UCGuard

Bonjour Destrio,

Voici le lien FRST : https://pjjoint.malekal.com/files.php?id=FRST_20170603_o7r6n6w6q5
et le lien Addition : https://pjjoint.malekal.com/files.php?id=20170603_p5e10w12e6u14

Merci

"Emotiplus"

"QQ2003 SA"

--> Ces logiciels sont-il voulus ?

Le script de suppression est prêt, j'attends juste ta réponse pour les inclure ou non.

Ok, désinstalle-les puis fais ceci :

--> Ouvre le Bloc-notes.
--> Copie-colle le texte en gras ci-dessous dans le Bloc-notes :


start
CreateRestorePoint:
CloseProcesses:
HKLM-x32\...\Run: [mcpltui_exe] => "C:\Program Files\Common~1\McAfee\Platform\mcuicnt.exe" /platui /runkey
ShellIconOverlayIdentifiers: [JzShlobj] -> {7B286609-DA97-47E1-AC6B-33B8B4732C95} => C:\Program Files\ZipTool\JZipExt.dll -> Pas de fichier
C:\Program Files\ZipTool
Startup: C:\Users\Louis Bonneau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cb94c56c7ce912c44e0787de257bc820.exe [2017-06-03] ()
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope la valeur est absente
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1642951985-2161069645-3994995789-1001 -> {C865866B-6FAD-4826-872E-26B92D0B3239} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - Pas de fichier
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - Pas de fichier
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - Pas de fichier
FF SearchPlugin: C:\Users\Louis Bonneau\AppData\Roaming\Mozilla\Firefox\Profiles\jv07wfjw.default-1439727511759\searchplugins\McSiteAdvisor.xml [2016-03-20]
C:\Users\Louis Bonneau\AppData\Roaming\Firefox
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi => non trouvé(e)
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi => non trouvé(e)
C:\Program Files (x86)\McAfee
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [Pas de fichier]
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [Pas de fichier]
CHR DefaultProfile: nabokprewerckthataph
CHR Profile: C:\Users\Louis Bonneau\AppData\Local\Google\Chrome\User Data\nabokprewerckthataph [2017-05-27] <==== ATTENTION
S2 GTFPOQUOTT Updater; C:\Program Files (x86)\GTFPOQUOTT Updater\GTFPOQUOTT Updater.exe [X]
C:\Program Files (x86)\GTFPOQUOTT Updater
S2 McAPExe; "C:\Program Files\McAfee\MSC\McAPExe.exe" [X]
C:\Program Files\McAfee
S3 McAWFwk; c:\PROGRA~1\COMMON~1\mcafee\actwiz\mcawfwk.exe [X]
S2 mccspsvc; "C:\Program Files\Common Files\McAfee\CSP\1.3.336.0\McCSPServiceHost.exe" [X]
C:\Program Files\Common Files\McAfee
S4 McOobeSv2; "C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe" /McCoreSvc [X]
S2 mcpltsvc; "C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe" /McCoreSvc [X]
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
C:\Windows\System32\drivers\HipShieldK.sys
S3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [447440 2014-09-19] (McAfee, Inc.)
C:\Windows\system32\DRIVERS\mfencbdc.sys
S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [96600 2014-09-19] (McAfee, Inc.)
C:\Windows\system32\DRIVERS\mfencrk.sys
R1 UCGuard; C:\Windows\System32\DRIVERS\ucguard.sys [81792 2016-07-04] (Huorong Borui (Beijing) Technology Co., Ltd.) <==== ATTENTION
C:\Windows\System32\DRIVERS\ucguard.sys
S3 mfesapsn; \??\C:\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys [X]
HKU\S-1-5-21-1642951985-2161069645-3994995789-1001\...\Run: [EmotiplusHelper] => C:\Users\Louis Bonneau\AppData\Local\EmotiplusHelper\EmotiplusHelper.exe [136088 2017-02-03] (Emotiplus)
C:\Users\Louis Bonneau\AppData\Local\EmotiplusHelper
Startup: C:\Users\Louis Bonneau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Emotiplus.lnk [2016-08-04]
ShortcutTarget: Emotiplus.lnk -> C:\Users\Louis Bonneau\AppData\Local\Emotiplus\Emotiplus.exe (Emotiplus)
C:\Users\Louis Bonneau\AppData\Local\Emotiplus
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QQ.lnk [2016-08-07]
ShortcutTarget: QQ.lnk -> C:\Program Files (x86)\QQ\Africa2003\QQ.exe ()
C:\program files (x86)\qq
C:\Users\Louis Bonneau\AppData\Roaming\AdbWinApi.dll
C:\Users\Louis Bonneau\AppData\Roaming\AdbWinUsbApi.dll
C:\Users\Louis Bonneau\AppData\Roaming\agent.dat
C:\Users\Louis Bonneau\AppData\Roaming\Installer.dat
C:\Users\Louis Bonneau\AppData\Roaming\Main.dat
C:\Users\Louis Bonneau\AppData\Roaming\setup.apk
C:\Users\Louis Bonneau\AppData\Roaming\ziptool_wc-9015_setup.exe
Task: {1AC9574E-6F79-4CB6-BD3B-3F7C392FE2D2} - System32\Tasks\{FDD5B2DA-2011-468A-8371-55A646419EC0} => pcalua.exe -a "C:\Program Files (x86)\Common Files\Blackdox\uninstall.exe" -c shuz -f "C:\Program Files (x86)\Common Files\Blackdox\uninstall.dat" -a uninstallme 48B58811-1879-422A-9E9F-4E950621A5AA DeviceId=600602fd-4b48-5a89-b4e5-0016a7839fed BarcodeId=51198003 ChannelId=3 DistributerName=APSFWakeNet
Task: {5FE28F95-4EA2-4E3D-ACAF-86478D42E0D8} - \UCBrowserUpdater -> Pas de fichier <==== ATTENTION
ShortcutWithArgument: C:\Users\Louis Bonneau\Desktop\Louis - Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory="nabokprewerckthataph"
ShortcutWithArgument: C:\Users\Louis Bonneau\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Applications Chrome\Bureau à distance Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=nabokprewerckthataph --app-id=gbchcmhmhahfdphkhkmpfmihenigjmpp
ShortcutWithArgument: C:\Users\Louis Bonneau\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\cf68c5a319200781\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=nabokprewerckthataph
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
FirewallRules: [{85180A67-43C8-4623-8932-663E803F6E47}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{49A3E56B-FEC3-4069-8E8A-668AD0488871}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{A451E274-53E1-4CD5-B30A-94F6DE299391}] => (Allow) C:\Program Files (x86)\Firefox\firefox.exe
FirewallRules: [{0F341929-737F-428B-A710-D87617E68DEC}] => (Allow) C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe
FirewallRules: [{40655BB3-B110-44DA-918C-95DE1E8A4358}] => (Allow) C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe
FirewallRules: [{7FD6760A-A225-4E1E-93E0-956749810746}] => (Allow) C:\Program Files (x86)\Firefox\Firefox.exe
FirewallRules: [{1E8BF083-0636-4E57-B34F-F3E1EEBF540E}] => (Allow) C:\Program Files (x86)\Firefox\Firefox.exe
FirewallRules: [TCP Query User{B9DBB96F-D7D6-47D5-A829-5A6C91367573}C:\program files (x86)\qq\africa2003\qq.exe] => (Allow) C:\program files (x86)\qq\africa2003\qq.exe
FirewallRules: [UDP Query User{AC626028-45C5-4465-921D-7384FAFB58BF}C:\program files (x86)\qq\africa2003\qq.exe] => (Allow) C:\program files (x86)\qq\africa2003\qq.exe
FirewallRules: [{34282C23-16BC-42DA-97D9-54131BAF5EAA}] => (Allow) C:\Users\Louis Bonneau\AppData\Local\Temp\Nvidia.exe
FirewallRules: [{4B310C13-A8BB-488B-A3A7-0BF1192CC3F0}] => (Allow) C:\Users\Louis Bonneau\AppData\Local\Temp\Nvidia.exe
Reg: reg delete "HKU\S-1-5-21-1642951985-2161069645-3994995789-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Emotiplus" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QQ2003" /f
EmptyTemp:
end


--> Enregistre le fichier sur ton Bureau (au même endroit que FRST) sous le nom fixlist.txt
--> Lance FRST (Sous Windows Vista/7/8/10, clic droit sur FRST > Exécuter en tant qu'administrateur).
--> Clique sur Corriger. Patiente le temps de la correction.

Note : si l'outil a besoin d'un redémarrage, accepte pour qu'il termine son travail.

--> Une fois la correction terminée, un rapport Fixlog.txt remplacera le fichier fixlist.
--> Héberge le rapport sur http://pjjoint.malekal.com/ et copie-colle le lien fourni dans ta prochaine réponse.