Analyse rapport ADW - MABM - FRST

Salut,

Je regarde cela.

Voici la correction à effectuer avec FRST.
Tu peux t'inspirer de cette note explicative avec des captures d'écran pour t'aider: https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/#fix

Ouvre le bloc-notes : Touche Windows + R, dans le champs executer, tape notepad et OK.
Copie/colle dedans ce qui suit :

2015-07-28 17:04 - 2015-08-01 09:09 - 00000000 ____D C:\Program Files (x86)\Software
2015-07-28 17:04 - 2015-07-28 17:04 - 00000000 ____D C:\Users\Camille\AppData\Local\Software
2015-07-28 16:55 - 2015-08-01 09:40 - 00000000 ____D C:\Program Files (x86)\52b602d6-0702-47f3-a1eb-7698a14547aa
2015-07-28 16:55 - 2009-06-10 23:00 - 00000824 _____ C:\Windows\system32\Drivers\etc\hp.bak
2015-07-28 16:54 - 2015-08-01 09:41 - 00001412 _____ C:\Windows\Tasks\cinemaplus-9.0v_notification_service.job
2015-07-28 16:54 - 2015-08-01 09:41 - 00000536 _____ C:\Windows\Tasks\cinemaplus-9.0v_helper_service.job
2015-07-28 16:54 - 2015-08-01 09:13 - 00000004 _____ C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-07-28 16:54 - 2015-07-28 21:49 - 00004374 _____ C:\Windows\System32\Tasks\cinemaplus-9.0v_notification_service
2015-07-28 16:54 - 2015-07-28 21:49 - 00003500 _____ C:\Windows\System32\Tasks\cinemaplus-9.0v_helper_service
2015-08-01 09:18 - 2015-08-01 09:41 - 00000000 ____D C:\ProgramData\Browser
Task: C:\Windows\Tasks\cinemaplus-9.0v_helper_service.job => C:\Program Files (x86)\CinemaPlus-9.0v\cinemaplus-9.0v_helper_service.exe <==== ATTENTION
Task: C:\Windows\Tasks\cinemaplus-9.0v_notification_service.job => C:\Program Files (x86)\CinemaPlus-9.0v\cinemaplus-9.0v_notification_service.exe?/url='http:/notif.openobjstack.com/notf_sys/index.html' /crregname='CinemaPlus-9.0v' /appid='73143' /srcid='3067' /bic='8b41bdc1d3bad6dfc78ebd30a30fcc16' /verifier='27bcf2a14701cd448a5f867047f3d9f0' /installerversion='1.50.5.17' /statsdomain='http:/stats.openobjstack.com/data.gif?' /errorsdomain='http:/stats.openobjstack.com/data.gif?' /monetizationdomain='http:/logs.openobjstack.com/marker.gif <==== ATTENTION
Task: {0DA84F81-FBA1-46F1-B364-0C205CCCA518} - System32\Tasks\Olufkneog => C:\ProgramData\Olufkneog\1.0.4.1\iuarvaus.exe
Task: {3B85AD41-D5A7-45BA-BBEE-FD4955CBBEA0} - System32\Tasks\cinemaplus-9.0v_helper_service => C:\Program Files (x86)\CinemaPlus-9.0v\cinemaplus-9.0v_helper_service.exe <==== ATTENTION
Task: {69252B89-5E69-4957-BC83-624FEFA0E1A1} - System32\Tasks\{CB6FDB84-67F3-4E7E-905F-BD52414C9D67} => pcalua.exe -a C:\Users\Camille\AppData\Roaming\mystartsearch\UninstallManager.exe -c -ptid=cmi
FF Extension: No Name - C:\Users\Camille\AppData\Roaming\Mozilla\Firefox\Profiles\rrsdub70.default\extensions\williamslake@yahoo.com [not found]
FF Extension: No Name - C:\Users\Camille\AppData\Roaming\Mozilla\Firefox\Profiles\rrsdub70.default\extensions\defsearchp@gmail.com [not found]
FF Extension: No Name - C:\Users\Camille\AppData\Roaming\Mozilla\Firefox\Profiles\rrsdub70.default\extensions\deskCutv2@gmail.com [not found]
2015-07-28 17:43 - 2015-08-01 09:40 - 00000000 ____D C:\ProgramData\OWinManProO
2015-07-28 17:43 - 2015-07-28 17:43 - 00000000 _____ C:\Windows\prleth.sys
2015-07-28 17:43 - 2015-07-28 17:43 - 00000000 _____ C:\Windows\hgfs.sys

Relance FRST et clic sur le bouton Fix
Selon comment un redémarrage est nécessaire (pas obligatoire).
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

Redémarre l'ordinateur

puis réinitialise tes navigateurs:
==================================
Réinitialise tes navigateurs et ou manuellement reparamètre tes navigateurs WEB (page de démarrage, moteur de recherche etc) mais aussi supprimer/désactiver les extensions inutiles/parasites :

• Internet Explorer et modules complémentaires / moteurs de recherche : https://forum.malekal.com/viewtopic.php?t=41399&start=
• Firefox : https://www.malekal.com/reparer-firefox/?t=36057&start=
• Google Chrome : https://www.malekal.com/reparer-google-chrome/?t=35837&start=

Si les pubs continuent, précise le navigateur WEB.

J'ai lancé un scan complet avec MSE.
Dois-je l'interrompre pour faire le nettoyage avec FRST ou est-il préférable de finir l'analyse puis de lancer FRST ensuite ?

Merci

Ci-après le fichier Fixlog.txt

Fix result of Farbar Recovery Scan Tool (x64) Version:30-07-2015
Ran by Camille (2015-08-01 13:20:48) Run:1
Running from C:\Users\Camille\Desktop
Loaded Profiles: Camille (Available Profiles: Camille)
Boot Mode: Normal
==============================================

fixlist content:
2015-07-28 17:04 - 2015-08-01 09:09 - 00000000 ____D C:\Program Files (x86)\Software
2015-07-28 17:04 - 2015-07-28 17:04 - 00000000 ____D C:\Users\Camille\AppData\Local\Software
2015-07-28 16:55 - 2015-08-01 09:40 - 00000000 ____D C:\Program Files (x86)\52b602d6-0702-47f3-a1eb-7698a14547aa
2015-07-28 16:55 - 2009-06-10 23:00 - 00000824 _____ C:\Windows\system32\Drivers\etc\hp.bak
2015-07-28 16:54 - 2015-08-01 09:41 - 00001412 _____ C:\Windows\Tasks\cinemaplus-9.0v_notification_service.job
2015-07-28 16:54 - 2015-08-01 09:41 - 00000536 _____ C:\Windows\Tasks\cinemaplus-9.0v_helper_service.job
2015-07-28 16:54 - 2015-08-01 09:13 - 00000004 _____ C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-07-28 16:54 - 2015-07-28 21:49 - 00004374 _____ C:\Windows\System32\Tasks\cinemaplus-9.0v_notification_service
2015-07-28 16:54 - 2015-07-28 21:49 - 00003500 _____ C:\Windows\System32\Tasks\cinemaplus-9.0v_helper_service
2015-08-01 09:18 - 2015-08-01 09:41 - 00000000 ____D C:\ProgramData\Browser
Task: C:\Windows\Tasks\cinemaplus-9.0v_helper_service.job => C:\Program Files (x86)\CinemaPlus-9.0v\cinemaplus-9.0v_helper_service.exe <==== ATTENTION
Task: C:\Windows\Tasks\cinemaplus-9.0v_notification_service.job => C:\Program Files (x86)\CinemaPlus-9.0v\cinemaplus-9.0v_notification_service.exe?/url='http:/notif.openobjstack.com/notf_sys/index.html' /crregname='CinemaPlus-9.0v' /appid='73143' /srcid='3067' /bic='8b41bdc1d3bad6dfc78ebd30a30fcc16' /verifier='27bcf2a14701cd448a5f867047f3d9f0' /installerversion='1.50.5.17' /statsdomain='http:/stats.openobjstack.com/data.gif?' /errorsdomain='http:/stats.openobjstack.com/data.gif?' /monetizationdomain='http:/logs.openobjstack.com/marker.gif <==== ATTENTION
Task: {0DA84F81-FBA1-46F1-B364-0C205CCCA518} - System32\Tasks\Olufkneog => C:\ProgramData\Olufkneog\1.0.4.1\iuarvaus.exe
Task: {3B85AD41-D5A7-45BA-BBEE-FD4955CBBEA0} - System32\Tasks\cinemaplus-9.0v_helper_service => C:\Program Files (x86)\CinemaPlus-9.0v\cinemaplus-9.0v_helper_service.exe <==== ATTENTION
Task: {69252B89-5E69-4957-BC83-624FEFA0E1A1} - System32\Tasks\{CB6FDB84-67F3-4E7E-905F-BD52414C9D67} => pcalua.exe -a C:\Users\Camille\AppData\Roaming\mystartsearch\UninstallManager.exe -c -ptid=cmi
FF Extension: No Name - C:\Users\Camille\AppData\Roaming\Mozilla\Firefox\Profiles\rrsdub70.default\extensions\williamslake@yahoo.com [not found]
FF Extension: No Name - C:\Users\Camille\AppData\Roaming\Mozilla\Firefox\Profiles\rrsdub70.default\extensions\defsearchp@gmail.com [not found]
FF Extension: No Name - C:\Users\Camille\AppData\Roaming\Mozilla\Firefox\Profiles\rrsdub70.default\extensions\deskCutv2@gmail.com [not found]
2015-07-28 17:43 - 2015-08-01 09:40 - 00000000 ____D C:\ProgramData\OWinManProO
2015-07-28 17:43 - 2015-07-28 17:43 - 00000000 _____ C:\Windows\prleth.sys
2015-07-28 17:43 - 2015-07-28 17:43 - 00000000 _____ C:\Windows\hgfs.sys

C:\Program Files (x86)\Software => moved successfully.
C:\Users\Camille\AppData\Local\Software => moved successfully.
C:\Program Files (x86)\52b602d6-0702-47f3-a1eb-7698a14547aa => moved successfully.
C:\Windows\system32\Drivers\etc\hp.bak => moved successfully.
C:\Windows\Tasks\cinemaplus-9.0v_notification_service.job => moved successfully.
C:\Windows\Tasks\cinemaplus-9.0v_helper_service.job => moved successfully.
C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7 => moved successfully.
C:\Windows\System32\Tasks\cinemaplus-9.0v_notification_service => moved successfully.
C:\Windows\System32\Tasks\cinemaplus-9.0v_helper_service => moved successfully.
C:\ProgramData\Browser => moved successfully.
C:\Windows\Tasks\cinemaplus-9.0v_helper_service.job not found.
C:\Windows\Tasks\cinemaplus-9.0v_notification_service.job not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{0DA84F81-FBA1-46F1-B364-0C205CCCA518}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0DA84F81-FBA1-46F1-B364-0C205CCCA518}" => key removed successfully
C:\Windows\System32\Tasks\Olufkneog => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Olufkneog" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3B85AD41-D5A7-45BA-BBEE-FD4955CBBEA0}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3B85AD41-D5A7-45BA-BBEE-FD4955CBBEA0}" => key removed successfully
C:\Windows\System32\Tasks\cinemaplus-9.0v_helper_service not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\cinemaplus-9.0v_helper_service" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{69252B89-5E69-4957-BC83-624FEFA0E1A1}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{69252B89-5E69-4957-BC83-624FEFA0E1A1}" => key removed successfully
C:\Windows\System32\Tasks\{CB6FDB84-67F3-4E7E-905F-BD52414C9D67} => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{CB6FDB84-67F3-4E7E-905F-BD52414C9D67}" => key removed successfully
C:\Users\Camille\AppData\Roaming\Mozilla\Firefox\Profiles\rrsdub70.default\extensions\williamslake@yahoo.com not found.
C:\Users\Camille\AppData\Roaming\Mozilla\Firefox\Profiles\rrsdub70.default\extensions\defsearchp@gmail.com not found.
C:\Users\Camille\AppData\Roaming\Mozilla\Firefox\Profiles\rrsdub70.default\extensions\deskCutv2@gmail.com not found.
C:\ProgramData\OWinManProO => moved successfully.
C:\Windows\prleth.sys => moved successfully.
C:\Windows\hgfs.sys => moved successfully.

End of Fixlog 13:20:49

ok fais la suite et vois ce qu'il reste comme problème.
Si les pubs persistent, précise sur quel navigateur WEB.

OK navigateurs (Chrome et Firefox) réinitialisés.
Plus de pub ni de lancement de logiciels douteux.
C'est parfait, comme d'habitude.

Une dernière question.
Sur ce PC (déjà infesté par le passé), je ne peux pas installer le SP1 de W7. Cela peut-il être le résultat d'une infection ?

Merci encore pour ton aide