~ ZHPCleaner v2020.6.4.202 by Nicolas Coolman (2020/06/04)
~ Run by Gomez (Administrator)  (06/06/2020 19:30:12)
~ Web: https://www.nicolascoolman.com
~ Blog: https://nicolascoolman.eu/
~ Facebook : https://www.facebook.com/nicolascoolman1
~ State version : Version KO
~ Type : Nettoyer
~ Report : C:\Users\Gomez\Desktop\ZHPCleaner (R).txt
~ Quarantine : C:\Users\Gomez\AppData\Roaming\ZHP\ZHPCleaner_Reg.txt
~ System Restore Point : 
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
Windows 7 Professional, 64-bit Service Pack 1 (Build 7601)


---\\  ALTERNATE DATA STREAM (ADS). (0)
~ Aucun élément malicieux ou superflu trouvé.


---\\  SERVICE. (0)
~ Aucun élément malicieux ou superflu trouvé.


---\\  NAVIGATEUR INTERNET. (0)
~ Aucun élément malicieux ou superflu trouvé.


---\\  FICHIER HÔTE. (1)
~ Le fichier hôte est légitime. (18)


---\\  TÂCHE PLANIFIÉE. (1)
SUPPRIMÉ tâche: [bookingDesktopAppUpdateTaskMachineCore] [C:\Program Files (x86)\bookingDesktopApp\Update\bookingDesktopAppUpdate.exe (Not File) ]  =>PUP.Optional.Booking


---\\  EXPLORATEUR  ( Dossiers, Fichiers ). (32)
DEPLACÉ fichier: C:\Program Files (x86)\bookingDesktopApp\Update\1.3.99.0\npbookingDesktopAppUpdate3.dll [bookingDesktopApp. - bookingDesktopApp Update]  =>PUP.Optional.Booking
DEPLACÉ fichier: C:\Users\Gomez\AppData\Local\chromium\User Data\Default\Local Storage\chrome-extension_gfdefkjpjdbiiclhimebabkmclmiiegk_0.localstorage    =>Hijacker.Browser
DEPLACÉ fichier: C:\Program Files (x86)\bookingDesktopApp\Update\bookingDesktopAppUpdate.exe [bookingDesktopApp. - bookingDesktopApp Update]  =>PUP.Optional.Booking
DEPLACÉ fichier: C:\Windows\Temp\GURB7E9.exe    =>Heuristic.Suspect
DEPLACÉ fichier: C:\Users\Gomez\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Goodgame Empire.lnk    =>.SUP.GoodGameEmpire
DEPLACÉ fichier*: C:\Program Files (x86)\Lavasoft\web companion    =>PUP.Optional.LavasoftWebCompanion
DEPLACÉ fichier*: C:\ProgramData\Lavasoft\web companion    =>PUP.Optional.LavasoftWebCompanion
DEPLACÉ fichier: C:\Users\Gomez\AppData\Local\chromium\User Data\Default\Extensions\gfdefkjpjdbiiclhimebabkmclmiiegk\1.0.0.50_0\background.html    =>Hijacker.Browser
DEPLACÉ fichier: C:\Users\Gomez\AppData\Local\chromium\User Data\Default\Extensions\gfdefkjpjdbiiclhimebabkmclmiiegk\1.0.0.50_0\manifest.json    =>Hijacker.Browser
DEPLACÉ fichier: C:\Users\Gomez\AppData\Local\chromium\User Data\Default\Extensions\kjdcopljcgiekkmjhinmcpioncofoclg\14.1.4.58_0\background.html    =>Hijacker.Browser
DEPLACÉ fichier: C:\Users\Gomez\AppData\Local\chromium\User Data\Default\Extensions\kjdcopljcgiekkmjhinmcpioncofoclg\14.1.4.58_0\background.js    =>Hijacker.Browser
DEPLACÉ fichier: C:\Users\Gomez\AppData\Local\chromium\User Data\Default\Extensions\kjdcopljcgiekkmjhinmcpioncofoclg\14.1.4.58_0\config.json    =>Hijacker.Browser
DEPLACÉ fichier: C:\Users\Gomez\AppData\Local\chromium\User Data\Default\Extensions\kjdcopljcgiekkmjhinmcpioncofoclg\14.1.4.58_0\manifest.json    =>Hijacker.Browser
DEPLACÉ fichier: C:\Users\Gomez\AppData\Local\chromium\User Data\Default\Extensions\kjdcopljcgiekkmjhinmcpioncofoclg\14.1.4.58_0\test.js    =>Hijacker.Browser
DEPLACÉ fichier: C:\Users\Gomez\AppData\Local\chromium\User Data\Default\Extensions\kjdcopljcgiekkmjhinmcpioncofoclg\14.1.4.58_0\tr.js    =>Hijacker.Browser
DEPLACÉ fichier: C:\Users\Gomez\AppData\Local\chromium\User Data\Default\Extensions\kjdcopljcgiekkmjhinmcpioncofoclg\14.1.4.58_0\images\chromium.svg    =>Hijacker.Browser
DEPLACÉ fichier: C:\Users\Gomez\AppData\Local\chromium\User Data\Default\Extensions\kjdcopljcgiekkmjhinmcpioncofoclg\14.1.4.58_0\images\shadow.png    =>Hijacker.Browser
DEPLACÉ dossier: C:\Users\Gomez\AppData\Local\chromium\User Data\Default\Extensions\gfdefkjpjdbiiclhimebabkmclmiiegk  =>Hijacker.Browser [http://dafucah.com/update]
DEPLACÉ dossier: C:\Users\Gomez\AppData\Local\chromium\User Data\Default\Extensions\kjdcopljcgiekkmjhinmcpioncofoclg  =>Hijacker.Browser [http://nuqudop.com/update]
DEPLACÉ dossier: C:\Users\Gomez\AppData\Roaming\System  =>Adware.Suspect
DEPLACÉ dossier^: C:\Program Files (x86)\bookingDesktopApp  =>PUP.Optional.Booking
DEPLACÉ dossier: C:\Users\Gomez\AppData\Roaming\Goodgame Empire  =>.SUP.GoodGameEmpire
DEPLACÉ dossier: C:\Users\Gomez\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Goodgame Empire  =>.SUP.GoodGameEmpire
DEPLACÉ dossier: C:\Documents and Settings\Gomez\Application Data\Microsoft\Windows\Start Menu\Programs\Goodgame Empire  =>.SUP.GoodGameEmpire
DEPLACÉ dossier: C:\Users\Gomez\AppData\Roaming\Lavasoft\Web Companion  =>PUP.Optional.LavasoftWebCompanion
DEPLACÉ dossier: C:\Program Files (x86)\lavasoft\web companion  =>PUP.Optional.LavasoftWebCompanion
DEPLACÉ dossier: C:\ProgramData\lavasoft\web companion  =>PUP.Optional.LavasoftWebCompanion
DEPLACÉ dossier: C:\ProgramData\Application Data\lavasoft\web companion  =>PUP.Optional.LavasoftWebCompanion
DEPLACÉ dossier: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion  =>PUP.Optional.LavasoftWebCompanion
DEPLACÉ dossier: C:\Users\Gomez\AppData\Local\chromium\User Data\Default\Extensions\gfdefkjpjdbiiclhimebabkmclmiiegk\1.0.0.50_0  =>Hijacker.Browser
DEPLACÉ dossier: C:\Users\Gomez\AppData\Local\chromium\User Data\Default\Extensions\kjdcopljcgiekkmjhinmcpioncofoclg\14.1.4.58_0  =>Hijacker.Browser
DEPLACÉ dossier: C:\Users\Gomez\AppData\Local\chromium\User Data\Default\Extensions\kjdcopljcgiekkmjhinmcpioncofoclg\14.1.4.58_0\images  =>Hijacker.Browser


---\\  BASE DE REGISTRES ( Clés, Valeurs, Données ). (48)
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@bookingdesktopapp.com/bookingDesktopApp Update;version=3 [bookingDesktopApp.]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@bookingdesktopapp.com/bookingDesktopApp Update;version=9 [bookingDesktopApp.]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: HKCU\Software\undefined [AdditionalScan 147]  =>.SUP.Downloader
SUPPRIMÉ clé*: HKCU\Software\ProductSetup [AdditionalScan 152]  =>Adware.InstallCore
SUPPRIMÉ clé*: HKEY_USERS\S-1-5-21-2264680239-2557701228-1583835890-1000\SOFTWARE\bookingDesktopApp []  =>PUP.Optional.Booking
SUPPRIMÉ clé*: HKEY_USERS\S-1-5-21-2264680239-2557701228-1583835890-1000\SOFTWARE\cacaoweb [C:\Users\Gomez\AppData\Roaming\cacaoweb\cacaoweb.exe (Not File)]  =>.SUP.CacaoWeb
SUPPRIMÉ clé**: HKCU\Software\bookingDesktopApp []  =>PUP.Optional.Booking
SUPPRIMÉ clé**: HKCU\Software\cacaoweb [C:\Users\Gomez\AppData\Roaming\cacaoweb\cacaoweb.exe (Not File)]  =>.SUP.CacaoWeb
SUPPRIMÉ clé*: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\thebrighttag.com []  =>PUP.Optional.TheBrightTag
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopApp.OneClickCtrl.9 [bookingDesktopApp Update Plugin]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopApp.Update3WebControl.3 [bookingDesktopApp Update Plugin]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.CoCreateAsync [CoCreateAsync]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.CoCreateAsync.1.0 [CoCreateAsync]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.CoreClass [Google Update Core Class]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.CoreClass.1 [Google Update Core Class]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.CoreMachineClass [Google Update Core Class]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.CoreMachineClass.1 [Google Update Core Class]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.CredentialDialogMachine [GoogleUpdate CredentialDialog]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.CredentialDialogMachine.1.0 [GoogleUpdate CredentialDialog]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.OnDemandCOMClassMachine [Google Update Broker Class Factory]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.OnDemandCOMClassMachine.1.0 [Google Update Broker Class Factory]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.OnDemandCOMClassMachineFallback [Google Update Legacy On Demand]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.OnDemandCOMClassMachineFallback.1.0 [Google Update Legacy On Demand]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.OnDemandCOMClassSvc [Google Update Legacy On Demand]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.OnDemandCOMClassSvc.1.0 [Google Update Legacy On Demand]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.ProcessLauncher [Google Update Process Launcher Class]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.ProcessLauncher.1.0 [Google Update Process Launcher Class]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.Update3WebMachine [Google Update Broker Class Factory]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.Update3WebMachine.1.0 [Google Update Broker Class Factory]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.Update3WebMachineFallback [GoogleUpdate Update3Web]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.Update3WebMachineFallback.1.0 [GoogleUpdate Update3Web]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.Update3WebSvc [GoogleUpdate Update3Web]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\bookingDesktopAppUpdate.Update3WebSvc.1.0 [GoogleUpdate Update3Web]  =>PUP.Optional.Booking
SUPPRIMÉ clé^: [X64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\bookingDesktopAppUpdateTaskMachineCore []  =>PUP.Optional.Booking
SUPPRIMÉ clé^: [X64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\bookingDesktopAppUpdateTaskMachineUA []  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Wow6432Node\bookingDesktopApp []  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1CB82F79-F13F-4F62-86F7-CAA51E3D58A2} [C:\Program Files (x86)\bookingDesktopApp\Update\1.3.99.0]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AF09D48-D8ED-4444-BC2C-CD2FE457564B} [C:\Program Files (x86)\bookingDesktopApp\Update\1.3.99.0]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Goodgame Empire [Goodgame Empire]  =>.SUP.GoodGameEmpire
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\CLSID\{214CE195-79AA-4CA1-9C40-AE44339A8A10} []  =>PUP.Optional.Booking
SUPPRIMÉ clé**: [X64] HKLM\SOFTWARE\Classes\CLSID\{214CE195-79AA-4CA1-9C40-AE44339A8A10}\InprocServer32 [C:\Program Files (x86)\bookingDesktopApp\Update\1.3.99.0\psmachine_64.dll (Not File)]  =>PUP.Optional.Booking
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Classes\CLSID\{6BC1E857-E2AC-4787-91AD-8D23D871496D} [PSFactoryBuffer]  =>PUP.Optional.Booking
SUPPRIMÉ clé**: [X64] HKLM\SOFTWARE\Classes\CLSID\{6BC1E857-E2AC-4787-91AD-8D23D871496D}\InprocServer32 [C:\Program Files (x86)\bookingDesktopApp\Update\1.3.99.0\psmachine_64.dll (Not File)]  =>PUP.Optional.Booking
SUPPRIMÉ valeur: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_5DA9B9AB0E8E3ED495539C3AB185EBA9 ["C:\Users\Gomez\AppData\Local\chromium\Application]  =>PUP.Optional.MyBrowser
SUPPRIMÉ valeur: HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\firewallRules\\TCP Query User{8FA1D564-73BA-46DE-BDA4-838E6804C10F}C:\users\gomez\appdata\roaming\cacaoweb\cacaoweb.exe [C:\users\gomez\appdata\roaming\cacaoweb\cacaoweb.e]  =>.SUP.CacaoWeb
SUPPRIMÉ valeur: HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\firewallRules\\UDP Query User{04687BBD-5FA7-496F-BF24-8B2A3FADCE87}C:\users\gomez\appdata\roaming\cacaoweb\cacaoweb.exe [C:\users\gomez\appdata\roaming\cacaoweb\cacaoweb.e]  =>.SUP.CacaoWeb
SUPPRIMÉ valeur: HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\firewallRules\\TCP Query User{080D8E42-DF57-4490-A27B-25C1680A6EED}C:\users\gomez\appdata\roaming\cacaoweb\cacaoweb.exe [C:\users\gomez\appdata\roaming\cacaoweb\cacaoweb.e]  =>.SUP.CacaoWeb
SUPPRIMÉ valeur: HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\firewallRules\\UDP Query User{338CF3E4-5F6E-4BAE-9738-22B1E9AE4C40}C:\users\gomez\appdata\roaming\cacaoweb\cacaoweb.exe [C:\users\gomez\appdata\roaming\cacaoweb\cacaoweb.e]  =>.SUP.CacaoWeb


---\\  RÉCAPITULATIF DES ÉLÉMENTS TROUVÉS SUR VOTRE STATION. (13)
https://nicolascoolman.eu/forum/Topic/booking-logiciel-potentiellement-indesirable-pup-lpi/  =>PUP.Optional.Booking
https://nicolascoolman.eu/2017/11/10/hijacker-browser-3/  =>Hijacker.Browser
https://nicolascoolman.eu/wp-content/uploads/2019/01/Informations-Sécurité-Zone-antimalware.jpg  =>Heuristic.Suspect
https://nicolascoolman.eu/2017/01/20/logiciels-superflus/  =>.SUP.GoodGameEmpire
https://nicolascoolman.eu/2017/03/12/superfluous-lavasoftwebcompanion/  =>PUP.Optional.LavasoftWebCompanion
https://nicolascoolman.eu/2017/01/27/repaquetage-et-infection/  =>Hijacker.Browser [http://dafucah.com/update]
https://nicolascoolman.eu/2017/01/27/repaquetage-et-infection/  =>Hijacker.Browser [http://nuqudop.com/update]
https://nicolascoolman.eu/2017/03/02/adware-suspect/  =>Adware.Suspect
https://nicolascoolman.eu/2017/12/22/sup-downloader/  =>.SUP.Downloader
https://nicolascoolman.eu/2017/09/19/adware-installcore-3/  =>Adware.InstallCore
https://nicolascoolman.eu/2017/01/15/superfluous-cacaoweb/  =>.SUP.CacaoWeb
https://nicolascoolman.eu/2017/01/27/repaquetage-et-infection/  =>PUP.Optional.TheBrightTag
https://nicolascoolman.eu/2017/11/01/adware-mybrowser/  =>PUP.Optional.MyBrowser


---\\  NETTOYAGE ADDITIONNEL. (34)
~ Suppression des Clés de registre Tracing. (34)
~ Suppression des anciens rapports ZHPCleaner. (0)


---\\ BILAN DE LA REPARATION
~ Réparation réalisée avec succès.
~ Google Chrome OK
~ Mozilla Firefox OK
~ Internet Explorer OK
~ Le système a été redémarré.


---\\ STATISTIQUES
~ Items scannés : 1652
~ Items trouvés : 0
~ Items annulés : 0
~ Gain de place (Octets) : 0
~ Items options : 8/15


---\\ OPTIONS DESACTIVÉES
~ Analyse et suppression des fichiers temporaires
~ Analyse et suppression des répertoires temporaires
~ Recherche et suppression des répertoires CLSID vides
~ Recherche et suppression des autres répertoires vides
~ Recherche et suppression des répertoires vides de LocalLow
~ Recherche et suppression des répertoires vides de Local
~ Recherche et suppression des fichiers obsolètes





~ End of clean in 00h01mn51s

---\\  LISTE DES RAPPORTS (3)
ZHPCleaner-[S]-06062020-16_56_55.txt
ZHPCleaner-[S]-06062020-19_25_23.txt
ZHPCleaner-[R]-06062020-19_32_03.txt