~ ZHPCleaner v2017.1.20.17 by Nicolas Coolman (2017/01/20)
~ Run by PC-ABDERRAHMEN (Administrator) (20/01/2017 21:49:27)
~ Web: https://www.nicolascoolman.com
~ Blog: https://www.anti-malware.top
~ Facebook : https://www.facebook.com/nicolascoolman1
~ State version : Version OK
~ Type : Repair
~ Report : C:\Users\PC-ABDERRAHMEN\Desktop\ZHPCleaner.txt
~ Quarantine : C:\Users\PC-ABDERRAHMEN\AppData\Roaming\ZHP\ZHPCleaner_Quarantine.txt
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
Windows 10 Pro, 64-bit (Build 14393)


---\\ Services (0)


---\\ Browser internet (0)
~ No malicious or unnecessary items found.


---\\ Hosts file (1)
~ The hosts file is legitimate (21)


---\\ Scheduled automatic tasks. (1)
DELETED task: [AutoPico Daily Restart] [C:\Program Files\KMSpico\AutoPico.exe (Not File) ] =>HackTool.KMSpico


---\\ Explorer ( File, Folder) (56)
MOVED file: C:\Users\PC-ABDERRAHMEN\Desktop\Popcorn Time.lnk [Bad : C:\Users\PC-ABDERRAHMEN\AppData\Local\Popcorn Time\nw.exe](..) =>.Superfluous.PopcornTime
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gihcngphjjankfngmgdkihhngndcdflc_0.localstorage-journal =>PUP.Optional.Adblocker
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gihcngphjjankfngmgdkihhngndcdflc_0.localstorage =>PUP.Optional.Adblocker
MOVED file: C:\Windows\KMSServerService\KMS Server Service.exe [My Digital Life Forums - KMS Server Emulator Service] =>HackTool.AutoKMS
MOVED file: C:\ProgramData\KMSAutoS\KMSAuto Net.exe [MSFree Inc. - KMSAuto Net] =>HackTool.WinActivator
MOVED file: C:\ProgramData\KMSAutoS\bin\KMSSS.exe [MDL Forum, mod by Ratiborus - KMS Server Emulator Service (XP)] =>HackTool.AutoKMS
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.00D57B0F-01FA-B79F-08D6-878ED20C4C9B_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.0116DC02-781B-D1D1-FC1C-C80195511E17_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.0862A72D-A96C-83E5-AD0F-78B6AA06F9C6_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.0C8CF327-9D17-CCDE-18AF-DFF4F20070E5_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.18DDC675-D472-0DB4-9563-7DF7C34F512C_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.1A7994D6-5342-8581-71FB-A2BD1C895D93_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.1F63B8C3-2D48-9497-0A0A-2CBD462EDE76_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.1FE89C0B-9BED-CC5D-7426-9E4025D6BDD9_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.32A48683-F264-932C-7870-B93BB448ED69_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.3BFD26C9-8DA9-B940-F638-55890012AAB4_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.50611331-FE19-D366-B049-694B8AC9D758_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.557EA3BB-623E-ADD9-4DFB-629A8648A038_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.558F5D32-0827-EB7B-6AD6-D5DB4138B3AA_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.62B49C0A-499E-A02D-EBCB-EB168E148E52_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.664AA17A-2D25-0823-3315-3708FE16147A_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.674C4C14-7BAA-F782-E214-956DC3BEDF39_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.68BC3251-2D8B-A604-92BA-893638CA72EA_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.68E019EB-0B92-5E08-5D86-9BFE6DBA8517_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.69F3BCAB-8975-C526-30F5-39FA70C77AD9_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.6D151227-6BD9-726D-B30E-A8A018DCC82B_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.6EA6FC2E-9305-586B-3411-02826D151533_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.97612282-D1E8-1D6A-9E92-C271E7F177EF_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.993325CD-9CA8-DD49-50C4-377C092AEF1B_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.9D4DED89-CABC-F4FB-8133-BC5EDB1C7EDA_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.A8849751-10C4-3F5D-1F42-DA79DB2C7BE9_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.A90B8400-D36D-8235-8BF2-A21A53D3FB65_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.DFBE09D0-1F22-A9C0-2D3D-3F4C6351E58F_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.E336BB8F-16ED-7CBE-AFEE-971DD3041585_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.E6658C19-4221-2EBE-763A-F0493FBA2BB0_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.E6D3B497-80AF-7F14-F9E6-9606EE369FC3_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED file: C:\Users\PC-ABDERRAHMEN\AppData\Local\Temp\sa.FACF9DDE-1FF1-B57D-4D1D-CE479FDD42AF_5__.Public.AppUpdate.dat =>.Superfluous.Temporary
MOVED folder: C:\Users\PC-ABDERRAHMEN\AppData\Local\Google\Chrome\User Data\Default\Extensions\gihcngphjjankfngmgdkihhngndcdflc =>PUP.Optional.Adblocker
MOVED folder: C:\Program Files\KMSpico =>HackTool.KMSpico
MOVED folder: C:\ProgramData\KMSAutoS =>HackTool.WinActivator
MOVED folder: C:\ProgramData\Microsoft Toolkit =>HackTool.AutoKMS
MOVED folder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico =>HackTool.KMSpico
MOVED folder: C:\Users\PC-ABDERRAHMEN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Popcorn Time =>.Superfluous.PopcornTime
MOVED folder: C:\Users\PC-ABDERRAHMEN\AppData\Local\MSfree Inc =>HackTool.WinActivator
MOVED folder: C:\Users\PC-ABDERRAHMEN\AppData\Local\Popcorn Time =>.Superfluous.PopcornTime
MOVED folder: C:\Users\PC-ABDERRAHMEN\AppData\Local\Popcorn-Time =>.Superfluous.PopcornTime
MOVED folder: C:\Users\PC-ABDERRAHMEN\AppData\Local\Google\Chrome\User Data\Default\File System\008 =>PUP.Optional.DomaIQ
MOVED folder: C:\WINDOWS\Installer\MSI1263.tmp- =>.Superfluous.Empty
MOVED folder: C:\WINDOWS\Installer\MSI4720.tmp- =>.Superfluous.Empty
MOVED folder: C:\WINDOWS\Installer\MSI5078.tmp- =>.Superfluous.Empty
MOVED folder: C:\WINDOWS\Installer\MSI6FEC.tmp- =>.Superfluous.Empty
MOVED folder: C:\WINDOWS\Installer\MSI8F01.tmp- =>.Superfluous.Empty
MOVED folder: C:\WINDOWS\Installer\MSI900C.tmp- =>.Superfluous.Empty
MOVED folder: C:\WINDOWS\Installer\MSIAAEA.tmp- =>.Superfluous.Empty
MOVED folder: C:\WINDOWS\Installer\MSIAFAF.tmp- =>.Superfluous.Empty
MOVED folder: C:\WINDOWS\Installer\MSIF36.tmp- =>.Superfluous.Empty


---\\ Registry ( Key, Value, Data) (7)
DELETED key*: HKLM\SYSTEM\CurrentControlSet\Services\KMSServerService [C:\Windows\KMSServerService\KMS Server Service.exe (Not File)] =>HackTool.AutoKMS
DELETED key*: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Popcorn Time [Popcorn Official] =>.Superfluous.PopcornTime
DELETED key*: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\internetspeedtracker.dl.myway.com [12] =>.Superfluous.MindSpark
DELETED key*: [X64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1 [KMSpico] =>HackTool.KMSpico
DELETED value: HKLM64\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\\SMΔRT-Protection [C:\Program Files (x86)\SMADAV\SMΔRTP.exe] =>Heuristic.Salus
DELETED value: HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\firewallRules\\{A6953636-E786-4621-B360-B9089679F4E8} [C:\Program Files\KMSpico\Service_KMS.exe] =>HackTool.KMSpico
DELETED value: HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\firewallRules\\{33D75540-C517-4E6B-ADFA-D126A983B1BF} [C:\Program Files\KMSpico\Service_KMS.exe] =>HackTool.KMSpico


---\\ Summary of the elements found (10)
https://www.anti-malware.top/2016/09/08/hacktool-kmspico/ =>HackTool.KMSpico
https://www.anti-malware.top/2016/09/28/superfluous-popcorntime/ =>.Superfluous.PopcornTime
https://www.nicolascoolman.com/fr/repaquetage-et_infections/ =>PUP.Optional.Adblocker
https://www.anti-malware.top/2016/05/04/hacktool-autokms/ =>HackTool.AutoKMS
https://nicolascoolman.eu/2017/01/13/hacktool-winactivator/ =>HackTool.WinActivator
https://nicolascoolman.eu/2017/01/20/logiciels-superflus/logiciels-superflus =>.Superfluous.Temporary
https://www.nicolascoolman.com/fr/adware-domaiq/ =>PUP.Optional.DomaIQ
https://nicolascoolman.eu/2017/01/20/logiciels-superflus/logiciels-superflus =>.Superfluous.Empty
https://nicolascoolman.eu/2017/01/15/superfluous-mindspark/ =>.Superfluous.MindSpark
https://www.nicolascoolman.com/fr/repaquetage-et_infections/ =>Heuristic.Salus


---\\ Other deletions. (23)
~ Registry Keys Tracing deleted (23)
~ Remove the old reports ZHPCleaner. (0)


---\\ Result of repair
~ Repair carried out successfully
~ Browser not found (Opera Software)


---\\ Statistics
~ Items scanned : 653
~ Items found : 0
~ Items cancelled : 0
~ Items repaired : 65


~ End of clean in 00h02mn40s
~====================
ZHPCleaner-[R]-20012017-21_52_07.txt
ZHPCleaner-[S]-20012017-21_47_54.txt