Comment supprimer ADS by Cloudscout (besoin du script !)

Question

Bonjour,

J'ai un problème sur mon ordinateur à cause de... ADS by CloudScout ! J'ai vu beaucoup de posts, mais j'ai aussi remarqué que chaque scripts étaient spécifiques à chaque personne, j'ai donc besoin d'un script qui correspond à mon problème. L'un d'entre vous serait-il capable de me fournir ce fameux script ?

PS : J'ai suivi ce tutoriel https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/#fix

Merci d'avance !

Voici les fichiers FRST, Addition et Shortcut obtenus lors du scan.
https://pjjoint.malekal.com/files.php?id=FRST_20150627_u13g13k11g14e14
https://pjjoint.malekal.com/files.php?id=20150627_l15k15w13f6y11
https://pjjoint.malekal.com/files.php?id=20150627_h10x13x8p13o14

Configuration: Windows 7 / Mozilla 11.0

Utilisateur anonyme · Answer

Bonjour iSpeeX

Nous allons regarder cela de plus près.

Le rapport de ZHPDiag doit être posté en lien, il est trop long pour tenir dans une réponse.

 ZHPDiag(de Nicolas coolman)

ZHPDiag : https://nicolascoolman.eu

 Pour Vista Windows 7 et Windows 8 clic droit sur le fichier téléchargé et Exécuter en tant qu'administrateur
 Deux icônes seront crées sur le bureau lors de son installation ZHPDiag et ZHPFix
 Lance ZHPDiag en double cliquant sur son icône présente sur le bureau  
 Pour Vista Windows 7 et Windows 8 clic droit sur le raccourci de ZHPDiag et Exécuter en tant qu'administrateur
 Clique sur Complet 
 Laisse le scan se dérouler.
 Le scan terminé le rapport sera automatiquement sauvegardé sur le bureau sous ce nom ZHPDiag.txt
 Sinon le rapport se trouvera aussi ici ==> c:\ZHP\ZHPDiag.txt

Pour poster le rapport en lien dans ta réponse utilise cet hébergeur de fichiers : http://www.cjoint.com/ 
 
 
.::Helper en désinfection PC::.

Malekal_morte- · Answer

Salut,

Tu as mis un mot de passe sur les rapports, donc on ne peut pas les lire.

Sinon ceci devrait faire l'affaire comme sur les autres sujets résolus :

Remets/vérifie que tous les serveurs de noms (DNS) sont automatiques : https://forum.malekal.com/viewtopic.php?t=48312&start=
PUIS ensuite vide le cache DNS et internet.
Les 3 étapes sont importantes et à  faire sinon les pubs vont continuer.
 
 
Like the angel you are, you laugh creating a lightness in my chest,
Your eyes they penetrate me,
(Your answer's always 'maybe')
That's when I got up and left

iSpeeX · Answer

Voici le FIXLOG : Fix result of Farbar Recovery Scan Tool (x64) Version:24-06-2015 Ran by DOMZEN06 at 2015-06-27 22:55:48 Run:1 Running from C:\Users\DOMZEN06\Desktop Loaded Profiles: UpdatusUser & DOMZEN06 & DefaultAppPool (Available Profiles: UpdatusUser & DOMZEN06 & DefaultAppPool) Boot Mode: Normal ============================================== fixlist content: HKLM\...\Run: [shopperz] => C:\Program Files\shopperz\Ynauoihe.exe HKLM\...\Run: [shopperz64] => C:\Program Files\shopperz\Ynauoihe64.exe HKLM-x32\...\Run: [SmartWeb] => C:\Users\DOMZEN06\AppData\Local\SmartWeb\SmartWebHelper.exe HKLM-x32\...\Run: [gmsd_fr_005010014] => [X] FF Extension: No Name - C:\Users\DOMZEN06\AppData\Roaming\Mozilla\Firefox\Profiles\vjwejrec.default-1416659744052\extensions\39ffxtbr@www.mapsgalaxy.com [not found] FF Extension: No Name - C:\Users\DOMZEN06\AppData\Roaming\Mozilla\Firefox\Profiles\vjwejrec.default-1416659744052\extensions\arthurj8283@gmail.com [not found] FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [not found] 2015-06-27 21:57 - 2015-06-27 21:57 - 00000000 ____D C:\Users\DOMZEN06\Documents\Optimizer Pro 2015-06-27 21:52 - 2015-06-27 21:52 - 00000000 ____D C:\Program Files (x86)\predm 2015-06-22 00:00 - 2015-06-22 00:00 - 00613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local scBF4B.tmp 2015-06-21 23:59 - 2015-06-21 23:59 - 00003634 _____ C:\Windows\System32\Tasks\Ioect 2015-06-21 23:59 - 2015-06-18 12:08 - 00061336 _____ (Cherimoya Ltd) C:\Windows\system32\Drivers\cherimoya.sys 2015-06-21 19:46 - 2015-06-21 19:46 - 00613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local syD45.tmp 2015-06-21 19:28 - 2015-06-21 19:28 - 00000000 ____D C:\ProgramData\IHProtectUpDate 2015-06-21 19:28 - 2015-06-21 19:27 - 00613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local sr8300.tmp 2015-06-21 19:27 - 2015-06-26 22:34 - 00004044 _____ C:\Windows\System32\Tasks\SmartWeb Upgrade Trigger Task 2015-06-21 19:27 - 2015-06-26 22:12 - 00000000 ____D C:\Program Files (x86)\MiuiTab 2015-06-21 17:26 - 2015-06-21 17:26 - 00613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local st8A28.tmp 2015-06-21 17:19 - 2015-06-21 17:24 - 00000000 ____D C:\Users\DOMZEN06\AppData\Local\gmsd_fr_002020008 2015-06-21 17:10 - 2015-06-21 17:10 - 00613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local sn533A.tmp 2015-06-20 02:04 - 2015-06-20 02:04 - 00000000 ____D C:\ProgramData\{09b9b015-1280-f39d-09b9-9b015128c054} 2015-06-20 01:59 - 2015-06-20 01:59 - 00000000 ____D C:\Users\DOMZEN06\AppData\Roaming\288F1C80-1434758374-81E1-23A3-10BF4814D716 2015-06-20 01:49 - 2015-06-20 01:49 - 00613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local scCF13.tmp 2015-06-19 23:55 - 2015-06-19 23:55 - 00613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local sp496A.tmp 2015-06-19 23:46 - 2015-06-20 01:58 - 00000000 ____D C:\Users\DOMZEN06\AppData\Local\gmsd_fr_005010007 2015-06-19 19:26 - 2015-06-19 19:26 - 00613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local siBFE4.tmp 2015-06-18 22:20 - 2015-06-18 22:20 - 00613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local sy5F8C.tmp 2015-06-16 21:04 - 2015-06-16 21:04 - 00613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local sc126B.tmp 2015-06-16 21:03 - 2015-06-16 21:03 - 00000000 _____ C:\Windows\prleth.sys 2015-06-16 21:03 - 2015-06-16 21:03 - 00000000 _____ C:\Windows\hgfs.sys 2015-06-16 20:34 - 2015-06-26 22:20 - 00000000 ____D C:\Users\DOMZEN06\AppData\Local\288F1C80-1434486863-81E1-23A3-10BF4814D716 2015-06-16 20:32 - 2015-06-26 22:17 - 00000000 ____D C:\Users\DOMZEN06\AppData\Local\288F1C80-1434486726-81E1-23A3-10BF4814D716 2015-06-16 20:32 - 2015-06-16 23:10 - 00000000 ____D C:\Program Files (x86)\CutterGeneration 2015-06-16 20:31 - 2015-06-26 22:13 - 00000000 ____D C:\Users\DOMZEN06\AppData\Roaming\288F1C80-1434479479-81E1-23A3-10BF4814D716 2015-06-16 20:31 - 2015-06-16 20:42 - 00000000 ____D C:\ProgramData\{8cbfc9a0-0e4b-60d0-8cbf-fc9a00e42680} 2015-06-16 20:31 - 2015-06-16 20:32 - 00000000 ____D C:\ProgramData\8244572019325762438 2015-06-16 20:31 - 2015-06-16 20:31 - 00000000 ____D C:\ProgramData\hidkddeihdbjgnlpfjjdbcehbjhpifll 2015-06-10 16:36 - 2015-04-11 05:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys 2015-06-10 00:13 - 2015-06-16 20:42 - 00000000 ____D C:\Users\DOMZEN06\AppData\Local\25955 2015-06-09 23:46 - 2015-06-16 20:31 - 00000000 ___HD C:\ProgramData\joy 2015-06-08 16:54 - 2015-06-08 16:54 - 00000000 ____D C:\Users\DOMZEN06\AppData\Roaming\Yahoo! 2015-06-08 16:54 - 2015-06-08 16:54 - 00000000 ____D C:\ProgramData\Yahoo! 2015-06-08 14:55 - 2015-06-08 19:42 - 00000112 _____ C:\ProgramData\8A51J0f.dat 2015-06-08 13:11 - 2015-06-08 20:51 - 00000000 ____D C:\ProgramData\abc 2015-06-08 13:09 - 2015-06-08 13:09 - 00000000 _____ C:\Windows\SysWOW64\Number of results 2015-06-08 13:06 - 2015-06-21 16:42 - 00003164 _____ C:\Windows\System32\Tasks\{8CC7942C-F2B7-4222-B53E-46E448F310BC} 2015-06-08 12:27 - 2015-06-27 18:55 - 00045056 _____ C:\Windows\SysWOW64\acovcnt.exe 2015-06-08 12:13 - 2015-06-24 19:39 - 00000004 _____ C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7 2015-06-08 12:10 - 2009-06-10 23:00 - 00000824 _____ C:\Windows\system32\Drivers\etc\hp.bak 2015-06-08 12:09 - 2015-06-26 22:20 - 00000000 ____D C:\Users\DOMZEN06\AppData\Roaming\288F1C80-1433758165-81E1-23A3-10BF4814D716 2015-06-08 12:09 - 2015-06-08 12:09 - 00631296 _____ C:\Windows\joy.dat 012-07-21 21:54 - 2015-06-27 18:55 - 0000387 _____ () C:\Users\DOMZEN06\AppData\Roaming\sp_data.sys 2015-06-16 21:04 - 2015-06-16 21:04 - 0613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local sc126B.tmp 2015-06-22 00:00 - 2015-06-22 00:00 - 0613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local scBF4B.tmp 2015-06-20 01:49 - 2015-06-20 01:49 - 0613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local scCF13.tmp 2015-06-19 19:26 - 2015-06-19 19:26 - 0613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local siBFE4.tmp 2015-06-21 17:10 - 2015-06-21 17:10 - 0613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local sn533A.tmp 2015-06-19 23:55 - 2015-06-19 23:55 - 0613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local sp496A.tmp 2015-06-21 19:28 - 2015-06-21 19:27 - 0613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local sr8300.tmp 2015-06-21 17:26 - 2015-06-21 17:26 - 0613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local st8A28.tmp 2015-06-18 22:20 - 2015-06-18 22:20 - 0613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local sy5F8C.tmp 2015-06-21 19:46 - 2015-06-21 19:46 - 0613255 _____ (CMI Limited) C:\Users\DOMZEN06\AppData\Local syD45.tmp Task: {132AD632-F2D5-4FB4-909A-4336B64DB55A} - System32\Tasks\{8CC7942C-F2B7-4222-B53E-46E448F310BC} => pcalua.exe -a C:\Users\DOMZEN06\AppData\Roaming\mystartsearch\UninstallManager.exe -c -ptid=cmi Task: {2F960467-696E-4862-9C99-A034311AF72D} - \SpyHunter4Startup No Task File <==== ATTENTION Task: {68A61DE0-9708-45DC-A9AE-61CB27E94BCF} - System32\Tasks\WebInternetSecurity Update Task => C:\Program Files (x86)\Webinternetsecurity\uninstall.webinternetsecurity.exe <==== ATTENTION Task: {7D6F95F8-77E8-48E1-B2C9-099E924610F1} - \iren3006 No Task File <==== ATTENTION Task: {CB1CEABD-887C-4929-9743-28147AD2D8AE} - System32\Tasks\Ioect => C:\Program Files\shopperz\Ewvdwdoae.bat <==== ATTENTION Task: {F5574861-E994-4C87-956E-76CCABD0C6DC} - System32\Tasks\SmartWeb Upgrade Trigger Task => C:\Users\DOMZEN06\AppData\Local\SmartWeb\SmartWebHelper.exe <==== ATTENTION HKLM\Software\Microsoft\Windows\CurrentVersion\Run\shopperz => value removed successfully HKLM\Software\Microsoft\Windows\CurrentVersion\Run\shopperz64 => value removed successfully HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SmartWeb => value removed successfully HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gmsd_fr_005010014 => value removed successfully C:\Users\DOMZEN06\AppData\Roaming\Mozilla\Firefox\Profiles\vjwejrec.default-1416659744052\extensions\39ffxtbr@www.mapsgalaxy.com not found. C:\Users\DOMZEN06\AppData\Roaming\Mozilla\Firefox\Profiles\vjwejrec.default-1416659744052\extensions\arthurj8283@gmail.com not found. C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} not found. "C:\Users\DOMZEN06\Documents\Optimizer Pro" => File/Folder not found. C:\Program Files (x86)\predm => moved successfully. C:\Users\DOMZEN06\AppData\Local scBF4B.tmp => moved successfully. C:\Windows\System32\Tasks\Ioect => moved successfully. C:\Windows\system32\Drivers\cherimoya.sys => moved successfully. C:\Users\DOMZEN06\AppData\Local syD45.tmp => moved successfully. C:\ProgramData\IHProtectUpDate => moved successfully. C:\Users\DOMZEN06\AppData\Local sr8300.tmp => moved successfully. C:\Windows\System32\Tasks\SmartWeb Upgrade Trigger Task => moved successfully. C:\Program Files (x86)\MiuiTab => moved successfully. C:\Users\DOMZEN06\AppData\Local st8A28.tmp => moved successfully. C:\Users\DOMZEN06\AppData\Local\gmsd_fr_002020008 => moved successfully. C:\Users\DOMZEN06\AppData\Local sn533A.tmp => moved successfully. C:\ProgramData\{09b9b015-1280-f39d-09b9-9b015128c054} => moved successfully. C:\Users\DOMZEN06\AppData\Roaming\288F1C80-1434758374-81E1-23A3-10BF4814D716 => moved successfully. C:\Users\DOMZEN06\AppData\Local scCF13.tmp => moved successfully. C:\Users\DOMZEN06\AppData\Local sp496A.tmp => moved successfully. C:\Users\DOMZEN06\AppData\Local\gmsd_fr_005010007 => moved successfully. C:\Users\DOMZEN06\AppData\Local siBFE4.tmp => moved successfully. C:\Users\DOMZEN06\AppData\Local sy5F8C.tmp => moved successfully. C:\Users\DOMZEN06\AppData\Local sc126B.tmp => moved successfully. C:\Windows\prleth.sys => moved successfully. C:\Windows\hgfs.sys => moved successfully. C:\Users\DOMZEN06\AppData\Local\288F1C80-1434486863-81E1-23A3-10BF4814D716 => moved successfully. C:\Users\DOMZEN06\AppData\Local\288F1C80-1434486726-81E1-23A3-10BF4814D716 => moved successfully. C:\Program Files (x86)\CutterGeneration => moved successfully. C:\Users\DOMZEN06\AppData\Roaming\288F1C80-1434479479-81E1-23A3-10BF4814D716 => moved successfully. C:\ProgramData\{8cbfc9a0-0e4b-60d0-8cbf-fc9a00e42680} => moved successfully. C:\ProgramData\8244572019325762438 => moved successfully. C:\ProgramData\hidkddeihdbjgnlpfjjdbcehbjhpifll => moved successfully. Could not move "C:\Windows\system32\Drivers\stream.sys" => Scheduled to move on reboot. C:\Users\DOMZEN06\AppData\Local\25955 => moved successfully. C:\ProgramData\joy => moved successfully. C:\Users\DOMZEN06\AppData\Roaming\Yahoo! => moved successfully. C:\ProgramData\Yahoo! => moved successfully. C:\ProgramData\8A51J0f.dat => moved successfully. C:\ProgramData\abc => moved successfully. C:\Windows\SysWOW64\Number of results => moved successfully. C:\Windows\System32\Tasks\{8CC7942C-F2B7-4222-B53E-46E448F310BC} => moved successfully. C:\Windows\SysWOW64\acovcnt.exe => moved successfully. C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7 => moved successfully. C:\Windows\system32\Drivers\etc\hp.bak => moved successfully. C:\Users\DOMZEN06\AppData\Roaming\288F1C80-1433758165-81E1-23A3-10BF4814D716 => moved successfully. C:\Windows\joy.dat => moved successfully. 012-07-21 21:54 - 2015-06-27 18:55 - 0000387 _____ () C:\Users\DOMZEN06\AppData\Roaming\sp_data.sys => Error: No automatic fix found for this entry. "C:\Users\DOMZEN06\AppData\Local sc126B.tmp" => File/Folder not found. "C:\Users\DOMZEN06\AppData\Local scBF4B.tmp" => File/Folder not found. "C:\Users\DOMZEN06\AppData\Local scCF13.tmp" => File/Folder not found. "C:\Users\DOMZEN06\AppData\Local siBFE4.tmp" => File/Folder not found. "C:\Users\DOMZEN06\AppData\Local sn533A.tmp" => File/Folder not found. "C:\Users\DOMZEN06\AppData\Local sp496A.tmp" => File/Folder not found. "C:\Users\DOMZEN06\AppData\Local sr8300.tmp" => File/Folder not found. "C:\Users\DOMZEN06\AppData\Local st8A28.tmp" => File/Folder not found. "C:\Users\DOMZEN06\AppData\Local sy5F8C.tmp" => File/Folder not found. "C:\Users\DOMZEN06\AppData\Local syD45.tmp" => File/Folder not found. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{132AD632-F2D5-4FB4-909A-4336B64DB55A}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{132AD632-F2D5-4FB4-909A-4336B64DB55A}" => key removed successfully C:\Windows\System32\Tasks\{8CC7942C-F2B7-4222-B53E-46E448F310BC} not found. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{8CC7942C-F2B7-4222-B53E-46E448F310BC}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{2F960467-696E-4862-9C99-A034311AF72D}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2F960467-696E-4862-9C99-A034311AF72D}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SpyHunter4Startup" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{68A61DE0-9708-45DC-A9AE-61CB27E94BCF}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{68A61DE0-9708-45DC-A9AE-61CB27E94BCF}" => key removed successfully C:\Windows\System32\Tasks\WebInternetSecurity Update Task => moved successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WebInternetSecurity Update Task" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{7D6F95F8-77E8-48E1-B2C9-099E924610F1}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7D6F95F8-77E8-48E1-B2C9-099E924610F1}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\iren3006" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CB1CEABD-887C-4929-9743-28147AD2D8AE}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CB1CEABD-887C-4929-9743-28147AD2D8AE}" => key removed successfully C:\Windows\System32\Tasks\Ioect not found. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Ioect" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F5574861-E994-4C87-956E-76CCABD0C6DC}" => key removed successfully "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F5574861-E994-4C87-956E-76CCABD0C6DC}" => key removed successfully C:\Windows\System32\Tasks\SmartWeb Upgrade Trigger Task not found. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SmartWeb Upgrade Trigger Task" => key removed successfully Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2015-06-27 22:58:59)<= C:\Windows\system32\Drivers\stream.sys => Is moved successfully End of Fixlog 22:58:59

Comment supprimer ADS by Cloudscout (besoin du script !)

3 réponses

End of Fixlog 22:58:59

Discussions similaires

Newsletters