~ ZHPCleaner v2022.1.21.8 by Nicolas Coolman (2022/01/21) ~ Run by pc (Administrator) (27/01/2022 11:53:56) ~ Web: https://www.nicolascoolman.com ~ Blog: https://nicolascoolman.eu/ ~ Facebook : https://www.facebook.com/nicolascoolman1 ~ State version : Version OK ~ Type : Repair ~ Report : C:\Users\pc\Desktop\ZHPCleaner (R).txt ~ Quarantine : C:\Users\pc\AppData\Roaming\ZHP\ZHPCleaner_Reg.txt ~ System Restore Point : OK ~ UAC : Activate ~ Boot Mode : Normal (Normal boot) Windows 10 Home, 64-bit (Build 17134) ---\\ Alternate Data Stream (ADS). (0) ~ No malicious or unnecessary items found. ---\\ Services (0) ~ No malicious or unnecessary items found. ---\\ Browser internet (0) ~ No malicious or unnecessary items found. ---\\ Hosts file (1) ~ The hosts file is legitimate (21) ---\\ Scheduled automatic tasks. (1) DELETED task: [ASC_PerformanceMonitor] [C:\Program Files (x86)\IObit\Advanced SystemCare\Monitor.exe] =>SUP.Optional.AdvancedSystemCare ---\\ Explorer ( File, Folder) (25) MOVED file: C:\Users\pc\AppData\Local\Microsoft\Edge\User Data\Default\Preferences =>Préférences Chromium MOVED file: C:\Users\pc\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences =>Préférences Chromium MOVED file: C:\Windows\Prefetch\AUSLOGICS-BOOST-SPEED-SETUP.T-00025CF9.pf =>SUP.Optional.Auslogics MOVED file: C:\Windows\Prefetch\AUSLOGICS-BOOST-SPEED-SETUP.T-15D834E3.pf =>SUP.Optional.Auslogics MOVED file: C:\Windows\Prefetch\AUSLOGICS-WINDOWS-SLIMMER-SET-CD6D4888.pf =>SUP.Optional.Auslogics MOVED file: C:\Windows\Prefetch\AUSLOGICS-WINDOWS-SLIMMER-SET-CE62ABB2.pf =>SUP.Optional.Auslogics MOVED file: C:\Windows\Installer\wix{2CA8B2E7-B4B7-4553-83E6-448A543EA5AD}.SchedServiceConfig.rmi =>.SUP.Empty MOVED file: C:\Windows\Installer\wix{5FFF909D-D88F-42B9-9A85-328A1290611C}.SchedServiceConfig.rmi =>.SUP.Empty MOVED file: C:\Windows\Installer\wix{8F2D6CEB-BC98-4B69-A5C1-78BED238FE77}.SchedServiceConfig.rmi =>.SUP.Empty MOVED file: C:\Users\pc\AppData\Local\Temp\wct64C0.tmp =>.SUP.Temporary.Office MOVED file: C:\Users\pc\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Advanced SystemCare.lnk =>SUP.Optional.AdvancedSystemCare MOVED folder: C:\Program Files (x86)\Auslogics =>SUP.Optional.Auslogics MOVED folder: C:\ProgramData\Auslogics =>SUP.Optional.Auslogics MOVED folder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare =>SUP.Optional.AdvancedSystemCare MOVED folder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Auslogics =>SUP.Optional.Auslogics MOVED folder: C:\Users\pc\AppData\LocalLow\IObit\Advanced SystemCare =>SUP.Optional.AdvancedSystemCare MOVED folder^: C:\Users\pc\AppData\Roaming\IObit\Advanced SystemCare =>SUP.Optional.AdvancedSystemCare MOVED folder: C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Roaming\IObit\Advanced SystemCare =>SUP.Optional.AdvancedSystemCare MOVED folder: C:\Program Files (x86)\Common Files\IObit\Advanced SystemCare =>SUP.Optional.AdvancedSystemCare MOVED folder: C:\ProgramData\Auslogics\BoostSpeed =>SUP.Optional.AuslogicsBoostSpeed MOVED folder: C:\ProgramData\BSD\DriverHive =>.SUP.DriverUpdatePlus MOVED folder^: C:\ProgramData\IObit\Advanced SystemCare =>SUP.Optional.AdvancedSystemCare MOVED folder: C:\ProgramData\Application Data\IObit\ASCDownloader =>SUP.Optional.AdvancedSystemCare MOVED folder: C:\ProgramData\IObit\ASCDownloader =>SUP.Optional.AdvancedSystemCare MOVED folder: C:\ProgramData\Application Data\BSD\DriverHive =>.SUP.DriverUpdatePlus ---\\ Registry ( Key, Value, Data) (41) DELETED key*: HKU\S-1-5-21-120822950-1225855894-879144086-1001\Software\BSD [AdditionalScan 42] =>.SUP.DriverUpdatePlus DELETED key*: HKU\S-1-5-21-120822950-1225855894-879144086-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\drp.su [AdditionalScan 50] =>.SUP.DriverPack DELETED key*: HKCU\Software\drpsu [AdditionalScan 67] =>.SUP.DriverPack DELETED key**: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\drp.su [AdditionalScan 264] =>.SUP.DriverPack DELETED key*: HKLM\SOFTWARE\Wow6432Node\Auslogics\BoostSpeed [AdditionalScan 287] =>SUP.Optional.AuslogicsBoostSpeed DELETED key*: HKLM\SOFTWARE\Wow6432Node\IObit\RealTimeProtector [AdditionalScan 289] =>SUP.Optional.AdvancedSystemCare DELETED key*: HKLM\SOFTWARE\Wow6432Node\IObit\Advanced SystemCare [AdditionalScan 290] =>SUP.Optional.AdvancedSystemCare DELETED key*: HKLM\SOFTWARE\Wow6432Node\IObit\ASC [AdditionalScan 291] =>SUP.Optional.AdvancedSystemCare DELETED key*: HKLM\SOFTWARE\Wow6432Node\drpsu [AdditionalScan 293] =>.SUP.DriverPack DELETED key*: HKLM\SOFTWARE\Wow6432Node\Classes\TypeLib\{60AD0991-ECD4-49DC-B170-8B7E7C60F51B} [AdditionalScan 365] =>SUP.Optional.AdvancedSystemCare DELETED key**: HKLM\SOFTWARE\Auslogics\BoostSpeed [AdditionalScan 408] =>SUP.Optional.AuslogicsBoostSpeed DELETED key**: HKLM\SOFTWARE\drpsu [AdditionalScan 409] =>.SUP.DriverPack DELETED key^: HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.ascplugin.protect [AdditionalScan 427] =>SUP.Optional.AdvancedSystemCare DELETED key**: HKLM\SOFTWARE\IObit\RealTimeProtector [AdditionalScan 428] =>SUP.Optional.AdvancedSystemCare DELETED key**: HKLM\SOFTWARE\IObit\Advanced SystemCare [AdditionalScan 429] =>SUP.Optional.AdvancedSystemCare DELETED key**: HKLM\SOFTWARE\Iobit\ASC [AdditionalScan 455] =>SUP.Optional.AdvancedSystemCare DELETED key**: HKLM\SOFTWARE\Classes\TypeLib\{60AD0991-ECD4-49DC-B170-8B7E7C60F51B} [AdditionalScan 518] =>SUP.Optional.AdvancedSystemCare DELETED key**: HKEY_USERS\S-1-5-21-120822950-1225855894-879144086-1001\SOFTWARE\drpsu [] =>.SUP.DriverPack DELETED key**: HKCU\Software\drpsu [] =>.SUP.DriverPack DELETED key*: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\s0ft4pc.com [] =>.SUP.EORezo DELETED key*: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\s0ft4pc.com [13] =>.SUP.EORezo DELETED key*: [X64] HKLM\SOFTWARE\Classes\Interface\{BA935377-E17C-4475-B1BF-DE3110613A99} [ICExtMenu] =>SUP.Optional.AdvancedSystemCare DELETED key*: [X64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0630D25DD5987F00B6A0CE8FF9637EF9 [02:\Software\Microsoft\IpOverUsbSdk\RPCSurrogate03\LocalAddress (Not File)] =>SUP.Optional.PCSpeedUp DELETED key*: [X64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\06C64C0CDFB44B5B799CB2AE94026E00 [02:\Software\Microsoft\IpOverUsbSdk\RPCSurrogate07\DestinationAddress (Not File)] =>SUP.Optional.PCSpeedUp DELETED key*: [X64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0B02399EE0D80B854D7EC4486CD01F5F [02:\Software\Microsoft\IpOverUsbSdk\RPCSurrogate05\DestinationAddress (Not File)] =>SUP.Optional.PCSpeedUp DELETED key*: [X64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0BEB8BFF16E429A344C9421E62B2FB06 [02:\Software\Microsoft\IpOverUsbSdk\RPCSurrogate02\LocalAddress (Not File)] =>SUP.Optional.PCSpeedUp DELETED key*: [X64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\15655699E72632A9F228095E170D88C5 [02:\Software\Microsoft\IpOverUsbSdk\RPCSurrogate01\DestinationAddress (Not File)] =>SUP.Optional.PCSpeedUp DELETED key*: [X64] HKLM\SOFTWARE\Wow6432Node\Auslogics [] =>SUP.Optional.Auslogics DELETED key**: [X64] HKLM\SOFTWARE\Wow6432Node\drpsu [] =>.SUP.DriverPack DELETED key*: [X64] HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BA935377-E17C-4475-B1BF-DE3110613A99} [ICExtMenu] =>SUP.Optional.AdvancedSystemCare DELETED key*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Advanced SystemCare_is1 [IObit] =>SUP.Optional.AdvancedSystemCare DELETED key*: [X64] HKLM\SOFTWARE\Classes\CLSID\{2803063F-4B8D-4dc6-8874-D1802487FE2D} [CExtMenu Class] =>SUP.Optional.AdvancedSystemCare DELETED key**: [X64] HKLM\SOFTWARE\Classes\CLSID\{2803063F-4B8D-4dc6-8874-D1802487FE2D}\InprocServer32 [C:\Program Files (x86)\IObit\Advanced SystemCare\ASCExtMenu_64.dll] =>SUP.Optional.AdvancedSystemCare DELETED key*: HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\Advanced SystemCare [{2803063F-4B8D-4dc6-8874-D1802487FE2D}] =>SUP.Optional.AdvancedSystemCare DELETED key*: HKLM\Software\Classes\lnkfile\shellex\ContextMenuHandlers\Advanced SystemCare [{2803063F-4B8D-4dc6-8874-D1802487FE2D}] =>SUP.Optional.AdvancedSystemCare DELETED key*: HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers\Advanced SystemCare [{2803063F-4B8D-4dc6-8874-D1802487FE2D}] =>SUP.Optional.AdvancedSystemCare DELETED key*: HKLM\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Advanced SystemCare [{2803063F-4B8D-4dc6-8874-D1802487FE2D}] =>SUP.Optional.AdvancedSystemCare DELETED value: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Advanced SystemCare ["C:\Program Files (x86)\IObit\Advanced SystemCare\] =>SUP.Optional.AdvancedSystemCare DELETED value: HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\\C:\Program Files (x86)\IObit\Advanced SystemCare\ASC.exe [Binary Data] =>SUP.Optional.AdvancedSystemCare DELETED value: HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\\C:\Program Files (x86)\IObit\Advanced SystemCare\ASCFeature.exe [Binary Data] =>SUP.Optional.AdvancedSystemCare DELETED value: HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\\C:\Program Files (x86)\IObit\Advanced SystemCare\Pub\rmuin.exe [Binary Data] =>SUP.Optional.AdvancedSystemCare ---\\ Summary of the elements found (10) https://nicolascoolman.eu/wp-content/uploads/2017/12/26/sup-advancedsystemcare/ =>SUP.Optional.AdvancedSystemCare https://nicolascoolman.eu/forum/Topic/repaquetage-et-infection/ =>Préférences Chromium https://nicolascoolman.eu/forum/Topic/auslogics-logiciel-potentiellement-superflu-lps/ =>SUP.Optional.Auslogics https://nicolascoolman.eu/forum/Topic/logiciels-potentiellement-superflus-lps/ =>.SUP.Empty https://nicolascoolman.eu/forum/Topic/logiciels-potentiellement-superflus-lps/ =>.SUP.Temporary.Office https://nicolascoolman.eu/2019/05/04/sup-auslogics-boostspeed/ =>SUP.Optional.AuslogicsBoostSpeed https://nicolascoolman.eu/forum/Topic/logiciels-potentiellement-superflus-lps/ =>.SUP.DriverUpdatePlus https://nicolascoolman.eu/2018/07/04/sup-driverpack/ =>.SUP.DriverPack https://nicolascoolman.eu/forum/Topic/eorezo-logiciel-publicitaire-adware/ =>.SUP.EORezo https://nicolascoolman.eu/2017/03/05/superfluous-pcspeeduppro/ =>SUP.Optional.PCSpeedUp ---\\ Other deletions. (17) ~ Registry Keys Tracing deleted (15) ~ Remove the old reports ZHPCleaner. (2) ---\\ Result of repair ~ Repair carried out successfully ~ Internet Explorer OK ~ The system has been restarted. ---\\ Statistics ~ Items scanned : 982 ~ Items found : 0 ~ Items cancelled : 0 ~ Space saving (bytes) : 45637 ~ Items options : 17/17 ---\\ OPTIONS NOT ACTIVES ~ End of clean in 00h01mn52s ---\\ Reports (2) ZHPCleaner-[S]-27012022-11_26_50.txt ZHPCleaner-[R]-27012022-11_55_48.txt