comment virer incrédibar Fermé

Question

Bonjour, 


je sais pas quoi faire merci d'avance


Configuration: Windows Vista / Firefox 17.0

Utilisateur anonyme · Answer

Bonsoir

 Télécharge AdwCleaner ( d'Xplode ) sur ton bureau. 
Lance le, clique sur  [Suppression] puis patiente le temps du scan. 
Une fois le scan fini, un rapport s'ouvrira. Poste moi son contenu dans ta prochaine réponse. 

Note : Le rapport est également sauvegardé sous C:\AdwCleaner[S1].txt 

Les toolbars, c'est pas obligatoire ( par Malekal ) :https://forum.malekal.com/viewtopic.php?t=6173&start= 

@+

dogg g · Answer

ça marche pas :/

quand je clique sur suppression il y un message qui me dit " adwcleaner a détecté une variante particulière... " 

[IMG]http://i270.photobucket.com/albums/jj97/SneaksDaGood/adwcleaner_zpsb921dea2.jpg[/IMG]

j'appuit sur ok ça me ferme tout et ça redémare

Utilisateur anonyme · Answer

Bonjour

Tu n'as aucun rapport?

Fait ceci:

Pour de plus amples informations, fait ceci stp

Ouvre ce lien et télécharge ZHPDiag de Nicolas Coolman : 

https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

Ou

https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/

Serveur N°2

Ou

http://www.premiumorange.com/zeb-help-process/zhpdiag.html 
en bas de la page ZHP avec un numéro de version.
 
Une fois le téléchargement achevé, 

Double-clique sur l'icône pour lancer le programme.  Sous Vista ; Seven ou Windows 8 clic droit «  exécuter en tant que administrateur » 

Clique sur  la loupe   pour lancer l'analyse.

Laisse l'outil travailler, il peut être assez long. 

Ferme ZHPDiag en fin d'analyse. 


Pour transmettre le rapport clique sur ce lien : 

https://forums-fec.be/upload 
 
http://pjjoint.malekal.com/

https://www.cjoint.com/

Regarde sur le bureau
 
Sélectionne le fichier ZHPDiag.txt. 

Clique sur "Cliquez ici pour déposer le fichier". 

Un lien de cette forme : 

http://www.cijoint.com/cjlink.php?file=cj200905/cijSKAP5fU.txt 

est ajouté dans la page. 

Copie ce lien dans ta réponse.

Merci

@+

dogg g · Answer

merci beaucoup !

voici le lien :  	https://forums-fec.be/upload/www/?action=d&id=5491737045

Utilisateur anonyme · Answer

Re

1)Télécharge AdwCleaner ( d'Xplode ) sur ton bureau. 
Lance le, clique sur  [Suppression] puis patiente le temps du scan. 
Une fois le scan fini, un rapport s'ouvrira. Poste moi son contenu dans ta prochaine réponse. 

Note : Le rapport est également sauvegardé sous C:\AdwCleaner[S1].txt 

Les toolbars, c'est pas obligatoire ( par Malekal ) :https://forum.malekal.com/viewtopic.php?t=6173&start= 


2) Télécharge Malwaresbytes anti malware ici  
https://fr.malwarebytes.com/mwb-download/

 
* Installe le (choisis bien "français" ; ne modifie pas les paramètres d'installe ) et  mets le à jour .   

* Potasse le tuto pour te familiariser avec le prg : 

https://forum.pcastuces.com/sujet.asp?f=31&s=3 

(cela dis, il est très simple d'utilisation). 

relance Malwaresbytes en suivant scrupuleusement ces consignes : 

! Déconnecte toi et ferme toutes applications en cours ! 

* Lance Malwarebyte's.   Sous Vista ;Seven ou Windows 8   (clic droit de la souris « exécuter en tant que administrateur »)

*Procèdes à une mise à jour

*Fais un examen dit "Complet"

--> Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ). 
--> à la fin tu cliques sur  "Afficher les résultats" "   . 
--> Vérifie que tous les objets infectés soient validés, puis  clique sur " supprimer la sélection "   . 

 Note   : si il faut redémarrer ton PC pour finir le nettoyage, fais le ! 


 Poste le rapport sauvegardé après la suppression des objets infectés   (dans l'onglet "rapport/log"de Malwaresbytes, le dernier en date)

@+

dogg g · Answer

c'est ça le rapport ? : 


Malwarebytes' Anti-Malware 1.40
Database version: 2705
Windows 6.0.6001 Service Pack 1

11/01/2013 19:43:44
mbam-log-2013-01-11 (19-43-44).txt

Scan type: Quick Scan
Objects scanned: 166540
Time elapsed: 6 minute(s), 23 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 9
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdAgent.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdwizreg.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seccenter.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Arrakis3.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdreinit.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdsubwiz.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdtkexec.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uiscan.exe (Security.Hijack) -> Delete on reboot.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Utilisateur anonyme · Answer

Re

Malwaresbytes n'est pas à jour
Fait le nécessaire et reprend une analyse complète

Merci

@+

dogg g · Answer

Malwarebytes Anti-Malware (Trial) 1.70.0.1100
www.malwarebytes.org

Database version: v2013.01.12.08

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
Jérôme le grand III :: PC-FALILIAL [administrator]

Protection: Enabled

12/01/2013 23:06:24
mbam-log-2013-01-12 (23-06-24).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 498465
Time elapsed: 16 minute(s), 17 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 38
HKCR\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\funmoods.funmoodsHlpr.1 (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\funmoods.funmoodsHlpr (PUP.Funmoods) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9} (PUP.Software.Updater) -> Quarantined and deleted successfully.
HKCR\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476} (PUP.Software.Updater) -> Quarantined and deleted successfully.
HKCR\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} (PUP.Software.Updater) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} (PUP.Software.Updater) -> Quarantined and deleted successfully.
HKCR\Updater.AmiUpd.1 (PUP.Software.Updater) -> Quarantined and deleted successfully.
HKCR\Updater.AmiUpd (PUP.Software.Updater) -> Quarantined and deleted successfully.
HKCR\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\esrv.funmoodsESrvc.1 (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\esrv.funmoodsESrvc (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\escort.escortIEPane.1 (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\escort.escortIEPane (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\funmoods.dskBnd.1 (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\funmoods.dskBnd (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\funmoodsApp.appCore.1 (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\funmoodsApp.appCore (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\f (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\Typelib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCR\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A} (PUP.Funmoods) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Funmoods (PUP.FunMoods) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\InstallCore\funmoods (PUP.FunMoods) -> Quarantined and deleted successfully.
HKCU\Software\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh (PUP.Funmoods) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh (PUP.Funmoods) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\InstallCore\funmoods (PUP.FunMoods) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\funmoods (PUP.FunMoods) -> Quarantined and deleted successfully.

Registry Values Detected: 2
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data: Funmoods Toolbar -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data:  -> Quarantined and deleted successfully.

Registry Data Items Detected: 1
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.FunMoods) -> Bad: (http://searchfunmoods.com/?f=1&a=nv1&ir=nv1&cd=2XzuyEtN2Y1L1QzutDtD0CtD0Azz0FyDyB0CtAtBzz0A0BtBtN0D0Tzu0CtAyDyBtN1L2XzutBtFtBtFtCtFyEtDyB&cr=1648733502 Good: (http://www.google.com) -> Quarantined and repaired successfully.

Folders Detected: 13
C:\Users\Jérôme le grand III\AppData\Roaming\SystemProc (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Pascal\AppData\Roaming\SystemProc (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Thierry\AppData\Roaming\SystemProc (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Cyril\AppData\Roaming\SysWin (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Jérôme le grand III\AppData\Roaming\SysWin (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Pascal\AppData\Roaming\SysWin (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Thierry\AppData\Roaming\SysWin (Trojan.Agent) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC-Optimizer (Adware.PCOptimizer) -> Quarantined and deleted successfully.
C:\Users\Jérôme le grand III\AppData\LocalLow\Funmoods (PUP.FunMoods) -> Quarantined and deleted successfully.
C:\Users\Jérôme le grand III\AppData\LocalLow\Funmoods\Funmoods (PUP.FunMoods) -> Quarantined and deleted successfully.
C:\Program Files\Funmoods (PUP.FunMoods) -> Quarantined and deleted successfully.
C:\Program Files\Funmoods\1.5.23.22 (PUP.FunMoods) -> Quarantined and deleted successfully.
C:\Program Files\Funmoods\1.5.23.22\bh (PUP.FunMoods) -> Quarantined and deleted successfully.

Files Detected: 24
C:\Program Files\Funmoods\1.5.23.22\bh\escort.dll (PUP.Funmoods) -> Quarantined and deleted successfully.
C:\Users\Jérôme le grand III\AppData\Local\SwvUpdater\Updater.exe (PUP.Software.Updater) -> Quarantined and deleted successfully.
C:\Program Files\Funmoods\1.5.23.22\funmoodssrv.exe (PUP.Funmoods) -> Quarantined and deleted successfully.
C:\Program Files\Funmoods\1.5.23.22\escorTlbr.dll (PUP.Funmoods) -> Quarantined and deleted successfully.
C:\Program Files\Funmoods\1.5.23.22\escortApp.dll (PUP.Funmoods) -> Quarantined and deleted successfully.
C:\Program Files\Funmoods\1.5.23.22\escortEng.dll (PUP.Funmoods) -> Quarantined and deleted successfully.
C:\Users\Cyril\Downloads\SoftonicDownloader_for_the-godfather.exe (PUP.OfferBundler.ST) -> Quarantined and deleted successfully.
C:\Users\Jérôme le grand III\Downloads\SoftonicDownloader_pour_poster-forge.exe (PUP.OfferBundler.ST) -> Quarantined and deleted successfully.
C:\Users\Jérôme le grand III\Downloads\PandaPDFConverter.exe (PUP.BundleInstaller.IB) -> Quarantined and deleted successfully.
C:\Users\Jérôme le grand III\Downloads\DVDRip_Romanzo_Criminale_-_Versione_Integrale(1).exe (PUP.Adware.Agent) -> Quarantined and deleted successfully.
C:\Users\Jérôme le grand III\Downloads\DVDRip_Romanzo_Criminale_-_Versione_Integrale.exe (PUP.Adware.Agent) -> Quarantined and deleted successfully.
C:\Windows\Tasks\AmiUpdXp.job (PUP.Software.Updater) -> Quarantined and deleted successfully.
C:\Users\Cyril\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbjciahceamgodcoidkjpchnokgfpphh_0.localstorage (PUP.Funmoods) -> Quarantined and deleted successfully.
C:\Users\Jérôme le grand III\Local Settings\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbjciahceamgodcoidkjpchnokgfpphh_0.localstorage (PUP.Funmoods) -> Quarantined and deleted successfully.
C:\Users\Cyril\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbjciahceamgodcoidkjpchnokgfpphh_0.localstorage (PUP.Funmoods) -> Quarantined and deleted successfully.
C:\Users\Jérôme le grand III\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbjciahceamgodcoidkjpchnokgfpphh_0.localstorage (PUP.Funmoods) -> Quarantined and deleted successfully.
C:\Users\Jérôme le grand III\AppData\Local\funmoods.crx (PUP.Funmoods) -> Quarantined and deleted successfully.
C:\Users\Jérôme le grand III\Local Settings\Application Data\funmoods.crx (PUP.Funmoods) -> Quarantined and deleted successfully.
C:\Users\Jérôme le grand III\AppData\Roaming\Funmoods\UpdateProc\UpdateTask.exe (PUP.FunMoods) -> Quarantined and deleted successfully.
C:\Program Files\Funmoods\1.5.23.22\escortShld.dll (PUP.FunMoods) -> Quarantined and deleted successfully.
C:\Program Files\Funmoods\1.5.23.22\FavIcon.ico (PUP.FunMoods) -> Quarantined and deleted successfully.
C:\Program Files\Funmoods\1.5.23.22\Sqlite3.dll (PUP.FunMoods) -> Quarantined and deleted successfully.
C:\Program Files\Funmoods\1.5.23.22\uninst.dat (PUP.FunMoods) -> Quarantined and deleted successfully.
C:\Program Files\Funmoods\1.5.23.22\uninstall.exe (PUP.FunMoods) -> Quarantined and deleted successfully.

Utilisateur anonyme · Answer

Bonjour

As tu encore des soucis?

@+

dogg g · Answer

oui ... :/

Utilisateur anonyme · Answer

Bonsoir

Pourriez-vous, s'il vous plait, reformuler votre problème avec des phrases complètes; bonjour et merci sont aussi des mots bien appréciés ici, puisque notre seul salaire. 
 
http://img139.imageshack.us/img139/8973/notdistrimq9.jpg

@+

dogg g · Answer

relis mon premier poste tu verras que j'y ai mis bonsoir et merci ...

je reformule mon problème : je n'arrive pas à supprimer un bug sur internet. Quand je navigue, intempestivement une page du nom de incredibar s'ouvre tout le temps

merci bonne soirée

Utilisateur anonyme · Answer

Bonjour

Poste moi un nouveau rapport ZHPdiag;merci

@+

dogg g · Answer

Bonsoir,

https://pjjoint.malekal.com/files.php?id=ZHPDiag_20130119_n14d14z9u6o5

Utilisateur anonyme · Answer

Bonjour

Commence par faire de la place 
    
System drive C: has 8 GB (1%) free of 458 GB 

Et ensuite met à jour ton système via Windows update

@+

dogg g · Answer

Bonsoir, 

j'ai fait ce que vous m'avez demandé.
( maintenant la page qui s'ouvre c'est ça : http://assist.babylon.com/babylonassista/dnsassist/main?domain=.disqus.comcount.js )

a+

Utilisateur anonyme · Answer

Bonsoir

Poste moi un nouveau rapport ZHPDiag

Merci

@+

Comment virer incrédibar

17 réponses

Discussions similaires