Remove the virus that converts folders into shortcuts.

Solved

karim377 Posted messages 43 Status Member -
Anonymous user - 20 Jan 2014 at 13:53

Hello,
Everyone knows about the virus that turns files into shortcuts, and there are many methods to address it, such as USBFix, Virus Shortcut remover....., this works very well, but the problem for me is that every time I plug my flash drive back into the PC, it gets infected immediately, even though it was previously vaccinated by USBFix. That said, the problem persists.
Is there a method to remove the virus from the PC?
Thank you for your responses.

8 answers

Answer 1 / 8
Anonymous user

Re

Send me a UsbFix report; thanks

See you

--
--------Security Contributor---------
We have all been beginners in something at some point.
But knowledge is the reward of diligence.
1
Answer 2 / 8
Anonymous user

Hello

Your infection is one that spreads through removable disks (USB drives, external hard drives, flash cards, etc.).
The removable disks you inserted into the computer when it was infected have been infected in turn.

Simply opening the file explorer and double-clicking on your USB drive/external hard drive will reinfect your system.
You will find an explanatory link on the propagation of these infections, how to protect yourself, etc., from these links:

https://forum.malekal.com/viewtopic.php?t=5544&start=

To remedy this:
Download and install UsbFix from El Desaparecido & g3n-h@ckm@n

http://general-changelog-team.fr/fr/outils/71-usbfix

Tutorial by Malekal_Morte if needed, thanks to him: https://www.malekal.com/usbfix-supprimer-virus-usb/

Connect your external data sources to your PC (USB drive, external hard drive, etc.) that may have been infected without opening them
*
If your antivirus displays an alert, ignore it and temporarily disable the antivirus.

* Double-click on UsbFix (for Windows Vista, Windows 7, Windows 8 users, right-click => "Run as administrator")
* Click on search.
# Let the tool work.

# Then post the UsbFix.txt report that will appear.

# Note: The UsbFix.txt report is saved at the root of the disk. (C:\UsbFix [Scan].txt)

(CTRL+A to select all, CTRL+C to copy, and CTRL+V to paste)

@+

--
--------Security Contributor---------
We have all been beginners at something at one point.
But knowledge is the reward of diligence.
0
1. karim377 Posted messages 43 Status Member
  
  Thank you for responding.
  However, I have done all this, and every time I plug in a USB key that has already been vaccinated and cleaned with USBFix into my PC, I notice that it is infected again. In short, the only thing I haven't done is post the report, which I will do in my next response. Perhaps a solution will be sent to me. Thank you very much for responding.
  
  0
2. karim377 Posted messages 43 Status Member
  
  ############################## | UsbFix V 7.079 | [Removal]
  
  User: Cellule Info (Administrator) # CELLULE-INFO
  Updated on 01/21/2012 by El Desaparecido
  Launched at 10:16:41 | 01/15/2014
  
  Website: https://www.sosvirus.net/
  Suspicious file? : http://eldesaparecido.com/upload.html
  Contact: contact@eldesaparecido.com
  
  PC: Gigabyte Technology Co., Ltd. (945PL-S3P) (X86-based PC) # Desktop Computer
  CPU: Intel(R) Pentium(R) Dual CPU E2220 @ 2.40GHz (2400)
  RAM -> [ Total: 2048 | Free: 1017 ]
  BIOS: Award Modular BIOS v6.00PG
  BOOT: Normal boot
  
  OS: Microsoft Windows 7 Professional (6.1.7601 32-Bit) # Service Pack 1
  WB: Windows Internet Explorer 9.11.9600.16476
  
  SC: Security Center Service [ Enabled ]
  WU: Windows Update Service [ Enabled ]
  AV: Kaspersky Anti-Virus [ Enabled | Updated ]
  FW: Windows FireWall Service [ Enabled ]
  
  C:\ (%systemdrive%) -> Fixed disk # 86 Go (53 Go free(s) - 62%) [] # NTFS
  D:\ -> Fixed disk # 73 Go (4 Go free(s) - 6%) [Backups] # NTFS
  E:\ -> Fixed disk # 73 Go (60 Go free(s) - 82%) [Windows 8] # NTFS
  F:\ -> CD-ROM
  G:\ -> Removable disk # 7 Go (5 Go free(s) - 68%) [ADATA UFD] # FAT32
  H:\ -> CD-ROM
  
  ################## | Active Processes |
  
  C:\Windows\system32\csrss.exe (404)
  C:\Windows\system32\wininit.exe (456)
  C:\Windows\system32\csrss.exe (476)
  C:\Windows\system32\services.exe (532)
  C:\Windows\system32\lsass.exe (548)
  C:\Windows\system32\lsm.exe (556)
  C:\Windows\system32\winlogon.exe (628)
  C:\Windows\system32\svchost.exe (728)
  C:\Windows\system32\svchost.exe (840)
  C:\Windows\System32\svchost.exe (940)
  C:\Windows\System32\svchost.exe (980)
  C:\Windows\system32\svchost.exe (1020)
  C:\Windows\system32\svchost.exe (1052)
  C:\Windows\system32\svchost.exe (1612)
  C:\Windows\system32\svchost.exe (1812)
  C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe (1916)
  C:\Windows\system32\svchost.exe (1976)
  C:\Windows\system32\Dwm.exe (2212)
  C:\Windows\System32\svchost.exe (2904)
  C:\Windows\system32\svchost.exe (3116)
  C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe (3616)
  C:\Windows\System32\svchost.exe (6056)
  C:\Windows\System32\rundll32.exe (4900)
  C:\Program Files\Windows Media Player\wmpnetwk.exe (4372)
  C:\Windows\system32\SearchIndexer.exe (1248)
  C:\Windows\System32\spoolsv.exe (5216)
  C:\Windows\system32\CNAB4RPK.EXE (3160)
  C:\Windows\Explorer.exe (3340)
  C:\Program Files\DAEMON Tools Pro\DTShellHlp.exe (3128)
  C:\Windows\system32\DllHost.exe (2804)
  C:\Windows\system32\nvvsvc.exe (668)
  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (2384)
  C:\Windows\system32\nvvsvc.exe (3868)
  C:\Windows\System32\WUDFHost.exe (3844)
  C:\Windows\system32\SearchProtocolHost.exe (4404)
  C:\Windows\system32\SearchFilterHost.exe (4544)
  c:\program files\windows defender\MpCmdRun.exe (2788)
  C:\UsbFix\Go.exe (5256)
  C:\Windows\system32\wbem\wmiprvse.exe (4308)
  
  ################## | Stopped Processes |
  
  Stopped! C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe (1916)
  Stopped! C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe (3616)
  Stopped! C:\Windows\System32\rundll32.exe (4900)
  Stopped! C:\Program Files\Windows Media Player\wmpnetwk.exe (4372)
  Stopped! C:\Windows\system32\SearchIndexer.exe (1248)
  Stopped! C:\Windows\System32\spoolsv.exe (5216)
  Stopped! C:\Windows\system32\CNAB4RPK.EXE (3160)
  Stopped! C:\Program Files\DAEMON Tools Pro\DTShellHlp.exe (3128)
  Stopped! C:\Windows\system32\DllHost.exe (2804)
  Stopped! C:\Windows\system32\nvvsvc.exe (668)
  Stopped! C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (2384)
  Stopped! C:\Windows\system32\nvvsvc.exe (3868)
  Stopped! C:\Windows\System32\WUDFHost.exe (3844)
  Stopped! C:\Windows\system32\SearchProtocolHost.exe (4404)
  Stopped! C:\Windows\system32\SearchFilterHost.exe (4544)
  Stopped! c:\program files\windows defender\MpCmdRun.exe (2788)
  
  ################## | Infectious Items |
  
  Deleted! G:\Au khelfa.lnk
  Deleted! G:\LSSAS.lnk
  Deleted! G:\Monsieur 26 10 2013.lnk
  Deleted! G:\wcyi.lnk
  Deleted! G:\Monsieur le directeur general.lnk
  Deleted! G:\oiwo.lnk
  Deleted! G:\26 10 2013.lnk
  Deleted! G:\dossier nesrine.lnk
  Deleted! G:\imdossier nesrine.lnk
  Deleted! G:\EVALUATION DES CONDITIONS D.lnk
  Deleted! G:\presentation 06-11-2013.lnk
  Deleted! G:\NoHost.lnk
  Deleted! G:\recld.lnk
  Deleted! G:\BORDEREAU D 06-11.lnk
  Deleted! G:\BORDEREAU D 07-11.lnk
  Deleted! G:\BORDEREAU Dernier 07.lnk
  Deleted! G:\1presentation 06-11-2013.lnk
  Deleted! G:\finale maitre khemkham 0711.lnk
  Deleted! G:\final BORDEREAU Dernier 0711.lnk
  Deleted! G:\finalpresentation 06-11-20131.lnk
  Deleted! G:\SikaPlan_12G_PDS.lnk
  Deleted! G:\SITE.lnk
  Deleted! G:\Entreprise des Services et Activités détancheité.lnk
  Deleted! G:\12g-15g(fr).lnk
  Deleted! G:\accessoires systemessikaplan.lnk
  Deleted! G:\BOOTEX.lnk
  Deleted! G:\rbon.lnk
  Deleted! G:\1237122_535202596550189_1609096292_n.lnk
  Deleted! G:\1235517_535092419894540_932677741_n.lnk
  Deleted! G:\ARES.lnk
  Deleted! G:\consltation ofares.lnk
  Deleted! G:\nessam.lnk
  Deleted! G:\eeov.lnk
  Deleted! G:\cv rachida.lnk
  Deleted! G:\Nouveau dossier.lnk
  Deleted! G:\AUTORUN.lnk
  Deleted! G:\Ecole de blida.lnk
  Deleted! G:\M. KHELFA.lnk
  Deleted! G:\malika.lnk
  Deleted! G:\SIKA.lnk
  Deleted! G:\sarah.lnk
  Deleted! C:\$RECYCLE.BIN\S-1-5-21-916970292-3413564281-2109517251-1000
  Deleted! D:\$RECYCLE.BIN\S-1-5-21-916970292-3413564281-2109517251-1000
  Deleted! E:\$RECYCLE.BIN\S-1-5-21-916970292-3413564281-2109517251-1000
  
  (!) Temporary files deleted.
  
  ################## | Registry |
  
  ################## | Mountpoints2 |
  
  ################## | Listing |
  
  [15/01/2014 - 10:17:37 | SHD ] C:\$Recycle.Bin
  [10/06/2009 - 22:42:20 | N | 24] C:\autoexec.bat
  [15/01/2014 - 10:09:33 | RASHD ] C:\Autorun.inf
  [18/11/2013 - 11:30:26 | D ] C:\Boot
  [26/07/2012 - 04:44:30 | RASH | 398156] C:\bootmgr
  [02/06/2012 - 15:30:55 | N | 1] C:\BOOTNXT
  [18/11/2013 - 11:30:28 | N | 8192] C:\BOOTSECT.BAK
  [10/06/2009 - 22:42:20 | N | 10] C:\config.sys
  [14/07/2009 - 05:53:55 | SHD ] C:\Documents and Settings
  [04/08/2009 - 18:06:10 | N | 171136] C:\grldr
  [15/01/2014 - 09:10:19 | ASH | 1610260480] C:\hiberfil.sys
  [18/11/2013 - 13:10:46 | D ] C:\KAV
  [18/11/2013 - 14:08:29 | RHD ] C:\MSOCache
  [15/01/2014 - 09:10:20 | ASH | 2147016704] C:\pagefile.sys
  [14/07/2009 - 03:37:05 | D ] C:\PerfLogs
  [08/01/2014 - 10:21:36 | D ] C:\Program Files
  [06/01/2014 - 10:01:17 | HD ] C:\ProgramData
  [18/11/2013 - 13:03:38 | SHD ] C:\Recovery
  [15/01/2014 - 02:53:56 | SHD ] C:\System Volume Information
  [18/11/2013 - 19:29:50 | D ] C:\Temp
  [15/01/2014 - 10:17:37 | D ] C:\UsbFix
  [15/01/2014 - 10:16:53 | A | 6870] C:\UsbFix.txt
  [15/01/2014 - 10:05:53 | N | 424451] C:\UsbFix_Upload_Me_CELLULE-INFO.zip
  [18/11/2013 - 19:29:52 | D ] C:\Users
  [30/12/2013 - 09:34:10 | D ] C:\Windows
  [18/11/2013 - 11:19:59 | D ] C:\Windows.old
  [15/01/2014 - 10:17:37 | SHD ] D:\$RECYCLE.BIN
  [15/12/2013 - 10:51:11 | D ] D:\AKROUR
  [15/01/2014 - 10:09:35 | RASHD ] D:\Autorun.inf
  [09/12/2013 - 09:05:44 | SHD ] D:\RECYCLER
  [23/12/2012 - 08:53:06 | SHD ] D:\System Volume Information
  [15/01/2014 - 10:17:37 | SHD ] E:\$RECYCLE.BIN
  [15/01/2014 - 10:09:35 | RASHD ] E:\Autorun.inf
  [17/12/2013 - 10:09:36 | D ] E:\bac 2013
  [09/12/2013 - 09:05:44 | SHD ] E:\RECYCLER
  [02/12/2013 - 14:08:16 | D ] E:\réc
  [03/12/2013 - 14:32:10 | D ] E:\rééduc
  [18/11/2013 - 11:32:20 | SHD ] E:\System Volume Information
  [04/05/2013 - 13:36:50 | D ] G:\Ecole de blida
  [20/10/2013 - 09:47:44 | N | 12828] G:\Au khelfa.docx
  [10/10/2013 - 15:29:16 | D ] G:\M. KHELFA
  [27/10/2013 - 15:29:02 | N | 18306] G:\Monsieur 26 10 2013.docx
  [14/10/2013 - 11:19:24 | N | 16119] G:\Monsieur le directeur general.docx
  [10/11/2013 - 10:53:00 | D ] G:\malika
  [03/12/2013 - 13:09:26 | D ] G:\SIKA
  [27/10/2013 - 15:53:44 | N | 18659] G:\26 10 2013.docx
  [07/11/2013 - 14:03:44 | N | 14024] G:\dossier nesrine.docx
  [07/11/2013 - 11:28:48 | N | 12664] G:\imdossier nesrine.docx
  [04/11/2013 - 14:50:36 | N | 16367] G:\EVALUATION DES CONDITIONS D.docx
  [07/11/2013 - 13:37:40 | N | 21837] G:\presentation 06-11-2013.docx
  [07/01/2014 - 13:59:44 | N | 453632] G:\NoHost.exe
  [07/11/2013 - 09:42:50 | N | 13372] G:\BORDEREAU D 06-11.docx
  [07/11/2013 - 09:43:16 | N | 13380] G:\BORDEREAU D 07-11.docx
  [10/11/2013 - 10:40:00 | N | 17978] G:\BORDEREAU Dernier 07.docx
  [07/11/2013 - 13:38:38 | N | 21913] G:\1presentation 06-11-2013.docx
  [10/11/2013 - 10:23:26 | N | 12716] G:\finale maitre khemkham 0711.docx
  [10/11/2013 - 10:42:04 | N | 17936] G:\final BORDEREAU Dernier 0711.docx
  [10/11/2013 - 10:50:16 | N | 22140] G:\finalpresentation 06-11-20131.docx
  [10/12/2013 - 11:42:36 | N | 2467799] G:\SikaPlan_12G_PDS.pdf
  [13/11/2013 - 13:33:54 | N | 10159] G:\SITE.docx
  [19/11/2013 - 09:06:18 | N | 10461] G:\???? ?????? ????? ???? ?????.docx
  [10/12/2013 - 09:16:08 | N | 842112] G:\Entreprise des Services et Activités détancheité.docx
  [10/12/2013 - 11:43:08 | N | 62560] G:\12g-15g(fr).pdf
  [10/12/2013 - 13:07:42 | N | 1983206] G:\accessoires systemessikaplan.pdf
  [16/12/2013 - 08:35:22 | N | 1558] G:\BOOTEX.LOG
  [10/12/2013 - 13:33:22 | N | 22160] G:\1237122_535202596550189_1609096292_n.jpg
  [10/12/2013 - 13:36:10 | N | 18331] G:\1235517_535092419894540_932677741_n.jpg
  [15/01/2014 - 10:00:04 | N | 27136] G:\ARES.EXE
  [18/12/2013 - 13:41:26 | N | 12712] G:\consltation ofares.docx
  [09/01/2014 - 14:40:22 | D ] G:\sarah
  [07/01/2014 - 14:07:10 | N | 13213] G:\nessam.docx
  [12/04/2012 - 00:54:14 | N | 18066] G:\cv rachida.docx
  [17/11/2013 - 07:11:30 | N | 54523] G:\IDM.vbs
  [15/01/2014 - 10:11:24 | RASHD ] G:\Autorun.inf
  [09/01/2014 - 14:45:28 | D ] G:\cv redjam
  
  ################## | Vaccine |
  
  C:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
  D:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
  E:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
  G:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
  
  0
Answer 3 / 8
Anonymous user

Re

It's normal for it to come back, you don't have the latest version of UsbFix
You have the link in this message
https://forums.commentcamarche.net/forum/affich-29534528-supprimer-le-virus-qui-transforme-les-dossiers-en-raccourcis#1

And send me a scan report

thank you

@+
--
--------Security Contributor---------
We have all been beginners at something at one time.
But knowledge is the reward of diligence.
0
1. karim377 Posted messages 43 Status Member
  
  ############################## | UsbFix V 7.161 | [Search]
  
  User: Info Cell (Administrator) # CELLULE-INFO
  Updated on 15/01/2014 by El Desaparecido - Team SosVirus
  Started at 11:20:40 | 19/01/2014
  
  Website: https://www.usbfix.net/
  Changelog: https://www.usb-antivirus.com/fr/maj/
  Support: https://www.sosvirus.net/
  Upload Malware: http://www.sosvirus.net/upload_malware.php
  Contact: https://www.usb-antivirus.com/fr/contact/
  
  PC: Gigabyte Technology Co., Ltd. (945PL-S3P)
  CPU: Intel(R) Pentium(R) Dual CPU E2220 @ 2.40GHz
  RAM -> [Total: 2048 Mo| Free: 645 Mo]
  Bios: Award Software International, Inc.
  Boot: Normal boot
  
  OS: Microsoft Windows 7 Professional (6.1.7601 32-Bit) Service Pack 1
  WB: Windows Internet Explorer: 11.0.9600.16476
  
  SC: Security Center Service [Enabled]
  WU: Windows Update Service [Enabled]
  AS: Windows Defender: 6.1.7600.16385 (win7_rtm.090713-1255)
  FW: Windows Firewall Service [Enabled]
  
  C:\ (%systemdrive%) -> Fixed drive # 86 Go (53 Go free - 62%) [] # NTFS
  D:\ -> Fixed drive # 73 Go (9 Go free - 13%) [Backups] # NTFS
  E:\ -> Fixed drive # 73 Go (53 Go free - 72%) [Windows 8] # NTFS
  F:\ -> CD-ROM
  H:\ -> CD-ROM
  
  ################## | Active Processes |
  
  C:\Windows\system32\csrss.exe (ID: 404 |ParentID: 396)
  C:\Windows\system32\wininit.exe (ID: 464 |ParentID: 396)
  C:\Windows\system32\csrss.exe (ID: 476 |ParentID: 456)
  C:\Windows\system32\services.exe (ID: 532 |ParentID: 464)
  C:\Windows\system32\lsass.exe (ID: 544 |ParentID: 464)
  C:\Windows\system32\lsm.exe (ID: 552 |ParentID: 464)
  C:\Windows\system32\winlogon.exe (ID: 624 |ParentID: 456)
  C:\Windows\system32\svchost.exe (ID: 728 |ParentID: 532)
  C:\Windows\system32\nvvsvc.exe (ID: 796 |ParentID: 532)
  C:\Windows\system32\svchost.exe (ID: 844 |ParentID: 532)
  C:\Windows\System32\svchost.exe (ID: 928 |ParentID: 532)
  C:\Windows\System32\svchost.exe (ID: 968 |ParentID: 532)
  C:\Windows\system32\svchost.exe (ID: 1008 |ParentID: 532)
  C:\Windows\system32\svchost.exe (ID: 1040 |ParentID: 532)
  C:\Windows\system32\svchost.exe (ID: 1340 |ParentID: 532)
  C:\Windows\System32\spoolsv.exe (ID: 1460 |ParentID: 532)
  C:\Windows\system32\svchost.exe (ID: 1496 |ParentID: 532)
  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (ID: 1548 |ParentID: 796)
  C:\Windows\system32\nvvsvc.exe (ID: 1556 |ParentID: 796)
  C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe (ID: 1664 |ParentID: 532)
  C:\Windows\system32\svchost.exe (ID: 1712 |ParentID: 532)
  C:\Windows\system32\svchost.exe (ID: 328 |ParentID: 532)
  C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (ID: 480 |ParentID: 532)
  C:\Windows\system32\taskhost.exe (ID: 2052 |ParentID: 532)
  C:\Windows\system32\taskeng.exe (ID: 2088 |ParentID: 1040)
  C:\Windows\system32\Rundll32.exe (ID: 2164 |ParentID: 2088)
  C:\Windows\system32\Dwm.exe (ID: 2276 |ParentID: 968)
  C:\Windows\system32\CNAB4RPK.EXE (ID: 2424 |ParentID: 1460)
  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (ID: 2588 |ParentID: 532)
  C:\Windows\System32\svchost.exe (ID: 2804 |ParentID: 532)
  C:\Windows\system32\svchost.exe (ID: 3048 |ParentID: 532)
  C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe (ID: 3516 |ParentID: 2340)
  C:\Program Files\DAEMON Tools Pro\DTShellHlp.exe (ID: 3544 |ParentID: 2340)
  C:\Program Files\CyberLink\YouCam\YouCamService.exe (ID: 3552 |ParentID: 2340)
  C:\Windows\vsnp325.exe (ID: 3604 |ParentID: 2340)
  C:\Program Files\HSPA USB Modem\HSPALauncher.exe (ID: 3628 |ParentID: 2340)
  C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE (ID: 3656 |ParentID: 2340)
  C:\Windows\system32\SearchIndexer.exe (ID: 768 |ParentID: 532)
  C:\Program Files\Windows Media Player\wmpnetwk.exe (ID: 2044 |ParentID: 532)
  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (ID: 2100 |ParentID: 1548)
  C:\Program Files\Internet Download Manager\IDMan.exe (ID: 3972 |ParentID: 2340)
  C:\Program Files\uTorrent\uTorrent.exe (ID: 112 |ParentID: 2340)
  C:\Windows\system32\RunDll32.exe (ID: 3732 |ParentID: 2340)
  C:\Windows\System32\WScript.exe (ID: 2012 |ParentID: 2340)
  C:\Program Files\Internet Download Manager\IEMonitor.exe (ID: 4124 |ParentID: 3972)
  C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (ID: 2912 |ParentID: 532)
  C:\Windows\System32\svchost.exe (ID: 4956 |ParentID: 532)
  C:\Program Files\Internet Download Manager\IDMGrHlp.exe (ID: 4588 |ParentID: 3972)
  C:\Windows\explorer.exe (ID: 4656 |ParentID: 1032)
  C:\Windows\system32\wbem\wmiprvse.exe (ID: 3256 |ParentID: 728)
  C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe (ID: 4844 |ParentID: 1664)
  C:\Program Files\Opera\18.0.1284.68\opera.exe (ID: 2360 |ParentID: 6856)
  C:\Program Files\Opera\18.0.1284.68\opera_crashreporter.exe (ID: 8060 |ParentID: 2360)
  C:\Program Files\Opera\18.0.1284.68\opera.exe (ID: 8644 |ParentID: 2360)
  C:\Program Files\Opera\18.0.1284.68\opera.exe (ID: 4696 |ParentID: 2360)
  C:\Program Files\Opera\18.0.1284.68\opera.exe (ID: 10232 |ParentID: 2360)
  C:\Program Files\Opera\18.0.1284.68\opera.exe (ID: 4080 |ParentID: 2360)
  C:\Program Files\Opera\18.0.1284.68\opera.exe (ID: 5084 |ParentID: 2360)
  C:\Program Files\Opera\18.0.1284.68\opera.exe (ID: 7692 |ParentID: 2360)
  C:\Program Files\Opera\18.0.1284.68\opera.exe (ID: 6944 |ParentID: 2360)
  C:\Program Files\Opera\18.0.1284.68\opera.exe (ID: 8600 |ParentID: 2360)
  C:\Windows\system32\SearchProtocolHost.exe (ID: 5796 |ParentID: 768)
  C:\Windows\system32\SearchFilterHost.exe (ID: 6216 |ParentID: 768)
  C:\Program Files\Internet Explorer\iexplore.exe (ID: 1796 |ParentID: 9896)
  C:\Program Files\Internet Explorer\iexplore.exe (ID: 4904 |ParentID: 1796)
  C:\Windows\system32\SearchProtocolHost.exe (ID: 7920 |ParentID: 768)
  
  ################## | Regedit Run |
  
  04 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe"
  04 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  04 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
  04 - HKLM\..\Run: [YouCam Service] "C:\Program Files\CyberLink\YouCam\YouCamService.exe" /s
  04 - HKLM\..\Run: [snp325] C:\Windows\vsnp325.exe
  04 - HKLM\..\Run: [HSPALauncher] C:\PROGRA~1\HSPAUS~1\HSPALA~1.EXE
  04 - HKLM\..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
  04 - HKLM\..\RunOnce: []
  04 - HKU\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
  04 - HKU\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
  04 - HKU\S-1-5-21-916970292-3413564281-2109517251-1000\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTAgent.exe" -autorun
  04 - HKU\S-1-5-21-916970292-3413564281-2109517251-1000\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
  04 - HKU\S-1-5-21-916970292-3413564281-2109517251-1000\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
  04 - HKU\S-1-5-21-916970292-3413564281-2109517251-1000\..\Run: [BackgroundContainer] "C:\Windows\system32\Rundll32.exe" "C:\Users\Cellule Info\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun
  04 - HKU\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe
  04 - HKU\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe
  
  ################## | Generic Search |
  
  Present! C:\Users\Cellule Info\AppData\Roaming\IDM.vbs
  Present! C:\Users\CELLUL~1\AppData\Local\Temp\temp
  Present! C:\Users\Cellule Info\AppData\Local\Temp\temp\Film\Setup.vbs
  Present! C:\Users\Cellule Info\AppData\Local\Temp\temp\Games\Setup.vbs
  Present! C:\Users\Cellule Info\AppData\Local\Temp\temp\Images\Setup.vbs
  Present! C:\Users\Cellule Info\AppData\Local\Temp\temp\Jeux\Setup.vbs
  Present! C:\Users\Cellule Info\AppData\Local\Temp\temp\Music\Setup.vbs
  Present! C:\Users\Cellule Info\AppData\Local\Temp\temp\PES2014\Setup.vbs
  Present! C:\Users\Cellule Info\AppData\Local\Temp\temp\Programs\Setup.vbs
  Present! C:\Users\Cellule Info\AppData\Local\Temp\temp\Torrent\Setup.vbs
  Present! C:\Users\Cellule Info\AppData\Local\Temp\temp\Video\Setup.vbs
  Present! C:\Users\Cellule Info\AppData\Local\Temp\temp\Video Porno\Setup.vbs
  Present! C:\Users\Cellule Info\AppData\Local\Temp\temp\XNXX\Setup.vbs
  
  ################## | Registry |
  
  Present! HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyGames -> 0
  
  ################## | Vaccine |
  
  C:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
  D:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
  E:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
  
  ################## | E.O.F | https://www.usbfix.net/ - https://www.sosvirus.net/ |
  
  0
2. karim377 Posted messages 43 Status Member
  
  Here I posted the research report.
  And if it's not too much to ask, I would really like to get an idea of how it works. Otherwise, please direct me to a forum dedicated to these things.
  Thank you.
  
  0
3. Anonymous user
  
  Move on; thank you.
  
  0
Answer 4 / 8
Anonymous user

Re

Connect your external data sources to your PC (USB stick, external hard drive, etc.) that may have been infected without opening them

# Double click on UsbFix (for users of Windows Vista, Windows 7, Windows 8), right click => "Run as administrator"
# Choose Remove

# Your desktop will disappear and the PC will restart.

# Upon restart, UsbFix will scan your PC, let the tool work.

# Then post the UsbFix.txt report that will appear with the desktop.

# Note: The UsbFix.txt report is saved at the root of the drive. (C:\UsbFix [Clean].txt)

( CTRL+A to select all, CTRL+C to copy and CTRL+V to paste )

@+

--
--------Security Contributor---------
We have all been beginners at something at one time.
But knowledge is the reward of diligence.
0
1. karim377 Posted messages 43 Status Member
  
  ############################## | UsbFix V 7.161 | [Removal]
  
  User: Cellule Info (Administrator) # CELLULE-INFO
  Updated on 01/15/2014 by El Desaparecido - Team SosVirus
  Launched at 13:16:13 | 01/19/2014
  
  Website: https://www.usbfix.net/
  Changelog: https://www.usb-antivirus.com/fr/maj/
  Support: https://www.sosvirus.net/
  Upload Malware: http://www.sosvirus.net/upload_malware.php
  Contact: https://www.usb-antivirus.com/fr/contact/
  
  PC: Gigabyte Technology Co., Ltd. (945PL-S3P)
  CPU: Intel(R) Pentium(R) Dual CPU E2220 @ 2.40GHz
  RAM -> [Total: 2048 MB | Free: 1094 MB]
  Bios: Award Software International, Inc.
  Boot: Normal boot
  
  OS: Microsoft Windows 7 Professional (6.1.7601 32-Bit) Service Pack 1
  WB: Windows Internet Explorer: 11.0.9600.16476
  
  SC: Security Center Service [Enabled]
  WU: Windows Update Service [Enabled]
  AS: Windows Defender: 6.1.7600.16385 (win7_rtm.090713-1255)
  FW: Windows Firewall Service [Enabled]
  
  C:\ (%systemdrive%) -> Hard Disk # 86 GB (53 GB free - 62%) [] # NTFS
  D:\ -> Hard Disk # 73 GB (9 GB free - 13%) [Backups] # NTFS
  E:\ -> Hard Disk # 73 GB (53 GB free - 72%) [Windows 8] # NTFS
  F:\ -> CD-ROM
  H:\ -> CD-ROM
  J:\ -> Removable Drive # 8 GB (7 GB free - 99%) [ADATA UFD] # NTFS
  
  ################## | Stopped Processes |
  
  Stopped! C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe (ID: 1664 | ParentID: 532)
  Stopped! C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe (ID: 3516 | ParentID: 2340)
  Stopped! C:\Windows\explorer.exe (ID: 4656 | ParentID: 1032)
  Stopped! C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe (ID: 4844 | ParentID: 1664)
  Stopped! C:\Windows\system32\SearchIndexer.exe (ID: 9824 | ParentID: 532)
  Stopped! C:\Program Files\Windows Media Player\wmpnetwk.exe (ID: 4472 | ParentID: 532)
  Stopped! C:\Windows\System32\spoolsv.exe (ID: 6628 | ParentID: 532)
  Stopped! C:\Windows\system32\CNAB4RPK.EXE (ID: 872 | ParentID: 6628)
  Stopped! C:\Windows\system32\nvvsvc.exe (ID: 3784 | ParentID: 532)
  Stopped! C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (ID: 5072 | ParentID: 3784)
  Stopped! C:\Windows\system32\nvvsvc.exe (ID: 7836 | ParentID: 3784)
  Stopped! C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (ID: 2540 | ParentID: 5072)
  Stopped! C:\Windows\System32\WUDFHost.exe (ID: 7260 | ParentID: 968)
  Stopped! c:\program files\windows defender\MpCmdRun.exe (ID: 1696 | ParentID: 2144)
  
  ################## | Regedit Run |
  
  04 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations MP4\avp.exe"
  04 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  04 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
  04 - HKLM\..\Run: [YouCam Service] "C:\Program Files\CyberLink\YouCam\YouCamService.exe" /s
  04 - HKLM\..\Run: [snp325] C:\Windows\vsnp325.exe
  04 - HKLM\..\Run: [HSPALauncher] C:\PROGRA~1\HSPAUS~1\HSPALA~1.EXE
  04 - HKLM\..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
  04 - HKLM\..\RunOnce: []
  04 - HKU\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
  04 - HKU\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
  04 - HKU\S-1-5-21-916970292-3413564281-2109517251-1000\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTAgent.exe" -autorun
  04 - HKU\S-1-5-21-916970292-3413564281-2109517251-1000\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
  04 - HKU\S-1-5-21-916970292-3413564281-2109517251-1000\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
  04 - HKU\S-1-5-21-916970292-3413564281-2109517251-1000\..\Run: [BackgroundContainer] "C:\Windows\system32\Rundll32.exe" "C:\Users\Cellule Info\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun
  04 - HKU\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe
  04 - HKU\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe
  
  ################## | Generic Search |
  
  Deleted! C:\Users\Cellule Info\AppData\Roaming\IDM.vbs
  Deleted! C:\Users\CELLUL~1\AppData\Local\Temp\temp
  
  (!) Temporary files deleted.
  
  ################## | Registry |
  
  Fixed! HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyGames -> 1
  
  ################## | Listing |
  
  [01/15/2014 - 10:17:37 | SHD] - C:\$Recycle.Bin
  [06/10/2009 - 22:42:20 | N | 0 KB] - C:\autoexec.bat
  [01/15/2014 - 12:17:30 | RASHD] - C:\Autorun.inf
  [11/18/2013 - 11:30:26 | D] - C:\Boot
  [07/26/2012 - 04:44:30 | RASH | 389 KB] - C:\bootmgr
  [06/02/2012 - 15:30:55 | N | 0 KB] - C:\BOOTNXT
  [11/18/2013 - 11:30:28 | N | 8 KB] - C:\BOOTSECT.BAK
  [06/10/2009 - 22:42:20 | N | 0 KB] - C:\config.sys
  [07/14/2009 - 05:53:55 | SHD] - C:\Documents and Settings
  [01/16/2014 - 13:36:34 | ASH | 1572520 KB] - C:\hiberfil.sys
  [11/18/2013 - 13:10:46 | D] - C:\KAV
  [01/15/2014 - 10:20:47 | | 315 KB] - C:\MAFKH
  [11/18/2013 - 14:08:29 | RHD] - C:\MSOCache
  [01/16/2014 - 13:36:35 | ASH | 2096696 KB] - C:\pagefile.sys
  [07/14/2009 - 03:37:05 | D] - C:\PerfLogs
  [01/16/2014 - 15:09:46 | D] - C:\Program Files
  [01/15/2014 - 13:41:19 | HD] - C:\ProgramData
  [11/18/2013 - 13:03:38 | SHD] - C:\Recovery
  [01/16/2014 - 03:00:25 | SHD] - C:\System Volume Information
  [11/18/2013 - 19:29:50 | D] - C:\Temp
  [01/19/2014 - 13:16:15 | D] - C:\UsbFix
  [01/19/2014 - 13:17:12 | A | 5 KB | 3BA9B8EB8415C187D40DC5DC82B09EAA] - C:\UsbFix [Clean 1] CELLULE-INFO.txt
  [01/19/2014 - 11:25:01 | N | 9 KB | 672AFE98E1730EF0DD1660312AD1E885] - C:\UsbFix [Scan 2] CELLULE-INFO.txt
  [01/15/2014 - 10:18:37 | N | 445 KB] - C:\UsbFix_Upload_Me_CELLULE-INFO.zip
  [11/18/2013 - 19:29:52 | D] - C:\Users
  [01/15/2014 - 22:06:54 | D] - C:\Windows
  [11/18/2013 - 11:19:59 | D] - C:\Windows.old
  [01/15/2014 - 10:17:37 | SHD] - D:\$RECYCLE.BIN
  [01/16/2014 - 10:18:34 | D] - D:\AKROUR
  [01/15/2014 - 12:17:31 | RASHD] - D:\Autorun.inf
  [12/09/2013 - 09:05:44 | SHD] - D:\RECYCLER
  [12/23/2012 - 08:53:06 | SHD] - D:\System Volume Information
  [01/15/2014 - 10:17:37 | SHD] - E:\$RECYCLE.BIN
  [01/15/2014 - 12:17:32 | RASHD] - E:\Autorun.inf
  [12/17/2013 - 10:09:36 | D] - E:\bac 2013
  [01/15/2014 - 11:29:36 | D] - E:\dora
  [12/09/2013 - 09:05:44 | SHD] - E:\RECYCLER
  [12/02/2013 - 14:08:16 | D] - E:\réc
  [12/03/2013 - 14:32:10 | D] - E:\rééduc
  [11/18/2013 - 11:32:20 | SHD] - E:\System Volume Information
  [01/16/2014 - 20:13:59 | RASHD] - J:\Autorun.inf
  
  ################## | Vaccine |
  
  J:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
  
  ################## | E.O.F | https://www.usbfix.net/ - https://www.sosvirus.net/ |
  
  0
Answer 5 / 8
Anonymous user

Re

Download Malwarebytes Anti-Malware here
https://www.commentcamarche.net/telecharger/securite/14361-malwarebytes-anti-malware/

* Install it (make sure to choose "French"; do not change the installation settings) and update it.

At the end of the installation: Uncheck "activate the free trial of Malwarebytes PRO"

* Study the tutorial to familiarize yourself with the program:

https://forum.pcastuces.com/sujet.asp?f=31&s=3

(That said, it is very easy to use).

Restart Malwarebytes by strictly following these instructions:

! Disconnect and close all running applications!

* Launch Malwarebytes. Under Vista, Seven or Windows 8 (right-click the mouse "run as administrator")

*Proceed with an update

*Run a "Quick" scan

--> Let the program work (and do nothing else with the PC during the scan).
--> At the end, click on "Show results".
--> Ensure that all infected items are checked, then click on "remove selected".

Note: if you need to restart your PC to complete the cleanup, do it!

Post the saved report after removing the infected items (in the "report/log" tab of Malwarebytes, the most recent one)

@+
--
--------Security Contributor---------
We have all been beginners at something at one point.
But knowledge is the reward of diligence.
0
1. karim377 Posted messages 43 Status Member
  
  Okay, thank you very much, I will take care of it.
  
  0
2. Anonymous user
  
  And it's not over!!!
  
  0
3. karim377 Posted messages 43 Status Member
  
  Hello, it will be today..... 3:30 PM is the end of my shift ;)
  
  0
4. karim377 Posted messages 43 Status Member
  
  Malwarebytes Anti-Malware 1.75.0.1300
  www.malwarebytes.org
  
  Database version: v2014.01.20.03
  
  Windows 7 Service Pack 1 x86 NTFS
  Internet Explorer 11.0.9600.16476
  Cell Info :: CELLULE-INFO [administrator]
  
  01/20/2014 09:41:54
  mbam-log-2014-01-20 (09-41-54).txt
  
  Scan type: Quick Scan
  Scan options enabled: Memory | Startup | Registry | File System | Heuristic/Extra | Heuristic/Shuriken | PUP | PUM
  Scan options disabled: P2P
  Element(s) scanned: 218817
  Elapsed time: 6 minute(s), 39 second(s)
  
  Memory processes detected: 0
  (No harmful items detected)
  
  Memory modules detected: 0
  (No harmful items detected)
  
  Registry keys detected: 7
  HKCR\CLSID\{A6FEED89-3BCD-4D19-9DC2-3E613A80A2A4} (PUP.Optional.Amonetize.A) -> Quarantined and successfully removed.
  HKCR\TypeLib\{1C1356DA-1E98-4810-A9F6-18D89BD1C0C0} (PUP.Optional.Amonetize.A) -> Quarantined and successfully removed.
  HKCR\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7} (PUP.Optional.Amonetize.A) -> Quarantined and successfully removed.
  HKCR\AmiBs.Installer.1 (PUP.Optional.Amonetize.A) -> Quarantined and successfully removed.
  HKCR\AmiBs.Installer (PUP.Optional.Amonetize.A) -> Quarantined and successfully removed.
  HKCU\Software\Conduit\FF (PUP.Optional.Conduit.A) -> Quarantined and successfully removed.
  HKCU\Software\Systweak\RegClean Pro (PUP.Optional.RegCleanerPro.A) -> Quarantined and successfully removed.
  
  Registry value(s) detected: 0
  (No harmful items detected)
  
  Registry data items detected: 0
  (No harmful items detected)
  
  Folder(s) detected: 6
  C:\Users\Cellule Info\AppData\Local\Temp\CT2851639 (PUP.Optional.Conduit.A) -> Quarantined and successfully removed.
  C:\Users\Cellule Info\AppData\Local\Temp\CT2851639\plugins (PUP.Optional.Conduit.A) -> Quarantined and successfully removed.
  C:\Users\Cellule Info\AppData\Local\Temp\CT2851639\xpi (PUP.Optional.Conduit.A) -> Quarantined and successfully removed.
  C:\Users\Cellule Info\AppData\Local\Temp\CT2851639\xpi\defaults (PUP.Optional.Conduit.A) -> Quarantined and successfully removed.
  C:\Users\Cellule Info\AppData\Local\Temp\CT2851639\xpi\defaults\preferences (PUP.Optional.Conduit.A) -> Quarantined and successfully removed.
  C:\ProgramData\Conduit\IE (PUP.Optional.Conduit.A) -> Quarantined and successfully removed.
  
  File(s) detected: 15
  C:\Users\Cellule Info\AppData\Local\Temp\tbuTo0.dll (PUP.Optional.Conduit) -> Quarantined and successfully removed.
  C:\Users\Cellule Info\AppData\Local\Temp\is-RBMMP.tmp\InstallManager.exe (PUP.Optional.InstallMonetizer.A) -> Quarantined and successfully removed.
  C:\Users\Cellule Info\AppData\Local\Temp\is-RBMMP.tmp\rkinstaller.exe (PUP.Optional.RelevantKnowledge) -> Quarantined and successfully removed.
  C:\Users\Cellule Info\Local Settings\Temporary Internet Files\Content.IE5\Z6ROKDCG\rcpsetup17970[1].exe (PUP.Optional.RegCleanerPro) -> Quarantined and successfully removed.
  C:\Windows\System32\roboot.exe (PUP.Optional.PCPerformer.A) -> Quarantined and successfully removed.
  C:\Windows\System32\Tasks\BackgroundContainer Startup Task (PUP.Optional.Conduit) -> Quarantined and successfully removed.
  C:\Users\Cellule Info\AppData\Local\Temp\CT2851639\conduit.xml (PUP.Optional.Conduit.A) -> Quarantined and successfully removed.
  C:\Users\Cellule Info\AppData\Local\Temp\CT2851639\CT2851639.txt (PUP.Optional.Conduit.A) -> Quarantined and successfully removed.
  C:\Users\Cellule Info\AppData\Local\Temp\CT2851639\CT2851639.xpi (PUP.Optional.Conduit.A) -> Quarantined and successfully removed.
  C:\Users\Cellule Info\AppData\Local\Temp\CT2851639\initData.json (PUP.Optional.Conduit.A) -> Quarantined and successfully removed.
  C:\Users\Cellule Info\AppData\Local\Temp\CT2851639\manifest.json (PUP.Optional.Conduit.A) -> Quarantined and successfully removed.
  C:\Users\Cellule Info\AppData\Local\Temp\CT2851639\version.txt (PUP.Optional.Conduit.A) -> Quarantined and successfully removed.
  C:\Users\Cellule Info\AppData\Local\Temp\CT2851639\plugins\TBVerifier.dll (PUP.Optional.Conduit.A) -> Quarantined and successfully removed.
  C:\Users\Cellule Info\AppData\Local\Temp\CT2851639\xpi\install.rdf (PUP.Optional.Conduit.A) -> Quarantined and successfully removed.
  C:\Users\Cellule Info\AppData\Local\Temp\CT2851639\xpi\defaults\preferences\defaults.js (PUP.Optional.Conduit.A) -> Quarantined and successfully removed.
  
  (end)
  
  0
Answer 6 / 8
Anonymous user

Hello

We continue with:

Download AdwCleaner (by Xplode) to your desktop.
Run it, click on [Scan] and wait for the scan to finish.
Once the scan is completed, click on the [Clean] button.
Wait during the cleaning process. Read the message that appears, then click on Ok. The PC will restart automatically and the report will open after the restart.
Post the report

Note: The report is also saved under C:\AdwCleaner[S1].txt

To read:
Potentially unwanted programs:
https://www.malekal.com/adwares-pup-protection/

Toolbars are not mandatory (by Malekal): https://forum.malekal.com/viewtopic.php?t=6173&start=

See you

--
***--------------------------Cs---------------------------***
We've all been a beginner at something at one point.
But knowledge is the reward for diligence.
0
1. karim377 Posted messages 43 Status Member
  
  # AdwCleaner v3.017 - Report created on 01/20/2014 at 1:16:42 PM
  # Updated on 01/12/2014 by Xplode
  # Operating System: Windows 7 Professional Service Pack 1 (32-bit)
  # Username: Cellule Info - CELLULE-INFO
  # Executed from: D:\AKROUR\utils\adwcleaner.exe
  # Option: Clean
  
  ***** [ Services ] *****
  
  ***** [ Files / Folders ] *****
  
  Deleted Folder: C:\ProgramData\Conduit
  Deleted Folder: C:\Program Files\Conduit
  Deleted Folder: C:\Program Files\goforfiles
  Deleted Folder: C:\Program Files\RegClean Pro
  Deleted Folder: C:\Users\Cellule Info\AppData\Local\Conduit
  Deleted Folder: C:\Users\Cellule Info\AppData\LocalLow\Conduit
  Deleted Folder: C:\Users\Cellule Info\AppData\LocalLow\PriceGong
  Deleted Folder: C:\Users\Cellule Info\AppData\Roaming\goforfiles
  Deleted Folder: C:\Users\Cellule Info\AppData\Roaming\Systweak
  Deleted File: C:\Windows\System32\Tasks\GoforFilesUpdate
  
  ***** [ Shortcuts ] *****
  
  ***** [ Registry ] *****
  
  Deleted Key: HKCU\Software\Google\Chrome\Extensions\paoponfhfdfnjgddpnpjkambkcgdaaib
  Deleted Key: HKLM\SOFTWARE\Google\Chrome\Extensions\paoponfhfdfnjgddpnpjkambkcgdaaib
  [#] Deleted Key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{28500193-71FB-46E6-8F74-3BD3A55A49B6}
  [#] Deleted Key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{28500193-71FB-46E6-8F74-3BD3A55A49B6}
  [#] Deleted Key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{27EC8471-C077-4FC1-855B-8777FBB95BAB}
  [#] Deleted Key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{27EC8471-C077-4FC1-855B-8777FBB95BAB}
  Deleted Key: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\conduit.com
  Deleted Key: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\conduit.com
  Deleted Key: HKLM\SOFTWARE\Classes\Toolbar.CT2851639
  Deleted Key: HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
  Deleted Key: HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
  Deleted Key: HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
  Deleted Key: HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
  Deleted Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
  Deleted Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
  Deleted Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
  Deleted Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
  Deleted Key: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
  Deleted Key: HKCU\Software\Conduit
  Deleted Key: HKCU\Software\GoforFiles
  Deleted Key: HKCU\Software\systweak
  Deleted Key: HKCU\Software\AppDataLow\Software\Conduit
  Deleted Key: HKCU\Software\AppDataLow\Software\ConduitSearchScopes
  Deleted Key: HKCU\Software\AppDataLow\Software\PriceGong
  Deleted Key: HKCU\Software\AppDataLow\Software\SmartBar
  Deleted Key: HKLM\Software\Conduit
  Deleted Key: HKLM\Software\GoforFiles
  
  ***** [ Browsers ] *****
  
  -\\ Internet Explorer v11.0.9600.16428
  
  *************************
  
  AdwCleaner[R0].txt - [3634 bytes] - [01/20/2014 1:12:26 PM]
  AdwCleaner[S0].txt - [3524 bytes] - [01/20/2014 1:16:42 PM]
  
  ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3584 bytes] ##########
  
  Here you go, I think it removed some stuff, thank you for taking the time to respond and follow up on this.
  
  0
Answer 7 / 8
Anonymous user

Re

For verification, please do this

Open this link and download ZHPDiag from Nicolas Coolman:

https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html

Or

https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/

at the bottom of the ZHP page with a version number.

Once the download is complete,

Double-click the icon to launch the program. Under Vista; Seven or Windows 8 right-click "run as administrator"

In the ZHPDiag window that opens, click on "Configure"

Click on the magnifying glass at the bottom left with the plus sign to start the scan.

Let the tool work, it may take a while.

A report will open. This report is also located on your desktop

To send the report click on this link:
http://pjjoint.malekal.com/

If there's a problem use one of the following

https://forums-fec.be/upload
https://www.cjoint.com/

Look on the desktop

Select the ZHPDiag.txt file.

Click on "Click here to upload the file".

A link of this form:

http://www.cijoint.com/cjlink.php?file=cj200905/cijSKAP5fU.txt

will be added to the page.

Copy this link in your response.

Thank you

@+

--
***--------------------------Cs---------------------------***
We have all been beginners at something.
But knowledge is the reward of diligence.
0
Answer 8 / 8
Redbart Posted messages 20952 Registration date Status Member Last intervention 3 381

Hello
install an antivirus
https://www.commentcamarche.net/telecharger/securite/antivirus-antimalwares/

my favorites: avast, avira antivir
-1
1. karim377 Posted messages 43 Status Member
  
  The antivirus doesn't detect it, I have a Kaspersky workstation with a license but nothing.
  Thank you for the response.
  
  0

Remove the virus that converts folders into shortcuts.

8 answers

Is it possible to sell dietary supplements on ebay?

How to disable a vpn

No tiktok voice messages

Broken tv stand

Mercedes-benz considers brake-free vehicles powered by a revolutionary electric motor.

Data merging on mac

My computer starts up by itself or shuts down by itself

Uninstall an application

Problem with directx 12 - steam game launch

Philips uhd led tv black screen