Comment nettoyer le malware/Troyen Searchqu? Fermé

Question

Bonjour, 

1) L'origine du problème:

J'ai un problème de Troyen/malware depuis le téléchargement et l'exécution d'un logiciel de conversion vidéo Free videoconverter HD qui était censé pouvoir convertir des fichiers MTS en avi.

J'ai installé ce logiciel après l'avoir scanné avec Avast qui n'a fait aucune alerte.

2) Les symptômes

Chrome ne fonctionne plus. Quand je le lance, il s'affiche juste la fenêtre avec Aie Aie Aie Une erreur s'est produite sur la page Web.

Internet Explorer fonctionne mais la page d'acceuil avait été remplacé par une page donnant sur un site Searchqu.

Firefox fonctionne mais se voit affublé d'une barre d'outils Searchqu et la page par défaut donne sur une adresse similaire.

3) Actions entreprises:

J'ai d'bord lancé Malwarebytes Anti-Malware qui a trouve un petit adware mais uniquement dans un répertoire d'un des utilisateurs de l'ordinateur.

Puis j'ai installé hitman pro 3.6 qui a trouvé deux choses:
Un malware SetupDataMngr_Searchqu.exe,
Un Troyen datamngrUI.exe.

J'ai fait corriger mais Chrome ne fonctionne toujours pas et les pages par défaut de firefox et IE étaient toujours bidonnées. firefox a toujours la barre d'outils Searchqu.

J'ai désinstallé Chrome et l'ait réinstallé mais ca ne fonctionne toujours pas.

j'ai refait un Hitman pro qui ne trouve plus rien mais les symptomes sont toujours la.

Donc ma question est: comment réparer tout ca et surtout avoir Chrome qui fonctionne de nouveau

Ci-dessous les logs des analyses Hikack This, AD-Remover.

Merci d'avance pour votre aide:

==============================
Log Hijack This:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:21:45, on 21/02/2012
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Program Files (x86)\SuperCopier2\SuperCopier2.exe
C:\Program Files (x86)\Wallpaper\Wallpaper.exe
C:\Users\CC\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Users\CC\AppData\Local\Akamai
etsession_win.exe
C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
C:\Program Files (x86)\HP\Buttons & OSDs control application gen2\MediaButtons.exe
C:\Program Files (x86)\Hewlett-Packard\HP KEYBOARD\HPKEYBOARD.EXE
C:\Windows\SysWOW64\OSDFORM.exe
C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
C:\Program Files (x86)\Sony\Content Transfer\ContentTransferWMDetector.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
C:\Users\CC\AppData\Local\Akamai
etsession_win.exe
C:\Users\CC\AppData\Local\Google\Update\1.3.21.99\GoogleCrashHandler.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Users\CC\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
C:\Program Files (x86)\Ad-Remover\Main.exe
C:\Windows\SysWOW64
otepad.exe
C:\Users\CC\Downloads\HiJackThis.exe
C:\Program Files (x86)\JGsoft\EditPadLite\EditPadLite.exe
C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.autocompletepro.com/?si=10203&bi=400
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.autocompletepro.com/?si=10203&bi=400
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.autocompletepro.com/?si=10203&bi=400
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://search.autocompletepro.com/?si=10203&bi=400
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;127.0.0.1:9421;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Audacity-tools Toolbar - {d0b1518e-3e45-4d16-a23b-4d90ef938e44} - C:\Program Files (x86)\Audacity-tools	bAuda.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SuggestMeYesBHO - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files (x86)\AutocompletePro\AutocompletePro.dll
O2 - BHO: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI9130~1\Datamngr\ToolBar\searchqudtx.dll
O2 - BHO: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\WI9130~1\Datamngr\BROWSE~1.DLL
O2 - BHO: Audacity-tools Toolbar - {d0b1518e-3e45-4d16-a23b-4d90ef938e44} - C:\Program Files (x86)\Audacity-tools	bAuda.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Audacity-tools Toolbar - {d0b1518e-3e45-4d16-a23b-4d90ef938e44} - C:\Program Files (x86)\Audacity-tools	bAuda.dll
O3 - Toolbar: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI9130~1\Datamngr\ToolBar\searchqudtx.dll
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe" /tray
O4 - HKLM\..\Run: [Buttons & OSDs control application gen2] "C:\Program Files (x86)\HP\Buttons & OSDs control application gen2\MediaButtons.exe"
O4 - HKLM\..\Run: [HP KEYBOARD] "C:\Program Files (x86)\Hewlett-Packard\HP KEYBOARD\HPKEYBOARD.EXE"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [ContentTransferWMDetector.exe] C:\Program Files (x86)\Sony\Content Transfer\ContentTransferWMDetector.exe
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [KiesTrayAgent] "C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe"
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files (x86)\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files (x86)\Wallpaper\Wallpaper.exe" Starter
O4 - HKCU\..\Run: [Google Update] "C:\Users\CC\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\CC\AppData\Local\Akamai
etsession_win.exe"
O4 - HKCU\..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe /s
O4 - HKCU\..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-4154590487-1511992936-3810515737-1007\..\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN (User 'Julie')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Envoyer l'&image au périphérique Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Envoyer à Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Envoyer au périphérique &Bluetooth... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O13 - Gopher Prefix: 
O15 - Trusted IP range: http://192.168.1.7
O15 - Trusted IP range: http://192.168.1.6
O16 - DPF: {0FF55459-6FAA-4931-ADB8-A51CDCF74913} (SSMultiEvent Control) - http://192.168.1.7:5000/surveillance/object/SSMultiEvent.cab
O16 - DPF: {32C11E38-E587-4BE9-9ABB-D69158C21CE5} (Moonlight MPEG-4 Video Decoder) - http://192.168.1.6/activex/decoder/mpeg4_dec.cab
O16 - DPF: {5C0E257E-9DFE-4955-AA93-0A9B166BAB50} (SSObject Control) - http://192.168.1.7:5000/surveillance/object/SSObject.cab
O16 - DPF: {6B84FBF3-A5DF-408D-90A2-70AAB46ED326} (SSEventPlayer Control Ver.3) - http://192.168.1.7:5000/surveillance/object/SSEventPlayer3.cab
O16 - DPF: {85D959DD-805D-4A04-89A0-0D07AA8EE37D} (SSResource Control) - http://192.168.1.7:5000/surveillance/object/SSResource.cab
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O16 - DPF: {B6E3D06F-F156-4146-B91C-6BEE03D3F6F4} - http://192.168.1.7:5000/surveillance/object/SSLiveView3.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://192.168.1.6/activex/AMC.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C9896E12-19C9-4A4F-B935-1EFA50D2DE63}: NameServer = 8.8.8.8,8.8.4.4
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files (x86)\a-squared Anti-Malware\a2service.exe
O23 - Service: Adobe Active File Monitor V10 (AdobeActiveFileMonitor10.0) - Adobe Systems Incorporated - C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe
O23 - Service: Adobe Active File Monitor V8 (AdobeActiveFileMonitor8.0) - Adobe Systems Incorporated - C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
O23 - Service: Adobe Active File Monitor V9 (AdobeActiveFileMonitor9.0) - Adobe Systems Incorporated - C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Unknown owner - C:\Windows\system32\AEADISRV.EXE (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Service d'état ASP.NET (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: avast! Firewall - AVAST Software - C:\Program Files\AVAST Software\Avast\afwServ.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\Windows\SysWOW64\brsvc01a.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: NetLogon (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32
vvsvc.exe (file missing)
O23 - Service: PMBDeviceInfoProvider - Sony Corporation - C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files (x86)\WinPcappcapd.exe (file missing)
O23 - Service: Localisateur d'appels de procédure distante (RPC) (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: Interruption SNMP (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: UsbClientService - Unknown owner - C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

===============================
Log Ad-remover

======= RAPPORT D'AD-REMOVER 2.0.0.2,G | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 12/04/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

C:\Program Files (x86)\Ad-Remover\main.exe (SCAN [4]) -> Lancé à 21:10:39 le 21/02/2012, Mode normal

Microsoft® Windows Vista(TM) Édition Familiale Premium  Service Pack 2 (X64) 
CC@PCCC (HP-Pavilion KQ517AA-ABF IQ500.fr) 
 
============== RECHERCHE ==============


Dossier trouvé: C:\Program Files (x86)\Windows Searchqu Toolbar
Dossier trouvé: C:\Users\CC\AppData\Roaming\Mozilla\FireFox\Profiles\bcyxpor4.default\extensions\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Dossier trouvé: C:\Users\Julie\AppData\Roaming\Mozilla\FireFox\Profiles\z2ym7vzg.default\extensions\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Dossier trouvé: C:\Program Files (x86)\AutocompletePro
Dossier trouvé: C:\Program Files (x86)\eRightSoft\SUPER\OpenCandy

-- Fichier ouvert: C:\Users\CCadmin\AppData\Roaming\Mozilla\FireFox\Profiles\q1j71d8e.default\Prefs.js --
Ligne trouvée: user_pref("browser.startup.homepage", "hxxp://www.searchqu.com/419"); 
-- Fichier Fermé --
 

Clé trouvée: HKLM\Software\Classes\CLSID\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Clé trouvée: HKLM\Software\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}
Clé trouvée: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{99079a25-328f-4bd4-be04-00955acaa0a7}
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079a25-328f-4bd4-be04-00955acaa0a7}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079a25-328f-4bd4-be04-00955acaa0a7}
Clé trouvée: HKLM\Software\Classes\CLSID\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}
Clé trouvée: HKLM\Software\Classes\AppID\AutocompletePro.DLL
Clé trouvée: HKLM\Software\Conduit
Clé trouvée: HKLM\Software\DataMngr
Clé trouvée: HKLM\Software\OpenCandy
Clé trouvée: HKLM\Software\SearchquMediabarTb
Clé trouvée: HKCU\Software\Complitly
Clé trouvée: HKCU\Software\DataMngr
Clé trouvée: HKCU\Software\AppDataLow\Toolbar
Clé trouvée: HKCU\Software\AppDataLow\Software\Conduit
Clé trouvée: HKLM\Software\eRightSoft\OpenCandy
Clé trouvée: HKLM\Software\Messenger Plus!\OpenCandy
Clé trouvée: HKLM\Software\Wow6432Node\eRightSoft\OpenCandy
Clé trouvée: HKLM\Software\Wow6432Node\Messenger Plus!\OpenCandy
Clé trouvée: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Clé trouvée: HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\AutocompletePro3_is1
Clé trouvée: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\AutocompletePro3_is1


============== SCAN ADDITIONNEL ==============

**** Mozilla Firefox Version [10.0.2 (fr)] ****

Plugins
pFoxitReaderPlugin.dll (Foxit Software Company)
Searchplugins\acpro.xml (                            hxxp://search.autocompletepro.com?si=10203&q={searchTerms}/)
Searchplugins\bing.xml (    hxxp://www.bing.com/search)
Searchplugins\completebartb.xml (hxxp://search.searchcompletion.com/)
Searchplugins\Search_Results.xml (  hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=419&sr=0&q={searchTerms}/)
Components\browsercomps.dll (Mozilla Foundation)

-- C:\Users\CC\AppData\Roaming\Mozilla\FireFox\Profiles\bcyxpor4.default --
Extensions\support@predictad.com (AutocompletePro - Your handy search suggestions tool)
Extensions\{99079a25-328f-4bd4-be04-00955acaa0a7} (Searchqu Toolbar)
Searchplugins\Search_Results.xml (  hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=419&sr=0&q={searchTerms}/)
Searchplugins\wikipedia-eng.xml (?)
Prefs.js - browser.download.dir, C:\Users\CC\Downloads
Prefs.js - browser.download.lastDir, C:\Users\CC\Desktop
Prefs.js - browser.search.defaultenginename, Search Results
Prefs.js - browser.search.selectedEngine, Search Results
Prefs.js - browser.startup.homepage, hxxp://www.google.fr/
Prefs.js - browser.startup.homepage_override.buildID, 20120215223356
Prefs.js - browser.startup.homepage_override.mstone, rv:10.0.2
Prefs.js - keyword.URL, hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=419&sr=0&q=

-- C:\Users\CCadmin\AppData\Roaming\Mozilla\FireFox\Profiles\q1j71d8e.default --
Extensions\staged-xpis (?)
Prefs.js - browser.startup.homepage, hxxp://www.searchqu.com/419
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.2.17
Prefs.js - keyword.URL, hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=419&sr=0&q=

-- C:\Users\Julie\AppData\Roaming\Mozilla\FireFox\Profiles\z2ym7vzg.default --
Extensions\{99079a25-328f-4bd4-be04-00955acaa0a7} (Searchqu Toolbar)
Prefs.js - browser.startup.homepage_override.mstone, rv:1.9.2.16

========================================

**** Google Chrome Version [17.0.963.56] ****

Extension\icmlaeflemplmjndnaapfdbbnpncnbda (C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx) (?)

-- C:\Users\CC\AppData\Local\Google\Chrome\User Data\Default --
Preferences - default_search_provider: "Google" (Activé: true) (?)
Preferences - homepage: hxxp://www.google.fr/
Preferences - homepage_is_newtabpage: true
Plugin - Shockwave Flash (Activé: false) (C:\Users\CC\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll)
Plugin - Remoting Viewer (Activé: true) (internal-remoting-viewer) (x)
Plugin - "Remoting Viewer" (Activé: true)
Plugin - Native Client (Activé: true) (C:\Users\CC\AppData\Local\Google\Chrome\Application\17.0.963.56\ppGoogleNaClPluginChrome.dll)
Plugin - "Native Client" (Activé: true)
Plugin - "Java" (Activé: true)
Plugin - "BitTorrent" (Activé: true)
Plugin - "Foxit Reader Plugin for Mozilla" (Activé: true)
Plugin - "Picasa" (Activé: true)
Plugin - "Facebook Plugin" (Activé: true)
Plugin - "Silverlight" (Activé: true)

========================================

**** Internet Explorer Version [9.0.8112.16421] ****

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU_Main|Default_Search_URL - hxxp://search.autocompletepro.com/?si=10203&bi=400
HKCU_Main|Search bar - hxxp://search.autocompletepro.com/?si=10203&bi=400
HKCU_Main|Search Page - hxxp://search.autocompletepro.com/?si=10203&bi=400
HKCU_Main|Start Page - hxxp://www.google.fr/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Start Page - hxxp://fr.msn.com/
HKCU_URLSearchHooks|{d0b1518e-3e45-4d16-a23b-4d90ef938e44} - "Audacity-tools Toolbar" (C:\Program Files (x86)\Audacity-tools	bAuda.dll)
HKLM_URLSearchHooks|{d0b1518e-3e45-4d16-a23b-4d90ef938e44} - "Audacity-tools Toolbar" (C:\Program Files (x86)\Audacity-tools	bAuda.dll)
HKCU_SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} - "Search The Web" (hxxp://search.searchcompletion.com/?si=16605&chrome=true&q={searchTerms})
HKCU_SearchScopes\{5713E691-56F2-483A-87E6-218EA2E73124} - "Kelkoo" (hxxp://fr.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromfor...)
HKCU_SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2419} - "Search Results" (hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=419&sr=0&q={searchTerm...)
HKCU_SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b} - "Web Search" (hxxp://search.autocompletepro.com/?si=10203&bi=400&q={searchTerms})
HKLM_SearchScopes\{5713E691-56F2-483A-87E6-218EA2E73124} - "Kelkoo" (hxxp://fr.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromfor...)
HKLM_SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2419} - "Search Results" (hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=419&sr=0&q={searchTerm...)
HKCU_Toolbar\WebBrowser|{D0B1518E-3E45-4D16-A23B-4D90EF938E44} (C:\Program Files (x86)\Audacity-tools	bAuda.dll)
HKLM_Toolbar|{d0b1518e-3e45-4d16-a23b-4d90ef938e44} (C:\Program Files (x86)\Audacity-tools	bAuda.dll)
HKLM_Toolbar|{99079a25-328f-4bd4-be04-00955acaa0a7} (C:\PROGRA~2\WI9130~1\Datamngr\ToolBar\searchqudtx.dll)
HKCU_ElevationPolicy\{99E87093-89D6-41E9-A3BD-4969B9D92D8A} - C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Reader.exe (?)
HKCU_ElevationPolicy\{D09C464F-07DE-4C04-ABB4-88C30329C02D} - C:\Users\CC\AppData\Local\Yahoo!\BrowserPlus\2.5.1\BrowserPlusCore.exe (x)
HKCU_ElevationPolicy\{E0A900DF-9611-4446-86BD-4B1D47E7DB2A} - C:\Users\CC\AppData\Local\Google\Chrome\Application\14.0.835.202\chrome_launcher.exe (x)
HKCU_ElevationPolicy\{F6406B2D-39A7-4566-A174-E19DDD818A95} - C:\Users\CC\AppData\Local\Yahoo!\BrowserPlus\2.4.21\BrowserPlusCore.exe (x)
HKLM_ElevationPolicy\{2AAE3CCD-D9F0-4BDD-9EFE-171075E6C750} - C:\PROGRA~2\WI9130~1\Datamngr\ToolBar\dtUser.exe (Visicom Media Inc.)
HKLM_ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999} - C:\Program Files (x86)\Internet Explorer\iedw.exe (x)
HKLM_ElevationPolicy\{99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI9130~1\Datamngr\ToolBar\uninstall.exe (?)
HKLM_Extensions\{CCA281CA-C863-46ef-9331-5C8D4460577F} - "Envoyer à Bluetooth" (c:\Program Files\WIDCOMM\Bluetooth Software\bt_cold_icon.ico)
BHO\{0FB6A909-6086-458F-BD92-1F8EE10042A0} - "AC-Pro" (C:\Program Files (x86)\AutocompletePro\AutocompletePro.dll)
BHO\{99079a25-328f-4bd4-be04-00955acaa0a7} - "Searchqu Toolbar" (C:\PROGRA~2\WI9130~1\Datamngr\ToolBar\searchqudtx.dll)
BHO\{9D717F81-9148-4f12-8568-69135F087DB0} - "DataMngr" (C:\PROGRA~2\WI9130~1\Datamngr\BROWSE~1.DLL)
BHO\{d0b1518e-3e45-4d16-a23b-4d90ef938e44} - "Audacity-tools Toolbar" (C:\Program Files (x86)\Audacity-tools	bAuda.dll)

========================================

C:\Program Files (x86)\Ad-Remover\Quarantine: 1 Fichier(s)
C:\Program Files (x86)\Ad-Remover\Backup: 21 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 21/08/2010 11:38:21 (3765 Octet(s)) 
C:\Ad-Report-CLEAN[2].txt - 21/08/2010 20:03:31 (2632 Octet(s)) 
C:\Ad-Report-SCAN[1].txt - 21/08/2010 11:27:24 (3739 Octet(s)) 
C:\Ad-Report-SCAN[2].txt - 21/08/2010 11:34:28 (3795 Octet(s)) 
C:\Ad-Report-SCAN[3].txt - 21/02/2012 21:04:19 (3563 Octet(s)) 
C:\Ad-Report-SCAN[4].txt - 21/02/2012 21:10:43 (10777 Octet(s)) 

Fin à: 21:11:47, 21/02/2012 
 
============== E.O.F ============== 




Configuration: Windows Vista / Firefox 10.0.2

anton025 · Answer

télécharge https://www.commentcamarche.net/telecharger/securite/14361-malwarebytes-anti-malware/

c'est un antimalware . fais bien les mises a jours. Ensuite redémarre ton PC en mode sans échec, puis fais un scan de ton PC avec antimalware.

Deathwindfr · Answer

Bonjour,

Merci Anton25 pour ta réponse rapide.

En passant Malwarebytes en mode échec, ca a pris très longtemps et au final l'analyse n'a rien détecté.

Mais après reboot, tout est remis en ordre. Chrome fonctionne de nouveau et la barre d'outils vérolée dans Firefox a disparu.

J'avoue que je ne sais pas ce qui a fait effet le plus mais au final ca fonctionne de nouveau.

Merci.

Comment nettoyer le malware/Troyen Searchqu?

2 réponses

Discussions similaires