Virus amule c winsnare et autres

le premier lien est:
https://pjjoint.malekal.com/files.php?id=20170329_d5b6p5t9j13
merci

Passe à la suite.

addition.text
https://pjjoint.malekal.com/files.php?id=20170403_n11y14t6h15j14

pour le FRST.txt cela echoue chaque fois donc je copie le texte et je colle directement ici

je n'arrive toujours pas a le faire.
il ecrit upload echoué

Je n'avais pas compris que tu n'arrivais pas à l'héberger.

Envoie-le moi par mail : (adresse mail supprimée)

ok cela est fait merci

Il y a un faux Firefox et un faux Google Chrome. Tu réinstalleras les vrais si besoin.

"金山毒霸 (HKLM\...\Kingsoft Internet Security) (Version: 2017.11.3.8 - Kingsoft Internet Security)
c:\program files\kingsoft"

"C:\Program Files\Tencent"

--> Pour ces deux logiciels, essaie de trouver un fichier uninstall dans leur dossier respectif pour lancer la désinstallation.

Puis fais ceci :

--> Ouvre le Bloc-notes (Démarrer => Tous les programmes => Accessoires => Bloc-notes).
--> Copie-colle le texte en gras ci-dessous dans le Bloc-notes :


start
CreateRestorePoint:
CloseProcesses:
C:\Windows\Temp\g5CF9.tmp.exe
HKLM\...\Run: [kxesc] => c:\program files\kingsoft\kingsoft antivirus\kxetray.exe [1846552 2017-03-20] (Kingsoft Corporation)
HKLM\...\Run: [ QQPCTray] => C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QQPCTRAY.EXE [362304 2017-03-20] (Tencent)
HKLM\...\Providers\owitrgcu: C:\Program Files\Shiwot Cache\local32spl.dll
C:\Program Files\Shiwot Cache
ShellExecuteHooks: Pas de nom - {7F7806D8-DE44-11E6-82D2-64006A5CFC23} - C:\Users\GAH\AppData\Roaming\Kaphghibapy\Thuposhriquward.dll -> Pas de fichier
C:\Users\GAH\AppData\Roaming\Kaphghibapy
ShellIconOverlayIdentifiers: [.QMDeskTopGCIcon] -> {B7667919-3765-4815-A66D-98A09BE662D6} => C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QMGCShellExt.dll [2017-03-20] (Tencent)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.6789.com/?id=108
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.startpageing123.com/search/?type=ds&ts=1490780292&z=cf09695ae02a900b2482c21gczdteecm5b5e2oat9o&from=che0812&uid=ST9500325AS_6VEGTHXGXXXX6VEGTHXG&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.startpageing123.com/?type=hp&ts=1490780292&z=cf09695ae02a900b2482c21gczdteecm5b5e2oat9o&from=che0812&uid=ST9500325AS_6VEGTHXGXXXX6VEGTHXG
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.startpageing123.com/search/?type=ds&ts=1490780292&z=cf09695ae02a900b2482c21gczdteecm5b5e2oat9o&from=che0812&uid=ST9500325AS_6VEGTHXGXXXX6VEGTHXG&q={searchTerms}
HKU\S-1-5-21-2977373009-1723860718-2465262605-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGIjVkxlyIP4NYe17aVLWqJMKYLApJ0uz6jJVMcU2rNRFa64WvtvFqwqYfkJvkk0Hod60Y5kZTUrKzmaRGLBsnbylycXK39wzMo_O0cNtxKForHSuLopx-u9X6utY8537Bk4R9rHaLzZmLpwQLTgnOejMXFSGUz_1hkh50ZUwFp_qI2Yya3ZdDllsnqJK&q={searchTerms}
HKU\S-1-5-21-2977373009-1723860718-2465262605-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.6789.com/?id=108
HKU\S-1-5-21-2977373009-1723860718-2465262605-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.startpageing123.com/?type=hp&ts=1490780292&z=cf09695ae02a900b2482c21gczdteecm5b5e2oat9o&from=che0812&uid=ST9500325AS_6VEGTHXGXXXX6VEGTHXG
SearchScopes: HKU\S-1-5-21-2977373009-1723860718-2465262605-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.startpageing123.com/?type=sc&ts=1490780292&z=cf09695ae02a900b2482c21gczdteecm5b5e2oat9o&from=che0812&uid=ST9500325AS_6VEGTHXGXXXX6VEGTHXG
CHR HomePage: Default -> hxxp://www.startpageing123.com/?type=hp&ts=1490780292&z=cf09695ae02a900b2482c21gczdteecm5b5e2oat9o&from=che0812&uid=ST9500325AS_6VEGTHXGXXXX6VEGTHXG
CHR StartupUrls: Default -> "hxxp://www.6789.com/?id=108"
CHR DefaultSearchURL: Default -> hxxp://www.startpageing123.com/search/?type=ds&ts=1490684232&z=df896073307d0a81e02927fgdz7t0eaqdb2z1o8c8b&from=che0812&uid=ST9500325AS_6VEGTHXGXXXX6VEGTHXG&q={searchTerms}
CHR DefaultSearchKeyword: Default -> startpageing123
StartMenuInternet: Google Chrome - C:\Program Files\Google\Chrome\Application\chrome.exe hxxp://www.startpageing123.com/?type=sc&ts=1490780292&z=cf09695ae02a900b2482c21gczdteecm5b5e2oat9o&from=che0812&uid=ST9500325AS_6VEGTHXGXXXX6VEGTHXG
R2 FirefoxU; C:\Program Files\Firefox\bin\FirefoxUpdate.exe [108720 2017-03-28] ()
R2 kxescore; c:\program files\kingsoft\kingsoft antivirus\kxescore.exe [326376 2017-03-20] (Kingsoft Corporation)
R2 Kyubey; C:\Users\GAH\AppData\Roaming\Kyubey\Kyubey.exe [240128 2017-03-29] () [Fichier non signé]
R2 Protecultsakt; C:\Program Files\Newughikeing\PlpVerfier.dll [149504 2017-01-30] () [Fichier non signé]
R2 QQPCRtp; C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QQPCRTP.exe [315920 2017-03-20] (Tencent)
R2 WinSAPSvc; C:\Users\GAH\AppData\Roaming\WinSAPSvc\WinSAP.dll [218624 2017-03-29] (Windows) [Fichier non signé]
R2 WINSNARE; C:\Users\GAH\AppData\Roaming\WINSNARE\WinSnare.dll [648704 2017-03-28] (InterSect Alliance Pty Ltd) [Fichier non signé] <==== ATTENTION
S2 cepowoxy; pas de ImagePath
S2 CommonFilesGoogle; rundll32.exe "C:\Program Files\Common Files\CommonFilesGoogle.dll",soeasy [X]
S2 gemeloki; pas de ImagePath
S2 serverws; C:\Windows\Temp\66B9.tmp [X]
S2 MS_CHECK_SVC; C:\Windows\System32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 Ntp2NetSvc; C:\Program Files\notepad2\notepad2.exe [2340864 2017-02-16] (Don HO don.h@free.fr) [Fichier non signé]
C:\Program Files\notepad2
S2 Ntp2UpSvc; C:\Program Files\Common Files\ntp2UpSvc\notepad2.exe [2340864 2017-02-16] (Don HO don.h@free.fr) [Fichier non signé]
C:\Program Files\Common Files\ntp2UpSvc
R1 KDHacker; c:\program files\kingsoft\kingsoft antivirus\security\kxescan\kdhacker.sys [146248 2017-03-20] (Kingsoft Corporation)
R2 kisknl; C:\Windows\system32\drivers\kisknl.sys [313936 2017-03-20] (Kingsoft Corporation)
R1 kisnetm; c:\program files\kingsoft\kingsoft antivirus\security\ksnetm\kisnetm.sys [113464 2017-03-20] (Kingsoft Corporation)
R2 ksapi; C:\Windows\system32\drivers\ksapi.sys [113744 2017-03-20] (Kingsoft Corporation)
R1 QMIEProtect; C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QMIEProtect.sys [60024 2017-03-20] (Tencent)
R1 QMUdisk; C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QMUdisk.sys [113144 2017-03-15] (Tencent)
R2 QQSysMon; C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QQSysMon.sys [121464 2017-03-20] (电脑管家)
R1 softaal; C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\softaal.sys [43640 2017-03-20] (Tencent)
R3 TAOAccelerator; C:\Windows\system32\Drivers\TAOAccelerator.sys [133464 2017-03-20] (Tencent)
R1 TAOKernelDriver; C:\Windows\system32\Drivers\TAOKernel.sys [107512 2017-03-20] (Tencent Technology(Shenzhen) Company Limited)
R1 TFsFlt; C:\Windows\System32\Drivers\TFsFlt.sys [157688 2017-03-20] (电脑管家)
R3 TS888; C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\TS888.sys [37752 2017-03-29] (Tencent)
R1 TsDefenseBt; C:\Windows\System32\DRIVERS\TSDefenseBt.sys [14008 2017-03-20] (Tencent)
R0 TSFLTMGR; C:\Windows\System32\DRIVERS\TSFLTMGR.SYS [137272 2017-03-20] (电脑管家)
R1 Tsksp; C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\TSKsp.sys [218968 2017-03-20] (电脑管家)
R2 tsnethlp; C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\TsNetHlp.sys [52216 2017-03-20] ()
R4 TSSysKit; C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\TSSysKit.sys [109560 2017-03-20] (电脑管家)
R2 wfpgameprotect; C:\Users\GAH\AppData\Local\Temp\892A.tmp.sys [24944 2017-03-29] (北京万辰博海文化传播有限公司. ) [Fichier non signé] <==== ATTENTION
C:\Windows\system32\Drivers\TAOKernel.sys
C:\Windows\system32\Drivers\TS888.sys
C:\ProgramData\TXQMPC
C:\Windows\system32\Drivers\TAOAccelerator.sys
C:\Program Files\settings.dat
C:\Program Files\reports
C:\Users\GAH\AppData\Local\Firefox
C:\Users\GAH\AppData\Roaming\Firefox
C:\Program Files\Firefox
C:\Users\Public\Documents\report.dat
C:\Users\GAH\AppData\Roaming\WINSNARE
C:\Users\GAH\AppData\Roaming\Kyubey
C:\Program Files\WinSnare(4.4.0)
C:\Users\Public\Documents\temp.dat
C:\Users\GAH\AppData\Roaming\WinSAPSvc
C:\Windows\system32\{24FBF75C-A260-43D7-9CBC-AC199EA05F9A}
C:\Program Files\58DA0903tmp
C:\Program Files\58DA090C_cacayima
C:\Program Files\58D43890_cacayima
C:\ProgramData\KRSHistory
C:\Users\GAH\AppData\Local\BIT1767.tmp
C:\Users\GAH\AppData\Roaming\shoujizhushou
C:\Users\GAH\AppData\Local\Kingsoft
C:\Windows\system32\Drivers\TSDefenseBt.sys
C:\Program Files\Common Files\Tencent
C:\Windows\system32\Drivers\TFsFlt.sys
C:\Windows\system32\Drivers\TsFltMgr.sys
C:\Program Files\Tencent
C:\KRECYCLE
C:\Users\GAH\AppData\Roaming\Tencent
C:\ProgramData\Tencent
C:\Users\GAH\AppData\Roaming\Kingsoft
C:\ProgramData\kdesk
C:\Windows\system32\config\KAVEventLog.EVT
C:\ProgramData\Kingsoft
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\金山毒霸
C:\Program Files\kingsoft
C:\Windows\system32\Drivers\kisknl_del.sys
C:\Windows\system32\Drivers\kisknl.sys
C:\Windows\system32\Drivers\kisnetmxp.sys
C:\Windows\system32\Drivers\ksapi.sys
C:\Windows\system32\Drivers\kisnetm.sys
C:\Windows\system32\Drivers\kisnetm64.sys
C:\Windows\system32\Drivers\ksapi64.sys
C:\Windows\system32\Drivers\ksskrpr.sys
C:\Windows\system32\{99A8BBDC-E996-4A0A-B43B-6605887BE113}
C:\Windows\system32\4
C:\Windows\system32\3
C:\Program Files\e6d6ebfa-69f5-43b9-8a35-7704f2ca49171486589032
C:\Program Files\owitrgcu
C:\Program Files\Newughikeing
C:\Program Files\metadata
C:\Program Files\settings.dat
C:\Users\GAH\AppData\Roaming\Antone.exe
C:\Users\GAH\AppData\Roaming\Antone.tst
C:\Users\GAH\AppData\Roaming\Bluetam.bin
C:\Users\GAH\AppData\Roaming\Geoflex.bin
C:\Users\GAH\AppData\Roaming\Tamfix.bin
HKU\S-1-5-21-2977373009-1723860718-2465262605-1000\...\ChromeHTML: -> C:\Program Files\Baghair\Application\chrome.exe (Google Inc.) <==== ATTENTION
C:\Program Files\Baghair
C:\Users\GAH\AppData\Local\Baghair
Task: {78614F6E-F726-4F17-8D02-DBA1EF332CF4} - System32\Tasks\Milimili => C:\Program Files\MIO\MIO.exe [2017-02-06] ()
C:\Program Files\MIO
Task: {FF320F77-75C0-4F2B-8950-54387041F6A1} - System32\Tasks\7454m57u32q632 => Rundll32.exe "C:\ProgramData\7454m57u32q632\7454m57u32q632.dll",muqsjyd <==== ATTENTION
C:\ProgramData\7454m57u32q632
WMI_ActiveScriptEventConsumer_ASEC: <===== ATTENTION
ShortcutWithArgument: C:\Users\GAH\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.startpageing123.com/?type=sc&ts=1490780292&z=cf09695ae02a900b2482c21gczdteecm5b5e2oat9o&from=che0812&uid=ST9500325AS_6VEGTHXGXXXX6VEGTHXG
ShortcutWithArgument: C:\Users\GAH\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files\Baghair\Application\chrome.exe (Google Inc.) -> --load-extension="C:\Users\GAH\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk" hxxp://qtipr.com/
ShortcutWithArgument: C:\Users\GAH\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files\Baghair\Application\chrome.exe (Google Inc.) -> --load-extension="C:\Users\GAH\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk" hxxp://qtipr.com/
ShortcutWithArgument: C:\Users\GAH\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files\Firefox\Firefox.exe (Mozilla Corporation) -> hxxp://qtipr.com/
ShortcutWithArgument: C:\Users\GAH\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk -> C:\Program Files\Baghair\Application\chrome.exe (Google Inc.) -> --load-extension="C:\Users\GAH\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk" hxxp://qtipr.com/
ShortcutWithArgument: C:\Users\GAH\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mozilla Firefox.lnk -> C:\Program Files\Firefox\Firefox.exe (Mozilla Corporation) -> hxxp://qtipr.com/
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files\Baghair\Application\chrome.exe (Google Inc.) -> --load-extension="C:\Users\GAH\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk" hxxp://qtipr.com/
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files\Firefox\Firefox.exe (Mozilla Corporation) -> hxxp://qtipr.com/
ShortcutWithArgument: C:\Users\Public\Desktop\Mozilla Firefox.lnk -> C:\Program Files\Firefox\Firefox.exe (Mozilla Corporation) -> hxxp://qtipr.com/
FirewallRules: [{B7CB3A1D-F1D7-448F-BB7F-67D73AC358A7}] => (Allow) C:\Users\GAH\AppData\Local\Temp\is-8TTAO.tmp\download\MiniThunderPlatform.exe
FirewallRules: [{D6D7BB26-7391-4F66-8B16-FCD2A1BA2558}] => (Allow) C:\Windows\Temp\66B9.tmp
FirewallRules: [{FEC4713E-3CF1-4B1B-91EF-023012B5E432}] => (Allow) C:\Program Files\Baghair\Application\chrome.exe
FirewallRules: [{D045720D-D262-4F25-A99B-8FF2F357B056}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QQPCTray.exe
FirewallRules: [{4D9E2493-8E3D-4717-AC75-25AA18959ADB}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QQPCMgr.exe
FirewallRules: [{2C718D6F-842B-483D-8923-8B51E34D008A}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QQPCRTP.exe
FirewallRules: [{68AF0909-F0AB-4275-BEA0-5676BC6934D0}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QMDL.exe
FirewallRules: [{0B2FCC26-D6F1-4D4C-B398-AE78E64DF4EA}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\bugreport.exe
FirewallRules: [{3F2D9220-7F0F-40EC-B64D-E85B01C7AC41}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QQPCFileOpen.exe
FirewallRules: [{E113CD66-31FB-4258-923B-2A83FE839B37}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QQPCLeakScan.exe
FirewallRules: [{66A152D6-3047-45AA-BC07-A519A5685E91}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QQPConfig.exe
FirewallRules: [{DF29CF0B-1216-4CA7-AB99-811924CB3784}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QQPCSoftMgr.exe
FirewallRules: [{054DD36C-2600-4ED1-9558-AA1D132F34E8}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\plugins\QMNetMon\QQPCNetFlow.exe
FirewallRules: [{7E973A66-D237-41A1-8B84-278BCCE06850}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QQPCBTU.exe
FirewallRules: [{D864730B-1BF6-459C-9720-526F4E9A37AC}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QQPCClinic.exe
FirewallRules: [{F6902E22-785A-455B-8953-5889C6B4260C}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QQPCLaunch.exe
FirewallRules: [{26E0014F-A180-4382-89F0-6C5110FA0561}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QMUpdate\QQPCMgrUpdate.exe
FirewallRules: [{C0D8228F-3D10-48CF-8EFA-24CEAFCD4A08}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QQPCSoftGame.exe
FirewallRules: [{40BCE319-6922-46F2-B9DA-6404480BF8AF}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QQPCSysOptimize.exe
FirewallRules: [{11D51D2B-B7CD-4F10-B2F5-896390892F8F}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QQPCUpdateAVLib.exe
FirewallRules: [{C2BFCE15-9B80-43EF-92B9-6EF957DDC18F}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QQRepair.exe
FirewallRules: [{6B5F7405-A060-43E3-BD43-9AE463484042}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\Uninst.exe
FirewallRules: [{87E83720-F421-4E4D-BC28-698506E18E7A}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QQPCPatch.exe
FirewallRules: [{1DEC24DE-1A13-4DD8-A133-3D2103C8ADE3}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\TpkUpdate.exe
FirewallRules: [{251612C1-A725-454D-8782-AE7460784A8C}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QMAccountProtection.exe
FirewallRules: [{7D3D83DB-EC18-40EE-BE0B-818BF6664C3A}] => (Allow) C:\Program Files\Tencent\QQPCMgr\12.1.18202.223\QMAdBlock.exe
FirewallRules: [{C3568971-D530-4FE0-A410-2DC68B012EB7}] => (Allow) C:\program files\common files\tencent\qqdownload\130\tencentdl.exe
FirewallRules: [{B614C9EE-7F1E-4F4B-8683-884D7C5CAE7F}] => (Allow) C:\program files\common files\tencent\qqdownload\130\bugreport_xf.exe
FirewallRules: [{4991C68D-EAA9-4F05-AA5B-7FA53D0F8C33}] => (Allow) C:\Program Files\Maoha\MaohaAP\MaohaWifiSvr.exe
FirewallRules: [{E59A84E7-19CF-44A2-AF9D-7F31A74C2EF6}] => (Allow) C:\Program Files\Firefox\bin\FirefoxUpdate.exe
FirewallRules: [{0A4546A2-193F-4ADE-9F58-84C0A6F46705}] => (Allow) C:\Program Files\Firefox\Firefox.exe
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0F7B5011-72EC-493D-A7BF-546591047E8E}" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7CC4BD9A-10F3-432B-A037-AE9FCE1F9B64}" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{10CB3D4C-21FB-43AA-B191-AF187522EEE8}" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kingsoft Internet Security" /f
Hosts:
EmptyTemp:
end


--> Enregistre le fichier dans le dossier "Téléchargements" (au même endroit que FRST) sous le nom fixlist.txt
--> Lance FRST (Sous Windows Vista/7/8/10, clic droit sur FRST > Exécuter en tant qu'administrateur).
--> Clique sur Corriger. Patiente le temps de la correction.

Note : si l'outil a besoin d'un redémarrage, accepte pour qu'il termine son travail.

--> Une fois la correction terminée, un rapport Fixlog.txt remplacera le fichier fixlist.
--> Héberge le rapport sur pjjoint.malekal.com et copie-colle le lien fourni dans ta prochaine réponse.

ok je le fais merci

Ok

non je n'ai plus de pubs intempestives

lien pour addition
http://pjjoint.malekal.com/files.php?id=20170413_u12b6v11m8u6

lien pour FRST.txt
http://pjjoint.malekal.com/files.php?id=FRST_20170413_146e11n9m8

Tu as utilisé une clé USB infectée ?

Un nouveau fixlist pour l'option "Corriger" de FRST :

start
CreateRestorePoint:
CloseProcesses:
HKU\S-1-5-21-2977373009-1723860718-2465262605-1000\...\Run: [Windows Update] => C:\Google\Windowsupdate.lnk [515 1980-01-04] ()
HKU\S-1-5-21-2977373009-1723860718-2465262605-1000\...\Run: [AdopeUpdate] => C:\Google\GoogleUpdate.lnk [633 2014-08-28] ()
HKU\S-1-5-21-2977373009-1723860718-2465262605-1000\...\Run: [AdopeFlash] => C:\Google\AutoIt3.exe [750320 2012-01-29] (AutoIt Team)
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1491432620&z=3874ac4526d240ee7dbe8b1g7zctdg9z0c3o5q2o3e&from=che0812&uid=ST9500325AS_6VEGTHXGXXXX6VEGTHXG&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1491432620&z=3874ac4526d240ee7dbe8b1g7zctdg9z0c3o5q2o3e&from=che0812&uid=ST9500325AS_6VEGTHXGXXXX6VEGTHXG&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2977373009-1723860718-2465262605-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1491432620&z=3874ac4526d240ee7dbe8b1g7zctdg9z0c3o5q2o3e&from=che0812&uid=ST9500325AS_6VEGTHXGXXXX6VEGTHXG&q={searchTerms}
S2 SNARER; C:\Windows\System32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 wfpgameprotect; C:\Users\GAH\AppData\Local\Temp\892A.tmp.sys [24944 2017-04-10] (北京万辰博海文化传播有限公司. ) [Fichier non signé] <==== ATTENTION
S1 iSafeKrnlMon; \??\C:\Program Files\Elex-tech\YAC\iSafeKrnlMon.sys [X]
C:\Windows\system32\Drivers\iSafeNetFilter.sys
C:\Users\GAH\AppData\Roaming\SNARER
C:\Program Files\SNARE(4.4.6)
C:\Program Files\WINSNARE(4.4.6)
C:\Users\GAH\AppData\Local\clean
C:\Google
C:\ProgramData\ProgramData.lnk
FirewallRules: [{8C402FCA-7E54-4B88-B607-0E0E06F0296A}] => (Allow) C:\Program Files\MIO\loader\st9500325as_6vegthxgxxxx6vegthxg.dat
FirewallRules: [{36CD1AA8-CB71-47E5-84DA-FCE76916C5D3}] => (Allow) C:\Program Files\MIO\loader\st9500325as_6vegthxgxxxx6vegthxg.dat
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5BEFAE45-636B-48E3-AB2D-49E08AB0C836}" /f
EmptyTemp:
end