search.certified toolbar Résolu/Fermé

Question

Bonjour, 

par erreur j'ai installé search.certified toolbar...j'ai ensuite installé adwcleaner et après suppression, le rapport indique qu'il est enfin supprimé. Or, quand je tape une entrée dans la barre de recherche, ma recherche ne se fait pas sur google, comme avant, mais sur search.certified toolbar
est ce vraiment supprimé et comment puis je faire pour l'enlever définitivement?
merci !

yoann090 · Answer

Bonjour,  
Poste le rapport d'AdwCleaner.

Ensuite suis ce tutoriel : http://www.security-helpzone.com/Thread-ZHPDiag-Generer-un-rapport 

Et donne le lien vers le rapport

yoann090 · Answer

--> Copie tout le texte en gras ci-dessous : (CTRL + C (copier), CTRL +V (coller))

SysRestore
[HKLM\Software\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}]    => Infection PUP (PUP.DealPly)
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}]    => Infection PUP (PUP.DealPly)
[HKLM\Software\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}]    => Infection PUP (Spyware.Soft2PC)
[HKLM\Software\Wow6432Node\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}]    => Infection PUP (Spyware.Soft2PC)
[HKLM\Software\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}]    => Infection BT (Toolbar.Babylon)
[HKLM\Software\Wow6432Node\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}]    => Infection BT (Toolbar.Babylon)
[HKLM\Software\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}]    => Infection BT (Toolbar.Babylon)
[HKLM\Software\Wow6432Node\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}]    => Infection BT (Toolbar.Babylon)
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}]    => Infection BT (Hijack.Browser)
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C}]    => Infection BT (Hijack.Browser)
O4 - HKCU\..\Run: [bvrlym] c:\users\erika\appdata\local\lollipop\bvrlym.exe (.not file.)
O4 - HKUS\S-1-5-21-2111735515-2556741541-2646084351-1000\..\Run: [bvrlym] c:\users\erika\appdata\local\lollipop\bvrlym.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [RunAsStdUser Task] (...) -- C:\Program Files (x86)\BrightBreeze\bin\2.0.12.0\BrightBreezeSA.exe (.not file.)
O87 - FAEL: "{CCD53A17-DB9D-4296-BD8C-A0F9E7ADD005}" |In - None - P17 - TRUE | .(...) -- C:\Program Files (x86)\Protected Search\ProtectedSearch.exe (.not file.)
O87 - FAEL: "{A7F0393D-DC89-4FFA-B7B4-656458A53025}" |Out - None - P17 - TRUE | .(...) -- C:\Program Files (x86)\Protected Search\ProtectedSearch.exe (.not file.)
[HKCU\Software\AppDataLow\Software\midicair]    => midicair Toolbar
O43 - CFD: 30/01/2011 - 21:01:13 - [3,934] ----D C:\Program Files (x86)\midicair    => midicair Toolbar
O69 - SBI: SearchScopes [HKCU] {afdbddaa-5d3f-42ee-b79c-185a7020515b} - (Search the web (Babylon)) - http://search.babylon.com    => Toolbar.Conduit
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}]    => Toolbar.Conduit
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}]    => Toolbar.Conduit
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4daac69c-cba7-45e2-9bc8-1044483d3352}]    => Toolbar.Conduit
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{4daac69c-cba7-45e2-9bc8-1044483d3352}]    => Toolbar.Conduit
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}]
G1 - GCS: Preference [User Data\Default] http://ww7.certified-toolbar.com
O42 - Logiciel: Lollipop - (.Pas de propriétaire.) [HKCU][64Bits] -- bvrlym
[HKCU\Software\ProtectedSearch]
EmptyTemp
EmptyCLSID



Puis suis ce tutoriel : http://www.security-helpzone.com/Thread-ZHPFix-Script
et transmet le lien du rapport.

yoann090 · Answer

Bon ben on tente autre chose ^^

Essaye de reinitialiser Google chrome : https://forums.commentcamarche.net/forum/affich-37585758-reinitialiser-son-navigateur#reinitialiser-google-chrome 

Si tu as des favoris sauvegarde les : https://support.google.com/chrome/answer/96816?hl=fr

juju666 · Answer

Hello à la demande de yoann

&#9654 Télécharge ici :SEAF.exe de C_XX


&#9654 Double clique sur SF.exe (Exécuter en tant qu'administrateur pour Vista/7) .

&#9654 Une fenêtre va s'ouvrir .

&#9654 Tape search.certified

 dans cette fenêtre 

&#9654 &#9654 confirme la recherche dans le registre et [Entrée].

&#9654 Patiente pendant la recherche.

&#9654 Une fenêtre avec un log.txt va s'afficher.

&#9654 Copie/colle ce rapport dans ta prochaine réponse.

Lily59 · Answer

Bonjour

voici le rapport :
 

1. ========================= SEAF 1.0.1.0 - C_XX
2. 
3. Commencé à: 12:28:37 le 30/11/2012
4. 
5. Valeur(s) recherchée(s):
6. search.certified
7. 
8. Légende: TC => Date de création, TM => Date de modification, DA => Dernier accès
9. 
10. (!) --- Recherche registre
11. 
12. ====== Fichier(s) ======
13. 
14. Aucun fichier trouvé
15. 
16. 
17. ====== Entrée(s) du registre ======
18. 
19. 
20. [HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{6ACEAAC0-DBE4-4788-888A-612C72270664}]
21. "URL"="http://ww12.certified-toolbar.com{searchTerms}" (REG_SZ)
22. 
23. [HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{6ACEAAC0-DBE4-4788-888A-612C72270664}]
24. "TopResultURLFallback"="http://ww12.certified-toolbar.com{searchTerms}" (REG_SZ)
25. 
26. [HKLM\Software\Microsoft\Internet Explorer\SearchURI]
27. "(Default)"="http://search.certified-toolbar.com?si=38268&bs=true&tid=77&q=%s" (REG_SZ)
28. 
29. [HKLM\Software\Microsoft\Internet Explorer\SearchUrl]
30. "(Default)"="http://search.certified-toolbar.com?si=38268&bs=true&tid=77&q=%s" (REG_SZ)
31. 
32. [HKLM\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\Main]
33. "Start Page"="http://ww1.certified-toolbar.com" (REG_SZ)
34. 
35. [HKLM\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\Main]
36. "Start Default_Page_URL"="http://ww1.certified-toolbar.com" (REG_SZ)
37. 
38. [HKLM\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\Main]
39. "Default_Search_URL"="http://ww12.certified-toolbar.com" (REG_SZ)
40. 
41. [HKLM\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\Main]
42. "Search Bar"="http://ww12.certified-toolbar.com" (REG_SZ)
43. 
44. [HKLM\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\Main]
45. "Search Page"="http://ww12.certified-toolbar.com" (REG_SZ)
46. 
47. [HKLM\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\Search]
48. "Start Page"="http://ww1.certified-toolbar.com" (REG_SZ)
49. 
50. [HKLM\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\Search]
51. "Start Default_Page_URL"="http://ww1.certified-toolbar.com" (REG_SZ)
52. 
53. [HKLM\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\Search]
54. "Default_Search_URL"="http://ww12.certified-toolbar.com" (REG_SZ)
55. 
56. [HKLM\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\Search]
57. "Search Bar"="http://ww12.certified-toolbar.com" (REG_SZ)
58. 
59. [HKLM\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\Search]
60. "Search Page"="http://ww12.certified-toolbar.com" (REG_SZ)
61. 
62. [HKLM\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
63. "URL"="http://ww12.certified-toolbar.com{searchTerms}" (REG_SZ)
64. 
65. [HKLM\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
66. "TopResultURLFallback"="http://ww12.certified-toolbar.com{searchTerms}" (REG_SZ)
67. 
68. [HKLM\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\SearchURI]
69. "(Default)"="http://search.certified-toolbar.com?si=38268&bs=true&tid=77&q=%s" (REG_SZ)
70. 
71. [HKLM\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\SearchUrl]
72. "(Default)"="http://search.certified-toolbar.com?si=38268&bs=true&tid=77&q=%s" (REG_SZ)
73. 
74. [HKU\S-1-5-21-2111735515-2556741541-2646084351-1000\Software\Microsoft\Internet Explorer\SearchURI]
75. "(Default)"="http://search.certified-toolbar.com?si=38268&bs=true&tid=77&q=%s" (REG_SZ)
76. 
77. [HKU\S-1-5-21-2111735515-2556741541-2646084351-1000\Software\Microsoft\Internet Explorer\SearchUrl]
78. "(Default)"="http://search.certified-toolbar.com?si=38268&bs=true&tid=77&q=%s" (REG_SZ)
79. 
80. =========================
81. 
82. Fin à: 12:30:50 le 30/11/2012
83. 508808 Éléments analysés
84. 
85. =========================
86. E.O.F

juju666 · Answer

&#9654 Désactive ton antivirus le temps de la manipulation car OTM est détecté comme une infection à tort. 

&#9654 Télécharge OTM (OldTimer) sur ton Bureau : 

&#9654 Double-clique sur OTM.exe afin de le lancer. 

&#9654 Copie (Ctrl+C) le texte suivant ci-dessous : 

:reg
[-HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{6ACEAAC0-DBE4-4788-888A-612C72270664}] 
[-HKLM\Software\Microsoft\Internet Explorer\SearchURI] 
[HKLM\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page"=-
"Start Default_Page_URL"=-
"Default_Search_URL"=-
"Search Bar"=-
"Search Page"=-
"Start Page"=-
"Start Default_Page_URL"=-
"Default_Search_URL"=-
[HKLM\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"URL"=-
"TopResultURLFallback"=-

:commands
[emptytemp]

&#9654 Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

&#9654 Clique maintenant sur le bouton MoveIt! puis ferme OTM 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

&#9654 Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\ 

*Le nom du rapport correspond au moment de sa création : date_heure.log

Lily59 · Answer

voilà le rapport : 

All processes killed
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{6ACEAAC0-DBE4-4788-888A-612C72270664}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6ACEAAC0-DBE4-4788-888A-612C72270664}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchURI\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\Main\Start Default_Page_URL deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page not found.
Registry value HKEY_LOCAL_MACHINE\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\Main\Start Default_Page_URL not found.
Registry value HKEY_LOCAL_MACHINE\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL not found.
Registry value HKEY_LOCAL_MACHINE\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Classes\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\TopResultURLFallback deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: AppData
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 41620 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Erika
->Temp folder emptied: 17879109 bytes
->Temporary Internet Files folder emptied: 19112607 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 124762561 bytes
->Google Chrome cache emptied: 355964643 bytes
->Flash cache emptied: 43128 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1056433 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 118456 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 97544110 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 588,00 mb
 
 
OTM by OldTimer - Version 3.1.21.0 log created on 12012012_133445

Files moved on Reboot...
C:\Users\Erika\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

juju666 · Answer

Re encore des soucis?

Lily59 · Answer

Bonjour, 
apparemment pas de problème enfin plus de problème
Merci encore pour ton aide !

juju666 · Answer

Coucou Lily du Nord :)

Reste ceci à faire : https://forums-fec.be/entraide/viewtopic.php?f=11&t=229

A+

Search.certified toolbar

10 réponses

Discussions similaires