Very slow PC and Java exploits Solved

Question

Hello, I am contacting you because for a few days my PC has been very very slow. It takes hours to open a page and even when I type, only a few letters appear here and there. I’m really struggling!!  Obviously, I came to read the forum advice and I did a cleanup with CCleaner and I ran a scan with my antivirus “Avira”. I’m posting the report hoping to find a solution. Thanks in advance.  REPORT  Avira Free Antivirus Report file creation date: Saturday, March 16, 2013 08:59  The scan covers 5,206,996 virus strains.  The program is running in unlimited full version. Online services are available.  License holder: Avira Free Antivirus Serial number: 0000149996-ADJIE-0000001 Platform: Windows Vista (TM) Home Premium Windows version: (Service Pack 2) [6.0.6002] Boot mode: Normal startup Identifier: SYSTEM Computer name: PC-DE-NICO  Version information: BUILD.DAT: 12.1.9.402 40870 Bytes 17/10/2012 16:29:00 AVSCAN.EXE: 12.3.0.48 468256 Bytes 15/11/2012 14:15:01 AVSCAN.DLL: 12.3.0.15 65488 Bytes 13/08/2012 20:27:50 LUKE.DLL: 12.3.0.15 68304 Bytes 13/08/2012 20:27:50 AVSCPLR.DLL: 12.3.0.14 97032 Bytes 09/05/2012 06:59:26 AVREG.DLL: 12.3.0.17 232200 Bytes 11/05/2012 07:10:53 VBASE000.VDF: 7.10.0.0 19875328 Bytes 06/11/2009 18:18:34 VBASE001.VDF: 7.11.0.0 13342208 Bytes 14/12/2010 09:07:39 VBASE002.VDF: 7.11.19.170 14374912 Bytes 20/12/2011 17:37:34 VBASE003.VDF: 7.11.21.238 4472832 Bytes 01/02/2012 19:34:22 VBASE004.VDF: 7.11.26.44 4329472 Bytes 28/03/2012 18:54:57 VBASE005.VDF: 7.11.34.116 4034048 Bytes 29/06/2012 10:37:04 VBASE006.VDF: 7.11.41.250 4902400 Bytes 06/09/2012 17:54:11 VBASE007.VDF: 7.11.50.230 3904512 Bytes 22/11/2012 20:32:25 VBASE008.VDF: 7.11.60.10 6627328 Bytes 07/02/2013 20:55:25 VBASE009.VDF: 7.11.60.11 2048 Bytes 07/02/2013 20:55:25 VBASE010.VDF: 7.11.60.12 2048 Bytes 07/02/2013 20:55:25 VBASE011.VDF: 7.11.60.13 2048 Bytes 07/02/2013 20:55:25 VBASE012.VDF: 7.11.60.14 2048 Bytes 07/02/2013 20:55:25 VBASE013.VDF: 7.11.60.62 351232 Bytes 08/02/2013 20:54:54 VBASE014.VDF: 7.11.60.115 190976 Bytes 09/02/2013 22:46:42 VBASE015.VDF: 7.11.60.177 282624 Bytes 11/02/2013 22:46:46 VBASE016.VDF: 7.11.60.249 215552 Bytes 13/02/2013 14:25:20 VBASE017.VDF: 7.11.61.65 151040 Bytes 15/02/2013 17:47:36 VBASE018.VDF: 7.11.61.135 159232 Bytes 18/02/2013 18:31:33 VBASE019.VDF: 7.11.61.163 152064 Bytes 18/02/2013 18:31:33 VBASE020.VDF: 7.11.61.207 164352 Bytes 19/02/2013 18:31:34 VBASE021.VDF: 7.11.62.43 206336 Bytes 21/02/2013 18:31:22 VBASE022.VDF: 7.11.64.106 1510912 Bytes 11/03/2013 18:46:50 VBASE023.VDF: 7.11.64.157 137216 Bytes 12/03/2013 20:59:31 VBASE024.VDF: 7.11.64.233 159744 Bytes 14/03/2013 20:59:34 VBASE025.VDF: 7.11.65.19 143360 Bytes 15/03/2013 20:59:35 VBASE026.VDF: 7.11.65.20 2048 Bytes 15/03/2013 20:59:35 VBASE027.VDF: 7.11.65.21 2048 Bytes 15/03/2013 20:59:35 VBASE028.VDF: 7.11.65.22 2048 Bytes 15/03/2013 20:59:35 VBASE029.VDF: 7.11.65.23 2048 Bytes 15/03/2013 20:59:35 VBASE030.VDF: 7.11.65.24 2048 Bytes 15/03/2013 20:59:35 VBASE031.VDF: 7.11.65.38 6144 Bytes 15/03/2013 20:59:35 Engine version: 8.2.12.16 AElD.DLL: 8.1.2.10 102772 Bytes 10/07/2012 20:14:23 AESCRIPT.DLL: 8.1.4.98 475516 Bytes 14/03/2013 20:59:41 AESCN.DLL: 8.1.10.0 131445 Bytes 14/12/2012 18:43:08 AESBX.DLL: 8.2.5.12 606578 Bytes 15/06/2012 18:07:50 AERDL.DLL: 8.2.0.88 643444 Bytes 10/01/2013 20:31:59 AEPACK.DLL: 8.3.2.2 827767 Bytes 14/03/2013 20:59:41 AEOFFICE.DLL: 8.1.2.56 205180 Bytes 08/03/2013 18:46:48 AEHEUR.DLL: 8.1.4.248 5804409 Bytes 14/03/2013 20:59:40 AEHELP.DLL: 8.1.25.2 258423 Bytes 11/10/2012 18:07:55 AEGEN.DLL: 8.1.6.16 434549 Bytes 24/01/2013 20:31:18 AEEXP.DLL: 8.4.0.12 192886 Bytes 14/03/2013 20:59:42 AEEMU.DLL: 8.1.3.2 393587 Bytes 10/07/2012 20:14:22 AECORE.DLL: 8.1.31.2 201080 Bytes 19/02/2013 18:31:35 AEBB.DLL: 8.1.1.4 53619 Bytes 05/11/2012 23:38:11 AVWINLL.DLL: 12.3.0.15 27344 Bytes 13/08/2012 20:27:50 AVPREF.DLL: 12.3.0.32 50720 Bytes 15/11/2012 14:15:01 AVREP.DLL: 12.3.0.15 179208 Bytes 09/05/2012 06:59:26 AVARKT.DLL: 12.3.0.33 209696 Bytes 15/11/2012 14:15:00 AVEVTLOG.DLL: 12.3.0.15 169168 Bytes 13/08/2012 20:27:50 SQLITE3.DLL: 3.7.0.1 398288 Bytes 13/08/2012 20:27:50 AVSMTP.DLL: 12.3.0.32 63992 Bytes 13/08/2012 20:27:50 NETNT.DLL: 12.3.0.15 17104 Bytes 13/08/2012 20:27:50 RCIMAGE.DLL: 12.1.0.13 4449488 Bytes 20/09/2011 00:36:03 RCTEXT.DLL: 12.3.0.32 100640 Bytes 15/11/2012 14:14:41  Current scan configuration: Task name: System Integrity Check Configuration file: C:\Program Files\Avira\AntiVir Desktop\sysscan.avp Documentation: default Main action: interactive Secondary action: ignore Boot sector search: on Boot sector search: on Boot sectors: C:, Scan active programs: on Extended task programs: on Search in registry: on Rootkit search: on System file integrity check: off Scan mode: All files Search in archives: on Recursion depth limit: 20 Archive Smart Extensions: on Macrovirus heuristic: on File heuristic: advanced  Start time: Saturday, March 16, 2013 08:59  Boot record search begins: Master boot record HD0  [INFO] No virus found! Master boot record HD1  [INFO] No virus found! Master boot record HD2  [INFO] No virus found! Master boot record HD3  [INFO] No virus found! Master boot record HD4  [INFO] No virus found!  Boot search begins: Boot sector 'C:\'  [INFO] No virus found!  Hidden objects search begins.  Process search begins: Search process 'SearchFilterHost.exe' - '32' module(s) are checked Search process 'SearchProtocolHost.exe' - '52' module(s) are checked Search process 'taskeng.exe' - '24' module(s) are checked Search process 'consent.exe' - '50' module(s) are checked Search process 'PresentationFontCache.exe' - '31' module(s) are checked Search process 'ipmGui.exe' - '96' module(s) are checked Search process 'svchost.exe' - '30' module(s) are checked Search process 'vssvc.exe' - '49' module(s) are checked Search process 'conime.exe' - '16' module(s) are checked Search process 'CCC.exe' - '201' module(s) are checked Search process 'avscan.exe' - '87' module(s) are checked Search process 'avscan.exe' - '29' module(s) are checked Search process 'netsession_win.exe' - '59' module(s) are checked Search process 'avcenter.exe' - '72' module(s) are checked Search process 'svchost.exe' - '21' module(s) are checked Search process 'soffice.bin' - '85' module(s) are checked Search process 'ehmsas.exe' - '19' module(s) are checked Search process 'soffice.exe' - '17' module(s) are checked Search process 'AutoStartupService.exe' - '75' module(s) are checked Search process 'QuickShare.exe' - '125' module(s) are checked Search process 'ehtray.exe' - '26' module(s) are checked Search process 'netsession_win.exe' - '37' module(s) are checked Search process 'sidebar.exe' - '55' module(s) are checked Search process '64brmon.exe' - '18' module(s) are checked Search process 'DivXUpdate.exe' - '67' module(s) are checked Search process 'avgnt.exe' - '72' module(s) are checked Search process 'jusched.exe' - '29' module(s) are checked Search process 'MOM.exe' - '55' module(s) are checked Search process 'MSASCui.exe' - '41' module(s) are checked Search process 'GFFUpdater.exe' - '59' module(s) are checked Search process 'taskeng.exe' - '80' module(s) are checked Search process 'Explorer.EXE' - '135' module(s) are checked Search process 'Dwm.exe' - '33' module(s) are checked Search process 'taskeng.exe' - '25' module(s) are checked Search process 'avshadow.exe' - '33' module(s) are checked Search process 'taskeng.exe' - '49' module(s) are checked Search process 'WUDFHost.exe' - '32' module(s) are checked Search process 'SearchIndexer.exe' - '61' module(s) are checked Search process 'svchost.exe' - '9' module(s) are checked Search process 'ExtensionUpdaterService.exe' - '21' module(s) are checked Search process '64barsvc.exe' - '14' module(s) are checked Search process 'svchost.exe' - '64' module(s) are checked Search process 'svchost.exe' - '42' module(s) are checked Search process 'lxbccoms.exe' - '36' module(s) are checked Search process 'ibsvc.exe' - '38' module(s) are checked Search process 'avguard.exe' - '59' module(s) are checked Search process 'svchost.exe' - '58' module(s) are checked Search process 'armsvc.exe' - '25' module(s) are checked Search process 'svchost.exe' - '59' module(s) are checked Search process 'sched.exe' - '52' module(s) are checked Search process 'spoolsv.exe' - '88' module(s) are checked Search process 'svchost.exe' - '93' module(s) are checked Search process 'atieclxx.exe' - '32' module(s) are checked Search process 'svchost.exe' - '81' module(s) are checked Search process 'SLsvc.exe' - '26' module(s) are checked Search process 'svchost.exe' - '37' module(s) are checked Search process 'svchost.exe' - '151' module(s) are checked Search process 'svchost.exe' - '80' module(s) are checked Search process 'svchost.exe' - '64' module(s) are checked Search process 'atiesrxx.exe' - '25' module(s) are checked Search process 'svchost.exe' - '49' module(s) are checked Search process 'svchost.exe' - '35' module(s) are checked Search process 'svchost.exe' - '40' module(s) are checked Search process 'winlogon.exe' - '31' module(s) are checked Search process 'lsm.exe' - '22' module(s) are checked Search process 'lsass.exe' - '59' module(s) are checked Search process 'services.exe' - '33' module(s) are checked Search process 'csrss.exe' - '14' module(s) are checked Search process 'wininit.exe' - '26' module(s) are checked Search process 'csrss.exe' - '14' module(s) are checked Search process 'smss.exe' - '2' module(s) are checked  Registry reflection search begins: The registry has been scanned ('1212' files).   Search in selected files begins:  Starting search in 'C:\' C:\Users
ico\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\741f078f-3210318d  [0] Archive type: ZIP  --> vqd.class  [RESULT] Contains the EXP/CVE-2013-0422.A exploit detection pattern C:\Users
ico\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\1a46d6e7-387f45c0  [0] Archive type: ZIP  --> n.class  [RESULT] Contains the EXP/2012-1723.GL detection pattern  --> h.class  [RESULT] Contains the EXP/CVE-2012-1723.A.3159 detection pattern  --> van.class  [RESULT] Contains the EXP/CVE-2012-1723.A.3156 detection pattern  --> j.class  [RESULT] Contains the EXP/CVE-2012-1723.A.3170 detection pattern  --> pou.class  [RESULT] Contains the EXP/CVE-2012-1723.A.3117 detection pattern  --> e.class  [RESULT] Contains the EXP/CVE-2012-1723.GK detection pattern C:\Users
ico\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\26d83b2b-66d42c69  [0] Archive type: ZIP  --> a.class  [RESULT] Contains the EXP/2011-3544.DV.1 detection pattern  --> l.class  [RESULT] Contains the EXP/CVE-2011-3544.CD detection pattern C:\Users
ico\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\29c837e-37fe7701  [RESULT] Contains the Trojan horse TR/Necurs.A.890 C:\Users
ico\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\3b1a84bf-12144c0b  [0] Archive type: ZIP  -- >

billmaxime · Answer

hello  do a full scan with MBAM  download MBAM on your desktop  the link https://www.malwarebytes.com/ (use the free version)  the tutorial https://www.donnemoilinfo.com/tuto/Malwarebytes-Anti-Malware/  vista-w7-w8 users run as administrator (right click)  at the end of the scan, delete everything MBAM finds  delete the selection (use the 2nd page of the tutorial)  the scan can take about 2 hours (let it work)  the report will appear on your desktop and in MBAM's report/log  paste the report via a copy/paste  see you later

papa 14 · Answer

Hi, go to run and put "msconfig" after you go to the Startup tab and it will show you everything that starts at startup see you later

kirabelle · Answer

thank you, dad 14. I’ve seen everything that starts at startup... but what do I do now? (couldn’t copy-paste it).....

papa 14 · Answer

No, uncheck the programs that you don't need at startup, then restart normally; that should help you. Be careful not to touch the Windows or System32 programs.

kirabelle · Answer

For Billmaxime  Malwarebytes Anti-Malware (Trial) 1.70.0.1100 www.malwarebytes.org  Database version: v2013.03.16.07  Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 nico :: PC-DE-NICO [administrator]  Protection: Enabled  16/03/2013 14:35:25 MALWAREBYTES-MBAM-log-2013-03-16 (17-43-58).txt  Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|H:\|I:\|) Scan options enabled: Memory | Boot | Registry | File system | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Object(s) analyzed: 417965 Elapsed time: 2 hour(s), 20 minute(s), 57 second(s)  Memory process detected: 1 C:\ProgramData\IBUpdaterService\ibsvc.exe (PUP.InstallBrain) -> 276 -> No action taken.  Memory module detected: 0 (No malicious items detected)  Registry key detected: 15 HKCR\CLSID\{11111111-1111-1111-1111-110011501160} (PUP.CrossRider.SSK) -> No action taken. HKCR\TypeLib\{44444444-4444-4444-4444-440044504460} (PUP.CrossRider.SSK) -> No action taken. HKCR\Interface\{55555555-5555-5555-5555-550055505560} (PUP.CrossRider.SSK) -> No action taken. HKCR\CrossriderApp0005060.BHO.1 (PUP.CrossRider.SSK) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110011501160} (PUP.CrossRider.SSK) -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110011501160} (PUP.CrossRider.SSK) -> No action taken. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110011501160} (PUP.CrossRider.SSK) -> No action taken. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011501160} (PUP.CrossRider.SSK) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011501160} (PUP.CrossRider.SSK) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PricePeep (Adware.Shopper) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Savings Sidekick (PUP.CrossRider.SSK) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCTuto_is1 (Trojan.Eorezo) -> No action taken. HKLM\SYSTEM\CurrentControlSet\Services\IBUpdaterService (PUP.InstallBrain) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Updater Service (PUP.InstallBrain) -> No action taken. HKCU\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\215 APPS (PUP.CrossFire.SA) -> No action taken.  Registry value detected: 1 HKCU\Software\InstalledBrowserExtensions\215 Apps|5060 (PUP.CrossFire.SA) -> Data: Savings Sidekick -> No action taken.  Data item(s) in the Registry detected: 0 (No harmful items detected)  Folder(s) detected: 9 C:\Program Files\Agency-Exclusive (Trojan.Eorezo) -> No action taken. C:\Users
ico\AppData\Roaming\Agency-Exclusive\Agency-Exclusive (PUP.Tuto4PC) -> No action taken. C:\Users
ico\AppData\Roaming\Agency-Exclusive\Agency-Exclusive\Download (PUP.Tuto4PC) -> No action taken. C:\Users
ico\AppData\Roaming\Agency-Exclusive\Agency-Exclusive\Software (PUP.Tuto4PC) -> No action taken. C:\ProgramData\IBUpdaterService (PUP.InstallBrain) -> No action taken. C:\Program Files\Savings Sidekick (PUP.CrossRider.SSK) -> No action taken. C:\Program Files\RelevantKnowledge (PUP.Spyware.MarketScore) -> No action taken. C:\Program Files\RelevantKnowledge\components (PUP.Spyware.MarketScore) -> No action taken. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge (PUP.Spyware.MarketScore) -> No action taken.  File(s) detected: 43 C:\Program Files\Savings Sidekick\Savings Sidekick.dll (PUP.CrossRider.SSK) -> No action taken. C:\Program Files\PricePeep\uninstall.exe (Adware.Shopper) -> No action taken. C:\Program Files\RelevantKnowledgells.dll (PUP.Adware.RelevantKnowledge) -> No action taken. C:\Program Files\RelevantKnowledgells64.dll (PUP.Adware.RelevantKnowledge) -> No action taken. C:\Program Files\RelevantKnowledgelph.dll (PUP.Adware.RelevantKnowledge) -> No action taken. C:\Program Files\RelevantKnowledgelvknlg64.exe (PUP.Adware.RelevantKnowledge) -> No action taken. C:\Program Files\RelevantKnowledgelxf.dll (PUP.Adware.RelevantKnowledge) -> No action taken. C:\Program Files\RelevantKnowledge\componentslxg.dll (PUP.Adware.RelevantKnowledge) -> No action taken. C:\Program Files\RelevantKnowledge\componentslxh.dll (PUP.Adware.RelevantKnowledge) -> No action taken. C:\Program Files\RelevantKnowledge\componentslxi.dll (PUP.Adware.RelevantKnowledge) -> No action taken. C:\Program Files\RelevantKnowledge\componentslxj.dll (PUP.Adware.RelevantKnowledge) -> No action taken. C:\Program Files\RelevantKnowledge\componentslxk.dll (PUP.Adware.RelevantKnowledge) -> No action taken. C:\Program Files\Savings Sidekick\Savings Sidekick-bg.exe (PUP.CrossRider.SSK) -> No action taken. C:\Program Files\Savings Sidekick\Savings Sidekick.exe (PUP.CrossRider.SSK) -> No action taken. C:\Program Files\Savings Sidekick\Uninstall.exe (PUP.CrossRider.SSK) -> No action taken. C:\Users
ico\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle\1.3.331.4_0\pluginslcm.dll (PUP.Adware.RelevantKnowledge) -> No action taken. C:\Users
ico\AppData\Roaming\Agency-Exclusive\Agency-Exclusive\UpdatePCTuto.exe (PUP.Tuto4PC) -> No action taken. C:\Program Files\Agency-Exclusive\ConfMedia.cyp (Trojan.Eorezo) -> No action taken. C:\Program Files\Agency-Exclusive\unins000.dat (Trojan.Eorezo) -> No action taken. C:\Program Files\Agency-Exclusive\unins000.exe (Trojan.Eorezo) -> No action taken. C:\Users
ico\AppData\Roaming\Agency-Exclusive\Agency-Exclusive\user_config.cyp (PUP.Tuto4PC) -> No action taken. C:\Users
ico\AppData\Roaming\Agency-Exclusive\Agency-Exclusive\help_config.cyp (PUP.Tuto4PC) -> No action taken. C:\Users
ico\AppData\Roaming\Agency-Exclusive\Agency-Exclusive\shared.cyp (PUP.Tuto4PC) -> No action taken. C:\Users
ico\AppData\Roaming\Agency-Exclusive\Agency-Exclusive\user_profil.cyp (PUP.Tuto4PC) -> No action taken. C:\ProgramData\IBUpdaterService\ibsvc.exe (PUP.InstallBrain) -> No action taken. C:\ProgramData\IBUpdaterServiceepository.xml (PUP.InstallBrain) -> No action taken. C:\Program Files\Savings Sidekick\Savings SidekickInstaller.log (PUP.CrossRider.SSK) -> No action taken. C:\Program Files\Savings Sidekick\ButtonUtil.dll (PUP.CrossRider.SSK) -> No action taken. C:\Program Files\Savings Sidekick\Savings Sidekick.ico (PUP.CrossRider.SSK) -> No action taken. C:\Program Files\Savings Sidekick\Savings Sidekick.ini (PUP.CrossRider.SSK) -> No action taken. C:\Users
ico\Local Settings\Application Data\Savings Sidekick\Chrome\Savings Sidekick.crx (PUP.CrossRider.SSK) -> No action taken. C:\Users
ico\AppData\Local\Savings Sidekick\Chrome\Savings Sidekick.crx (PUP.CrossRider.SSK) -> No action taken. C:\Program Files\RelevantKnowledge\chrome.manifest (PUP.Spyware.MarketScore) -> No action taken. C:\Program Files\RelevantKnowledge\install.rdf (PUP.Spyware.MarketScore) -> No action taken. C:\Program Files\RelevantKnowledge
cncf.dat (PUP.Spyware.MarketScore) -> No action taken. C:\Program Files\RelevantKnowledge
scf.dat (PUP.Spyware.MarketScore) -> No action taken. C:\Program Files\RelevantKnowledgelcm.crx (PUP.Spyware.MarketScore) -> No action taken. C:\Program Files\RelevantKnowledgelcm.txt (PUP.Spyware.MarketScore) -> No action taken. C:\Program Files\RelevantKnowledgeloci.bin (PUP.Spyware.MarketScore) -> No action taken. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\About RelevantKnowledge.lnk (PUP.Spyware.MarketScore) -> No action taken. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Privacy Policy and User License Agreement.lnk (PUP.Spyware.MarketScore) -> No action taken. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Support.lnk (PUP.Spyware.MarketScore) -> No action taken. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Uninstall Instructions.lnk (PUP.Spyware.MarketScore) -> No action taken.  (end)

billmaxime · Answer

hi kirabelle  you didn’t remove everything MBAM found (no action taken)  look at this IMAGE for the procedure  i recommend you to restart the scan and delete what MBAM finds  ps: make sure everything is checked before deleting  see you

kirabelle · Answer

Hi bilmaxime, I didn’t do anything because in the Malwarebytes tutorial they say to show the report to someone competent before removing anything. I kept the analysis, so I’m going to delete everything. Thanks

billmaxime · Answer

Hi Kirabelle  How is the PC doing since MBAM found and removed what it did?  See you later

kirabelle · Answer

Well, exactly, I meant to say that things aren’t getting better! My PC is clean (I suppose), but it’s still slow and I still have problems with typing... I don’t know what to do anymore...

billmaxime · Answer

create me a zhpdiag (diagnostic tool)

download zhpdiag onto your desktop

the link https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/

run it as administrator (right-click)

to start the scan, click on the 2nd button from the left (the one with the +)

the report will appear on your desktop and in C:\zhpdiag.txt

post the report via this link https://www.cjoint.com/

@+

billmaxime · Answer

re

it's not normal, tell me if you have any trouble downloading other software

see you

billmaxime · Answer

re  and did you try downloading zhpdiag again?  See you later

billmaxime · Answer

re  try this site  https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/  @+

kirabelle · Answer

Alleluia! voici le lien de mon scan ZHPDiag! ! ! merci  http://cjoint.com/?CCrsnvXqDIj

billmaxime · Answer

re  tell me if you are there  @+

billmaxime · Answer

re  it's normal, your PC is loaded with adware and toolbars  i want to run adwcleaner on you, but since you have antivir as antivirus  i would like to know if you plan to keep it or replace it with another one  ps: personally i recommend avast8  i await your reply  @+

kirabelle · Answer

I’m open to switching antivirus if you think Avast8 is better than Avira and provided that it’s free...

billmaxime · Answer

yes it is free and it is better than Avira (follow the instructions carefully) you will uninstall Avira with this link https://www.commentcamarche.net/faq/7367-desinstaller-proprement-liens-et-astuces#avira-antivir on the page, when you click to download the uninstall tool, you will choose "avira registry cleaner" (to download) ------------------------------------------------------------------------------------------ then download adwcleaner to your desktop the link https://www.commentcamarche.net/telecharger/securite/2759-adwcleaner/ ps: once you have downloaded adwcleaner, restart your PC and tap the F8 key to access Safe Mode (the PC will be slower)  SAFE MODE run it as administrator (right-click) choose the mode removal the report will appear on your desktop and in C:\adw[S1].txt post the report via this link https://www.cjoint.com/ if you have questions... see you @+

billmaxime · Answer

no problem ^^

billmaxime · Answer

re  for the report it’s in C:\adw[S1].txt  you’ll still need to include avast as well and there are still some things to uninstall  see you later

kirabelle · Answer

Thank you, but I don’t know how to find C:\adw[S1].txt? and on the desktop I don’t see any report.....  As I noted earlier, I installed AVAST8. They tell me that I have it free for only 30 days and afterward I’ll need to sign up.......will I have to pay then?  One last question: Avast offers updates ............is it necessary to accept them? Thanks again for everything, you saved me.....

billmaxime · Answer

take it easy...

did you download Avast from Avast's site?

did you uncheck the Google toolbar that's offered?  
-----------------------------------------------------------------

to confirm your Avast registration, right-click the Avast “shield” in the taskbar and choose “Open Avast user interface”

in the page that opens, click on “Maintenance” then “Registration”

and you’ll be set for 365 days  
-------------------------------------------------------------------------------

to update Avast, in “Maintenance” click on Updates, then Update the program  
----------------------------------------------------------------------------------

to find the AdwCleaner report in C:\

click Start > Computer > C:\ (the report is there)

waiting for your reply

see you later

billmaxime · Answer

you must uninstall this Adobe Reader X (10.1.1) and download the latest version here  here https://get2.adobe.com/fr/reader/otherversions/  ps: don't forget to uncheck McAfee  same for this Java(TM) 6 Update 22  Java(TM) 6 Update 29  and download the latest version here https://www.java.com/fr/  see you later

kirabelle · Answer

Thank you Billmaxime!  I did everything you told me. Everything went very well! and my computer is running like in the good old days! I thank you for your patience and professionalism, thankfully this forum exists and there are people like you (or you) to help people who, like me, know nothing or not much, because it's not easy at all this stuff....... Thanks again!

billmaxime · Answer

Hi Kirabelle

I'm far from being a pro, but your thanks make me happy.

That said, it's not over... so if you swing by this topic again, send me a message.

See you later

kirabelle · Answer

Hi,

Here is today’s report:

http://cjoint.com/?CCttqR8ukYd

See you later

billmaxime · Answer

hi kirabelle,  i’ll start with this (http://www.goforfiles.com/  you should find your happiness there, but not only that!!!  i downloaded it and started the installation.... oh dear, i don’t know if you took the  time to read this http://www.goforfiles.com/terms  if you click to launch the software and you accept the "terms" without reading what it’s about (you’re screwed)  there is 1 pre-checked box that authorizes putting the software in the "exceptions" of the  firewall (so your firewall stops doing its job)  i quoted 2 lines in the "warning"  GoforFiles does not guarantee that media downloaded from the Internet will be spyware-free, virus-free, malware  GoforFiles does not guarantee that the media you download will not damage your computer  same for C:\Program Files\eMule\emule.exe (P2P= often infections)  same for C:\Program Files\PlayerPlus\playerplus.exe  the analysis was done 9 months ago by virustotal and the result isn’t nice  Date of analysis: 2012-05-31 15:01:34 UTC (9 months, 3 weeks ago) https://www.virustotal.com/gui/file/74461cd68eeb147415c70630eddeb77c7fa284a363e9f77a37654ef4bb2d4e96  same for C:\Users
ico\AppData\Local\{73E50B0C-DB06-5CD0-92D7-4F7572453A52}\syshost.exe  read this https://www.processlibrary.com/fr/directory/files/syshost/23702/  you can uninstall this (the proof is that your PC is infected)  O42 - Software: Microsoft Antimalware Service FR-FR Language Pack - (.Microsoft Corporation.) [HKLM] -- {32E9C1A5-0FDA-4483-987D-DBABF9CC1DD8}   when you’ve done all this, send me 1 message for the next steps  good night  @+

kirabelle · Answer

Hello, I just read your message, but I don’t understand anything...... Okay, my PC is infected despite all the scans I’ve done! You tell me: ""you can uninstall this (the proof is that your PC is infected)  O42 - Software: Microsoft Antimalware Service FR-FR Language Pack - (.Microsoft Corporation.) [HKLM] -- {32E9C1A5-0FDA-4483-987D-DBABF9CC1DD8}"   yes, but what exactly should I uninstall? ? ? ? ? ? HELP ?

billmaxime · Answer

hi kirabelle  the infections will return if you do not uninstall these programs  uninstall these programs via "Programs and Features" in the Control Panel  Microsoft Antimalware goforfiles eMule PlayerPlus ------------------------------------------------------------------------------------------ when it's done, run CCleaner (Cleaner + Registry)  do it until it finds nothing ------------------------------------------------------------------------------------------- do a full scan again (all drives) with MBAM and delete everything it finds  ps: before the scan be sure to update it (3rd button)  post the report via 1 copy/paste  let me know when it's done  @+

kirabelle · Answer

I’ll do all that tomorrow evening... good night

billmaxime · Answer

Hi Kirabelle,  okay, and send 1 message when everything is done  have a good evening/night  see you later

kirabelle · Answer

I wanted to remove everything you told me, but I could only find and uninstall the following: - goforfiles (deleted) - playerPlus (deleted) - Emule was already removed a while ago - Microsoft Antimalware? I don’t see it. There is only this:  - Malwarebytes AntiMalware  - Microsoft-NET Framework 3.5 SP1  - Microsoft-NET Framework 4 Client Profile  - Microsoft Silverlight  - Microsoft SQM Server Compact 3.5 SP2 ENU  - Microsoft Visual C++ 2005 Redistributable  - Microsoft Visual C++ 2008 Redistributable-x86 9.0.2  - Microsoft Visual C++ 2008 Redistributable-x86 9.0.3  - Microsoft Visual C++ 2010 x86 9.0.2 Redistributable-10.0  what should I do?

billmaxime · Answer

hi kirabelle  you don’t touch any of this  Microsoft Antimalware? I don’t see it. There’s only this: -Malwarebytes AntiMalware -Microsoft-NET Framework 3.5 SP1 -Microsoft-NET Framework 4 Client Profile -Microsoft Silverlight -Microsoft SQM Server Compact 3.5 SP2 ENU -Microsoft Visual C++ 2005 Redistributable -Microsoft Visual C++ 2008 Redistributable-x86 9.0.2 -Microsoft Visual C++ 2008 Redistributable-x86 9.0.3 -Microsoft Visual C++ 2010 x86 9.0.2 Redistributable-10.0   you also asked me to run a full scan with MBAM when you had  removed what I asked you to  so, with the software removals done, run the scan with MBAM  thanks  see you later

kirabelle · Answer

Here is the scan MBAM:  https://www.cjoint.com/c/CCxoltuR1b6 @ +

billmaxime · Answer

Hi Kirabelle  the MBAM report is clean  can you redo one zhpdiag for me  see you later

kirabelle · Answer

and here is the ZHPDIAG report:  https://www.cjoint.com/c/CCxqsosGkEs

billmaxime · Answer

hi kirabelle  do this now  download purera to your desktop  the link https://www.commentcamarche.net/telecharger/utilitaires/18611-purera/  the configuration https://www.cjoint.com/c/CCxr5oR9p18  run it as administrator (right click)  post only the last line (total space cleaned Mo)  see you later

billmaxime · Answer

re kirabelle

leave purera aside for the moment and do this

launch zhpfix as administrator (right click)

copy all bold text below

click on the 2nd button at the top left (paste from clipboard)

click on GO at the bottom of the page and confirm by yes to start cleaning the data

the report will appear on your desktop and in C:\zhpfix.txt

post the report via this link https://www.cjoint.com/

the text to copy

SysRestore

R3 - URLSearchHook: (no name) - {590ee40d-ab7d-4ed9-b49c-3cc11ad38edf} . (.Google Inc. - Google Update.) (No version) -- (.not file.)
R3 - URLSearchHook: (no name) - {09a07b02-f491-4b6b-bfc9-684a624f4f3b} . (.Google Inc. - Google Update.) (No version) -- (.not file.)
R3 - URLSearchHook: (no name) - {cfcb809c-3a22-4616-a916-6c007bd9d920} . (.Google Inc. - Google Update.) (No version) -- (.not file.)
R3 - URLSearchHook: (no name) - {0696f815-a3a9-490a-bb14-9ec3350b1276} . (.Google Inc. - Google Update.) (No version) -- (.not file.)
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Google Inc. - Google Update.) (No version) -- (.not file.)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} . (.Google Inc. - Google Toolbar.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKCU\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [syshost32] C:\Users
ico\AppData\Local\{73E50B0C-DB06-5CD0-92D7-4F7572453A52}\syshost.exe (.not file.)
O4 - HKUS\S-1-5-21-2084289949-3729338263-3237244158-1000\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-21-2084289949-3729338263-3237244158-1000\..\Run: [syshost32] C:\Users
ico\AppData\Local\{73E50B0C-DB06-5CD0-92D7-4F7572453A52}\syshost.exe (.not file.)
O4 - GS\QuickLaunch: eMule (2).lnk . (...) -- C:\Program Files\eMule\emule.exe (.not file.)
O4 - GS\QuickLaunch: eMule.lnk . (...) -- C:\Program Files\eMule\emule.exe (.not file.)
O4 - GS\Desktop: 7-Zip - Raccourci.lnk - Clé orpheline
O4 - GS\Desktop: Avira - Raccourci.lnk - Clé orpheline
O4 - GS\Desktop: eMule.lnk . (...) -- C:\Program Files\eMule\emule.exe (.not file.)
O4 - GS\Desktop: Incoming - Raccourci.lnk . (...) -- C:\Users
ico\Downloads\eMule\Incoming
O4 - GS\Desktop: Panneau de configuration - Raccourci.lnk - Clé orpheline
O23 - Service: Web Assistant (Web Assistant) . (...) - C:\Program Files\Web Assistant\ExtensionUpdaterService.exe (.not file.)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\DriverScanner.job [326]
[MD5.00000000000000000000000000000000] [APT] [DriverScanner] (...) -- C:\Program Files\Uniblue\DriverScanner\dsmonitor.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [GoforFilesUpdate] (...) -- C:\Program Files\GoforFiles\GFFUpdater.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{6EE3408F-7BD1-42EE-B1FB-A75B6EEF2AB8}] (...) -- D:\setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{8EC9E9D9-B543-4E37-B676-FE92A313A15D}] (...) -- C:\Users
ico\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NADME3LQ\avira_antivir_personal_fr.exe (.not file.) [0]
O42 - Logiciel: Google Toolbar for Internet Explorer - (.Google Inc..) [HKLM] -- {18455581-E099-4BA8-BC6B-F34B2F06600C}
O42 - Logiciel: Google Toolbar for Internet Explorer - (.Google Inc..) [HKLM] -- {2318C2B1-4965-11d4-9B18-009027A5CD4F}
O42 - Logiciel: Microsoft Antimalware Service FR-FR Language Pack - (.Microsoft Corporation.) [HKLM] -- {32E9C1A5-0FDA-4483-987D-DBABF9CC1DD8}
[HKCU\Software\GoforFiles]
[HKCU\Software\fAfvfSfP [fVf#f" fEfBfU [fh'Å ¶ ¬'³'ê'½f [fJf< fAfvfSfP [fVf#f"]]
[HKLM\Software\Bunndle]
[HKLM\Software\GoforFiles]
[HKLM\Software\IncrediMail]
[HKLM\Software\Uniblue]
O43 - CFD: 15/03/2013 - 22:20:55 - [0] ----D C:\ProgramData\eMule
O43 - CFD: 04/12/2011 - 15:58:35 - [0] ----D C:\ProgramData\Uniblue
O43 - CFD: 13/03/2013 - 17:15:30 - [0,001] ----D C:\Users
ico\AppData\Roaming\GoforFiles
O43 - CFD: 10/09/2012 - 17:18:57 - [1,674] ----D C:\Users
ico\AppData\Roaming\uTorrent
O43 - CFD: 15/03/2013 - 22:20:56 - [0] ----D C:\Users
ico\AppData\Local\eMule
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {0FCD9A10-1D09-44A5-81B5-210B5498CEDE} - (FileConverter 1.5 Customized Web Search) - http://search.conduit.com
O69 - SBI: SearchScopes [HKCU] {5820DC08-C7F6-42AC-A204-593AAD05EB5B} - (Ask Search) - http://www.search.ask.com/?o=10148&l=dis
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {9D5BD211-422C-4164-9298-BB4186A30F31} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {a5b9c0f5-5616-47cd-a95f-e43b488faccf} - (My Web Search) - https://hp.mywebsearch.com/mywebsearch/index.html
[MD5.B28C334C03CEE7C5E829C43AE75DAE5A] [SPRF][28/01/2013] (.Ask.com - AskIC Dynamic Link Library.) -- C:\Users
ico\AppData\Local\Temp\AskSLib.dll [248008]
[MD5.6DA49B8F484EC3097F65C37F31C3FCE5] [SPRF][13/03/2013] (. - GoforFiles.) -- C:\Users
ico\AppData\Local\Temp\uninstall5576099.exe [6375560]
[MD5.20362D635A0DE200A963BD634153312D] [SPRF][13/03/2013] (. - GoforFiles Application.) -- C:\Users
ico\AppData\Local\Temp\uninstall5586645.exe [901712]
O87 - FAEL: "TCP Query User{CB6FC360-0698-4942-8051-3E9B28C20C9D}C:\program files\emule\emule.exe" |In - Public - P6 - TRUE | .(...) -- C:\program files\emule\emule.exe (.not file.)
O87 - FAEL: "UDP Query User{A02E79E2-1AAA-4115-83D3-2C6E51B4E921}C:\program files\emule\emule.exe" |In - Public - P17 - TRUE | .(...) -- C:\program files\emule\emule.exe (.not file.)
O87 - FAEL: "{3A520E64-754E-45A8-95AE-CB08D020E054}" |In - Public - P6 - TRUE | .(...) -- C:\Program Files\GoforFiles\goforfilesdl.exe (.not file.)
O87 - FAEL: "{0C06868B-31AF-43BA-8853-A506CC0945CB}" |In - Public - P17 - TRUE | .(...) -- C:\Program Files\GoforFiles\goforfilesdl.exe (.not file.)
O87 - FAEL: "{41F3D9F0-D8F1-4E71-BD4A-CD62B6229F51}" |In - Public - P6 - TRUE | .(...) -- C:\Program Files\GoforFiles\GoforFiles.exe (.not file.)
O87 - FAEL: "{F56BFB81-1373-4163-84D2-24D9136F0D32}" |In - Public - P17 - TRUE | .(...) -- C:\Program Files\GoforFiles\GoforFiles.exe (.not file.)
[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110011501160}] =>PUP.SpecialSavings
[HKCU\Software\AppDataLow\Software\FileConverter_1.5] =>Toolbar.Agent
[HKCU\Software\AppDataLow\Software\TelevisionFanatic] =>Adware.MyWebSearch
[HKLM\Software\TelevisionFanatic] =>Adware.MyWebSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\TelevisionFanaticbar Uninstall] =>Adware.MyWebSearch
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] =>Toolbar.Bing
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] =>Toolbar.Bing
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{0A9893CE-951C-4CD0-A31C-84CCDD7A0077}_is1] =>Adware.SocialSkinz
[HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks]:{0696F815-A3A9-490A-BB14-9EC3350B1276} =>Adware.MyWebSearch
[HKLM\Software\Mozilla\Firefox\Extensions]:64ffxtbr@TelevisionFanatic.com =>Adware.MyWebSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]:TelevisionFanatic Browser Plugin Loader =>Adware.MyWebSearch
C:\Users
ico\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok =>Adware.PriceGong
C:\Users
ico\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlfienamagdnkekbbbocojppncdambda =>Adware.PredictAd
C:\Users
ico\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle =>Adware.RelevantKnowledge

FirewallRAZ
EmptyCLSID
EmptyTemp
EmptyFlash

@+

kirabelle · Answer

I can’t see the "GO" at the bottom where I’m supposed to click...

billmaxime · Answer

hi kirabelle  if you don't see the GO, it's because your text isn't "pasted"  on the zhpfix page  see you later

kirabelle · Answer

Sorry, but I don’t understand what you’re telling me: "if you don’t see the GO, it means your text isn’t "coller"  on the zhpfix page"

billmaxime · Answer

Hello Kirabelle

Make sure you launch zhpfix (the syringe icon)

Run it as administrator (right-click)

Copy all the bold text below, then click on the 2nd button at the top left (paste clipboard)

When done, click GO at the bottom of the page, then confirm by "yes" you confirm the cleaning of data

The report will appear on your desktop and in C:\zhpfix.txt

Post the report via this link
https://www.cjoint.com/

the text to copy

SysRestore

R3 - URLSearchHook: (no name) - {590ee40d-ab7d-4ed9-b49c-3cc11ad38edf} . (.Google Inc. - Google Update.) (No version) -- (.not file.)
R3 - URLSearchHook: (no name) - {09a07b02-f491-4b6b-bfc9-684a624f4f3b} . (.Google Inc. - Google Update.) (No version) -- (.not file.)
R3 - URLSearchHook: (no name) - {cfcb809c-3a22-4616-a916-6c007bd9d920} . (.Google Inc. - Google Update.) (No version) -- (.not file.)
R3 - URLSearchHook: (no name) - {0696f815-a3a9-490a-bb14-9ec3350b1276} . (.Google Inc. - Google Update.) (No version) -- (.not file.)
R3 - Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Google Inc. - Google Update.) (No version) -- (.not file.)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} . (.Google Inc. - Google Toolbar.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKCU\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [syshost32] C:\Users
ico\AppData\Local\{73E50B0C-DB06-5CD0-92D7-4F7572453A52}\syshost.exe (.not file.)
O4 - HKUS\S-1-5-21-2084289949-3729338263-3237244158-1000\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-21-2084289949-3729338263-3237244158-1000\..\Run: [syshost32] C:\Users
ico\AppData\Local\{73E50B0C-DB06-5CD0-92D7-4F7572453A52}\syshost.exe (.not file.)
O4 - GS\QuickLaunch: eMule (2).lnk . (...) -- C:\Program Files\eMule\emule.exe (.not file.)
O4 - GS\QuickLaunch: eMule.lnk . (...) -- C:\Program Files\eMule\emule.exe (.not file.)
O4 - GS\Desktop: 7-Zip - Raccourci.lnk - Clé orpheline
O4 - GS\Desktop: Avira - Raccourci.lnk - Clé orpheline
O4 - GS\Desktop: eMule.lnk . (...) -- C:\Program Files\eMule\emule.exe (.not file.)
O4 - GS\Desktop: Incoming - Raccourci.lnk . (...) -- C:\Users
ico\Downloads\eMule\Incoming
O4 - GS\Desktop: Panneau de configuration - Raccourci.lnk - Clé orpheline
O23 - Service: Web Assistant (Web Assistant) . (...) - C:\Program Files\Web Assistant\ExtensionUpdaterService.exe (.not file.)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\DriverScanner.job [326]
[MD5.00000000000000000000000000000000] [APT] [DriverScanner] (...) -- C:\Program Files\Uniblue\DriverScanner\dsmonitor.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [GoforFilesUpdate] (...) -- C:\Program Files\GoforFiles\GFFUpdater.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{6EE3408F-7BD1-42EE-B1FB-A75B6EEF2AB8}] (...) -- D:\setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{8EC9E9D9-B543-4E37-B676-FE92A313A15D}] (...) -- C:\Users
ico\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NADME3LQ\avira_antivir_personal_fr.exe (.not file.) [0]
O42 - Software: Google Toolbar for Internet Explorer - (.Google Inc..) [HKLM] -- {18455581-E099-4BA8-BC6B-F34B2F06600C}
O42 - Software: Google Toolbar for Internet Explorer - (.Google Inc..) [HKLM] -- {2318C2B1-4965-11d4-9B18-009027A5CD4F}
O42 - Software: Microsoft Antimalware Service FR-FR Language Pack - (.Microsoft Corporation.) [HKLM] -- {32E9C1A5-0FDA-4483-987D-DBABF9CC1DD8}
[HKCU\Software\GoforFiles]
[HKCU\Software\fAfvfSfP [fVf#f" fEfBfU [fh'Å ¶ ¬'³'ê'½f [fJf< fAfvfSfP [fVf#f"]]
[HKLM\Software\Bunndle]
[HKLM\Software\GoforFiles]
[HKLM\Software\IncrediMail]
[HKLM\Software\Uniblue]
O43 - CFD: 15/03/2013 - 22:20:55 - [0] ----D C:\ProgramData\eMule
O43 - CFD: 04/12/2011 - 15:58:35 - [0] ----D C:\ProgramData\Uniblue
O43 - CFD: 13/03/2013 - 17:15:30 - [0,001] ----D C:\Users
ico\AppData\Roaming\GoforFiles
O43 - CFD: 10/09/2012 - 17:18:57 - [1,674] ----D C:\Users
ico\AppData\Roaming\uTorrent
O43 - CFD: 15/03/2013 - 22:20:56 - [0] ----D C:\Users
ico\AppData\Local\eMule
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {0FCD9A10-1D09-44A5-81B5-210B5498CEDE} - (FileConverter 1.5 Customized Web Search) - http://search.conduit.com
O69 - SBI: SearchScopes [HKCU] {5820DC08-C7F6-42AC-A204-593AAD05EB5B} - (Ask Search) - http://www.search.ask.com/?o=10148&l=dis
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {9D5BD211-422C-4164-9298-BB4186A30F31} - (Bing) - https://www.bing.com/?toHttps=1&redig=69DA0EF8272048D9864AF4DB37211DE8
O69 - SBI: SearchScopes [HKCU] {a5b9c0f5-5616-47cd-a95f-e43b488faccf} - (My Web Search) - https://hp.mywebsearch.com/mywebsearch/index.html
[MD5.B28C334C03CEE7C5E829C43AE75DAE5A] [SPRF][28/01/2013] (.Ask.com - AskIC Dynamic Link Library.) -- C:\Users
ico\AppData\Local\Temp\AskSLib.dll [248008]
[MD5.6DA49B8F484EC3097F65C37F31C3FCE5] [SPRF][13/03/2013] (.http://www.goforfiles.com/ - GoforFiles.) -- C:\Users
ico\AppData\Local\Temp\uninstall5576099.exe [6375560]
[MD5.20362D635A0DE200A963BD634153312D] [SPRF][13/03/2013] (.http://goforfiles.com/ - GoforFiles Application.) -- C:\Users
ico\AppData\Local\Temp\uninstall5586645.exe [901712]
O87 - FAEL: "TCP Query User{CB6FC360-0698-4942-8051-3E9B28C20C9D}C:\program files\emule\emule.exe" |In - Public - P6 - TRUE | .(...) -- C:\program files\emule\emule.exe (.not file.)
O87 - FAEL: "UDP Query User{A02E79E2-1AAA-4115-83D3-2C6E51B4E921}C:\program files\emule\emule.exe" |In - Public - P17 - TRUE | .(...) -- C:\program files\emule\emule.exe (.not file.)
O87 - FAEL: "{3A520E64-754E-45A8-95AE-CB08D020E054}" |In - Public - P6 - TRUE | .(...) -- C:\Program Files\GoforFiles\goforfilesdl.exe (.not file.)
O87 - FAEL: "{0C06868B-31AF-43BA-8853-A506CC0945CB}" |In - Public - P17 - TRUE | .(...) -- C:\Program Files\GoforFiles\goforfilesdl.exe (.not file.)
O87 - FAEL: "{41F3D9F0-D8F1-4E71-BD4A-CD62B6229F51}" |In - Public - P6 - TRUE | .(...) -- C:\Program Files\GoforFiles\GoforFiles.exe (.not file.)
O87 - FAEL: "{F56BFB81-1373-4163-84D2-24D9136F0D32}" |In - Public - P17 - TRUE | .(...) -- C:\Program Files\GoforFiles\GoforFiles.exe (.not file.)
[HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110011501160}] => PUP.SpecialSavings
[HKCU\Software\AppDataLow\Software\FileConverter_1.5] => Toolbar.Agent
[HKCU\Software\AppDataLow\Software\TelevisionFanatic] => Adware.MyWebSearch
[HKLM\Software\TelevisionFanatic] => Adware.MyWebSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\TelevisionFanaticbar Uninstall] => Adware.MyWebSearch
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] => Toolbar.Bing
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] => Toolbar.Bing
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{0A9893CE-951C-4CD0-A31C-84CCDD7A0077}_is1] => Adware.SocialSkinz
[HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks]:{0696F815-A3A9-490A-BB14-9EC3350B1276} => Adware.MyWebSearch
[HKLM\Software\Mozilla\Firefox\Extensions]:64ffxtbr@TelevisionFanatic.com => Adware.MyWebSearch
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]:TelevisionFanatic Browser Plugin Loader => Adware.MyWebSearch
C:\Users
ico\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok => Adware.PriceGong
C:\Users
ico\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlfienamagdnkekbbbocojppncdambda => Adware.PredictAd
C:\Users
ico\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle => Adware.RelevantKnowledge

FirewallRAZ
EmptyCLSID
EmptyTemp
EmptyFlash

@+

kirabelle · Answer

here is the uninstallation report for zhpfix  https://www.cjoint.com/c/CCDt42Qo660

billmaxime · Answer

Hi Kirabelle,

You ran it twice (zhpfix)

C:\ZHP\ZHPFix[R1].txt - 29/03/2013 19:41:26 [5946]
C:\ZHP\ZHPFix[R2].txt - 29/03/2013 19:45:11 [5564]

but it's okay

do this now

download purera to your desktop

the link https://www.commentcamarche.net/telecharger/utilitaires/18611-purera/

the configuration https://www.cjoint.com/c/CCxr5oR9p18

run it as administrator (right-click)

post only the last line (total space cleaned Mo)

see you later

juju666 · Answer

Hi, I’m surprised that at this stage of disinfection no warning about Java has been given!  --  .::. Security Contributor .::.

billmaxime · Answer

hi juju,  in this message, i ask kirabelle to uninstall the old versions of java  and to download the latest one  https://forums.commentcamarche.net/forum/affich-27376015-pc-tres-lent-et-exploits-java?page=2#34  thanks anyway for your intervention  see you later

juju666 · Answer

I would have thought of awareness like here: https://forums.commentcamarche.net/forum/affich-27440886-virus-hadopi-soutenu-et-protege-par-avira#6 Thus also in #8  By saying to uninstall the old versions and install the new ones that does not raise awareness and in 1 month we’ll see our user again  Cheers  --  .::. Security Contributor .::.

billmaxime · Answer

re juju  i’m going to make additional Canned Speech to properly warn and alert the user who asks for help (see: raise awareness) to this kind of issue  thanks for your tips  see you later

juju666 · Answer

Experience ;)  --  .::. Security Contributor .::.

billmaxime · Answer

re juju  I have no doubt about it whatsoever (and I’m glad you’re making remarks to me)  thank you and have a good evening ;)

kirabelle · Answer

I tried to download "purera," but it’s in English and I don’t understand what they’re telling me... for example: in the first window there are options: NEXT - ABOUT - EXIT? what should I click, if I click NEXT they give me a choice: - CHECK ALL - CREATE LOY and then: CLEAN BACK and after a checkbox choice: - SQM - CEYPRNET URL CACHE - ICON CACHE.DB - THUMBNAILCACHES - SPYBOTSPD - SOFTCARE DISTRIBUTION LOG... etc... WHAT TO DO?

kirabelle · Answer

for g3n-h@ckm@n....."you must read!"

for juju666 ......."when you’ve checked the boxes you have to click on clean"

Indeed, in my previous message, I said I don’t understand English and therefore what they tell me... so, can someone tell me:
- if I should click NEXT, ABOUT or EXIT ?
- then if I should check CHECK or CREATE LOY ?
- which boxes to check to clean? ? ? ? ? ?
so, I repeat my question:
"I tried to download "purera", but it's in English and I don’t understand what they are telling me... for example:
 in the first window there are: NEXT - ABOUT - EXIT ? which one should I click,
 if I click NEXT they give me a choice:
- CHECK ALL
- CREATE LOY
and then: CLEAN
BACK
and after a checkbox choice:
-SQM
-CEYPRNET URL CACHE
-ICON CACHE.DB
-THUMBNAILCACHES
- SPYBOTSPD
-SOFTCARE DISTRIBUTION LOG....etc...
WHAT TO DO?
THANKS

billmaxime · Answer

Hi Kirabelle

You run PureRA as administrator (right-click)

In the window that opens, click “Next”

In the new window, click “Check all” and uncheck the 2 boxes

As in the image

When done, click “Clean”

Just post the last line of the report (total space cleaned)

See you soon

kirabelle · Answer

THANK YOU pure report  https://www.cjoint.com/?CDbr6yNbjd6

billmaxime · Answer

re kirabelle

download delfix to your desktop (click the green arrow)

the link http://general-changelog-team.fr/fr/downloads/viewdownload/20-outils-de-xplode/9-delfix

run it as administrator (right-click)

the box "delete disinfect tools" is checked by default

also check the boxes "reenable UAC" and "purge restore"

click "run"

the report will appear on your desktop and in C:\delfix.txt

post the report via 1 copy/paste

@+

kirabelle · Answer

RAPPORT CELFIX  # DelFix v10.1 - Report created on 2013-04-02 at 19:19:17 # Updated on 2013-02-23 by Xplode # Username: nico - PC-DE-NICO  ~ Activation of UAC ... OK  ~ Removal of disinfection tools ...  Deleted: C:\ZHP Deleted: C:\Program Files\ZHPDiag Deleted: C:\PhysicalDisk0_MBR.bin Deleted: C:\Users\Public\Desktop\MBRCheck.lnk Deleted: C:\Users\Public\Desktop\ZHPFix.lnk Deleted: HKLM\SOFTWARE\AdwCleaner Deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1  ~ Purge of system restore ...  Deleted: RP #659 [Scheduled Restore Point | 03/16/2013 16:42:45] Deleted: RP #660 [Scheduled Restore Point | 03/17/2013 11:18:23] Deleted: RP #661 [Installation avast! Free Antivirus | 03/17/2013 20:58:06] Deleted: RP #662 [Scheduled Restore Point | 03/18/2013 10:51:56] Deleted: RP #663 [Removed Adobe Reader X (10.1.1) - French. | 03/18/2013 19:32:15] Deleted: RP #664 [Removed Java(TM) 6 Update 22 | 03/18/2013 19:41:38] Deleted: RP #665 [Removed Java(TM) 6 Update 29 | 03/18/2013 19:42:44] Deleted: RP #666 [Installed Java 7 Update 17 | 03/18/2013 19:46:16] Deleted: RP #667 [Windows Update | 03/19/2013 04:10:41] Deleted: RP #668 [Scheduled Restore Point | 03/20/2013 11:22:16] Deleted: RP #669 [Scheduled Restore Point | 03/21/2013 12:02:03] Deleted: RP #670 [Windows Update | 03/22/2013 15:56:38] Deleted: RP #671 [Scheduled Restore Point | 03/23/2013 08:21:02] Deleted: RP #672 [Scheduled Restore Point | 03/23/2013 20:58:42] Deleted: RP #673 [Scheduled Restore Point | 03/24/2013 13:47:00] Deleted: RP #674 [Windows Update | 03/26/2013 17:32:31] Deleted: RP #675 [Scheduled Restore Point | 03/27/2013 07:03:11] Deleted: RP #676 [Scheduled Restore Point | 03/27/2013 23:28:48] Deleted: RP #677 [Scheduled Restore Point | 03/29/2013 05:12:41] Deleted: RP #678 [Removed Microsoft Antimalware Service FR-FR Language Pack | 03/29/2013 18:38:59] Deleted: RP #679 [Windows Update | 03/29/2013 18:39:05] Deleted: RP #681 [P | 03/29/2013 18:39:42] Deleted: RP #683 [P | 03/29/2013 18:44:50] Deleted: RP #684 [Scheduled Restore Point | 03/30/2013 13:38:32] Deleted: RP #685 [Scheduled Restore Point | 04/01/2013 10:38:11]  New restore point created!  ########## - EOF - ##########

billmaxime · Answer

translation
- You still have problems? How’s the PC doing?
- See you soon

billmaxime · Answer

Hi Gen, what do you mean by that? See you later

billmaxime · Answer

re  yes it is clear and well detailed and now the report appears again on the desktop and in C:\...  thank you

kirabelle · Answer

The PC is fine, but then, what do you think about it, is it good? yes or no?  and what should I do now?

billmaxime · Answer

re  if you have no more concerns, everything is okay for me  tell me how your pc is doing  see you soon

kirabelle · Answer

well, thanks to all of you and especially to Billmaxime, my PC is doing very well!!!
thank you to you and to this forum on which I come every time I have a problem, PC, phone or other.......
THANK YOU!

billmaxime · Answer

hi kirabelle,  since your problem is solved, you can mark your topic as resolved  https://www.commentcamarche.net/infos/25917-marquer-un-fil-de-discussion-comme-etant-resolu/  good continuation  @+

Very slow PC and Java exploits - Page 4

Transfer data to a new pc

I don’t know, i don’t understand anything, i’m 76 years old and i’m not sure

No internet connection possible

Put in the correct order

Unable to open xsl and xslx files

How to create an imail

Self-invoking js function

Access to google internet tab blocked

Very slow computer

Unusable screen