désinstaller claro search Résolu

Question

Bonjour, 
Depuis deux jours,claro search s'est installé sur ma page d'accueil mozilla firefox je ne sais pas trop pourquoi,mais je n'arrive pas à remettre google.J'ai regardé les différents forums mais n'étant pas très doué en informatique,je n'ai pas vraiment compris.merci d'avance pour votre aide.


Configuration: Windows 7 / Firefox 16.0

Fish66 · Answer

Bonjour,
Télécharge AdwCleaner (merci à Xplode)
Lance AdwCleaner
Clique sur le bouton [ Suppression ] 
Patiente...
Poste le rapport qui apparait en fin de recherche.
(Le rapport est sauvegardé aussi sous C:\ AdwCleaner[SX].Txt)

jaybee666 · Answer

# AdwCleaner v2.008 - Logfile created 11/18/2012 at 10:55:07
# Updated 17/11/2012 by Xplode
# Operating system : Windows 7 Ultimate Service Pack 1 (32 bits)
# User : alien - ALIEN-PC
# Boot Mode : Normal
# Running from : C:\Users\alien\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****

Stopped & Deleted : Browser Manager
Stopped & Deleted : IBUpdaterService

***** [Files / Folders] *****

Deleted on reboot : C:\ProgramData\Browser Manager
File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
File Deleted : C:\Users\alien\AppData\Roaming\Mozilla\Firefox\Profiles\sp74outq.default\searchplugins\Askcom.xml
File Deleted : C:\Users\alien\AppData\Roaming\Mozilla\Firefox\Profiles\sp74outq.default\searchplugins\Conduit.xml
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\DealPly
Folder Deleted : C:\Program Files\RewardsArcade
Folder Deleted : C:\Program Files\Tuto4pc
Folder Deleted : C:\Program Files\Vuze_Remote
Folder Deleted : C:\Program Files\Yontoo
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\IBUpdaterService
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DealPly
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tuto4pc
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\Users\alien\AppData\Local\Conduit
Folder Deleted : C:\Users\alien\AppData\Local\RewardsArcade
Folder Deleted : C:\Users\alien\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\alien\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\alien\AppData\LocalLow\Vuze_Remote
Folder Deleted : C:\Users\alien\AppData\Roaming\Babylon
Folder Deleted : C:\Users\alien\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Browser Manager
Folder Deleted : C:\Users\alien\AppData\Roaming\Mozilla\Firefox\Profiles\sp74outq.default\ConduitCommon
Folder Deleted : C:\Users\alien\AppData\Roaming\Mozilla\Firefox\Profiles\sp74outq.default\CT2504091
Folder Deleted : C:\Users\alien\AppData\Roaming\Mozilla\Firefox\Profiles\sp74outq.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
Folder Deleted : C:\Users\alien\AppData\Roaming\Mozilla\Firefox\Profiles\sp74outq.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}
Folder Deleted : C:\Users\alien\AppData\Roaming\Mozilla\Firefox\Profiles\sp74outq.default\extensions\plugin@yontoo.com

***** [Registry] *****

Data Deleted : HKLM\..\Windows [AppInit_DLLs] = c:\progra~2\browse~1\23796~1.11\{16cdf~1\browse~1.dll
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Software\RewardsArcade
Key Deleted : HKCU\Software\AppDataLow\Software\Vuze_Remote
Key Deleted : HKCU\Software\AppDataLow\Toolbar
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Cr_Installer
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\DataMngr_Toolbar
Key Deleted : HKCU\Software\DealPly
Key Deleted : HKCU\Software\Google\Chrome\Extensions\gaiilaahiahdejapggenmdmafpmbipje
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{597A9974-8CB0-4F41-B61F-ED065738A397}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BA14329E-9550-4989-B3F2-9732E92D17CC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{597A9974-8CB0-4F41-B61F-ED065738A397}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA14329E-9550-4989-B3F2-9732E92D17CC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\RewardsArcade
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\Tutorials
Key Deleted : HKCU\Software\TutoTag
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{25514C64-8321-494E-BD3E-3DBAB3F8CEBA}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{597A9974-8CB0-4F41-B61F-ED065738A397}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BA14329E-9550-4989-B3F2-9732E92D17CC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E30ED111-BD63-48C2-A6CB-AB3C9FFFB07C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6427058B-217C-4C7F-A6CE-C7934C0BDCEB}
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\RewardsArcade.BHO.1
Key Deleted : HKLM\SOFTWARE\Classes\RewardsArcade.FBApi
Key Deleted : HKLM\SOFTWARE\Classes\RewardsArcade.FBApi.1
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2504091
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{60BE6B2E-F2F5-4404-AA1E-4381D4A6EEA2}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\Software\DealPly
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\gaiilaahiahdejapggenmdmafpmbipje
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohdhomoefph
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{29F6B50B-1BDB-4DB2-8D69-22838200DF15}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{907839DC-8913-469C-B813-BC90C29B773A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{597A9974-8CB0-4F41-B61F-ED065738A397}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA14329E-9550-4989-B3F2-9732E92D17CC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E30ED111-BD63-48C2-A6CB-AB3C9FFFB07C}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DealPly
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Tuto4pc_is1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Updater Service
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vuze_Remote Toolbar
Key Deleted : HKLM\SOFTWARE\Software
Key Deleted : HKLM\Software\Tarma Installer
Key Deleted : HKLM\Software\Tuto4PC
Key Deleted : HKLM\Software\Vuze_Remote
Key Deleted : HKU\S-1-5-21-1772841914-261610752-621916125-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{BA14329E-9550-4989-B3F2-9732E92D17CC}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{BA14329E-9550-4989-B3F2-9732E92D17CC}]
Value Deleted : HKCU\Software\Mozilla\Firefox\Extensions [{b64982b1-d112-42b5-b1e4-d3867c4533f8}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{BA14329E-9550-4989-B3F2-9732E92D17CC}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{BA14329E-9550-4989-B3F2-9732E92D17CC}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Tutorials]

***** [Internet Browsers] *****

-\ Internet Explorer v9.0.8112.16421

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.claro-search.com/?affID=117423&tt=4612_4&babsrc=HP_ss&mntrId=12e3b6220000000000000018e734a064 --> hxxp://www.google.com
Deleted : [HKCU\Software\Microsoft\Internet Explorer\Main - bProtector Start Page]

-\ Mozilla Firefox v16.0.2 (fr)

Profile name : default 
File : C:\Users\alien\AppData\Roaming\Mozilla\Firefox\Profiles\sp74outq.default\prefs.js

C:\Users\alien\AppData\Roaming\Mozilla\Firefox\Profiles\sp74outq.default\user.js ... Deleted !

Deleted : user_pref("CT2504091..clientLogIsEnabled", true);
Deleted : user_pref("CT2504091..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Deleted : user_pref("CT2504091..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Deleted : user_pref("CT2504091.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Deleted : user_pref("CT2504091.BrowserCompStateIsOpen_129566938558801595", true);
Deleted : user_pref("CT2504091.CTID", "ct2504091");
Deleted : user_pref("CT2504091.CurrentServerDate", "24-9-2011");
Deleted : user_pref("CT2504091.DialogsAlignMode", "LTR");
Deleted : user_pref("CT2504091.DialogsGetterLastCheckTime", "Sat Sep 24 2011 11:42:35 GMT+0200");
Deleted : user_pref("CT2504091.DownloadReferralCookieData", "");
Deleted : user_pref("CT2504091.EMailNotifierPollDate", "Sat Sep 24 2011 21:50:14 GMT+0200");
Deleted : user_pref("CT2504091.FeedPollDate128891351169457140", "Sat Sep 24 2011 21:50:14 GMT+0200");
Deleted : user_pref("CT2504091.FeedPollDate129079840422964131", "Sat Sep 24 2011 21:50:14 GMT+0200");
Deleted : user_pref("CT2504091.FeedTTL128891351169457140", 40);
Deleted : user_pref("CT2504091.FirstServerDate", "24-9-2011");
Deleted : user_pref("CT2504091.FirstTime", true);
Deleted : user_pref("CT2504091.FirstTimeFF3", true);
Deleted : user_pref("CT2504091.FixPageNotFoundErrors", true);
Deleted : user_pref("CT2504091.GroupingServerCheckInterval", 1440);
Deleted : user_pref("CT2504091.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Deleted : user_pref("CT2504091.HasUserGlobalKeys", true);
Deleted : user_pref("CT2504091.Initialize", true);
Deleted : user_pref("CT2504091.InitializeCommonPrefs", true);
Deleted : user_pref("CT2504091.InstallationAndCookieDataSentCount", 3);
Deleted : user_pref("CT2504091.InstallationType", "ConduitIntegration");
Deleted : user_pref("CT2504091.InstalledDate", "Sat Sep 24 2011 11:42:33 GMT+0200");
Deleted : user_pref("CT2504091.IsAlertDBUpdated", true);
Deleted : user_pref("CT2504091.IsGrouping", false);
Deleted : user_pref("CT2504091.IsInitSetupIni", true);
Deleted : user_pref("CT2504091.IsMulticommunity", false);
Deleted : user_pref("CT2504091.IsOpenThankYouPage", false);
Deleted : user_pref("CT2504091.IsOpenUninstallPage", false);
Deleted : user_pref("CT2504091.LanguagePackLastCheckTime", "Sat Sep 24 2011 11:42:35 GMT+0200");
Deleted : user_pref("CT2504091.LanguagePackReloadIntervalMM", 1440);
Deleted : user_pref("CT2504091.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Deleted : user_pref("CT2504091.LastLogin_3.6.0.10", "Sat Sep 24 2011 21:50:16 GMT+0200");
Deleted : user_pref("CT2504091.LatestVersion", "3.6.0.10");
Deleted : user_pref("CT2504091.Locale", "en-us");
Deleted : user_pref("CT2504091.MCDetectTooltipHeight", "83");
Deleted : user_pref("CT2504091.MCDetectTooltipShow", false);
Deleted : user_pref("CT2504091.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Deleted : user_pref("CT2504091.MCDetectTooltipWidth", "295");
Deleted : user_pref("CT2504091.MyStuffEnabledAtInstallation", true);
Deleted : user_pref("CT2504091.OriginalFirstVersion", "3.6.0.10");
Deleted : user_pref("CT2504091.SavedHomepage", "hxxp://www.google.fr/");
Deleted : user_pref("CT2504091.SearchFromAddressBarIsInit", true);
Deleted : user_pref("CT2504091.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT250[...]
Deleted : user_pref("CT2504091.SearchInNewTabEnabled", true);
Deleted : user_pref("CT2504091.SearchInNewTabIntervalMM", 1440);
Deleted : user_pref("CT2504091.SearchInNewTabLastCheckTime", "Sat Sep 24 2011 11:42:35 GMT+0200");
Deleted : user_pref("CT2504091.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Deleted : user_pref("CT2504091.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]
Deleted : user_pref("CT2504091.ServiceMapLastCheckTime", "Sat Sep 24 2011 11:42:33 GMT+0200");
Deleted : user_pref("CT2504091.SettingsLastCheckTime", "Sat Sep 24 2011 11:42:33 GMT+0200");
Deleted : user_pref("CT2504091.SettingsLastUpdate", "1315002176");
Deleted : user_pref("CT2504091.ThirdPartyComponentsInterval", 504);
Deleted : user_pref("CT2504091.ThirdPartyComponentsLastCheck", "Sat Sep 24 2011 11:42:33 GMT+0200");
Deleted : user_pref("CT2504091.ThirdPartyComponentsLastUpdate", "1312887586");
Deleted : user_pref("CT2504091.ToolbarShrinkedFromSetup", false);
Deleted : user_pref("CT2504091.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2504091");
Deleted : user_pref("CT2504091.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Deleted : user_pref("CT2504091.UserID", "UN19270312275509915");
Deleted : user_pref("CT2504091.alertChannelId", "897164");
Deleted : user_pref("CT2504091.approveUntrustedApps", true);
Deleted : user_pref("CT2504091.backendstorage.for_aoi", "31333136383933383139");
Deleted : user_pref("CT2504091.backendstorage.for_ccid", "5061726973");
Deleted : user_pref("CT2504091.backendstorage.for_cdtr2", "31333136383933383233");
Deleted : user_pref("CT2504091.backendstorage.for_cdtr6", "31333136383933383139");
Deleted : user_pref("CT2504091.backendstorage.for_cid", "4652");
Deleted : user_pref("CT2504091.backendstorage.for_ip", "37382E3131342E39302E323336");
Deleted : user_pref("CT2504091.backendstorage.for_lcut", "31333136383933383139");
Deleted : user_pref("CT2504091.backendstorage.for_pid", "31303231");
Deleted : user_pref("CT2504091.backendstorage.for_rid", "4138");
Deleted : user_pref("CT2504091.backendstorage.for_zoneid", "3130313537");
Deleted : user_pref("CT2504091.componentAlertEnabled", false);
Deleted : user_pref("CT2504091.components.1000034", false);
Deleted : user_pref("CT2504091.ct2504091.DialogsAlignMode", "LTR");
Deleted : user_pref("CT2504091.ct2504091.FeedLastCount129079840422964131", 10);
Deleted : user_pref("CT2504091.ct2504091.LanguagePackLastCheckTime", "Sat Sep 24 2011 21:50:16 GMT+0200");
Deleted : user_pref("CT2504091.ct2504091.Locale", "en-us");
Deleted : user_pref("CT2504091.ct2504091.SearchInNewTabLastCheckTime", "Sat Sep 24 2011 21:50:14 GMT+0200");
Deleted : user_pref("CT2504091.ct2504091.SettingsLastCheckTime", "Sat Sep 24 2011 21:50:14 GMT+0200");
Deleted : user_pref("CT2504091.ct2504091.SettingsLastUpdate", "1315002176");
Deleted : user_pref("CT2504091.ct2504091.ThirdPartyComponentsLastCheck", "Sat Sep 24 2011 11:42:33 GMT+0200");
Deleted : user_pref("CT2504091.ct2504091.ThirdPartyComponentsLastUpdate", "1312887586");
Deleted : user_pref("CT2504091.ct2504091.components.129079840422182852", false);
Deleted : user_pref("CT2504091.ct2504091.components.129079840422339107", false);
Deleted : user_pref("CT2504091.ct2504091.components.129079840422964131", false);
Deleted : user_pref("CT2504091.ct2504091.components.129079849636241789", false);
Deleted : user_pref("CT2504091.ct2504091.components.129408243997825547", false);
Deleted : user_pref("CT2504091.ct2504091.components.129566938558801595", false);
Deleted : user_pref("CT2504091.ct2504091.components.129593776931068636", false);
Deleted : user_pref("CT2504091.ct2504091.globalFirstTimeInfoLastCheckTime", "Sat Sep 24 2011 21:50:16 GMT+0200[...]
Deleted : user_pref("CT2504091.ct2504091.toolbarAppMetaDataLastCheckTime", "Sat Sep 24 2011 11:42:35 GMT+0200"[...]
Deleted : user_pref("CT2504091.ct2504091.toolbarContextMenuLastCheckTime", "Sat Sep 24 2011 21:50:17 GMT+0200"[...]
Deleted : user_pref("CT2504091.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Deleted : user_pref("CT2504091.globalFirstTimeInfoLastCheckTime", "Sat Sep 24 2011 11:42:34 GMT+0200");
Deleted : user_pref("CT2504091.homepageProtectorEnableByLogin", true);
Deleted : user_pref("CT2504091.initDone", true);
Deleted : user_pref("CT2504091.isAppTrackingManagerOn", true);
Deleted : user_pref("CT2504091.myStuffEnabled", true);
Deleted : user_pref("CT2504091.myStuffPublihserMinWidth", 400);
Deleted : user_pref("CT2504091.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Deleted : user_pref("CT2504091.myStuffServiceIntervalMM", 1440);
Deleted : user_pref("CT2504091.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Deleted : user_pref("CT2504091.oldAppsList", "129079840421557838,129079840422026594,111,129079849636241789,129[...]
Deleted : user_pref("CT2504091.searchProtectorDialogDelayInSec", 10);
Deleted : user_pref("CT2504091.searchProtectorEnableByLogin", true);
Deleted : user_pref("CT2504091.testingCtid", "");
Deleted : user_pref("CT2504091.toolbarAppMetaDataLastCheckTime", "Sat Sep 24 2011 11:42:33 GMT+0200");
Deleted : user_pref("CT2504091.toolbarContextMenuLastCheckTime", "Sat Sep 24 2011 11:42:35 GMT+0200");
Deleted : user_pref("CT2504091.undefined", "Sat Sep 24 2011 11:42:35 GMT+0200");
Deleted : user_pref("CT2504091.usagesFlag", 2);
Deleted : user_pref("CommunityToolbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT2504091&Search[...]
Deleted : user_pref("CommunityToolbar.ConduitSearchList", "Web Search");
Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2504091", [...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=ct2504091", [...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.6.[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2504091",[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT2504091&octid=[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=ct2504091&octid=[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en-us", "\"[...]
Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\Users\alien\AppData\Roaming\Mozilla\F[...]
Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.6.0.10");
Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://www.google.fr/");
Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2504091");
Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2504091");
Deleted : user_pref("CommunityToolbar.ToolbarsList4", "CT2504091");
Deleted : user_pref("CommunityToolbar.globalUserId", "e0a37699-377b-4a09-bbf9-2a83b36b5ec1");
Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Deleted : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Sat Sep 24 2011 21:50:1[...]
Deleted : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Deleted : user_pref("CommunityToolbar.notifications.locale", "en");
Deleted : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
Deleted : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Sat Sep 24 2011 21:50:15 GMT+0200");
Deleted : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");
Deleted : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Deleted : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Deleted : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Deleted : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Deleted : user_pref("CommunityToolbar.notifications.userId", "e9440268-aec7-4fba-876d-fac66b31cd74");
Deleted : user_pref("browser.search.defaultengine", "Ask.com");
Deleted : user_pref("browser.search.defaultthis.engineName", "Web Search");
Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2504091&Sea[...]
Deleted : user_pref("browser.search.selectedEngine", "Claro Search");
Deleted : user_pref("browser.startup.homepage", "hxxp://www.claro-search.com/?affID=117423&tt=4612_4&babsrc=HP[...]
Deleted : user_pref("extensions.BabylonToolbar_i.newTab", true);
Deleted : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://www.claro-search.com/?affID=117423&tt=461[...]
Deleted : user_pref("extensions.claro.admin", false);
Deleted : user_pref("extensions.claro.aflt", "babsst");
Deleted : user_pref("extensions.claro.appId", "{C3110516-8EFC-49D6-8B72-69354F332062}");
Deleted : user_pref("extensions.claro.dfltLng", "en");
Deleted : user_pref("extensions.claro.excTlbr", false);
Deleted : user_pref("extensions.claro.id", "12e3b6220000000000000018e734a064");
Deleted : user_pref("extensions.claro.instlDay", "15660");
Deleted : user_pref("extensions.claro.instlRef", "sst");
Deleted : user_pref("extensions.claro.prdct", "claro");
Deleted : user_pref("extensions.claro.prtnrId", "claro");
Deleted : user_pref("extensions.claro.tlbrId", "claro");
Deleted : user_pref("extensions.claro.tlbrSrchUrl", "");
Deleted : user_pref("extensions.claro.vrsn", "1.8.3.10");
Deleted : user_pref("extensions.claro.vrsni", "1.8.3.10");
Deleted : user_pref("extensions.claro_i.smplGrp", "none");
Deleted : user_pref("extensions.claro_i.vrsnTs", "1.8.3.1017:52:32");

*************************

AdwCleaner[S1].txt - [24468 octets] - [18/11/2012 10:55:07]

########## EOF - C:\AdwCleaner[S1].txt - [24529 octets] ##########

Fish66 · Answer

Re, * Télécharge puis enregistre sur le bureau de ton PC ZHPDiag (de Nicolas Coolman) à partir : ce lien * Lance-le, (Clic droit "exécuter en tant qu'administrateur" si tu es sous Vista/7) * Clique sur l'icône en forme de loupe pour lancer le diagnostique * Héberge le rapport ZHPDiag.txt de ton bureau sur : malekal.com ou cjoint.com * Fais copier/coller le lien fourni dans ta prochaine réponse * Aide ZHPDiag : <<< ICI >>>

jaybee666 · Answer

https://pjjoint.malekal.com/files.php?read=ZHPDiag_20121119_8x7g15s11o9

Fish66 · Answer

Bonjour,
1/
=> Copie tout le texte présent en gras ci-dessous (Sélectionne-le, clique droit dessus et choisis "Copier").



[MD5.CDF95731C177C1E34B944EA5E63D492D] [SPRF][21/09/2012] (...) -- C:\Users\alien\AppData\Local\Temp\MyClaroTB.exe   [888472] 
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{597A9974-8CB0-4f41-B61F-ED065738A397}]     
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}]     
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{ba14329e-9550-4989-b3f2-9732e92d17cc}]     
C:\ProgramData\Browser Manager 
[MD5.CDE71F79668F9F37B96EA8B45480D737] [SPRF][16/11/2012] (.Babylon Ltd. - Uninstaller Application.) -- C:\Users\alien\AppData\Local\Temp\uninst1.exe   [378008] 
[MD5.48A2AFEB63131A434BCC00335E656A0F] [SPRF][04/09/2012] (.Yahoo! Inc. - Yahoo! Toolbar Detecter Setup.) -- C:\Users\alien\AppData\Local\Temp\ydetect.exe   [79024] 
[MD5.9C40EEF2594AC6AC43B24FD81F97A05D] [SPRF][16/11/2012] (.Tuto4pc - Tuto Gimp Setup.) -- C:\Users\alien\AppData\Local\Temp\ins410A.tmp.exe   [2237261] 
[MD5.05FECA1B4B1F7F9D924191716AD3F0BA] [SPRF][18/11/2012] (.Pas de propriétaire - IncrediMail Installer.) -- C:\Users\alien\AppData\Local\Temp\incredibar_installer.exe   [463184] 
[HKCU\Software\Somoto]     
[MD5.FF6E0179F60F08B648AEBD597EF0CAF1] [SPRF][18/11/2012] (.Somoto Ltd. - FilesFrog Update Checker.) -- C:\Users\alien\AppData\Local\Temp\UpdateCheckerSetup.exe   [260040] 

EmptyCLSID
EmptyFlash
EmptyTemp


=> Puis lance ZHPFix depuis le raccourci situé sur ton Bureau.
(Sous Vista/Win7, il faut cliquer droit sur le raccourci de ZHPFix et choisir Exécuter en tant qu'administrateur)

=> Une fois ZHPFix ouvert, clique sur le bouton "Coller le presse-papier".

=> Dans l'encadré principal, tu verras donc les lignes que tu as copié précédemment apparaître. Vérifie que toutes les lignes que je t'ai demandé de copier (et seulement elles) sont dans la fenêtre.

=> Clique sur "GO" pour lancer le nettoyage. Laisse l'outil travailler et ne touche à rien.

=> Une fois terminé, copie-colle le rapport dans ton prochain message. 

2/
* Télécharge sur le bureau RogueKiller (par tigzy)    
https://www.luanagames.com/index.fr.html    
* ( Sous Vista/Seven,clique droit, lancer en tant qu'administrateur )    
* Quitte tous tes programmes en cours    
* Lance RogueKiller.exe   
Si l'infection bloque le programme, il faut le relancer plusieurs fois ou le renommer en winlogon.exe   
* Laisse le prescan se terminer, clique sur Scan   
* Clique sur Rapport pour l'ouvrir puis copie/colle le sur le dans ton prochain message

jaybee666 · Answer

Rapport de ZHPFix 1.3.07 par Nicolas Coolman, Update du 13/11/2012
Fichier d'export Registre : C:\ZHP\ZHPExportRegistry-19-11-2012-17-28-37.txt
Run by alien at 19/11/2012 17:28:37
Windows 7 Ultimate Edition, 32-bit Service Pack 1 (Build 7601)



========== Processus mémoire ==========
SUPPRIME Memory Process: C:\Users\alien\AppData\Local\Temp\MyClaroTB.exe
SUPPRIME Memory Process: C:\Users\alien\AppData\Local\Temp\uninst1.exe
SUPPRIME Memory Process: C:\Users\alien\AppData\Local\Temp\ydetect.exe
SUPPRIME Memory Process: C:\Users\alien\AppData\Local\Temp\ins410A.tmp.exe
SUPPRIME Memory Process: C:\Users\alien\AppData\Local\Temp\incredibar_installer.exe
SUPPRIME Memory Process: C:\Users\alien\AppData\Local\Temp\UpdateCheckerSetup.exe

========== Clé(s) du Registre ==========
SUPPRIME Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{597A9974-8CB0-4f41-B61F-ED065738A397}
SUPPRIME Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
SUPPRIME Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{ba14329e-9550-4989-b3f2-9732e92d17cc}
SUPPRIME Key: HKCU\Software\Somoto

========== Dossier(s) ==========
SUPPRIME Folder: C:\Users\alien\AppData\Local\{037FCFF6-E306-446C-84DB-55DA535C7642}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{03E42090-F39B-4042-AFD2-E57E1E6063B4}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{04994F2C-8DE3-4E5B-BEF1-B6F19DFCDF0A}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{06D56DF0-9564-4AB1-AF51-AEF5A826ACE3}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{0AC411C1-C8CA-4014-B202-A675C2AE1478}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{0EC58687-E61B-4622-A9FF-C9EC8E037F41}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{10D250AA-3A3D-4972-B193-68ACB45FFD20}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{13B1BAA5-B50B-415F-BDF2-A4DBAFC087C5}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{14BEA189-18D2-4A23-80E2-2C0F285C442D}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{15EA7F60-AFF7-4F27-B7EE-C7EF50CE9EE0}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{184B6D10-5A2D-4DD7-B8A7-2FF90AB0BFDE}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{18E40643-C1EA-499C-AF4D-17C606711DCB}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{1B8B6F57-D846-4F6F-8510-5B102984A697}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{1DBFEAFA-BF4B-449C-AAE4-56543F6EBF7D}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{1E75D2C1-CEFB-4A8C-9C09-99A3C3B26E3F}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{21980B9E-DA2B-4DE4-B742-7F35E87B74D3}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{23E181FB-BEBD-422E-BB8E-C35ADAF98769}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{25060BCF-0344-41CA-903E-3F275CE61E42}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{29549905-DD5B-477F-89A0-F878E05F9C6E}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{37C9926C-A97A-4FE9-ACEE-CD1133D9EEBA}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{393A6C84-9243-4EE3-A61C-4CA81FA1E915}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{3D02715C-808D-4B87-A286-37BC90145DFE}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{3E1D6FE2-1705-48FA-8824-8171D72F7AEF}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{3E4ADABB-7D6A-4A28-BE7F-04D0D14A4837}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{3FCFD53C-7B0E-4E96-AD23-3F19C6FCE86C}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{48B12847-18C7-4EC6-9CA4-1DF1AD9BFC42}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{4CF2E629-D343-4B33-BF8E-E8EA676D2471}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{55EE3C6D-33B3-4C6D-A98B-140DCCD8CE88}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{5888AAE7-A629-425E-8683-3488CB418C49}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{5AD545CC-B280-4F3C-9C20-DCE6C3BBDE2C}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{5F3710BF-7BC2-4966-B543-AA840CC31103}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{6036F4A7-60F8-426D-B10D-DEFD21BB2DA7}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{6177B580-69A6-4199-BE6B-593254A43EEC}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{61D08FCB-F86F-4B09-AC68-C16CE474721A}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{61D669A4-9018-4E1C-A660-2B43498193A3}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{65544118-29CC-4ED0-815A-4131EBC43B7B}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{6D6BFB65-E5A6-43A4-A1F7-7AB88CAE63AC}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{70A4B363-8CC6-4AF9-81DC-A8D854715653}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{70A67258-7D1B-4285-AD5A-B52F7CEC09D3}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{71CBCB39-9311-4FEA-9339-38A5B57218E0}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{766B2609-0B5D-44EB-B391-2BCCA739345D}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{778644BD-611B-4FD3-87DD-66868A0D4345}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{7A577C7C-2E08-43AF-9963-9523D6B97CB5}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{7B157A2A-094A-4126-AC90-DF6F8A6A0843}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{8002638C-5CB0-4D75-BCC8-3795B02AC722}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{81DD9D90-1867-4343-8615-4888DB97D47A}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{8355F1E7-B5A6-4DBE-AA65-FDAE5335ED9F}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{856E16FD-329E-41A1-B8F7-4F75FF195BD3}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{86735D6E-5841-4C79-98C5-F07D5D099560}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{86DC3DB2-FB83-4347-A5AD-4C8857CB1444}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{8D2831F0-90D7-46C6-9CC6-F96A6FF9A004}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{90401251-723D-4B32-B7B8-60E9584E37CA}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{9240CC16-0AF6-4B3B-B302-2A3F45778038}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{9415B4DA-B50E-4650-AB28-2FB4987A11DF}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{976B8A82-89AD-4618-84BF-D32CF9C334A4}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{990C91F5-041C-479B-9F86-E2E9ADA8030E}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{9B19BA5B-673E-4200-BA91-6BB807BE4E65}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{9D6CB9C4-C610-49F3-B2A9-C62B5CDBF05C}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{9D98A462-EB5B-4D3B-8FFC-3E452061C3C5}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{9E18CB7B-4C0A-4370-B52C-259402178139}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{9EFAE183-C296-46CB-81A4-D3175900C97D}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{9F071E92-707F-42F9-9FF1-4BD529BA72D5}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{9FA5E80F-F528-4A40-99FB-8FA517F0EE3A}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{A1224994-5F94-436A-9AE1-9EE37BC3DE18}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{A18C8077-BDE1-4E13-8E5C-5A7DBF918833}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{A2AA3878-879C-4ECF-AAD1-D83AA8E304B6}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{A586CA1B-0FE3-49A8-958B-60B9EC10CDD4}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{A8A742A6-7AB8-4526-A518-24BE25019D43}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{AB57C2BA-F88C-43F2-8854-A3EA3265AD8E}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{B3C4B636-B847-43D7-BE4D-FE270DE8C17D}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{B62EE741-0B82-40FE-A8F3-3E35EF37B4D0}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{B8833F64-D713-454A-A9B2-1C731001A295}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{BB7DB828-720F-4888-AEF5-F92035B3C61D}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{C0ADCECF-8DF8-4B0C-BED4-56BD8DBF545C}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{C0BD0093-ADE6-4F16-A9AC-B4D1F9C710DC}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{C10D9364-ECF4-4981-A266-8AD80D6C2E31}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{C5CFED81-E6C9-4A16-9FD8-50CF7B571EA1}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{C6C3769D-C8A1-4C41-B303-14424FC25807}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{C8B01581-5EFC-404A-B2F4-AB0E60F31959}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{CD433FFC-3DEE-495B-83F0-A1990F96FAC7}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{CF06AF3E-E72A-4A18-9151-528F744E2776}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{CF9BA30F-7E90-4619-969C-EE0EB83526D1}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{D0A208BF-B1B4-47D2-BF4C-46CBFC3E0A6F}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{D0A96521-7AC5-41EF-B327-E24F6595984D}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{D1F82CB0-5A92-4F94-A435-93AC37614374}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{D3FF6C72-885B-48C4-9F9D-DDBBAC3E869C}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{D4549750-FD9D-494D-8C5B-8CC17F730E72}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{DD7F2688-F6AA-4D39-85CA-9DADEA446A09}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{E136FF13-C28C-4504-9E0D-F7E81976BA87}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{E1D3230D-8B36-4B50-AD23-119D288613B1}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{E278BCB0-D98C-4A87-AB01-EA35FD958C35}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{E50A02D1-5E0A-49F4-83B2-CCC9395633A6}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{E5247C4C-E3FC-46E2-9D10-487C3C6650D7}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{E836C3DA-26AB-45C5-8C32-749E7962C6C1}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{EE216EBE-5541-4F60-88F4-2DDD21BB7724}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{EF6661D5-94C4-4645-A54B-209B020EACE3}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{EFE848B5-CDC0-443F-A959-942A685EDDA0}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{F2F34E61-693C-4907-B57C-20AC5D060178}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{F6B0292B-57F5-4CA5-B8E1-CDE7EFD56304}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{FB06D5F4-4CF7-44C0-8F31-2FC334DDD916}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{FB13496B-D5BA-4F46-AE13-BB4D570D4666}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{FC3C2AD5-62FA-4214-BF67-2C81F7F4B075}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{FCD027DB-AA3B-43FD-95D1-0CB57880CB05}
SUPPRIME Folder: C:\Users\alien\AppData\Local\{FE6FF18C-5FDF-4ABF-BC41-564E2DB7E684}
SUPPRIME Flash Cookies:
SUPPRIME Temporaires Windows:

========== Fichier(s) ==========
SUPPRIME File*: c:\users\alien\appdata\local	emp\myclarotb.exe
SUPPRIME File*: c:\users\alien\appdata\local	emp\uninst1.exe
SUPPRIME File*: c:\users\alien\appdata\local	emp\ydetect.exe
SUPPRIME File: c:\users\alien\appdata\local	emp\ins410a.tmp.exe
SUPPRIME File: c:\users\alien\appdata\local	emp\incredibar_installer.exe
SUPPRIME File*: c:\users\alien\appdata\local	emp\updatecheckersetup.exe
SUPPRIME Flash Cookies:
SUPPRIME Temporaires Windows:


========== Récapitulatif ==========
6 : Processus mémoire
4 : Clé(s) du Registre
106 : Dossier(s)
8 : Fichier(s)


End of clean in 00mn 12s

========== Chemin de fichier rapport ==========
C:\ZHP\ZHPFix[R1].txt - 19/11/2012 17:28:37 [10867]

jaybee666 · Answer

RogueKiller V8.3.0 [Nov 18 2012] par Tigzy mail: tigzyRKgmailcom Remontees: https://www.luanagames.com/index.fr.html Website: https://www.luanagames.com/index.fr.html Blog: http://tigzyrk.blogspot.com Systeme d'exploitation: Windows 7 (6.1.7601 Service Pack 1) 32 bits version Demarrage : Mode normal Utilisateur : alien [Droits d'admin] Mode : Recherche -- Date : 19/11/2012 17:56:41 ¤¤¤ Processus malicieux : 2 ¤¤¤ [SUSP PATH] supt4pc_fr_14.exe -- C:\Users\alien\AppData\Local\tuto4pc_fr_14\supt4pc_fr_14.exe -> TUÉ [TermProc] [RESIDUE][DLL] explorer.exe -- C:\Windows\explorer.exe : C:\Windows\system32\OobeFldr.dll -> DECHARGÉE ¤¤¤ Entrees de registre : 7 ¤¤¤ [RUN][BLACKLISTDLL] HKLM\[...]\Run : Welcome Center (C:\Windows\system32\rundll32.exe C:\Windows\system32\OobeFldr.dll,ShowWelcomeCenter LaunchedBy_StartMenuShortcut) -> TROUVÉ [HJ] HKLM\[...]\System : ConsentPromptBehaviorUser (0) -> TROUVÉ [HJ DESK] HKCU\[...]\ClassicStartMenu : {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> TROUVÉ [HJ DESK] HKCU\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> TROUVÉ [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> TROUVÉ [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> TROUVÉ [APPINIT][SUSP PATH] HKLM\[...]\Windows : AppInit_DLLs (c:\ProgramData\Browser Manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll) -> TROUVÉ ¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤ ¤¤¤ Driver : [CHARGE] ¤¤¤ ¤¤¤ Fichier HOSTS: ¤¤¤ --> C:\Windows\system32\drivers\etc\hosts ¤¤¤ MBR Verif: ¤¤¤ +++++ PhysicalDrive0: MAXTOR STM3250310AS ATA Device +++++ --- User --- [MBR] 403b6af6c81ac03fc7665c74f2a8e71f [BSP] a31e15d0df2d415f5d37ac34a0670550 : Windows 7/8 MBR Code Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 55000 Mo 1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 112642048 | Size: 183473 Mo User = LL1 ... OK! User = LL2 ... OK! Termine : << RKreport[1]_S_19112012_175641.txt >> RKreport[1]_S_19112012_175641.txt

Fish66 · Answer

Salut, 1/ Relance RogueKiller puis choisis "Suppression" et poste le rapport 2/ Ensuite /!\ ATTENTION : cette analyse peut durer quelques heures /!\ * Télécharge MBAM et installe le selon l'emplacement par défaut https://www.malwarebytes.com/mwb-download/ * Installe-le puis configure-le comme indiqué : <<< ICI >>> * si tu n'as rien modifié fais directement quitter sinon enregistrer * Lance Malwarebytes' Anti-Malware ================================= Si MBAM est déjà installé, aller directement à la mise à jour puis à l'analyse. ==> Ce logiciel gratuit est à garder. ================================= * Fais la mise à jour * Clique dans l'onglet "Recherche" * Coche l'option "Exécuter un examen complet" puis sur le bouton "Rechercher" * Choisis de scanner tous tes disques durs, puis clique sur 'Lancer l'examen" A la fin de l'analyse, si MBAM n'a rien trouvé : * Clique sur OK, le rapport s'ouvre spontanément Si des menaces ont été détectées : * Clique sur OK puis "Afficher les résultats" *Vérifie que toutes les lignes sont cochées * Choisis l'option "Supprimer la sélection" * Si MBAM demande le redémarrage de Windows : Clique sur "Oui" * Le rapport s'ouvre automatiquement après la suppression, il se trouve aussi dans l'onglet "Rapports/Logs" * Copie/colle le rapport dans le prochain message Remarque : - S'il y'a un problème de mise à jour de mbam, tu peux la faire manuellement en téléchargeant ce fichier puis en l'exécutant ¤¤¤ Le meilleur remède pour tous les problèmes, c'est la patience.... ¤¤¤

jaybee666 · Answer

RogueKiller V8.3.0 [Nov 18 2012] par Tigzy mail: tigzyRKgmailcom Remontees: https://www.luanagames.com/index.fr.html Website: https://www.luanagames.com/index.fr.html Blog: http://tigzyrk.blogspot.com Systeme d'exploitation: Windows 7 (6.1.7601 Service Pack 1) 32 bits version Demarrage : Mode normal Utilisateur : alien [Droits d'admin] Mode : Suppression -- Date : 19/11/2012 18:50:56 ¤¤¤ Processus malicieux : 0 ¤¤¤ ¤¤¤ Entrees de registre : 7 ¤¤¤ [RUN][BLACKLISTDLL] HKLM\[...]\Run : Welcome Center (C:\Windows\system32\rundll32.exe C:\Windows\system32\OobeFldr.dll,ShowWelcomeCenter LaunchedBy_StartMenuShortcut) -> SUPPRIMÉ [HJ] HKLM\[...]\System : ConsentPromptBehaviorUser (0) -> REMPLACÉ (1) [HJ DESK] HKCU\[...]\ClassicStartMenu : {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> REMPLACÉ (0) [HJ DESK] HKCU\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REMPLACÉ (0) [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REMPLACÉ (0) [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REMPLACÉ (0) [APPINIT][SUSP PATH] HKLM\[...]\Windows : AppInit_DLLs (c:\ProgramData\Browser Manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll) -> REMPLACÉ () ¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤ ¤¤¤ Driver : [CHARGE] ¤¤¤ ¤¤¤ Fichier HOSTS: ¤¤¤ --> C:\Windows\system32\drivers\etc\hosts ¤¤¤ MBR Verif: ¤¤¤ +++++ PhysicalDrive0: MAXTOR STM3250310AS ATA Device +++++ --- User --- [MBR] 403b6af6c81ac03fc7665c74f2a8e71f [BSP] a31e15d0df2d415f5d37ac34a0670550 : Windows 7/8 MBR Code Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 55000 Mo 1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 112642048 | Size: 183473 Mo User = LL1 ... OK! User = LL2 ... OK! Termine : << RKreport[3]_D_19112012_185056.txt >> RKreport[1]_S_19112012_175641.txt ; RKreport[2]_S_19112012_185025.txt ; RKreport[3]_D_19112012_185056.txt

jaybee666 · Answer

Malwarebytes Anti-Malware (Essai) 1.65.1.1000
www.malwarebytes.org

Version de la base de données: v2012.11.19.07

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
alien :: ALIEN-PC [administrateur]

Protection: Activé

19/11/2012 19:06:58
mbam-log-2012-11-19 (19-06-58).txt

Type d'examen: Examen complet (C:\|D:\|)
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 319187
Temps écoulé: 27 minute(s), 17 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FoxTab PDF Creator (Adware.Agent) -> Mis en quarantaine et supprimé avec succès.

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 1
C:\Program Files\FoxTabPDFConverter\Uninstall\Uninstall.exe (Adware.Agent) -> Mis en quarantaine et supprimé avec succès.

(fin)

Fish66 · Answer

Re,

Il me faut un nouveau rapport ZHPDiag (à héberger)

jaybee666 · Answer

Bonjour,voici le lien du fichier et merci beaucoup pour tous ces conseils mon pc fonctionne déjà beaucoup mieux qu'avant.https://pjjoint.malekal.com/files.php?id=ZHPDiag_20121120_k6e15x14x13q6

Fish66 · Answer

Salut,
1/
=> Copie tout le texte présent en gras ci-dessous (Sélectionne-le, clique droit dessus et choisis "Copier").



[MD5.00000000000000000000000000000000] [APT] [DealPlyUpdate] (...) -- C:\Program Files\DealPly\DealPlyUpdate.exe (.not file.)    
[HKCU\Software\Somoto]    
[MD5.00000000000000000000000000000000] [APT] [Ad-Aware Update (Weekly)] (...) -- C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe (.not file.)    => Lavasoft AB Ad-Aware
[MD5.00000000000000000000000000000000] [APT] [{33F5082A-85DF-4511-A541-E92C59DF6E4B}] (...) -- C:\Users\alien\Desktop\Vuze_Installer.exe (.not file.)
O23 - Service: supt4pc_fr_14 (supt4pc_fr_14) . (...) - C:\Users\alien\AppData\Local	uto4pc_fr_14\supt4pc_fr_14.exe
[HKCU\Software\5a48bdae63aee43]
[HKLM\Software\5a48bdae63aee43]
[HKLM\Software\VB2S360]


=> Puis lance ZHPFix depuis le raccourci situé sur ton Bureau.
(Sous Vista/Win7, il faut cliquer droit sur le raccourci de ZHPFix et choisir Exécuter en tant qu'administrateur)

=> Une fois ZHPFix ouvert, clique sur le bouton "Coller le presse-papier".

=> Dans l'encadré principal, tu verras donc les lignes que tu as copié précédemment apparaître. Vérifie que toutes les lignes que je t'ai demandé de copier (et seulement elles) sont dans la fenêtre.

=> Clique sur "GO" pour lancer le nettoyage. Laisse l'outil travailler et ne touche à rien.

=> Une fois terminé, copie-colle le rapport dans ton prochain message.

2/
* Telecharge et installe  USBFix à partir  : ce lien  ou encore : celui-ci



(!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectés sans les ouvrir   

* Double clique sur le raccourci UsbFix sur ton Bureau (clique droit avec la souris  

:exécuter en tant qu'administrateur pour vista/seven), l'installation se fera  

automatiquement  

* Clique sur "Recherche"   
* Laisse travailler l'outil

* A la fin, le rapport va s'afficher : poste le dans ta prochaine réponse (il est aussi  sauvegardé a la racine du disque dur : C:\UsbFix.txt  )

jaybee666 · Answer

Rapport de ZHPFix 1.3.07 par Nicolas Coolman, Update du 13/11/2012
Fichier d'export Registre : C:\ZHP\ZHPExportRegistry-20-11-2012-13-52-26.txt
Run by alien at 20/11/2012 13:52:20
Windows 7 Ultimate Edition, 32-bit Service Pack 1 (Build 7601)



========== Clé(s) du Registre ==========
SUPPRIME Key: HKCU\Software\Somoto
SUPPRIME Key: Service: supt4pc_fr_14
SUPPRIME Key: HKCU\Software\5a48bdae63aee43
SUPPRIME Key: HKLM\Software\5a48bdae63aee43
SUPPRIME Key: HKLM\Software\VB2S360

========== Fichier(s) ==========
SUPPRIME Reboot c:\users\alien\appdata\local	uto4pc_fr_14\supt4pc_fr_14.exe

========== Tache planifiée ==========
SUPPRIME Task: DealPlyUpdate
SUPPRIME Task: Ad-Aware Update (Weekly)
SUPPRIME Task: {33F5082A-85DF-4511-A541-E92C59DF6E4B}


========== Récapitulatif ==========
5 : Clé(s) du Registre
1 : Fichier(s)
3 : Tache planifiée


End of clean in 00mn 06s

========== Chemin de fichier rapport ==========
C:\ZHP\ZHPFix[R1].txt - 19/11/2012 17:28:37 [10920]
C:\ZHP\ZHPFix[R2].txt - 20/11/2012 13:52:21 [965]

jaybee666 · Answer

############################## | UsbFix V 7.100 | [Research]

User: alien (Administrator) # ALIEN-PC
Updated 11/11/2012 by El Desaparecido
Started at 13:58:12 | 20/11/2012

Website: https://www.sosvirus.net/
Contact: contact@eldesaparecido.com

PC: System manufacturer (P5K) (X86-based PC
CPU: Intel(R) Core(TM)2 Duo CPU     E6750  @ 2.66GHz (2664)
RAM -> [Total : 2047 | Free : 1235]
BIOS: BIOS Date: 10/30/07 20:44:12 Ver: 08.00.12
BOOT: Normal boot

OS: Microsoft Windows 7 Édition Intégrale  (6.1.7601 32-Bit) # Service Pack 1
WB: Windows Internet Explorer 9.0.8112.16421

SC: Security Center Service [(!) Disabled]
WU: Windows Update Service [Enabled]
AS: Windows Defender [Enabled | (!) Outdated]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Fixed drive # 54 Gb (16 Mb free - 30%) [] # NTFS
D:\ -> Fixed drive # 179 Gb (34 Mb free - 19%) [Disque 2] # NTFS
E:\ -> CD-ROM
F:\ -> Removable drive # 7 Gb (523 Mb free - 7%) [] # FAT32
G:\ -> Fixed drive # 298 Gb (292 Mb free - 98%) [FREECOM HDD] # FAT32

################## | Active Processes |

C:\Windows\system32\csrss.exe (396)
C:\Windows\system32\wininit.exe (476)
C:\Windows\system32\csrss.exe (484)
C:\Windows\system32\services.exe (524)
C:\Windows\system32\lsass.exe (540)
C:\Windows\system32\lsm.exe (548)
C:\Windows\system32\winlogon.exe (616)
C:\Windows\system32\svchost.exe (708)
C:\Windows\system32\svchost.exe (780)
C:\Windows\system32\atiesrxx.exe (824)
C:\Windows\System32\svchost.exe (880)
C:\Windows\System32\svchost.exe (916)
C:\Windows\system32\svchost.exe (956)
C:\Windows\system32\svchost.exe (1136)
C:\Windows\system32\atieclxx.exe (1172)
C:\Windows\system32\Dwm.exe (1412)
C:\Windows\Explorer.EXE (1428)
C:\Windows\system32\svchost.exe (1516)
C:\Windows\System32\spoolsv.exe (1652)
C:\Windows\system32\svchost.exe (1708)
C:\Windows\vVX3000.exe (1772)
C:\Windows\system32	askhost.exe (1808)
C:\Program Files\Common Files\Java\Java Update\jusched.exe (1836)
C:\Program Files\Logitech\SetPointP\SetPoint.exe (1848)
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (1868)
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (1936)
D:\jeux ds\VTech\DownloadManager\System\AgentMonitor.exe (1984)
C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe (2000)
C:\Program Files\Epson Software\Event Manager\EEventManager.exe (2008)
C:\Program Files\Windows Sidebar\sidebar.exe (2036)
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE (288)
C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe (1316)
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (1804)
C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE (1076)
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE (2052)
C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE (2076)
C:\Windows\system32\svchost.exe (2112)
C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe (2148)
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (2204)
C:\Program Files\SFR\Media Center\MediaCenter.exe (2264)
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (2348)
C:\Program Files\FilesFrog Update Checker\update_checker.exe (2616)
C:\Program Files\Microsoft LifeCam\MSCamS32.exe (2636)
C:\Windows\system32\svchost.exe (2664)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (2732)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (2884)
C:\Windows\system32\wbem\wmiprvse.exe (2976)
C:\Windows\system32\svchost.exe (736)
C:\Windows\system32\SearchIndexer.exe (3528)
C:\Program Files\SFR\Media Center\httpd\httpd.exe (3824)
C:\Windows\system32\conhost.exe (3920)
C:\Program Files\SFR\Media Center\httpd\httpd.exe (3280)
C:\Windows\System32\svchost.exe (4608)
C:\Windows\system32\DllHost.exe (4196)
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (4652)
C:\Program Files\Nero\Update\NASvc.exe (4140)
C:\PROGRA~1\Raptraptr.exe (4100)
C:\PROGRA~1\Raptraptr_im.exe (4500)
C:\Program Files\Mozilla Firefox\firefox.exe (1012)
C:\Windows\system32\WUDFHost.exe (1668)
C:\UsbFix\Go.exe (1180)
\?\C:\Windows\system32\wbem\WMIADAP.EXE (4224)
C:\Windows\system32\wbem\wmiprvse.exe (2400)
C:\Windows\System32\svchost.exe (3976)

################## | Files # Infected Folders |

Found ! G:\._autorun.inf
Found ! G:\autorun.inf

################## | Registry |


################## | Mountpoints2 |

HKCU\.\.\.\.\Explorer\MountPoints2\{a74407d3-e455-11e1-8b55-001e8c1a803a}
Shell\AutoRun\Command = F:\LGAutoRun.exe



################## | Vaccin |

(!) This computer is not vaccinated!

################## | E.O.F |

Fish66 · Answer

Re,
(!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectés sans les ouvrir   

* Double clique sur le raccourci UsbFix sur ton Bureau (clique droit avec la souris  

:exécuter en tant qu'administrateur pour vista/seven), l'installation se fera  

automatiquement  

* Clique sur "Suppression"   
* Laisse travailler l'outil

* A la fin, le rapport va s'afficher : poste le dans ta prochaine réponse (il est aussi  sauvegardé a la racine du disque dur : C:\UsbFix.txt  )

jaybee666 · Answer

############################## | UsbFix V 7.100 | [Deletion]

User: alien (Administrator) # ALIEN-PC
Updated 11/11/2012 by El Desaparecido
Started at 16:14:26 | 20/11/2012

Website: https://www.sosvirus.net/
Contact: contact@eldesaparecido.com

PC: System manufacturer (P5K) (X86-based PC
CPU: Intel(R) Core(TM)2 Duo CPU     E6750  @ 2.66GHz (2664)
RAM -> [Total : 2047 | Free : 1053]
BIOS: BIOS Date: 10/30/07 20:44:12 Ver: 08.00.12
BOOT: Normal boot

OS: Microsoft Windows 7 Édition Intégrale  (6.1.7601 32-Bit) # Service Pack 1
WB: Windows Internet Explorer 9.0.8112.16421

SC: Security Center Service [(!) Disabled]
WU: Windows Update Service [Enabled]
AS: Windows Defender [Enabled | (!) Outdated]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Fixed drive # 54 Gb (16 Mb free - 30%) [] # NTFS
D:\ -> Fixed drive # 179 Gb (34 Mb free - 19%) [Disque 2] # NTFS
E:\ -> CD-ROM
F:\ -> Removable drive # 7 Gb (523 Mb free - 7%) [] # FAT32
G:\ -> Fixed drive # 298 Gb (292 Mb free - 98%) [FREECOM HDD] # FAT32

################## | Active Processes |

C:\Windows\system32\csrss.exe (396)
C:\Windows\system32\wininit.exe (476)
C:\Windows\system32\csrss.exe (484)
C:\Windows\system32\services.exe (524)
C:\Windows\system32\lsass.exe (540)
C:\Windows\system32\lsm.exe (548)
C:\Windows\system32\winlogon.exe (616)
C:\Windows\system32\svchost.exe (708)
C:\Windows\system32\svchost.exe (780)
C:\Windows\system32\atiesrxx.exe (824)
C:\Windows\System32\svchost.exe (880)
C:\Windows\System32\svchost.exe (916)
C:\Windows\system32\svchost.exe (956)
C:\Windows\system32\svchost.exe (1136)
C:\Windows\system32\atieclxx.exe (1172)
C:\Windows\system32\Dwm.exe (1412)
C:\Windows\Explorer.EXE (1428)
C:\Windows\system32\svchost.exe (1516)
C:\Windows\System32\spoolsv.exe (1652)
C:\Windows\system32\svchost.exe (1708)
C:\Windows\vVX3000.exe (1772)
C:\Windows\system32	askhost.exe (1808)
C:\Program Files\Common Files\Java\Java Update\jusched.exe (1836)
C:\Program Files\Logitech\SetPointP\SetPoint.exe (1848)
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (1868)
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (1936)
D:\jeux ds\VTech\DownloadManager\System\AgentMonitor.exe (1984)
C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe (2000)
C:\Program Files\Epson Software\Event Manager\EEventManager.exe (2008)
C:\Program Files\Windows Sidebar\sidebar.exe (2036)
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE (288)
C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe (1316)
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (1804)
C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE (1076)
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE (2052)
C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE (2076)
C:\Windows\system32\svchost.exe (2112)
C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe (2148)
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (2204)
C:\Program Files\SFR\Media Center\MediaCenter.exe (2264)
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (2348)
C:\Program Files\FilesFrog Update Checker\update_checker.exe (2616)
C:\Program Files\Microsoft LifeCam\MSCamS32.exe (2636)
C:\Windows\system32\svchost.exe (2664)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (2732)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (2884)
C:\Windows\system32\wbem\wmiprvse.exe (2976)
C:\Windows\system32\svchost.exe (736)
C:\Windows\system32\SearchIndexer.exe (3528)
C:\Program Files\SFR\Media Center\httpd\httpd.exe (3824)
C:\Windows\system32\conhost.exe (3920)
C:\Program Files\SFR\Media Center\httpd\httpd.exe (3280)
C:\Windows\System32\svchost.exe (4608)
C:\Windows\system32\DllHost.exe (4196)
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (4652)
C:\Program Files\Nero\Update\NASvc.exe (4140)
C:\PROGRA~1\Raptraptr.exe (4100)
C:\PROGRA~1\Raptraptr_im.exe (4500)
C:\Program Files\Mozilla Firefox\firefox.exe (1012)
C:\Windows\system32\WUDFHost.exe (1668)
C:\Program Files\Mozilla Firefox\plugin-container.exe (3352)
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe (4204)
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe (5456)
C:\Windows\system32	askhost.exe (1900)
C:\UsbFix\Go.exe (2424)

################## | Stopped processes |

Stopped! C:\Windows\system32\atiesrxx.exe (824)
Stopped! C:\Windows\system32\atieclxx.exe (1172)
Stopped! C:\Windows\Explorer.EXE (1428)
Stopped! C:\Windows\System32\spoolsv.exe (1652)
Stopped! C:\Windows\vVX3000.exe (1772)
Stopped! C:\Windows\system32	askhost.exe (1808)
Stopped! C:\Program Files\Common Files\Java\Java Update\jusched.exe (1836)
Stopped! C:\Program Files\Logitech\SetPointP\SetPoint.exe (1848)
Stopped! C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (1868)
Stopped! C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (1936)
Stopped! D:\jeux ds\VTech\DownloadManager\System\AgentMonitor.exe (1984)
Stopped! C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe (2000)
Stopped! C:\Program Files\Epson Software\Event Manager\EEventManager.exe (2008)
Stopped! C:\Program Files\Windows Sidebar\sidebar.exe (2036)
Stopped! C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE (288)
Stopped! C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe (1316)
Stopped! C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (1804)
Stopped! C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE (1076)
Stopped! C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE (2052)
Stopped! C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE (2076)
Stopped! C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe (2148)
Stopped! C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (2204)
Stopped! C:\Program Files\SFR\Media Center\MediaCenter.exe (2264)
Stopped! C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (2348)
Stopped! C:\Program Files\FilesFrog Update Checker\update_checker.exe (2616)
Stopped! C:\Program Files\Microsoft LifeCam\MSCamS32.exe (2636)
Stopped! C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (2732)
Stopped! C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (2884)
Stopped! C:\Windows\system32\SearchIndexer.exe (3528)
Stopped! C:\Program Files\SFR\Media Center\httpd\httpd.exe (3824)
Stopped! C:\Windows\system32\conhost.exe (3920)
Stopped! C:\Program Files\SFR\Media Center\httpd\httpd.exe (3280)
Stopped! C:\Windows\system32\DllHost.exe (4196)
Stopped! C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (4652)
Stopped! C:\Program Files\Nero\Update\NASvc.exe (4140)
Stopped! C:\PROGRA~1\Raptraptr.exe (4100)
Stopped! C:\PROGRA~1\Raptraptr_im.exe (4500)
Stopped! C:\Program Files\Mozilla Firefox\firefox.exe (1012)
Stopped! C:\Windows\system32\WUDFHost.exe (1668)
Stopped! C:\Program Files\Mozilla Firefox\plugin-container.exe (3352)
Stopped! C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe (4204)
Stopped! C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe (5456)

################## | Files # Infected Folders |

Deleted ! C:\$RECYCLE.BIN\S-1-5-21-1772841914-261610752-621916125-1000
Deleted ! D:\$RECYCLE.BIN\S-1-5-21-143080996-3975923987-1403853564-1000
Deleted ! D:\$RECYCLE.BIN\S-1-5-21-1475794054-1191329829-4276394343-500
Deleted ! D:\$RECYCLE.BIN\S-1-5-21-1772841914-261610752-621916125-1000
Deleted ! G:\._autorun.inf
Deleted ! G:\autorun.inf

(!) Temporary files deleted.

################## | Registry |


################## | Mountpoints2 |

Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{a74407d3-e455-11e1-8b55-001e8c1a803a}

################## | Listing |

[20/11/2012 - 16:15:01 | SHD ] 	C:\$Recycle.Bin
[01/11/2011 - 09:41:25 | N | 27019] 	C:\aaw7boot.log
[18/11/2012 - 10:55:15 | N | 24599] 	C:\AdwCleaner[S1].txt
[05/05/2011 - 13:41:27 | D ] 	C:\ATI
[10/06/2009 - 22:42:20 | N | 24] 	C:\autoexec.bat
[02/05/2011 - 18:06:07 | SHD ] 	C:\Boot
[20/11/2010 - 13:40:07 | RASH | 383786] 	C:\bootmgr
[22/02/2011 - 01:05:48 | N | 8192] 	C:\BOOTSECT.BAK
[10/06/2009 - 22:42:20 | N | 10] 	C:\config.sys
[14/07/2009 - 05:53:55 | SHD ] 	C:\Documents and Settings
[20/11/2012 - 10:07:53 | ASH | 1609916416] 	C:\hiberfil.sys
[05/05/2011 - 13:44:06 | D ] 	C:\Intel
[21/02/2011 - 18:33:54 |  | 393329] 	C:\JAWDC
[20/11/2012 - 10:08:03 | ASH | 2146557952] 	C:\pagefile.sys
[14/07/2009 - 03:37:05 | D ] 	C:\PerfLogs
[19/11/2012 - 18:55:25 | D ] 	C:\Program Files
[19/11/2012 - 18:55:26 | HD ] 	C:\ProgramData
[05/05/2011 - 13:43:47 | D ] 	C:\RaidTool
[21/02/2011 - 22:16:29 | SHD ] 	C:\Recovery
[20/11/2012 - 13:17:22 | SHD ] 	C:\System Volume Information
[20/11/2012 - 16:15:01 | D ] 	C:\UsbFix
[20/11/2012 - 16:14:45 | A | 8983] 	C:\UsbFix.txt
[21/02/2011 - 22:16:39 | D ] 	C:\Users
[21/02/2011 - 18:33:54 |  | 20] 	C:\win7.ld
[18/11/2012 - 10:57:00 | D ] 	C:\Windows
[20/11/2012 - 13:52:26 | D ] 	C:\ZHP
[20/11/2012 - 16:15:01 | SHD ] 	D:\$RECYCLE.BIN
[19/09/2011 - 20:10:01 | D ] 	D:\crack
[13/04/2008 - 10:36:29 | D ] 	D:\Icones
[25/06/2008 - 09:11:20 | D ] 	D:\Images
[25/01/2012 - 10:33:09 | D ] 	D:\jeux ds
[22/02/2011 - 01:44:08 | RHD ] 	D:\MSOCache
[31/10/2012 - 12:37:14 | D ] 	D:\Photos
[01/01/2002 - 11:27:54 | SHD ] 	D:\System Volume Information
[10/08/2012 - 10:25:22 | D ] 	D:\Truc a la con
[23/03/2012 - 11:59:53 | D ] 	D:\Videos
[13/08/2012 - 22:17:44 | D ] 	D:\Windows Burn Temp Files
[12/11/2012 - 18:05:23 | D ] 	D:\Zik
[27/11/2011 - 19:55:24 | D ] 	F:\FOUND.000
[11/11/2012 - 05:12:38 | N | 1469484325] 	F:\The.Woman.2011.FRENCH.BRRip.AC3.x264-Cellular.mkv
[05/09/2012 - 23:36:46 | N | 733777920] 	F:\Eva.2011.FRENCH.DVDRip.XviD-ARTEFAC.avi
[31/10/2012 - 06:48:14 | N | 732803072] 	F:\s8-rouille-xvid.cd1.avi
[31/10/2012 - 06:48:18 | N | 729587712] 	F:\s8-rouille-xvid.cd2.avi
[13/11/2012 - 10:58:58 | N | 736139264] 	F:\La.Cara.Oculta.2011.TRUEFRENCH.DVDRip.XviD-UTT.avi
[12/11/2012 - 00:07:56 | N | 734967808] 	F:\Mains.Armees.2012.FRENCH.BDRip.XviD-UTT.avi
[17/11/2012 - 05:35:52 | N | 730587784] 	F:\Total.Recall.2012.TRUEFRENCH.DVDRiP.XviD-AUTOPSiE.avi
[15/11/2012 - 23:03:08 | N | 731664384] 	F:	he.dark.knight.rises.2012.french.bdrip.xvid-tickets.cd1.avi
[15/11/2012 - 23:03:12 | N | 732612608] 	F:	he.dark.knight.rises.2012.french.bdrip.xvid-tickets.cd2.avi
[18/08/2010 - 14:57:26 | N | 12292] 	G:\.DS_Store
[31/08/2010 - 10:25:20 | N | 4096] 	G:\._.DS_Store
[31/08/2010 - 10:25:20 | N | 4096] 	G:\._logo.ico
[31/08/2010 - 10:25:58 | N | 4096] 	G:\._MAC
[31/08/2010 - 10:28:20 | N | 4096] 	G:\._Start MAC.app
[02/02/2010 - 19:00:42 | N | 37311] 	G:\logo.ico
[21/01/2012 - 15:14:52 | SHD ] 	G:\$RECYCLE.BIN
[13/11/2012 - 10:58:58 | N | 736139264] 	G:\la cara oculta.avi
[12/11/2012 - 00:07:56 | N | 734967808] 	G:\mains armées.avi
[15/11/2012 - 23:03:08 | N | 731664384] 	G:	he dark knight rises cd1.avi
[15/11/2012 - 23:03:12 | N | 732612608] 	G:	he dark knight rises cd2.avi
[11/11/2012 - 05:12:38 | N | 1469484325] 	G:	he woman.mkv
[11/11/2012 - 05:21:28 | N | 1463867720] 	G:	riangle.mkv
[17/11/2012 - 05:35:52 | N | 730587784] 	G:	otal recall mémoires programées.avi

################## | Vaccin |

C:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
F:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
G:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)

################## | Upload |

Please send the file: C:\UsbFix_Upload_Me_ALIEN-PC.zip
http://eldesaparecido.com/upload.php
Thank you for your contribution.

################## | E.O.F |

Fish66 · Answer

Re,
Si tu n'as plus de soucis :
Updatechecker :
Téléchage updatechecker pour t'indiquer les logiciels qui ne sont pas à jour et te permet aussi d'effectuer ces mises à jour  
Tu peux l'utiliser une fois par semaine       	
===========================================
**Nettoyage 
 
Suppression des outils de désinfections:
* Télécharge  Delfix   sur ton bureau.      	
* Lance le, tape suppression puis valide      	
* Patiente pendant le scan jusqu'à l'ouverture du rapport.      	
* Copie/Colle le contenu du rapport dans ta prochaine réponse.      	
Note : Le rapport se trouve également sous C:\DelFix.txt      	
* Tu peux le desinstaller      	
 
===========================================     	
<code>Défragmentation : :
Défragmente tes disques dur par defraggler 
Tu peux lutiliser une fois par trimestre	
===========================================	
 
Nettoyage des fichiers et des clés de registre :
* Télécharge et installe CCleaner version Slim           	
* Lance-le.(clic droit "en tant qu'administrateur" pour Vista et Seven) Va dans Options puis     	
* Avancé et décoche la case Effacer uniquement les fichiers etc....     	
* Va dans Nettoyeur, choisis Analyse. Une fois terminé, lance le nettoyage.     	
* Ensuite, choisis Registre, puis Chercher des erreurs. Une fois terminé, répare toutes les erreurs tant de fois qu il en trouve a l analyse .     	
** Aide ici : https://www.malekal.com/tutoriel-ccleaner/     	
Tu peux utiliser Ccleaner une fois par semaine    	
 
===========================================	
Purger les points de restauration système:  
 
* Désactive et réactive la restauration de système en suivant les procédures indiquées dans ces liens :  
 
Windows XP	
 
Windows Vista	
 
Windows 7	
 
* Après avoir vidé la restauration du système, il est nécessaire de créer un nouveau point de restauration ...  
 
===========================================	
Conseils :   	
1/ Je te conseille d'utiliser le navigateur Firefox et d'installer les modules         
complémentaires WOT pour t'indiquer les sites douteux et Adblock plus pour bloquer les publicités...     	
 
2/ Aussi tu peux garder Malwarebytes et l'utiliser aussi une fois par semaine.         
 
3/ Un peu de lecture :    	
* Les dangers du Peer-To-Peer, Emule etc..        
* Comment Sécuriser son ordinateur...       
*Pourquoi et comment je me fais infecter  
 *pourquoi maintenir son navigateur à jour

jaybee666 · Answer

# DelFix v6.2 - Logfile created 11/20/2012 at 17:18:49
# Updated 11/11/2012 by Xplode
# Operating system : Windows 7 Ultimate Service Pack 1 (32 bits)
# User : alien - ALIEN-PC
# Running from : C:\Users\alien\Desktop\delfix.exe
# Option [Delete]


~~~~~~ Folder(s) ~~~~~~

Not Deleted : C:\USBFix
Deleted : C:\ZHP
Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP
Deleted : C:\Program Files\ZHPDiag

~~~~~~ File(s) ~~~~~~

Deleted : C:\AdwCleaner[S1].txt
Deleted : C:\UsbFix.txt
Deleted : C:\UsbFix_Upload_Me_ALIEN-PC.zip

~~~~~~ Registry ~~~~~~

Key Deleted : HKCU\Software\USBFix
Key Deleted : HKLM\SOFTWARE\AdwCleaner
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\USBFix
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1

~~~~~~ Other ~~~~~~

-> Prefetch Emptied

*************************

DelFix[S1].txt - [903 octets] - [20/11/2012 17:18:49]

########## EOF - C:\DelFix[S1].txt - [1026 octets] ##########

jaybee666 · Answer

Merci encore pour le coup de main,c'est vraiment sympa de m'avoir expliqué toutes ces manipulations que je n'aurais jamais pu faire moi meme.

Fish66 · Answer

Bonsoir,

De rien.. , sois prudent et  bon surf!  :-)

Désinstaller claro search

21 réponses

Votre réponse

Discussions similaires

Newsletters