~ ZHPCleaner v2015.3.15.122 by Nicolas Coolman (15/03/2015)
~ Run by Julien (Administrator) (15/03/2015 23:01:19)
~ Forum : http://forum.nicolascoolman.fr
~ Facebook : https://www.facebook.com/nicolascoolman1
~ State version : Version OK
~ Type : R�parer
~ Report : C:\Users\Julien\Desktop\ZHPCleaner.txt
~ Quarantine : C:\Users\Julien\AppData\Roaming\ZHP\ZHPCleaner_Quarantine.txt
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
~ Windows 81, 64-bit (Build 9600)


---\\ Service. (0)
~ Aucun �l�ment malicieux trouv�.


---\\ Navigateur internet. (30)
SUPPRIM� donn�e: HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings [Bad : Port=50396 <-Loopback>] (Hijacker.Proxy)
SUPPRIM� donn�e: HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings [Bad : Port=50396 <-Loopback>] (Hijacker.Proxy)
REMPLAC� Quicklaunch: C:\Users\Julien\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk [Bad : "http://bitable.com/"] (Hijacker.Browser)
REMPLAC� Programs: C:\Users\Julien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [Bad : "http://bitable.com/"] (Hijacker.Browser)
REMPLAC� IE Params: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page [hxxp://Vosteran.com/?f=1&a=vst_ggfc_15_01_ff&cd=2XzuyEtN2Y1L1Qzu0E0CtD0E0CyEtA0D[...]] (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.AL", 4); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.aflt", "vst_ggfc_15_01_ff"); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.appId", "{4CB3598A-82E8-4D1F-983F-061238AE696E}"); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.cd", "2XzuyEtN2Y1L1Qzu0E0CtD0E0CyEtA0D0Azz0ByByCtDtC0BtN0D0Tzu0StCtD[...] (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.cr", "488345220"); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.dfltLng", ""); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.dfltSrch", true); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.dnsErr", true); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.excTlbr", false); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.hmpg", true); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.hmpgUrl", "http://Vosteran.com/?f=1&a=vst_ggfc_15_01_ff&cd=2XzuyEtN2[...] (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.id", "EC0EC43DA8B7601B"); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.instlDay", "16435"); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.instlRef", "142905_a"); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.newTabUrl", "http://Vosteran.com/?f=2&a=vst_ggfc_15_01_ff&cd=2XzuyEt[...] (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.prdct", "srchvstrn"); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.prtnrId", "WSE_Vosteran"); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.srchPrvdr", "Vosteran"); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.tlbrId", ""); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.tlbrSrchUrl", "http://Vosteran.com/?f=3&a=vst_ggfc_15_01_ff&cd=2Xzuy[...] (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.vrsn", ""); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn.vrsni", ""); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn_i.newTab", true); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn_i.smplGrp", "none"); (PUP.Vosteran)
REMPLAC�: [ogojzg98.default-1419367971695] - user_pref("extensions.srchvstrn_i.vrsnTs", "18:25:45"); (PUP.Vosteran)


---\\ Fichier h�te. (2)
~ Le fichier h�te est l�gitime. (21)
~ Le fichier h�te est l�gitime. (21)


---\\ T�che planifi�e. (0)
~ Aucun �l�ment malicieux trouv�.


---\\ Explorateur ( Dossiers, Fichiers ). (11)
DEPLAC� fichier: C:\Users\Julien\AppData\Roaming\Mozilla\Firefox\Profiles\ogojzg98.default-1419367971695\searchplugins\Vosteran.xml [] (PUP.Vosteran)
DEPLAC� dossier: C:\ProgramData\Baidu\Antivirus (Adware.BDPlugin)
DEPLAC� dossier: C:\ProgramData\Baidu (Adware.BDPlugin)
DEPLAC� fichier: C:\WINDOWS\Prefetch\WINSERVICESUPDATER.EXE-3E920447.pf (Trojan.Inject.RRE)
DEPLAC� fichier: C:\WINDOWS\Prefetch\WINSERVICESUPDATER.EXE-74D7E0F6.pf (Trojan.Inject.RRE)
DEPLAC� fichier: C:\WINDOWS\System32\roboot64.exe [solvusoft - WinThruster] (PUP.Systweak)
DEPLAC� fichier: C:\WINDOWS\System32\VisualDiscoveryOff.ini (PUP.VisualDiscovery)
DEPLAC� fichier: C:\WINDOWS\SysWOW64\VisualDiscovery.ini (PUP.VisualDiscovery)
DEPLAC� fichier: C:\WINDOWS\SysWOW64\VisualDiscoveryOff.ini (PUP.VisualDiscovery)
DEPLAC� fichier: C:\Users\Julien\AppData\Local\Temp\is765589038\3E4AFBE3_stp\PCSpeedMaximizer_AQFR_AFD_PPI_PCSM_4TR_AVG_bis.exe [Smart PC Solutions - PC Speed Maximizer] (PUP.SmartPCSolutions)
DEPLAC� fichier: C:\Users\Julien\AppData\Local\Temp\VisualDiscoveryr.log (PUP.VisualDiscovery)


---\\ Base de Registres ( Cl�s, Valeurs, Donn�es ). (23)
SUPPRIM� cl�*: HKCU\Software\InstallCore\1I1T1Q1S [] (Heuristic.InstallCore)
SUPPRIM� cl�*: HKCU\Software\InstallCore\Uninstall [] (Heuristic.InstallCore)
SUPPRIM� cl�: [X64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} [http://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_ggfc_15_01_ff&cd=2XzuyEtN2Y1L1Qzu0E0CtD0E0[...]] [Vosteran] (PUP.Vosteran)
SUPPRIM� cl�^: HKLM\SYSTEM\CurrentControlSet\Services\Update Dynamo Combo ["C:\Program Files (x86)\Dynamo Combo\updateDynamoCombo.exe"] (PUP.DynamoCombo)
SUPPRIM� cl�*: HKEY_USERS\S-1-5-21-1035883588-3461395266-744280900-1001\Software\Appscion [] (PUP.LiveSoftAction)
SUPPRIM� cl�*: HKEY_USERS\S-1-5-21-1035883588-3461395266-744280900-1001\Software\InstallCore [] (Adware.InstallCore)
SUPPRIM� cl�*: HKEY_USERS\S-1-5-21-1035883588-3461395266-744280900-1001\Software\nuevos-programas.com [] (PUP.Optional)
SUPPRIM� cl�*: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\api.browsestudio.com [171818] (PUP.BrowseStudio)
SUPPRIM� cl�*: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\browsestudio.com [] (PUP.BrowseStudio)
SUPPRIM� cl�*: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\api.browsestudio.com [172113] (PUP.BrowseStudio)
SUPPRIM� cl�*: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\browsestudio.com [] (PUP.BrowseStudio)
SUPPRIM� cl�*: [X64] HKLM\SOFTWARE\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967} [ISetup] (PUP.GetNow)
SUPPRIM� cl�*: [X64] HKLM\SOFTWARE\Classes\Iminent [] (Adware.IMBooster)
SUPPRIM� cl�*: [X64] HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Update BrowseStudio [] (PUP.BrowseStudio)
SUPPRIM� cl�*: [X64] HKLM\SOFTWARE\Wow6432Node\Iminent [] (Adware.IMBooster)
SUPPRIM� cl�*: [X64] HKLM\SOFTWARE\Wow6432Node\LenovoBrowserGuard [] (PUP.LenovoBrowserGuard)
SUPPRIM� cl�*: [X64] HKLM\SOFTWARE\Wow6432Node\VisualDiscovery [] (PUP.VisualDiscovery)
SUPPRIM� cl�*: [X64] HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{237FDFDB-3722-470E-8BA8-90196DABE967} [ISetup] (PUP.GetNow)
SUPPRIM� cl�*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LenovoBrowserGuard [ClientConnect LTD] (PUP.ClientConnect)
SUPPRIM� cl�*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack [] (PUP.ClientConnect)
SUPPRIM� cl�*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\WajamInternetEnhancer_RASAPI32 [] (PUP.Wajam)
SUPPRIM� cl�*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\WajamInternetEnhancer_RASMANCS [] (PUP.Wajam)
SUPPRIM� cl�*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08} [C:\Program Files (x86)\Iminent] (Adware.IMBooster)



---\\ Bilan de la r�paration
~ R�paration r�alis�e avec succ�s.
~ Ce navigateur est absent (Google Chrome)
~ Ce navigateur est absent (Opera Software)
~ Le syst�me a �t� red�marr�.


---\\ Statistiques
~ Items scann�s : 75153
~ Items trouv�s : 0
~ Items r�par�s : 45


End of clean at 23:13:50
===================
ZHPCleaner-[R]-15032015-23_13_50.txt
ZHPCleaner-[S]-15032015-23_00_18.txt