Log hijackthis PC vérolé
Résolu
Bonjour,
Mon Pc est bien pourri, je suis perdu.je lance un sos.
Merci de votre cordialité.
Mon log Hijackthis
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 22:27:43, on 06/07/2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17126)
FIREFOX: 29.0.1 (pt-BR)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files\fst_br_152\fst_br_152.exe
C:\Users\DENIS\AppData\Local\Facebook\Update\FacebookUpdate.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\OEM\i-CO2 v1.0\i-CO2.exe
C:\Program Files\OEM\IPM 1.6\IPM.exe
C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
C:\Program Files\OEM\OSD 1.7\SunflowerOSD.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Users\DENIS\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files\MyPC Backup\MyPC Backup.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
C:\Windows\system32\taskeng.exe
C:\Users\DENIS\Downloads\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1402946301&from=tugs&uid=TOSHIBAXMK5059GSXP_61PYT0ZWTXX61PYT0ZWT
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=ds&ts=1402946301&from=tugs&uid=TOSHIBAXMK5059GSXP_61PYT0ZWTXX61PYT0ZWT&q={searchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=ds&ts=1402946301&from=tugs&uid=TOSHIBAXMK5059GSXP_61PYT0ZWTXX61PYT0ZWT&q={searchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hp&ts=1402946301&from=tugs&uid=TOSHIBAXMK5059GSXP_61PYT0ZWTXX61PYT0ZWT
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1402946301&from=tugs&uid=TOSHIBAXMK5059GSXP_61PYT0ZWTXX61PYT0ZWT
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=ds&ts=1402946301&from=tugs&uid=TOSHIBAXMK5059GSXP_61PYT0ZWTXX61PYT0ZWT&q={searchTerms}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=ds&ts=1402946301&from=tugs&uid=TOSHIBAXMK5059GSXP_61PYT0ZWTXX61PYT0ZWT&q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hp&ts=1402946301&from=tugs&uid=TOSHIBAXMK5059GSXP_61PYT0ZWTXX61PYT0ZWT
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:64215;https=127.0.0.1:64215
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <-loopback>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll
O2 - BHO: 2rs3 - {10AD2C61-0898-4348-8600-14A342F22AC3} - C:\Program Files\SupraSavings\2rs3.dll
O2 - BHO: CrossriderApp0058488 - {11111111-1111-1111-1111-110511841188} - C:\Program Files\Mediaa_Play_AIR_1.4\Mediaa_Play_AIR_1.4-bho.dll
O2 - BHO: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files\SupTab\SupTab.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: G-Buster Browser Defense Itaú Unibanco - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\Program Files\GbPlugin\gbiehuni.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AutorunReload] Autoload.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [LXBUCATS] rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [fst_br_152] "C:\Program Files\fst_br_152\fst_br_152.exe"
O4 - HKLM\..\RunOnce: [upfst_br_152.exe] C:\Users\DENIS\AppData\Local\fst_br_152\upfst_br_152.exe -runonce
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\DENIS\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil32_13_0_0_214_Plugin.exe -update plugin
O4 - Startup: Dropbox.lnk = DENIS\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Startup: MyPC Backup.lnk = C:\Program Files\MyPC Backup\MyPC Backup.exe
O4 - Startup: Recorte de tela e Iniciador do OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: i-CO2.lnk = ?
O4 - Global Startup: IPM.lnk = ?
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
O4 - Global Startup: OSD.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: bankline.itau.com.br
O15 - Trusted Zone: clickbanking.itau.com.br
O15 - Trusted Zone: guardiao.itau.com.br
O15 - Trusted Zone: www.itau.com.br
O15 - Trusted Zone: http://www.itau.com.br
O15 - Trusted Zone: *.itau.com.br
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\PROGRA~1\SupTab\SEARCH~1.DLL
O20 - Winlogon Notify: GbPluginUni - C:\Program Files\GbPlugin\gbiehUni.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Computer Backup (MyPC Backup) (BackupStack) - Just Develop It - C:\Program Files\MyPC Backup\BackupStack.exe
O23 - Service: buuoujqmrk32 - Unknown owner - C:\Program Files\003\buuoujqmrk32.exe
O23 - Service: Gbp Service (GbpSv) - GAS Tecnologia - C:\PROGRA~1\GbPlugin\GbpSv.exe
O23 - Service: globalUpdate Update Service (globalUpdate) (globalUpdate) - globalUpdate - C:\Program Files\globalUpdate\Update\GoogleUpdate.exe
O23 - Service: globalUpdate Update Service (globalUpdatem) (globalUpdatem) - globalUpdate - C:\Program Files\globalUpdate\Update\GoogleUpdate.exe
O23 - Service: Serviço do Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IePlugin Services (IePluginServices) - Cherished Technololgy LIMITED - C:\ProgramData\IePluginServices\PluginService.exe
O23 - Service: lxbu_device - - C:\Windows\system32\lxbucoms.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NewPlayer Updater Service (NewPlayerUpdaterService) - Unknown owner - C:\Program Files\NewPlayer\NewPlayerUpdaterService.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\stlang.dll,-10102 (STacSV) - IDT, Inc. - C:\Program Files\IDT\WDM\STacSV.exe
O23 - Service: Wajam Internet Enhancer Service - Wajam Internet Technologies Inc. - C:\Program Files\Wajam\Wajam Internet Enhancer\WajamInternetEnhancerService.exe
O23 - Service: WindowsProtectManger Service (WindowsProtectManger) - Fuyu LIMITED - C:\ProgramData\WindowsProtectManger\wprotectmanager.exe
--
End of file - 11535 bytes
Mon Pc est bien pourri, je suis perdu.je lance un sos.
Merci de votre cordialité.
Mon log Hijackthis
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 22:27:43, on 06/07/2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17126)
FIREFOX: 29.0.1 (pt-BR)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files\fst_br_152\fst_br_152.exe
C:\Users\DENIS\AppData\Local\Facebook\Update\FacebookUpdate.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\OEM\i-CO2 v1.0\i-CO2.exe
C:\Program Files\OEM\IPM 1.6\IPM.exe
C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
C:\Program Files\OEM\OSD 1.7\SunflowerOSD.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Users\DENIS\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files\MyPC Backup\MyPC Backup.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
C:\Windows\system32\taskeng.exe
C:\Users\DENIS\Downloads\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1402946301&from=tugs&uid=TOSHIBAXMK5059GSXP_61PYT0ZWTXX61PYT0ZWT
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=ds&ts=1402946301&from=tugs&uid=TOSHIBAXMK5059GSXP_61PYT0ZWTXX61PYT0ZWT&q={searchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=ds&ts=1402946301&from=tugs&uid=TOSHIBAXMK5059GSXP_61PYT0ZWTXX61PYT0ZWT&q={searchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hp&ts=1402946301&from=tugs&uid=TOSHIBAXMK5059GSXP_61PYT0ZWTXX61PYT0ZWT
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1402946301&from=tugs&uid=TOSHIBAXMK5059GSXP_61PYT0ZWTXX61PYT0ZWT
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=ds&ts=1402946301&from=tugs&uid=TOSHIBAXMK5059GSXP_61PYT0ZWTXX61PYT0ZWT&q={searchTerms}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=ds&ts=1402946301&from=tugs&uid=TOSHIBAXMK5059GSXP_61PYT0ZWTXX61PYT0ZWT&q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hp&ts=1402946301&from=tugs&uid=TOSHIBAXMK5059GSXP_61PYT0ZWTXX61PYT0ZWT
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:64215;https=127.0.0.1:64215
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <-loopback>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll
O2 - BHO: 2rs3 - {10AD2C61-0898-4348-8600-14A342F22AC3} - C:\Program Files\SupraSavings\2rs3.dll
O2 - BHO: CrossriderApp0058488 - {11111111-1111-1111-1111-110511841188} - C:\Program Files\Mediaa_Play_AIR_1.4\Mediaa_Play_AIR_1.4-bho.dll
O2 - BHO: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files\SupTab\SupTab.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: G-Buster Browser Defense Itaú Unibanco - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\Program Files\GbPlugin\gbiehuni.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AutorunReload] Autoload.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [LXBUCATS] rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [fst_br_152] "C:\Program Files\fst_br_152\fst_br_152.exe"
O4 - HKLM\..\RunOnce: [upfst_br_152.exe] C:\Users\DENIS\AppData\Local\fst_br_152\upfst_br_152.exe -runonce
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\DENIS\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil32_13_0_0_214_Plugin.exe -update plugin
O4 - Startup: Dropbox.lnk = DENIS\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Startup: MyPC Backup.lnk = C:\Program Files\MyPC Backup\MyPC Backup.exe
O4 - Startup: Recorte de tela e Iniciador do OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: i-CO2.lnk = ?
O4 - Global Startup: IPM.lnk = ?
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
O4 - Global Startup: OSD.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: bankline.itau.com.br
O15 - Trusted Zone: clickbanking.itau.com.br
O15 - Trusted Zone: guardiao.itau.com.br
O15 - Trusted Zone: www.itau.com.br
O15 - Trusted Zone: http://www.itau.com.br
O15 - Trusted Zone: *.itau.com.br
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\PROGRA~1\SupTab\SEARCH~1.DLL
O20 - Winlogon Notify: GbPluginUni - C:\Program Files\GbPlugin\gbiehUni.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Computer Backup (MyPC Backup) (BackupStack) - Just Develop It - C:\Program Files\MyPC Backup\BackupStack.exe
O23 - Service: buuoujqmrk32 - Unknown owner - C:\Program Files\003\buuoujqmrk32.exe
O23 - Service: Gbp Service (GbpSv) - GAS Tecnologia - C:\PROGRA~1\GbPlugin\GbpSv.exe
O23 - Service: globalUpdate Update Service (globalUpdate) (globalUpdate) - globalUpdate - C:\Program Files\globalUpdate\Update\GoogleUpdate.exe
O23 - Service: globalUpdate Update Service (globalUpdatem) (globalUpdatem) - globalUpdate - C:\Program Files\globalUpdate\Update\GoogleUpdate.exe
O23 - Service: Serviço do Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IePlugin Services (IePluginServices) - Cherished Technololgy LIMITED - C:\ProgramData\IePluginServices\PluginService.exe
O23 - Service: lxbu_device - - C:\Windows\system32\lxbucoms.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NewPlayer Updater Service (NewPlayerUpdaterService) - Unknown owner - C:\Program Files\NewPlayer\NewPlayerUpdaterService.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\stlang.dll,-10102 (STacSV) - IDT, Inc. - C:\Program Files\IDT\WDM\STacSV.exe
O23 - Service: Wajam Internet Enhancer Service - Wajam Internet Technologies Inc. - C:\Program Files\Wajam\Wajam Internet Enhancer\WajamInternetEnhancerService.exe
O23 - Service: WindowsProtectManger Service (WindowsProtectManger) - Fuyu LIMITED - C:\ProgramData\WindowsProtectManger\wprotectmanager.exe
--
End of file - 11535 bytes
14 réponses
-
ModérateurBonjour,
--> Télécharge et lance AdwCleaner (d'Xplode), choisis l'option "Scanner".
--> Une fois le scan terminé, choisis l'option "Nettoyer".
--> Redémarre le PC comme demandé, héberge le rapport sur pjjoint.malekal.com puis copie-colle le lien donné par le site dans ta réponse. Le rapport est enregistré dans C:\AdwCleaner sous le nom d'AdwCleaner[s?]. -
Modérateur--> Télécharge ZHPDiag (de Nicolas Coolman).
--> Double-clique sur le fichier d'installation. Installe ZHPDiag avec les paramètres par défaut (laisse "Créer une icône sur le Bureau" coché).
--> Lance ZHPDiag en double-cliquant sur le raccourci présent sur ton Bureau.
--> Clique sur "Complet".
--> Une fois le scan terminé, un rapport est créé sur le Bureau.
--> Héberge-le sur pjjoint.malekal.com puis copie-colle le lien donné par le site dans ton prochain message. -
ModérateurOn a supprimé pas mal d'adwares. Le PC fonctionne correctement ?
Réutilise ZHPFix avec le script suivant :
Script ZHPFix
SysRestore
C:\Users\DENIS\AppData\Local\Google\Chrome\User Data\Default\Preferences
EmptyFlash
EmptyTemp -
http://pjjoint.malekal.com/files.php?id=20140707_w15u14y5p7i11
-
http://pjjoint.malekal.com/files.php?id=20140707_b10e9c9l7f10
-
Modérateur--> Désinstalle McAfee Security Scan Plus.
--> Copie tout le texte présent en gras ci-dessous (Sélectionne-le, clique droit dessus et choisis "Copier").
Script ZHPFix
SysRestore
ProxyFix
G2 - GCE: Preference [User Data\Default] [mfhkgfigejkhikbkfkkglinnkfojkdek] Clock View v.0.1 (Activé)
G2 - EXT: C:\Users\DENIS\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfhkgfigejkhikbkfkkglinnkfojkdek [Clock View]
[MD5.00000000000000000000000000000000] [APT] [{93000727-04CE-43D1-8902-C109F9B9D348}] (...) -- C:\Users\DENIS\AppData\Roaming\webssearches\UninstallManager.exe (.not file.) [0]
[HKLM\Software\F978377C-B7D4-4536-8E10-14CA97B13394]
O43 - CFD: 16/06/2014 - 16:20:22 - [] ----D C:\Users\DENIS\AppData\Local\com
O45 - LFCP:[MD5.099CB74AA05121D93599658363AE0664] - 16/06/2014 - 22:00:25 ---A- - C:\Windows\Prefetch\MEDIAA_PLAY_AIR_1.4-BG.EXE-CA58726F.pf =>PUP.CrossRider
O45 - LFCP:[MD5.11A3F49F5D9AE9EDB8D6F172B54C43FF] - 06/07/2014 - 22:21:02 ---A- - C:\Windows\Prefetch\MEDIAA_PLAY_AIR_1.4-CODEDOWNL-68B583F4.pf =>PUP.CrossRider
O45 - LFCP:[MD5.31F399C06A0AB5EB0906100025219794] - 07/07/2014 - 01:21:10 ---A- - C:\Windows\Prefetch\MEDIAA_PLAY_AIR_1.4-NOVA.EXE-D5E04A86.pf =>PUP.CrossRider
O45 - LFCP:[MD5.52989B947D53397013EB751C782FFED1] - 06/07/2014 - 22:21:06 ---A- - C:\Windows\Prefetch\MEDIAA_PLAY_AIR_1.4-NOVAINSTA-36FACED4.pf =>PUP.CrossRider
O45 - LFCP:[MD5.9223576C823AF9B981E92611DB880614] - 06/07/2014 - 22:12:53 ---A- - C:\Windows\Prefetch\MYPC BACKUP.EXE-E64F9341.pf =>PUP.MyPCBackup
O45 - LFCP:[MD5.C466B90C86444BBA4AD16F8F80B44769] - 07/07/2014 - 01:19:13 ---A- - C:\Windows\Prefetch\SPEEDUPMYPC.EXE-FD673F29.pf =>PUP.SpeedUpMyPC
O45 - LFCP:[MD5.5AF8451349625D397CF474C1A9A6722B] - 07/07/2014 - 01:15:28 ---A- - C:\Windows\Prefetch\WAJAMINTERNETENHANCER.EXE-ABC59711.pf =>PUP.Wajam
O45 - LFCP:[MD5.C06CDAC82FD239844BD3CCEF0EC37DC9] - 07/07/2014 - 01:18:32 ---A- - C:\Windows\Prefetch\WAJAMINTERNETENHANCERSERVICE.-7F27393E.pf =>PUP.Wajam
O90 - PUC: "8B501B6E56F182443979D1DFA8309BD4" . (.SupraSavings.) -- c:\Windows\Installer\{E6B105B8-1F65-4428-9397-1DFD8A03B94D}\icon64.ico
[MD5.9D0767859EE938C0C4FAC30693109843] [WIS][16/06/2014] (.SupraSavings - SupraSavings.) -- C:\Windows\Installer\9741ecb.msi [3162112]
C:\Windows\Installer\9741ecb.msi
EmptyCLSID
EmptyFlash
EmptyTemp
--> Lance ZHPFix depuis le raccourci situé sur ton Bureau.
--> Clique sur le bouton IMPORTER. Dans l'encadré principal, tu verras les lignes que tu as copié précédemment apparaître.
--> Clique sur GO et confirme pour lancer le nettoyage. Laisse l'outil travailler et ne touche à rien.
--> Une fois terminé, héberge le rapport sur pjjoint.malekal.com puis copie-colle le lien dans ton prochain message. -
http://pjjoint.malekal.com/files.php?id=20140707_s8x6f8b6p6
-
ModérateurPlus de souci ?
Je voudrais un nouveau rapport ZHPDiag (pour vérifier). -
J'espère que tout est cool. Je suis incapable de le dire moi même. s-)
Je t'envois le lien du dernier rapport demander.
http://pjjoint.malekal.com/files.php?id=20140707_k8w11z14m13y12 -
Oui ça a l'air de rouler normallement.
le rapport
http://pjjoint.malekal.com/files.php?id=20140707_r10p10v10h11y14 -
ModérateurPour finir :
1/
---> Télécharge et installe CCleaner.
* Lance-le. Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers temporaires de Windows datant de plus de 24 heures.
* Va dans Nettoyeur, choisis Analyse. Une fois terminé, lance le nettoyage.
2/
---> Télécharge DelFix sur ton Bureau puis lance-le.
* Coche Purger la restauration système et laisse Supprimer les outils de désinfection coché.
* Clique sur Exécuter.
* Poste le rapport.
==Prévention==
Mets à jour Adobe Reader (décoche McAfee Security Scan Plus).
Mets à jour Adobe Flash Player (décoche aussi McAfee Security Scan Plus).
Désinstalle Java 7 Update 55 et installe la dernière version :
https://www.java.com/fr/download/manual.jsp
Malwarebytes' Anti-Malware est pratique en cas d'infection :
https://www.commentcamarche.net/telecharger/securite/14361-malwarebytes-anti-malware/
Un dossier sur la prévention et sécurité sur Internet est disponible ici. -
Removido : C:\AdwCleaner
Removido : C:\Users\DENIS\AppData\Roaming\ZHP
Removido : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP
Removido : C:\Program Files\ZHPDiag
Removido : C:\PhysicalDisk0_MBR.bin
Removido : C:\Users\DENIS\Desktop\AdwCleaner[R0]scan.txt
Removido : C:\Users\DENIS\Desktop\ZHPDiag.lnk
Removido : C:\Users\DENIS\Desktop\ZHPDiag.txt
Removido : C:\Users\DENIS\Desktop\ZHPFix.lnk
Removido : C:\Users\DENIS\Desktop\ZHPFixReport.txt
Removido : C:\Users\DENIS\Downloads\adwcleaner_3.214.exe
Removido : C:\Users\DENIS\Downloads\HijackThis.exe
Removido : C:\Users\DENIS\Downloads\hijackthis.log
Removido : C:\Users\DENIS\Downloads\ZHPDiag2.exe
Removido : HKLM\SOFTWARE\AdwCleaner
Removido : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1
~ Limpando pontos da restauração do sistema ...
Removido : RP #210 [Ponto de Verificação Agendado | 05/28/2014 10:50:01]
Removido : RP #211 [Windows Update | 05/30/2014 09:23:40]
Removido : RP #212 [Windows Update | 06/03/2014 13:42:58]
Removido : RP #213 [Windows Update | 06/10/2014 11:28:53]
Removido : RP #214 [Windows Update | 06/12/2014 10:34:27]
Removido : RP #216 [Uniblue SpeedUpMyPC installation | 06/16/2014 19:18:07]
Removido : RP #217 [Windows Update | 06/17/2014 08:23:40]
Removido : RP #218 [Windows Update | 07/07/2014 01:20:43]
Removido : RP #220 [ZHPFix Restore System Point | 07/07/2014 15:58:44]
Removido : RP #222 [ZHPFix Restore System Point | 07/07/2014 19:42:54]
Novo ponto de restauração criado !
########## - EOF - ########## -
ModérateurOk pour DelFix.
Bonne soirée / nuit / journée ;) -
http://pjjoint.malekal.com/files.php?id=20140712_z7x13f12w12i6
merci pour tout
