Sujet Précédent Sujet Suivant

Supprimer AmuleC et WinSnare

Fermé
Arthurfaro Messages postés 2 Date d'inscription vendredi 10 février 2017 Statut Membre Dernière intervention 1 mars 2017 - 24 févr. 2017 à 08:34
Malekal_morte- Messages postés 180304 Date d'inscription mercredi 17 mai 2006 Statut Modérateur, Contributeur sécurité Dernière intervention 15 décembre 2020 - 1 mars 2017 à 19:10
Bonjour la blogosphère,

je suis Arthur. J’espère que vous vous portez bien. Je suis un utilisateur habituellement assez prudent sur internet, mais cette fois j'ai pêché en voulant télécharger gratuitement 'Plants Vs Zombies 2'. Conséquence je me retrouve infecté par AmuleC + WinSnare et je voudrais bien m'en débarrasser.
J'ai effectué des scans avec FRST et voici les liens vers les rapports

Shortcut - http://pjjoint.malekal.com/files.php?id=20170224_b10m12k9k8y6

FRST - http://pjjoint.malekal.com/files.php?id=FRST_20170224_l11b11f9i14q11

Addition - http://pjjoint.malekal.com/files.php?id=20170224_8d10x8y6z9

Un coup de main pour me sortir cette épine du pied m'aidera grandement. Merci d'avance

PS: Ne jouez pas aux petits malins en essayant de télécharger gratuitement 'Plants Vs Zombies 2' :-)

A voir également:

4 réponses

Réponse 1 / 4
Malekal_morte- Messages postés 180304 Date d'inscription mercredi 17 mai 2006 Statut Modérateur, Contributeur sécurité Dernière intervention 15 décembre 2020 24 660
24 févr. 2017 à 08:48
Salut,

Je regarde les rapports =)
0
Réponse 2 / 4
Malekal_morte- Messages postés 180304 Date d'inscription mercredi 17 mai 2006 Statut Modérateur, Contributeur sécurité Dernière intervention 15 décembre 2020 24 660
24 févr. 2017 à 08:54
Salut,

Désinstalle TuneUp Utilities
Pas utile.


Voici la correction à effectuer avec FRST. Tu peux t'aider de cette note explicative avec des captures d'écran.

Ouvre le bloc-notes : Touche Windows + R,
Dans le champs "Exécuter", saisir notepad et OK.
Copie/Colle dedans ce qui suit : 


CloseProcesses:
CreateRestorePoint:
HKLM\...\Providers\dcd88c8o: C:\Program Files (x86)\Qoerchvilily Log\local64spl.dll [289792 2017-02-04] () 
BHO-x32: MrFroggy Class -> {856E12B5-22D7-4E22-9ACA-EA9A008DD65B} -> C:\Program Files (x86)\Minibar\Froggy.dll [2011-06-01] (TODO: <название компании>)
BHO-x32: AskBar BHO -> {201f27d4-3704-41d6-89c1-aa35e39143ed} -> C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll [2008-11-18] (Ask.com)
C:\Program Files (x86)\Minibar
C:\Program Files (x86)\AskBarDi
BHO-x32: Funmoods Helper Object -> {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} -> No File
ShortcutWithArgument: C:\Users\Dong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Standuck\Application\chrome.exe (Google Inc.) -> hxxp://www.amisites.com/?type=sc&ts=1486410500&z=355c957b8653090b9f29e6agdz6bfqez3g6edz4t9t&from=che0812&uid=WDCXWD3200BEVT-75A23T0_WD-WX11A31X9864X9864
ShortcutWithArgument: C:\Users\Dong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JonDoFox\Firefox Profile Manager.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.amisites.com/?type=sc&ts=1486410500&z=355c957b8653090b9f29e6agdz6bfqez3g6edz4t9t&from=che0812&uid=WDCXWD3200BEVT-75A23T0_WD-WX11A31X9864X9864
ShortcutWithArgument: C:\Users\Dong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JonDoFox\JonDoFox Help.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.amisites.com/?type=sc&ts=1486410500&z=355c957b8653090b9f29e6agdz6bfqez3g6edz4t9t&from=che0812&uid=WDCXWD3200BEVT-75A23T0_WD-WX11A31X9864X9864
ShortcutWithArgument: C:\Users\Dong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JonDoFox\Start JonDoFox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.amisites.com/?type=sc&ts=1486410500&z=355c957b8653090b9f29e6agdz6bfqez3g6edz4t9t&from=che0812&uid=WDCXWD3200BEVT-75A23T0_WD-WX11A31X9864X9864
ShortcutWithArgument: C:\Users\Dong\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Standuck\Application\chrome.exe (Google Inc.) -> hxxp://www.amisites.com/?type=sc&ts=1486410500&z=355c957b8653090b9f29e6agdz6bfqez3g6edz4t9t&from=che0812&uid=WDCXWD3200BEVT-75A23T0_WD-WX11A31X9864X9864
ShortcutWithArgument: C:\Users\Dong\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files (x86)\Firefox\Firefox.exe (Mozilla Corporation) -> hxxp://www.amisites.com/?type=sc&ts=1486410500&z=355c957b8653090b9f29e6agdz6bfqez3g6edz4t9t&from=che0812&uid=WDCXWD3200BEVT-75A23T0_WD-WX11A31X9864X9864
ShortcutWithArgument: C:\Users\Dong\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk -> C:\Program Files (x86)\Standuck\Application\chrome.exe (Google Inc.) -> hxxp://www.amisites.com/?type=sc&ts=1486410500&z=355c957b8653090b9f29e6agdz6bfqez3g6edz4t9t&from=che0812&uid=WDCXWD3200BEVT-75A23T0_WD-WX11A31X9864X9864
ShortcutWithArgument: C:\Users\Dong\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mozilla Firefox.lnk -> C:\Program Files (x86)\Firefox\Firefox.exe (Mozilla Corporation) -> hxxp://www.amisites.com/?type=sc&ts=1486410500&z=355c957b8653090b9f29e6agdz6bfqez3g6edz4t9t&from=che0812&uid=WDCXWD3200BEVT-75A23T0_WD-WX11A31X9864X9864
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Firefox\Firefox.exe (Mozilla Corporation) -> hxxp://www.amisites.com/?type=sc&ts=1486410500&z=355c957b8653090b9f29e6agdz6bfqez3g6edz4t9t&from=che0812&uid=WDCXWD3200BEVT-75A23T0_WD-WX11A31X9864X9864
 HKLM\...\Policies\Explorer\Run: [application] => C:\Program Files (x86)\ACSPMonitor\ASMonitor.exe 
 R2 WinSnare; C:\Users\Dong\AppData\Roaming\WinSnare\WinSnare.dll [779264 2017-02-20] (InterSect Alliance Pty Ltd) [File not signed]
S2 FirefoxDL; "C:\Users\Dong\AppData\Local\Temp\1\QQBrowser.exe" -isvc [X] <==== ATTENTION
R2 Themes; C:\windows\system32\themeservice.dll [44544 2009-07-14] (Microsoft Corporation) [DependOnService: iThemes5]<==== ATTENTION
R3 iThemes5; C:\Program Files (x86)\Common Files\Services\iThemes.dll [526848 2017-02-05] () [File not signed] <==== ATTENTION
R2 FirefoxU; C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe [157184 2017-02-17] () [File not signed]
R2 GubedZL; C:\Program Files (x86)\Gubed\GubedZL.dll [118272 2017-02-05] () [File not signed]
R2 GubZL; C:\Program Files (x86)\Gub\GubZL.dll [116224 2017-02-08] () [File not signed]
R2 Archer; C:\Program Files (x86)\WinArcher\Archer.dll [760320 2017-02-14] () [File not signed]
2017-02-17 20:50 - 2017-02-17 20:50 - 00000000 ____D C:\windows\system32\log
2017-02-17 20:45 - 2017-02-24 07:27 - 00000000 _____ C:\Users\Public\Documents\report.dat
2017-02-17 20:45 - 2017-02-24 07:14 - 00000048 _____ C:\Users\Public\Documents\temp.dat
2017-02-17 18:51 - 2017-02-21 00:07 - 00000000 ____D C:\Program Files (x86)\WinSnare(4.1.1)
2017-02-13 20:46 - 2017-02-17 22:09 - 00000000 ____D C:\Users\Dong\AppData\Roaming\WinSAPSvc
2017-02-11 23:18 - 2017-02-11 23:18 - 00001042 _____ C:\Users\openpgsvc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2017-02-10 07:09 - 2017-02-10 07:13 - 00404554 _____ C:\windows\ntbtlog.txt
2017-02-10 00:05 - 2017-02-17 18:51 - 00000000 ____D C:\Program Files (x86)\WinSnare(4.1.0)
2017-02-10 00:05 - 2017-02-10 00:05 - 00000000 ____D C:\Users\Dong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\amuleC
2017-02-10 00:05 - 2017-02-10 00:05 - 00000000 ____D C:\Users\Dong\AppData\Roaming\aMule
2017-02-10 00:05 - 2017-02-10 00:05 - 00000000 ____D C:\Program Files (x86)\amuleCe
2017-02-06 20:48 - 2017-02-21 00:07 - 00000000 ____D C:\Users\Dong\AppData\Roaming\WinSnare
2017-02-06 20:48 - 2017-02-09 23:55 - 00000000 ____D C:\Program Files (x86)\WinSnare(4.0.9)
2017-02-06 20:48 - 2017-02-06 20:48 - 00000000 ____D C:\Program Files (x86)\Gub
2017-02-05 09:24 - 2017-02-05 09:24 - 00000000 ____D C:\Program Files (x86)\WinArcher
2017-02-05 09:24 - 2017-02-05 09:24 - 00000000 ____D C:\Program Files (x86)\Gubed
2017-02-05 09:23 - 2017-02-14 22:01 - 00000000 ____D C:\ProgramData\WinSAPSvc
2017-02-05 09:23 - 2017-02-10 00:05 - 00000000 ____D C:\Program Files (x86)\MIO
2017-02-05 09:18 - 2017-02-13 21:45 - 00000000 ____D C:\Program Files (x86)\dcd88c8o
2017-02-04 16:05 - 2017-02-04 16:05 - 00000000 ____D C:\Users\Dong\AppData\LocalLow\IObit
2017-02-04 15:45 - 2017-02-04 18:23 - 00000000 ____D C:\Users\Dong\AppData\Roaming\Vonepy
2017-02-04 15:45 - 2017-02-04 15:45 - 00000000 ____D C:\Users\Dong\AppData\Local\Arojot
2017-02-04 15:45 - 2017-02-04 15:45 - 00000000 ____D C:\Program Files (x86)\Qoerchvilily Log
2017-02-04 15:44 - 2017-02-04 16:05 - 00000000 ____D C:\ProgramData\ProductData
2017-02-04 15:42 - 2017-02-04 15:42 - 00000000 ____D C:\Users\Public\Thunder Network
2017-02-04 15:42 - 2017-02-04 15:42 - 00000000 ____D C:\ProgramData\Thunder Network
2017-02-04 15:41 - 2017-02-14 22:01 - 00000000 ____D C:\Program Files (x86)\Shurerphraterward
HKU\S-1-5-21-1226309827-1340859763-2886337956-1000\...\ChromeHTML: -> C:\Program Files (x86)\Standuck\Application\chrome.exe (Google Inc.) <==== ATTENTION
C:\Program Files (x86)\Standuck
Hosts:
EmptyTemp:
RemoveProxy:
Reboot:


Une fois, le texte collé dans le Bloc-notes,
Menu "Fichier" puis "Enregistrer sous",

A gauche, place toi sur le Bureau,

Dans le champs en bas, nom du fichier mets : fixlist.txt
Clique sur "Enregistrer", cela va créer fixlist.txt sur le Bureau.

Relance FRST et clique sur le bouton "Corriger / Fix"
Un redémarrage sera peut-être nécessaire ( pas obligatoire )
Un fichier texte apparait, copie/colle le contenu ici dans un nouveau message.


Redémarre l'ordinateur.


2°)
Réinitialise/Répare les navigateurs WEB :

0
Malekal_morte- Messages postés 180304 Date d'inscription mercredi 17 mai 2006 Statut Modérateur, Contributeur sécurité Dernière intervention 15 décembre 2020 24 660
24 févr. 2017 à 08:59
Tu pourras supprimer WinSnare de la liste des programmes comme le fix Microsoft indiqué sur cette page : supprimer entrée de la liste des programmes de Windows
0
Réponse 3 / 4
Arthurfaro Messages postés 2 Date d'inscription vendredi 10 février 2017 Statut Membre Dernière intervention 1 mars 2017
1 mars 2017 à 19:03
Bonjour @M.M

J'ai effectué un redémarrage en mode sans échec puis j'ai fait la réparation demandée. La machine a redémarré et j'ai vu le fichier Fixlog sur mon bureau. Voici son contennu :

Fix result of Farbar Recovery Scan Tool (x64) Version: 23-02-2017 01
Ran by Dong (01-03-2017 18:30:00) Run:1
Running from C:\Users\Dong\Desktop
Loaded Profiles: Dong (Available Profiles: Dong & openpgsvc & Guest)
Boot Mode: Safe Mode (minimal)
==============================================

fixlist content:

CloseProcesses:
CreateRestorePoint:
HKLM\...\Providers\dcd88c8o: C:\Program Files (x86)\Qoerchvilily Log\local64spl.dll [289792 2017-02-04] ()
BHO-x32: MrFroggy Class -> {856E12B5-22D7-4E22-9ACA-EA9A008DD65B} -> C:\Program Files (x86)\Minibar\Froggy.dll [2011-06-01] (TODO: <???????? ????????>)
BHO-x32: AskBar BHO -> {201f27d4-3704-41d6-89c1-aa35e39143ed} -> C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll [2008-11-18] (Ask.com)
C:\Program Files (x86)\Minibar
C:\Program Files (x86)\AskBarDi
BHO-x32: Funmoods Helper Object -> {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} -> No File
ShortcutWithArgument: C:\Users\Dong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Standuck\Application\chrome.exe (Google Inc.) -> hxxp://www.amisites.com/?type=sc&ts=1486410500&z=355c957b8653090b9f29e6agdz6bfqez3g6edz4t9t&from=che0812&uid=WDCXWD3200BEVT-75A23T0_WD-WX11A31X9864X9864
ShortcutWithArgument: C:\Users\Dong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JonDoFox\Firefox Profile Manager.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.amisites.com/?type=sc&ts=1486410500&z=355c957b8653090b9f29e6agdz6bfqez3g6edz4t9t&from=che0812&uid=WDCXWD3200BEVT-75A23T0_WD-WX11A31X9864X9864
ShortcutWithArgument: C:\Users\Dong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JonDoFox\JonDoFox Help.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.amisites.com/?type=sc&ts=1486410500&z=355c957b8653090b9f29e6agdz6bfqez3g6edz4t9t&from=che0812&uid=WDCXWD3200BEVT-75A23T0_WD-WX11A31X9864X9864
ShortcutWithArgument: C:\Users\Dong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JonDoFox\Start JonDoFox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.amisites.com/?type=sc&ts=1486410500&z=355c957b8653090b9f29e6agdz6bfqez3g6edz4t9t&from=che0812&uid=WDCXWD3200BEVT-75A23T0_WD-WX11A31X9864X9864
ShortcutWithArgument: C:\Users\Dong\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Standuck\Application\chrome.exe (Google Inc.) -> hxxp://www.amisites.com/?type=sc&ts=1486410500&z=355c957b8653090b9f29e6agdz6bfqez3g6edz4t9t&from=che0812&uid=WDCXWD3200BEVT-75A23T0_WD-WX11A31X9864X9864
ShortcutWithArgument: C:\Users\Dong\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files (x86)\Firefox\Firefox.exe (Mozilla Corporation) -> hxxp://www.amisites.com/?type=sc&ts=1486410500&z=355c957b8653090b9f29e6agdz6bfqez3g6edz4t9t&from=che0812&uid=WDCXWD3200BEVT-75A23T0_WD-WX11A31X9864X9864
ShortcutWithArgument: C:\Users\Dong\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk -> C:\Program Files (x86)\Standuck\Application\chrome.exe (Google Inc.) -> hxxp://www.amisites.com/?type=sc&ts=1486410500&z=355c957b8653090b9f29e6agdz6bfqez3g6edz4t9t&from=che0812&uid=WDCXWD3200BEVT-75A23T0_WD-WX11A31X9864X9864
ShortcutWithArgument: C:\Users\Dong\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mozilla Firefox.lnk -> C:\Program Files (x86)\Firefox\Firefox.exe (Mozilla Corporation) -> hxxp://www.amisites.com/?type=sc&ts=1486410500&z=355c957b8653090b9f29e6agdz6bfqez3g6edz4t9t&from=che0812&uid=WDCXWD3200BEVT-75A23T0_WD-WX11A31X9864X9864
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Firefox\Firefox.exe (Mozilla Corporation) -> hxxp://www.amisites.com/?type=sc&ts=1486410500&z=355c957b8653090b9f29e6agdz6bfqez3g6edz4t9t&from=che0812&uid=WDCXWD3200BEVT-75A23T0_WD-WX11A31X9864X9864
HKLM\...\Policies\Explorer\Run: [application] => C:\Program Files (x86)\ACSPMonitor\ASMonitor.exe
R2 WinSnare; C:\Users\Dong\AppData\Roaming\WinSnare\WinSnare.dll [779264 2017-02-20] (InterSect Alliance Pty Ltd) [File not signed]
S2 FirefoxDL; "C:\Users\Dong\AppData\Local\Temp\1\QQBrowser.exe" -isvc [X] <==== ATTENTION
R2 Themes; C:\windows\system32\themeservice.dll [44544 2009-07-14] (Microsoft Corporation) [DependOnService: iThemes5]<==== ATTENTION
R3 iThemes5; C:\Program Files (x86)\Common Files\Services\iThemes.dll [526848 2017-02-05] () [File not signed] <==== ATTENTION
R2 FirefoxU; C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe [157184 2017-02-17] () [File not signed]
R2 GubedZL; C:\Program Files (x86)\Gubed\GubedZL.dll [118272 2017-02-05] () [File not signed]
R2 GubZL; C:\Program Files (x86)\Gub\GubZL.dll [116224 2017-02-08] () [File not signed]
R2 Archer; C:\Program Files (x86)\WinArcher\Archer.dll [760320 2017-02-14] () [File not signed]
2017-02-17 20:50 - 2017-02-17 20:50 - 00000000 ____D C:\windows\system32\log
2017-02-17 20:45 - 2017-02-24 07:27 - 00000000 _____ C:\Users\Public\Documents\report.dat
2017-02-17 20:45 - 2017-02-24 07:14 - 00000048 _____ C:\Users\Public\Documents\temp.dat
2017-02-17 18:51 - 2017-02-21 00:07 - 00000000 ____D C:\Program Files (x86)\WinSnare(4.1.1)
2017-02-13 20:46 - 2017-02-17 22:09 - 00000000 ____D C:\Users\Dong\AppData\Roaming\WinSAPSvc
2017-02-11 23:18 - 2017-02-11 23:18 - 00001042 _____ C:\Users\openpgsvc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2017-02-10 07:09 - 2017-02-10 07:13 - 00404554 _____ C:\windows\ntbtlog.txt
2017-02-10 00:05 - 2017-02-17 18:51 - 00000000 ____D C:\Program Files (x86)\WinSnare(4.1.0)
2017-02-10 00:05 - 2017-02-10 00:05 - 00000000 ____D C:\Users\Dong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\amuleC
2017-02-10 00:05 - 2017-02-10 00:05 - 00000000 ____D C:\Users\Dong\AppData\Roaming\aMule
2017-02-10 00:05 - 2017-02-10 00:05 - 00000000 ____D C:\Program Files (x86)\amuleCe
2017-02-06 20:48 - 2017-02-21 00:07 - 00000000 ____D C:\Users\Dong\AppData\Roaming\WinSnare
2017-02-06 20:48 - 2017-02-09 23:55 - 00000000 ____D C:\Program Files (x86)\WinSnare(4.0.9)
2017-02-06 20:48 - 2017-02-06 20:48 - 00000000 ____D C:\Program Files (x86)\Gub
2017-02-05 09:24 - 2017-02-05 09:24 - 00000000 ____D C:\Program Files (x86)\WinArcher
2017-02-05 09:24 - 2017-02-05 09:24 - 00000000 ____D C:\Program Files (x86)\Gubed
2017-02-05 09:23 - 2017-02-14 22:01 - 00000000 ____D C:\ProgramData\WinSAPSvc
2017-02-05 09:23 - 2017-02-10 00:05 - 00000000 ____D C:\Program Files (x86)\MIO
2017-02-05 09:18 - 2017-02-13 21:45 - 00000000 ____D C:\Program Files (x86)\dcd88c8o
2017-02-04 16:05 - 2017-02-04 16:05 - 00000000 ____D C:\Users\Dong\AppData\LocalLow\IObit
2017-02-04 15:45 - 2017-02-04 18:23 - 00000000 ____D C:\Users\Dong\AppData\Roaming\Vonepy
2017-02-04 15:45 - 2017-02-04 15:45 - 00000000 ____D C:\Users\Dong\AppData\Local\Arojot
2017-02-04 15:45 - 2017-02-04 15:45 - 00000000 ____D C:\Program Files (x86)\Qoerchvilily Log
2017-02-04 15:44 - 2017-02-04 16:05 - 00000000 ____D C:\ProgramData\ProductData
2017-02-04 15:42 - 2017-02-04 15:42 - 00000000 ____D C:\Users\Public\Thunder Network
2017-02-04 15:42 - 2017-02-04 15:42 - 00000000 ____D C:\ProgramData\Thunder Network
2017-02-04 15:41 - 2017-02-14 22:01 - 00000000 ____D C:\Program Files (x86)\Shurerphraterward
HKU\S-1-5-21-1226309827-1340859763-2886337956-1000\...\ChromeHTML: -> C:\Program Files (x86)\Standuck\Application\chrome.exe (Google Inc.) <==== ATTENTION
C:\Program Files (x86)\Standuck
Hosts:
EmptyTemp:
RemoveProxy:
Reboot:


Processes closed successfully.
Error: Restore point can only be created in normal mode.
HKLM\SYSTEM\CurrentControlSet\Control\Print\Providers\dcd88c8o => key removed successfully
HKLM\SYSTEM\CurrentControlSet\Control\Print\Providers\\order dcd88c8o => removed successfully
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{856E12B5-22D7-4E22-9ACA-EA9A008DD65B} => key removed successfully
HKCR\Wow6432Node\CLSID\{856E12B5-22D7-4E22-9ACA-EA9A008DD65B} => key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed} => key removed successfully
HKCR\Wow6432Node\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed} => key not found.
C:\Program Files (x86)\Minibar => moved successfully
"C:\Program Files (x86)\AskBarDi" => not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} => key removed successfully
HKCR\Wow6432Node\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} => key not found.
C:\Users\Dong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk => Shortcut argument removed successfully.
C:\Users\Dong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JonDoFox\Firefox Profile Manager.lnk => Shortcut argument removed successfully.
C:\Users\Dong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JonDoFox\JonDoFox Help.lnk => Shortcut argument removed successfully.
C:\Users\Dong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JonDoFox\Start JonDoFox.lnk => Shortcut argument removed successfully.
C:\Users\Dong\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk => Shortcut argument removed successfully.
C:\Users\Dong\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk => Shortcut argument removed successfully.
C:\Users\Dong\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk => Shortcut argument removed successfully.
C:\Users\Dong\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mozilla Firefox.lnk => Shortcut argument removed successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk => Shortcut argument removed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\application => value removed successfully
HKLM\System\CurrentControlSet\Services\WinSnare => key removed successfully
WinSnare => service removed successfully
HKLM\System\CurrentControlSet\Services\FirefoxDL => key removed successfully
FirefoxDL => service removed successfully
HKLM\System\CurrentControlSet\Services\Themes\\DependOnService => value removed successfully
HKLM\System\CurrentControlSet\Services\iThemes5 => key removed successfully
iThemes5 => service removed successfully
HKLM\System\CurrentControlSet\Services\FirefoxU => key removed successfully
FirefoxU => service removed successfully
HKLM\System\CurrentControlSet\Services\GubedZL => key removed successfully
GubedZL => service removed successfully
HKLM\System\CurrentControlSet\Services\GubZL => key removed successfully
GubZL => service removed successfully
Archer => service not found.
C:\windows\system32\log => moved successfully
C:\Users\Public\Documents\report.dat => moved successfully
C:\Users\Public\Documents\temp.dat => moved successfully
C:\Program Files (x86)\WinSnare(4.1.1) => moved successfully
C:\Users\Dong\AppData\Roaming\WinSAPSvc => moved successfully
C:\Users\openpgsvc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk => moved successfully
C:\windows\ntbtlog.txt => moved successfully
C:\Program Files (x86)\WinSnare(4.1.0) => moved successfully
C:\Users\Dong\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\amuleC => moved successfully
C:\Users\Dong\AppData\Roaming\aMule => moved successfully
C:\Program Files (x86)\amuleCe => moved successfully
C:\Users\Dong\AppData\Roaming\WinSnare => moved successfully
C:\Program Files (x86)\WinSnare(4.0.9) => moved successfully
C:\Program Files (x86)\Gub => moved successfully
C:\Program Files (x86)\WinArcher => moved successfully
C:\Program Files (x86)\Gubed => moved successfully
C:\ProgramData\WinSAPSvc => moved successfully
C:\Program Files (x86)\MIO => moved successfully
C:\Program Files (x86)\dcd88c8o => moved successfully
C:\Users\Dong\AppData\LocalLow\IObit => moved successfully
C:\Users\Dong\AppData\Roaming\Vonepy => moved successfully
C:\Users\Dong\AppData\Local\Arojot => moved successfully
C:\Program Files (x86)\Qoerchvilily Log => moved successfully
C:\ProgramData\ProductData => moved successfully
C:\Users\Public\Thunder Network => moved successfully
C:\ProgramData\Thunder Network => moved successfully
C:\Program Files (x86)\Shurerphraterward => moved successfully
HKU\S-1-5-21-1226309827-1340859763-2886337956-1000_Classes\ChromeHTML => key removed successfully
C:\Program Files (x86)\Standuck => moved successfully
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully
HKU\S-1-5-21-1226309827-1340859763-2886337956-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-1226309827-1340859763-2886337956-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully


========= End of RemoveProxy: =========


=========== EmptyTemp: ==========

BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 48578263 B
Java, Flash, Steam htmlcache => 877 B
Windows/system/drivers => 93864395 B
Edge => 0 B
Chrome => 294596801 B
Firefox => 37461953 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 117991 B
systemprofile32 => 62102129 B
LocalService => 16384 B
NetworkService => 30473382 B
Dong => 144281446 B
openpgsvc => 0 B
standard user => 122400 B
Guest => 428020 B

RecycleBin => 0 B
EmptyTemp: => 679.1 MB temporary data Removed.

================================


The system needed a reboot.

End of Fixlog 18:30:30

J'ai ensuite désinstallé TuneUp Utilities comme suggéré et réinitialisé/réparé mes navigateurs.

Jusqu'ici tout semble pas mal. Merci beaucoup @M.M
Je ne sais pas ce que j'aurai fait sans toi
0
Réponse 4 / 4
Malekal_morte- Messages postés 180304 Date d'inscription mercredi 17 mai 2006 Statut Modérateur, Contributeur sécurité Dernière intervention 15 décembre 2020 24 660
1 mars 2017 à 19:10
de rien :)

fais un nettoyage Malwarebytes - Tutoriel Malwarebytes Anti-Malware version gratuite

puis un nouveau scan FRST et donne les rapports via pjjoint.

0

Discussions similaires

PIX
plart -
jordane45 -

1 réponse