~ ZHPCleaner v2016.12.21.221 by Nicolas Coolman (2016/12/21)
~ Run by Fabrice (Administrator) (24/12/2016 09:35:14)
~ Web: https://www.nicolascoolman.com
~ Blog: https://www.anti-malware.top
~ Facebook : https://www.facebook.com/nicolascoolman1
~ State version :
~ Type : Repair
~ Report : C:\Users\Fabrice\Desktop\ZHPCleaner.txt
~ Quarantine : C:\Users\Fabrice\AppData\Roaming\ZHP\ZHPCleaner_Quarantine.txt
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
Windows 7 Home Premium, 64-bit Service Pack 1 (Build 7601)


---\\ Services (1)
CLOSED : ExpressVpnService =>PUP.Optional.ServiceManager


---\\ Browser internet (1)
REPLACED IE Params: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page [http://www.search.ask.com/?tpid=ORJ-V7-SAT&o=APN11461&pf=V7&trgb=IE&p2=%5EBE7%5E[...]] =>Toolbar.Ask


---\\ Hosts file (1)
~ The hosts file is legitimate (21)


---\\ Scheduled automatic tasks. (0)
~ No malicious or unnecessary items found.


---\\ Explorer ( File, Folder) (25)
MOVED file: C:\Program Files (x86)\ExpressVPN\bootstrap\AMD64\nssm.exe [Public Domain; Author Iain Patterson 2003-2014 - The non-sucking service manager] =>
MOVED file: C:\Windows\Prefetch\AMZNSEARCHPROTECT.EXE-69CB8B09.pf =>
MOVED file: C:\Windows\Installer\wix{2E4AF2A6-50EA-4260-9BA4-5E582D11879A}.SchedServiceConfig.rmi =>
MOVED file: C:\Windows\Installer\wix{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}.SchedServiceConfig.rmi =>
MOVED file: C:\Windows\Installer\wix{AA11FD16-297F-452D-9015-F9014303CDD3}.SchedServiceConfig.rmi =>
MOVED file: C:\Windows\Installer\wix{B6DCCCD3-520D-4485-B642-FCC136CE12C3}.SchedServiceConfig.rmi =>
MOVED file: C:\Windows\Installer\wix{FA378CD1-F32D-4610-9884-3902DF8AF826}.SchedServiceConfig.rmi =>
MOVED file: C:\Windows\Installer\wix{FE86CB0C-FCB3-4358-B4B0-B0A41E33B3DD}.SchedServiceConfig.rmi =>
MOVED file: C:\Users\Fabrice\AppData\Local\Google\Chrome\User Data\Default\bProtector Web Data =>
MOVED file: C:\Users\Fabrice\AppData\Local\Google\Chrome\User Data\Default\bprotectorpreferences =>
MOVED file: C:\Windows\Installer\{4F524A2D-5637-2D53-4154-A758B70C2D01}\ToolbarIcon.exe =>
MOVED file*: C:\Windows\Installer\{4F524A2D-5637-006A-76A7-A758B70C2E00}\ToolbarIcon.exe =>
MOVED folder: C:\Users\Fabrice\AppData\Roaming\Delta =>.Superfluous.DeltaSearch
MOVED folder: C:\Users\Fabrice\Music\iMesh =>.Superfluous.iMesh
MOVED folder: C:\Windows\Installer\MSI30E1.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI3A0B.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI3BCA.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI3BF.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI3CA6.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI3D91.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI3EBA.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSI68A8.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSIA4D0.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSICF3B.tmp- =>.Superfluous.Empty
MOVED folder: C:\Windows\Installer\MSIF69.tmp- =>.Superfluous.Empty


---\\ Registry ( Key, Value, Data) (33)
DELETED value: [X64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{4F524A2D-5637-2D53-4154-7A786E7484D7} [Ask Shopping Toolbar] =>PUP.Optional.APNToolBar
DELETED value: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{4F524A2D-5637-2D53-4154-7A786E7484D7} [Ask Shopping Toolbar] =>PUP.Optional.APNToolBar
DELETED key*: [X64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4F524A2D-5637-006A-76A7-7A786E7484D7} [Ask Toolbar BHO] =>Toolbar.AskTBar
DELETED key*: [X64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4F524A2D-5637-2D53-4154-7A786E7484D7} [Ask Shopping Toolbar BHO] =>PUP.Optional.Bandoo
DELETED key*: [X64] HKLM\Software\Classes\CLSID\{4F524A2D-5637-006A-76A7-7A786E7484D7} [Ask Toolbar] =>Toolbar.AskTBar
DELETED key*: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4F524A2D-5637-2D53-4154-7A786E7484D7} [] =>PUP.Optional.Bandoo
DELETED key*: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4F524A2D-5637-2D53-4154-7A786E7484D7} [] =>PUP.Optional.Bandoo
DELETED key*: [X64] HKLM\Software\Classes\CLSID\{4F524A2D-5637-2D53-4154-7A786E7484D7} [Ask Shopping Toolbar] =>PUP.Optional.Bandoo
DELETED key*: [X64] HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4F524A2D-5637-2D53-4154-7A786E7484D7} [Ask Shopping Toolbar] =>PUP.Optional.Bandoo
DELETED key*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4F524A2D-5637-2D53-4154-7A786E7484D7} [Ask Shopping Toolbar BHO] =>PUP.Optional.Bandoo
DELETED key*: HKLM\SYSTEM\CurrentControlSet\Services\ExpressVpnService [C:\Program Files (x86)\ExpressVPN\bootstrap\AMD64\nssm.exe (Not File)] =>PUP.Optional.ServiceManager
DELETED key*: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\calendarspark.dl.myway.com [12] =>.Superfluous.MindSpark
DELETED key*: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\filmfanatic2.dl.myway.com [12] =>.Superfluous.MindSpark
DELETED key*: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\putlocker.com [] =>PUP.Optional.PutLocker
DELETED key*: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\safepcrepair.dl.myway.com [12] =>.Superfluous.SafePCRepair
DELETED key*: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\static.audienceinsights.net [43] =>.Superfluous.AudienceInsights
DELETED key*: [X64] HKLM\SOFTWARE\Classes\d [escrtAx Object] =>PUP.Optional.Generic
DELETED key*: [X64] HKLM\Software\Classes\Installer\Products\D2A425F47365A600677A7A857BC0E200 [Ask Toolbar] =>Toolbar.AskTBar
DELETED key*: [X64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6978F29A-3493-40B2-8CDC-9C13A02F85A4} [C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ (Not File)] =>PUP.Optional.APNToolBar
DELETED key*: [X64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7949A66-D936-4028-9552-14F7DC50F38D} [C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ (Not File)] =>PUP.Optional.APNToolBar
DELETED key*: [X64] HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5} [ITool] =>Toolbar.Ask
DELETED key*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4F524A2D-5637-006A-76A7-A758B70C2E00} [APN, LLC] =>PUP.Optional.Bandoo
DELETED key*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4F524A2D-5637-2D53-4154-A758B70C2D01} [APN, LLC] =>PUP.Optional.Bandoo
DELETED key*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2} [Google Inc.] =>Heuristic.Suspect
DELETED key*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0ABE0FED-50E7-4e42-A125-57C0A11DBCDE} [C:\Program Files (x86)\iMesh Applications\iMesh (Not File)] =>.Superfluous.iMesh
DELETED key*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6978F29A-3493-40B2-8CDC-9C13A02F85A4} [C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ (Not File)] =>PUP.Optional.APNToolBar
DELETED key*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7949A66-D936-4028-9552-14F7DC50F38D} [C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ (Not File)] =>PUP.Optional.APNToolBar
DELETED key*: [X64] HKLM\Software\Classes\Installer\Products\D2A425F4736535D214457A857BC0D210 [Ask Shopping Toolbar] =>PUP.Optional.Bandoo
DELETED key*: [X64] HKLM\Software\Classes\Installer\Features\D2A425F4736535D214457A857BC0D210 [] =>PUP.Optional.Bandoo
DELETED key*: [X64] HKLM\Software\Classes\Installer\Features\D2A425F47365A600677A7A857BC0E200 [] =>Toolbar.AskTBar
DELETED key: [X64] HKLM\SOFTWARE\Classes\CLSID\{4F524A2D-5637-006A-76A7-7A786E7484D7}\InprocServer32 ["C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ-V7\Passport_x64.dll" (Not File)] =>Toolbar.AskTBar
DELETED key: [X64] HKLM\SOFTWARE\Classes\CLSID\{4F524A2D-5637-2D53-4154-7A786E7484D7}\InprocServer32 ["C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ-V7-SAT\Passport_x64.dll" (Not File)] =>PUP.Optional.APNToolBar
DELETED value: HKLM\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\firewallRules\\{7ECBC3BB-D3E6-4495-9733-051320F809B4} [C:\Program Files (x86)\iMesh Applications\iMesh\iMesh.exe] =>.Superfluous.iMesh


---\\ Summary of the elements found (14)
https://www.nicolascoolman.com/fr/repaquetage-et_infections/ =>PUP.Optional.ServiceManager
https://www.anti-malware.top/2016/09/22/toolbar-ask/ =>Toolbar.Ask
https://www.nicolascoolman.com/fr/toolbar-deltasearch/ =>.Superfluous.DeltaSearch
https://www.nicolascoolman.com/fr/pup-imesh/ =>.Superfluous.iMesh
https://www.nicolascoolman.com/fr/logiciels-superflus =>.Superfluous.Empty
https://www.nicolascoolman.com/fr/repaquetage-et_infections/ =>PUP.Optional.APNToolBar
https://www.nicolascoolman.com/fr/?p=5143 =>Toolbar.AskTBar
https://www.nicolascoolman.com/fr/adware-bandoo/ =>PUP.Optional.Bandoo
https://www.anti-malware.top/2016/05/29/superfluous-mindspark/ =>.Superfluous.MindSpark
https://www.nicolascoolman.com/fr/spyware-putlocker/ =>PUP.Optional.PutLocker
https://www.nicolascoolman.com/fr/logiciels-superflus =>.Superfluous.SafePCRepair
https://www.nicolascoolman.com/fr/logiciels-superflus =>.Superfluous.AudienceInsights
https://www.anti-malware.top/2016/05/01/definition-dun-logiciel-pup-lpi/ =>PUP.Optional.Generic
https://www.anti-malware.top/2016/04/22/heuristic-suspect/ =>Heuristic.Suspect


---\\ Other deletions. (39)
~ Registry Keys Tracing deleted (39)
~ Remove the old reports ZHPCleaner. (0)


---\\ Result of repair
~ Repair carried out successfully
~ Browser not found (Mozilla Firefox)
~ Browser not found (Opera Software)


---\\ Statistics
~ Items scanned : 392
~ Items found : 0
~ Items cancelled : 1
~ Items repaired : 60


~ End of clean in 00h00mn58s
~====================
ZHPCleaner-[R]-24122016-09_36_12.txt
ZHPCleaner-[S]-24122016-09_32_23.txt