~ ZHPCleaner v2017.2.10.25 by Nicolas Coolman (2017/02/10)
~ Run by Abdo (Administrator)  (11/02/2017 09:24:05)
~ Web: https://www.nicolascoolman.com
~ Blog: https://nicolascoolman.eu/
~ Facebook : https://www.facebook.com/nicolascoolman1
~ State version : Version OK
~ Type : Scan
~ Report : C:\Users\Abdo\Desktop\ZHPCleaner.txt
~ Quarantine : C:\Users\Abdo\AppData\Roaming\ZHP\ZHPCleaner_Quarantine.txt
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
Windows 10 Pro, 64-bit  (Build 10586)


---\\  Services (1)
[S] FOUND : Service KMSELDI  =>HackTool.KMSpico


---\\  Browser internet (0)
~ No malicious or unnecessary items found.


---\\  Hosts file (1)
~ The hosts file is legitimate (21)


---\\  Scheduled automatic tasks. (1)
FOUND task: [AutoPico Daily Restart] [C:\Program Files\KMSpico\AutoPico.exe]  =>HackTool.KMSpico


---\\  Explorer ( File, Folder) (104)
FOUND file: C:\Users\Abdo\Desktop\QQPlayer.lnk  [Bad : C:\Program Files (x86)\Tencent\QQPlayer\QQPlayer.exe](.Tencent.)  =>.Superfluous.Tencent
FOUND file: C:\Users\Abdo\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QQPlayer.lnk  [Bad : C:\Program Files (x86)\Tencent\QQPlayer\QQPlayer.exe](.Tencent.)  =>.Superfluous.Tencent
FOUND file: C:\Program Files\KMSpico\Service_KMS.exe [@ByELDI - Service_KMS]  =>HackTool.KMSpico
FOUND file: C:\Program Files (x86)\Tencent\QQPlayer\QQPlayer.exe [Tencent - كيوكيو بلاير]  =>.Superfluous.Tencent
FOUND file: C:\Users\Abdo\Desktop\QQPlayer.lnk    =>.Superfluous.Tencent
FOUND file: C:\Users\Abdo\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QQPlayer.lnk    =>.Superfluous.Tencent
FOUND file: C:\Program Files\KMSpico\AutoPico.exe [@ByELDI - AutoPico]  =>HackTool.KMSpico
FOUND file: C:\Windows\Prefetch\LENOVOSHAREIT-WIN.TMP-7D477408.pf    =>.Superfluous.SHAREit
FOUND file: C:\Windows\Prefetch\LENOVOSHAREIT-WIN.TMP-9C6917BB.pf    =>.Superfluous.SHAREit
FOUND file: C:\Windows\Installer\wix{7774002B-60B3-4146-BF82-5BF767D468B8}.SchedServiceConfig.rmi    =>.Superfluous.Empty
FOUND file: C:\Windows\Installer\wix{827F31DC-A307-4A62-B640-840D1A5D2698}.SchedServiceConfig.rmi    =>.Superfluous.Empty
FOUND file: C:\Windows\Installer\wix{C1578C4F-5453-44FE-A172-01331906BF18}.SchedServiceConfig.rmi    =>.Superfluous.Empty
FOUND folder: C:\Program Files (x86)\Tencent\QQPlayer  =>.Superfluous.Tencent
FOUND folder: C:\Program Files (x86)\Tencent  =>.Superfluous.Tencent
FOUND file: C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll [DevComponents.com - DevComponents.DotNetBar]  =>HackTool.KMSpico
FOUND file: C:\Program Files\KMSpico\KMSELDI.exe [@ByELDI - KMS GUI ELDI]  =>HackTool.KMSpico
FOUND file: C:\Program Files\KMSpico\unins000.dat    =>HackTool.KMSpico
FOUND file: C:\Program Files\KMSpico\unins000.exe [ - Setup/Uninstall]  =>HackTool.KMSpico
FOUND file: C:\Program Files\KMSpico\UninsHs.exe [Han-soft - Uninstall for InnoSetup by Han-soft]  =>HackTool.KMSpico
FOUND file: C:\Program Files\KMSpico\Vestris.ResourceLib.dll [Vestris Inc. - ResourceLib]  =>HackTool.KMSpico
FOUND file: C:\Program Files\KMSpico\WinDivert.dll    =>HackTool.KMSpico
FOUND file: C:\Program Files\KMSpico\WinDivert.sys [Basil Projects - WinDivert network packet capture and (re)in]  =>HackTool.KMSpico
FOUND folder: C:\Program Files\KMSpico\cert  =>HackTool.KMSpico
FOUND folder: C:\Program Files\KMSpico\driver  =>HackTool.KMSpico
FOUND folder: C:\Program Files\KMSpico\icons  =>HackTool.KMSpico
FOUND folder: C:\Program Files\KMSpico\logs  =>HackTool.KMSpico
FOUND folder: C:\Program Files\KMSpico\scripts  =>HackTool.KMSpico
FOUND folder: C:\Program Files\KMSpico\sounds  =>HackTool.KMSpico
FOUND folder: C:\Program Files\KMSpico\TokensBackup  =>HackTool.KMSpico
FOUND folder: C:\Program Files\KMSpico  =>HackTool.KMSpico
FOUND file: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\AutoPico.lnk    =>HackTool.KMSpico
FOUND file: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\KMSpico.lnk    =>HackTool.KMSpico
FOUND file: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\Log KMSpico.lnk    =>HackTool.KMSpico
FOUND file: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\Uninstall KMSpico.lnk    =>HackTool.KMSpico
FOUND folder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico  =>HackTool.KMSpico
FOUND folder: C:\Users\Abdo\AppData\Roaming\Tencent\QQPlayer  =>.Superfluous.Tencent
FOUND folder: C:\Users\Abdo\AppData\Roaming\Tencent  =>.Superfluous.Tencent
FOUND folder: C:\Windows\Installer\MSI103E.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI1252.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI12D.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI18FE.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI1F87.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI218B.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI219.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI2209.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI25D.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI287.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI2921.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI2A6A.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI2B57.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI2ED5.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI2F82.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI3040.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI344C.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI3556.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI3622.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI36FE.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI41.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI5EAC.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI647B.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI655B.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI65D9.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI6657.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI6752.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI6A12.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI75D2.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI774A.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI77E8.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI7894.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI819F.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI9279.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI95A8.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI975F.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI9898.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI9B68.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI9BF6.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI9CB2.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI9DF0.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSI9EFA.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIA034.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIA11F.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIA595.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIA651.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIAF.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIC35.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIDDC.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIE09C.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIE3.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIE763.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIE987.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIEA44.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIF0FF.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIF15B.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIF573.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIF9CA.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIFB35.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIFBCF.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIFC8D.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIFCFC.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIFDB8.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIFE46.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIFEC4.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Windows\Installer\MSIFFB3.tmp-  =>.Superfluous.Empty
FOUND folder: C:\Users\Abdo\AppData\Local\Temp\chrome_BITS_6312_909  =>.Superfluous.Empty


---\\  Registry ( Key, Value, Data) (17)
FOUND key: HKLM\SYSTEM\CurrentControlSet\Services\Service KMSELDI [C:\Program Files\KMSpico\Service_KMS.exe](.@ByELDI.)  =>HackTool.KMSpico
FOUND key: HKLM\SYSTEM\CurrentControlSet\Services\Service KMSELDI [C:\Program Files\KMSpico\Service_KMS.exe]  =>HackTool.KMSpico
FOUND key: HKEY_USERS\S-1-5-21-2940119149-3528213125-3126080836-1001\SOFTWARE\Tencent []  =>.Superfluous.Tencent
FOUND key: HKCU\Software\Tencent []  =>.Superfluous.Tencent
FOUND key: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\QQPlayer [Tencent]  =>.Superfluous.Tencent
FOUND key: [X64] HKLM\SOFTWARE\Classes\protector_dll.Protector [Protector Class]  =>PUP.Optional.BProtector
FOUND key: [X64] HKLM\SOFTWARE\Classes\protector_dll.Protector.1 [Protector Class]  =>PUP.Optional.BProtector
FOUND key: [X64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib [ProtectorLib Class]  =>PUP.Optional.BProtector
FOUND key: [X64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorLib.1 [ProtectorLib Class]  =>PUP.Optional.BProtector
FOUND key: [X64] HKLM\SOFTWARE\Classes\StartSearchExt.StartSearchTool [StartSearchTool Class]  =>PUP.Optional.StartSearch
FOUND key: [X64] HKLM\SOFTWARE\Classes\StartSearchExt.StartSearchTool.1 [StartSearchTool Class]  =>PUP.Optional.StartSearch
FOUND key: [X64] HKLM\SOFTWARE\Classes\CLSID\{960495F9-F09C-4CB9-A101-A19EC6218CF0} [StartSearchTool Class]  =>PUP.Optional.StartSearch
FOUND key: HKLM\SYSTEM\CurrentControlSet\Services\Service KMSELDI []  =>HackTool.KMSpico
FOUND key: [X64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1 [KMSpico]  =>HackTool.KMSpico
FOUND key: [X64] HKLM\SOFTWARE\Wow6432Node\Tencent []  =>.Superfluous.Tencent
FOUND key: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2} [Google Inc.]  =>Heuristic.Suspect
FOUND key: [X64] HKLM\SOFTWARE\Classes\CLSID\{960495F9-F09C-4CB9-A101-A19EC6218CF0}\InprocServer32 [C:\Program Files\SOLIDWORKS Corp\SOLIDWORKS PDM\StartSearchExt.dll]  =>PUP.Optional.StartSearch


---\\  Summary of the elements found (7)
https://www.anti-malware.top/2016/09/08/hacktool-kmspico/  =>HackTool.KMSpico
https://www.nicolascoolman.com/fr/adware-tencentaddressbar/  =>.Superfluous.Tencent
https://nicolascoolman.eu/2017/01/20/logiciels-superflus/  =>.Superfluous.SHAREit
https://nicolascoolman.eu/2017/01/20/logiciels-superflus/  =>.Superfluous.Empty
https://www.anti-malware.top/2016/04/30/pup-optional-bprotector/  =>PUP.Optional.BProtector
https://www.nicolascoolman.com/fr/pup-optional-startsearch/  =>PUP.Optional.StartSearch
https://nicolascoolman.eu/2017/01/28/heuristic-suspect/  =>Heuristic.Suspect


---\\ Result of repair
~ Any repair made
~ Browser not found (Mozilla Firefox)
~ Browser not found (Opera Software)


---\\ Statistics
~ Items scanned : 92874
~ Items found : 129
~ Items cancelled : 0
~ Items repaired : 0


~ End of search in 00h05mn44s
~====================
ZHPCleaner-[S]-11022017-09_29_49.txt