PC infecté, publicités intempestives : FlashBeat, Xtab, SmartWeb

Résolu
girfred Messages postés 17 Date d'inscription   Statut Membre Dernière intervention   -  
Malekal_morte- Messages postés 180304 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   -
Bonjour à tous,

Le Pc portable de mes beaux parents est infecté par un truc que je n'arrive pas à supprimer. Je pense que c'est FlashBeat mais je n'en suis pas certain. La naviguation sur le net est infernale.

Merci à ceux voudront bien m'aider.
A voir également:

21 réponses

  • 1
  • 2
Réponse 1 / 21
Malekal_morte- Messages postés 180304 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 685
 
Salut,

Suis ce tutoriel FRST: https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/
(et bien prendre le temps de lire afin d'appliquer correctement - tout y est expliqué).
Télécharge et lance le scan FRST, cela va générer trois rapports FRST :
  • FRST.txt
  • Shortcut.txt
  • Additionnal.txt


Envoie, comme expliqué, ces trois rapports sur le site http://pjjoint.malekal.com et en retour donne les trois liens pjjoint qui mènent à ses rapports ici dans une nouvelle réponse afin que l'on puisse les consulter.




0
Réponse 2 / 21
girfred Messages postés 17 Date d'inscription   Statut Membre Dernière intervention  
 
Salut,

Merci pour ton aide.
Ci-dessous les trois


https://pjjoint.malekal.com/files.php?id=20150404_y6m8o13m9t5
https://pjjoint.malekal.com/files.php?id=20150404_h7w9q1214c8
https://pjjoint.malekal.com/files.php?id=FRST_20150404_l13g11g10b11g10
0
Réponse 3 / 21
Malekal_morte- Messages postés 180304 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 685
 
Tu as installé des adwares et programmes parasites sur ton PC qui ouvrent des publicités et ralentissent l'ordinateur et les navigateurs WEB.
Voici la procédure à suivre pour les supprimer :

Commence par ceci :

Suis le tutorial AdwCleaner https://www.malekal.com/adwcleaner-supprimer-virus-adwares-pup/?t=33839&start= ( d'Xplode )
Télécharge le sur ton bureau ou dossier de téléchargement.
Lance AdwCleaner, clique sur [Scanner].
L'analyse peux durer plusieurs minutes, patiente.
Une fois le scan terminé, ne décoche rien, clique sur [Nettoyer]

Une fois le nettoyage terminé, un rapport s'ouvrira. Copie/colle le contenu du rapport dans ta prochaine réponse par un copier/coller.
Si cela ne fonctionne pas, utilise le site http://pjjoint.malekal.com pour héberger le rapport, donne le lien du rapport dans un nouveau message.

Note : Le rapport est également sauvegardé sous C:\AdwCleaner[S1].txt


0
Réponse 4 / 21
girfred Messages postés 17 Date d'inscription   Statut Membre Dernière intervention  
 
Bien enfin c'est fait, la navigation est vraiment pénible! Ci-dessous le rapport.

# AdwCleaner v4.200 - Rapport créé le 04/04/2015 à 22:50:23
# Mis à jour le 29/03/2015 par Xplode
# Base de données : 2015-03-29.1 [Serveur]
# Système d'exploitation : Windows 7 Home Premium Service Pack 1 (x64)
# Nom d'utilisateur : Françoise - FRANÇOISE-HP
# Exécuté depuis : C:\Users\Françoise\Downloads\adwcleaner_4.200.exe
# Option : Nettoyer
          • [ Services ] *****


Service Supprimé : CltMngSvc
[#] Service Supprimé : Gambali
[#] Service Supprimé : globalUpdate
[#] Service Supprimé : globalUpdatem
Service Supprimé : netfilter64
Service Supprimé : Orbiter
Service Supprimé : ServiceEverything
[#] Service Supprimé : pfnfd_1_10_0_9
[#] Service Supprimé : qrnfd_1_10_0_9
          • [ Fichiers / Dossiers ] *****


Dossier Supprimé : C:\TVWizard
Dossier Supprimé : C:\HealthAlert
Dossier Supprimé : C:\ProgramData\Browser
Dossier Supprimé : C:\ProgramData\ParetoLogic
Dossier Supprimé : C:\ProgramData\PicRec
Dossier Supprimé : C:\ProgramData\PriceMeterLiveUpdate
Dossier Supprimé : C:\ProgramData\systemk
Dossier Supprimé : C:\ProgramData\WindowsMangerProtect
Dossier Supprimé : C:\ProgramData\WPM
Dossier Supprimé : C:\ProgramData\YTAHelper
Dossier Supprimé : C:\ProgramData\IHProtectUpDate
Dossier Supprimé : C:\ProgramData\FlashBeat
Dossier Supprimé : C:\ProgramData\CoolSaleCuouppoon
Dossier Supprimé : C:\ProgramData\dEalpeaak
Dossier Supprimé : C:\ProgramData\WOwCouponn
Dossier Supprimé : C:\ProgramData\6eb9994600007367
Dossier Supprimé : C:\ProgramData\a06c590c1f809607
Dossier Supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Flash Player Pro
Dossier Supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverRestore
Dossier Supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GAMESDESKTOP
Dossier Supprimé : C:\Program Files (x86)\AnyProtectEx
Dossier Supprimé : C:\Program Files (x86)\Boxore
Dossier Supprimé : C:\Program Files (x86)\Easy Speed Check
Dossier Supprimé : C:\Program Files (x86)\Flash Player Pro
Dossier Supprimé : C:\Program Files (x86)\globalUpdate
Dossier Supprimé : C:\Program Files (x86)\ParetoLogic
Dossier Supprimé : C:\Program Files (x86)\PC Speed Maximizer
Dossier Supprimé : C:\Program Files (x86)\PicRec
Dossier Supprimé : C:\Program Files (x86)\predm
Dossier Supprimé : C:\Program Files (x86)\Probit Software
Dossier Supprimé : C:\Program Files (x86)\SearchProtect
Dossier Supprimé : C:\Program Files (x86)\Settings Manager
Dossier Supprimé : C:\Program Files (x86)\Smart Driver Updater
Dossier Supprimé : C:\Program Files (x86)\WinZipper
Dossier Supprimé : C:\Program Files (x86)\DriverRestore
Dossier Supprimé : C:\Program Files (x86)\ORBTR
Dossier Supprimé : C:\Program Files (x86)\EZ Software Updater
Dossier Supprimé : C:\Program Files (x86)\XTab
Dossier Supprimé : C:\Program Files (x86)\igs
Dossier Supprimé : C:\Program Files (x86)\QuickRef_1.10.0.9
Dossier Supprimé : C:\Program Files (x86)\CoolSaleCuouppoon
Dossier Supprimé : C:\Program Files (x86)\dEalpeaak
Dossier Supprimé : C:\Program Files (x86)\WOwCouponn
Dossier Supprimé : C:\Program Files (x86)\gmsd_fr_373
Dossier Supprimé : C:\Program Files (x86)\gmsd_fr_379
Dossier Supprimé : C:\Program Files (x86)\Common Files\ParetoLogic
Dossier Supprimé : C:\Windows\Microsoft\sogr
Dossier Supprimé : C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Infigo
Dossier Supprimé : C:\Program Files\002
Dossier Supprimé : C:\Program Files\003
Dossier Supprimé : C:\Program Files\shopperz
Dossier Supprimé : C:\Users\Françoise\AppData\Local\Boxore
Dossier Supprimé : C:\Users\Françoise\AppData\Local\Genesis
Dossier Supprimé : C:\Users\Françoise\AppData\Local\globalUpdate
Dossier Supprimé : C:\Users\Françoise\AppData\Local\Mobogenie
Dossier Supprimé : C:\Users\Françoise\AppData\Local\SearchProtect
Dossier Supprimé : C:\Users\Françoise\AppData\Local\TVWizard
Dossier Supprimé : C:\Users\Françoise\AppData\Local\SmartWeb
Dossier Supprimé : C:\Users\Françoise\AppData\Local\Doctor_PC
Dossier Supprimé : C:\Users\Françoise\AppData\Local\Pro_PC_Cleaner
Dossier Supprimé : C:\Users\Françoise\AppData\Local\Microsoft\WinU
Dossier Supprimé : C:\Users\Françoise\AppData\Local\Binkiland
Dossier Supprimé : C:\Users\Françoise\AppData\Local\gmsd_fr_373
Dossier Supprimé : C:\Users\Françoise\AppData\Local\gmsd_fr_379
Dossier Supprimé : C:\Users\Françoise\AppData\LocalLow\iac
Dossier Supprimé : C:\Users\Françoise\AppData\LocalLow\IminentToolbar
Dossier Supprimé : C:\Users\Françoise\AppData\LocalLow\mystarttb
Dossier Supprimé : C:\Users\Françoise\AppData\LocalLow\SmartWeb
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\AnyProtectEx
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\DriverCure
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\Gameo
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\istartsurf
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\Nosibay
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\ParetoLogic
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\Probit Software
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\qone8
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\sweet-page
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\Systweak
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\webplayer
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\wp_update
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\Advanced Cleaner Pro
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\Infigo
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\Company Name
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\Binkiland
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\Extensions\7r64_lvf@hcvkzbuyoi.com
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\Extensions\jzju0h@uydys.org
Dossier Supprimé : C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\Extensions\rbfm1xa@iyy-gzmh.edu
Fichier Supprimé : C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\Extensions\{E77F341C-F32E-40AA-8829-AA785C7D9316}.xpi
Fichier Supprimé : C:\crossbrowse.lnk
Fichier Supprimé : C:\Windows\apppatch\apppatch64\vcldr64.dll
Fichier Supprimé : C:\Windows\AppPatch\Custom\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}.sdb
Fichier Supprimé : C:\Windows\AppPatch\Custom\Custom64\{cf2797aa-b7ec-e311-8ed9-005056c00008}.sdb
Fichier Supprimé : C:\Windows\AppPatch\nbin\VC32Loader.dll
Fichier Supprimé : C:\Windows\efix.ini
Fichier Supprimé : C:\Windows\patsearch.bin
Fichier Supprimé : C:\Windows\Reimage.ini
Fichier Supprimé : C:\Windows\SysWOW64\Gambali.dll
Fichier Supprimé : C:\Windows\SysWOW64\GambaliOff.ini
Fichier Supprimé : C:\Users\FRANOI~1\AppData\Local\Temp\Uninstall.exe
Fichier Supprimé : C:\Windows\System32\Gambali64.dll
Fichier Supprimé : C:\Windows\System32\GambaliOff.ini
Fichier Supprimé : C:\Windows\System32\roboot64.exe
Fichier Supprimé : C:\Windows\System32\drivers\netfilter64.sys
Fichier Supprimé : C:\Windows\System32\drivers\qrnfd_1_10_0_9.sys
Fichier Supprimé : C:\Users\Françoise\daemonprocess.txt
Fichier Supprimé : C:\Users\Françoise\AppData\Roaming\aps.uninstall.scan.results
Fichier Supprimé : C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartWeb.lnk
Fichier Supprimé : C:\Users\Françoise\Desktop\AnyProtect.lnk
Fichier Supprimé : C:\Users\Françoise\Desktop\eBay.lnk
Fichier Supprimé : C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\searchplugins\MyOnlineSearch.xml
Fichier Supprimé : C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\searchplugins\mysearchskms.xml
Fichier Supprimé : C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\user.js
          • [ Tâches planifiées ] *****


Tâche Supprimée : APSnotifierPP1
Tâche Supprimée : APSnotifierPP2
Tâche Supprimée : APSnotifierPP3
Tâche Supprimée : Binkiland
Tâche Supprimée : DoctorPC_Start
Tâche Supprimée : globalUpdateUpdateTaskMachineCore
Tâche Supprimée : globalUpdateUpdateTaskMachineUA
Tâche Supprimée : InfiniteCrisis TW1
Tâche Supprimée : InfiniteCrisis TW2
Tâche Supprimée : LaunchSignup
Tâche Supprimée : Optimizer Pro Schedule
Tâche Supprimée : pricemeterdownloader
Tâche Supprimée : PriceMeterLiveUpdateUpdateTaskMachineCore
Tâche Supprimée : PriceMeterLiveUpdateUpdateTaskMachineUA
Tâche Supprimée : PriceMeterUpdater
Tâche Supprimée : ProPCCleaner_Start
Tâche Supprimée : SmartWeb Upgrade Trigger Task
Tâche Supprimée : TaskUserUpdate_wp
Tâche Supprimée : 7afd764a-e7cd-4246-be3e-541cc5aa9a66-10_user
          • [ Raccourcis ] *****
          • [ Registre ] *****


Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdate.OneClickCtrl.10
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdate.Update3WebControl.4
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc
Clé Supprimée : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0
Clé Supprimée : HKLM\SOFTWARE\Classes\speedupmypc
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Clé Supprimée : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10
Clé Supprimée : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4
Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Valeur Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [EasySpeedCheck]
Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wpm
Valeur Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SmartWeb]
Valeur Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [gmsd_fr_373]
Valeur Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [gmsd_fr_379]
Clé Supprimée : HKLM\SOFTWARE\69c797b1-4ba6-2a3b-d356-5d276df4c3ea
Clé Supprimée : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{126C78A0-36E7-4697-A3AB-32706144398B}
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{00A154AE-6C33-4F1E-9057-242350540936}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{126C78A0-36E7-4697-A3AB-32706144398B}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{5B60D1C0-453A-485D-AE91-61FAC9203719}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{E5A7A645-8318-4895-B85C-EDC606B80DB6}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}
Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{CCB24E92-62C4-4C53-95D2-65F9EED476BC}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}
Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\CLSID\{E5A7A645-8318-4895-B85C-EDC606B80DB6}
Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Clé Supprimée : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Clé Supprimée : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{460C3D19-B3D4-4964-A550-77D263B0CCCB}
Clé Supprimée : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2476}
Clé Supprimée : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Clé Supprimée : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{460C3D19-B3D4-4964-A550-77D263B0CCCB}
Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2476}
Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CC865B26-C31D-4D23-B17B-96548EEF03F6}
Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}
Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2476}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{a0892e19-6051-4ae6-9a5f-91542a166b2b}
Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0b4d26f6-61a8-4463-99dd-5f2fe0400fa6}
Clé Supprimée : HKCU\Software\AnyProtect
Clé Supprimée : HKCU\Software\Boost
Clé Supprimée : HKCU\Software\BRS
Clé Supprimée : HKCU\Software\eSupport.com
Clé Supprimée : HKCU\Software\genesis
Clé Supprimée : HKCU\Software\GlobalUpdate
Clé Supprimée : HKCU\Software\Goobzo
Clé Supprimée : HKCU\Software\IM
Clé Supprimée : HKCU\Software\ImInstaller
Clé Supprimée : HKCU\Software\InstallCore
Clé Supprimée : HKCU\Software\Nosibay
Clé Supprimée : HKCU\Software\Optimizer Pro
Clé Supprimée : HKCU\Software\simplytech
Clé Supprimée : HKCU\Software\Store
Clé Supprimée : HKCU\Software\systweak
Clé Supprimée : HKCU\Software\Tutorials
Clé Supprimée : HKCU\Software\TutoTag
Clé Supprimée : HKCU\Software\Vittalia
Clé Supprimée : HKCU\Software\DriverRestore
Clé Supprimée : HKCU\Software\UpdateFiles
Clé Supprimée : HKCU\Software\Easy Speed Check
Clé Supprimée : HKCU\Software\Advanced Cleaner Pro
Clé Supprimée : HKCU\Software\gameo
Clé Supprimée : HKCU\Software\GAMESDESKTOP
Clé Supprimée : HKCU\Software\TNT2
Clé Supprimée : HKCU\Software\Super Optimizer
Clé Supprimée : HKCU\Software\ProPCCleanerLanguage
Clé Supprimée : HKCU\Software\ProPCCleanerConfig
Clé Supprimée : HKCU\Software\Binkiland Browser
Clé Supprimée : HKCU\Software\SearchProtectWS
Clé Supprimée : HKCU\Software\Kreapixel
Clé Supprimée : HKCU\Software\Crossbrowse
Clé Supprimée : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Clé Supprimée : HKCU\Software\AppDataLow\Software\BlockAndSurf
Clé Supprimée : HKCU\Software\AppDataLow\Software\Crossrider
Clé Supprimée : HKCU\Software\AppDataLow\Software\DynConIE
Clé Supprimée : HKCU\Software\AppDataLow\Software\SmartWeb
Clé Supprimée : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Clé Supprimée : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Clé Supprimée : HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
Clé Supprimée : HKLM\SOFTWARE\Boost
Clé Supprimée : HKLM\SOFTWARE\EZ Software Updater
Clé Supprimée : HKLM\SOFTWARE\GlobalUpdate
Clé Supprimée : HKLM\SOFTWARE\Goobzo
Clé Supprimée : HKLM\SOFTWARE\hdcode
Clé Supprimée : HKLM\SOFTWARE\ImInstaller
Clé Supprimée : HKLM\SOFTWARE\istartsurfSoftware
Clé Supprimée : HKLM\SOFTWARE\SearchProtect
Clé Supprimée : HKLM\SOFTWARE\SupDp
Clé Supprimée : HKLM\SOFTWARE\SupTab
Clé Supprimée : HKLM\SOFTWARE\sweet-pageSoftware
Clé Supprimée : HKLM\SOFTWARE\systweak
Clé Supprimée : HKLM\SOFTWARE\Tutorials
Clé Supprimée : HKLM\SOFTWARE\winzipersvc
Clé Supprimée : HKLM\SOFTWARE\SpeedBrowser
Clé Supprimée : HKLM\SOFTWARE\mystartsearchSoftware
Clé Supprimée : HKLM\SOFTWARE\ORBTR
Clé Supprimée : HKLM\SOFTWARE\GAMESDESKTOP
Clé Supprimée : HKLM\SOFTWARE\IHProtect
Clé Supprimée : HKLM\SOFTWARE\SPPDCOM
Clé Supprimée : HKLM\SOFTWARE\IGS
Clé Supprimée : HKLM\SOFTWARE\FlashBeat
Clé Supprimée : HKLM\SOFTWARE\QuickRef_1.10.0.9
Clé Supprimée : HKLM\SOFTWARE\Crossbrowse
Clé Supprimée : HKLM\SOFTWARE\doctor pc
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1B8A71D1-31D4-EE6A-C32F-836E0BFFA6D3}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C60D3D4E-3B20-5AB3-7F2C-9C946AD4080F}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnyProtect
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SmartWeb
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FlashBeat
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_fr_379_is1
Clé Supprimée : [x64] HKLM\SOFTWARE\ShopperPro
Clé Supprimée : [x64] HKLM\SOFTWARE\FlashBeat
Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Donnée Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll
Donnée Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll
Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CA0054A5AB3EFFE4CB5660E44A1E7DCC
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bpsvc.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsersafeguard.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dprotectsvc.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PriceMeterLiveUpdate.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectedsearch.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchinstaller.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotection.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotector.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings64.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snapdo.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SoftwareUpdate.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst32.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst64.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\umbrella.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utiljumpflip.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroids.exe
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroidsservice.exe
Donnée Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <-loopback>
          • [ Navigateurs ] *****


-\\ Internet Explorer v11.0.9600.17689

Paramètre Restauré : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Paramètre Restauré : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Paramètre Restauré : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Paramètre Restauré : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Paramètre Restauré : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

-\\ Mozilla Firefox v

[4xlmdvpw.default\prefs.js] - Ligne Supprimée : user_pref("browser.search.order.1", "default-search.net");
[4xlmdvpw.default\prefs.js] - Ligne Supprimée : user_pref("extensions.a0cd1569197354ecf9be03d3ee3bc4210848f7b5a58324f064fcom63831.63831.internaldb.__ICM_LITE__blacklist_domain.value", "%7B%22SLIDERS%22%3A%5B%226pm.com%22%2C%22amazon.co.uk%22%2C%22a[...]
[4xlmdvpw.default\prefs.js] - Ligne Supprimée : user_pref("extensions.a0cd1569197354ecf9be03d3ee3bc4210848f7b5a58324f064fcom63831.63831.internaldb.__ICM_LITE__fifty_test_rules.value", "%7B%22DE%22%3A%7B%22ALL%22%3A%5B%22anastasiadate.com%22%2C%22op[...]
[4xlmdvpw.default\prefs.js] - Ligne Supprimée : user_pref("extensions.a0cd1569197354ecf9be03d3ee3bc4210848f7b5a58324f064fcom63831.63831.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22%5D[...]
[4xlmdvpw.default\prefs.js] - Ligne Supprimée : user_pref("extensions.ataylorralstonhotmailcom64755.64755.internaldb.__ICM_LITE__blacklist_domain.value", "%7B%22SLIDERS%22%3A%5B%226pm.com%22%2C%22amazon.co.uk%22%2C%22amazon.com%22%2C%22anthropologi[...]
[4xlmdvpw.default\prefs.js] - Ligne Supprimée : user_pref("extensions.ataylorralstonhotmailcom64755.64755.internaldb.__ICM_LITE__fifty_test_rules.value", "%7B%22DE%22%3A%7B%22ALL%22%3A%5B%22anastasiadate.com%22%2C%22optionweb.com%22%2C%22pctools.co[...]

-\\ Opera v0.0.0.0


AdwCleaner[R0].txt - [31293 octets] - [04/04/2015 22:34:19]
AdwCleaner[S0].txt - [28672 octets] - [04/04/2015 22:50:23]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [28733 octets] ##########


A+
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 5 / 21
Malekal_morte- Messages postés 180304 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 685
 
ok, voici la suite :


Scan Malwarebytes (temps : environ 40min de scan):
==================================================
Télécharge et installe Malwarebyte : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Mets le à jour puis lance un examen.

A la fin du scan, clic sur "Mettre tout en quarantaine" en bas à gauche.
Redémarre l'ordinateur si besoin.
Après redémarrage, relance Malwarebytes.
Vas chercher le rapport dans l'onglet Historique.
A gauche Journal des examens.
Doube-clic sur l'examen dans la liste.
Puis en bas Copier dans le presse papier
Vas sur http://pjjoint.malekal.com et en bas, clic droit / coller pour coller le rapport du scan Malwarebytes.
Clic sur envoyer.
Dans un nouveau message ici en réponse, donne le lien pjjoint afin de pouvoir consulter le rapport.


0
Réponse 6 / 21
girfred
 
Bonjour,

J'ai mis deux liens pour le journal de protection et pour le rapport


http://pjjoint.malekal.com/files.php?id=20150405_f15i9v7t8o5
http://pjjoint.malekal.com/files.php?id=20150405_p7l106f15y5

J'espère que tu vas arriver à en faire quelque chose car j'ai eu des difficultés à tous trouver.

A+ et encore merci pour ton aide.
0
Réponse 7 / 21
Malekal_morte- Messages postés 180304 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 685
 
ca doit aller mieux déjà là non ?

Refais un scan FRST et donne les rapports via pjjoint pour voir.
0
Réponse 8 / 21
girfred
 
La navigation est polluée par des demandes de mise à jour d'adobe flash Player et des pages s'ouvrent de façon intempestives. Rien que pour t'écrire là c'est galère.
Je relance un scan FRST et je t'envoie le résultat.
0
Réponse 9 / 21
girfred Messages postés 17 Date d'inscription   Statut Membre Dernière intervention  
 
Voilà les rapports FRST

https://pjjoint.malekal.com/files.php?id=20150405_l511c13y15y5
https://pjjoint.malekal.com/files.php?id=20150405_b7p15y7u10p5
https://pjjoint.malekal.com/files.php?id=20150405_i12l6r7v7o11

Ca reste encore galère! Faut-il supprimer ce qui est mis en quarantaine dans Mbam ?
0
Malekal_morte- Messages postés 180304 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 685
 
Laisse tomber pour Malwarebytes, ça ne changera rien.
Bon y a plein d'adwares.
T'as la tâche planifiée qui réinstalle tout, donc faut tout virer en un bloc.
0
Réponse 10 / 21
Malekal_morte- Messages postés 180304 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 685
 
bon y a du boulot =)




Voici la correction à effectuer avec FRST.
Tu peux t'inspirer de cette note explicative avec des captures d'écran pour t'aider: https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/#fix

Ouvre le bloc-notes : Touche Windows + R, dans le champs executer, tape notepad et OK.
Copie/colle dedans ce qui suit :

HKLM-x32\...\Run: [gmsd_fr_340] => [X]
HKLM-x32\...\Run: [gmsd_fr_349] => [X]
HKLM-x32\...\Run: [gmsd_fr_362] => [X]
HKLM-x32\...\Run: [gmsd_fr_364] => C:\Program Files (x86)\gmsd_fr_364\gmsd_fr_364.exe [3983504 2015-03-30] ()
HKLM-x32\...\Run: [gmsd_fr_379] => C:\Program Files (x86)\gmsd_fr_379\gmsd_fr_379.exe [3984016 2015-04-04] ()
HKLM-x32\...\Run: [SmartWeb] => C:\Users\Françoise\AppData\Local\SmartWeb\SmartWebHelper.exe [270368 2015-02-17] (SoftBrain Technologies Ltd.)
HKLM-x32\...\RunOnce: [Ridigefekuke] => C:\Windows\SysWOW64\wscript.exe /E:vbscript /B "C:\Users\FRANOI~1\AppData\Local\61BF73~1\Cuba.dat"
HKLM-x32\...\RunOnce: [upgmsd_fr_364.exe] => C:\Users\Françoise\AppData\Local\gmsd_fr_364\upgmsd_fr_364.exe [3308688 2015-03-30] ()
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-805902893-1657446439-1934957100-1000\...\Run: [Optimizer Pro] => C:\Program Files (x86)\Optimizer Pro 3.75\OptProLauncher.exe [148008 2015-03-31] ()
HKU\S-1-5-21-805902893-1657446439-1934957100-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-805902893-1657446439-1934957100-1000\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-805902893-1657446439-1934957100-1000\...\MountPoints2: {a9835061-5c33-11e4-9a00-80c16e586cac} - G:\LaunchU3.exe
HKU\S-1-5-18\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_16_0_0_287_Plugin.exe -update plugin
AppInit_DLLs-x32: c:/progra~3/{4884a~1/192~1.1/rari.dll => "c:\progra~3\{4884a~1\192~1.1\rari.dll" File Not Found
IFEO\jumpflip: [Debugger] tasklist.exe
IFEO\volaro: [Debugger] tasklist.exe
IFEO\vonteera: [Debugger] tasklist.exe
Startup: C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hqghumeaylnlf.lnk
ShortcutTarget: hqghumeaylnlf.lnk -> C:\ProgramData\{b24c03f5-2214-6cba-b24c-c03f52210fd4}\hqghumeaylnlf.exe (PC Utilities Software Limited)
Startup: C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartWeb.lnk
ShortcutTarget: SmartWeb.lnk -> C:\Users\Françoise\AppData\Local\SmartWeb\SmartWebHelper.exe (SoftBrain Technologies Ltd.)
roxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:57266;https=127.0.0.1:57266
R2 542bb8ed; c:\Program Files (x86)\Optimizer Pro 3.75\OptProMon.dll [2292264 2015-04-04] ()
R2 cicifiso; C:\Users\Françoise\AppData\Roaming\32444335-1427214172-3535-4C39-80C16E586CAC\nsz8ACC.tmp [208384 2015-04-04] () [File not signed]
R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [158816 2015-03-16] (XTab system)
R2 toqukozi; C:\Users\Françoise\AppData\Roaming\32444335-1424508927-3535-4C39-80C16E586CAC\jnsxBEAE.tmp [90624 2015-02-21] () [File not signed]
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [493712 2015-04-04] (SysTool PasSame LIMITED)
R2 xuhejygu; C:\Users\Françoise\AppData\Roaming\32444335-1427214172-3535-4C39-80C16E586CAC\jnsu55B1.tmp [131584 2015-03-24] () [File not signed]
S2 FlashBeat; C:\ProgramData\FlashBeat\FlashBeat.exe [X]
R2 gusomybu; C:\Users\Françoise\AppData\Roaming\32444335-1424508927-3535-4C39-80C16E586CAC\nsr900.tmpfs [X]
S2 qrsvc_1.10.0.9; "C:\Program Files (x86)\QuickRef_1.10.0.9\Service\qrsvc.exe" [X]
S3 clwvd; system32\DRIVERS\clwvd.sys [X]
FF Extension: linkygemaldk - C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\Extensions\linky@gemal.dk [2014-08-31]
FF Extension: Settings Manager - C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\Extensions\{1ED03F15-1006-1C66-CCA5-15A00B80A7B7} [2014-05-18]
FF Extension: No Name - C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\extensions\boost@boost.net.xpi [Not Found]
FF Extension: No Name - C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\extensions\{8299d9bc-4fe2-4889-9adf-025a0769d461}.xpi [Not Found]
FF Extension: No Name - C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\extensions\idmsq@idmsq.com [Not Found]
FF Extension: No Name - C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [Not Found]
FF Extension: No Name - C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\extensions\taylorralston@hotmail.com [Not Found]
FF Extension: No Name - C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\extensions\0cd1569197354ecf9be03@d3ee3bc4210848f7b5a58324f064f.com [Not Found]
2015-04-05 09:14 - 2015-04-05 09:19 - 00002836 _____ () C:\Windows\System32\Tasks\APSnotifierPP1
2015-04-05 09:14 - 2015-04-05 09:19 - 00002834 _____ () C:\Windows\System32\Tasks\APSnotifierPP3
2015-04-05 09:14 - 2015-04-05 09:19 - 00002834 _____ () C:\Windows\System32\Tasks\APSnotifierPP2
2015-04-05 09:14 - 2015-04-05 09:14 - 00001045 _____ () C:\Users\Françoise\Desktop\AnyProtect.lnk
2015-04-05 09:14 - 2015-04-05 09:14 - 00000000 ____D () C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup
2015-04-05 09:13 - 2015-04-05 11:27 - 00000000 ____D () C:\Program Files (x86)\AnyProtectEx
2015-04-05 09:13 - 2015-04-05 09:13 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsjC83D.tmp
2015-04-05 09:13 - 2015-04-05 09:13 - 00000000 __SHD () C:\Users\Françoise\AppData\Roaming\AnyProtectEx
2015-04-05 09:08 - 2015-04-05 11:27 - 00000000 ____D () C:\Users\Françoise\AppData\Local\SmartWeb
2015-04-05 09:08 - 2015-04-05 09:08 - 00004058 _____ () C:\Windows\System32\Tasks\SmartWeb Upgrade Trigger Task
2015-04-05 09:07 - 2015-04-05 11:27 - 00000000 ____D () C:\Users\Françoise\AppData\Local\gmsd_fr_379
2015-04-05 09:07 - 2015-04-05 09:11 - 00000000 ____D () C:\Program Files (x86)\gmsd_fr_379
2015-04-04 23:44 - 2015-04-04 23:44 - 00000000 ____D () C:\Users\Françoise\SupTab
2015-04-04 23:29 - 2015-04-05 11:10 - 00000000 ____D () C:\Users\Françoise\AppData\Local\gmsd_fr_364
2015-04-04 23:29 - 2015-04-05 08:53 - 00003278 _____ () C:\Windows\System32\Tasks\Optimizer Pro Schedule
2015-04-04 23:29 - 2015-04-04 23:29 - 00000000 ____D () C:\Users\Françoise\Documents\Optimizer Pro
2015-04-04 23:29 - 2015-04-04 23:29 - 00000000 ____D () C:\Users\Françoise\AppData\Roaming\Optimizer Pro
2015-04-04 23:29 - 2015-04-04 23:29 - 00000000 ____D () C:\Program Files (x86)\gmsd_fr_364
2015-04-04 23:28 - 2015-04-05 08:36 - 00000000 ____D () C:\ProgramData\{b24c03f5-2214-6cba-b24c-c03f52210fd4}
2015-04-04 23:28 - 2015-04-04 23:28 - 00001099 _____ () C:\Users\Françoise\Desktop\Optimizer Pro.lnk
2015-04-04 23:28 - 2015-04-04 23:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2
2015-04-04 23:28 - 2015-04-04 23:28 - 00000000 ____D () C:\Program Files (x86)\Optimizer Pro 3.75
2015-04-04 23:27 - 2015-04-05 11:05 - 00000000 ____D () C:\Program Files (x86)\XTab
2015-04-04 23:27 - 2015-04-04 23:27 - 00001101 _____ () C:\Users\Françoise\Desktop\Continue Live Installation.lnk
2015-04-04 23:27 - 2015-04-04 23:27 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2015-04-04 23:27 - 2015-04-04 23:27 - 00000000 ____D () C:\ProgramData\IHProtectUpDate
2015-04-04 23:26 - 2015-04-04 23:26 - 00000000 ____D () C:\Users\Françoise\AppData\Roaming\mystartsearch
2015-04-04 20:07 - 2015-04-04 20:07 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsl19A7.tmp
2015-04-04 20:06 - 2015-04-05 11:40 - 00026874 _____ () C:\Users\Françoise\Desktop\FRST.txt
2015-04-04 20:06 - 2015-04-04 20:06 - 00000306 _____ () C:\Windows\Tasks\avaavaxvyy.job
2015-04-04 20:05 - 2015-04-05 11:39 - 00000000 ____D () C:\FRST
2015-04-04 20:05 - 2015-04-04 20:05 - 00000000 ____D () C:\Users\Françoise\AppData\Local\avaavaxvyy
2015-04-04 20:01 - 2015-04-04 20:01 - 02095616 _____ (Farbar) C:\Users\Françoise\Desktop\FRST64.exe
2015-04-04 19:02 - 2015-04-04 19:02 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsoEDD6.tmp
2015-04-04 18:59 - 2015-04-04 18:59 - 00000000 ____D () C:\Users\Françoise\AppData\Local\Software
2015-04-04 18:58 - 2015-04-04 18:58 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsxDBAD.tmp
2015-04-04 18:24 - 2015-04-04 23:26 - 00001615 _____ () C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-04 18:24 - 2015-04-04 18:24 - 00000300 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{F3D00496-1512-4FEF-A011-C2925A21559B}.job
2015-04-04 18:24 - 2015-04-04 18:24 - 00000000 ____D () C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-04-04 16:27 - 2015-04-04 16:27 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsgEBB7.tmp
2015-04-04 06:55 - 2015-04-04 06:55 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsbFDBE.tmp
2015-04-04 06:54 - 2015-04-04 06:54 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsl570A.tmp
2015-04-04 06:52 - 2015-04-04 06:54 - 01950208 _____ () C:\Users\Françoise\AppData\Roaming\GWEXI.exe
2015-04-04 06:52 - 2015-04-04 06:54 - 00001352 _____ () C:\Windows\Tasks\GWEXI.job
2015-04-03 09:32 - 2015-04-03 09:32 - 00000000 ___HD () C:\Users\Françoise\AppData\Local\61bf73677f83230a
2015-04-02 18:09 - 2015-04-02 18:09 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsdFDF0.tmp
2015-03-31 12:01 - 2015-04-05 03:42 - 00000000 ____D () C:\Program Files (x86)\Mountain Bike
2015-03-31 05:19 - 2015-03-31 05:19 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsiDF85.tmp
2015-03-30 10:33 - 2015-03-30 10:33 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsm5819.tmp
2015-03-30 07:23 - 2015-04-05 11:10 - 00000348 _____ () C:\Windows\Tasks\HPCeeScheduleForFrançoise.job
2015-03-30 07:17 - 2015-03-30 07:17 - 00000000 _____ () C:\Windows\SysWOW64\sho148F.tmp
2015-03-29 12:11 - 2015-03-29 12:11 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nso16B3.tmp
2015-03-29 11:57 - 2015-03-29 11:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\1 Media Player
2015-03-29 11:57 - 2015-03-29 11:57 - 00000000 ____D () C:\Program Files (x86)\1 Media Player
2015-03-29 07:38 - 2015-03-29 07:39 - 00914436 _____ () C:\Users\Françoise\Downloads\widget-1-6.zip
2015-03-28 16:36 - 2015-03-28 16:35 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsn2300.tmp
2015-03-28 16:34 - 2015-04-05 03:43 - 00000000 ____D () C:\Program Files (x86)\GoHDV28.03
2015-03-28 16:34 - 2015-03-28 16:34 - 01971200 _____ () C:\Users\Françoise\AppData\Roaming\FDEDZBML.exe
2015-03-28 16:34 - 2015-03-28 16:34 - 00001702 _____ () C:\Windows\Tasks\FDEDZBML.job
2015-03-27 17:05 - 2015-03-27 17:05 - 02250712 _____ (Company Name) C:\Users\Françoise\Downloads\adsl-tv-fm_setup.exe
2015-03-27 10:46 - 2015-03-27 10:46 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsnC48.tmp
2015-03-27 07:30 - 2015-03-27 07:30 - 00003176 _____ () C:\Windows\System32\Tasks\{29DAE379-E7E9-4211-98F1-3C0DF9E21230}
2015-03-26 21:14 - 2015-03-26 21:14 - 00005542 _____ () C:\Users\Françoise\AppData\Roaming\GWEXI
2015-03-26 21:14 - 2015-03-26 21:14 - 00005542 _____ () C:\Users\Françoise\AppData\Roaming\FDEDZBML
2015-03-26 20:50 - 2015-03-26 20:50 - 00000000 ____D () C:\ZombieNews
2015-03-26 20:43 - 2015-03-26 20:43 - 01940992 _____ () C:\Users\Françoise\AppData\Roaming\THULJOON.exe
2015-03-26 20:43 - 2015-03-26 20:43 - 00001702 _____ () C:\Windows\Tasks\THULJOON.job
2015-03-26 20:42 - 2015-03-26 20:42 - 00000000 ____D () C:\Users\Public\Documents\YTAHelper
2015-03-26 20:40 - 2015-03-26 20:40 - 00000000 ____D () C:\Users\Françoise\AppData\Local\CrashRpt
2015-03-26 20:39 - 2015-03-26 20:39 - 01978840 _____ () C:\Users\Françoise\AppData\Roaming\PWKN.exe
2015-03-26 20:39 - 2015-03-26 20:39 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsuC72D.tmp
2015-03-26 20:39 - 2015-03-26 20:39 - 00001350 _____ () C:\Windows\Tasks\PWKN.job
2015-03-26 20:36 - 2015-03-26 20:36 - 01940992 _____ () C:\Users\Françoise\AppData\Roaming\TJYHKE.exe
2015-03-26 20:36 - 2015-03-26 20:36 - 00001354 _____ () C:\Windows\Tasks\TJYHKE.job
2015-03-26 08:24 - 2015-03-26 08:24 - 00000000 _____ () C:\Users\Françoise\AppData\Local\.w852.db
2015-03-25 08:52 - 2015-03-25 08:52 - 00001103 _____ () C:\Users\Françoise\Downloads\Download-setup.website
2015-03-24 18:38 - 2015-03-24 18:38 - 00001700 _____ () C:\Windows\Tasks\LQNCBDR.job
2015-03-24 18:37 - 2015-03-24 18:37 - 01933824 _____ () C:\Users\Françoise\AppData\Roaming\LQNCBDR.exe
2015-03-24 18:35 - 2015-04-05 03:50 - 00000000 ____D () C:\Users\Françoise\AppData\Local\avaavxvyex
2015-03-24 18:27 - 2015-04-05 11:27 - 00000000 ____D () C:\Users\Françoise\AppData\Local\32444335-1427218036-3535-4C39-80C16E586CAC
2015-03-24 18:26 - 2015-03-24 18:26 - 00003582 _____ () C:\Windows\System32\Tasks\OKKFODDR
2015-03-24 18:26 - 2015-03-24 18:26 - 00001702 _____ () C:\Windows\Tasks\OKPPBAAR.job
2015-03-24 18:26 - 2015-03-24 18:26 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webTinstMKTN_01009.Wdf
2015-03-24 18:26 - 2015-03-24 18:25 - 01933824 _____ () C:\Users\Françoise\AppData\Roaming\OKPPBAAR.exe
2015-03-24 18:25 - 2015-04-05 11:26 - 00000000 ____D () C:\ProgramData\e551e40cdd5e4104afe48d92c795a590
2015-03-24 18:25 - 2015-03-24 18:25 - 00000000 ____D () C:\ProgramData\7fbb4485eae14230b10d76d5ce7f1c83
2015-03-24 18:24 - 2015-03-24 18:24 - 00000000 ____D () C:\Users\Françoise\AppData\Roaming\WebplayerRemote
2015-03-24 18:22 - 2015-04-05 10:35 - 00000000 ____D () C:\Users\Françoise\AppData\Roaming\32444335-1427214172-3535-4C39-80C16E586CAC
2015-03-24 18:20 - 2015-04-04 18:22 - 00000000 ____D () C:\Program Files (x86)\CloudScout Parental Control
2015-03-24 18:19 - 2015-03-24 18:19 - 00000000 ____D () C:\d05e7453-6a9e-4756-b897-37340347d5ca
2015-03-23 18:55 - 2015-04-04 15:42 - 00000978 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job
2015-03-23 18:55 - 2015-04-04 14:34 - 00000982 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job
2015-04-04 15:55 - 2015-03-02 09:55 - 00000306 _____ () C:\Windows\Tasks\Binkiland.job
2015-04-04 15:40 - 2015-01-19 11:23 - 00000000 ____D () C:\Users\Françoise\AppData\Everything
2015-04-04 12:10 - 2014-04-07 20:04 - 00000451 _____ () C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Yahoo!.website
2015-04-05 09:59 - 2014-05-05 06:27 - 00000378 _____ () C:\Windows\Tasks\APSnotifierPP1.job
2015-03-26 21:14 - 2015-03-26 21:14 - 0005542 _____ () C:\Users\Françoise\AppData\Roaming\FDEDZBML
2015-03-28 16:34 - 2015-03-28 16:34 - 1971200 _____ () C:\Users\Françoise\AppData\Roaming\FDEDZBML.exe
2015-03-26 21:14 - 2015-03-26 21:14 - 0005542 _____ () C:\Users\Françoise\AppData\Roaming\GWEXI
2015-04-04 06:52 - 2015-04-04 06:54 - 1950208 _____ () C:\Users\Françoise\AppData\Roaming\GWEXI.exe
2015-03-09 23:30 - 2015-03-09 23:30 - 0005487 _____ () C:\Users\Françoise\AppData\Roaming\LQNCBDR
2015-03-24 18:37 - 2015-03-24 18:37 - 1933824 _____ () C:\Users\Françoise\AppData\Roaming\LQNCBDR.exe
2015-03-09 23:30 - 2015-03-09 23:30 - 0005487 _____ () C:\Users\Françoise\AppData\Roaming\OKPPBAAR
2015-03-24 18:26 - 2015-03-24 18:25 - 1933824 _____ () C:\Users\Françoise\AppData\Roaming\OKPPBAAR.exe
2014-09-01 10:18 - 2014-09-01 10:18 - 0001248 _____ () C:\Users\Françoise\AppData\Roaming\ONLLP
2015-01-25 18:12 - 2015-01-25 18:12 - 0001248 _____ () C:\Users\Françoise\AppData\Roaming\PWKN
2015-03-26 20:39 - 2015-03-26 20:39 - 1978840 _____ () C:\Users\Françoise\AppData\Roaming\PWKN.exe
2015-03-09 23:30 - 2015-03-09 23:30 - 0005487 _____ () C:\Users\Françoise\AppData\Roaming\THULJOON
2015-03-26 20:43 - 2015-03-26 20:43 - 1940992 _____ () C:\Users\Françoise\AppData\Roaming\THULJOON.exe
2015-03-09 23:30 - 2015-03-09 23:30 - 0005487 _____ () C:\Users\Françoise\AppData\Roaming\TJYHKE
2015-03-26 20:36 - 2015-03-26 20:36 - 1940992 _____ () C:\Users\Françoise\AppData\Roaming\TJYHKE.exe
2014-09-01 10:18 - 2014-09-01 10:18 - 0002086 _____ () C:\Users\Françoise\AppData\Roaming\UFQUWS
2014-12-17 12:12 - 2014-12-17 12:12 - 0022528 _____ () C:\Users\Françoise\AppData\Local\dsisetup13768332.exe
2015-02-23 12:38 - 2015-02-23 12:38 - 0613057 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsb2586.tmp
2015-04-04 06:55 - 2015-04-04 06:55 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsbFDBE.tmp
2015-04-02 18:09 - 2015-04-02 18:09 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsdFDF0.tmp
2015-04-04 16:27 - 2015-04-04 16:27 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsgEBB7.tmp
2014-05-09 18:31 - 2014-05-09 18:31 - 0301488 _____ (VuuPC Limited) C:\Users\Françoise\AppData\Local\nsi1680.tmp
2015-03-31 05:19 - 2015-03-31 05:19 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsiDF85.tmp
2015-04-05 09:13 - 2015-04-05 09:13 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsjC83D.tmp
2015-04-04 20:07 - 2015-04-04 20:07 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsl19A7.tmp
2015-04-04 06:54 - 2015-04-04 06:54 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsl570A.tmp
2015-02-21 10:49 - 2015-02-21 10:49 - 0613057 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsl76E0.tmp
2015-03-30 10:33 - 2015-03-30 10:33 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsm5819.tmp
2015-03-28 16:36 - 2015-03-28 16:35 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsn2300.tmp
2015-03-27 10:46 - 2015-03-27 10:46 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsnC48.tmp
2015-03-29 12:11 - 2015-03-29 12:11 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nso16B3.tmp
2015-04-04 19:02 - 2015-04-04 19:02 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsoEDD6.tmp
2015-03-26 20:39 - 2015-03-26 20:39 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsuC72D.tmp
2015-04-04 18:58 - 2015-04-04 18:58 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsxDBAD.tmp
2014-11-14 08:12 - 2014-11-14 08:12 - 0301608 _____ (VuuPC Limited) C:\Users\Françoise\AppData\Local\nsy3999.tmp
2015-04-04 15:14 - 2015-03-01 15:52 - 0196504 _____ () C:\Program Files (x86)\9tres.dll
2015-04-04 15:14 - 2015-03-01 15:52 - 1037896 _____ () C:\Program Files (x86)\9tUninstall Internet Speed Tracker.dll
Task: {0C399515-1567-4D57-81CD-079D99FFF752} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {12FFAF24-CD9C-44A8-87F3-40B7BD32B842} - System32\Tasks\t4h2IDlcVS2y0Sr => C:\Users\Françoise\AppData\Roaming\jDuSLEf\6O1gHkb.exe
Task: {26E4C186-E388-4729-B0DC-40672FC139FB} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {2A377C54-9448-48C7-81BC-4F827718F323} - System32\Tasks\{0072C348-C0F5-4690-B9C5-C8B850EAAA95} => pcalua.exe -a C:\Users\Françoise\AppData\Roaming\sweet-page\UninstallManager.exe -c -ptid=cor
Task: {2A83656A-D193-4CDE-AFD1-3D0F5462B76A} - System32\Tasks\S7qLnZDxEjVnWif => C:\Users\Françoise\AppData\Roaming\FXOoNoy\eSAjdhI.exe [2015-02-27] ( )
Task: {2F74EA80-3F09-42F5-BB56-FD6D23201531} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {70D31263-C8AA-4F72-94CD-B847C475C5B0} - \8c6736a2-0446-4148-8f02-ca63eff37ec5-12 No Task File <==== ATTENTION
Task: {70EB7038-801D-4629-B59A-F2B52526ACD8} - System32\Tasks\{1393E89C-3D33-423C-BECB-D5548128FBC0} => pcalua.exe -a C:\Users\Françoise\AppData\Roaming\omiga-plus\UninstallManager.exe -c -ptid=adks <==== ATTENTION
Task: {7904E1AC-513E-4EB8-A318-65389D155BFD} - System32\Tasks\{E3E303C7-214A-4246-8966-F0426841A603} => Iexplore.exe http://ui.skype.com/ui/0/5.6.0.110.161/fr/abandoninstall?page=tsDownload&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;disabled
Task: {8255801E-C819-4A83-A3BD-006338DEBEF6} - System32\Tasks\ULNtEsDPMKLzji9 => C:\Users\Françoise\AppData\Roaming\Cpap4wF\gn5Vm4r.exe
Task: {828CA497-D5EC-40F1-82B1-D94654F80D64} - System32\Tasks\SmartWeb Upgrade Trigger Task => C:\Users\Françoise\AppData\Local\SmartWeb\SmartWebHelper.exe [2015-02-17] (SoftBrain Technologies Ltd.) <==== ATTENTION
Task: {89431725-61A5-43B7-B149-4F68602D645C} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {8B7A841B-A394-44EA-A832-C8834484C0C3} - \8c6736a2-0446-4148-8f02-ca63eff37ec5-1-7 No Task File <==== ATTENTION
Task: {8CCE1C4E-E6A6-4004-B556-526E9C1DD61F} - System32\Tasks\Optimizer Pro Schedule => C:\Program Files (x86)\Optimizer Pro 3.75\OptProLauncher.exe [2015-03-31] () <==== ATTENTION
Task: {924D639B-824C-4387-85D8-6B8F305DD4CD} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {94907B4A-CFE9-4508-B069-BDF1D85BEE81} - System32\Tasks\WIN-statsAdmin => C:\Users\Françoise\AppData\Local\Microsoft\WinU\~pqrhxft.exe <==== ATTENTION
Task: {A269C044-F854-4A64-A9C0-E84F64848B15} - System32\Tasks\{9687AFBA-FA57-48A3-90A8-3D61C414676A} => pcalua.exe -a C:\Users\Françoise\AppData\Roaming\qone8\UninstallManager.exe -c -ptid=adks
Task: {A832BAFF-4526-4A32-A841-37226B978D64} - System32\Tasks\{29DAE379-E7E9-4211-98F1-3C0DF9E21230} => pcalua.exe -a C:\Users\Françoise\AppData\Roaming\mystartsearch\UninstallManager.exe -c -ptid=smt
Task: {AE872F99-D435-474D-B58A-D4D2145EF8A9} - System32\Tasks\WIN-statsSystem => C:\Users\Françoise\AppData\Local\Microsoft\WinU\~frodbro.exe
Task: {B4F88351-D346-47F7-BF79-FFEA82521039} - System32\Tasks\9XGQKw3LInouXt0 => C:\Users\Françoise\AppData\Roaming\xmfTvyu\yUAoRwK.exe [2015-02-24] ( )
Task: {C2AF11FA-199C-49F3-8234-A42D3EF9F64A} - System32\Tasks\{1ED12CDA-49C0-49C3-876E-45DFAE76E072} => Firefox.exe
Task: {C3A564F3-F565-444F-B9B9-2C7BE983C80C} - System32\Tasks\WIN-GGfIfEGCfEGbGffIfCfEGC => C:\Users\Françoise\AppData\Roaming\~lbehxzl.exe
Task: {CE821C2E-F472-4C86-B298-9539C29181B5} - System32\Tasks\OKKFODDR => C:\ProgramData\e551e40cdd5e4104afe48d92c795a590\e551e40cdd5e4104afe48d92c795a590.exe
Task: {E5FBFE04-9BCE-47A6-AB45-41896307775D} - System32\Tasks\{6C6A1B19-AC17-40B1-81FA-F846708DC1B4} => Iexplore.exe http://ui.skype.com/ui/0/5.6.0.110.161/fr/abandoninstall?page=tsDownload&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;disabled
Task: {F08FCB6F-1C7C-4618-897D-DCA0C185FF9C} - System32\Tasks\{A9DA2D5F-CB04-4000-BA22-B132226837FD} => Iexplore.exe http://ui.skype.com/ui/0/5.6.0.110.161/fr/abandoninstall?page=tsDownload&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;disabled
Task: {F486969F-6FE3-4F2B-9DE6-EF16AAA97E54} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-04] (Google Inc.)
Task: {F9283F80-A3F8-43C6-BE94-75A3471EFCC1} - \8c6736a2-0446-4148-8f02-ca63eff37ec5-1-6 No Task File <==== ATTENTION
Task: {FAEBBC22-5575-45A7-B295-A53013F7C389} - \8c6736a2-0446-4148-8f02-ca63eff37ec5-5 No Task File <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\avaavaxvyy.job => C:\Users\Françoise\AppData\Local\avaavaxvyy\avaavaxvyy.exe
Task: C:\Windows\Tasks\Binkiland.job => C:\Users\FRANOI~1\AppData\Roaming\BINKIL~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\FDEDZBML.job => C:\Users\Franýÿoise\AppData\Roaming\FDEDZBML.exe <==== ATTENTION
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\GWEXI.job => C:\Users\Franýÿoise\AppData\Roaming\GWEXI.exe <==== ATTENTION
Task: C:\Windows\Tasks\LQNCBDR.job => C:\Users\Franýÿoise\AppData\Roaming\LQNCBDR.exe <==== ATTENTION
Task: C:\Windows\Tasks\OKPPBAAR.job => C:\Users\Franýÿoise\AppData\Roaming\OKPPBAAR.exe <==== ATTENTION
Task: C:\Windows\Tasks\ONLLP.job => C:\Users\Franýÿoise\AppData\Roaming\ONLLP.exe <==== ATTENTION
Task: C:\Windows\Tasks\PWKN.job => C:\Users\Franýÿoise\AppData\Roaming\PWKN.exe <==== ATTENTION
Task: C:\Windows\Tasks\THULJOON.job => C:\Users\Franýÿoise\AppData\Roaming\THULJOON.exe <==== ATTENTION
Task: C:\Windows\Tasks\TJYHKE.job => C:\Users\Franýÿoise\AppData\Roaming\TJYHKE.exe <==== ATTENTION
Task: C:\Windows\Tasks\UFQUWS.job => C:\Users\Franýÿoise\AppData\Roaming\UFQUWS.exe <==== ATTENTION
Task: C:\Windows\Tasks\User_Feed_Synchronization-{F3D00496-1512-4FEF-A011-C2925A21559B}.job => C:\Windows\system32\msfeedssync.exe



Une fois, le texte coller dans le bloc-note.
Menu Fichier puis Enregistrer sous.
A gauche, place toi sur le bureau.
Dans le champs en bas, nom du fichier mets : fixlist.txt
Clic sur Enregistrer - cela va créer un fichier fixlist.txt sur le bureau.

Relance FRST et clic sur le bouton Fix
Selon comment un redémarrage est nécessaire (pas obligatoire).
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

Redémarre l'ordinateur


Supprime les PUM.DNS avec RogueKiller en suivant ce tutorial : https://forum.malekal.com/viewtopic.php?t=48312&start=
Donne le rapport de suppression de RogueKiller.


puis :

puis réinitialise tes navigateurs:
==================================
Réinitialise tes navigateurs et ou manuellement reparamètre tes navigateurs WEB (page de démarrage, moteur de recherche etc) mais aussi supprimer/désactiver les extensions inutiles/parasites :



0
Réponse 11 / 21
girfred Messages postés 17 Date d'inscription   Statut Membre Dernière intervention  
 
Bien enfin ,c'est vraiment galère.


Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by Françoise at 2015-04-05 13:43:53 Run:1
Running from C:\Users\Françoise\Desktop
Loaded Profiles: Françoise (Available profiles: Françoise)
Boot Mode: Normal
==============================================

Content of fixlist:

HKLM-x32\...\Run: [gmsd_fr_340] => [X]
HKLM-x32\...\Run: [gmsd_fr_349] => [X]
HKLM-x32\...\Run: [gmsd_fr_362] => [X]
HKLM-x32\...\Run: [gmsd_fr_364] => C:\Program Files (x86)\gmsd_fr_364\gmsd_fr_364.exe [3983504 2015-03-30] ()
HKLM-x32\...\Run: [gmsd_fr_379] => C:\Program Files (x86)\gmsd_fr_379\gmsd_fr_379.exe [3984016 2015-04-04] ()
HKLM-x32\...\Run: [SmartWeb] => C:\Users\Françoise\AppData\Local\SmartWeb\SmartWebHelper.exe [270368 2015-02-17] (SoftBrain Technologies Ltd.)
HKLM-x32\...\RunOnce: [Ridigefekuke] => C:\Windows\SysWOW64\wscript.exe /E:vbscript /B "C:\Users\FRANOI~1\AppData\Local\61BF73~1\Cuba.dat"
HKLM-x32\...\RunOnce: [upgmsd_fr_364.exe] => C:\Users\Françoise\AppData\Local\gmsd_fr_364\upgmsd_fr_364.exe [3308688 2015-03-30] ()
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-805902893-1657446439-1934957100-1000\...\Run: [Optimizer Pro] => C:\Program Files (x86)\Optimizer Pro 3.75\OptProLauncher.exe [148008 2015-03-31] ()
HKU\S-1-5-21-805902893-1657446439-1934957100-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-805902893-1657446439-1934957100-1000\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-805902893-1657446439-1934957100-1000\...\MountPoints2: {a9835061-5c33-11e4-9a00-80c16e586cac} - G:\LaunchU3.exe
HKU\S-1-5-18\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_16_0_0_287_Plugin.exe -update plugin
AppInit_DLLs-x32: c:/progra~3/{4884a~1/192~1.1/rari.dll => "c:\progra~3\{4884a~1\192~1.1\rari.dll" File Not Found
IFEO\jumpflip: [Debugger] tasklist.exe
IFEO\volaro: [Debugger] tasklist.exe
IFEO\vonteera: [Debugger] tasklist.exe
Startup: C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hqghumeaylnlf.lnk
ShortcutTarget: hqghumeaylnlf.lnk -> C:\ProgramData\{b24c03f5-2214-6cba-b24c-c03f52210fd4}\hqghumeaylnlf.exe (PC Utilities Software Limited)
Startup: C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartWeb.lnk
ShortcutTarget: SmartWeb.lnk -> C:\Users\Françoise\AppData\Local\SmartWeb\SmartWebHelper.exe (SoftBrain Technologies Ltd.)
roxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:57266;https=127.0.0.1:57266
R2 542bb8ed; c:\Program Files (x86)\Optimizer Pro 3.75\OptProMon.dll [2292264 2015-04-04] ()
R2 cicifiso; C:\Users\Françoise\AppData\Roaming\32444335-1427214172-3535-4C39-80C16E586CAC\nsz8ACC.tmp [208384 2015-04-04] () [File not signed]
R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [158816 2015-03-16] (XTab system)
R2 toqukozi; C:\Users\Françoise\AppData\Roaming\32444335-1424508927-3535-4C39-80C16E586CAC\jnsxBEAE.tmp [90624 2015-02-21] () [File not signed]
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [493712 2015-04-04] (SysTool PasSame LIMITED)
R2 xuhejygu; C:\Users\Françoise\AppData\Roaming\32444335-1427214172-3535-4C39-80C16E586CAC\jnsu55B1.tmp [131584 2015-03-24] () [File not signed]
S2 FlashBeat; C:\ProgramData\FlashBeat\FlashBeat.exe [X]
R2 gusomybu; C:\Users\Françoise\AppData\Roaming\32444335-1424508927-3535-4C39-80C16E586CAC\nsr900.tmpfs [X]
S2 qrsvc_1.10.0.9; "C:\Program Files (x86)\QuickRef_1.10.0.9\Service\qrsvc.exe" [X]
S3 clwvd; system32\DRIVERS\clwvd.sys [X]
FF Extension: linkygemaldk - C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\Extensions\linky@gemal.dk [2014-08-31]
FF Extension: Settings Manager - C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\Extensions\{1ED03F15-1006-1C66-CCA5-15A00B80A7B7} [2014-05-18]
FF Extension: No Name - C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\extensions\boost@boost.net.xpi [Not Found]
FF Extension: No Name - C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\extensions\{8299d9bc-4fe2-4889-9adf-025a0769d461}.xpi [Not Found]
FF Extension: No Name - C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\extensions\idmsq@idmsq.com [Not Found]
FF Extension: No Name - C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [Not Found]
FF Extension: No Name - C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\extensions\taylorralston@hotmail.com [Not Found]
FF Extension: No Name - C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\extensions\0cd1569197354ecf9be03@d3ee3bc4210848f7b5a58324f064f.com [Not Found]
2015-04-05 09:14 - 2015-04-05 09:19 - 00002836 _____ () C:\Windows\System32\Tasks\APSnotifierPP1
2015-04-05 09:14 - 2015-04-05 09:19 - 00002834 _____ () C:\Windows\System32\Tasks\APSnotifierPP3
2015-04-05 09:14 - 2015-04-05 09:19 - 00002834 _____ () C:\Windows\System32\Tasks\APSnotifierPP2
2015-04-05 09:14 - 2015-04-05 09:14 - 00001045 _____ () C:\Users\Françoise\Desktop\AnyProtect.lnk
2015-04-05 09:14 - 2015-04-05 09:14 - 00000000 ____D () C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup
2015-04-05 09:13 - 2015-04-05 11:27 - 00000000 ____D () C:\Program Files (x86)\AnyProtectEx
2015-04-05 09:13 - 2015-04-05 09:13 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsjC83D.tmp
2015-04-05 09:13 - 2015-04-05 09:13 - 00000000 __SHD () C:\Users\Françoise\AppData\Roaming\AnyProtectEx
2015-04-05 09:08 - 2015-04-05 11:27 - 00000000 ____D () C:\Users\Françoise\AppData\Local\SmartWeb
2015-04-05 09:08 - 2015-04-05 09:08 - 00004058 _____ () C:\Windows\System32\Tasks\SmartWeb Upgrade Trigger Task
2015-04-05 09:07 - 2015-04-05 11:27 - 00000000 ____D () C:\Users\Françoise\AppData\Local\gmsd_fr_379
2015-04-05 09:07 - 2015-04-05 09:11 - 00000000 ____D () C:\Program Files (x86)\gmsd_fr_379
2015-04-04 23:44 - 2015-04-04 23:44 - 00000000 ____D () C:\Users\Françoise\SupTab
2015-04-04 23:29 - 2015-04-05 11:10 - 00000000 ____D () C:\Users\Françoise\AppData\Local\gmsd_fr_364
2015-04-04 23:29 - 2015-04-05 08:53 - 00003278 _____ () C:\Windows\System32\Tasks\Optimizer Pro Schedule
2015-04-04 23:29 - 2015-04-04 23:29 - 00000000 ____D () C:\Users\Françoise\Documents\Optimizer Pro
2015-04-04 23:29 - 2015-04-04 23:29 - 00000000 ____D () C:\Users\Françoise\AppData\Roaming\Optimizer Pro
2015-04-04 23:29 - 2015-04-04 23:29 - 00000000 ____D () C:\Program Files (x86)\gmsd_fr_364
2015-04-04 23:28 - 2015-04-05 08:36 - 00000000 ____D () C:\ProgramData\{b24c03f5-2214-6cba-b24c-c03f52210fd4}
2015-04-04 23:28 - 2015-04-04 23:28 - 00001099 _____ () C:\Users\Françoise\Desktop\Optimizer Pro.lnk
2015-04-04 23:28 - 2015-04-04 23:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2
2015-04-04 23:28 - 2015-04-04 23:28 - 00000000 ____D () C:\Program Files (x86)\Optimizer Pro 3.75
2015-04-04 23:27 - 2015-04-05 11:05 - 00000000 ____D () C:\Program Files (x86)\XTab
2015-04-04 23:27 - 2015-04-04 23:27 - 00001101 _____ () C:\Users\Françoise\Desktop\Continue Live Installation.lnk
2015-04-04 23:27 - 2015-04-04 23:27 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2015-04-04 23:27 - 2015-04-04 23:27 - 00000000 ____D () C:\ProgramData\IHProtectUpDate
2015-04-04 23:26 - 2015-04-04 23:26 - 00000000 ____D () C:\Users\Françoise\AppData\Roaming\mystartsearch
2015-04-04 20:07 - 2015-04-04 20:07 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsl19A7.tmp
2015-04-04 20:06 - 2015-04-05 11:40 - 00026874 _____ () C:\Users\Françoise\Desktop\FRST.txt
2015-04-04 20:06 - 2015-04-04 20:06 - 00000306 _____ () C:\Windows\Tasks\avaavaxvyy.job
2015-04-04 20:05 - 2015-04-05 11:39 - 00000000 ____D () C:\FRST
2015-04-04 20:05 - 2015-04-04 20:05 - 00000000 ____D () C:\Users\Françoise\AppData\Local\avaavaxvyy
2015-04-04 20:01 - 2015-04-04 20:01 - 02095616 _____ (Farbar) C:\Users\Françoise\Desktop\FRST64.exe
2015-04-04 19:02 - 2015-04-04 19:02 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsoEDD6.tmp
2015-04-04 18:59 - 2015-04-04 18:59 - 00000000 ____D () C:\Users\Françoise\AppData\Local\Software
2015-04-04 18:58 - 2015-04-04 18:58 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsxDBAD.tmp
2015-04-04 18:24 - 2015-04-04 23:26 - 00001615 _____ () C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-04 18:24 - 2015-04-04 18:24 - 00000300 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{F3D00496-1512-4FEF-A011-C2925A21559B}.job
2015-04-04 18:24 - 2015-04-04 18:24 - 00000000 ____D () C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-04-04 16:27 - 2015-04-04 16:27 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsgEBB7.tmp
2015-04-04 06:55 - 2015-04-04 06:55 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsbFDBE.tmp
2015-04-04 06:54 - 2015-04-04 06:54 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsl570A.tmp
2015-04-04 06:52 - 2015-04-04 06:54 - 01950208 _____ () C:\Users\Françoise\AppData\Roaming\GWEXI.exe
2015-04-04 06:52 - 2015-04-04 06:54 - 00001352 _____ () C:\Windows\Tasks\GWEXI.job
2015-04-03 09:32 - 2015-04-03 09:32 - 00000000 ___HD () C:\Users\Françoise\AppData\Local\61bf73677f83230a
2015-04-02 18:09 - 2015-04-02 18:09 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsdFDF0.tmp
2015-03-31 12:01 - 2015-04-05 03:42 - 00000000 ____D () C:\Program Files (x86)\Mountain Bike
2015-03-31 05:19 - 2015-03-31 05:19 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsiDF85.tmp
2015-03-30 10:33 - 2015-03-30 10:33 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsm5819.tmp
2015-03-30 07:23 - 2015-04-05 11:10 - 00000348 _____ () C:\Windows\Tasks\HPCeeScheduleForFrançoise.job
2015-03-30 07:17 - 2015-03-30 07:17 - 00000000 _____ () C:\Windows\SysWOW64\sho148F.tmp
2015-03-29 12:11 - 2015-03-29 12:11 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nso16B3.tmp
2015-03-29 11:57 - 2015-03-29 11:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\1 Media Player
2015-03-29 11:57 - 2015-03-29 11:57 - 00000000 ____D () C:\Program Files (x86)\1 Media Player
2015-03-29 07:38 - 2015-03-29 07:39 - 00914436 _____ () C:\Users\Françoise\Downloads\widget-1-6.zip
2015-03-28 16:36 - 2015-03-28 16:35 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsn2300.tmp
2015-03-28 16:34 - 2015-04-05 03:43 - 00000000 ____D () C:\Program Files (x86)\GoHDV28.03
2015-03-28 16:34 - 2015-03-28 16:34 - 01971200 _____ () C:\Users\Françoise\AppData\Roaming\FDEDZBML.exe
2015-03-28 16:34 - 2015-03-28 16:34 - 00001702 _____ () C:\Windows\Tasks\FDEDZBML.job
2015-03-27 17:05 - 2015-03-27 17:05 - 02250712 _____ (Company Name) C:\Users\Françoise\Downloads\adsl-tv-fm_setup.exe
2015-03-27 10:46 - 2015-03-27 10:46 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsnC48.tmp
2015-03-27 07:30 - 2015-03-27 07:30 - 00003176 _____ () C:\Windows\System32\Tasks\{29DAE379-E7E9-4211-98F1-3C0DF9E21230}
2015-03-26 21:14 - 2015-03-26 21:14 - 00005542 _____ () C:\Users\Françoise\AppData\Roaming\GWEXI
2015-03-26 21:14 - 2015-03-26 21:14 - 00005542 _____ () C:\Users\Françoise\AppData\Roaming\FDEDZBML
2015-03-26 20:50 - 2015-03-26 20:50 - 00000000 ____D () C:\ZombieNews
2015-03-26 20:43 - 2015-03-26 20:43 - 01940992 _____ () C:\Users\Françoise\AppData\Roaming\THULJOON.exe
2015-03-26 20:43 - 2015-03-26 20:43 - 00001702 _____ () C:\Windows\Tasks\THULJOON.job
2015-03-26 20:42 - 2015-03-26 20:42 - 00000000 ____D () C:\Users\Public\Documents\YTAHelper
2015-03-26 20:40 - 2015-03-26 20:40 - 00000000 ____D () C:\Users\Françoise\AppData\Local\CrashRpt
2015-03-26 20:39 - 2015-03-26 20:39 - 01978840 _____ () C:\Users\Françoise\AppData\Roaming\PWKN.exe
2015-03-26 20:39 - 2015-03-26 20:39 - 00613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsuC72D.tmp
2015-03-26 20:39 - 2015-03-26 20:39 - 00001350 _____ () C:\Windows\Tasks\PWKN.job
2015-03-26 20:36 - 2015-03-26 20:36 - 01940992 _____ () C:\Users\Françoise\AppData\Roaming\TJYHKE.exe
2015-03-26 20:36 - 2015-03-26 20:36 - 00001354 _____ () C:\Windows\Tasks\TJYHKE.job
2015-03-26 08:24 - 2015-03-26 08:24 - 00000000 _____ () C:\Users\Françoise\AppData\Local\.w852.db
2015-03-25 08:52 - 2015-03-25 08:52 - 00001103 _____ () C:\Users\Françoise\Downloads\Download-setup.website
2015-03-24 18:38 - 2015-03-24 18:38 - 00001700 _____ () C:\Windows\Tasks\LQNCBDR.job
2015-03-24 18:37 - 2015-03-24 18:37 - 01933824 _____ () C:\Users\Françoise\AppData\Roaming\LQNCBDR.exe
2015-03-24 18:35 - 2015-04-05 03:50 - 00000000 ____D () C:\Users\Françoise\AppData\Local\avaavxvyex
2015-03-24 18:27 - 2015-04-05 11:27 - 00000000 ____D () C:\Users\Françoise\AppData\Local\32444335-1427218036-3535-4C39-80C16E586CAC
2015-03-24 18:26 - 2015-03-24 18:26 - 00003582 _____ () C:\Windows\System32\Tasks\OKKFODDR
2015-03-24 18:26 - 2015-03-24 18:26 - 00001702 _____ () C:\Windows\Tasks\OKPPBAAR.job
2015-03-24 18:26 - 2015-03-24 18:26 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webTinstMKTN_01009.Wdf
2015-03-24 18:26 - 2015-03-24 18:25 - 01933824 _____ () C:\Users\Françoise\AppData\Roaming\OKPPBAAR.exe
2015-03-24 18:25 - 2015-04-05 11:26 - 00000000 ____D () C:\ProgramData\e551e40cdd5e4104afe48d92c795a590
2015-03-24 18:25 - 2015-03-24 18:25 - 00000000 ____D () C:\ProgramData\7fbb4485eae14230b10d76d5ce7f1c83
2015-03-24 18:24 - 2015-03-24 18:24 - 00000000 ____D () C:\Users\Françoise\AppData\Roaming\WebplayerRemote
2015-03-24 18:22 - 2015-04-05 10:35 - 00000000 ____D () C:\Users\Françoise\AppData\Roaming\32444335-1427214172-3535-4C39-80C16E586CAC
2015-03-24 18:20 - 2015-04-04 18:22 - 00000000 ____D () C:\Program Files (x86)\CloudScout Parental Control
2015-03-24 18:19 - 2015-03-24 18:19 - 00000000 ____D () C:\d05e7453-6a9e-4756-b897-37340347d5ca
2015-03-23 18:55 - 2015-04-04 15:42 - 00000978 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job
2015-03-23 18:55 - 2015-04-04 14:34 - 00000982 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job
2015-04-04 15:55 - 2015-03-02 09:55 - 00000306 _____ () C:\Windows\Tasks\Binkiland.job
2015-04-04 15:40 - 2015-01-19 11:23 - 00000000 ____D () C:\Users\Françoise\AppData\Everything
2015-04-04 12:10 - 2014-04-07 20:04 - 00000451 _____ () C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Yahoo!.website
2015-04-05 09:59 - 2014-05-05 06:27 - 00000378 _____ () C:\Windows\Tasks\APSnotifierPP1.job
2015-03-26 21:14 - 2015-03-26 21:14 - 0005542 _____ () C:\Users\Françoise\AppData\Roaming\FDEDZBML
2015-03-28 16:34 - 2015-03-28 16:34 - 1971200 _____ () C:\Users\Françoise\AppData\Roaming\FDEDZBML.exe
2015-03-26 21:14 - 2015-03-26 21:14 - 0005542 _____ () C:\Users\Françoise\AppData\Roaming\GWEXI
2015-04-04 06:52 - 2015-04-04 06:54 - 1950208 _____ () C:\Users\Françoise\AppData\Roaming\GWEXI.exe
2015-03-09 23:30 - 2015-03-09 23:30 - 0005487 _____ () C:\Users\Françoise\AppData\Roaming\LQNCBDR
2015-03-24 18:37 - 2015-03-24 18:37 - 1933824 _____ () C:\Users\Françoise\AppData\Roaming\LQNCBDR.exe
2015-03-09 23:30 - 2015-03-09 23:30 - 0005487 _____ () C:\Users\Françoise\AppData\Roaming\OKPPBAAR
2015-03-24 18:26 - 2015-03-24 18:25 - 1933824 _____ () C:\Users\Françoise\AppData\Roaming\OKPPBAAR.exe
2014-09-01 10:18 - 2014-09-01 10:18 - 0001248 _____ () C:\Users\Françoise\AppData\Roaming\ONLLP
2015-01-25 18:12 - 2015-01-25 18:12 - 0001248 _____ () C:\Users\Françoise\AppData\Roaming\PWKN
2015-03-26 20:39 - 2015-03-26 20:39 - 1978840 _____ () C:\Users\Françoise\AppData\Roaming\PWKN.exe
2015-03-09 23:30 - 2015-03-09 23:30 - 0005487 _____ () C:\Users\Françoise\AppData\Roaming\THULJOON
2015-03-26 20:43 - 2015-03-26 20:43 - 1940992 _____ () C:\Users\Françoise\AppData\Roaming\THULJOON.exe
2015-03-09 23:30 - 2015-03-09 23:30 - 0005487 _____ () C:\Users\Françoise\AppData\Roaming\TJYHKE
2015-03-26 20:36 - 2015-03-26 20:36 - 1940992 _____ () C:\Users\Françoise\AppData\Roaming\TJYHKE.exe
2014-09-01 10:18 - 2014-09-01 10:18 - 0002086 _____ () C:\Users\Françoise\AppData\Roaming\UFQUWS
2014-12-17 12:12 - 2014-12-17 12:12 - 0022528 _____ () C:\Users\Françoise\AppData\Local\dsisetup13768332.exe
2015-02-23 12:38 - 2015-02-23 12:38 - 0613057 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsb2586.tmp
2015-04-04 06:55 - 2015-04-04 06:55 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsbFDBE.tmp
2015-04-02 18:09 - 2015-04-02 18:09 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsdFDF0.tmp
2015-04-04 16:27 - 2015-04-04 16:27 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsgEBB7.tmp
2014-05-09 18:31 - 2014-05-09 18:31 - 0301488 _____ (VuuPC Limited) C:\Users\Françoise\AppData\Local\nsi1680.tmp
2015-03-31 05:19 - 2015-03-31 05:19 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsiDF85.tmp
2015-04-05 09:13 - 2015-04-05 09:13 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsjC83D.tmp
2015-04-04 20:07 - 2015-04-04 20:07 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsl19A7.tmp
2015-04-04 06:54 - 2015-04-04 06:54 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsl570A.tmp
2015-02-21 10:49 - 2015-02-21 10:49 - 0613057 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsl76E0.tmp
2015-03-30 10:33 - 2015-03-30 10:33 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsm5819.tmp
2015-03-28 16:36 - 2015-03-28 16:35 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsn2300.tmp
2015-03-27 10:46 - 2015-03-27 10:46 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsnC48.tmp
2015-03-29 12:11 - 2015-03-29 12:11 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nso16B3.tmp
2015-04-04 19:02 - 2015-04-04 19:02 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsoEDD6.tmp
2015-03-26 20:39 - 2015-03-26 20:39 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsuC72D.tmp
2015-04-04 18:58 - 2015-04-04 18:58 - 0613255 _____ (CMI Limited) C:\Users\Françoise\AppData\Local\nsxDBAD.tmp
2014-11-14 08:12 - 2014-11-14 08:12 - 0301608 _____ (VuuPC Limited) C:\Users\Françoise\AppData\Local\nsy3999.tmp
2015-04-04 15:14 - 2015-03-01 15:52 - 0196504 _____ () C:\Program Files (x86)\9tres.dll
2015-04-04 15:14 - 2015-03-01 15:52 - 1037896 _____ () C:\Program Files (x86)\9tUninstall Internet Speed Tracker.dll
Task: {0C399515-1567-4D57-81CD-079D99FFF752} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {12FFAF24-CD9C-44A8-87F3-40B7BD32B842} - System32\Tasks\t4h2IDlcVS2y0Sr => C:\Users\Françoise\AppData\Roaming\jDuSLEf\6O1gHkb.exe
Task: {26E4C186-E388-4729-B0DC-40672FC139FB} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {2A377C54-9448-48C7-81BC-4F827718F323} - System32\Tasks\{0072C348-C0F5-4690-B9C5-C8B850EAAA95} => pcalua.exe -a C:\Users\Françoise\AppData\Roaming\sweet-page\UninstallManager.exe -c -ptid=cor
Task: {2A83656A-D193-4CDE-AFD1-3D0F5462B76A} - System32\Tasks\S7qLnZDxEjVnWif => C:\Users\Françoise\AppData\Roaming\FXOoNoy\eSAjdhI.exe [2015-02-27] ( )
Task: {2F74EA80-3F09-42F5-BB56-FD6D23201531} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {70D31263-C8AA-4F72-94CD-B847C475C5B0} - \8c6736a2-0446-4148-8f02-ca63eff37ec5-12 No Task File <==== ATTENTION
Task: {70EB7038-801D-4629-B59A-F2B52526ACD8} - System32\Tasks\{1393E89C-3D33-423C-BECB-D5548128FBC0} => pcalua.exe -a C:\Users\Françoise\AppData\Roaming\omiga-plus\UninstallManager.exe -c -ptid=adks <==== ATTENTION
Task: {7904E1AC-513E-4EB8-A318-65389D155BFD} - System32\Tasks\{E3E303C7-214A-4246-8966-F0426841A603} => Iexplore.exe http://ui.skype.com/ui/0/5.6.0.110.161/fr/abandoninstall?page=tsDownload&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;disabled
Task: {8255801E-C819-4A83-A3BD-006338DEBEF6} - System32\Tasks\ULNtEsDPMKLzji9 => C:\Users\Françoise\AppData\Roaming\Cpap4wF\gn5Vm4r.exe
Task: {828CA497-D5EC-40F1-82B1-D94654F80D64} - System32\Tasks\SmartWeb Upgrade Trigger Task => C:\Users\Françoise\AppData\Local\SmartWeb\SmartWebHelper.exe [2015-02-17] (SoftBrain Technologies Ltd.) <==== ATTENTION
Task: {89431725-61A5-43B7-B149-4F68602D645C} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {8B7A841B-A394-44EA-A832-C8834484C0C3} - \8c6736a2-0446-4148-8f02-ca63eff37ec5-1-7 No Task File <==== ATTENTION
Task: {8CCE1C4E-E6A6-4004-B556-526E9C1DD61F} - System32\Tasks\Optimizer Pro Schedule => C:\Program Files (x86)\Optimizer Pro 3.75\OptProLauncher.exe [2015-03-31] () <==== ATTENTION
Task: {924D639B-824C-4387-85D8-6B8F305DD4CD} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {94907B4A-CFE9-4508-B069-BDF1D85BEE81} - System32\Tasks\WIN-statsAdmin => C:\Users\Françoise\AppData\Local\Microsoft\WinU\~pqrhxft.exe <==== ATTENTION
Task: {A269C044-F854-4A64-A9C0-E84F64848B15} - System32\Tasks\{9687AFBA-FA57-48A3-90A8-3D61C414676A} => pcalua.exe -a C:\Users\Françoise\AppData\Roaming\qone8\UninstallManager.exe -c -ptid=adks
Task: {A832BAFF-4526-4A32-A841-37226B978D64} - System32\Tasks\{29DAE379-E7E9-4211-98F1-3C0DF9E21230} => pcalua.exe -a C:\Users\Françoise\AppData\Roaming\mystartsearch\UninstallManager.exe -c -ptid=smt
Task: {AE872F99-D435-474D-B58A-D4D2145EF8A9} - System32\Tasks\WIN-statsSystem => C:\Users\Françoise\AppData\Local\Microsoft\WinU\~frodbro.exe
Task: {B4F88351-D346-47F7-BF79-FFEA82521039} - System32\Tasks\9XGQKw3LInouXt0 => C:\Users\Françoise\AppData\Roaming\xmfTvyu\yUAoRwK.exe [2015-02-24] ( )
Task: {C2AF11FA-199C-49F3-8234-A42D3EF9F64A} - System32\Tasks\{1ED12CDA-49C0-49C3-876E-45DFAE76E072} => Firefox.exe
Task: {C3A564F3-F565-444F-B9B9-2C7BE983C80C} - System32\Tasks\WIN-GGfIfEGCfEGbGffIfCfEGC => C:\Users\Françoise\AppData\Roaming\~lbehxzl.exe
Task: {CE821C2E-F472-4C86-B298-9539C29181B5} - System32\Tasks\OKKFODDR => C:\ProgramData\e551e40cdd5e4104afe48d92c795a590\e551e40cdd5e4104afe48d92c795a590.exe
Task: {E5FBFE04-9BCE-47A6-AB45-41896307775D} - System32\Tasks\{6C6A1B19-AC17-40B1-81FA-F846708DC1B4} => Iexplore.exe http://ui.skype.com/ui/0/5.6.0.110.161/fr/abandoninstall?page=tsDownload&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;disabled
Task: {F08FCB6F-1C7C-4618-897D-DCA0C185FF9C} - System32\Tasks\{A9DA2D5F-CB04-4000-BA22-B132226837FD} => Iexplore.exe http://ui.skype.com/ui/0/5.6.0.110.161/fr/abandoninstall?page=tsDownload&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;disabled
Task: {F486969F-6FE3-4F2B-9DE6-EF16AAA97E54} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-04] (Google Inc.)
Task: {F9283F80-A3F8-43C6-BE94-75A3471EFCC1} - \8c6736a2-0446-4148-8f02-ca63eff37ec5-1-6 No Task File <==== ATTENTION
Task: {FAEBBC22-5575-45A7-B295-A53013F7C389} - \8c6736a2-0446-4148-8f02-ca63eff37ec5-5 No Task File <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\avaavaxvyy.job => C:\Users\Françoise\AppData\Local\avaavaxvyy\avaavaxvyy.exe
Task: C:\Windows\Tasks\Binkiland.job => C:\Users\FRANOI~1\AppData\Roaming\BINKIL~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\FDEDZBML.job => C:\Users\Franýÿoise\AppData\Roaming\FDEDZBML.exe <==== ATTENTION
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\GWEXI.job => C:\Users\Franýÿoise\AppData\Roaming\GWEXI.exe <==== ATTENTION
Task: C:\Windows\Tasks\LQNCBDR.job => C:\Users\Franýÿoise\AppData\Roaming\LQNCBDR.exe <==== ATTENTION
Task: C:\Windows\Tasks\OKPPBAAR.job => C:\Users\Franýÿoise\AppData\Roaming\OKPPBAAR.exe <==== ATTENTION
Task: C:\Windows\Tasks\ONLLP.job => C:\Users\Franýÿoise\AppData\Roaming\ONLLP.exe <==== ATTENTION
Task: C:\Windows\Tasks\PWKN.job => C:\Users\Franýÿoise\AppData\Roaming\PWKN.exe <==== ATTENTION
Task: C:\Windows\Tasks\THULJOON.job => C:\Users\Franýÿoise\AppData\Roaming\THULJOON.exe <==== ATTENTION
Task: C:\Windows\Tasks\TJYHKE.job => C:\Users\Franýÿoise\AppData\Roaming\TJYHKE.exe <==== ATTENTION
Task: C:\Windows\Tasks\UFQUWS.job => C:\Users\Franýÿoise\AppData\Roaming\UFQUWS.exe <==== ATTENTION
Task: C:\Windows\Tasks\User_Feed_Synchronization-{F3D00496-1512-4FEF-A011-C2925A21559B}.job => C:\Windows\system32\msfeedssync.exe


HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\gmsd_fr_340 => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\gmsd_fr_349 => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\gmsd_fr_362 => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\gmsd_fr_364 => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\gmsd_fr_379 => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SmartWeb => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\Ridigefekuke => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\upgmsd_fr_364.exe => value deleted successfully.
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui" => Key deleted successfully.
HKU\S-1-5-21-805902893-1657446439-1934957100-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Optimizer Pro => value deleted successfully.
HKU\S-1-5-21-805902893-1657446439-1934957100-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\\DisableLockWorkstation => value deleted successfully.
HKU\S-1-5-21-805902893-1657446439-1934957100-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\\DisableChangePassword => value deleted successfully.
"HKU\S-1-5-21-805902893-1657446439-1934957100-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a9835061-5c33-11e4-9a00-80c16e586cac}" => Key deleted successfully.
HKCR\CLSID\{a9835061-5c33-11e4-9a00-80c16e586cac} => Key not found.
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\\FlashPlayerUpdate => value deleted successfully.
"c:/progra~3/{4884a~1/192~1.1/rari.dll" => Value Data removed successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\jumpflip" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\volaro" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\vonteera" => Key deleted successfully.
C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hqghumeaylnlf.lnk => Moved successfully.
C:\ProgramData\{b24c03f5-2214-6cba-b24c-c03f52210fd4}\hqghumeaylnlf.exe => Moved successfully.
C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartWeb.lnk => Moved successfully.
C:\Users\Françoise\AppData\Local\SmartWeb\SmartWebHelper.exe => Moved successfully.
roxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled. => Error: No automatic fix found for this entry.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
542bb8ed => Service deleted successfully.
cicifiso => Service stopped successfully.
cicifiso => Service deleted successfully.
IHProtect Service => Service stopped successfully.
IHProtect Service => Service deleted successfully.
toqukozi => Service stopped successfully.
toqukozi => Service deleted successfully.
WindowsMangerProtect => Service stopped successfully.
WindowsMangerProtect => Service deleted successfully.
xuhejygu => Service stopped successfully.
xuhejygu => Service deleted successfully.
FlashBeat => Service deleted successfully.
gusomybu => Service stopped successfully.
gusomybu => Service deleted successfully.
qrsvc_1.10.0.9 => Service deleted successfully.
clwvd => Service deleted successfully.
C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\Extensions\linky@gemal.dk => Moved successfully.
C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\Extensions\{1ED03F15-1006-1C66-CCA5-15A00B80A7B7} => Moved successfully.
C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\extensions\boost@boost.net.xpi not found.
C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\extensions\{8299d9bc-4fe2-4889-9adf-025a0769d461}.xpi not found.
C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\extensions\idmsq@idmsq.com not found.
C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} not found.
C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\extensions\taylorralston@hotmail.com not found.
C:\Users\Françoise\AppData\Roaming\Mozilla\Firefox\Profiles\4xlmdvpw.default\extensions\0cd1569197354ecf9be03@d3ee3bc4210848f7b5a58324f064f.com not found.
C:\Windows\System32\Tasks\APSnotifierPP1 => Moved successfully.
C:\Windows\System32\Tasks\APSnotifierPP3 => Moved successfully.
C:\Windows\System32\Tasks\APSnotifierPP2 => Moved successfully.
C:\Users\Françoise\Desktop\AnyProtect.lnk => Moved successfully.
C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup => Moved successfully.
C:\Program Files (x86)\AnyProtectEx => Moved successfully.
C:\Users\Françoise\AppData\Local\nsjC83D.tmp => Moved successfully.
C:\Users\Françoise\AppData\Roaming\AnyProtectEx => Moved successfully.
C:\Users\Françoise\AppData\Local\SmartWeb => Moved successfully.
C:\Windows\System32\Tasks\SmartWeb Upgrade Trigger Task => Moved successfully.
C:\Users\Françoise\AppData\Local\gmsd_fr_379 => Moved successfully.
C:\Program Files (x86)\gmsd_fr_379 => Moved successfully.
C:\Users\Françoise\SupTab => Moved successfully.
C:\Users\Françoise\AppData\Local\gmsd_fr_364 => Moved successfully.
C:\Windows\System32\Tasks\Optimizer Pro Schedule => Moved successfully.
C:\Users\Françoise\Documents\Optimizer Pro => Moved successfully.
C:\Users\Françoise\AppData\Roaming\Optimizer Pro => Moved successfully.
C:\Program Files (x86)\gmsd_fr_364 => Moved successfully.
C:\ProgramData\{b24c03f5-2214-6cba-b24c-c03f52210fd4} => Moved successfully.
C:\Users\Françoise\Desktop\Optimizer Pro.lnk => Moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2 => Moved successfully.
C:\Program Files (x86)\Optimizer Pro 3.75 => Moved successfully.
C:\Program Files (x86)\XTab => Moved successfully.
C:\Users\Françoise\Desktop\Continue Live Installation.lnk => Moved successfully.
C:\ProgramData\WindowsMangerProtect => Moved successfully.
C:\ProgramData\IHProtectUpDate => Moved successfully.
C:\Users\Françoise\AppData\Roaming\mystartsearch => Moved successfully.
C:\Users\Françoise\AppData\Local\nsl19A7.tmp => Moved successfully.
C:\Users\Françoise\Desktop\FRST.txt => Moved successfully.
C:\Windows\Tasks\avaavaxvyy.job => Moved successfully.

"C:\FRST" directory move:

Could not move "C:\FRST" directory. => Scheduled to move on reboot.

C:\Users\Françoise\AppData\Local\avaavaxvyy => Moved successfully.
C:\Users\Françoise\Desktop\FRST64.exe => Moved successfully.
C:\Users\Françoise\AppData\Local\nsoEDD6.tmp => Moved successfully.
C:\Users\Françoise\AppData\Local\Software => Moved successfully.
C:\Users\Françoise\AppData\Local\nsxDBAD.tmp => Moved successfully.
C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk => Moved successfully.
C:\Windows\Tasks\User_Feed_Synchronization-{F3D00496-1512-4FEF-A011-C2925A21559B}.job => Moved successfully.
C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories => Moved successfully.
C:\Users\Françoise\AppData\Local\nsgEBB7.tmp => Moved successfully.
C:\Users\Françoise\AppData\Local\nsbFDBE.tmp => Moved successfully.
C:\Users\Françoise\AppData\Local\nsl570A.tmp => Moved successfully.
C:\Users\Françoise\AppData\Roaming\GWEXI.exe => Moved successfully.
C:\Windows\Tasks\GWEXI.job => Moved successfully.
C:\Users\Françoise\AppData\Local\61bf73677f83230a => Moved successfully.
C:\Users\Françoise\AppData\Local\nsdFDF0.tmp => Moved successfully.
C:\Program Files (x86)\Mountain Bike => Moved successfully.
C:\Users\Françoise\AppData\Local\nsiDF85.tmp => Moved successfully.
C:\Users\Françoise\AppData\Local\nsm5819.tmp => Moved successfully.
C:\Windows\Tasks\HPCeeScheduleForFrançoise.job => Moved successfully.
C:\Windows\SysWOW64\sho148F.tmp => Moved successfully.
C:\Users\Françoise\AppData\Local\nso16B3.tmp => Moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\1 Media Player => Moved successfully.
C:\Program Files (x86)\1 Media Player => Moved successfully.
C:\Users\Françoise\Downloads\widget-1-6.zip => Moved successfully.
C:\Users\Françoise\AppData\Local\nsn2300.tmp => Moved successfully.
C:\Program Files (x86)\GoHDV28.03 => Moved successfully.
C:\Users\Françoise\AppData\Roaming\FDEDZBML.exe => Moved successfully.
C:\Windows\Tasks\FDEDZBML.job => Moved successfully.
C:\Users\Françoise\Downloads\adsl-tv-fm_setup.exe => Moved successfully.
C:\Users\Françoise\AppData\Local\nsnC48.tmp => Moved successfully.
C:\Windows\System32\Tasks\{29DAE379-E7E9-4211-98F1-3C0DF9E21230} => Moved successfully.
C:\Users\Françoise\AppData\Roaming\GWEXI => Moved successfully.
C:\Users\Françoise\AppData\Roaming\FDEDZBML => Moved successfully.
C:\ZombieNews => Moved successfully.
C:\Users\Françoise\AppData\Roaming\THULJOON.exe => Moved successfully.
C:\Windows\Tasks\THULJOON.job => Moved successfully.
C:\Users\Public\Documents\YTAHelper => Moved successfully.
C:\Users\Françoise\AppData\Local\CrashRpt => Moved successfully.
C:\Users\Françoise\AppData\Roaming\PWKN.exe => Moved successfully.
C:\Users\Françoise\AppData\Local\nsuC72D.tmp => Moved successfully.
C:\Windows\Tasks\PWKN.job => Moved successfully.
C:\Users\Françoise\AppData\Roaming\TJYHKE.exe => Moved successfully.
C:\Windows\Tasks\TJYHKE.job => Moved successfully.
C:\Users\Françoise\AppData\Local\.w852.db => Moved successfully.
C:\Users\Françoise\Downloads\Download-setup.website => Moved successfully.
C:\Windows\Tasks\LQNCBDR.job => Moved successfully.
C:\Users\Françoise\AppData\Roaming\LQNCBDR.exe => Moved successfully.
C:\Users\Françoise\AppData\Local\avaavxvyex => Moved successfully.
C:\Users\Françoise\AppData\Local\32444335-1427218036-3535-4C39-80C16E586CAC => Moved successfully.
C:\Windows\System32\Tasks\OKKFODDR => Moved successfully.
C:\Windows\Tasks\OKPPBAAR.job => Moved successfully.
C:\Windows\system32\Drivers\Msft_Kernel_webTinstMKTN_01009.Wdf => Moved successfully.
C:\Users\Françoise\AppData\Roaming\OKPPBAAR.exe => Moved successfully.
C:\ProgramData\e551e40cdd5e4104afe48d92c795a590 => Moved successfully.
C:\ProgramData\7fbb4485eae14230b10d76d5ce7f1c83 => Moved successfully.
C:\Users\Françoise\AppData\Roaming\WebplayerRemote => Moved successfully.
C:\Users\Françoise\AppData\Roaming\32444335-1427214172-3535-4C39-80C16E586CAC => Moved successfully.
C:\Program Files (x86)\CloudScout Parental Control => Moved successfully.
C:\d05e7453-6a9e-4756-b897-37340347d5ca => Moved successfully.
C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => Moved successfully.
C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job => Moved successfully.
C:\Windows\Tasks\Binkiland.job => Moved successfully.
C:\Users\Françoise\AppData\Everything => Moved successfully.
C:\Users\Françoise\AppData\Roaming\Microsoft\Windows\Start Menu\Yahoo!.website => Moved successfully.
C:\Windows\Tasks\APSnotifierPP1.job => Moved successfully.
"C:\Users\Françoise\AppData\Roaming\FDEDZBML" => File/Directory not found.
"C:\Users\Françoise\AppData\Roaming\FDEDZBML.exe" => File/Directory not found.
"C:\Users\Françoise\AppData\Roaming\GWEXI" => File/Directory not found.
"C:\Users\Françoise\AppData\Roaming\GWEXI.exe" => File/Directory not found.
C:\Users\Françoise\AppData\Roaming\LQNCBDR => Moved successfully.
"C:\Users\Françoise\AppData\Roaming\LQNCBDR.exe" => File/Directory not found.
C:\Users\Françoise\AppData\Roaming\OKPPBAAR => Moved successfully.
"C:\Users\Françoise\AppData\Roaming\OKPPBAAR.exe" => File/Directory not found.
C:\Users\Françoise\AppData\Roaming\ONLLP => Moved successfully.
C:\Users\Françoise\AppData\Roaming\PWKN => Moved successfully.
"C:\Users\Françoise\AppData\Roaming\PWKN.exe" => File/Directory not found.
C:\Users\Françoise\AppData\Roaming\THULJOON => Moved successfully.
"C:\Users\Françoise\AppData\Roaming\THULJOON.exe" => File/Directory not found.
C:\Users\Françoise\AppData\Roaming\TJYHKE => Moved successfully.
"C:\Users\Françoise\AppData\Roaming\TJYHKE.exe" => File/Directory not found.
C:\Users\Françoise\AppData\Roaming\UFQUWS => Moved successfully.
C:\Users\Françoise\AppData\Local\dsisetup13768332.exe => Moved successfully.
C:\Users\Françoise\AppData\Local\nsb2586.tmp => Moved successfully.
"C:\Users\Françoise\AppData\Local\nsbFDBE.tmp" => File/Directory not found.
"C:\Users\Françoise\AppData\Local\nsdFDF0.tmp" => File/Directory not found.
"C:\Users\Françoise\AppData\Local\nsgEBB7.tmp" => File/Directory not found.
C:\Users\Françoise\AppData\Local\nsi1680.tmp => Moved successfully.
"C:\Users\Françoise\AppData\Local\nsiDF85.tmp" => File/Directory not found.
"C:\Users\Françoise\AppData\Local\nsjC83D.tmp" => File/Directory not found.
"C:\Users\Françoise\AppData\Local\nsl19A7.tmp" => File/Directory not found.
"C:\Users\Françoise\AppData\Local\nsl570A.tmp" => File/Directory not found.
C:\Users\Françoise\AppData\Local\nsl76E0.tmp => Moved successfully.
"C:\Users\Françoise\AppData\Local\nsm5819.tmp" => File/Directory not found.
"C:\Users\Françoise\AppData\Local\nsn2300.tmp" => File/Directory not found.
"C:\Users\Françoise\AppData\Local\nsnC48.tmp" => File/Directory not found.
"C:\Users\Françoise\AppData\Local\nso16B3.tmp" => File/Directory not found.
"C:\Users\Françoise\AppData\Local\nsoEDD6.tmp" => File/Directory not found.
"C:\Users\Françoise\AppData\Local\nsuC72D.tmp" => File/Directory not found.
"C:\Users\Françoise\AppData\Local\nsxDBAD.tmp" => File/Directory not found.
C:\Users\Françoise\AppData\Local\nsy3999.tmp => Moved successfully.
C:\Program Files (x86)\9tres.dll => Moved successfully.
C:\Program Files (x86)\9tUninstall Internet Speed Tracker.dll => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0C399515-1567-4D57-81CD-079D99FFF752}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0C399515-1567-4D57-81CD-079D99FFF752}" => Key deleted successfully.
C:\Windows\System32\Tasks\APSnotifierPP1 not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP1" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{12FFAF24-CD9C-44A8-87F3-40B7BD32B842}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{12FFAF24-CD9C-44A8-87F3-40B7BD32B842}" => Key deleted successfully.
C:\Windows\System32\Tasks\t4h2IDlcVS2y0Sr => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\t4h2IDlcVS2y0Sr" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{26E4C186-E388-4729-B0DC-40672FC139FB}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{26E4C186-E388-4729-B0DC-40672FC139FB}" => Key deleted successfully.
C:\Windows\System32\Tasks\APSnotifierPP3 not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP3" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2A377C54-9448-48C7-81BC-4F827718F323}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2A377C54-9448-48C7-81BC-4F827718F323}" => Key deleted successfully.
C:\Windows\System32\Tasks\{0072C348-C0F5-4690-B9C5-C8B850EAAA95} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{0072C348-C0F5-4690-B9C5-C8B850EAAA95}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{2A83656A-D193-4CDE-AFD1-3D0F5462B76A}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2A83656A-D193-4CDE-AFD1-3D0F5462B76A}" => Key deleted successfully.
C:\Windows\System32\Tasks\S7qLnZDxEjVnWif => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\S7qLnZDxEjVnWif" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2F74EA80-3F09-42F5-BB56-FD6D23201531}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2F74EA80-3F09-42F5-BB56-FD6D23201531}" => Key deleted successfully.
C:\Windows\System32\Tasks\APSnotifierPP2 not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP2" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{70D31263-C8AA-4F72-94CD-B847C475C5B0}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{70D31263-C8AA-4F72-94CD-B847C475C5B0}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\8c6736a2-0446-4148-8f02-ca63eff37ec5-12" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{70EB7038-801D-4629-B59A-F2B52526ACD8}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{70EB7038-801D-4629-B59A-F2B52526ACD8}" => Key deleted successfully.
C:\Windows\System32\Tasks\{1393E89C-3D33-423C-BECB-D5548128FBC0} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{1393E89C-3D33-423C-BECB-D5548128FBC0}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7904E1AC-513E-4EB8-A318-65389D155BFD}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7904E1AC-513E-4EB8-A318-65389D155BFD}" => Key deleted successfully.
C:\Windows\System32\Tasks\{E3E303C7-214A-4246-8966-F0426841A603} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{E3E303C7-214A-4246-8966-F0426841A603}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{8255801E-C819-4A83-A3BD-006338DEBEF6}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8255801E-C819-4A83-A3BD-006338DEBEF6}" => Key deleted successfully.
C:\Windows\System32\Tasks\ULNtEsDPMKLzji9 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ULNtEsDPMKLzji9" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{828CA497-D5EC-40F1-82B1-D94654F80D64}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{828CA497-D5EC-40F1-82B1-D94654F80D64}" => Key deleted successfully.
C:\Windows\System32\Tasks\SmartWeb Upgrade Trigger Task not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SmartWeb Upgrade Trigger Task" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{89431725-61A5-43B7-B149-4F68602D645C}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{89431725-61A5-43B7-B149-4F68602D645C}" => Key deleted successfully.
C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OfficeSoftwareProtectionPlatform\SvcRestartTask" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{8B7A841B-A394-44EA-A832-C8834484C0C3}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8B7A841B-A394-44EA-A832-C8834484C0C3}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\8c6736a2-0446-4148-8f02-ca63eff37ec5-1-7" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{8CCE1C4E-E6A6-4004-B556-526E9C1DD61F}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8CCE1C4E-E6A6-4004-B556-526E9C1DD61F}" => Key deleted successfully.
C:\Windows\System32\Tasks\Optimizer Pro Schedule not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Optimizer Pro Schedule" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{924D639B-824C-4387-85D8-6B8F305DD4CD}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{924D639B-824C-4387-85D8-6B8F305DD4CD}" => Key deleted successfully.
C:\Windows\System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{94907B4A-CFE9-4508-B069-BDF1D85BEE81}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{94907B4A-CFE9-4508-B069-BDF1D85BEE81}" => Key deleted successfully.
C:\Windows\System32\Tasks\WIN-statsAdmin => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WIN-statsAdmin" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A269C044-F854-4A64-A9C0-E84F64848B15}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A269C044-F854-4A64-A9C0-E84F64848B15}" => Key deleted successfully.
C:\Windows\System32\Tasks\{9687AFBA-FA57-48A3-90A8-3D61C414676A} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{9687AFBA-FA57-48A3-90A8-3D61C414676A}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A832BAFF-4526-4A32-A841-37226B978D64}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A832BAFF-4526-4A32-A841-37226B978D64}" => Key deleted successfully.
C:\Windows\System32\Tasks\{29DAE379-E7E9-4211-98F1-3C0DF9E21230} not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{29DAE379-E7E9-4211-98F1-3C0DF9E21230}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{AE872F99-D435-474D-B58A-D4D2145EF8A9}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AE872F99-D435-474D-B58A-D4D2145EF8A9}" => Key deleted successfully.
C:\Windows\System32\Tasks\WIN-statsSystem => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WIN-statsSystem" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{B4F88351-D346-47F7-BF79-FFEA82521039}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B4F88351-D346-47F7-BF79-FFEA82521039}" => Key deleted successfully.
C:\Windows\System32\Tasks\9XGQKw3LInouXt0 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\9XGQKw3LInouXt0" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C2AF11FA-199C-49F3-8234-A42D3EF9F64A}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C2AF11FA-199C-49F3-8234-A42D3EF9F64A}" => Key deleted successfully.
C:\Windows\System32\Tasks\{1ED12CDA-49C0-49C3-876E-45DFAE76E072} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{1ED12CDA-49C0-49C3-876E-45DFAE76E072}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{C3A564F3-F565-444F-B9B9-2C7BE983C80C}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C3A564F3-F565-444F-B9B9-2C7BE983C80C}" => Key deleted successfully.
C:\Windows\System32\Tasks\WIN-GGfIfEGCfEGbGffIfCfEGC => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WIN-GGfIfEGCfEGbGffIfCfEGC" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CE821C2E-F472-4C86-B298-9539C29181B5}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CE821C2E-F472-4C86-B298-9539C29181B5}" => Key deleted successfully.
C:\Windows\System32\Tasks\OKKFODDR not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OKKFODDR" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E5FBFE04-9BCE-47A6-AB45-41896307775D}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E5FBFE04-9BCE-47A6-AB45-41896307775D}" => Key deleted successfully.
C:\Windows\System32\Tasks\{6C6A1B19-AC17-40B1-81FA-F846708DC1B4} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{6C6A1B19-AC17-40B1-81FA-F846708DC1B4}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F08FCB6F-1C7C-4618-897D-DCA0C185FF9C}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F08FCB6F-1C7C-4618-897D-DCA0C185FF9C}" => Key deleted successfully.
C:\Windows\System32\Tasks\{A9DA2D5F-CB04-4000-BA22-B132226837FD} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{A9DA2D5F-CB04-4000-BA22-B132226837FD}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{F486969F-6FE3-4F2B-9DE6-EF16AAA97E54}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F486969F-6FE3-4F2B-9DE6-EF16AAA97E54}" => Key deleted successfully.
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{F9283F80-A3F8-43C6-BE94-75A3471EFCC1}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F9283F80-A3F8-43C6-BE94-75A3471EFCC1}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\8c6736a2-0446-4148-8f02-ca63eff37ec5-1-6" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{FAEBBC22-5575-45A7-B295-A53013F7C389}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FAEBBC22-5575-45A7-B295-A53013F7C389}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\8c6736a2-0446-4148-8f02-ca63eff37ec5-5" => Key deleted successfully.
C:\Windows\Tasks\APSnotifierPP1.job not found.
C:\Windows\Tasks\APSnotifierPP2.job => Moved successfully.
C:\Windows\Tasks\APSnotifierPP3.job => Moved successfully.
C:\Windows\Tasks\avaavaxvyy.job not found.
C:\Windows\Tasks\Binkiland.job not found.
C:\Windows\Tasks\FDEDZBML.job not found.
C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job not found.
C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job not found.
C:\Windows\Tasks\GWEXI.job not found.
C:\Windows\Tasks\LQNCBDR.job not found.
C:\Windows\Tasks\OKPPBAAR.job not found.
C:\Windows\Tasks\ONLLP.job => Moved successfully.
C:\Windows\Tasks\PWKN.job not found.
C:\Windows\Tasks\THULJOON.job not found.
C:\Windows\Tasks\TJYHKE.job not found.
C:\Windows\Tasks\UFQUWS.job => Moved successfully.
C:\Windows\Tasks\User_Feed_Synchronization-{F3D00496-1512-4FEF-A011-C2925A21559B}.job not found.
0
Réponse 12 / 21
girfred
 
Ouf!! Ci-dessous le lien du rapport roguekiller

http://pjjoint.malekal.com/files.php?id=20150405_m12s9q10s1113
0
Réponse 13 / 21
girfred
 
On a fait un grand pas en avant, il reste deux raccourcis qui à l'ouverture de la page internet annonce qu'un site web veut ouvrir un contenu web en utilisant ce programme sur l'ordi : AcroRd32.exe, éditeur adobe système. Je ne sais pas si il faut autoriser ou pas ?

Un grand merci, déjà pour tout le temps que tu m'as accordé.

Mes beaux parents vont être contents. Après je ne sais pas pour combien de temps le PC va rester dans cet état!
0
Réponse 14 / 21
Malekal_morte- Messages postés 180304 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 685
 
oui vas y.
Tu as supprimé les PUM.DNS avec RogueKiller ?
0
Réponse 15 / 21
girfred
 
Les PUM.DNS ont été supprimés avec RogueKiller.

Je peux donc autoriser AcroRd32.exe alors ?
0
Malekal_morte- Messages postés 180304 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 685
 
oui,

refais un scan Malwarebytes et supprime tout ce qu'il détecte.
refais un scan FRST et donne les rapports via pjjoint afin de vérifier qu'il n'y ait plus rien.
0
Réponse 16 / 21
girfred Messages postés 17 Date d'inscription   Statut Membre Dernière intervention  
 
Voilà,

https://pjjoint.malekal.com/files.php?id=20150405_w14j7g1011l12
https://pjjoint.malekal.com/files.php?id=20150405_v128s8j9w6
https://pjjoint.malekal.com/files.php?id=20150405_f59r13m15k5
0
Réponse 17 / 21
Malekal_morte- Messages postés 180304 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 685
 
ok c'est mieux, tu n'as pas dû réinitialiser Firefox.
Il faudrait le faire.

0
Réponse 18 / 21
girfred Messages postés 17 Date d'inscription   Statut Membre Dernière intervention  
 
Je ne trouve pas Firefox !
0
Malekal_morte- Messages postés 180304 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 685
 
ok alors il ne doit pas être installé.

Du coup plus de soucis ?
0
Réponse 19 / 21
girfred Messages postés 17 Date d'inscription   Statut Membre Dernière intervention  
 
Super, un très grand merci. Pour finir quelues conseils pour protéger la navigation : mes beaux parents arrivent dans les 70 ans et ils ont le clique facile!
0
Réponse 20 / 21
Malekal_morte- Messages postés 180304 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 685
 
Mets leur blockulicious et imprime leur le dossier.
Ca devrait limiter la casse =)

Quelques conseils :



Pour prévenir les sites malicieux, tu peux installer Blockulicious : https://forum.malekal.com/viewtopic.php?t=46656&start=


Pour ne plus te faire avoir.
A lire - Programmes parasites / PUPs : https://www.malekal.com/adwares-pup-protection/


Le reste de la sécurité : http://forum.malekal.com/comment-securiser-son-ordinateur.html

0