ZHPDiag software tutorials, ZHPFix and ZHPCleaner.

Download ZHPDiag :

Download ZHPDiag on the official website of Nicolas Coolman :

An icon is created on your desktop.

Click ZHPDiag icon to start the program and bring up the interface.


Comment lever la protection SmartScreen :

Since the release of its version 8, Microsoft includes a protection system against malweillants websites named “SmartScreen”. But it turns out that this filter blocks the download many legitimate software.


Note : Read also FAQ

Start searching :

– Click on “Scanner” to start search.
– Research courses, a counter indicates the number of detections.


– let s”search until the progress bar reaches the 100%
– To cancel the search, click the button “Escape”.

The report ZHPDiag :

– At the end of the search, click on the button “Report” Displays the report in Notepad.

~ Report ZHPDiag v2015.6.29.74 – Nicolas Coolman (29/06/2015)
~ Launched by Coolman (29/06/2015 12:08:54)
~ Website Address : https://www.nicolascoolman.com/fr
~ Translated by Nicolas Coolman
~ State of version :
~ White list : Enabled by the program
~ Elevation of Privileges : OK
~ User Account Control (UAC): Deactivate by user

– This report is also in your user folder “%AppData% /ZHP”

Host your report :

– The report can be long and does not fit in a forum post, he must therefore be hosted

0 pjjoint.malekal.com

pjjoint.malekal.com allows to upload files to be shared with correspondents.

0 cjoint.com

Select the document to be published (photo, document, archive…). (*) The size of acceptable documents is limited to 8192 my.


Download ZHPFix :

Normally ZHPFix is installed with the package ZHPDiag (shortcut icon on the desktop), if this is not the case you can download it from the official website of Nicolas Coolman :

Writing the cleanup script :

The first line must include the 2 words “Script ZHPFix“. Below is a sample script written by NCDiag.

—\\ cleanup script with ZHPFix
Script ZHPFix
HKCUSoftwareOpencandy =>Adware.OpenCandy
HKCUSoftwareAppDataLowSoftwareLyricsFolder =>Adware.AddLyrics
C:\Program Files (x86)\deals plugin =>Adware.DealsPlugin
C:\Program Files (x86)\dealsplugin =>Adware.DealsPlugin
C:\Program Files (x86)\GreyGray =>PUP.GreyGray
C:\Program Files (x86)\TheBestMatch =>Hijacker.Proxy
C:\ProgramDataMicrosoftWindowsStart MenuProgramseMule =>P2P.eMule
C:\ProgramDataBestttSaveeeForYou =>PUP.BestSaveForYou
C:\ProgramDataBrrroTwsep2Save =>PUP.Browse2Save
C:\ProgramDataDealsPlugin =>Adware.DealsPlugin
C:\ProgramDataFlexiblESHoppeer =>PUP.FlexibleShoper
C:\ProgramDataGetNow =>PUP.GetNow
C:\ProgramDatagReatesaVer =>PUP.GreatSaver
C:\ProgramDataYourFileDownloader =>PUP.YourFileDownloader
HKLMSOFTWAREWOW6432NodeMicrosoftTracingAskInstallChecker-1_RASAPI32 =>Toolbar.Ask
HKLMSOFTWAREWOW6432NodeMicrosoftTracingAskInstallChecker-1_RASMANCS =>Toolbar.Ask
HKLMSOFTWAREWOW6432NodeMicrosoftTracingeMule_RASAPI32 =>P2P.eMule
HKLMSOFTWAREWOW6432NodeMicrosoftTracingeMule_RASMANCS =>P2P.eMule
HKLMSOFTWAREWOW6432NodeMicrosoftTracingMobogenie12_RASAPI32 =>PUP.Mobogenie[HKCUSOFTWARE592d8deb33dbe46]:INSTALL_FOLDER_NAME=”BitGuard” =>PUP.BitGuard[HKCUSOFTWARE592d8deb33dbe46]:PROTECTOR_DLL_NAME=”BitGuard.dll” =>PUP.BitGuard[HKCUSOFTWARE592d8deb33dbe46]:PROTECT_EXE_NAME=”BitGuard.exe” =>PUP.BitGuard[HKCUSOFTWARE592d8deb33dbe46]:SERVICE_NAME=”BitGuard” =>PUP.BitGuard
HKCUSOFTWAREOpencandyOpenCandy =>Adware.OpenCandy
HKCUSOFTWAREClassesDealioOpen2 =>PUP.Dealio
HKLMSOFTWAREWow6432NodeClassesDealiodddd =>PUP.Dealio
HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstallSP_tests_0000 =>Adware.Browse2Save
HKCUSoftwareClassesCLSID{00D9C840-044E-11D1-B3E9-00805F499D93} =>PUP.Eorezo
~ ATTENTION, This script is provided as an indication, it must be validated by a qualified expert in disinfection.
~ 49 ZHPFix Script Files found in 0 second(s)

Before use, do check your script by a qualified expert in disinfection.

Place the script in the windows clipboard (CTRL+A et CTRL+C)

Starting the software :

– Stand on the ZHPFix icon and right-click, select “Run with administrative rights” If present in the dropdown menu.

– The following interface appears :


Click on “IMPORTER” ,

A window opens with a copy of your script.


If the script is not correct, such as forgetting the first line “Script ZHPFix”, this message :


Check that all lines are present and click the button “GO”

Acknowledge message that asks if you confirm the data cleansing.

Validate the Trash cleaning the message, This can take some time depending on your deleted data.

ZHPFix report :

At the end of treatment, a cleaning report appears in the notebook style :

ZHPFix Report 2014.4.13.3 by Nicolas Coolman, Update du 13/04/2014
Registry export file : C:\UsersCoolmanAppDataRoamingZHPZHPExportRegistry-22-05-2014-13-57-16.txt
Run by Coolman at 22/05/2014 13:57:02
High Elevated Privileges : OK
Windows 7 Business Edition, 64-bit Service Pack 1 (Build 7601)

Trash emptied (00mn 13s)
Folder emptied Prefetcher

========== ========== Registry Keys
DELETED: HKCUSoftwareOpencandy
DELETED: HKCUSoftwareAppDataLowSoftwareLyricsFolder

========== ========== Registry Values
No value Standard Profile: FirewallRaz :
No Value Domain Profile: FirewallRaz :
ProxyFix : deleted successfully Proxy Configuration
DELETED ProxyServer Value
SUPPRIMÉ ProxyEnable Value
SUPPRIMÉ EnableHttp1_1 Value
SUPPRIMÉ ProxyHttp1.1 Value
DELETED ProxyOverride Value

========== ========== Records
DELETED: C:\UsersCoolmanAppDataLocal{00000BA0-5731-46FD-9326-FA79A36E6D46}
DELETED: C:\UsersCoolmanAppDataLocal{46A13B26-D605-4DC3-8770-D0F4A0C3565D}

========== ========== Files
Windows Temporary DELETED (569) (329 604 303 bytes)
DELETED Flash Cookies (0) (0 bytes)
DELETED: C:\WindowsTasksb09b8b1-b267-4ac3-a1e3-c3f904efd354-1.job
DELETED: C:\WindowsSystem32Tasksb09b8b1-b267-4ac3-a1e3-c3f904efd354-1

Summary ========== ==========
2 : Registry keys
8 : Registry values
2 : records
4 : files

End of clean in 00mn 28s

========== ========== File Path report
C:\UsersCoolmanAppDataRoamingZHPZHPFix[R1].txt – 22/05/2014 13:57:42 [1028] – This report is also in your user folder “%AppData% /ZHP”

– Send your report if it makes you demand in a forum disinfection.


Download ZHPCleaner :

Download ZHPCleaner by Nicolas Coolman on your desktop.

Starting the software :

– Stand on the ZHPCleaner icon and right-click, select “Run with administrative rights” If present in the dropdown menu.

– accept “conditions of use” (CLUF) .

– The following interface appears :


Click on “SCANNER” to start search

Leave the progress bar reach the end.

Click on “CLEAN” to start cleaning.


In the repair interface, validate the lines and / or click on “Clean”

Allow the cleaning progress bar reach the end.

ZHPCleaner report :

At the end of treatment, a search or cleaning report appears in the notebook style :


– This report can also be found in your user folder “%AppData% /ZHP” and on your desktop.

– Send your report if it makes you demand in a forum disinfection.