File in .Ink format Solved

Question

Hello,
I’m new to the forum, so I hope this is indeed the right place to post my topic.
Here is my problem that I can’t seem to solve even after browsing several web pages. After plugging my USB drive into a computer at my high school, I think I got a virus and all my files turned into Ink format. I understood that I needed to download usbfix and send the report to the forum so that the problem could be resolved, but I have already sent it and nothing has happened; no one has come to help me.
Thank you for clarifying this for me as soon as possible; it’s very important. Best regards.

Configuration: Windows 7 / Mozilla 11.0

Jimpix · Answer

Hello,  "Sending a report" does not solve the problem in any way... It only allows those who want to help you to understand how your PC is infected...

Anonymous user · Answer

Hello,

I only see one topic, and it's this one!

Copy and paste the content of the report in your next message

--
O.o°*Member, CCM Security Staff o°.Oø¤º°'°º¤ø
=>> Breathe deeply, write your message in proper French and clearly. It will be fine, you’ll see, well we’ll try!!! o°Oø

rikki-38 · Answer

############################## | UsbFix V 7.162 | [Search]  User: titine (Administrator) # TITINE-PC Updated on 27/01/2014 by El Desaparecido - Team SosVirus Launched at 16:26:42 | 08/03/2014  Website: https://www.usbfix.net/ Changelog: https://www.usb-antivirus.com/fr/maj/ Support: https://www.sosvirus.net/ Upload Malware: http://www.sosvirus.net/upload_malware.php Contact: https://www.usb-antivirus.com/fr/contact/  PC: ASUSTeK Computer INC. (A7N8X-LA) CPU: AMD Athlon(tm) XP 2400+ RAM -> [Total: 1535 Mo| Free: 696 Mo] Bios: American Megatrends Inc. Boot: Normal boot  OS: Microsoft Windows 7 Ultimate Edition (6.1.7601 32-Bit) Service Pack 1 WB: Windows Internet Explorer: 11.0.9600.16518  SC: Security Center [Enabled] WU: Windows Update [Enabled] AV: Microsoft Security Essentials [Enabled | Updated] AV: Avira Desktop [Enabled | Updated] AS: Avira Desktop [Enabled | Updated] AS: Windows Defender [(!) Disabled | Updated] AS: Microsoft Security Essentials [Enabled | Updated] FW: Windows Firewall [(!) Disabled]  C:\ (%systemdrive%) -> Hard Disk # 74 Go (25 Go free - 33%) [] # NTFS D:\ -> CD-ROM E:\ -> CD-ROM F:\ -> Hard Disk # 37 Go (1 Go free - 3%) [New Name] # NTFS G:\ -> Removable Disk # 8 Go (8 Go free - 100%) [WESKER] # FAT32  ################## | Active Processes |  C:\Windows\system32\csrss.exe (ID: 384 |ParentID: 376) C:\Windows\system32\wininit.exe (ID: 444 |ParentID: 376) C:\Windows\system32\csrss.exe (ID: 456 |ParentID: 436) C:\Windows\system32\services.exe (ID: 496 |ParentID: 444) C:\Windows\system32\lsass.exe (ID: 512 |ParentID: 444) C:\Windows\system32\lsm.exe (ID: 520 |ParentID: 444) C:\Windows\system32\winlogon.exe (ID: 580 |ParentID: 436) C:\Windows\system32\svchost.exe (ID: 640 |ParentID: 496) C:\Windows\system32
vvsvc.exe (ID: 724 |ParentID: 496) C:\Windows\system32\svchost.exe (ID: 752 |ParentID: 496) c:\Program Files\Microsoft Security Client\MsMpEng.exe (ID: 800 |ParentID: 496) C:\Windows\system32\Ati2evxx.exe (ID: 956 |ParentID: 496) C:\Windows\System32\svchost.exe (ID: 992 |ParentID: 496) C:\Windows\System32\svchost.exe (ID: 1032 |ParentID: 496) C:\Windows\system32\svchost.exe (ID: 1072 |ParentID: 496) C:\Windows\system32\svchost.exe (ID: 1096 |ParentID: 496) C:\Windows\system32\svchost.exe (ID: 1192 |ParentID: 496) C:\Windows\system32\svchost.exe (ID: 1432 |ParentID: 496) C:\Windows\system32\Ati2evxx.exe (ID: 1504 |ParentID: 956) C:\Windows\System32\spoolsv.exe (ID: 1584 |ParentID: 496) C:\Program Files\Avira\AntiVir Desktop\sched.exe (ID: 1620 |ParentID: 496) C:\Windows\system32\svchost.exe (ID: 1640 |ParentID: 496) C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (ID: 1756 |ParentID: 496) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (ID: 1780 |ParentID: 496) C:\Program Files\ma-config.com\MaConfigAgent.exe (ID: 1836 |ParentID: 496) C:\Windows\system32\svchost.exe (ID: 1916 |ParentID: 496) C:\Windows\system32	askhost.exe (ID: 1824 |ParentID: 496) C:\Windows\system32\Dwm.exe (ID: 2092 |ParentID: 1032) C:\Windows\Explorer.EXE (ID: 2104 |ParentID: 2052) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (ID: 2876 |ParentID: 1780) c:\Program Files\Microsoft Security Client\NisSrv.exe (ID: 3404 |ParentID: 496) C:\Windows\system32\svchost.exe (ID: 3664 |ParentID: 496) C:\Windows\System32\WUDFHost.exe (ID: 3920 |ParentID: 1032) C:\Windows\SOUNDMAN.EXE (ID: 1724 |ParentID: 2104) C:\Program Files\Athan\Athan.exe (ID: 2112 |ParentID: 2104) C:\Program Files\HP\HP Software Update\hpwuschd2.exe (ID: 2324 |ParentID: 2104) C:\Program Files\AVAST Software\Avast\AvastUI.exe (ID: 876 |ParentID: 2104) C:\Windows\system32\SearchIndexer.exe (ID: 2404 |ParentID: 496) C:\Program Files\Microsoft Security Client\msseces.exe (ID: 1416 |ParentID: 2104) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (ID: 2516 |ParentID: 2104) C:\Program Files\Common Files\Java\Java Update\jusched.exe (ID: 1008 |ParentID: 2104) C:\Program Files\Internet Explorer\iexplore.exe (ID: 820 |ParentID: 2104) C:\Users	itine\AppData\Roaming\cacaoweb\cacaoweb.exe (ID: 1712 |ParentID: 2104) C:\Windows\system32\svchost.exe (ID: 556 |ParentID: 496) C:\Program Files\Windows Media Player\wmpnetwk.exe (ID: 3824 |ParentID: 496) C:\Program Files\Internet Explorer\iexplore.exe (ID: 916 |ParentID: 820) C:\Windows\System32\svchost.exe (ID: 1384 |ParentID: 496) C:\Windows\system32\svchost.exe (ID: 1260 |ParentID: 496) C:\Program Files\Internet Explorer\iexplore.exe (ID: 5816 |ParentID: 820) C:\Windows\System32\MsSpellCheckingFacility.exe (ID: 4532 |ParentID: 640) C:\Windows\system32	askeng.exe (ID: 4384 |ParentID: 1096) C:\Program Files\Windows Media Player\wmprph.exe (ID: 5220 |ParentID: 640) C:\Program Files\Internet Explorer\iexplore.exe (ID: 5596 |ParentID: 820) C:\Windows\system32\SearchProtocolHost.exe (ID: 3032 |ParentID: 2404) C:\Windows\system32\SearchFilterHost.exe (ID: 2568 |ParentID: 2404) C:\Windows\system32\wbem\wmiprvse.exe (ID: 4572 |ParentID: 640)  ################## | Regedit Run |  04 - HKCU\..\Run: [Driver Whiz] C:\Program Files\Driver Whiz\Driver Whiz\DriverWhiz.exe /applicationMode:systemTray /showWelcome:false 04 - HKCU\..\Run: [cacaoweb] "C:\Users	itine\AppData\Roaming\cacaoweb\cacaoweb.exe" -noplayer 04 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" 04 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun 04 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE 04 - HKLM\..\Run: [Athan] C:\Program Files\Athan\Athan.exe 04 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe 04 - HKLM\..\Run: [] 04 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui 04 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey 04 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min 04 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" 04 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" 04 - HKU\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun 04 - HKU\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun 04 - HKU\S-1-5-21-2125735380-3021094265-2757106911-1000\..\Run: [Driver Whiz] C:\Program Files\Driver Whiz\Driver Whiz\DriverWhiz.exe /applicationMode:systemTray /showWelcome:false 04 - HKU\S-1-5-21-2125735380-3021094265-2757106911-1000\..\Run: [cacaoweb] "C:\Users	itine\AppData\Roaming\cacaoweb\cacaoweb.exe" -noplayer 04 - HKU\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe 04 - HKU\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe  ################## | Generic Search |  Present! G:\film18.lnk Present! G:\Resident evil movie.lnk Present! G:\Biohazard (2) - Copy.lnk Present! G:\AOUADI ELYES cv.lnk  ################## | Registry |   ################## | Vaccine |  F:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido) G:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)  ################## | E.O.F | https://www.usbfix.net/ - https://www.sosvirus.net/ |

¡El Desaparecido! · Answer

Hello,

To proceed.

Rikki-38, uninstall your version of UsbFix as it is not up to date.

Then do this:

# Download UsbFix by El Desaparecido to your Desktop.
# If your antivirus shows an alert, ignore it and temporarily disable the antivirus.
# Connect all your external data sources to your PC (USB flash drive, external hard drive, etc.) without opening them.
# Double click on UsbFix.exe.
# Click on Delete.

# Note: The computer will restart automatically, upon restart, click on the message sent by UsbFix and let the program work.

# Let the tool work, your desktop will not be accessible during the cleaning phase, that’s normal.

# At the end of the scan, a report will be displayed, post it in your next response on the forum.

# The report is also saved at the root of the system drive (C:\UsbFix [Clean ?] Computer name.txt).
(CTRL+A to select, CTRL+C to copy and CTRL+V to paste)
# ->> Tutorial (help) in images on the author's site.
Developer: UsbFix ## Webmaster: SosVirus
As Birdy says -> People help the people

rikki-38 · Answer

I just performed the deletion with the new version of usbfix, here is the report in 3 parts:
############################## | UsbFix V 7.166 | [Deletion]

User: titine (Administrator) # TITINE-PC
Updated on 26/02/2014 by El Desaparecido - Team SosVirus
Launched at 19:18:41 | 08/03/2014

Website: https://www.usbfix.net/
Changelog: https://www.usb-antivirus.com/fr/maj/
Support: https://www.sosvirus.net/
Upload Malware: http://www.sosvirus.net/upload_malware.php
Contact: https://www.usb-antivirus.com/fr/contact/

PC: ASUSTeK Computer INC. (A7N8X-LA)
CPU: AMD Athlon(tm) XP 2400+
RAM -> [Total: 1535 MB | Free: 620 MB]
Bios: American Megatrends Inc.
Boot: Normal boot

OS: Microsoft Windows 7 Ultimate Edition (6.1.7601 32-Bit) Service Pack 1
WB: Windows Internet Explorer: 11.0.9600.16518

SC: Security Center [Enabled]
WU: Windows Update [Enabled]
AV: Microsoft Security Essentials [(!) Disabled | Updated]
AV: Avira Desktop [(!) Disabled | Updated]
AS: Avira Desktop [(!) Disabled | Updated]
AS: Windows Defender [(!) Disabled | Updated]
AS: Microsoft Security Essentials [(!) Disabled | Updated]
FW: Windows Firewall [(!) Disabled]

C:\ (%systemdrive%) -> Fixed Drive # 74 GB (25 GB free - 33%) [] # NTFS
D:\ -> CD-ROM
E:\ -> CD-ROM
F:\ -> Fixed Drive # 37 GB (1 GB free - 3%) [New name] # NTFS
G:\ -> Removable Drive # 8 GB (8 GB free - 100%) [WESKER] # FAT32

################## | Active Processes |

¡El Desaparecido! · Answer

You've got 2 antivirus programs too many...

Only one antivirus per machine; otherwise, you'll end up being a victim of crashes, conflicts, and more ;)

Uninstall Avast and Microsoft Security Essentials and keep Antivir instead ;)

# Download Malwarebytes' Anti-Malware and install it.

# Launch Malwarebytes' Anti-Malware.
# Click on the "Updates" tab then on "Check for updates."
# Click on the "Scan" tab, check "Perform a quick scan" then click on Scan.

At the end of the scan, if MBAM found nothing:
# Click OK, the report opens automatically

If threats were detected:
# Click OK then "Show Results"
# Choose the "Remove Selected" option
# If MBAM asks to restart Windows: Click "Yes"
# Once the PC has restarted, the report can be found in the "Reports/Logs" tab
# Otherwise, the report opens automatically after removal.
Developer: UsbFix ## Webmaster: SosVirus
As Birdy says -> People help the people

¡El Desaparecido! · Answer

Should I rescan with usbfix or is it not necessary?  No need, but you should use Malwarebytes as explained above :)  -- Developer: UsbFix ## Webmaster: SosVirus As Birdy said -> People help the people

rikki-38 · Answer

and here is the Malwarebytes report:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.03.08.07

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 11.0.9600.16518
titine :: TITINE-PC [administrator]

03/08/2014 20:57:30
mbam-log-2014-03-08 (20-57-30).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File system | Heuristic/Extra | Heuristic/Shuriken | PUP | PUM
Scan options disabled: P2P
Element(s) scanned: 209088
Time elapsed: 25 minute(s), 6 second(s)

Memory processes detected: 0
(No harmful items detected)

Memory modules detected: 0
(No harmful items detected)

Registry key(s) detected: 45
HKLM\SYSTEM\CurrentControlSet\Services\WajamUpdater (PUP.Optional.Wajam.A) -> No action taken.
HKCR\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} (PUP.Optional.Wajam.A) -> No action taken.
HKCR\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} (PUP.Optional.Wajam.A) -> No action taken.
HKCR\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D} (PUP.Optional.Wajam.A) -> No action taken.
HKCR\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} (PUP.Optional.Wajam.A) -> No action taken.
HKCR\wajam.WajamBHO.1 (PUP.Optional.Wajam.A) -> No action taken.
HKCR\wajam.WajamBHO (PUP.Optional.Wajam.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} (PUP.Optional.Wajam.A) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} (PUP.Optional.Wajam.A) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} (PUP.Optional.Wajam.A) -> No action taken.
HKCR\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634} (PUP.Optional.Wajam.A) -> No action taken.
HKCR\AppID\{7169BBB3-3289-4696-B35D-4A88BCF6FB12} (PUP.Optional.WebCake.A) -> No action taken.
HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> No action taken.
HKCR\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} (PUP.Optional.Wajam.A) -> No action taken.
HKCR\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5} (PUP.Optional.Wajam.A) -> No action taken.
HKCR\wajam.WajamDownloader.1 (PUP.Optional.Wajam.A) -> No action taken.
HKCR\wajam.WajamDownloader (PUP.Optional.Wajam.A) -> No action taken.
HKCR\CLSID\{AF6B0594-6008-4327-93E5-608AD710A6FA} (PUP.Optional.WebCake.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{AF6B0594-6008-4327-93E5-608AD710A6FA} (PUP.Optional.WebCake.A) -> No action taken.
HKCR\CLSID\{BB975E58-E769-4E5A-BA12-B765BC559FF3} (PUP.Optional.WebCake.A) -> No action taken.
HKCR\CLSID\{DF84E609-C3A4-49CB-A160-61767DAF8899} (PUP.Optional.WebCake.A) -> No action taken.
HKCR\Interface\{DF84E609-C3A4-49CB-A160-61767DAF8899} (PUP.Optional.WebCake.A) -> No action taken.
HKCR\Typelib\{DCABB943-792E-44C4-9029-ECBEE6265AF9} (PUP.Optional.OutBrowse) -> No action taken.
HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534} (PUP.Optional.OutBrowse) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{18DBB6CE-3148-4FEC-B481-103CB3290427} (PUP.Optional.SpeedAnalysis.A) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{FF103732-4528-4322-AA8B-F7849AB7776B} (PUP.Optional.BestToolbars) -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} (PUP.Optional.Iminent.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08} (PUP.Optional.Iminent.A) -> No action taken.
HKCR\AppID\priam_bho.DLL (PUP.Optional.Wajam.A) -> No action taken.
HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr.A) -> No action taken.
HKCU\Software\DataMngr (PUP.Optional.DataMngr.A) -> No action taken.
HKCU\Software\Iminent (PUP.Optional.Iminent.A) -> No action taken.
HKCU\Software\AppDataLow\Software\Crossrider (PUP.Optional.CrossRider.A) -> No action taken.
HKCU\Software\BabSolution\Updater (PUP.Optional.Babylon.A) -> No action taken.
HKCU\Software\InstallCore\1I1T1Q1S (PUP.Optional.InstallCore.A) -> No action taken.
HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> No action taken.
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings (PUP.Optional.BProtector.A) -> No action taken.
HKCU\Software\Nosibay\Bubble Dock Tag (PUP.Optional.BubbleDock.A) -> No action taken.
HKCU\SOFTWARE\WAJAM (PUP.Optional.Wajam.A) -> No action taken.
HKLM\SOFTWARE\DomaIQ (PUP.Optional.DomaIQ.A) -> No action taken.
HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp (PUP.Optional.Wajam.A) -> No action taken.
HKLM\SOFTWARE\WAJAM (PUP.Optional.Wajam.A) -> No action taken.
HKLM\Software\Iminent (PUP.Optional.Iminent.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wajam (PUP.Optional.Wajam.A) -> No action taken.
HKLM\SOFTWARE\Boxore (Adware.Boxore) -> Quarantined and deleted successfully.

¡El Desaparecido! · Answer

No action taken.  You need to check everything and click on "delete selection"  You’ve earned the right to start over :(  -- Developer: UsbFix ## Webmaster: SosVirus As Birdy says -> People help the people

¡El Desaparecido! · Answer

Impeccable rikki :) ,

# Download AdwCleaner by Xplode to your desktop.
# Run AdwCleaner.exe.

# Right-click on it, run as administrator under Windows: 7/8 and Vista
# Choose the Scan option
# Choose the Clean option
# Accept the warning by clicking OK

# Once the scan is finished, a report will open. Post its content in your next response.
# The report is also saved under C:\AdwCleaner[S1].txt

Developer: UsbFix ## Webmaster: SosVirus
As Birdy said -> People help the people

Anonymous user · Answer

re,

restart ADWC, click on uninstall,

go through this:

* Download and save ZHPDiag on your desktop:

https://toolslib.net

or:

https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/

* Follow the installation guide; it will launch automatically at the end.

/!\Users of Vista, Seven, and W8:

* Right-click on the ZHPdiag logo, "run as Administrator"

=> The icon is shaped like a parchment.

* Click on configure, then on the magnifying glass + .

* Let the tool work, even if it seems stuck!

* Save the report on your Desktop using the icon that looks like a floppy disk
* Host the ZHPDiag.txt report on:
https://www.cjoint.com/ to read => https://www.commentcamarche.net/faq/29493-utiliser-cjoint-pour-heberger-des-fichiers

or
https://up2sha.re/
, then copy/paste the provided link in your next response on the forum

tutorial zhpdiag:

http://nicolascoolman.webs.com/tutorials.htm

--
O.o°*Member, CCM security Staff o°.Oø¤º°'°º¤ø
=>>Breathe deeply, write your message in proper French and clearly. It will go well, you’ll see, at least we will try!!! o°Oø

Anonymous user · Answer

* /!\ Warning /!\,
* this script is only valid for this PC, during the cleaning process, do not use it on another PC, risk of crashing!

* Launch ZHPFix via the shortcut on your Desktop, the icon looks like a syringe.

/!\Users of Vista, Seven and W8:

* Right-click on the ZHPfix logo, “run as Administrator”

Click on “import”

You will see a warning message appear, click Ok.

* * Copy ( Ctrl + C ) and paste ( Ctrl + V ) the following lines in bold into the Zhpfix window:
---------------------------------------------------------

Zhpfix Script
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Orphaned key
O42 - Software: Ask Toolbar - (.APN, LLC.) [HKLM] -- {4F524A2D-5637-006A-76A7-A758B70C0600}
[HKCU\Software\AskPartnerNetwork]
[HKLM\Software\AskPartnerNetwork]
O43 - CFD: 28/10/2013 - 11:08:19 - [8,034] ----D C:\Program Files\AskPartnerNetwork
O43 - CFD: 21/07/2013 - 02:20:38 - [0] ----D C:\ProgramData\APN
O43 - CFD: 28/10/2013 - 11:08:19 - [0,079] ----D C:\ProgramData\AskPartnerNetwork
O90 - PUC: "D2A425F47365A600677A7A857BC06000" . (.Ask Toolbar.) -- C:\Windows\Installer\{4F524A2D-5637-006A-76A7-A758B70C0600}\ToolbarIcon.exe
[MD5.E4EBA3E29DA9125A07DB0C7631D077B1] [WIS][15/10/2013] (.APN, LLC - Ask Toolbar.) -- C:\Windows\Installer\1e94ec.msi [465408]
SS - | Disabled 15/10/2013 166352 | (APNMCP) . (.APN LLC..) - C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4F524A2D-5637-006A-76A7-A758B70C0600}]
[HKCU\Software\AskPartnerNetwork]
[HKLM\Software\AskPartnerNetwork]
C:\Program Files\AskPartnerNetwork
C:\ProgramData\AskPartnerNetwork
C:\Windows\Installer\1e94ec.msi
O43 - CFD: 21/07/2013 - 02:20:35 - [0,047] ----D C:\Program Files\Uninstaller
[MD5.00000000000000000000000000000000] [APT] [{5DC9CCBF-9709-452E-85A9-AD259BE31593}] (...) -- C:\Users\titine\AppData\Local\Temp\Temp1_6305_Vista_Win7_PG537.zip\6305_Vista_PG537\setup.exe (.not file.) [0]
O53 - SMSR:HKLM\...\startupreg\NeroFilterCheck [Key] . (...) -- C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (.not file.)
O45 - LFCP:[MD5.6C38DE62443A3BEA29C3A6F5306CE6FE] - 08/03/2014 - 23:06:19 ---A- - C:\Windows\Prefetch\CACAOWEB.EXE-EC34E520.pf
C:\Users\titine\AppData\Local\Software
C:\Users\titine\Downloads\cacaoweb.exe
Firewallraz
EmptyPrefetch
ShortcutFix
Emptytemp
EmptyClsid

----------------------------------------------------------
- Click on the “GO” button to start the cleaning,
- confirm the cleaning
- Host the ZHPFIX.txt report on
https://www.cjoint.com/
or
https://up2sha.re/
then copy/paste the provided link in your next response on the forum.

Tutorial at the bottom of this page:
http://nicolascoolman.webs.com/tutorials.htm

--
O.o°*Member, Security Staff CCM o°.Oø¤º°'°º¤ø
=>>Breathe deeply, Write your message in good French and clearly. It will be fine, you’ll see, well we try!!! o°Oø

Anonymous user · Answer

great,

restart the PC and let me know how it's working and your files!

--
O.o°*Member, CCM security Staff o°.Oø¤º°'°º¤ø
=>>Take a deep breath, write your message in proper French and clearly. It will be fine, you'll see, well we're trying!!! o°Oø

Anonymous user · Answer

not cool,

use this to help me send a new report, but I am absent all day, wait for my return:

https://forums.commentcamarche.net/forum/affich-29842551-fichier-au-format-ink#42

@ +

--
O.o°*Member, CCM security staff o°.Oø¤º°'°º¤ø
=>>Breathe deeply, write your message in proper French and clearly. It's going to be fine, you'll see, well we're trying!!! o°Oø

Anonymous user · Answer

Apart from a few too many programs launching at startup, nothing infectious!

You have 1.5 GB of RAM, of which 50% is free,

Is your PC a laptop or a desktop?

--
O.o°*Member, Security Staff CCM o°.Oø¤º°'°º¤ø
=>>Take a deep breath, write your message in proper French and clearly. It will be fine, you’ll see, at least we’re trying!!! o°Oø

rikki-38 · Answer

My computer is a desktop PC.

Anonymous user · Answer

stop it,

unplug it,

just remove the cover, give it a quick clean inside without disassembling anything,

restart it to see!

--
O.o°*Member, Security Staff CCM o°.Oø¤º°'°º¤ø
=>>Breathe deeply, write your message in proper French and clearly. It will be fine, you’ll see, well we’ll try!!! o°Oø

Anonymous user · Answer

Restart the PC to see if it still lags,

it shouldn't!

otherwise, you'll need to check the unnecessary software that launches at Windows startup!

--
O.o°*Member, CCM security staff o°.Oø¤º°'°º¤ø
=>>Breathe deeply, write your message in proper French and clearly. It'll be fine, you'll see, well, we're trying!!! o°Oø

Anonymous user · Answer

what is the extension of these files?

there is a variant of infections that encodes the files and makes them unusable!

if you have this variant, 3 solutions:

=> you use an anti-cryptor, indicated at the bottom of this page:

https://www.bleepingcomputer.com/virus-removal/cryptorbit-ransomware-information

=> if you have important data, this service which seems to be paid:

http://support.drweb.fr/new/free_unlocker/no_service/?lng=fr

=> there is nothing to do, waiting for a tool to be developed!

--
O.o°*Member, Security Staff CCM o°.Oø¤º°'°º¤ø
=>> Breathe deeply, write your message in good French and clearly. It will be fine, you'll see, well we’ll try!!! o°Oø

Anonymous user · Answer

Host one of the files on Cjoint,

copy and paste its link in your next message!

I wonder if there’s a compatibility issue!

--
O.o°*Member, Security Staff CCM o°.Oø¤º°'°º¤ø
=>>Take a deep breath, write your message in proper French and clearly. It will be fine, you’ll see, well we’ll try!!! o°Oø

Anonymous user · Answer

try to compress the file and host it on cjoint,    -- O.o°*Member, Security Staff CCM o°.Oø¤º°'°º¤ø =>>Take a deep breath, write your message in proper French and clearly. It will be fine, you'll see, well we're trying !!! o°Oø

Anonymous user · Answer

do you have a file compression software?    -- O.o°*Member, Security Staff CCM o°.Oø¤º°'°º¤ø =>>Breathe deeply, write your message clearly and in proper French. It will be fine, you'll see, well, we’ll try!!! o°Oø

Anonymous user · Answer

ok,  the 3 compressed books, it's WinRAR!  right-click on one of the files, then select WinRAR (3 books), then add to archive "filename.zip  a file with the same name will be created on your desktop (if the original file is there), host it on cjoint and copy and paste its link in your next message!    -- O.o°*Member, CCM security staff o°.Oø¤º°'°º¤ø =>>Take a deep breath, write your message in good French and clearly. It'll be fine, you'll see, well we are trying!!! o°Oø

Anonymous user · Answer

Place the file in a directory that you will create and repeat the same operation to compress the directory to see!    -- O.o°*Member, CCM security staff o°.Oø¤º°'°º¤ø =>>Breathe deeply, write your message clearly and in proper French. It's going to be fine, you'll see, well, let's try !!! o°Oø

Anonymous user · Answer

yes!    -- O.o°*Member, CCM security staff o°.Oø¤º°'°º¤ø =>>Take a deep breath, write your message in proper French and clearly. It will be fine, you'll see, well we're trying!!! o°Oø

Anonymous user · Answer

You sent me a shortcut:  it points to a .VBS file and the real file that should be hidden!  Have you tried to show hidden files?    -- O.o°*Member, Security Staff CCM o°.Oø¤º°'°º¤ø =>>Take a deep breath, write your message in proper French and clearly. It's going to be okay, you'll see, well we try!!! o°Oø

Anonymous user · Answer

same, another shortcut!  try displaying hidden files to see if you can find your actual files!    -- O.o°*Member, CCM Security Staff o°.Oø¤º°'°º¤ø =>>Breathe deeply, write your message in proper French and clearly. It will be fine, you'll see, well we're trying!!! o°Oø

Anonymous user · Answer

look here :  https://www.commentcamarche.net/informatique/windows/185-afficher-les-extensions-et-les-fichiers-caches-sous-windows/  -- O.o°*Member, Security Staff CCM o°.Oø¤º°'°º¤ø =>>Take a deep breath, write your message in good French and clearly. It will be fine, you'll see, well we're trying !!! o°Oø

Anonymous user · Answer

Use this to recover your formatted files, maybe with a bit of luck, we will be able to recover the original files!    https://forum.pcastuces.com/recuperer_ses_donnees_avec_power_data_recovery-f3s10939.htm  Please note, since this is a trial version, you have the possibility to use it only 2 times!    -- O.o°*Member, CCM security staff o°.Oø¤º°'°º¤ø =>>Take a deep breath, write your message in proper French and clearly. It will be fine, you’ll see, at least we’ll try!!! o°Oø

Anonymous user · Answer

ok,  for unreadable files, there's nothing to be done!  for the Raw partition, whether it's a USB stick or a main partition of the PC, it's toast!  so hardware needs to be replaced!  as for the file names, if you can read them, you can always change them :D      -- O.o°*Member, CCM security staff o°.Oø¤º°'°º¤ø =>>Take a deep breath, write your message in proper French and clearly. It'll be fine, you'll see, well we're trying!!! o°Oø

sipherion · Answer

Since the beginning, you've been writing INK, but I'm sure it's LNK = Link in English = Shortcut in French...  In fact, you didn't copy the files correctly onto the USB stick. To copy the files correctly, you select them (try it first with 1), right-click, and look for Copy. Then you open your USB stick, right-click anywhere in the window, and click Paste.  -- "It's better to know how to search for everything than to try to know everything." "The Internet is actually an acronym for: Unpredictable Night Owl Carrying a Collection of Gossip and Eminently Trivial News"

Anonymous user · Answer

You've done quite a few operations with these files; in all the reports, I only see shortcuts!   The files should be there, but they're not!    Our friend's comment is quite good, worth reading:  https://forums.commentcamarche.net/forum/affich-29842551-fichier-au-format-ink?page=2#89   For the RAW partition, I've already given you the solution!   For the files you need, aside from finding a backup of the real files and not shortcuts, you have to start over and redo your file!    -- O.o°*Member, CCM Security Staff o°.Oø¤º°'°º¤ø =>> Breathe deeply, write your message in proper French and clearly. It'll be fine, you'll see; let's try!!! o°Oø

rikki-38 · Answer

Alright, thank you for your advice! I had copied my files from my Tab 2 to my USB stick! Unless I look for the files on my Tab 2, will they be recoverable even if I have formatted my Tab 2 (Samsung Galaxy Tab 2)????

sipherion · Answer

Oh no, after formatting you won't be able to recover them... You must always make sure you can exploit the files you've saved before formatting a device.  "It's better to know how to search for everything than to try to know everything." "The Internet is actually an acronym for: Unpredictable Night Owl Carrying a Collection of Gossip and Eminently Trivial News."

Anonymous user · Answer

what an idea to constantly format tablets and USB drives!  run this tool on your tab2, it may be possible to recover them:  https://forum.pcastuces.com/recuperer_ses_donnees_avec_power_data_recovery-f3s10939.htm  but we'll see ...    -- O.o°*Member, CCM security staff o°.Oø¤º°'°º¤ø =>>Breathe deeply, write your message in proper French and clearly. It's going to be okay, you'll see, well at least we hope so!!! o°Oø

Anonymous user · Answer

just a clarification,  connect your tab 2 to your PC because the software is only compatible with Windows!    -- O.o°*Member, Security Staff CCM o°.Oø¤º°'°º¤ø =>>Take a deep breath, write your message in proper French and clearly. It's going to be fine, you’ll see, well we’ll try!!! o°Oø

Anonymous user · Answer

ok,  we'll see if there are any usable things!    -- O.o°*Member, CCM security staff o°.Oø¤º°'°º¤ø =>>Breathe deeply, write your message in proper French and clearly. It will be fine, you'll see, well, we’ll try!!! o°Oø

Anonymous user · Answer

Attention, the use of the software is limited because it's a demo version!    -- O.o°*Member, CCM Security Staff o°.Oø¤º°'°º¤ø =>>Breathe deeply, write your message in proper French and clearly. It will be fine, you'll see, well we're trying!!! o°Oø

sipherion · Answer

Otherwise, I found a technique specific to Galaxy Tab, a link that I have been desperately trying to post for a while now, but the CCM bot keeps telling me no!  https://www.nextpit.fr/forum/559659/samsung-galaxy-tab-2-7-0-recuperation-fichier  Normally, the first link is in the first reply.  -- "It’s better to know how to search for everything than to try to know everything." "Internet is actually an acronym for: Unpredictable Night Owl Carrying an Ensemble of Gossip and Some Eminently Trivial News"

Anonymous user · Answer

Transfer the file found on your PC without opening it,  then upload it to VirusTotal:  https://www.virustotal.com/gui/  wait for the scan to finish, once the report is generated, copy and paste its link in your next message     -- O.o°*Member, CCM security staff o°.Oø¤º°'°º¤ø =>>Breathe deeply, write your message in proper French and clearly. It'll be fine, you’ll see, well we’ll try!!! o°Oø

Anonymous user · Answer

In general, the files you sent are still on your PC, unless you deleted them!   You can find them in the recycle bin if that's the case!   For the file you just sent me, it’s not about infections:  https://www.virustotal.com/gui/file/3bc1535d6d37b553e8cb49fbe56e5b96eeda945b0a57fbfabbf5f2ee80c92609    -- O.o°*Member, Security Staff CCM o°.Oø¤º°'°º¤ø =>>Breathe deeply, write your message in proper French and clearly. It will be fine, you’ll see, we’re trying!!! o°Oø

Anonymous user · Answer

I think the file associations have been lost!  Pass this to restore the file associations:  http://general-changelog-team.fr/fr/downloads/viewdownload/20-outils-de-xplode/15-rstassociations-version-exe    -- O.o°*Member, CCM security staff o°.Oø¤º°'°º¤ø =>> Breathe deeply, write your message in proper French and clearly. It's going to be fine, you'll see, at least we're trying!!! o°Oø

Anonymous user · Answer

Yes, but you only kept shortcuts, not the original files!   So, and since you formatted the key and your tablet, everything has gone down the drain with the partition switching to RAW!   You've accumulated everything until now, but we need to stay positive and start fresh with a clean slate :-)    -- O.o°*Member, CCM Security Staff o°.Oø¤º°'°º¤ø =>>Take a deep breath, write your message in proper French and clearly. It's going to be alright, you'll see, well, we're trying!!! o°Oø

rikki-38 · Answer

Are you kidding me??!! I wasted 4 days messing around on my computer while I was on vacation, a vacation I needed to unwind, but I thought THAT EVERY PROBLEM HAS A SOLUTION! But no, I did all this for nothing!! And in the end, I lost files! And you tell me "you have to stay positive and start fresh with a clean slate"?

Anonymous user · Answer

Do I look like I'm joking?   Just know that during these 4 days, I accompanied you as best as I could instead of spending my vacation strolling and enjoying the sunshine and nice weather!   If I'm telling you to stay positive, it's for a reason!   In IT, every problem has a solution, but that solution also has its limits! That's what I tried to bring you during all this time!   I don't know where your key picked up this thing, but it not only damaged your system, but you've also lost almost all your data!   For your system, we need to check if the PC itself is working properly!   I still don't know if this whole event is related to your Tab 2 tablet!   But since you've reinstalled everything, it's hard to find a solution that leads to something concrete!    -- O.o°*Member, CCM Security Staff o°.Oø¤º°'°º¤ø =>>Take a deep breath, write your message in good French and clearly. It's going to be fine, you'll see, at least we're trying!!! o°Oø

Anonymous user · Answer

I'm sorry, my friend, but as I said, we can fix some things, but not everything!  As for the mechanic, I don't know if he'll do better than an electrician! :lol:    -- O.o°*Member, CCM security staff o°.Oø¤º°'°º¤ø =>>Take a deep breath, write your message in proper French and clearly. It'll be fine, you'll see, well, we’ll try!!! o°Oø

Anonymous user · Answer

The mechanic wasn't any more effective than me, as far as I can see :P Right-click on one of the files, properties, previous version to see if it finds anything to restore your files! Otherwise, I'll give you a software to recover all the deleted data on the PC, but be careful, the file names are not what you assigned to them! -- =>> Take a deep breath, write your message in good French and clearly. It'll be alright, you'll see, well, let's give it a try!!! o°Oø

Anonymous user · Answer

Look here: https://forum.pcastuces.com/recuperer_ses_donnees_avec_power_data_recovery-f3s10939.htm The software is in English, it works a bit like Recuva, but it's different! This is a trial version but already, it allows you to recover a lot :-) The only problem is that it sorts files by extension and a different name than the one you gave to the original files! This software recovers files even if your PC has been reformatted! -- =>> Breathe deeply, write your message in proper French and clearly. It will be fine, you'll see, well, let's try!!! o°Oø

Anonymous user · Answer

He must have found both backups and the original file; did you check to see if you have a backup in the files? -- =>>Take a deep breath, write your message in proper French and clearly. It'll be fine, you'll see; well, we'll try!!! o°Oø

Anonymous user · Answer

connect your tablet to your PC if you can like a mass storage device (like USB), then launch the tool specifying the location of your tablet to try to recover it! this is our last chance! -- =>> Breathe deeply, write your message clearly in good French. It will be fine, you’ll see, well we're trying!!! o°Oø

Anonymous user · Answer

I can't read it either! Which version of Office did you create them with? -- =>>Breathe deeply, write your message in proper French and clearly. It's going to be alright, you'll see, or at least we’ll try!!! o°Oø

Anonymous user · Answer

Are the files compatible between your software and your version of Office? -- =>> Breathe deeply, write your message in proper French and clearly. It's going to be fine, you'll see, well we're trying!!! o°Oø

Anonymous user · Answer

if in the retrieved files, you do not find your file, nor a backup, there is nothing left to do, you will have to start all over again (to recreate the file)! -- =>>Take a deep breath, write your message in proper French and clearly. It will be fine, you will see, we will try!!! o°Oø

Anonymous user · Answer

Hello, before we part ways, you need to follow these steps: Download Delfix to your desktop: HERE or Check the following boxes: => Reactivate UAC (only for Vista, Seven, and W8) => Remove disinfection tools (checked by default) => Purge system restore * Then click on Run and wait during the removal process. * Once the procedures are completed, the tool will close and disappear from the desktop * A report is saved to the clipboard: you just need to right-click and "paste" in your next reply to send me the report ** the report is saved at this location: C:\DelFix.txt Warning: The report is unique and is deleted each time one or more options of DelFix are re-executed. * update your antivirus, run a full scan of your pc, and keep me posted on the result :-) -- =>>Take a deep breath, write your message in good French and clearly. It will be fine, you'll see, well we're trying!!! o°Oø

Anonymous user · Answer

* Update your antivirus, run a full scan of your PC, keep me posted on the results :-) -- =>> Breathe deeply, write your message in proper French and clearly. It will be fine, you'll see, well we're trying !!! o°Oø

Anonymous user · Answer

super :D on that note, good luck :D -- =>> Breathe deeply, write your message in good French and clearly. It'll be fine, you'll see, well we're giving it a try!!! o°Oø

File in .Ink format

56 answers

Self-invoking js function

Texture issues in enshrouded

My pc won’t charge anymore and runs super slowly

Download software against mcafee pop-ups

My computer stays connected for very little time

Unable to open xsl and xslx files

Archival hard drive no longer appears in file explorer

Samsung wallet

How to pair a receiver with an external speaker without fi

The black swift flies for 10 months in a row without interruption