J'ai un gros problème de spyware : dns pub, etc...

Résolu
tejipe -  
Malekal_morte- Messages postés 184348 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   -
Bonjour,
Pourriez vous m'aider à nettoyer mon pc? J'ai beau passer adw cleaner, j'ai des pages de pubs qui reviennent au bout d'une dizaine de minutes.

Je vous envoie le rapport de adwcleaner. Merci

# AdwCleaner v4.208 - Rapport créé le 06/08/2015 à 16:54:46
# Mis à jour le 09/07/2015 par Xplode
# Base de données : 2015-08-01.1 [Serveur]
# Système d'exploitation : Windows 8.1 (x64)
# Nom d'utilisateur : jeanphilippe - BUREAU
# Exécuté depuis : C:\Users\jeanphilippe\Downloads\AdwCleaner-4.208(1).exe
# Option : Nettoyer
          • [ Services ] *****


[#] Service Supprimé : IHProtect Service
[#] Service Supprimé : WindowsMangerProtect
          • [ Fichiers / Dossiers ] *****


Dossier Supprimé : C:\IQIYI Video
Dossier Supprimé : C:\ProgramData\IHProtectUpDate
Dossier Supprimé : C:\ProgramData\IQIYI Video
Dossier Supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GAMESDESKTOP
Dossier Supprimé : C:\Program Files (x86)\AnyProtectEx
Dossier Supprimé : C:\Program Files (x86)\miuitab
Dossier Supprimé : C:\Program Files (x86)\FriendlyError
Dossier Supprimé : C:\Program Files (x86)\gmsd_fr_005010053
Dossier Supprimé : C:\Users\jeanphilippe\AppData\Local\SmartWeb
Dossier Supprimé : C:\Users\jeanphilippe\AppData\Local\BreakingNewsAlert
Dossier Supprimé : C:\Users\jeanphilippe\AppData\Local\SysassistByHotWheel
Dossier Supprimé : C:\Users\jeanphilippe\AppData\Local\gmsd_fr_005010053
Dossier Supprimé : C:\Users\jeanphilippe\AppData\LocalLow\SmartWeb
Dossier Supprimé : C:\Users\jeanphilippe\AppData\Roaming\AnyProtectEx
Dossier Supprimé : C:\Users\jeanphilippe\AppData\Roaming\mystartsearch
Dossier Supprimé : C:\Users\jeanphilippe\AppData\Roaming\IQIYI Video
Dossier Supprimé : C:\Users\jeanphilippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup
Dossier Supprimé : C:\Users\jeanphilippe\AppData\Roaming\Mozilla\Firefox\Profiles\01a6jf7u.default-1419373580774\Extensions\***@***
Dossier Supprimé : C:\Users\jeanphilippe\AppData\Roaming\Mozilla\Firefox\Profiles\01a6jf7u.default-1419373580774\Extensions\***@***
Fichier Supprimé : C:\Users\jeanphilippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartWeb.lnk
Fichier Supprimé : C:\Users\jeanphilippe\Desktop\AnyProtect.lnk
Fichier Supprimé : C:\Users\jeanphilippe\AppData\Roaming\Mozilla\Firefox\Profiles\01a6jf7u.default-1419373580774\searchplugins\mystartsearch.xml
          • [ Tâches planifiées ] *****


Tâche Supprimée : APSnotifierPP1
Tâche Supprimée : APSnotifierPP2
          • [ Raccourcis ] *****


Raccourci Désinfecté : C:\Users\Public\Desktop\Google Chrome.lnk
Raccourci Désinfecté : C:\Users\Public\Desktop\Mozilla Firefox.lnk
Raccourci Désinfecté : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Raccourci Désinfecté : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
Raccourci Désinfecté : C:\Users\jeanphilippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Raccourci Désinfecté : C:\Users\jeanphilippe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
Raccourci Désinfecté : C:\Users\jeanphilippe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Raccourci Désinfecté : C:\Users\jeanphilippe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
Raccourci Désinfecté : C:\Users\jeanphilippe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
Raccourci Désinfecté : C:\Users\jeanphilippe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox (2).lnk
Raccourci Désinfecté : C:\Users\jeanphilippe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk
          • [ Registre ] *****


Valeur Supprimée : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [***@***]
Valeur Supprimée : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [***@***]
Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Clé Supprimée : HKCU\Software\Mozilla\Extends
Valeur Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SmartWeb]
Clé Supprimée : HKCU\Software\MozillaPlugins\@iqiyi.com/npWebPlayer
Clé Supprimée : HKLM\SOFTWARE\MozillaPlugins\@iqiyi.com/npWebPlayer
Clé Supprimée : HKLM\SOFTWARE\MozillaPlugins\@iqiyi.com/npclient
Valeur Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [HCDNClient]
Clé Supprimée : HKLM\SOFTWARE\Classes\qygameclient
Clé Supprimée : HKLM\SOFTWARE\Classes\HCDNProxy
Valeur Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [gmsd_fr_005010053]
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{5EC7C511-CD0F-42E6-830C-1BD9882F3458}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{D96C1D26-5CDF-4506-9244-57233C3984DF}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{1F91A9A1-01BA-4C81-863D-3BA0751E1419}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{D96C1D26-5CDF-4506-9244-57233C3984DF}
Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{B6360BD3-5CD0-40D3-BD87-DAFF37889F50}
Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{E1D75F62-CBBD-45C7-9D1D-6B5ECEC2E006}
Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{7D3C47ED-E0BE-4940-9DDA-A7A097AEBD88}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1F91A9A1-01BA-4C81-863D-3BA0751E1419}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5EC7C511-CD0F-42E6-830C-1BD9882F3458}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5EC7C511-CD0F-42E6-830C-1BD9882F3458}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5EC7C511-CD0F-42E6-830C-1BD9882F3458}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6BE0FB-8B18-4DFC-959F-233651CC4D7F}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAC94FEE-45B4-4FD4-9EEA-D8978EC96C6E}
Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}
Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}
Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\CLSID\{5EC7C511-CD0F-42E6-830C-1BD9882F3458}
Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\CLSID\{5CD76C57-6893-478A-B776-47E7C82504BE}
Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Clé Supprimée : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}
Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}
Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}
Donnée Restaurée : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command
Donnée Restaurée : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command
Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Clé Supprimée : HKCU\Software\AnyProtect
Clé Supprimée : HKCU\Software\APN PIP
Clé Supprimée : HKCU\Software\AskPartnerNetwork
Clé Supprimée : HKCU\Software\HomeTab
Clé Supprimée : HKCU\Software\simplytech
Clé Supprimée : HKCU\Software\Tutorials
Clé Supprimée : HKCU\Software\TutoTag
Clé Supprimée : HKCU\Software\WajIEnhance
Clé Supprimée : HKCU\Software\TNT2
Clé Supprimée : HKCU\Software\WajIntEnhance
Clé Supprimée : HKCU\Software\SearchProtectWS
Clé Supprimée : HKCU\Software\Linkey
Clé Supprimée : HKCU\Software\Kromtech
Clé Supprimée : HKCU\Software\QyGameClient
Clé Supprimée : HKCU\Software\AppDataLow\Software\SmartWeb
Clé Supprimée : HKLM\SOFTWARE\AskPartnerNetwork
Clé Supprimée : HKLM\SOFTWARE\Conduit
Clé Supprimée : HKLM\SOFTWARE\Iminent
Clé Supprimée : HKLM\SOFTWARE\SearchProtect
Clé Supprimée : HKLM\SOFTWARE\SupDp
Clé Supprimée : HKLM\SOFTWARE\SupTab
Clé Supprimée : HKLM\SOFTWARE\supWindowsMangerProtect
Clé Supprimée : HKLM\SOFTWARE\Tutorials
Clé Supprimée : HKLM\SOFTWARE\mystartsearchSoftware
Clé Supprimée : HKLM\SOFTWARE\GAMESDESKTOP
Clé Supprimée : HKLM\SOFTWARE\IHProtect
Clé Supprimée : HKLM\SOFTWARE\WajIntEnhance
Clé Supprimée : HKLM\SOFTWARE\SpeedBit
Clé Supprimée : HKLM\SOFTWARE\AIM Toolbar
Clé Supprimée : HKLM\SOFTWARE\FFPluginHp
Clé Supprimée : HKLM\SOFTWARE\searchult
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AnyProtect
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SmartWeb
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IQIYI Video
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7ADF667E-E14D-4D2C-827C-B0108F0D93BC}
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FriendlyError
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_fr_005010053_is1
          • [ Navigateurs ] *****


-\\ Internet Explorer v11.0.9600.17840

Paramètre Restauré : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Paramètre Restauré : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
Paramètre Restauré : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Paramètre Restauré : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Paramètre Restauré : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Paramètre Restauré : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Paramètre Restauré : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Paramètre Restauré : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Paramètre Restauré : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Paramètre Restauré : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]

-\\ Mozilla Firefox v39.0 (x86 fr)

[01a6jf7u.default-1419373580774\prefs.js] - Ligne Supprimée : user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");
[01a6jf7u.default-1419373580774\prefs.js] - Ligne Supprimée : user_pref("browser.search.defaultenginename", "mystartsearch");
[01a6jf7u.default-1419373580774\prefs.js] - Ligne Supprimée : user_pref("browser.search.searchengine.alias", "mystartsearch");
[01a6jf7u.default-1419373580774\prefs.js] - Ligne Supprimée : user_pref("browser.search.searchengine.iconURL", "hxxp://www.mystartsearch.com/web/favicon.ico");
[01a6jf7u.default-1419373580774\prefs.js] - Ligne Supprimée : user_pref("browser.search.searchengine.name", "mystartsearch");
[01a6jf7u.default-1419373580774\prefs.js] - Ligne Supprimée : user_pref("browser.search.searchengine.url", "hxxp://www.mystartsearch.com/web/?type=dspp&ts=1438872547&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=cmi&uid=ST1000DM003-1CH162_S1DC4NESXXXXS1DC4NE[...]
[01a6jf7u.default-1419373580774\prefs.js] - Ligne Supprimée : user_pref("browser.search.selectedEngine", "mystartsearch");
[01a6jf7u.default-1419373580774\prefs.js] - Ligne Supprimée : user_pref("browser.startup.homepage", "hxxp://www.mystartsearch.com/?type=hppp&ts=1438872547&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=cmi&uid=ST1000DM003-1CH162_S1DC4NESXXXXS1DC4NES");
[01a6jf7u.default-1419373580774\prefs.js] - Ligne Supprimée : user_pref("extensions.quick_start.enable_search1", false);
[01a6jf7u.default-1419373580774\prefs.js] - Ligne Supprimée : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);

-\\ Google Chrome v39.0.2171.71

[C:\Users\jeanphilippe\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Supprimée [Search Provider] : hxxp://www.mystartsearch.com/web/?type=dspp&ts=1438872547&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=cmi&uid=ST1000DM003-1CH162_S1DC4NESXXXXS1DC4NES&q={searchTerms}
[C:\Users\jeanphilippe\AppData\Local\Google\Chrome\User Data\Default\Preferences] - Supprimée [Homepage] : hxxp://www.mystartsearch.com/?type=hppp&ts=1438872547&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=cmi&uid=ST1000DM003-1CH162_S1DC4NESXXXXS1DC4NES
[C:\Users\jeanphilippe\AppData\Local\Google\Chrome\User Data\Default\Preferences] - Supprimée [Startup_URLs] : hxxp://www.mystartsearch.com/?type=hppp&ts=1438872547&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=cmi&uid=ST1000DM003-1CH162_S1DC4NESXXXXS1DC4NES

-\\ Chromium v


AdwCleaner[R0].txt - [53266 octets] - [15/10/2013 20:53:03]
AdwCleaner[R1].txt - [45669 octets] - [15/10/2013 21:04:42]
AdwCleaner[R2].txt - [13750 octets] - [15/10/2013 21:16:53]
AdwCleaner[R3].txt - [6318 octets] - [24/12/2014 00:31:34]
AdwCleaner[R4].txt - [24843 octets] - [06/08/2015 15:20:23]
AdwCleaner[R5].txt - [1527 octets] - [06/08/2015 15:26:56]
AdwCleaner[R6].txt - [13106 octets] - [06/08/2015 16:05:31]
AdwCleaner[R7].txt - [1769 octets] - [06/08/2015 16:14:55]
AdwCleaner[R8].txt - [1889 octets] - [06/08/2015 16:22:00]
AdwCleaner[R9].txt - [19385 octets] - [06/08/2015 16:53:51]
AdwCleaner[S0].txt - [47220 octets] - [15/10/2013 21:05:08]
AdwCleaner[S1].txt - [14460 octets] - [05/10/2014 21:38:44]
AdwCleaner[S2].txt - [16066 octets] - [23/12/2014 23:58:31]
AdwCleaner[S3].txt - [5176 octets] - [24/12/2014 00:32:36]
AdwCleaner[S4].txt - [20991 octets] - [06/08/2015 15:21:15]
AdwCleaner[S5].txt - [1591 octets] - [06/08/2015 15:27:39]
AdwCleaner[S6].txt - [10375 octets] - [06/08/2015 16:06:10]
AdwCleaner[S7].txt - [1833 octets] - [06/08/2015 16:15:40]
AdwCleaner[S8].txt - [16282 octets] - [06/08/2015 16:54:46]

########## EOF - C:\AdwCleaner\AdwCleaner[S8].txt - [16343 octets] ###

A voir également:

10 réponses

Réponse 1 / 10
Malekal_morte- Messages postés 184348 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 691
 
Salut,


Suis le tutoriel FRST.
(et bien prendre le temps de lire afin d'appliquer correctement - tout y est expliqué).
Télécharge et lance le scan FRST, cela va générer trois rapports FRST :
  • FRST.txt
  • Shortcut.txt
  • Additionnal.txt


Envoie, comme expliqué, ces trois rapports sur le site http://pjjoint.malekal.com et en retour donne les trois liens pjjoint qui mènent à ses rapports ici dans une nouvelle réponse afin que l'on puisse les consulter.

0
Réponse 2 / 10
tejipe
 
Merci de prendre mon probleme en charge

Voici les trois fichiers

http://pjjoint.malekal.com/files.php?id=20150806_u9b7v9d11j14
http://pjjoint.malekal.com/files.php?id=20150806_h11q10m7h9z11
http://pjjoint.malekal.com/files.php?id=20150806_u10n14b5l7e12
0
Réponse 3 / 10
Malekal_morte- Messages postés 184348 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 691
 
y a du bout,


Voici la correction à effectuer avec FRST.
Tu peux t'inspirer de cette note explicative avec des captures d'écran pour t'aider: https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/#fix

Ouvre le bloc-notes : Touche Windows + R, dans le champs executer, tape notepad et OK.
Copie/colle dedans ce qui suit :

HKLM-x32\...\Run: [gmsd_fr_005010052] => [X]
HKLM-x32\...\Run: [gmsd_fr_005010053] => C:\Program Files (x86)\gmsd_fr_005010053\gmsd_fr_005010053.exe
HKLM-x32\...\RunOnce: [upgmsd_fr_005010053.exe] => C:\Users\jeanphilippe\AppData\Local\gmsd_fr_005010053\upgmsd_fr_005010053.exe [3352720 2015-08-06] ()
HKU\S-1-5-21-2363316308-1714619483-545244223-1001\...\Run: [Moolineo.exe] => C:\Users\jeanphilippe\AppData\Roaming\JsMediaProd\MoolineoMail\Moolineo.exe [1339392 2015-03-05] ()
HKU\S-1-5-21-2363316308-1714619483-545244223-1001\...\Run: [GoogleChromeAutoLaunch_E6767101B8189532DE4ECA1F9AE60061] => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe [770048 2015-05-11] (Crossbrowse)
R2 IHProtect Service; C:\Program Files (x86)\MiuiTab\ProtectService.exe [125112 2015-07-30] (XTab system)
R2 Service Mgr OnStage; C:\ProgramData\2988696b-294c-4054-b34f-e97ca58a10e8\plugincontainer.exe [1140448 2015-08-06] ()
R2 vrKXJhPG; C:\ProgramData\GusMvG\vrKXJhPG.exe [2732000 2015-08-06] (Useful Technology)
S2 comyninu; C:\Program Files (x86)\8807057C-1438854212-1320-0606-090407000000\hnst8F5A.tmp [X]
S2 hyverumu; C:\Program Files (x86)\8807057C-1438854212-1320-0606-090407000000\jnse7633.tmp [X]
S1 wsfd_vw_1_10_0_20; system32\drivers\wsfd_vw_1_10_0_20.sys [X]
2015-08-06 21:01 - 2015-08-06 21:01 - 00000000 ____D C:\ProgramData\Browser
2015-08-06 17:33 - 2015-08-06 21:14 - 00000376 _____ C:\WINDOWS\Tasks\APSnotifierPP3.job
2015-08-06 17:33 - 2015-08-06 21:14 - 00000376 _____ C:\WINDOWS\Tasks\APSnotifierPP2.job
2015-08-06 17:33 - 2015-08-06 19:19 - 00000378 _____ C:\WINDOWS\Tasks\APSnotifierPP1.job
2015-08-06 17:33 - 2015-08-06 17:33 - 00002822 _____ C:\WINDOWS\System32\Tasks\APSnotifierPP1
2015-08-06 17:33 - 2015-08-06 17:33 - 00002820 _____ C:\WINDOWS\System32\Tasks\APSnotifierPP3
2015-08-06 17:33 - 2015-08-06 17:33 - 00002820 _____ C:\WINDOWS\System32\Tasks\APSnotifierPP2
2015-08-06 17:33 - 2015-08-06 17:33 - 00000000 ____D C:\Users\jeanphilippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup
2015-08-06 17:32 - 2015-08-06 17:32 - 00000000 ____D C:\Users\jeanphilippe\SupTab
2015-08-06 17:31 - 2015-08-06 21:12 - 00000000 ____D C:\Program Files (x86)\AnyProtectEx
2015-08-06 17:31 - 2015-08-06 17:31 - 00613255 _____ (CMI Limited) C:\Users\jeanphilippe\AppData\Local\nso9FE5.tmp
2015-08-06 17:31 - 2015-08-06 17:31 - 00000000 __SHD C:\Users\jeanphilippe\AppData\Roaming\AnyProtectEx
2015-08-06 17:27 - 2015-08-06 21:19 - 00000000 ____D C:\Users\jeanphilippe\AppData\Local\gmsd_fr_005010053
2015-08-06 17:27 - 2015-08-06 21:15 - 00001084 _____ C:\WINDOWS\Tasks\Crossbrowse.job
2015-08-06 17:27 - 2015-08-06 21:12 - 00000000 ____D C:\Program Files (x86)\gmsd_fr_005010053
2015-08-06 17:27 - 2015-08-06 19:57 - 00000000 ____D C:\Program Files (x86)\MiuiTab
2015-08-06 17:27 - 2015-08-06 19:32 - 00000000 ____D C:\ProgramData\2988696b-294c-4054-b34f-e97ca58a10e8
2015-08-06 17:27 - 2015-08-06 17:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crossbrowse
2015-08-06 17:27 - 2015-08-06 17:28 - 00000000 ____D C:\ProgramData\ZWinManProZ
2015-08-06 17:27 - 2015-08-06 17:27 - 00004094 _____ C:\WINDOWS\System32\Tasks\Crossbrowse
2015-08-06 17:27 - 2015-08-06 17:27 - 00000000 ____D C:\Users\jeanphilippe\AppData\Roaming\istartsurf
2015-08-06 17:27 - 2015-08-06 17:27 - 00000000 ____D C:\Users\jeanphilippe\AppData\Local\Crossbrowse
2015-08-06 17:27 - 2015-08-06 17:27 - 00000000 ____D C:\ProgramData\IHProtectUpDate
2015-08-06 17:27 - 2015-08-06 17:27 - 00000000 ____D C:\Program Files (x86)\On Stage
2015-08-06 17:27 - 2015-08-06 17:27 - 00000000 ____D C:\Program Files (x86)\FriendlyError
2015-08-06 17:27 - 2015-08-06 17:27 - 00000000 ____D C:\Program Files (x86)\Crossbrowse
2015-08-06 17:26 - 2015-08-06 21:13 - 00000000 ____D C:\Users\jeanphilippe\AppData\Local\SmartWeb
2015-08-06 17:03 - 2015-08-06 21:29 - 00000000 ____D C:\Users\jeanphilippe\AppData\Local\BreakingNewsAlert
2015-08-06 16:52 - 2015-08-06 16:52 - 00043709 _____ C:\Users\jeanphilippe\Desktop\Addition.txt
2015-08-06 16:52 - 2015-08-06 16:52 - 00000000 ____D C:\Users\Public\QiYi
2015-08-06 16:52 - 2015-08-06 16:52 - 00000000 ____D C:\Users\jeanphilippe\AppData\Local\Unity
2015-08-06 16:51 - 2015-08-06 16:51 - 00613255 _____ (CMI Limited) C:\Users\jeanphilippe\AppData\Local\nsyA978.tmp
2015-08-06 16:49 - 2015-08-06 16:50 - 00000000 ____D C:\ProgramData\SWinManProS
2015-08-06 16:48 - 2015-08-06 21:12 - 00000000 ____D C:\Program Files (x86)\baidu
2015-08-06 16:43 - 2015-08-06 16:44 - 00043709 _____ C:\Users\jeanphilippe\Downloads\Addition.txt
2015-08-06 16:21 - 2015-08-06 16:21 - 00000000 ____D C:\ProgramData\bdch
2015-08-06 15:03 - 2015-08-06 21:14 - 00012644 _____ C:\WINDOWS\PFRO.log
2015-08-06 15:03 - 2015-08-06 21:14 - 00000539 _____ C:\WINDOWS\setupact.log
2015-08-06 15:03 - 2015-08-06 15:03 - 00000000 _____ C:\WINDOWS\setuperr.log
2015-08-06 15:01 - 2015-08-06 15:01 - 00236080 _____ (Trend Micro Inc.) C:\WINDOWS\RegBootClean64.exe
2015-08-06 14:54 - 2015-08-06 14:54 - 00613255 _____ (CMI Limited) C:\Users\jeanphilippe\AppData\Local\nsyA044.tmp
2015-08-06 14:52 - 2015-08-06 19:55 - 00000000 ____D C:\Users\jeanphilippe\AppData\Local\27728
2015-08-06 14:52 - 2015-08-06 15:25 - 00000000 ____D C:\Users\jeanphilippe\AppData\Roaming\Opera Software
2015-08-06 14:52 - 2015-08-06 15:25 - 00000000 ____D C:\Users\jeanphilippe\AppData\Local\Opera Software
2015-08-06 14:45 - 2015-08-06 15:25 - 00000000 ____D C:\Program Files (x86)\Opera
2015-08-06 14:44 - 2015-08-06 20:44 - 00000364 _____ C:\WINDOWS\Tasks\CashMachine.job
2015-08-06 14:44 - 2015-08-06 14:44 - 00003264 _____ C:\WINDOWS\System32\Tasks\CashMachine
2015-08-06 14:44 - 2015-08-06 14:44 - 00000000 _____ C:\dummy.htm
2015-08-06 14:34 - 2015-08-06 14:34 - 02405672 _____ (Trend Micro Inc.) C:\Users\jeanphilippe\Downloads\HousecallLauncher64.exe
2015-08-06 14:22 - 2015-08-06 14:22 - 00000000 ____D C:\ProgramData\GusMvG
2015-08-06 14:21 - 2015-08-06 14:21 - 00022164 _____ C:\WINDOWS\System32\Tasks\DNSWABENO
2015-08-06 14:03 - 2015-08-06 14:03 - 00000875 _____ C:\WINDOWS\SysWOW64\${LOGFILE}
2015-08-06 13:47 - 2015-08-06 13:47 - 00613255 _____ (CMI Limited) C:\Users\jeanphilippe\AppData\Local\nsh5CCB.tmp
2015-08-06 13:38 - 2015-08-06 13:38 - 00000000 ____D C:\ProgramData\nWinManPron
2015-08-06 13:38 - 2015-08-06 13:38 - 00000000 _____ C:\WINDOWS\prleth.sys
2015-08-06 13:38 - 2015-08-06 13:38 - 00000000 _____ C:\WINDOWS\hgfs.sys
2015-08-06 12:15 - 2015-08-06 14:12 - 00000000 ____D C:\ProgramData\abc
2015-08-06 11:48 - 2015-08-06 11:48 - 00000000 ____D C:\ProgramData\Ashegneamuss
2015-08-06 11:43 - 2015-08-06 19:56 - 00000000 ____D C:\Program Files (x86)\8807057C-1438854212-1320-0606-090407000000
2015-08-06 13:47 - 2015-08-06 13:47 - 0613255 _____ (CMI Limited) C:\Users\jeanphilippe\AppData\Local\nsh5CCB.tmp
2015-08-06 17:31 - 2015-08-06 17:31 - 0613255 _____ (CMI Limited) C:\Users\jeanphilippe\AppData\Local\nso9FE5.tmp
2015-08-06 14:54 - 2015-08-06 14:54 - 0613255 _____ (CMI Limited) C:\Users\jeanphilippe\AppData\Local\nsyA044.tmp
2015-08-06 16:51 - 2015-08-06 16:51 - 0613255 _____ (CMI Limited) C:\Users\jeanphilippe\AppData\Local\nsyA978.tmp
Task: C:\WINDOWS\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\CashMachine.job => c:\programdata\{271eba2d-efce-057e-271e-eba2defce8b7}\nsvc59b.tmp.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Crossbrowse.job => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe <==== ATTENTION
Task: {093203A0-5962-465D-9F43-161DC963C6B9} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {30499B65-38BA-4DE3-BDC6-2C60F3699C76} - System32\Tasks\WIN-statsSystem => C:\Users\jeanphilippe\AppData\Local\Microsoft\WinU\~sjbsimx.exe
Task: {3CE5A9E4-F28B-40B2-8F80-3C5DAD6E0698} - System32\Tasks\WIN-GGfIfEGCfEGbGffIfCfEGC => C:\Users\jeanphilippe\AppData\Roaming\~uzafvyw.exe
Task: {55837973-8ABE-4031-A483-CF11B5ECCA8B} - \Plus-HD-2.3-chromeinstaller No Task File <==== ATTENTION
Task: {55B44731-3865-4CF7-95BF-44437CC7BC14} - System32\Tasks\DNSWABENO => dnswabeno.exe
Task: {5967A491-C9C9-4E88-87CC-57F80BEA4359} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {5FA70F2A-27D7-4F1B-8B8F-B93E96EAD3AC} - System32\Tasks\Qig8bWpIT9737Dk => C:\Users\jeanphilippe\AppData\Roaming\l7dQ7SE\N9477ZD.exe
Task: {63466080-0757-400E-ACB0-F7B087D20993} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-2363316308-1714619483-545244223-1001 => %localappdata%\Microsoft\OneDrive\OneDrive.exe
Task: {7F34993B-8DE5-4418-8F8E-89781803A1AA} - System32\Tasks\CashMachine => c:\programdata\{271eba2d-efce-057e-271e-eba2defce8b7}\nsvc59b.tmp.exe <==== ATTENTION
Task: {99E0893D-76C2-476B-9B13-2011734A37D3} - System32\Tasks\WIN-fdfEfEfAfC => C:\Users\jeanphilippe\AppData\Roaming\~tkscdxf.exe
Task: {9B884DE2-5839-4D72-BED6-8013542E53DE} - System32\Tasks\{D8B94517-B34B-47DE-AEE9-2D3CD4D95C04} => pcalua.exe -a C:\Users\jeanphilippe\AppData\Roaming\webssearches\UninstallManager.exe -c -ptid=ill <==== ATTENTION
Task: {ADA2A06F-F152-44E9-A6B7-991A6DCF0795} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {C046484B-31E3-4077-BCD4-5B77873BA5EC} - System32\Tasks\mMS7BILUrMHxGam => C:\Users\jeanphilippe\AppData\Roaming\IjpMWgY\9TmCYU3.exe
Task: {C716BB4F-87E9-4CB4-99A8-FA8383B630C8} - System32\Tasks\WIN-fIGbfFfEGCfFGEGbfCfE => C:\Users\jeanphilippe\AppData\Roaming\~wnbwbnh.exe
Task: {C9B5914C-194E-4B14-9CC2-9C33CD962356} - \Ashegneamuss No Task File <==== ATTENTION
Task: {CF64501F-6D53-4BF4-9BF2-AD0F1918CCBD} - System32\Tasks\Crossbrowse => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe <==== ATTENTION
Task: {D84D9822-4232-4B5C-AB38-3F072DA506C1} - System32\Tasks\aapWxo5p7lMVF7q => C:\Users\jeanphilippe\AppData\Roaming\DoXJerT\62LrGqw.exe
Task: {E1FFD5D6-E54B-4B50-9134-2BD67A681F7E} - System32\Tasks\{9B02C7A6-8302-4BF9-957E-003E97943927} => pcalua.exe -a C:\Users\jeanphilippe\AppData\Roaming\omiga-plus\UninstallManager.exe -c -ptid=ill <==== ATTENTION


Relance FRST et clic sur le bouton Fix
Selon comment un redémarrage est nécessaire (pas obligatoire).
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

Redémarre l'ordinateur


puis réinitialise tes navigateurs:
==================================
Réinitialise tes navigateurs et ou manuellement reparamètre tes navigateurs WEB (page de démarrage, moteur de recherche etc) mais aussi supprimer/désactiver les extensions inutiles/parasites :

~~

Désinstalle :
tous les programmes Ad-Aware et WebCompanion

~~

Remets/vérifie que tous les serveurs de noms (DNS) sont automatiques.
Suis le paragraphe "manuellement" : https://forum.malekal.com/viewtopic.php?t=48312&start=
PUIS ensuite vide le cache DNS et internet.
Les 3 étapes sont importantes et à faire sinon les pubs vont continuer.



Like the angel you are, you laugh creating a lightness in my chest,
Your eyes they penetrate me,
(Your answer's always 'maybe')
That's when I got up and left
0
tejipe
 
Ca y est, j'ai suivi toutes les procédures.

Je ne sais pas si tout est fini, mais j'ai encore des pages de pub qui s'ouvrent sur le côté quand je suis sur Internet. Apparemment ce sont des pages qui proviennent de "on stage"
0
Réponse 4 / 10
tejipe
 
Voici le rapport fixlist

Fix result of Farbar Recovery Scan Tool (x64) Version:06-08-2015
Ran by jeanphilippe (2015-08-07 08:51:15) Run:1
Running from C:\Users\jeanphilippe\Desktop
Loaded Profiles: jeanphilippe (Available Profiles: jeanphilippe)
Boot Mode: Normal
==============================================

fixlist content:

HKLM-x32\...\Run: [gmsd_fr_005010052] => [X]

HKLM-x32\...\Run: [gmsd_fr_005010053] => C:\Program Files (x86)\gmsd_fr_005010053\gmsd_fr_005010053.exe

HKLM-x32\...\RunOnce: [upgmsd_fr_005010053.exe] => C:\Users\jeanphilippe\AppData\Local\gmsd_fr_005010053\upgmsd_fr_005010053.exe [3352720 2015-08-06] ()

HKU\S-1-5-21-2363316308-1714619483-545244223-1001\...\Run: [Moolineo.exe] => C:\Users\jeanphilippe\AppData\Roaming\JsMediaProd\MoolineoMail\Moolineo.exe [1339392 2015-03-05] ()

HKU\S-1-5-21-2363316308-1714619483-545244223-1001\...\Run: [GoogleChromeAutoLaunch_E6767101B8189532DE4ECA1F9AE60061] => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe [770048 2015-05-11] (Crossbrowse)

R2 IHProtect Service; C:\Program Files (x86)\MiuiTab\ProtectService.exe [125112 2015-07-30] (XTab system)

R2 Service Mgr OnStage; C:\ProgramData\2988696b-294c-4054-b34f-e97ca58a10e8\plugincontainer.exe [1140448 2015-08-06] ()

R2 vrKXJhPG; C:\ProgramData\GusMvG\vrKXJhPG.exe [2732000 2015-08-06] (Useful Technology)

S2 comyninu; C:\Program Files (x86)\8807057C-1438854212-1320-0606-090407000000\hnst8F5A.tmp [X]

S2 hyverumu; C:\Program Files (x86)\8807057C-1438854212-1320-0606-090407000000\jnse7633.tmp [X]

S1 wsfd_vw_1_10_0_20; system32\drivers\wsfd_vw_1_10_0_20.sys [X]

2015-08-06 21:01 - 2015-08-06 21:01 - 00000000 ____D C:\ProgramData\Browser

2015-08-06 19:23 - 2015-08-06 19:25 - 00000000 ____D C:\Users\jeanphilippe\AppData\Roaming\Lavasoft

2015-08-06 19:23 - 2015-08-06 19:23 - 00000000 ____D C:\Users\jeanphilippe\AppData\Local\Lavasoft

2015-08-06 19:22 - 2015-08-06 21:15 - 00002357 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk

2015-08-06 19:22 - 2015-08-06 19:22 - 00000000 ____D C:\Program Files\Lavasoft

2015-08-06 19:21 - 2015-08-06 19:21 - 00000000 ____D C:\Program Files\Common Files\Lavasoft

2015-08-06 17:49 - 2015-08-06 19:22 - 00000000 ____D C:\ProgramData\Lavasoft

2015-08-06 17:33 - 2015-08-06 21:14 - 00000376 _____ C:\WINDOWS\Tasks\APSnotifierPP3.job

2015-08-06 17:33 - 2015-08-06 21:14 - 00000376 _____ C:\WINDOWS\Tasks\APSnotifierPP2.job

2015-08-06 17:33 - 2015-08-06 19:19 - 00000378 _____ C:\WINDOWS\Tasks\APSnotifierPP1.job

2015-08-06 17:33 - 2015-08-06 17:33 - 00002822 _____ C:\WINDOWS\System32\Tasks\APSnotifierPP1

2015-08-06 17:33 - 2015-08-06 17:33 - 00002820 _____ C:\WINDOWS\System32\Tasks\APSnotifierPP3

2015-08-06 17:33 - 2015-08-06 17:33 - 00002820 _____ C:\WINDOWS\System32\Tasks\APSnotifierPP2

2015-08-06 17:33 - 2015-08-06 17:33 - 00000000 ____D C:\Users\jeanphilippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup

2015-08-06 17:32 - 2015-08-06 17:32 - 00000000 ____D C:\Users\jeanphilippe\SupTab

2015-08-06 17:31 - 2015-08-06 21:12 - 00000000 ____D C:\Program Files (x86)\AnyProtectEx

2015-08-06 17:31 - 2015-08-06 17:31 - 00613255 _____ (CMI Limited) C:\Users\jeanphilippe\AppData\Local\nso9FE5.tmp

2015-08-06 17:31 - 2015-08-06 17:31 - 00000000 __SHD C:\Users\jeanphilippe\AppData\Roaming\AnyProtectEx

2015-08-06 17:27 - 2015-08-06 21:19 - 00000000 ____D C:\Users\jeanphilippe\AppData\Local\gmsd_fr_005010053

2015-08-06 17:27 - 2015-08-06 21:15 - 00001084 _____ C:\WINDOWS\Tasks\Crossbrowse.job

2015-08-06 17:27 - 2015-08-06 21:12 - 00000000 ____D C:\Program Files (x86)\gmsd_fr_005010053

2015-08-06 17:27 - 2015-08-06 19:57 - 00000000 ____D C:\Program Files (x86)\MiuiTab

2015-08-06 17:27 - 2015-08-06 19:32 - 00000000 ____D C:\ProgramData\2988696b-294c-4054-b34f-e97ca58a10e8

2015-08-06 17:27 - 2015-08-06 17:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crossbrowse

2015-08-06 17:27 - 2015-08-06 17:28 - 00000000 ____D C:\ProgramData\ZWinManProZ

2015-08-06 17:27 - 2015-08-06 17:27 - 00004094 _____ C:\WINDOWS\System32\Tasks\Crossbrowse

2015-08-06 17:27 - 2015-08-06 17:27 - 00000000 ____D C:\Users\jeanphilippe\AppData\Roaming\istartsurf

2015-08-06 17:27 - 2015-08-06 17:27 - 00000000 ____D C:\Users\jeanphilippe\AppData\Local\Crossbrowse

2015-08-06 17:27 - 2015-08-06 17:27 - 00000000 ____D C:\ProgramData\IHProtectUpDate

2015-08-06 17:27 - 2015-08-06 17:27 - 00000000 ____D C:\Program Files (x86)\On Stage

2015-08-06 17:27 - 2015-08-06 17:27 - 00000000 ____D C:\Program Files (x86)\FriendlyError

2015-08-06 17:27 - 2015-08-06 17:27 - 00000000 ____D C:\Program Files (x86)\Crossbrowse

2015-08-06 17:26 - 2015-08-06 21:13 - 00000000 ____D C:\Users\jeanphilippe\AppData\Local\SmartWeb

2015-08-06 17:03 - 2015-08-06 21:29 - 00000000 ____D C:\Users\jeanphilippe\AppData\Local\BreakingNewsAlert

2015-08-06 16:52 - 2015-08-06 16:52 - 00043709 _____ C:\Users\jeanphilippe\Desktop\Addition.txt

2015-08-06 16:52 - 2015-08-06 16:52 - 00000000 ____D C:\Users\Public\QiYi

2015-08-06 16:52 - 2015-08-06 16:52 - 00000000 ____D C:\Users\jeanphilippe\AppData\Local\Unity

2015-08-06 16:51 - 2015-08-06 16:51 - 00613255 _____ (CMI Limited) C:\Users\jeanphilippe\AppData\Local\nsyA978.tmp

2015-08-06 16:49 - 2015-08-06 16:50 - 00000000 ____D C:\ProgramData\SWinManProS

2015-08-06 16:48 - 2015-08-06 21:12 - 00000000 ____D C:\Program Files (x86)\baidu

2015-08-06 16:43 - 2015-08-06 16:44 - 00043709 _____ C:\Users\jeanphilippe\Downloads\Addition.txt

2015-08-06 16:21 - 2015-08-06 16:21 - 00000000 ____D C:\ProgramData\bdch

2015-08-06 15:03 - 2015-08-06 21:14 - 00012644 _____ C:\WINDOWS\PFRO.log

2015-08-06 15:03 - 2015-08-06 21:14 - 00000539 _____ C:\WINDOWS\setupact.log

2015-08-06 15:03 - 2015-08-06 15:03 - 00000000 _____ C:\WINDOWS\setuperr.log

2015-08-06 15:01 - 2015-08-06 15:01 - 00236080 _____ (Trend Micro Inc.) C:\WINDOWS\RegBootClean64.exe

2015-08-06 14:54 - 2015-08-06 14:54 - 00613255 _____ (CMI Limited) C:\Users\jeanphilippe\AppData\Local\nsyA044.tmp

2015-08-06 14:52 - 2015-08-06 19:55 - 00000000 ____D C:\Users\jeanphilippe\AppData\Local\27728

2015-08-06 14:52 - 2015-08-06 15:25 - 00000000 ____D C:\Users\jeanphilippe\AppData\Roaming\Opera Software

2015-08-06 14:52 - 2015-08-06 15:25 - 00000000 ____D C:\Users\jeanphilippe\AppData\Local\Opera Software

2015-08-06 14:45 - 2015-08-06 15:25 - 00000000 ____D C:\Program Files (x86)\Opera

2015-08-06 14:44 - 2015-08-06 20:44 - 00000364 _____ C:\WINDOWS\Tasks\CashMachine.job

2015-08-06 14:44 - 2015-08-06 14:44 - 00003264 _____ C:\WINDOWS\System32\Tasks\CashMachine

2015-08-06 14:44 - 2015-08-06 14:44 - 00000000 _____ C:\dummy.htm

2015-08-06 14:34 - 2015-08-06 14:34 - 02405672 _____ (Trend Micro Inc.) C:\Users\jeanphilippe\Downloads\HousecallLauncher64.exe

2015-08-06 14:22 - 2015-08-06 14:22 - 00000000 ____D C:\ProgramData\GusMvG

2015-08-06 14:21 - 2015-08-06 14:21 - 00022164 _____ C:\WINDOWS\System32\Tasks\DNSWABENO

2015-08-06 14:03 - 2015-08-06 14:03 - 00000875 _____ C:\WINDOWS\SysWOW64\${LOGFILE}

2015-08-06 13:47 - 2015-08-06 13:47 - 00613255 _____ (CMI Limited) C:\Users\jeanphilippe\AppData\Local\nsh5CCB.tmp

2015-08-06 13:38 - 2015-08-06 13:38 - 00000000 ____D C:\ProgramData\nWinManPron

2015-08-06 13:38 - 2015-08-06 13:38 - 00000000 _____ C:\WINDOWS\prleth.sys

2015-08-06 13:38 - 2015-08-06 13:38 - 00000000 _____ C:\WINDOWS\hgfs.sys

2015-08-06 12:15 - 2015-08-06 14:12 - 00000000 ____D C:\ProgramData\abc

2015-08-06 11:48 - 2015-08-06 11:48 - 00000000 ____D C:\ProgramData\Ashegneamuss

2015-08-06 11:43 - 2015-08-06 19:56 - 00000000 ____D C:\Program Files (x86)\8807057C-1438854212-1320-0606-090407000000

2015-08-06 13:47 - 2015-08-06 13:47 - 0613255 _____ (CMI Limited) C:\Users\jeanphilippe\AppData\Local\nsh5CCB.tmp

2015-08-06 17:31 - 2015-08-06 17:31 - 0613255 _____ (CMI Limited) C:\Users\jeanphilippe\AppData\Local\nso9FE5.tmp

2015-08-06 14:54 - 2015-08-06 14:54 - 0613255 _____ (CMI Limited) C:\Users\jeanphilippe\AppData\Local\nsyA044.tmp

2015-08-06 16:51 - 2015-08-06 16:51 - 0613255 _____ (CMI Limited) C:\Users\jeanphilippe\AppData\Local\nsyA978.tmp

Task: C:\WINDOWS\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION

Task: C:\WINDOWS\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION

Task: C:\WINDOWS\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION

Task: C:\WINDOWS\Tasks\CashMachine.job => c:\programdata\{271eba2d-efce-057e-271e-eba2defce8b7}\nsvc59b.tmp.exe <==== ATTENTION

Task: C:\WINDOWS\Tasks\Crossbrowse.job => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe <==== ATTENTION

Task: {093203A0-5962-465D-9F43-161DC963C6B9} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION

Task: {30499B65-38BA-4DE3-BDC6-2C60F3699C76} - System32\Tasks\WIN-statsSystem => C:\Users\jeanphilippe\AppData\Local\Microsoft\WinU\~sjbsimx.exe

Task: {3CE5A9E4-F28B-40B2-8F80-3C5DAD6E0698} - System32\Tasks\WIN-GGfIfEGCfEGbGffIfCfEGC => C:\Users\jeanphilippe\AppData\Roaming\~uzafvyw.exe

Task: {55837973-8ABE-4031-A483-CF11B5ECCA8B} - \Plus-HD-2.3-chromeinstaller No Task File <==== ATTENTION

Task: {55B44731-3865-4CF7-95BF-44437CC7BC14} - System32\Tasks\DNSWABENO => dnswabeno.exe

Task: {5967A491-C9C9-4E88-87CC-57F80BEA4359} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION

Task: {5FA70F2A-27D7-4F1B-8B8F-B93E96EAD3AC} - System32\Tasks\Qig8bWpIT9737Dk => C:\Users\jeanphilippe\AppData\Roaming\l7dQ7SE\N9477ZD.exe

Task: {63466080-0757-400E-ACB0-F7B087D20993} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-2363316308-1714619483-545244223-1001 => %localappdata%\Microsoft\OneDrive\OneDrive.exe

Task: {7F34993B-8DE5-4418-8F8E-89781803A1AA} - System32\Tasks\CashMachine => c:\programdata\{271eba2d-efce-057e-271e-eba2defce8b7}\nsvc59b.tmp.exe <==== ATTENTION

Task: {99E0893D-76C2-476B-9B13-2011734A37D3} - System32\Tasks\WIN-fdfEfEfAfC => C:\Users\jeanphilippe\AppData\Roaming\~tkscdxf.exe

Task: {9B884DE2-5839-4D72-BED6-8013542E53DE} - System32\Tasks\{D8B94517-B34B-47DE-AEE9-2D3CD4D95C04} => pcalua.exe -a C:\Users\jeanphilippe\AppData\Roaming\webssearches\UninstallManager.exe -c -ptid=ill <==== ATTENTION

Task: {ADA2A06F-F152-44E9-A6B7-991A6DCF0795} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION

Task: {C046484B-31E3-4077-BCD4-5B77873BA5EC} - System32\Tasks\mMS7BILUrMHxGam => C:\Users\jeanphilippe\AppData\Roaming\IjpMWgY\9TmCYU3.exe

Task: {C716BB4F-87E9-4CB4-99A8-FA8383B630C8} - System32\Tasks\WIN-fIGbfFfEGCfFGEGbfCfE => C:\Users\jeanphilippe\AppData\Roaming\~wnbwbnh.exe

Task: {C9B5914C-194E-4B14-9CC2-9C33CD962356} - \Ashegneamuss No Task File <==== ATTENTION

Task: {CF64501F-6D53-4BF4-9BF2-AD0F1918CCBD} - System32\Tasks\Crossbrowse => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe <==== ATTENTION

Task: {D84D9822-4232-4B5C-AB38-3F072DA506C1} - System32\Tasks\aapWxo5p7lMVF7q => C:\Users\jeanphilippe\AppData\Roaming\DoXJerT\62LrGqw.exe

Task: {E1FFD5D6-E54B-4B50-9134-2BD67A681F7E} - System32\Tasks\{9B02C7A6-8302-4BF9-957E-003E97943927} => pcalua.exe -a C:\Users\jeanphilippe\AppData\Roaming\omiga-plus\UninstallManager.exe -c -ptid=ill <==== ATTENTION


HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\gmsd_fr_005010052 => value removed successfully
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\gmsd_fr_005010053 => value removed successfully
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\upgmsd_fr_005010053.exe => value removed successfully
HKU\S-1-5-21-2363316308-1714619483-545244223-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Moolineo.exe => value removed successfully
HKU\S-1-5-21-2363316308-1714619483-545244223-1001\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_E6767101B8189532DE4ECA1F9AE60061 => value removed successfully
IHProtect Service => Unable to stop service.
IHProtect Service => service removed successfully
R2 Service Mgr OnStage; C:\ProgramData\2988696b-294c-4054-b34f-e97ca58a10e8\plugincontainer.exe [1140448 2015-08-06] () => Error: No automatic fix found for this entry.
vrKXJhPG => Unable to stop service.
vrKXJhPG => service removed successfully
comyninu => service removed successfully
hyverumu => service removed successfully
wsfd_vw_1_10_0_20 => service removed successfully
C:\ProgramData\Browser => moved successfully.
C:\Users\jeanphilippe\AppData\Roaming\Lavasoft => moved successfully.
C:\Users\jeanphilippe\AppData\Local\Lavasoft => moved successfully.
C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk => moved successfully.

"C:\Program Files\Lavasoft" folder move:

Could not move "C:\Program Files\Lavasoft" => Scheduled to move on reboot.

C:\Program Files\Common Files\Lavasoft => moved successfully.

"C:\ProgramData\Lavasoft" folder move:

Could not move "C:\ProgramData\Lavasoft" => Scheduled to move on reboot.

C:\WINDOWS\Tasks\APSnotifierPP3.job => moved successfully.
C:\WINDOWS\Tasks\APSnotifierPP2.job => moved successfully.
C:\WINDOWS\Tasks\APSnotifierPP1.job => moved successfully.
C:\WINDOWS\System32\Tasks\APSnotifierPP1 => moved successfully.
C:\WINDOWS\System32\Tasks\APSnotifierPP3 => moved successfully.
C:\WINDOWS\System32\Tasks\APSnotifierPP2 => moved successfully.
C:\Users\jeanphilippe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup => moved successfully.
C:\Users\jeanphilippe\SupTab => moved successfully.
C:\Program Files (x86)\AnyProtectEx => moved successfully.
C:\Users\jeanphilippe\AppData\Local\nso9FE5.tmp => moved successfully.
C:\Users\jeanphilippe\AppData\Roaming\AnyProtectEx => moved successfully.
C:\Users\jeanphilippe\AppData\Local\gmsd_fr_005010053 => moved successfully.
C:\WINDOWS\Tasks\Crossbrowse.job => moved successfully.
C:\Program Files (x86)\gmsd_fr_005010053 => moved successfully.
C:\Program Files (x86)\MiuiTab => moved successfully.

"C:\ProgramData\2988696b-294c-4054-b34f-e97ca58a10e8" folder move:

Could not move "C:\ProgramData\2988696b-294c-4054-b34f-e97ca58a10e8" => Scheduled to move on reboot.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crossbrowse => moved successfully.
C:\ProgramData\ZWinManProZ => moved successfully.
C:\WINDOWS\System32\Tasks\Crossbrowse => moved successfully.
C:\Users\jeanphilippe\AppData\Roaming\istartsurf => moved successfully.

"C:\Users\jeanphilippe\AppData\Local\Crossbrowse" folder move:

Could not move "C:\Users\jeanphilippe\AppData\Local\Crossbrowse" => Scheduled to move on reboot.

C:\ProgramData\IHProtectUpDate => moved successfully.
C:\Program Files (x86)\On Stage => moved successfully.
C:\Program Files (x86)\FriendlyError => moved successfully.

"C:\Program Files (x86)\Crossbrowse" folder move:

Could not move "C:\Program Files (x86)\Crossbrowse" => Scheduled to move on reboot.

C:\Users\jeanphilippe\AppData\Local\SmartWeb => moved successfully.
C:\Users\jeanphilippe\AppData\Local\BreakingNewsAlert => moved successfully.
C:\Users\jeanphilippe\Desktop\Addition.txt => moved successfully.
C:\Users\Public\QiYi => moved successfully.
C:\Users\jeanphilippe\AppData\Local\Unity => moved successfully.
C:\Users\jeanphilippe\AppData\Local\nsyA978.tmp => moved successfully.
C:\ProgramData\SWinManProS => moved successfully.
C:\Program Files (x86)\baidu => moved successfully.
C:\Users\jeanphilippe\Downloads\Addition.txt => moved successfully.
C:\ProgramData\bdch => moved successfully.
C:\WINDOWS\PFRO.log => moved successfully.
C:\WINDOWS\setupact.log => moved successfully.
C:\WINDOWS\setuperr.log => moved successfully.
C:\WINDOWS\RegBootClean64.exe => moved successfully.
C:\Users\jeanphilippe\AppData\Local\nsyA044.tmp => moved successfully.
C:\Users\jeanphilippe\AppData\Local\27728 => moved successfully.
C:\Users\jeanphilippe\AppData\Roaming\Opera Software => moved successfully.
C:\Users\jeanphilippe\AppData\Local\Opera Software => moved successfully.
C:\Program Files (x86)\Opera => moved successfully.
C:\WINDOWS\Tasks\CashMachine.job => moved successfully.
C:\WINDOWS\System32\Tasks\CashMachine => moved successfully.
C:\dummy.htm => moved successfully.
C:\Users\jeanphilippe\Downloads\HousecallLauncher64.exe => moved successfully.

"C:\ProgramData\GusMvG" folder move:

Could not move "C:\ProgramData\GusMvG" => Scheduled to move on reboot.

C:\WINDOWS\System32\Tasks\DNSWABENO => moved successfully.
C:\WINDOWS\SysWOW64\${LOGFILE} => moved successfully.
C:\Users\jeanphilippe\AppData\Local\nsh5CCB.tmp => moved successfully.
C:\ProgramData\nWinManPron => moved successfully.
C:\WINDOWS\prleth.sys => moved successfully.
C:\WINDOWS\hgfs.sys => moved successfully.
C:\ProgramData\abc => moved successfully.
C:\ProgramData\Ashegneamuss => moved successfully.
C:\Program Files (x86)\8807057C-1438854212-1320-0606-090407000000 => moved successfully.
"C:\Users\jeanphilippe\AppData\Local\nsh5CCB.tmp" => File/Folder not found.
"C:\Users\jeanphilippe\AppData\Local\nso9FE5.tmp" => File/Folder not found.
"C:\Users\jeanphilippe\AppData\Local\nsyA044.tmp" => File/Folder not found.
"C:\Users\jeanphilippe\AppData\Local\nsyA978.tmp" => File/Folder not found.
C:\WINDOWS\Tasks\APSnotifierPP1.job not found.
C:\WINDOWS\Tasks\APSnotifierPP2.job not found.
C:\WINDOWS\Tasks\APSnotifierPP3.job not found.
C:\WINDOWS\Tasks\CashMachine.job not found.
C:\WINDOWS\Tasks\Crossbrowse.job not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{093203A0-5962-465D-9F43-161DC963C6B9}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{093203A0-5962-465D-9F43-161DC963C6B9}" => key removed successfully
C:\Windows\System32\Tasks\APSnotifierPP3 not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP3" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{30499B65-38BA-4DE3-BDC6-2C60F3699C76}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{30499B65-38BA-4DE3-BDC6-2C60F3699C76}" => key removed successfully
C:\Windows\System32\Tasks\WIN-statsSystem => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WIN-statsSystem" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3CE5A9E4-F28B-40B2-8F80-3C5DAD6E0698}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3CE5A9E4-F28B-40B2-8F80-3C5DAD6E0698}" => key removed successfully
C:\Windows\System32\Tasks\WIN-GGfIfEGCfEGbGffIfCfEGC => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WIN-GGfIfEGCfEGbGffIfCfEGC" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{55837973-8ABE-4031-A483-CF11B5ECCA8B}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{55837973-8ABE-4031-A483-CF11B5ECCA8B}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Plus-HD-2.3-chromeinstaller" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{55B44731-3865-4CF7-95BF-44437CC7BC14}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{55B44731-3865-4CF7-95BF-44437CC7BC14}" => key removed successfully
C:\Windows\System32\Tasks\DNSWABENO not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DNSWABENO" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5967A491-C9C9-4E88-87CC-57F80BEA4359}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5967A491-C9C9-4E88-87CC-57F80BEA4359}" => key removed successfully
C:\Windows\System32\Tasks\APSnotifierPP2 not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP2" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{5FA70F2A-27D7-4F1B-8B8F-B93E96EAD3AC}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5FA70F2A-27D7-4F1B-8B8F-B93E96EAD3AC}" => key removed successfully
C:\Windows\System32\Tasks\Qig8bWpIT9737Dk => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Qig8bWpIT9737Dk" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{63466080-0757-400E-ACB0-F7B087D20993}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{63466080-0757-400E-ACB0-F7B087D20993}" => key removed successfully
C:\Windows\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-2363316308-1714619483-545244223-1001 => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft OneDrive Auto Update Task-S-1-5-21-2363316308-1714619483-545244223-1001" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7F34993B-8DE5-4418-8F8E-89781803A1AA}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7F34993B-8DE5-4418-8F8E-89781803A1AA}" => key removed successfully
C:\Windows\System32\Tasks\CashMachine not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\CashMachine" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{99E0893D-76C2-476B-9B13-2011734A37D3}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{99E0893D-76C2-476B-9B13-2011734A37D3}" => key removed successfully
C:\Windows\System32\Tasks\WIN-fdfEfEfAfC => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WIN-fdfEfEfAfC" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9B884DE2-5839-4D72-BED6-8013542E53DE}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9B884DE2-5839-4D72-BED6-8013542E53DE}" => key removed successfully
C:\Windows\System32\Tasks\{D8B94517-B34B-47DE-AEE9-2D3CD4D95C04} => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{D8B94517-B34B-47DE-AEE9-2D3CD4D95C04}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{ADA2A06F-F152-44E9-A6B7-991A6DCF0795}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ADA2A06F-F152-44E9-A6B7-991A6DCF0795}" => key removed successfully
C:\Windows\System32\Tasks\APSnotifierPP1 not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP1" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{C046484B-31E3-4077-BCD4-5B77873BA5EC}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C046484B-31E3-4077-BCD4-5B77873BA5EC}" => key removed successfully
C:\Windows\System32\Tasks\mMS7BILUrMHxGam => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\mMS7BILUrMHxGam" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{C716BB4F-87E9-4CB4-99A8-FA8383B630C8}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C716BB4F-87E9-4CB4-99A8-FA8383B630C8}" => key removed successfully
C:\Windows\System32\Tasks\WIN-fIGbfFfEGCfFGEGbfCfE => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WIN-fIGbfFfEGCfFGEGbfCfE" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{C9B5914C-194E-4B14-9CC2-9C33CD962356}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C9B5914C-194E-4B14-9CC2-9C33CD962356}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Ashegneamuss" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{CF64501F-6D53-4BF4-9BF2-AD0F1918CCBD}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CF64501F-6D53-4BF4-9BF2-AD0F1918CCBD}" => key removed successfully
C:\Windows\System32\Tasks\Crossbrowse not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Crossbrowse" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D84D9822-4232-4B5C-AB38-3F072DA506C1}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D84D9822-4232-4B5C-AB38-3F072DA506C1}" => key removed successfully
C:\Windows\System32\Tasks\aapWxo5p7lMVF7q => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\aapWxo5p7lMVF7q" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E1FFD5D6-E54B-4B50-9134-2BD67A681F7E}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E1FFD5D6-E54B-4B50-9134-2BD67A681F7E}" => key removed successfully
C:\Windows\System32\Tasks\{9B02C7A6-8302-4BF9-957E-003E97943927} => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{9B02C7A6-8302-4BF9-957E-003E97943927}" => key removed successfully

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2015-08-07 08:53:14)<=

C:\Program Files\Lavasoft => Is moved successfully
"C:\ProgramData\Lavasoft" => Could not move
C:\ProgramData\2988696b-294c-4054-b34f-e97ca58a10e8 => moved successfully
C:\Users\jeanphilippe\AppData\Local\Crossbrowse => Is moved successfully
C:\Program Files (x86)\Crossbrowse => Is moved successfully
C:\ProgramData\GusMvG => Is moved successfully

End of Fixlog 08:53:19

0
Malekal_morte- Messages postés 184348 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 691
 
ok fais la suite de la procédure =)
0
tejipe
 
C'est fait
0
Malekal_morte- Messages postés 184348 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 691
 
Tu as bien remis les DNS en automatique ?
0
tejipe
 
oui, c'est bon
0
tejipe
 
Malekal

J'ai un logiciel de comptabilité (c'est mon travail) qui ne s'ouvre plus. Il m'indique

[Erreur] - Une erreur liée au réseau ou spécifique à l'instance s'est produite lors de l'établissement d'une connexion à SQL Server. Le serveur est introuvable ou n'est pas accessible. Vérifiez que le nom de l'instance est correct et que SQL Server est configuré pour autoriser les connexions distantes. (provider: Shared Memory Provider, error: 40 - Impossible d'ouvrir une connexion à SQL Server)

Est ce que ca peut provenir du fait que j'ai mis les dns en automatique? Et comment arranger cela?
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 5 / 10
Malekal_morte- Messages postés 184348 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 691
 
Sur quel navigateur WEB les pubs ?
Tu peux refaire un scan FRST pour voir.

Pour ton logiciel, surement que les logiciels adwares ont planté le programme, faudra le réinstaller.
0
tejipe
 
surtout mozilla. C'est celui dont je me sers généralement.

J'ai toujours itartsurf sur IE

Et chrome me fait toujours pareil en ouvrant une page qui me prévint "attention... un virus...etc etc"

Je te fais passer le rapport de frst dans le prochain mesage
0
tejipe
 
rapport de frst : http://pjjoint.malekal.com/files.php?id=20150807_f15w11q12g9z11
rapport addition : http://pjjoint.malekal.com/files.php?id=20150807_z10z12f10g5o7
rapport shortcut : http://pjjoint.malekal.com/files.php?id=20150807_j8w8t8d5b8
0
Réponse 6 / 10
Malekal_morte- Messages postés 184348 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 691
 
Voici la correction à effectuer avec FRST.
Tu peux t'inspirer de cette note explicative avec des captures d'écran pour t'aider: https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/#fix

Ouvre le bloc-notes : Touche Windows + R, dans le champs executer, tape notepad et OK.
Copie/colle dedans ce qui suit :

Winsock: Catalog9 01 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9 02 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9 03 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9 04 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9 16 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9-x64 01 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9-x64 02 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9-x64 03 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9-x64 04 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9-x64 16 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-09] (Lavasoft Limited)
2015-08-07 09:19 - 2015-08-07 09:19 - 00000000 ____D C:\Program Files (x86)\On Stage
2015-08-07 09:12 - 2015-08-07 10:11 - 00000000 ____D C:\ProgramData\2988696b-294c-4054-b34f-e97ca58a10e8
2015-08-07 08:51 - 2015-08-07 08:51 - 00000000 ____D C:\Users\jeanphilippe\AppData\Local\BreakingNewsAlert
CHR Extension: (On Stage) - C:\Users\jeanphilippe\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbkdklpbijebijcacnklngkkmnndeoof [2015-08-07]
cmd: netsh winsock reset

Relance FRST et clic sur le bouton Fix
Selon comment un redémarrage est nécessaire (pas obligatoire).
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

Redémarre l'ordinateur


Tu peux me dire quels sont les paramètres DNS de chaque carte ?
C'est toujours en automatique ?

Like the angel you are, you laugh creating a lightness in my chest,
Your eyes they penetrate me,
(Your answer's always 'maybe')
That's when I got up and left
0
tejipe
 
1er rapport de fix


Fix result of Farbar Recovery Scan Tool (x64) Version:06-08-2015
Ran by jeanphilippe (2015-08-07 14:34:16) Run:2
Running from C:\Users\jeanphilippe\Desktop
Loaded Profiles: jeanphilippe (Available Profiles: jeanphilippe)
Boot Mode: Normal
==============================================

fixlist content:

Winsock: Catalog9 01 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9 02 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9 03 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9 04 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9 16 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9-x64 01 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9-x64 02 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9-x64 03 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9-x64 04 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9-x64 16 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-09] (Lavasoft Limited)
2015-08-07 09:19 - 2015-08-07 09:19 - 00000000 ____D C:\Program Files (x86)\On Stage
2015-08-07 09:12 - 2015-08-07 10:11 - 00000000 ____D C:\ProgramData\2988696b-294c-4054-b34f-e97ca58a10e8
2015-08-07 08:51 - 2015-08-07 08:51 - 00000000 ____D C:\Users\jeanphilippe\AppData\Local\BreakingNewsAlert
CHR Extension: (On Stage) - C:\Users\jeanphilippe\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbkdklpbijebijcacnklngkkmnndeoof [2015-08-07]

Voici la correction à effectuer avec FRST.
Tu peux t'inspirer de cette note explicative avec des captures d'écran pour t'aider: http://www.malekal.com/2013/06/15/tutorial-farbar-recovery-scan-tool-frst/#fix

Ouvre le bloc-notes : Touche Windows + R, dans le champs executer, tape notepad et OK.
Copie/colle dedans ce qui suit :

Winsock: Catalog9 01 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9 02 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9 03 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9 04 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9 16 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9-x64 01 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9-x64 02 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9-x64 03 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9-x64 04 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-09] (Lavasoft Limited)
Winsock: Catalog9-x64 16 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-09] (Lavasoft Limited)
2015-08-07 09:19 - 2015-08-07 09:19 - 00000000 ____D C:\Program Files (x86)\On Stage
2015-08-07 09:12 - 2015-08-07 10:11 - 00000000 ____D C:\ProgramData\2988696b-294c-4054-b34f-e97ca58a10e8
2015-08-07 08:51 - 2015-08-07 08:51 - 00000000 ____D C:\Users\jeanphilippe\AppData\Local\BreakingNewsAlert
CHR Extension: (On Stage) - C:\Users\jeanphilippe\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbkdklpbijebijcacnklngkkmnndeoof [2015-08-07]
C:\WINDOWS\system32\LavasoftTcpService64.dll
cmd: netsh winsock reset


Winsock: Catalog entry 000000000001 => removed successfully
Winsock: Catalog entry 000000000002 => removed successfully
Winsock: Catalog entry 000000000003 => removed successfully
Winsock: Catalog entry 000000000004 => removed successfully
Winsock: Catalog entry 000000000016 => removed successfully
Winsock: Catalog entry 000000000001 => removed successfully
Winsock: Catalog entry 000000000002 => removed successfully
Winsock: Catalog entry 000000000003 => removed successfully
Winsock: Catalog entry 000000000004 => removed successfully
Winsock: Catalog entry 000000000016 => removed successfully
C:\Program Files (x86)\On Stage => moved successfully.
C:\ProgramData\2988696b-294c-4054-b34f-e97ca58a10e8 => moved successfully.
C:\Users\jeanphilippe\AppData\Local\BreakingNewsAlert => moved successfully.
C:\Users\jeanphilippe\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbkdklpbijebijcacnklngkkmnndeoof => moved successfully.
Voici la correction à effectuer avec FRST. => Error: No automatic fix found for this entry.
Tu peux t'inspirer de cette note explicative avec des captures d'écran pour t'aider: http://www.malekal.com/2013/06/15/tutorial-farbar-recovery-scan-tool-frst/#fix => Error: No automatic fix found for this entry.
Ouvre le bloc-notes : Touche Windows + R, dans le champs executer, tape notepad et OK. => Error: No automatic fix found for this entry.
Copie/colle dedans ce qui suit : => Error: No automatic fix found for this entry.
Winsock: Catalog entry 000000000001 => not found.
Winsock: Catalog entry 000000000002 => not found.
Winsock: Catalog entry 000000000003 => not found.
Winsock: Catalog entry 000000000004 => not found.
Winsock: Catalog entry 000000000016 => not found.
Winsock: Catalog entry 000000000001 => not found.
Winsock: Catalog entry 000000000002 => not found.
Winsock: Catalog entry 000000000003 => not found.
Winsock: Catalog entry 000000000004 => not found.
Winsock: Catalog entry 000000000016 => not found.
"C:\Program Files (x86)\On Stage" => File/Folder not found.
"C:\ProgramData\2988696b-294c-4054-b34f-e97ca58a10e8" => File/Folder not found.
"C:\Users\jeanphilippe\AppData\Local\BreakingNewsAlert" => File/Folder not found.
C:\Users\jeanphilippe\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbkdklpbijebijcacnklngkkmnndeoof folder not found
C:\WINDOWS\system32\LavasoftTcpService64.dll => moved successfully.

========= netsh winsock reset =========

Le d?marrage de la fonction d'initialisation InitHelperDll dans NSHHTTP.DLL a ?chou??;
code d'erreur?: 10107

Le catalogue Winsock a ?t? r?initialis? correctement.
Vous devez red?marrer l'ordinateur afin de finaliser la r?initialisation.


========= End of CMD: =========
0
Réponse 7 / 10
Malekal_morte- Messages postés 184348 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 691
 
s'il reste des pubs sur Google Chrome, fais ça :

Exporte tes favoris : https://support.google.com/chrome/answer/96816?hl=fr
Désinstalle Google Chrome depuis le panneau de configuration et programmes et fonctionnalités (ou désinstaller programmes).
A la désinstallation coche l'option de suppression des profils.
Télécharge et Réinstalle Google Chrome https://telecharger.malekal.com/download/google-chrome/
Au premier démarrage de Google Chrome, tu dois le trouver vierge, comme lors de la première installation, pas de page de démarrage habituelle, ni les extensions qui étaient présentes.
Tout doit avoir disparu.
réimporte les favoris.

Vois ce qu'il reste comme problème.
0
tejipe
 
Je ne me sers quasiment jamais de google chrome. Est ce que je peux le désinstaller et ne pas le remettre en marche?
0
Malekal_morte- Messages postés 184348 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 691
 
Si tu veux oui.
0
tejipe
 
bon, finalement j'ai fait ce que tu m'as dit de faire
0
tejipe
 
google chrome est réinstallé et virge
0
tejipe
 
a priori, sur chrome, je n'ai plus de problème et mon problème de logiciel est résolu, sans réinstaller le logiciel
0
Réponse 8 / 10
Malekal_morte- Messages postés 184348 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 691
 
Malwarebytes (temps : environ 40min de scan):
==================================================
Télécharge et installe Malwarebyte : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Mets le à jour puis lance un examen.

A la fin du scan, clic sur "Supprimer Selection" en bas à gauche.
Redémarre l'ordinateur si besoin.
Après redémarrage, relance Malwarebytes.
Vas chercher le rapport dans l'onglet Historique.
A gauche Journal des examens.
Doube-clic sur l'examen dans la liste.
Puis en bas Copier dans le presse papier
Vas sur http://pjjoint.malekal.com et en bas, clic droit / coller pour coller le rapport du scan Malwarebytes.
Clic sur envoyer.
Dans un nouveau message ici en réponse, donne le lien pjjoint afin de pouvoir consulter le rapport.

0
tejipe
 
Ci joint le rapport de malware

Ps : J'ai toujours les pubs on stage

http://pjjoint.malekal.com/files.php?id=20150807_e10n612m8p5

Merci pour ton aide
0
Réponse 9 / 10
Malekal_morte- Messages postés 184348 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 691
 
humm j'ai l'impresion que quelque chose le remet.
On tourne en rond.

Serais-tu d'accord pour une prise en main à distance ? ce serait plus simple je pense.
Il faudrait que tu t'inscrire sur le site pour cela => https://www.commentcamarche.net/infos/25881-etre-membre-de-commentcamarche-pourquoi-comment/

Je t'enverrai un message privé.
Je mettrai la solution ici.
0
tejipe
 
Merci Malekal mais, apparemment avec Malwarebytes, tout a disparu.
0
Réponse 10 / 10
Malekal_morte- Messages postés 184348 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 691
 
soit =)


Voila, c'est terminé, tu peux supprimer les programmes utilisés.

Quelques conseils :


Pour prévenir les sites malicieux, tu peux installer Blockulicious : https://forum.malekal.com/viewtopic.php?t=46656&start=


Pour ne plus te faire avoir.
A lire - Programmes parasites / PUPs : https://www.malekal.com/adwares-pup-protection/
(Surtout active les détections LPIs pour détecter les programmes parasites et publicitaires)


Le reste de la sécurité : http://forum.malekal.com/comment-securiser-son-ordinateur.html

0