~ ZHPCleaner v2017.1.27.19 by Nicolas Coolman (2017/01/27) ~ Run by user (Administrator) (27/01/2017 16:42:30) ~ Web: https://www.nicolascoolman.com ~ Blog: https://www.anti-malware.top ~ Facebook : https://www.facebook.com/nicolascoolman1 ~ State version : Version OK ~ Type : Repair ~ Report : C:\Users\user\Desktop\ZHPCleaner.txt ~ Quarantine : C:\Users\user\AppData\Roaming\ZHP\ZHPCleaner_Quarantine.txt ~ UAC : Activate ~ Boot Mode : Normal (Normal boot) Windows 7 Ultimate, 64-bit Service Pack 1 (Build 7601) ---\\ Services (1) CLOSED : TTService =>.Superfluous.TorrentsTime ---\\ Browser internet (2) DELETED: [81o5rgg0.default] - user_pref("browser.startup.homepage", "C:\ProgramData\Quotenamrons\ff.HP"); =>PUP.Optional.Salus DELETED: [81o5rgg0.default] - user_pref("browser.newtab.url", "C:\ProgramData\Quotenamrons\ff.NT"); =>PUP.Optional.Salus ---\\ Hosts file (1) ~ The hosts file is legitimate (26) ---\\ Scheduled automatic tasks. (0) ~ No malicious or unnecessary items found. ---\\ Explorer ( File, Folder) (71) MOVED file: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\81o5rgg0.default\searchplugins\findit.xml =>PUP.Optional.SmartBar MOVED file: C:\Program Files (x86)\TorrentsTime Media Player\bin\npTTPlugin.dll [Torrents Time - Torrents Time plugin] =>.Superfluous.TorrentsTime MOVED file: C:\Users\user\AppData\Roaming\Dongcom.exe =>PUP.Optional.Pirrit MOVED file: C:\Program Files (x86)\TorrentsTime Media Player\bin\TTService.exe [TorrentsTime - TTService] =>.Superfluous.TorrentsTime MOVED file: C:\Windows\Temp\x250x5lq.exe =>Heuristic.Suspect MOVED file: C:\Windows\Installer\wix{4E9D4C35-BA44-4DC5-86F9-C8EC07492289}.SchedServiceConfig.rmi =>.Superfluous.Empty MOVED file: C:\Users\user\Downloads\BitlordSetup.exe [Larecakog - Borik Setup] =>PUP.Optional.WhenUSave MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_ar.hao123.com_0.localstorage =>PUP.Optional.Browser MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_ar.hao123.com_0.localstorage-journal =>PUP.Optional.Browser MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_d22j4fzzszoii2.cloudfront.net_0.localstorage =>.Superfluous.CloudfrontNet MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_d22j4fzzszoii2.cloudfront.net_0.localstorage-journal =>.Superfluous.CloudfrontNet MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_ol.at.atwola.com_0.localstorage =>.Superfluous.Atwola MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_ol.at.atwola.com_0.localstorage-journal =>.Superfluous.Atwola MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage =>PUP.Optional.Generic MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage-journal =>PUP.Optional.Generic MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_uhytajrtpo-a.akamaihd.net_0.localstorage =>.Superfluous.AkamaiHD MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_uhytajrtpo-a.akamaihd.net_0.localstorage-journal =>.Superfluous.AkamaiHD MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_d2m2wsoho8qq12.cloudfront.net_0.localstorage =>.Superfluous.CloudfrontNet MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_d2m2wsoho8qq12.cloudfront.net_0.localstorage-journal =>.Superfluous.CloudfrontNet MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_download.televisionfanatic.com_0.localstorage =>PUP.Optional.TelevisionFanatic MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_download.televisionfanatic.com_0.localstorage-journal =>PUP.Optional.TelevisionFanatic MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_hdwallpaperbackgrounds.net_0.localstorage =>.Superfluous.HDWallPaper MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_hdwallpaperbackgrounds.net_0.localstorage-journal =>.Superfluous.HDWallPaper MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_landing.chedot.com_0.localstorage =>PUP.Optional.ChedotBrowser MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_landing.chedot.com_0.localstorage-journal =>PUP.Optional.ChedotBrowser MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_myradioaccess.dl.myway.com_0.localstorage =>.Superfluous.MindSpark MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_myradioaccess.dl.myway.com_0.localstorage-journal =>.Superfluous.MindSpark MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_myradioaccess.dl.tb.ask.com_0.localstorage =>.Superfluous.MindSpark MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_myradioaccess.dl.tb.ask.com_0.localstorage-journal =>.Superfluous.MindSpark MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_putlocker.is_0.localstorage =>PUP.Optional.PutLocker MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_putlocker.is_0.localstorage-journal =>PUP.Optional.PutLocker MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_search.funmediatabsearch.com_0.localstorage =>.Superfluous.FunMediaTab MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_search.funmediatabsearch.com_0.localstorage-journal =>.Superfluous.FunMediaTab MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_search.socialnewpagesearch.com_0.localstorage =>.Superfluous.SocialNewPages MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_search.socialnewpagesearch.com_0.localstorage-journal =>.Superfluous.SocialNewPages MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_st.chatango.com_0.localstorage =>PUP.Optional.Chatango MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_st.chatango.com_0.localstorage-journal =>PUP.Optional.Chatango MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.audienceinsights.net_0.localstorage =>.Superfluous.AudienceInsights MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.audienceinsights.net_0.localstorage-journal =>.Superfluous.AudienceInsights MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.ask.com_0.localstorage =>Toolbar.Ask MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.ask.com_0.localstorage-journal =>Toolbar.Ask MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.azlyrics.com_0.localstorage =>PUP.Optional.AddLyrics MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.azlyrics.com_0.localstorage-journal =>PUP.Optional.AddLyrics MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.bringmesports.com_0.localstorage =>.Superfluous.MindSpark MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.bringmesports.com_0.localstorage-journal =>.Superfluous.MindSpark MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.hdwallpapernew.in_0.localstorage =>.Superfluous.HDWallPaper MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.hdwallpapernew.in_0.localstorage-journal =>.Superfluous.HDWallPaper MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.hdwallpapersnews.com_0.localstorage =>.Superfluous.HDWallPaper MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.hdwallpapersnews.com_0.localstorage-journal =>.Superfluous.HDWallPaper MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.metrolyrics.com_0.localstorage =>PUP.Optional.AddLyrics MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.metrolyrics.com_0.localstorage-journal =>PUP.Optional.AddLyrics MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.radiorage.com_0.localstorage =>.Superfluous.MindSpark MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.radiorage.com_0.localstorage-journal =>.Superfluous.MindSpark MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.tortugabackpacks.com_0.localstorage =>PUP.Optional.Tortuga MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.tortugabackpacks.com_0.localstorage-journal =>PUP.Optional.Tortuga MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.videodownloadconverter.com_0.localstorage =>PUP.Optional.VideoDownloadConverter MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.videodownloadconverter.com_0.localstorage-journal =>PUP.Optional.VideoDownloadConverter MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.whitesmoke.com_0.localstorage =>PUP.Optional.WhiteSmoke MOVED file: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.whitesmoke.com_0.localstorage-journal =>PUP.Optional.WhiteSmoke MOVED file*: C:\Users\user\AppData\Roaming\PDAppFlex =>Trojan.Elpman MOVED file: C:\program files (x86)\BitLord\BitLord.exe [House of Life - BitLord] =>PUP.Optional.WhenUSave MOVED folder: C:\Program Files (x86)\BitLord =>PUP.Optional.WhenUSave MOVED folder: C:\Program Files (x86)\TorrentsTime Media Player =>.Superfluous.TorrentsTime MOVED folder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TorrentsTime Media Player =>.Superfluous.TorrentsTime MOVED folder: C:\Users\user\AppData\Roaming\BitLord =>PUP.Optional.WhenUSave MOVED folder: C:\Users\user\Documents\BitLord =>PUP.Optional.WhenUSave MOVED folder: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitLord =>PUP.Optional.WhenUSave MOVED folder: C:\Users\user\AppData\Local\BitLord =>PUP.Optional.WhenUSave MOVED folder: C:\Users\user\AppData\Local\Temp\BitLord =>PUP.Optional.WhenUSave MOVED folder: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\File System\008 =>PUP.Optional.DomaIQ MOVED folder: C:\Users\user\AppData\Local\Temp\chrome_BITS_3412_30788 =>.Superfluous.Empty ---\\ Registry ( Key, Value, Data) (17) DELETED key*: HKCU\Software\MozillaPlugins\torrents-time.com/TTPlugin [] =>.Superfluous.TorrentsTime DELETED key*: HKLM\SYSTEM\CurrentControlSet\Services\TTService [C:\Program Files (x86)\TorrentsTime Media Player\bin\TTService.exe (Not File)] =>.Superfluous.TorrentsTime DELETED key*: HKEY_USERS\S-1-5-21-279693478-1646209937-2463236520-1000\SOFTWARE\bitlord.com [] =>PUP.Optional.WhenUSave DELETED key*: HKEY_USERS\S-1-5-21-279693478-1646209937-2463236520-1000\SOFTWARE\Classes\BitLord [BitLord] =>PUP.Optional.WhenUSave DELETED key: HKCU\Software\bitlord.com [] =>PUP.Optional.WhenUSave DELETED key*: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\soundcloud.com [] =>PUP.Optional.SoundCloud DELETED key*: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\chatango.com [] =>PUP.Optional.Chatango DELETED key*: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\d10lpsik1i8c69.cloudfront.net [1062] =>.Superfluous.CloudfrontNet DELETED key*: HKLM\SOFTWARE\TTime [] =>.Superfluous.TorrentsTime DELETED key*: [X64] HKLM\SOFTWARE\Classes\BitLord [BitLord] =>PUP.Optional.WhenUSave DELETED key*: [X64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Quotenamron.exe [] =>PUP.Optional.Salus DELETED key*: [X64] HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5} [ITool] =>Toolbar.Ask DELETED key*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BitLord [House of Life] =>.Superfluous.Conduit DELETED value: HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\firewallRules\\TCP Query User{F0B9776D-52A2-4404-9218-A54A09E9CC0C}C:\program files (x86)\bitlord\bitlord.exe [C:\program files (x86)\bitlord\bitlord.exe] =>PUP.Optional.WhenUSave DELETED value: HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\firewallRules\\UDP Query User{34D4CB3D-85CE-452F-AF3C-F21C858D9C9A}C:\program files (x86)\bitlord\bitlord.exe [C:\program files (x86)\bitlord\bitlord.exe] =>PUP.Optional.WhenUSave DELETED value: HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\firewallRules\\TCP Query User{A0CD62C5-8B1C-4CEC-9289-6ED76D7C04E6}C:\program files (x86)\bitlord\bitlord.exe [C:\program files (x86)\bitlord\bitlord.exe] =>PUP.Optional.WhenUSave DELETED value: HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\firewallRules\\UDP Query User{8324482B-2943-4BFE-8671-590286C8D430}C:\program files (x86)\bitlord\bitlord.exe [C:\program files (x86)\bitlord\bitlord.exe] =>PUP.Optional.WhenUSave ---\\ Summary of the elements found (30) https://nicolascoolman.eu/2017/01/20/logiciels-superflus/logiciels-superflus =>.Superfluous.TorrentsTime https://www.nicolascoolman.com/fr/pup-salus/ =>PUP.Optional.Salus https://www.nicolascoolman.com/fr/hijacker-smartbar/ =>PUP.Optional.SmartBar https://www.nicolascoolman.com/fr/pup-pirritsuggestor/ =>PUP.Optional.Pirrit https://www.anti-malware.top/2016/04/22/heuristic-suspect/ =>Heuristic.Suspect https://nicolascoolman.eu/2017/01/20/logiciels-superflus/logiciels-superflus =>.Superfluous.Empty https://www.nicolascoolman.com/fr/adware-whenusave/ =>PUP.Optional.WhenUSave https://nicolascoolman.eu/2017/01/26/hijacker-browser/ =>PUP.Optional.Browser https://www.anti-malware.top/2016/08/31/cloudfront-net/ =>.Superfluous.CloudfrontNet https://www.anti-malware.top/2016/07/21/superfluous-atwola/ =>.Superfluous.Atwola https://www.anti-malware.top/2016/05/01/definition-dun-logiciel-pup-lpi/ =>PUP.Optional.Generic https://nicolascoolman.eu/2017/01/20/logiciels-superflus/logiciels-superflus =>.Superfluous.AkamaiHD https://www.nicolascoolman.com/fr/pup-televisionfanatic/ =>PUP.Optional.TelevisionFanatic https://www.anti-malware.top/2016/08/22/superfluous-hdwallpaper/ =>.Superfluous.HDWallPaper https://www.nicolascoolman.com/fr/pup-optional-chedotbrowser/ =>PUP.Optional.ChedotBrowser https://nicolascoolman.eu/2017/01/15/superfluous-mindspark/ =>.Superfluous.MindSpark https://www.nicolascoolman.com/fr/spyware-putlocker/ =>PUP.Optional.PutLocker https://nicolascoolman.eu/2017/01/20/logiciels-superflus/logiciels-superflus =>.Superfluous.FunMediaTab https://nicolascoolman.eu/2017/01/20/logiciels-superflus/logiciels-superflus =>.Superfluous.SocialNewPages https://www.nicolascoolman.com/fr/repaquetage-et_infections/ =>PUP.Optional.Chatango https://nicolascoolman.eu/2017/01/20/logiciels-superflus/logiciels-superflus =>.Superfluous.AudienceInsights https://www.anti-malware.top/2016/09/22/toolbar-ask/ =>Toolbar.Ask https://www.nicolascoolman.com/fr/adware-addlyrics/ =>PUP.Optional.AddLyrics https://www.nicolascoolman.com/fr/repaquetage-et_infections/ =>PUP.Optional.Tortuga https://www.nicolascoolman.com/fr/repaquetage-et_infections/ =>PUP.Optional.VideoDownloadConverter https://www.nicolascoolman.com/fr/pup-whitesmoke/ =>PUP.Optional.WhiteSmoke https://www.nicolascoolman.com/fr/repaquetage-et_infections/ =>Trojan.Elpman https://www.nicolascoolman.com/fr/adware-domaiq/ =>PUP.Optional.DomaIQ https://www.nicolascoolman.com/fr/repaquetage-et_infections/ =>PUP.Optional.SoundCloud https://www.nicolascoolman.com/fr/toolbar-conduit/ =>.Superfluous.Conduit ---\\ Other deletions. (11) ~ Registry Keys Tracing deleted (11) ~ Remove the old reports ZHPCleaner. (0) ---\\ Result of repair ~ Repair carried out successfully ~ Browser not found (Opera Software) ---\\ Statistics ~ Items scanned : 449 ~ Items found : 0 ~ Items cancelled : 0 ~ Items repaired : 91 ~ End of clean in 00h00mn35s ~==================== ZHPCleaner-[R]-27012017-16_43_05.txt ZHPCleaner-[S]-27012017-16_41_55.txt