Win32:Dropper-gen [Drp]

Résolu
hburnt -  
Bonjour et au secours.
Je viens de chopper une saleté. ... en téléchargerant un fichier.

Menace
win32:Dropper-gen [Drp]

Ca me telecharge plein de logiciel merdiques...

Pouvez vous me guider pour nettoyer tout ca s'il vous plaît ?
merci d'avance.
NiCo.

8 réponses

  1.  Malekal_morte- Modérateur
    Salut,

    Si ton antivirus a bloqué le téléchargement, c'est bon.

    Si tu veux vérifier ton ordinateur :

    Suis ce tutoriel FRST: https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/
    (et bien prendre le temps de lire afin d'appliquer correctement - tout y est expliqué).
    Télécharge et lance le scan FRST, cela va générer trois rapports FRST :
    • FRST.txt
    • Shortcut.txt
    • Additionnal.txt


    Envoie, comme expliqué, ces trois rapports sur le site http://pjjoint.malekal.com et en retour donne les trois liens pjjoint qui mènent à ses rapports ici dans une nouvelle réponse afin que l'on puisse les consulter.

    1. hburnt Auteur
      Merci pour ta rapidité.
      Il y à un tas de logiciel nouveaux, navigateur internet remplacé, des pages web intempestives, l'impossibilité de supprimé le fichier téléchargé et les logiciels également.

      je me penche sur ta procédure.
      2. Malekal_morte- Modérateur
        Désinstalle Spybot,

        Voici la correction à effectuer avec FRST.
        Tu peux t'inspirer de cette note explicative avec des captures d'écran pour t'aider: https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/#fix

        Ouvre le bloc-notes : Touche Windows + R, dans le champs executer, tape notepad et OK.
        Copie/colle dedans ce qui suit :

        HKLM\...\Run: [mbot_fr_590] => [X]
        HKLM\...\Run: [Boxore Client] => C:\Program Files\Boxore\Boxore Client\boxore.exe [1551872 2015-03-20] (Boxore OU)
        HKLM\...\Run: [WinCheck] => C:\Users\Nico\AppData\Local\A004D4CE-1428918631-DD11-B78A-C0AB28C29AAD\bnso7F49.exe [242688 2015-04-12] ()
        HKU\S-1-5-21-3252800047-3378914798-960507929-1000\...\Run: [GoogleChromeAutoLaunch_F4C46051ED429E696ABEAC19682BADCE] => C:\Program Files\Crossbrowse\Crossbrowse\Application\crossbrowse.exe [637440 2015-03-04] (Crossbrowse)
        CHR Extension: (Boxore) - C:\Users\Nico\AppData\Local\Google\Chrome\User Data\Default\Extensions\engaigpbgdjjmanonjcjkcmomgibneba [2015-04-13]
        R2 gulimixo; C:\Users\Nico\AppData\Roaming\A004D4CE-1428911307-DD11-B78A-C0AB28C29AAD\jnso6975.tmp [129024 2015-04-13] () [File not signed]
        R2 IHProtect Service; C:\Program Files\XTab\ProtectService.exe [158816 2015-04-02] (XTab system)
        R2 rvkCeiiPhF; C:\ProgramData\qSXhSCqMepV\rvkCeiiPhF.exe [2731488 2015-04-13] (Useful Technology)
        S2 Software_update; C:\Program Files\Software\Update\SoftwareUpdate.exe [119408 2015-04-13] (The Software Group)
        S3 Software_update_m; C:\Program Files\Software\Update\SoftwareUpdate.exe [119408 2015-04-13] (The Software Group)
        R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [493712 2015-04-13] (SysTool PasSame LIMITED) [File not signed]
        R2 nefyloji; C:\Users\Nico\AppData\Roaming\A004D4CE-1428911307-DD11-B78A-C0AB28C29AAD\nsoE35F.tmpfs [X]
        2015-04-13 10:10 - 2015-04-13 10:10 - 00000000 ____D () C:\Users\Nico\AppData\Roaming\VOPackage
        2015-04-13 10:10 - 2015-04-13 10:10 - 00000000 ____D () C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
        2015-04-13 10:10 - 2015-04-13 10:10 - 00000000 ____D () C:\Users\Nico\AppData\Roaming\A004D4CE-1428912645-DD11-B78A-C0AB28C29AAD
        2015-04-13 10:10 - 2015-04-13 10:10 - 00000000 ____D () C:\Users\Nico\AppData\Local\BreakingNewsAlert
        2015-04-13 09:56 - 2015-04-13 09:56 - 00002060 _____ () C:\Users\Public\Desktop\Crossbrowse.lnk
        2015-04-13 09:56 - 2015-04-13 09:56 - 00001042 _____ () C:\Windows\Tasks\Crossbrowse.job
        2015-04-13 09:56 - 2015-04-13 09:56 - 00000000 ____D () C:\Users\Nico\AppData\Local\Crossbrowse
        2015-04-13 09:56 - 2015-04-13 09:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crossbrowse
        2015-04-13 09:56 - 2015-04-13 09:56 - 00000000 ____D () C:\Program Files\Crossbrowse
        2015-04-13 09:55 - 2015-04-13 10:10 - 00000000 ____D () C:\ProgramData\qSXhSCqMepV
        2015-04-13 09:55 - 2015-04-13 09:56 - 00000686 _____ () C:\Users\Nico\AppData\Roaming\Bubble Dock.installation.log
        2015-04-13 09:54 - 2015-04-13 09:56 - 00001310 _____ () C:\Users\Nico\AppData\Roaming\Bubble Dock.boostrap.log
        2015-04-13 09:54 - 2015-04-13 09:55 - 00000000 ____D () C:\ProgramData\BreakingNewsAlert
        2015-04-13 09:54 - 2015-04-13 09:54 - 00000764 _____ () C:\Users\Nico\Desktop\GUPlayer.lnk
        2015-04-13 09:54 - 2015-04-13 09:54 - 00000097 _____ () C:\Users\Nico\AppData\Roaming\WindApp.boostrap.log
        2015-04-13 09:54 - 2015-04-13 09:54 - 00000000 ____D () C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GUPlayer
        2015-04-13 09:54 - 2015-04-13 09:54 - 00000000 ____D () C:\Program Files\predm
        2015-04-13 09:54 - 2015-04-13 09:54 - 00000000 ____D () C:\Program Files\GUPlayer
        2015-04-13 09:53 - 2015-04-13 09:53 - 00001842 _____ () C:\Users\Nico\Desktop\Continue Mybest Offerstoday Uninstaller.lnk
        2015-04-13 09:52 - 2015-04-13 09:52 - 00000000 ____D () C:\Program Files\Search Extensions
        2015-04-13 09:50 - 2015-04-13 09:50 - 00000000 ____D () C:\Users\Nico\AppData\Local\A004D4CE-1428918631-DD11-B78A-C0AB28C29AAD
        2015-04-13 09:48 - 2015-04-13 09:49 - 00000000 ____D () C:\Users\Nico\AppData\Roaming\A004D4CE-1428911307-DD11-B78A-C0AB28C29AAD
        2015-04-13 09:48 - 2015-04-13 09:48 - 00000000 ____D () C:\ProgramData\LolliScan
        2015-04-13 09:46 - 2015-04-13 09:46 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
        2015-04-13 09:46 - 2015-04-13 09:46 - 00000000 ____D () C:\ProgramData\IHProtectUpDate
        2015-04-13 09:46 - 2015-04-13 09:46 - 00000000 ____D () C:\Program Files\XTab
        2015-04-13 09:45 - 2015-04-13 09:45 - 00000000 ____D () C:\Users\Nico\AppData\Local\Boxore
        2015-04-13 09:45 - 2015-04-13 09:45 - 00000000 ____D () C:\Program Files\Boxore
        2015-04-13 09:44 - 2015-04-13 09:49 - 00000902 _____ () C:\Windows\Tasks\SoftwareUpdateTaskMachineUA.job
        2015-04-13 09:44 - 2015-04-13 09:49 - 00000898 _____ () C:\Windows\Tasks\SoftwareUpdateTaskMachineCore.job
        2015-04-13 09:43 - 2015-04-13 09:43 - 00000000 ____D () C:\Users\Nico\AppData\Local\Software
        2015-04-13 09:43 - 2015-04-13 09:43 - 00000000 ____D () C:\Program Files\Software
        2015-04-13 09:42 - 2015-04-13 09:55 - 00000000 ____D () C:\Program Files\mbot_fr_590
        2015-04-13 09:54 - 2015-04-13 09:56 - 0001310 _____ () C:\Users\Nico\AppData\Roaming\Bubble Dock.boostrap.log
        2015-04-13 09:55 - 2015-04-13 09:56 - 0000686 _____ () C:\Users\Nico\AppData\Roaming\Bubble Dock.installation.log
        2015-04-13 09:54 - 2015-04-13 09:54 - 0000097 _____ () C:\Users\Nico\AppData\Roaming\WindApp.boostrap.log
        Startup: C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crossbrowse.lnk
        ShortcutTarget: crossbrowse.lnk -> C:\Program Files\Crossbrowse\Crossbrowse\Application\crossbrowse.exe (Crossbrowse)
        Task: C:\Windows\Tasks\Crossbrowse.job => C:\Program Files\Crossbrowse\Crossbrowse\Application\utility.exe <==== ATTENTION
        Task: C:\Windows\Tasks\SoftwareUpdateTaskMachineCore.job => C:\Program Files\Software\Update\SoftwareUpdate.exe <==== ATTENTION
        Task: C:\Windows\Tasks\SoftwareUpdateTaskMachineUA.job => C:\Program Files\Software\Update\SoftwareUpdate.exe <==== ATTENTION
        Task: {32625DAC-B7A9-4932-91AB-435E8634D8DE} - System32\Tasks\Crossbrowse => C:\Program Files\Crossbrowse\Crossbrowse\Application\utility.exe [2015-04-13] () <==== ATTENTION
        Task: {4AB84963-859C-4303-9C65-13B7FD2D4E95} - System32\Tasks\SoftwareUpdateTaskMachineUA => C:\Program Files\Software\Update\SoftwareUpdate.exe [2015-04-13] (The Software Group) <==== ATTENTION
        Task: {CBB7C8A3-6E8C-4157-87AA-B17FED846CD6} - System32\Tasks\RocketTab => cmd.exe /C start "" "C:\Program Files\Search Extensions\Client.exe" /Preferred=true <==== ATTENTION
        Task: {D1D4493B-E966-4AF6-9791-6EB024C9D414} - System32\Tasks\RocketTab Update Task => C:\Program Files\Search Extensions\uninstall.exe [2015-04-13] () <==== ATTENTION
        Task: {E2463DB8-5546-4EDF-A501-0165F229815F} - System32\Tasks\SoftwareUpdateTaskMachineCore => C:\Program Files\Software\Update\SoftwareUpdate.exe [2015-04-13] (The Software Group) <==== ATTENTION

        Une fois, le texte coller dans le bloc-note.
        Menu Fichier puis Enregistrer sous.
        A gauche, place toi sur le bureau.
        Dans le champs en bas, nom du fichier mets : fixlist.txt
        Clic sur Enregistrer - cela va créer un fichier fixlist.txt sur le bureau.

        Relance FRST et clic sur le bouton Fix
        Selon comment un redémarrage est nécessaire (pas obligatoire).
        Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

        Redémarre l'ordinateur

        puis réinitialise tes navigateurs:
        ==================================
        Réinitialise tes navigateurs et ou manuellement reparamètre tes navigateurs WEB (page de démarrage, moteur de recherche etc) mais aussi supprimer/désactiver les extensions inutiles/parasites :

        puis :

        Suis le tutorial AdwCleaner https://www.malekal.com/adwcleaner-supprimer-virus-adwares-pup/?t=33839&start= ( d'Xplode )
        Télécharge le sur ton bureau ou dossier de téléchargement.
        Lance AdwCleaner, clique sur [Scanner].
        L'analyse peux durer plusieurs minutes, patiente.
        Une fois le scan terminé, ne décoche rien, clique sur [Nettoyer]

        Une fois le nettoyage terminé, un rapport s'ouvrira. Copie/colle le contenu du rapport dans ta prochaine réponse par un copier/coller.
        Si cela ne fonctionne pas, utilise le site http://pjjoint.malekal.com pour héberger le rapport, donne le lien du rapport dans un nouveau message.

        Note : Le rapport est également sauvegardé sous C:\AdwCleaner[S1].txt

        2. hburnt Auteur
          Je n'ai pas Spybot dans "désinstaller un programme"
          Il me semble l'avoir déjà désinstaller.
          1. Malekal_morte- Modérateur
            ok =)
            il est encore référencé dans les AV, mais bon c'est pas grave!
        3. hburnt Auteur
          Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 12-04-2015
          Ran by Nico at 2015-04-13 11:04:50 Run:1
          Running from C:\Users\Nico\Desktop
          Loaded Profiles: Nico (Available profiles: Nico)
          Boot Mode: Normal

          ==============================================

          Content of fixlist:
          HKLM\...\Run: [mbot_fr_590] => [X]
          HKLM\...\Run: [Boxore Client] => C:\Program Files\Boxore\Boxore Client\boxore.exe [1551872 2015-03-20] (Boxore OU)
          HKLM\...\Run: [WinCheck] => C:\Users\Nico\AppData\Local\A004D4CE-1428918631-DD11-B78A-C0AB28C29AAD\bnso7F49.exe [242688 2015-04-12] ()
          HKU\S-1-5-21-3252800047-3378914798-960507929-1000\...\Run: [GoogleChromeAutoLaunch_F4C46051ED429E696ABEAC19682BADCE] => C:\Program Files\Crossbrowse\Crossbrowse\Application\crossbrowse.exe [637440 2015-03-04] (Crossbrowse)
          CHR Extension: (Boxore) - C:\Users\Nico\AppData\Local\Google\Chrome\User Data\Default\Extensions\engaigpbgdjjmanonjcjkcmomgibneba [2015-04-13]
          R2 gulimixo; C:\Users\Nico\AppData\Roaming\A004D4CE-1428911307-DD11-B78A-C0AB28C29AAD\jnso6975.tmp [129024 2015-04-13] () [File not signed]
          R2 IHProtect Service; C:\Program Files\XTab\ProtectService.exe [158816 2015-04-02] (XTab system)
          R2 rvkCeiiPhF; C:\ProgramData\qSXhSCqMepV\rvkCeiiPhF.exe [2731488 2015-04-13] (Useful Technology)
          S2 Software_update; C:\Program Files\Software\Update\SoftwareUpdate.exe [119408 2015-04-13] (The Software Group)
          S3 Software_update_m; C:\Program Files\Software\Update\SoftwareUpdate.exe [119408 2015-04-13] (The Software Group)
          R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [493712 2015-04-13] (SysTool PasSame LIMITED) [File not signed]
          R2 nefyloji; C:\Users\Nico\AppData\Roaming\A004D4CE-1428911307-DD11-B78A-C0AB28C29AAD\nsoE35F.tmpfs [X]
          2015-04-13 10:10 - 2015-04-13 10:10 - 00000000 ____D () C:\Users\Nico\AppData\Roaming\VOPackage
          2015-04-13 10:10 - 2015-04-13 10:10 - 00000000 ____D () C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
          2015-04-13 10:10 - 2015-04-13 10:10 - 00000000 ____D () C:\Users\Nico\AppData\Roaming\A004D4CE-1428912645-DD11-B78A-C0AB28C29AAD
          2015-04-13 10:10 - 2015-04-13 10:10 - 00000000 ____D () C:\Users\Nico\AppData\Local\BreakingNewsAlert
          2015-04-13 09:56 - 2015-04-13 09:56 - 00002060 _____ () C:\Users\Public\Desktop\Crossbrowse.lnk
          2015-04-13 09:56 - 2015-04-13 09:56 - 00001042 _____ () C:\Windows\Tasks\Crossbrowse.job
          2015-04-13 09:56 - 2015-04-13 09:56 - 00000000 ____D () C:\Users\Nico\AppData\Local\Crossbrowse
          2015-04-13 09:56 - 2015-04-13 09:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crossbrowse
          2015-04-13 09:56 - 2015-04-13 09:56 - 00000000 ____D () C:\Program Files\Crossbrowse
          2015-04-13 09:55 - 2015-04-13 10:10 - 00000000 ____D () C:\ProgramData\qSXhSCqMepV
          2015-04-13 09:55 - 2015-04-13 09:56 - 00000686 _____ () C:\Users\Nico\AppData\Roaming\Bubble Dock.installation.log
          2015-04-13 09:54 - 2015-04-13 09:56 - 00001310 _____ () C:\Users\Nico\AppData\Roaming\Bubble Dock.boostrap.log
          2015-04-13 09:54 - 2015-04-13 09:55 - 00000000 ____D () C:\ProgramData\BreakingNewsAlert
          2015-04-13 09:54 - 2015-04-13 09:54 - 00000764 _____ () C:\Users\Nico\Desktop\GUPlayer.lnk
          2015-04-13 09:54 - 2015-04-13 09:54 - 00000097 _____ () C:\Users\Nico\AppData\Roaming\WindApp.boostrap.log
          2015-04-13 09:54 - 2015-04-13 09:54 - 00000000 ____D () C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GUPlayer
          2015-04-13 09:54 - 2015-04-13 09:54 - 00000000 ____D () C:\Program Files\predm
          2015-04-13 09:54 - 2015-04-13 09:54 - 00000000 ____D () C:\Program Files\GUPlayer
          2015-04-13 09:53 - 2015-04-13 09:53 - 00001842 _____ () C:\Users\Nico\Desktop\Continue Mybest Offerstoday Uninstaller.lnk
          2015-04-13 09:52 - 2015-04-13 09:52 - 00000000 ____D () C:\Program Files\Search Extensions
          2015-04-13 09:50 - 2015-04-13 09:50 - 00000000 ____D () C:\Users\Nico\AppData\Local\A004D4CE-1428918631-DD11-B78A-C0AB28C29AAD
          2015-04-13 09:48 - 2015-04-13 09:49 - 00000000 ____D () C:\Users\Nico\AppData\Roaming\A004D4CE-1428911307-DD11-B78A-C0AB28C29AAD
          2015-04-13 09:48 - 2015-04-13 09:48 - 00000000 ____D () C:\ProgramData\LolliScan
          2015-04-13 09:46 - 2015-04-13 09:46 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
          2015-04-13 09:46 - 2015-04-13 09:46 - 00000000 ____D () C:\ProgramData\IHProtectUpDate
          2015-04-13 09:46 - 2015-04-13 09:46 - 00000000 ____D () C:\Program Files\XTab
          2015-04-13 09:45 - 2015-04-13 09:45 - 00000000 ____D () C:\Users\Nico\AppData\Local\Boxore
          2015-04-13 09:45 - 2015-04-13 09:45 - 00000000 ____D () C:\Program Files\Boxore
          2015-04-13 09:44 - 2015-04-13 09:49 - 00000902 _____ () C:\Windows\Tasks\SoftwareUpdateTaskMachineUA.job
          2015-04-13 09:44 - 2015-04-13 09:49 - 00000898 _____ () C:\Windows\Tasks\SoftwareUpdateTaskMachineCore.job
          2015-04-13 09:43 - 2015-04-13 09:43 - 00000000 ____D () C:\Users\Nico\AppData\Local\Software
          2015-04-13 09:43 - 2015-04-13 09:43 - 00000000 ____D () C:\Program Files\Software
          2015-04-13 09:42 - 2015-04-13 09:55 - 00000000 ____D () C:\Program Files\mbot_fr_590
          2015-04-13 09:54 - 2015-04-13 09:56 - 0001310 _____ () C:\Users\Nico\AppData\Roaming\Bubble Dock.boostrap.log
          2015-04-13 09:55 - 2015-04-13 09:56 - 0000686 _____ () C:\Users\Nico\AppData\Roaming\Bubble Dock.installation.log
          2015-04-13 09:54 - 2015-04-13 09:54 - 0000097 _____ () C:\Users\Nico\AppData\Roaming\WindApp.boostrap.log
          Startup: C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crossbrowse.lnk
          ShortcutTarget: crossbrowse.lnk -> C:\Program Files\Crossbrowse\Crossbrowse\Application\crossbrowse.exe (Crossbrowse)
          Task: C:\Windows\Tasks\Crossbrowse.job => C:\Program Files\Crossbrowse\Crossbrowse\Application\utility.exe <==== ATTENTION
          Task: C:\Windows\Tasks\SoftwareUpdateTaskMachineCore.job => C:\Program Files\Software\Update\SoftwareUpdate.exe <==== ATTENTION
          Task: C:\Windows\Tasks\SoftwareUpdateTaskMachineUA.job => C:\Program Files\Software\Update\SoftwareUpdate.exe <==== ATTENTION
          Task: {32625DAC-B7A9-4932-91AB-435E8634D8DE} - System32\Tasks\Crossbrowse => C:\Program Files\Crossbrowse\Crossbrowse\Application\utility.exe [2015-04-13] () <==== ATTENTION
          Task: {4AB84963-859C-4303-9C65-13B7FD2D4E95} - System32\Tasks\SoftwareUpdateTaskMachineUA => C:\Program Files\Software\Update\SoftwareUpdate.exe [2015-04-13] (The Software Group) <==== ATTENTION
          Task: {CBB7C8A3-6E8C-4157-87AA-B17FED846CD6} - System32\Tasks\RocketTab => cmd.exe /C start "" "C:\Program Files\Search Extensions\Client.exe" /Preferred=true <==== ATTENTION
          Task: {D1D4493B-E966-4AF6-9791-6EB024C9D414} - System32\Tasks\RocketTab Update Task => C:\Program Files\Search Extensions\uninstall.exe [2015-04-13] () <==== ATTENTION
          Task: {E2463DB8-5546-4EDF-A501-0165F229815F} - System32\Tasks\SoftwareUpdateTaskMachineCore => C:\Program Files\Software\Update\SoftwareUpdate.exe [2015-04-13] (The Software Group) <==== ATTENTION

          HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\mbot_fr_590 => value deleted successfully.
          HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Boxore Client => value deleted successfully.
          HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\WinCheck => value deleted successfully.
          HKU\S-1-5-21-3252800047-3378914798-960507929-1000\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_F4C46051ED429E696ABEAC19682BADCE => value deleted successfully.
          C:\Users\Nico\AppData\Local\Google\Chrome\User Data\Default\Extensions\engaigpbgdjjmanonjcjkcmomgibneba => Moved successfully.
          gulimixo => Service stopped successfully.
          gulimixo => Service deleted successfully.
          IHProtect Service => Service stopped successfully.
          IHProtect Service => Service deleted successfully.
          rvkCeiiPhF => Unable to stop service
          rvkCeiiPhF => Service deleted successfully.
          Software_update => Service deleted successfully.
          Software_update_m => Service deleted successfully.
          WindowsMangerProtect => Service stopped successfully.
          WindowsMangerProtect => Service deleted successfully.
          nefyloji => Service stopped successfully.
          nefyloji => Service deleted successfully.
          C:\Users\Nico\AppData\Roaming\VOPackage => Moved successfully.
          C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage => Moved successfully.
          C:\Users\Nico\AppData\Roaming\A004D4CE-1428912645-DD11-B78A-C0AB28C29AAD => Moved successfully.
          C:\Users\Nico\AppData\Local\BreakingNewsAlert => Moved successfully.
          C:\Users\Public\Desktop\Crossbrowse.lnk => Moved successfully.
          C:\Windows\Tasks\Crossbrowse.job => Moved successfully.

          "C:\Users\Nico\AppData\Local\Crossbrowse" directory move:

          Could not move "C:\Users\Nico\AppData\Local\Crossbrowse" directory. => Scheduled to move on reboot.

          C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crossbrowse => Moved successfully.

          "C:\Program Files\Crossbrowse" directory move:

          Could not move "C:\Program Files\Crossbrowse" directory. => Scheduled to move on reboot.

          "C:\ProgramData\qSXhSCqMepV" directory move:

          Could not move "C:\ProgramData\qSXhSCqMepV" directory. => Scheduled to move on reboot.

          C:\Users\Nico\AppData\Roaming\Bubble Dock.installation.log => Moved successfully.
          C:\Users\Nico\AppData\Roaming\Bubble Dock.boostrap.log => Moved successfully.
          C:\ProgramData\BreakingNewsAlert => Moved successfully.
          C:\Users\Nico\Desktop\GUPlayer.lnk => Moved successfully.
          C:\Users\Nico\AppData\Roaming\WindApp.boostrap.log => Moved successfully.
          C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GUPlayer => Moved successfully.
          C:\Program Files\predm => Moved successfully.
          C:\Program Files\GUPlayer => Moved successfully.
          C:\Users\Nico\Desktop\Continue Mybest Offerstoday Uninstaller.lnk => Moved successfully.

          "C:\Program Files\Search Extensions" directory move:

          Could not move "C:\Program Files\Search Extensions" directory. => Scheduled to move on reboot.

          C:\Users\Nico\AppData\Local\A004D4CE-1428918631-DD11-B78A-C0AB28C29AAD => Moved successfully.
          C:\Users\Nico\AppData\Roaming\A004D4CE-1428911307-DD11-B78A-C0AB28C29AAD => Moved successfully.
          C:\ProgramData\LolliScan => Moved successfully.
          C:\ProgramData\WindowsMangerProtect => Moved successfully.
          C:\ProgramData\IHProtectUpDate => Moved successfully.
          C:\Program Files\XTab => Moved successfully.
          C:\Users\Nico\AppData\Local\Boxore => Moved successfully.

          "C:\Program Files\Boxore" directory move:

          Could not move "C:\Program Files\Boxore" directory. => Scheduled to move on reboot.

          C:\Windows\Tasks\SoftwareUpdateTaskMachineUA.job => Moved successfully.
          C:\Windows\Tasks\SoftwareUpdateTaskMachineCore.job => Moved successfully.
          C:\Users\Nico\AppData\Local\Software => Moved successfully.
          C:\Program Files\Software => Moved successfully.
          C:\Program Files\mbot_fr_590 => Moved successfully.
          "C:\Users\Nico\AppData\Roaming\Bubble Dock.boostrap.log" => File/Directory not found.
          "C:\Users\Nico\AppData\Roaming\Bubble Dock.installation.log" => File/Directory not found.
          "C:\Users\Nico\AppData\Roaming\WindApp.boostrap.log" => File/Directory not found.
          C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crossbrowse.lnk => Moved successfully.
          C:\Program Files\Crossbrowse\Crossbrowse\Application\crossbrowse.exe => Moved successfully.
          C:\Windows\Tasks\Crossbrowse.job not found.
          C:\Windows\Tasks\SoftwareUpdateTaskMachineCore.job not found.
          C:\Windows\Tasks\SoftwareUpdateTaskMachineUA.job not found.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{32625DAC-B7A9-4932-91AB-435E8634D8DE}" => Key deleted successfully.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{32625DAC-B7A9-4932-91AB-435E8634D8DE}" => Key deleted successfully.
          C:\Windows\System32\Tasks\Crossbrowse => Moved successfully.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Crossbrowse" => Key deleted successfully.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4AB84963-859C-4303-9C65-13B7FD2D4E95}" => Key deleted successfully.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4AB84963-859C-4303-9C65-13B7FD2D4E95}" => Key deleted successfully.
          C:\Windows\System32\Tasks\SoftwareUpdateTaskMachineUA => Moved successfully.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SoftwareUpdateTaskMachineUA" => Key deleted successfully.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{CBB7C8A3-6E8C-4157-87AA-B17FED846CD6}" => Key deleted successfully.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CBB7C8A3-6E8C-4157-87AA-B17FED846CD6}" => Key deleted successfully.
          C:\Windows\System32\Tasks\RocketTab => Moved successfully.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RocketTab" => Key deleted successfully.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D1D4493B-E966-4AF6-9791-6EB024C9D414}" => Key deleted successfully.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D1D4493B-E966-4AF6-9791-6EB024C9D414}" => Key deleted successfully.
          C:\Windows\System32\Tasks\RocketTab Update Task => Moved successfully.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RocketTab Update Task" => Key deleted successfully.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{E2463DB8-5546-4EDF-A501-0165F229815F}" => Key deleted successfully.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E2463DB8-5546-4EDF-A501-0165F229815F}" => Key deleted successfully.
          C:\Windows\System32\Tasks\SoftwareUpdateTaskMachineCore => Moved successfully.
          "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SoftwareUpdateTaskMachineCore" => Key deleted successfully.

          > Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2015-04-13 11:07:27)<

          C:\Users\Nico\AppData\Local\Crossbrowse => Is moved successfully.
          C:\Program Files\Crossbrowse => Moved successfully.
          C:\ProgramData\qSXhSCqMepV => Is moved successfully.
          C:\Program Files\Search Extensions => Is moved successfully.
          C:\Program Files\Boxore => Is moved successfully.

          End of Fixlog 11:07:29

          1. hburnt Auteur
            # AdwCleaner v4.201 - Rapport créé le 13/04/2015 à 11:41:16
            # Mis à jour le 08/04/2015 par Xplode
            # Base de données : 2015-04-08.1 [Serveur]
            # Système d'exploitation : Windows Vista (TM) Home Premium Service Pack 2 (x86)
            # Nom d'utilisateur : Nico - PC-DE-NICO
            # Exécuté depuis : C:\Users\Nico\Downloads\adwcleaner_4.201.exe
            # Option : Nettoyer
                    • [ Services ] *****
                    • [ Fichiers / Dossiers ] *****


            Dossier Supprimé : C:\ProgramData\apn
            Dossier Supprimé : C:\ProgramData\Viewpoint
            Dossier Supprimé : C:\Program Files\Viewpoint
            Dossier Supprimé : C:\Users\Nico\AppData\Roaming\pdfforge
            Dossier Supprimé : C:\Users\Nico\AppData\Roaming\luckysearches
            Fichier Supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
            Fichier Supprimé : C:\Users\Nico\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\crossbrowse.lnk
                    • [ Tâches planifiées ] *****
                    • [ Raccourcis ] *****


            Raccourci Désinfecté : C:\Users\Public\Desktop\Mozilla Firefox.lnk
            Raccourci Désinfecté : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
            Raccourci Désinfecté : C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
            Raccourci Désinfecté : C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
            Raccourci Désinfecté : C:\Users\Nico\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
                    • [ Registre ] *****


            Valeur Supprimée : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [searchengine@gmail.com]
            Valeur Supprimée : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [istart_ffnt@gmail.com]
            Clé Supprimée : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl
            Clé Supprimée : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1
            Clé Supprimée : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary
            Clé Supprimée : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1
            Clé Supprimée : HKLM\SOFTWARE\Classes\Software.OneClickCtrl.9
            Clé Supprimée : HKLM\SOFTWARE\Classes\Software.OneClickProcessLauncherMachine
            Clé Supprimée : HKLM\SOFTWARE\Classes\Software.OneClickProcessLauncherMachine.1.0
            Clé Supprimée : HKLM\SOFTWARE\Classes\Software.Update3WebControl.3
            Clé Supprimée : HKLM\SOFTWARE\Classes\SoftwareUpdate.CoCreateAsync
            Clé Supprimée : HKLM\SOFTWARE\Classes\SoftwareUpdate.CoCreateAsync.1.0
            Clé Supprimée : HKLM\SOFTWARE\Classes\SoftwareUpdate.CoreClass
            Clé Supprimée : HKLM\SOFTWARE\Classes\SoftwareUpdate.CoreClass.1
            Clé Supprimée : HKLM\SOFTWARE\Classes\SoftwareUpdate.CoreMachineClass
            Clé Supprimée : HKLM\SOFTWARE\Classes\SoftwareUpdate.CoreMachineClass.1
            Clé Supprimée : HKLM\SOFTWARE\Classes\SoftwareUpdate.CredentialDialogMachine
            Clé Supprimée : HKLM\SOFTWARE\Classes\SoftwareUpdate.CredentialDialogMachine.1.0
            Clé Supprimée : HKLM\SOFTWARE\Classes\SoftwareUpdate.OnDemandCOMClassMachine
            Clé Supprimée : HKLM\SOFTWARE\Classes\SoftwareUpdate.OnDemandCOMClassMachine.1.0
            Clé Supprimée : HKLM\SOFTWARE\Classes\SoftwareUpdate.OnDemandCOMClassMachineFallback
            Clé Supprimée : HKLM\SOFTWARE\Classes\SoftwareUpdate.OnDemandCOMClassMachineFallback.1.0
            Clé Supprimée : HKLM\SOFTWARE\Classes\SoftwareUpdate.ProcessLauncher
            Clé Supprimée : HKLM\SOFTWARE\Classes\SoftwareUpdate.ProcessLauncher.1.0
            Clé Supprimée : HKLM\SOFTWARE\Classes\SoftwareUpdate.Update3WebMachine
            Clé Supprimée : HKLM\SOFTWARE\Classes\SoftwareUpdate.Update3WebMachine.1.0
            Clé Supprimée : HKLM\SOFTWARE\Classes\SoftwareUpdate.Update3WebMachineFallback
            Clé Supprimée : HKLM\SOFTWARE\Classes\SoftwareUpdate.Update3WebMachineFallback.1.0
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
            Clé Supprimée : HKLM\SOFTWARE\MozillaPlugins\@tools.Software.com/Software Update;version=3
            Clé Supprimée : HKLM\SOFTWARE\MozillaPlugins\@tools.Software.com/Software Update;version=9
            Clé Supprimée : HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com/VMP
            Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
            Clé Supprimée : HKLM\SOFTWARE\Classes\AdRotate.AdRotate
            Clé Supprimée : HKLM\SOFTWARE\Classes\AdRotate.AdRotate.1
            Clé Supprimée : HKCU\Software\Mozilla\Extends
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{051E9166-B275-4683-907B-372FAE22BC7C}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{08230486-CBAF-4000-8036-447C3852D034}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{13809C03-DE3B-47E5-96A3-2D8F83693A50}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{3B96B5D3-4A8D-42DC-9CDE-E9B94B3CFE5D}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{3D976BD4-0B6A-4757-9D2B-65AA20F4B4EA}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{76894207-241A-473B-B111-FAA75608F1D9}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{76C45B18-A29E-43EA-AAF8-AF55C2E1AE17}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{7A7C8DA9-8660-460D-849F-01619B91C03F}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{96EF404C-24C7-43D0-9096-4CCC8BB7CCAC}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{97720195-206A-42AE-8E65-260B9BA5589F}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{97D69524-BB57-4185-9C7F-5F05593B771A}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{986F7A5A-9676-47E1-8642-F41F8C3FCF82}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{ACCC747B-2A59-4F30-BA7C-D26333DE65F5}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{AE2506E3-0F75-44EE-B552-CFF3BFF4D50F}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{B18788A4-92BD-440E-A4D1-380C36531119}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{B6CD3C31-ABF4-4C7A-8CB7-29960BC7017C}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{C24C3824-63D8-42CD-BB5A-77631072FDB2}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{E5A7A645-8318-4895-B85C-EDC606B80DB6}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{EB41B92A-3A76-4237-9E6B-A5DDC2EAA771}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{F9A8326E-9C90-4BF2-ACC7-D0883D16AA82}
            Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{EFA7A511-B491-4312-BB35-4586B99E45ED}
            Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
            Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
            Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{9E598662-1ABE-48BC-B522-EF13ED372D08}
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EFA7A511-B491-4312-BB35-4586B99E45ED}
            Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
            Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
            Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EFA7A511-B491-4312-BB35-4586B99E45ED}
            Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
            Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
            Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EFA7A511-B491-4312-BB35-4586B99E45ED}
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3B96B5D3-4A8D-42DC-9CDE-E9B94B3CFE5D}
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{ACCC747B-2A59-4F30-BA7C-D26333DE65F5}
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B96B5D3-4A8D-42DC-9CDE-E9B94B3CFE5D}
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3D976BD4-0B6A-4757-9D2B-65AA20F4B4EA}
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ACCC747B-2A59-4F30-BA7C-D26333DE65F5}
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EFA7A511-B491-4312-BB35-4586B99E45ED}
            Valeur Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
            Donnée Restaurée : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
            Donnée Restaurée : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D4A29683-6D8B-4EEB-83DB-91A9AEECEF41}
            Clé Supprimée : HKCU\Software\Boxore
            Clé Supprimée : HKCU\Software\Conduit
            Clé Supprimée : HKCU\Software\IM
            Clé Supprimée : HKCU\Software\Nosibay
            Clé Supprimée : HKCU\Software\RocketTabInstalled
            Clé Supprimée : HKCU\Software\Search Extensions
            Clé Supprimée : HKCU\Software\Store
            Clé Supprimée : HKCU\Software\rttasks
            Clé Supprimée : HKCU\Software\CrossBrowser
            Clé Supprimée : HKCU\Software\Crossbrowse
            Clé Supprimée : HKCU\Software\AppDataLow\Software\DynConIE
            Clé Supprimée : HKLM\SOFTWARE\Boxore
            Clé Supprimée : HKLM\SOFTWARE\MetaStream
            Clé Supprimée : HKLM\SOFTWARE\RocketTab
            Clé Supprimée : HKLM\SOFTWARE\SupDp
            Clé Supprimée : HKLM\SOFTWARE\SupTab
            Clé Supprimée : HKLM\SOFTWARE\Tutorials
            Clé Supprimée : HKLM\SOFTWARE\Viewpoint
            Clé Supprimée : HKLM\SOFTWARE\IHProtect
            Clé Supprimée : HKLM\SOFTWARE\Crossbrowse
            Clé Supprimée : HKLM\SOFTWARE\luckysearchesSoftware
            Clé Supprimée : HKU\.DEFAULT\Software\AskPartnerNetwork
            Clé Supprimée : HKU\.DEFAULT\Software\Boxore
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RocketTab
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayer
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BreakingNewsAlert
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\wincheck
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{47BA91BB-CD0D-4208-BF6E-B8EF32BD5D54}
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Crossbrowse
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\luckysearches uninstall
            Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\PCSU-SL_is1
            Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\RocketTab
            Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ViewpointMediaPlayer
            Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\VOPackage
            Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ConvertAd
            Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BreakingNewsAlert
            Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\wincheck
            Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{47BA91BB-CD0D-4208-BF6E-B8EF32BD5D54}
            Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Crossbrowse
            Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\luckysearches uninstall
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AAC05EAA51DC78A41A1DCE3B31038584
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BA71D41F6CC0B6247B05D473850A8AEA
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CA0054A5AB3EFFE4CB5660E44A1E7DCC
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0DA5D75B5B33B4B83724742699814F
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C506B89D971FBA3418F37674F3BC1244
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FEA78903E905F6C41BA2E3CC615507CA
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\BB19AB74D0DC8024FBE68BFE23DBD545
            Clé Supprimée : HKLM\SOFTWARE\Classes\Installer\Features\BB19AB74D0DC8024FBE68BFE23DBD545
            Clé Supprimée : HKLM\SOFTWARE\Classes\Installer\Products\BB19AB74D0DC8024FBE68BFE23DBD545
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\1C875DDE39636004CA8CDAEC335B4160
            Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SoftwareUpdate.exe
            Donnée Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - hxxp=127.0.0.1:49193;hxxps=127.0.0.1:49193
            Donnée Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <-loopback>
                    • [ Navigateurs ] *****


            -\\ Internet Explorer v9.0.8112.16633

            Paramètre Restauré : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
            Paramètre Restauré : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
            Paramètre Restauré : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
            Paramètre Restauré : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]

            -\\ Mozilla Firefox v36.0.4 (x86 fr)

            -\\ Google Chrome v

            AdwCleaner[R0].txt - [14840 octets] - [13/04/2015 11:36:18]
            AdwCleaner[S0].txt - [14022 octets] - [13/04/2015 11:41:16]

            ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [14083 octets] ##########
            1. hburnt Auteur
              A ce stade, il reste seulement le fichier téléchargé source de l'infection et un raccourci ' continue installation ' sur le bureau, ayant pour cible le fichier en question
            2. Malekal_morte- Modérateur
              Supprime les.

              Pas de prob de pubs intempestives ?
            3. hburnt Auteur
              Fait. Je ne pouvais pas avant de suivre tes manip.
              Ben écoute tout à l'air d'être rentré dans l'ordre. Je te remercie chaleureusement pour ton efficacité et ta disponibilité.
          2. Malekal_morte- Modérateur
            Pas de soucis =)

            Voila, c'est terminé, tu peux supprimer les programmes utilisés.

            Quelques conseils :

            Pour prévenir les sites malicieux, tu peux installer Blockulicious : https://forum.malekal.com/viewtopic.php?t=46656&start=

            Pour ne plus te faire avoir.
            A lire - Programmes parasites / PUPs : https://www.malekal.com/adwares-pup-protection/

            Le reste de la sécurité : http://forum.malekal.com/comment-securiser-son-ordinateur.html

            1. hburnt Auteur
              Merci :-)

          Discussions similaires

          Problème avec "PUADIManager:Win32/OfferCore
          Knaki

          3 réponses
          PUADlManager:Win32/OfferCore
          tenmalade

          2 réponses
          PUADlManager:Win32/OfferCore
          bernardarrad

          3 réponses
          Pb Windows 7, .EXE n'est pas app win32 valide
          Witeric

          15 réponses
          PUA:Win32/InstallCore detecté par windows sécurité
          thetib

          11 réponses