C:\Users\benja_000\AppData\Local\nsdF531.tmp [CMI Limited - Setup] =>.Superfluous.CMILimited
DEPLACÉ fichier**: C:\Users\benja_000\AppData\Local\nspD2B8.tmp [CMI Limited - Setup] =>.Superfluous.CMILimited
DEPLACÉ fichier**: C:\Windows\SECOH-QAD.exe =>HackTool.KMSpico
DEPLACÉ dossier*: C:\Program Files (x86)\dollarkeeepper =>PUP.Optional.DollarKeeper
DEPLACÉ dossier*: C:\Program Files (x86)\Mirillis =>.Superfluous.Empty
DEPLACÉ dossier*: C:\Program Files (x86)\Software =>.Superfluous.Empty
DEPLACÉ dossier*: C:\Program Files\KMSpico =>HackTool.KMSpico
DEPLACÉ dossier*: C:\Program Files\shopperz =>PUP.Optional.Shopperz
DEPLACÉ dossier*: C:\ProgramData\41c80e239b441d2 =>Adware.CrossRider
DEPLACÉ dossier*: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico =>HackTool.KMSpico
DEPLACÉ dossier*: C:\Users\benja_000\AppData\Roaming\Store =>.Superfluous.Nosibay
DEPLACÉ dossier*: C:\Users\benja_000\Documents\Optimizer Pro =>PUP.Optional.OptimizerPro


---\\ Base de Registres ( Clés, Valeurs, Données ). (57)
SUPPRIMÉ clé*: HKCU\Software\HQ-Video-Pro-2.1cV14.01-nv [] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Sense-nv [] =>Adware.CrossRider
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Wow6432Node\HQ-Video-Pro-2.1cV14.01-nv [] =>Adware.CrossRider
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Wow6432Node\Sense-nv [] =>Adware.CrossRider
SUPPRIMÉ clé*: HKLM\SYSTEM\CurrentControlSet\Services\Service KMSELDI [C:\Program Files\KMSpico\Service_KMS.exe (Not File)] =>HackTool.KMSpico
SUPPRIMÉ clé*: HKLM\SYSTEM\CurrentControlSet\Services\{36ed28a4-ac0a-4653-91ff-10beb4246550}Gw64 [C:\WINDOWS\System32\drivers\{36ed28a4-ac0a-4653-91ff-10beb4246550}Gw64.sys (Not File)] =>PUP.Optional.LinkiDoo
SUPPRIMÉ clé*: HKLM\SYSTEM\CurrentControlSet\Services\{6dd55e9a-3d06-4d70-b5e7-05fc3e0a3d66}Gw64 [C:\WINDOWS\System32\drivers\{6dd55e9a-3d06-4d70-b5e7-05fc3e0a3d66}Gw64.sys] =>PUP.Optional.LinkiDoo
SUPPRIMÉ clé*: HKLM\SYSTEM\CurrentControlSet\Services\{848705a5-8a27-403e-9b59-732d0608bcbc}Gw64 [C:\WINDOWS\System32\drivers\{848705a5-8a27-403e-9b59-732d0608bcbc}Gw64.sys] =>PUP.Optional.LinkiDoo
SUPPRIMÉ clé*: HKLM\SYSTEM\CurrentControlSet\Services\{eb01aed1-bba3-4e72-8323-a77bb027b1d4}Gw64 [C:\WINDOWS\System32\drivers\{eb01aed1-bba3-4e72-8323-a77bb027b1d4}Gw64.sys] =>PUP.Optional.LinkiDoo
SUPPRIMÉ clé: HKEY_USERS\S-1-5-21-947915296-3583002873-1704246444-1001\SOFTWARE\HQ-Video-Pro-2.1cV14.01-nv [] =>Adware.CrossRider
SUPPRIMÉ clé*: HKEY_USERS\S-1-5-21-947915296-3583002873-1704246444-1001\SOFTWARE\PluginAddon [] =>PUP.Optional.Vonteera
SUPPRIMÉ clé*: HKEY_USERS\S-1-5-21-947915296-3583002873-1704246444-1001\SOFTWARE\Classes\.torrent [mediagettorrentfile] =>.Superfluous.MediaGet
SUPPRIMÉ clé*: HKEY_USERS\S-1-5-21-947915296-3583002873-1704246444-1001\SOFTWARE\Classes\mediagettorrentfile [MediaGet2 torrent] =>.Superfluous.MediaGet
SUPPRIMÉ clé*: HKEY_USERS\S-1-5-21-947915296-3583002873-1704246444-1001\SOFTWARE\Classes\mediagetvideofile [MediaGet2 video file] =>.Superfluous.MediaGet
SUPPRIMÉ clé*: HKEY_USERS\.DEFAULT\Software\HQ-Video-Pro-2.1cV14.01-nv [] =>Adware.CrossRider
SUPPRIMÉ clé*: HKEY_USERS\.DEFAULT\Software\AppDataLow\Software\HQ-Video-Pro-2.1cV14.01 [] =>Adware.CrossRider
SUPPRIMÉ clé: HKCU\Software\PluginAddon [] =>PUP.Optional.Vonteera
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1331551-D034-4771-9F94-9854325C18C} [C:\Program Files (x86)\Ge-Force (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1CDF8C60-BD8E-4AD2-9FE2-5D5B4C665262} [C:\Program Files (x86)\HQ-Video-Pro-2.1cV14.01 (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1F943EA7-7F8F-4E28-8724-E84A8A5C67E2} [C:\Program Files (x86)\HQ-Video-Pro-2.1cV14.01 (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2BFB1FB6-3D68-44C2-B754-AC7271E9D57B} [C:\Program Files (x86)\HQ-Video-Pro-2.1cV14.01 (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{35EBCEC4-23CE-41D6-A42F-931FCBFF01F} [C:\Program Files (x86)\HQ-Video-Pro-2.1cV14.01 (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3685C856-7574-4191-AC6-EEF502B2D25} [C:\Program Files (x86)\Ge-Force (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{38A77D01-E02D-49F2-8DAF-E6A0EB169E41} [C:\Program Files (x86)\Ge-Force (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{47F11AD1-9C15-4909-BA4F-49DDCA172126} [C:\Program Files (x86)\HQ-Video-Pro-2.1cV14.01 (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{583A2444-F2E5-4B86-BABD-BF5D437EB7E} [C:\Program Files (x86)\Ge-Force (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5F5A088F-69AC-4811-9FD8-1D4F6D55398} [C:\Program Files (x86)\HQ-Video-Pro-2.1cV14.01 (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6DAEDA42-C093-4744-A4D2-584FF184F4D0} [C:\Program Files (x86)\HQ-Video-Pro-2.1cV14.01 (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{755D5C-459C-4FE5-9F30-C22D885F80E2} [C:\Program Files (x86)\Ge-Force (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{78B00525-1713-49E4-BCA1-4A03DD9967D} [C:\Program Files (x86)\HQ-Video-Pro-2.1cV14.01 (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{800A4779-2AA4-4DE7-A14B-7DB075CDF1F} [C:\Program Files (x86)\HQ-Video-Pro-2.1cV14.01 (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B28806A8-C89-46D5-8538-CB999D4B349} [C:\Program Files (x86)\HQ-Video-Pro-2.1cV14.01 (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B620C5C8-7D57-42AB-8D65-5737D1608C} [C:\Program Files (x86)\HQ-Video-Pro-2.1cV14.01 (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B657AEFF-E3D5-4FB6-A33-6CE8995C4AE} [C:\Program Files (x86)\Ge-Force (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAD4A3F8-D45F-4B66-A99A-61428D72437A} [C:\Program Files (x86)\HQ-Video-Pro-2.1cV14.01 (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C7E6E0CF-E5A7-46D0-963E-B4E3E7812C46} [C:\Program Files (x86)\HQ-Video-Pro-2.1cV14.01 (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C9CC1EFD-8DFC-4ED4-A943-A9EDFB87E51D} [C:\Program Files (x86)\HQ-Video-Pro-2.1cV14.01 (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CAC7C1F1-29F8-44D3-B9D9-EECD407021F5} [C:\Program Files (x86)\Ge-Force (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F0D629D2-A4B7-4166-AADF-3D592A9C32D} [C:\Program Files (x86)\HQ-Video-Pro-2.1cV14.01 (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F3FCA3F4-4222-45C4-BD82-57297F5F7A9} [C:\Program Files (x86)\Ge-Force (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F71EC432-427E-4479-A0B5-53B27DD0E68} [C:\Program Files (x86)\HQ-Video-Pro-2.1cV14.01 (Not File)] =>Adware.CrossRider
SUPPRIMÉ clé*: HKCU\Software\WEBAPP [] =>.Superfluous.Downloader
SUPPRIMÉ clé*: HKLM\SOFTWARE\Wow6432Node\Policies\Google\Update [] =>PUM.Security.Hijack
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Microsoft\Tracing\ByteFence_RASAPI32 [] =>.Superfluous.ByteFence
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Microsoft\Tracing\ByteFence_RASMANCS [] =>.Superfluous.ByteFence
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KMSpico_is1 [KMSpico v9.3] =>HackTool.KMSpico
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SoftwareUpdate.exe [] =>PUP.Optional.Boxore
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Wow6432Node\ClickCaption_1.10.0.6 [] =>PUP.Optional.ClickCaption
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Wow6432Node\SuperClick_1.10.0.16 [] =>PUP.Optional.SuperClick
SUPPRIMÉ valeur: HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions\\{DACC7D21-88D3-8701-79DB-50B30225DE6E} [C:\Program Files (x86)\ver4BlockAndSurf\186.xpi] =>PUP.Optional.BlockAndSurf
SUPPRIMÉ valeur: HKLM64\SOFTWARE\Mozilla\Firefox\Extensions\\{2395B860-45E4-42fd-96E6-50BA597C1C42} [C:\Program Files\shopperz\Firefox] =>PUP.Optional.Shopperz
SUPPRIMÉ valeur: HKLM64\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions\\{2395B860-45E4-42fd-96E6-50BA597C1C42} [C:\Program Files\shopperz\Firefox] =>PUP.Optional.Shopperz
SUPPRIMÉ valeur: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\mbot_fr_627 [] =>Adware.CrossRider
SUPPRIMÉ valeur: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\gmsd_fr_571 [] =>Adware.CrossRider
SUPPRIMÉ valeur: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder\\SmartWeb.lnk [0x03000000C2DE06F5E59AD001] =>PUP.Optional.SmartWebSearch
SUPPRIMÉ valeur: HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\firewallRules\\{3EAFA32C-7F35-4D70-B04E-30FA9C6B3DF6} [C:\Users\benja_000\AppData\Local\MediaGet2\mediaget.exe] =>.Superfluous.MediaGet
SUPPRIMÉ valeur: HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\firewallRules\\{C00CA5C8-18AA-4F3C-B6DD-73A7903FA668} [C:\Users\benja_000\AppData\Local\MediaGet2\mediaget.exe] =>.Superfluous.MediaGet


---\\ Récapitulatif des éléments trouvés sur votre station. (21)
https://nicolascoolman.eu/2017/04/03/hijacker-proxy/ =>Hijacker.Proxy
https://nicolascoolman.eu/2017/02/16/hacktool-kmspico/ =>HackTool.KMSpico
https://www.nicolascoolman.com/fr/pup-linkidoo/ =>PUP.Optional.LinkiDoo
https://www.nicolascoolman.com/fr/pup-mediaget/ =>.Superfluous.MediaGet
https://nicolascoolman.eu/2017/01/20/logiciels-superflus/ =>.Superfluous.WebitarProduction
https://nicolascoolman.eu/2017/01/20/logiciels-superflus/ =>.Superfluous.CMILimited
https://nicolascoolman.eu/2017/01/27/repaquetage-et-infection/ =>PUP.Optional.DollarKeeper
https://nicolascoolman.eu/2017/01/20/logiciels-superflus/ =>.Superfluous.Empty
https://www.anti-malware.top/2016/04/21/pup-optional-shopperz/ =>PUP.Optional.Shopperz
https://nicolascoolman.eu/2017/03/11/pup-optional-crossrider/ =>Adware.CrossRider
https://www.anti-malware.top/2016/05/03/superfluous-nosibay/ =>.Superfluous.Nosibay
https://www.nicolascoolman.com/fr/pup-optimizerpro/ =>PUP.Optional.OptimizerPro
https://www.nicolascoolman.com/fr/trojan-vonteera/ =>PUP.Optional.Vonteera
https://nicolascoolman.eu/2017/01/20/logiciels-superflus/ =>.Superfluous.Downloader
https://nicolascoolman.eu/2017/01/27/repaquetage-et-infection/ =>PUM.Security.Hijack
https://nicolascoolman.eu/2017/03/13/superfluous-bytefence/ =>.Superfluous.ByteFence
https://nicolascoolman.eu/2017/03/14/pup-optional-boxore/ =>PUP.Optional.Boxore
https://www.nicolascoolman.com/fr/pup-optional-clickcaption/ =>PUP.Optional.ClickCaption
https://www.nicolascoolman.com/fr/pup-superclick/ =>PUP.Optional.SuperClick
https://www.nicolascoolman.com/fr/pup-blockandsurf/ =>PUP.Optional.BlockAndSurf
https://www.nicolascoolman.com/fr/pup-smartwebsearch/ =>PUP.Optional.SmartWebSearch


---\\ Nettoyage Additionnel. (26)
~ Suppression des Clés de registre Tracing. (26)
~ Suppression des anciens rapports ZHPCleaner. (0)


---\\ Bilan de la réparation
~ Réparation réalisée avec succès.
~ Ce navigateur est absent (Opera Software)
~ Le système a été redémarré.


---\\ Statistiques
~ Items scannés : 825
~ Items trouvés : 0
~ Items annulés : 0
~ Items réparés : 85


~ End of clean in 00h01mn26s
~====================
ZHPCleaner-[R]-02072017-15_38_15.txt
ZHPCleaner-[S]-02072017-15_36_33.txt