Virus
brod9621
Messages postés
2
Statut
Membre
-
Fish66 Messages postés 18337 Statut Contributeur sécurité -
Fish66 Messages postés 18337 Statut Contributeur sécurité -
Bonjour,
j'ai suivis les étapes que vous aviez recommandé, mais j'obtiens seulement deux rapports. Les voici:
https://pjjoint.malekal.com/files.php?id=20150414_q6c6e7k12s6
https://pjjoint.malekal.com/files.php?id=20150414_q9n12d5z9f11
Merci de m'aider pour la suite!
Alexandre
j'ai suivis les étapes que vous aviez recommandé, mais j'obtiens seulement deux rapports. Les voici:
https://pjjoint.malekal.com/files.php?id=20150414_q6c6e7k12s6
https://pjjoint.malekal.com/files.php?id=20150414_q9n12d5z9f11
Merci de m'aider pour la suite!
Alexandre
A voir également:
- Virus
- Virus mcafee - Accueil - Piratage
- Virus facebook demande d'amis - Accueil - Facebook
- Undisclosed-recipients virus - Guide
- Panda anti virus gratuit - Télécharger - Antivirus & Antimalwares
- Virus informatique - Guide
3 réponses
Bonsoir,
Si c'est le premier sujet que tu as créé, on peut continuer ensemble! :-) Est ce que tu peux expliquer le problème rencontré ?
------------
Tu as déjà lancé adwcleaner, poste le rapport stp, il se trouve
ici : C:\AdwCleaner\AdwCleaner[S0].txt
¤¤¤ Le meilleur remède pour tous les problèmes, c'est la patience.... ¤¤¤
Si c'est le premier sujet que tu as créé, on peut continuer ensemble! :-) Est ce que tu peux expliquer le problème rencontré ?
------------
Tu as déjà lancé adwcleaner, poste le rapport stp, il se trouve
ici : C:\AdwCleaner\AdwCleaner[S0].txt
¤¤¤ Le meilleur remède pour tous les problèmes, c'est la patience.... ¤¤¤
D'accord! :-)
---------
1/
Voici la correction à effectuer avec FRST.
[*] Appuies simultanément sur les touches Windows et R
[*] Une fenêtre va s'ouvrir, tape ceci : notepad
[*] Clic sur OK (Le bloc note va s'ouvrir)
[*] Coller le script en gras ci-dessous dans votre bloc-notes
start
CloseProcesses:
CreateRestorePoint:
() C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\jnspA6B0.tmp
() C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\nsu8669.tmp
HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\...\Run: [Itibiti.exe] => C:\Program Files (x86)\Itibiti Soft Phone\Itibiti.exe
HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\...\Run: [Bubble Suite] => C:\Users\Alexandre\AppData\Roaming\Nosibay\Bubble Suite\Bubble Suite.exe /winstartup
R2 jyhuheti; C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\jnspA6B0.tmp [230912 2015-04-09] () [File not signed]
R2 syxuxevo; C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\nsu8669.tmp [140288 2015-04-13] () [File not signed]
2015-04-14 14:50 - 2015-04-14 14:50 - 00001119 _____ () C:\Users\Alexandre\Desktop\Continue Live Installation.lnk
2015-04-09 14:08 - 2015-04-10 17:12 - 00000000 ____D () C:\ProgramData\T122078ED
2015-04-09 14:00 - 2015-04-10 22:07 - 00000000 ____D () C:\Users\Alexandre\AppData\Local\ZombieNews
2015-04-09 13:59 - 2015-04-09 13:59 - 00000000 ____D () C:\ProgramData\ZombieNews
2015-04-09 13:45 - 2015-04-09 13:45 - 00000000 ____D () C:\Users\Alexandre\AppData\Roaming\ehpjpfjm
2015-04-09 13:43 - 2015-04-09 13:43 - 00003780 _____ () C:\windows\System32\Tasks\Selection Tools Update
2013-10-22 11:21 - 2013-10-22 11:21 - 50053120 _____ () C:\Program Files (x86)\GUT5B65.tmp
2015-04-09 13:41 - 2015-04-09 13:41 - 0000078 _____ () C:\Users\Alexandre\AppData\Roaming\Bubble Suite.installation.log
2015-04-09 13:45 - 2015-04-09 13:45 - 0000064 _____ () C:\Users\Alexandre\AppData\Local\eb3de8941946cb3437202dbed8747183
2015-01-25 21:39 - 2015-01-25 21:39 - 0000000 _____ () C:\Users\Alexandre\AppData\Local\{DDBC60FA-FF81-4C7F-932A-F44716D885FE}
CustomCLSID: HKU\S-1-5-21-1199100571-1431918522-3286286321-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> C:\Users\Alexandre\AppData\Roaming\ehpjpfjm\enat.dll () <==== ATTENTION
Task: {10343A65-2E14-442B-95C9-BC67D6342A64} - System32\Tasks\avaavaevy => C:\Users\Alexandre\AppData\Local\avaavaevy\avaavaevy.exe [2015-04-12] () <==== ATTENTION
Task: {1404458D-EE30-4357-AACA-E6E5BC02CC16} - System32\Tasks\Bubble Suite Update => C:\Users\Alexandre\AppData\Roaming\Nosibay\Bubble Suite\Bubble Suite Update.exe
C:\Users\Alexandre\AppData\Roaming\ehpjpfjm\enat.dll
C:\Users\Alexandre\AppData\Local\avaavaevy\avaavaevy.exe
C:\Users\Alexandre\AppData\Roaming\Nosibay\Bubble Suite\Bubble Suite Update.exe
Task: {BF41359C-8963-4FDE-930B-04493FC74814} - System32\Tasks\{685CE949-96A1-49F6-AD47-E50BBA023AE0} => pcalua.exe -a C:\PROGRA~2\SearchProtect\Main\bin\uninstall.exe -c /S <==== ATTENTION
EmptyTemp:
end
[*] Une fois, le texte coller dans le bloc-note.
[*] Cliquez sur "Fichier" puis dans le menu déroulant sur "Enregistrer sous"
[*] A cette fenêtre cliquez sur "Bureau"
[*] Dans la zone de "Nom de fichier" tapez : fixlist puis validez en cliquant sur Enregistrer
[*] Sur votre bureau vous avec le fichier texte (fixlist.txt & FRST.exe)
[*] Lancez FRST, "exécuter en tant qu'administrateur" sous Windows Vista, Windows Seven et Windows 8/8.1
[*] Cliquez sur "Fix"
[*] Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.
[*] Redémarre l'ordinateur.
[*] ===> Aide : <<<ICI>>>
2/
https://www.malwarebytes.com/mwb-download/
=================================
Si tu as besoin d'aide tu peux voir ce tutoriel : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Bonne soirée
---------
1/
Voici la correction à effectuer avec FRST.
[*] Appuies simultanément sur les touches Windows et R
[*] Une fenêtre va s'ouvrir, tape ceci : notepad
[*] Clic sur OK (Le bloc note va s'ouvrir)
[*] Coller le script en gras ci-dessous dans votre bloc-notes
start
CloseProcesses:
CreateRestorePoint:
() C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\jnspA6B0.tmp
() C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\nsu8669.tmp
HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\...\Run: [Itibiti.exe] => C:\Program Files (x86)\Itibiti Soft Phone\Itibiti.exe
HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\...\Run: [Bubble Suite] => C:\Users\Alexandre\AppData\Roaming\Nosibay\Bubble Suite\Bubble Suite.exe /winstartup
R2 jyhuheti; C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\jnspA6B0.tmp [230912 2015-04-09] () [File not signed]
R2 syxuxevo; C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\nsu8669.tmp [140288 2015-04-13] () [File not signed]
2015-04-14 14:50 - 2015-04-14 14:50 - 00001119 _____ () C:\Users\Alexandre\Desktop\Continue Live Installation.lnk
2015-04-09 14:08 - 2015-04-10 17:12 - 00000000 ____D () C:\ProgramData\T122078ED
2015-04-09 14:00 - 2015-04-10 22:07 - 00000000 ____D () C:\Users\Alexandre\AppData\Local\ZombieNews
2015-04-09 13:59 - 2015-04-09 13:59 - 00000000 ____D () C:\ProgramData\ZombieNews
2015-04-09 13:45 - 2015-04-09 13:45 - 00000000 ____D () C:\Users\Alexandre\AppData\Roaming\ehpjpfjm
2015-04-09 13:43 - 2015-04-09 13:43 - 00003780 _____ () C:\windows\System32\Tasks\Selection Tools Update
2013-10-22 11:21 - 2013-10-22 11:21 - 50053120 _____ () C:\Program Files (x86)\GUT5B65.tmp
2015-04-09 13:41 - 2015-04-09 13:41 - 0000078 _____ () C:\Users\Alexandre\AppData\Roaming\Bubble Suite.installation.log
2015-04-09 13:45 - 2015-04-09 13:45 - 0000064 _____ () C:\Users\Alexandre\AppData\Local\eb3de8941946cb3437202dbed8747183
2015-01-25 21:39 - 2015-01-25 21:39 - 0000000 _____ () C:\Users\Alexandre\AppData\Local\{DDBC60FA-FF81-4C7F-932A-F44716D885FE}
CustomCLSID: HKU\S-1-5-21-1199100571-1431918522-3286286321-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> C:\Users\Alexandre\AppData\Roaming\ehpjpfjm\enat.dll () <==== ATTENTION
Task: {10343A65-2E14-442B-95C9-BC67D6342A64} - System32\Tasks\avaavaevy => C:\Users\Alexandre\AppData\Local\avaavaevy\avaavaevy.exe [2015-04-12] () <==== ATTENTION
Task: {1404458D-EE30-4357-AACA-E6E5BC02CC16} - System32\Tasks\Bubble Suite Update => C:\Users\Alexandre\AppData\Roaming\Nosibay\Bubble Suite\Bubble Suite Update.exe
C:\Users\Alexandre\AppData\Roaming\ehpjpfjm\enat.dll
C:\Users\Alexandre\AppData\Local\avaavaevy\avaavaevy.exe
C:\Users\Alexandre\AppData\Roaming\Nosibay\Bubble Suite\Bubble Suite Update.exe
Task: {BF41359C-8963-4FDE-930B-04493FC74814} - System32\Tasks\{685CE949-96A1-49F6-AD47-E50BBA023AE0} => pcalua.exe -a C:\PROGRA~2\SearchProtect\Main\bin\uninstall.exe -c /S <==== ATTENTION
EmptyTemp:
end
[*] Une fois, le texte coller dans le bloc-note.
[*] Cliquez sur "Fichier" puis dans le menu déroulant sur "Enregistrer sous"
[*] A cette fenêtre cliquez sur "Bureau"
[*] Dans la zone de "Nom de fichier" tapez : fixlist puis validez en cliquant sur Enregistrer
[*] Sur votre bureau vous avec le fichier texte (fixlist.txt & FRST.exe)
[*] Lancez FRST, "exécuter en tant qu'administrateur" sous Windows Vista, Windows Seven et Windows 8/8.1
[*] Cliquez sur "Fix"
[*] Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.
[*] Redémarre l'ordinateur.
[*] ===> Aide : <<<ICI>>>
2/
- Télécharge MBAM et installe le selon l'emplacement par défaut
https://www.malwarebytes.com/mwb-download/
- Mets le à jour puis lance un examen "Menaces".
- coche "Recherche de rootkits" (Paramètres -> Détection et protection)
- A la fin du scan, clic sur "Mettre tous en quarantaine" en bas à gauche.
- Redémarre l'ordinateur si besoin.
- Après redémarrage, relance Malwarebytes.
- Vas chercher le rapport dans l'onglet "Historique".
- Clic à gauche sur l'onglet Journaux de l'application.
- Double-clic sur le journal d'examen pour l'afficher.
- En bas à gauche choisis "Copier dans le presse papier"
- colle le rapport le contenu du journal ici
=================================
Si tu as besoin d'aide tu peux voir ce tutoriel : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Bonne soirée
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-04-2015
Ran by Alexandre at 2015-04-14 16:01:17 Run:1
Running from C:\Users\Alexandre\Desktop
Loaded Profiles: Alexandre (Available profiles: Alexandre)
Boot Mode: Normal
==============================================
Content of fixlist:
start
CloseProcesses:
CreateRestorePoint:
() C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\jnspA6B0.tmp
() C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\nsu8669.tmp
HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\...\Run: [Itibiti.exe] => C:\Program Files (x86)\Itibiti Soft Phone\Itibiti.exe
HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\...\Run: [Bubble Suite] => C:\Users\Alexandre\AppData\Roaming\Nosibay\Bubble Suite\Bubble Suite.exe /winstartup
R2 jyhuheti; C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\jnspA6B0.tmp [230912 2015-04-09] () [File not signed]
R2 syxuxevo; C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\nsu8669.tmp [140288 2015-04-13] () [File not signed]
2015-04-14 14:50 - 2015-04-14 14:50 - 00001119 _____ () C:\Users\Alexandre\Desktop\Continue Live Installation.lnk
2015-04-09 14:08 - 2015-04-10 17:12 - 00000000 ____D () C:\ProgramData\T122078ED
2015-04-09 14:00 - 2015-04-10 22:07 - 00000000 ____D () C:\Users\Alexandre\AppData\Local\ZombieNews
2015-04-09 13:59 - 2015-04-09 13:59 - 00000000 ____D () C:\ProgramData\ZombieNews
2015-04-09 13:45 - 2015-04-09 13:45 - 00000000 ____D () C:\Users\Alexandre\AppData\Roaming\ehpjpfjm
2015-04-09 13:43 - 2015-04-09 13:43 - 00003780 _____ () C:\windows\System32\Tasks\Selection Tools Update
2013-10-22 11:21 - 2013-10-22 11:21 - 50053120 _____ () C:\Program Files (x86)\GUT5B65.tmp
2015-04-09 13:41 - 2015-04-09 13:41 - 0000078 _____ () C:\Users\Alexandre\AppData\Roaming\Bubble Suite.installation.log
2015-04-09 13:45 - 2015-04-09 13:45 - 0000064 _____ () C:\Users\Alexandre\AppData\Local\eb3de8941946cb3437202dbed8747183
2015-01-25 21:39 - 2015-01-25 21:39 - 0000000 _____ () C:\Users\Alexandre\AppData\Local\{DDBC60FA-FF81-4C7F-932A-F44716D885FE}
CustomCLSID: HKU\S-1-5-21-1199100571-1431918522-3286286321-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> C:\Users\Alexandre\AppData\Roaming\ehpjpfjm\enat.dll () <==== ATTENTION
Task: {10343A65-2E14-442B-95C9-BC67D6342A64} - System32\Tasks\avaavaevy => C:\Users\Alexandre\AppData\Local\avaavaevy\avaavaevy.exe [2015-04-12] () <==== ATTENTION
Task: {1404458D-EE30-4357-AACA-E6E5BC02CC16} - System32\Tasks\Bubble Suite Update => C:\Users\Alexandre\AppData\Roaming\Nosibay\Bubble Suite\Bubble Suite Update.exe
C:\Users\Alexandre\AppData\Roaming\ehpjpfjm\enat.dll
C:\Users\Alexandre\AppData\Local\avaavaevy\avaavaevy.exe
C:\Users\Alexandre\AppData\Roaming\Nosibay\Bubble Suite\Bubble Suite Update.exe
Task: {BF41359C-8963-4FDE-930B-04493FC74814} - System32\Tasks\{685CE949-96A1-49F6-AD47-E50BBA023AE0} => pcalua.exe -a C:\PROGRA~2\SearchProtect\Main\bin\uninstall.exe -c /S <==== ATTENTION
EmptyTemp:
end
Processes closed successfully.
Restore point was successfully created.
C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\jnspA6B0.tmp => No running process found
C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\nsu8669.tmp => No running process found
HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Itibiti.exe => value deleted successfully.
HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Bubble Suite => value deleted successfully.
jyhuheti => Service deleted successfully.
syxuxevo => Service deleted successfully.
C:\Users\Alexandre\Desktop\Continue Live Installation.lnk => Moved successfully.
C:\ProgramData\T122078ED => Moved successfully.
C:\Users\Alexandre\AppData\Local\ZombieNews => Moved successfully.
C:\ProgramData\ZombieNews => Moved successfully.
C:\Users\Alexandre\AppData\Roaming\ehpjpfjm => Moved successfully.
C:\windows\System32\Tasks\Selection Tools Update => Moved successfully.
C:\Program Files (x86)\GUT5B65.tmp => Moved successfully.
C:\Users\Alexandre\AppData\Roaming\Bubble Suite.installation.log => Moved successfully.
C:\Users\Alexandre\AppData\Local\eb3de8941946cb3437202dbed8747183 => Moved successfully.
C:\Users\Alexandre\AppData\Local\{DDBC60FA-FF81-4C7F-932A-F44716D885FE} => Moved successfully.
"HKU\S-1-5-21-1199100571-1431918522-3286286321-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{10343A65-2E14-442B-95C9-BC67D6342A64}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{10343A65-2E14-442B-95C9-BC67D6342A64}" => Key deleted successfully.
C:\Windows\System32\Tasks\avaavaevy => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\avaavaevy" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1404458D-EE30-4357-AACA-E6E5BC02CC16}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1404458D-EE30-4357-AACA-E6E5BC02CC16}" => Key deleted successfully.
C:\Windows\System32\Tasks\Bubble Suite Update => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Bubble Suite Update" => Key deleted successfully.
"C:\Users\Alexandre\AppData\Roaming\ehpjpfjm\enat.dll" => File/Directory not found.
C:\Users\Alexandre\AppData\Local\avaavaevy\avaavaevy.exe => Moved successfully.
"C:\Users\Alexandre\AppData\Roaming\Nosibay\Bubble Suite\Bubble Suite Update.exe" => File/Directory not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BF41359C-8963-4FDE-930B-04493FC74814}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BF41359C-8963-4FDE-930B-04493FC74814}" => Key deleted successfully.
C:\Windows\System32\Tasks\{685CE949-96A1-49F6-AD47-E50BBA023AE0} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{685CE949-96A1-49F6-AD47-E50BBA023AE0}" => Key deleted successfully.
EmptyTemp: => Removed 1 GB temporary data.
The system needed a reboot.
Ran by Alexandre at 2015-04-14 16:01:17 Run:1
Running from C:\Users\Alexandre\Desktop
Loaded Profiles: Alexandre (Available profiles: Alexandre)
Boot Mode: Normal
==============================================
Content of fixlist:
start
CloseProcesses:
CreateRestorePoint:
() C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\jnspA6B0.tmp
() C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\nsu8669.tmp
HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\...\Run: [Itibiti.exe] => C:\Program Files (x86)\Itibiti Soft Phone\Itibiti.exe
HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\...\Run: [Bubble Suite] => C:\Users\Alexandre\AppData\Roaming\Nosibay\Bubble Suite\Bubble Suite.exe /winstartup
R2 jyhuheti; C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\jnspA6B0.tmp [230912 2015-04-09] () [File not signed]
R2 syxuxevo; C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\nsu8669.tmp [140288 2015-04-13] () [File not signed]
2015-04-14 14:50 - 2015-04-14 14:50 - 00001119 _____ () C:\Users\Alexandre\Desktop\Continue Live Installation.lnk
2015-04-09 14:08 - 2015-04-10 17:12 - 00000000 ____D () C:\ProgramData\T122078ED
2015-04-09 14:00 - 2015-04-10 22:07 - 00000000 ____D () C:\Users\Alexandre\AppData\Local\ZombieNews
2015-04-09 13:59 - 2015-04-09 13:59 - 00000000 ____D () C:\ProgramData\ZombieNews
2015-04-09 13:45 - 2015-04-09 13:45 - 00000000 ____D () C:\Users\Alexandre\AppData\Roaming\ehpjpfjm
2015-04-09 13:43 - 2015-04-09 13:43 - 00003780 _____ () C:\windows\System32\Tasks\Selection Tools Update
2013-10-22 11:21 - 2013-10-22 11:21 - 50053120 _____ () C:\Program Files (x86)\GUT5B65.tmp
2015-04-09 13:41 - 2015-04-09 13:41 - 0000078 _____ () C:\Users\Alexandre\AppData\Roaming\Bubble Suite.installation.log
2015-04-09 13:45 - 2015-04-09 13:45 - 0000064 _____ () C:\Users\Alexandre\AppData\Local\eb3de8941946cb3437202dbed8747183
2015-01-25 21:39 - 2015-01-25 21:39 - 0000000 _____ () C:\Users\Alexandre\AppData\Local\{DDBC60FA-FF81-4C7F-932A-F44716D885FE}
CustomCLSID: HKU\S-1-5-21-1199100571-1431918522-3286286321-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> C:\Users\Alexandre\AppData\Roaming\ehpjpfjm\enat.dll () <==== ATTENTION
Task: {10343A65-2E14-442B-95C9-BC67D6342A64} - System32\Tasks\avaavaevy => C:\Users\Alexandre\AppData\Local\avaavaevy\avaavaevy.exe [2015-04-12] () <==== ATTENTION
Task: {1404458D-EE30-4357-AACA-E6E5BC02CC16} - System32\Tasks\Bubble Suite Update => C:\Users\Alexandre\AppData\Roaming\Nosibay\Bubble Suite\Bubble Suite Update.exe
C:\Users\Alexandre\AppData\Roaming\ehpjpfjm\enat.dll
C:\Users\Alexandre\AppData\Local\avaavaevy\avaavaevy.exe
C:\Users\Alexandre\AppData\Roaming\Nosibay\Bubble Suite\Bubble Suite Update.exe
Task: {BF41359C-8963-4FDE-930B-04493FC74814} - System32\Tasks\{685CE949-96A1-49F6-AD47-E50BBA023AE0} => pcalua.exe -a C:\PROGRA~2\SearchProtect\Main\bin\uninstall.exe -c /S <==== ATTENTION
EmptyTemp:
end
Processes closed successfully.
Restore point was successfully created.
C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\jnspA6B0.tmp => No running process found
C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\nsu8669.tmp => No running process found
HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Itibiti.exe => value deleted successfully.
HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Bubble Suite => value deleted successfully.
jyhuheti => Service deleted successfully.
syxuxevo => Service deleted successfully.
C:\Users\Alexandre\Desktop\Continue Live Installation.lnk => Moved successfully.
C:\ProgramData\T122078ED => Moved successfully.
C:\Users\Alexandre\AppData\Local\ZombieNews => Moved successfully.
C:\ProgramData\ZombieNews => Moved successfully.
C:\Users\Alexandre\AppData\Roaming\ehpjpfjm => Moved successfully.
C:\windows\System32\Tasks\Selection Tools Update => Moved successfully.
C:\Program Files (x86)\GUT5B65.tmp => Moved successfully.
C:\Users\Alexandre\AppData\Roaming\Bubble Suite.installation.log => Moved successfully.
C:\Users\Alexandre\AppData\Local\eb3de8941946cb3437202dbed8747183 => Moved successfully.
C:\Users\Alexandre\AppData\Local\{DDBC60FA-FF81-4C7F-932A-F44716D885FE} => Moved successfully.
"HKU\S-1-5-21-1199100571-1431918522-3286286321-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{10343A65-2E14-442B-95C9-BC67D6342A64}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{10343A65-2E14-442B-95C9-BC67D6342A64}" => Key deleted successfully.
C:\Windows\System32\Tasks\avaavaevy => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\avaavaevy" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1404458D-EE30-4357-AACA-E6E5BC02CC16}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1404458D-EE30-4357-AACA-E6E5BC02CC16}" => Key deleted successfully.
C:\Windows\System32\Tasks\Bubble Suite Update => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Bubble Suite Update" => Key deleted successfully.
"C:\Users\Alexandre\AppData\Roaming\ehpjpfjm\enat.dll" => File/Directory not found.
C:\Users\Alexandre\AppData\Local\avaavaevy\avaavaevy.exe => Moved successfully.
"C:\Users\Alexandre\AppData\Roaming\Nosibay\Bubble Suite\Bubble Suite Update.exe" => File/Directory not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BF41359C-8963-4FDE-930B-04493FC74814}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BF41359C-8963-4FDE-930B-04493FC74814}" => Key deleted successfully.
C:\Windows\System32\Tasks\{685CE949-96A1-49F6-AD47-E50BBA023AE0} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{685CE949-96A1-49F6-AD47-E50BBA023AE0}" => Key deleted successfully.
EmptyTemp: => Removed 1 GB temporary data.
The system needed a reboot.
End of Fixlog 16:02:38
Malwarebytes Anti-Malware
www.malwarebytes.org
Date de l'examen: 14/04/2015
Heure de l'examen: 4:12:20 PM
Fichier journal:
Administrateur: Oui
Version: 2.01.4.1018
Base de données Malveillants: v2015.04.14.05
Base de données Rootkits: v2015.03.31.01
Licence: Gratuit
Protection contre les malveillants: Désactivé(e)
Protection contre les sites Web malveillants: Désactivé(e)
Auto-protection: Désactivé(e)
Système d'exploitation: Windows 7 Service Pack 1
Processeur: x64
Système de fichiers: NTFS
Utilisateur: Alexandre
Type d'examen: Examen "Menaces"
Résultat: Terminé
Objets analysés: 373058
Temps écoulé: 13 min, 22 sec
Mémoire: Activé(e)
Démarrage: Activé(e)
Système de fichiers: Activé(e)
Archives: Activé(e)
Rootkits: Désactivé(e)
Heuristique: Activé(e)
PUP: Activé(e)
PUM: Activé(e)
Processus: 0
(Aucun élément malicieux détecté)
Modules: 0
(Aucun élément malicieux détecté)
Clés du Registre: 7
PUP.Optional.Dregol.A, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\ihokndmjeombjojnfkmapfnjeghjohim, Mis en quarantaine, [88f5412b662439fd24d63d8563a035cb],
PUP.Optional.SearchProtect, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}, Mis en quarantaine, [532ac7a581091026255a75d304015fa1],
PUP.Optional.SearchProtect, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{cf2797aa-b7ec-e311-8ed9-005056c00008}, Mis en quarantaine, [e99423493d4da096cfaf1038eb1aec14],
PUP.Optional.Dregol.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\ihokndmjeombjojnfkmapfnjeghjohim, Mis en quarantaine, [304d1b5199f1dd59bf3bad157390936d],
PUP.Optional.VoPackage.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\VOPackage, Mis en quarantaine, [136a2745fa9076c00000054ff114c23e],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\SOFTWARE\HQCinema Pro 2.1V09.04-nv-ie, Mis en quarantaine, [037a4e1e800a6bcb546768705da6cd33],
PUP.Optional.Dregol.A, HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\ihokndmjeombjojnfkmapfnjeghjohim, Mis en quarantaine, [f48997d51b6fde58f10a4d75f80b2cd4],
Valeurs du Registre: 5
PUP.Optional.Dregol.A, HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|URL, http://www.dregol.com/results.php?f=4&q={searchTerms}&a=drg_cmi_15_16&cd=2XzuyEtN2Y1L1Qzu0Ezz0EtD0ByByEtDtBtCyCtC0A0E0EtAtN0D0Tzu0StCtCzyzytN1L2XzutAtFtCtDtFtBtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtAyByEtC0Azy0DtGzzyB0D0BtGyE0D0BtBtG0AtAyD0BtGyCyE0AtCzzzztD0B0CtAyD0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtCtCtCyDzzzzyEtG0C0AyCzztGyE0C0ByBtGzytDzz0CtGyCtAzz0BtB0C0DzzyEzztA0E2QtN0A0LzuyEtN1B2Z1V1T1S1NzuyBtDtD&cr=529251880&ir=, Mis en quarantaine, [641905676228aa8cbbb1282b3bcad828]
PUP.Optional.Dregol.A, HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|TopResultURLFallback, http://www.dregol.com/results.php?f=4&q={searchTerms}&a=drg_cmi_15_16&cd=2XzuyEtN2Y1L1Qzu0Ezz0EtD0ByByEtDtBtCyCtC0A0E0EtAtN0D0Tzu0StCtCzyzytN1L2XzutAtFtCtDtFtBtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtAyByEtC0Azy0DtGzzyB0D0BtGyE0D0BtBtG0AtAyD0BtGyCyE0AtCzzzztD0B0CtAyD0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtCtCtCyDzzzzyEtG0C0AyCzztGyE0C0ByBtGzytDzz0CtGyCtAzz0BtB0C0DzzyEzztA0E2QtN0A0LzuyEtN1B2Z1V1T1S1NzuyBtDtD&cr=529251880&ir=, Mis en quarantaine, [f28b8ae2c7c3f046472502515fa68878]
PUP.Optional.Dregol.A, HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|FaviconPath, C:\Users\Alexandre\AppData\LocalLow\Microsoft\Internet Explorer\Services\Run_Dregol.ico, Mis en quarantaine, [e39a1656b0da80b6d597064d17ee827e]
PUP.Optional.Dregol.A, HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}, Dregol, Mis en quarantaine, [532ad09cfe8cf046b7b587ccd82d45bb]
PUP.Optional.Dregol.A, HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|DisplayName, Dregol, Mis en quarantaine, [f489412bb7d39c9af3793e156f9640c0]
Données du Registre: 0
(Aucun élément malicieux détecté)
Dossiers: 2
PUP.Optional.MultiPlug.A, C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346, Mis en quarantaine, [b1cc8ae2c4c68da9c7417cd9dd282bd5],
PUP.Optional.SearchProtect.A, C:\Users\Alexandre\AppData\Local\avaavaevy, Mis en quarantaine, [d5a86a02f89248ee9f1fbefbbc47ca36],
Fichiers: 14
PUP.Optional.SearchProtect.A, C:\Users\Alexandre\AppData\Local\avaavaevy\pbqrmvbub, Mis en quarantaine, [ec910d5fb8d21422201f724b27dad030],
PUP.Optional.MultiPlug.A, C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\nsu8669.tmp, Mis en quarantaine, [b1cc8ae2c4c68da9c7417cd9dd282bd5],
PUP.Optional.MultiPlug.A, C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\jnspA6B0.tmp, Mis en quarantaine, [b1cc8ae2c4c68da9c7417cd9dd282bd5],
PUP.Optional.MultiPlug.A, C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\rnseA007.exe, Mis en quarantaine, [b1cc8ae2c4c68da9c7417cd9dd282bd5],
PUP.Optional.MultiPlug.A, C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\Uninstall.exe, Mis en quarantaine, [b1cc8ae2c4c68da9c7417cd9dd282bd5],
PUP.Optional.MultiPlug.A, C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\vnso3395.tmp, Mis en quarantaine, [b1cc8ae2c4c68da9c7417cd9dd282bd5],
PUP.Optional.SearchProtect.A, C:\Users\Alexandre\AppData\Local\avaavaevy\bahvxfk, Mis en quarantaine, [d5a86a02f89248ee9f1fbefbbc47ca36],
PUP.Optional.SearchProtect.A, C:\Users\Alexandre\AppData\Local\avaavaevy\mkfvxfk, Mis en quarantaine, [d5a86a02f89248ee9f1fbefbbc47ca36],
PUP.Optional.SearchProtect.A, C:\Users\Alexandre\AppData\Local\avaavaevy\pvpqbjobmlpfqlovvawq, Mis en quarantaine, [d5a86a02f89248ee9f1fbefbbc47ca36],
PUP.Optional.SearchProtect.A, C:\Users\Alexandre\AppData\Local\avaavaevy\qokvxfk, Mis en quarantaine, [d5a86a02f89248ee9f1fbefbbc47ca36],
PUP.Optional.SearchProtect.A, C:\Users\Alexandre\AppData\Local\avaavaevy\rfobmlpfqlovvawq, Mis en quarantaine, [d5a86a02f89248ee9f1fbefbbc47ca36],
PUP.Optional.SearchProtect.A, C:\Users\Alexandre\AppData\Local\avaavaevy\rpboobmlpfqlovvawq, Mis en quarantaine, [d5a86a02f89248ee9f1fbefbbc47ca36],
PUP.Optional.SearchProtect.A, C:\Users\Alexandre\AppData\Local\avaavaevy\ycfvxfk, Mis en quarantaine, [d5a86a02f89248ee9f1fbefbbc47ca36],
PUP.Optional.Dregol.A, C:\Users\Alexandre\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences, Bon: (), Mauvais: ( "homepage":"http://www.dregol.com/...",), Remplacé,[582535375c2e85b12a425ce29b6b926e]
Secteurs physiques: 0
(Aucun élément malicieux détecté)
(end)
www.malwarebytes.org
Date de l'examen: 14/04/2015
Heure de l'examen: 4:12:20 PM
Fichier journal:
Administrateur: Oui
Version: 2.01.4.1018
Base de données Malveillants: v2015.04.14.05
Base de données Rootkits: v2015.03.31.01
Licence: Gratuit
Protection contre les malveillants: Désactivé(e)
Protection contre les sites Web malveillants: Désactivé(e)
Auto-protection: Désactivé(e)
Système d'exploitation: Windows 7 Service Pack 1
Processeur: x64
Système de fichiers: NTFS
Utilisateur: Alexandre
Type d'examen: Examen "Menaces"
Résultat: Terminé
Objets analysés: 373058
Temps écoulé: 13 min, 22 sec
Mémoire: Activé(e)
Démarrage: Activé(e)
Système de fichiers: Activé(e)
Archives: Activé(e)
Rootkits: Désactivé(e)
Heuristique: Activé(e)
PUP: Activé(e)
PUM: Activé(e)
Processus: 0
(Aucun élément malicieux détecté)
Modules: 0
(Aucun élément malicieux détecté)
Clés du Registre: 7
PUP.Optional.Dregol.A, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\ihokndmjeombjojnfkmapfnjeghjohim, Mis en quarantaine, [88f5412b662439fd24d63d8563a035cb],
PUP.Optional.SearchProtect, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}, Mis en quarantaine, [532ac7a581091026255a75d304015fa1],
PUP.Optional.SearchProtect, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{cf2797aa-b7ec-e311-8ed9-005056c00008}, Mis en quarantaine, [e99423493d4da096cfaf1038eb1aec14],
PUP.Optional.Dregol.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\ihokndmjeombjojnfkmapfnjeghjohim, Mis en quarantaine, [304d1b5199f1dd59bf3bad157390936d],
PUP.Optional.VoPackage.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\VOPackage, Mis en quarantaine, [136a2745fa9076c00000054ff114c23e],
PUP.Optional.CrossRider.A, HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\SOFTWARE\HQCinema Pro 2.1V09.04-nv-ie, Mis en quarantaine, [037a4e1e800a6bcb546768705da6cd33],
PUP.Optional.Dregol.A, HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\ihokndmjeombjojnfkmapfnjeghjohim, Mis en quarantaine, [f48997d51b6fde58f10a4d75f80b2cd4],
Valeurs du Registre: 5
PUP.Optional.Dregol.A, HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|URL, http://www.dregol.com/results.php?f=4&q={searchTerms}&a=drg_cmi_15_16&cd=2XzuyEtN2Y1L1Qzu0Ezz0EtD0ByByEtDtBtCyCtC0A0E0EtAtN0D0Tzu0StCtCzyzytN1L2XzutAtFtCtDtFtBtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtAyByEtC0Azy0DtGzzyB0D0BtGyE0D0BtBtG0AtAyD0BtGyCyE0AtCzzzztD0B0CtAyD0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtCtCtCyDzzzzyEtG0C0AyCzztGyE0C0ByBtGzytDzz0CtGyCtAzz0BtB0C0DzzyEzztA0E2QtN0A0LzuyEtN1B2Z1V1T1S1NzuyBtDtD&cr=529251880&ir=, Mis en quarantaine, [641905676228aa8cbbb1282b3bcad828]
PUP.Optional.Dregol.A, HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|TopResultURLFallback, http://www.dregol.com/results.php?f=4&q={searchTerms}&a=drg_cmi_15_16&cd=2XzuyEtN2Y1L1Qzu0Ezz0EtD0ByByEtDtBtCyCtC0A0E0EtAtN0D0Tzu0StCtCzyzytN1L2XzutAtFtCtDtFtBtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyDtAyByEtC0Azy0DtGzzyB0D0BtGyE0D0BtBtG0AtAyD0BtGyCyE0AtCzzzztD0B0CtAyD0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtCtCtCyDzzzzyEtG0C0AyCzztGyE0C0ByBtGzytDzz0CtGyCtAzz0BtB0C0DzzyEzztA0E2QtN0A0LzuyEtN1B2Z1V1T1S1NzuyBtDtD&cr=529251880&ir=, Mis en quarantaine, [f28b8ae2c7c3f046472502515fa68878]
PUP.Optional.Dregol.A, HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|FaviconPath, C:\Users\Alexandre\AppData\LocalLow\Microsoft\Internet Explorer\Services\Run_Dregol.ico, Mis en quarantaine, [e39a1656b0da80b6d597064d17ee827e]
PUP.Optional.Dregol.A, HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}, Dregol, Mis en quarantaine, [532ad09cfe8cf046b7b587ccd82d45bb]
PUP.Optional.Dregol.A, HKU\S-1-5-21-1199100571-1431918522-3286286321-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{015DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|DisplayName, Dregol, Mis en quarantaine, [f489412bb7d39c9af3793e156f9640c0]
Données du Registre: 0
(Aucun élément malicieux détecté)
Dossiers: 2
PUP.Optional.MultiPlug.A, C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346, Mis en quarantaine, [b1cc8ae2c4c68da9c7417cd9dd282bd5],
PUP.Optional.SearchProtect.A, C:\Users\Alexandre\AppData\Local\avaavaevy, Mis en quarantaine, [d5a86a02f89248ee9f1fbefbbc47ca36],
Fichiers: 14
PUP.Optional.SearchProtect.A, C:\Users\Alexandre\AppData\Local\avaavaevy\pbqrmvbub, Mis en quarantaine, [ec910d5fb8d21422201f724b27dad030],
PUP.Optional.MultiPlug.A, C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\nsu8669.tmp, Mis en quarantaine, [b1cc8ae2c4c68da9c7417cd9dd282bd5],
PUP.Optional.MultiPlug.A, C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\jnspA6B0.tmp, Mis en quarantaine, [b1cc8ae2c4c68da9c7417cd9dd282bd5],
PUP.Optional.MultiPlug.A, C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\rnseA007.exe, Mis en quarantaine, [b1cc8ae2c4c68da9c7417cd9dd282bd5],
PUP.Optional.MultiPlug.A, C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\Uninstall.exe, Mis en quarantaine, [b1cc8ae2c4c68da9c7417cd9dd282bd5],
PUP.Optional.MultiPlug.A, C:\Users\Alexandre\AppData\Roaming\80F8CBE1-1428602347-E111-8053-B03D73106346\vnso3395.tmp, Mis en quarantaine, [b1cc8ae2c4c68da9c7417cd9dd282bd5],
PUP.Optional.SearchProtect.A, C:\Users\Alexandre\AppData\Local\avaavaevy\bahvxfk, Mis en quarantaine, [d5a86a02f89248ee9f1fbefbbc47ca36],
PUP.Optional.SearchProtect.A, C:\Users\Alexandre\AppData\Local\avaavaevy\mkfvxfk, Mis en quarantaine, [d5a86a02f89248ee9f1fbefbbc47ca36],
PUP.Optional.SearchProtect.A, C:\Users\Alexandre\AppData\Local\avaavaevy\pvpqbjobmlpfqlovvawq, Mis en quarantaine, [d5a86a02f89248ee9f1fbefbbc47ca36],
PUP.Optional.SearchProtect.A, C:\Users\Alexandre\AppData\Local\avaavaevy\qokvxfk, Mis en quarantaine, [d5a86a02f89248ee9f1fbefbbc47ca36],
PUP.Optional.SearchProtect.A, C:\Users\Alexandre\AppData\Local\avaavaevy\rfobmlpfqlovvawq, Mis en quarantaine, [d5a86a02f89248ee9f1fbefbbc47ca36],
PUP.Optional.SearchProtect.A, C:\Users\Alexandre\AppData\Local\avaavaevy\rpboobmlpfqlovvawq, Mis en quarantaine, [d5a86a02f89248ee9f1fbefbbc47ca36],
PUP.Optional.SearchProtect.A, C:\Users\Alexandre\AppData\Local\avaavaevy\ycfvxfk, Mis en quarantaine, [d5a86a02f89248ee9f1fbefbbc47ca36],
PUP.Optional.Dregol.A, C:\Users\Alexandre\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences, Bon: (), Mauvais: ( "homepage":"http://www.dregol.com/...",), Remplacé,[582535375c2e85b12a425ce29b6b926e]
Secteurs physiques: 0
(Aucun élément malicieux détecté)
(end)
J'essaie de supprimer une sorte d'application qui ne cesse de vouloir s'installer. Elle s'appelle: Continue Live Installation. Elle est sur mon bureau et j'aimerais la désinstaller, mais je n'y arrive pas.
Merci