View original (French)

Script hôte de la fenêtre : impossible de trouver c/kernel/r00t3r

Solved
Kfest Posted messages 9 Status Member -  
Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   -
For the past few days, the message "windows host script: can not find c/kernel/r00t3r" appears each time I start my laptop running Windows 7. Please help me, sincerely I am overwhelmed. I've been searching tirelessly for a solution but to no avail.
Any solution is welcome.
Thank you!!!

3 answers

  1.
    Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Hello,

    Follow the FRST tutorial. ( take the time to read it carefully - everything is well explained ).

    Download and run the FRST scan,
    Wait for the scan to finish, a message will indicate that the analysis is complete.

    Three FRST reports will be generated:
    • FRST.txt
    • Shortcut.txt
    • Additionnal.txt


    Send these 3 reports to the website https://pjjoint.malekal.com/ and return with the 3 pjjoint links leading to the reports here in a new response so we can review them.

    --
    Please press any key to continue the disinfection...
    1
  2. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    this computer is completely infested..
    Trojan, Adwares..
    You need to stop downloading cracks.

    Uninstall Wise Registry Cleaner
    It's useless.

    Here is the correction to be made with FRST. You can use this explanatory note with screenshots.

    Open Notepad: Press Windows + R,
    In the "Run" field, type notepad and OK.
    Copy/Paste the following into it: 

    CreateRestorePoint:
    CloseProcesses:
    S2 Windows; C:\Windows\svchost.exe [177152 2017-08-09] () [Unsigned file]
    S2 ReimageRealTimeProtector; C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [X]
    S2 XobniService; "C:\Program Files (x86)\Xobni\XobniService.exe" [X]
    2017-08-09 15:35 - 2017-08-09 15:35 - 000001481 ___RS C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnеt Еxрlorеr.lnk
    2017-08-09 15:35 - 2017-08-09 15:35 - 000000000 ____D C:\Users\Utilisateur\AppData\Roaming\SPI
    2017-08-09 15:34 - 2017-08-12 16:07 - 000000000 ____D C:\Users\Utilisateur\AppData\Roaming\Valit
    2017-08-09 15:34 - 2017-08-09 15:35 - 000000000 ____D C:\Users\Utilisateur\AppData\Roaming\1337
    2017-08-09 15:34 - 2017-08-09 15:34 - 000000000 ___HD C:\ProgramData\MicrosoftCorporation
    2017-08-09 15:33 - 2017-08-09 15:33 - 000177152 _____ C:\Windows\svchost.exe
    2017-08-09 15:33 - 2017-08-09 15:33 - 000073216 _____ C:\Windows\taskmgr.exe
    2017-08-09 20:56 - 2017-08-09 20:56 - 000003470 _____ C:\Windows\System32\Tasks\Reimage Reminder
    2017-08-09 20:54 - 2017-08-09 20:54 - 000004298 _____ C:\Windows\System32\Tasks\ReimageUpdater
    2017-08-09 20:54 - 2017-08-09 20:54 - 000000004 _____ C:\ProgramData\_lg.3sap
    2017-08-09 20:53 - 2017-08-09 20:54 - 000000000 ____D C:\ProgramData\Reimage Protector
    2017-08-09 20:51 - 2017-08-09 20:56 - 000000140 _____ C:\Windows\Reimage.ini
    2017-08-09 19:48 - 2017-08-09 19:56 - 000000000 ____D C:\Program Files\TNod User & Password Finder
    HKLM\...\Policies\Explorer\Run: [Updates] => C:\system32\SystemProtection.exe [168960 2009-07-14] (Microsoft Corporation)
    HKLM\ DisallowedCertificates: 03D22C9C66915D58C88912B64C1F984B8344EF09 (Comodo Security Solutions) <==== WARNING
    HKLM\ DisallowedCertificates: 0F684EC1163281085C6AF20528878103ACEFCAAB (F-Secure Corporation) <==== WARNING
    HKLM\ DisallowedCertificates: 1667908C9E22EFBD0590E088715CC74BE4C60884 (FRISK Software International/F-Prot) <==== WARNING
    HKLM\ DisallowedCertificates: 18DEA4EFA93B06AE997D234411F3FD72A677EECE (Bitdefender SRL) <==== WARNING
    HKLM\ DisallowedCertificates: 2026D13756EB0DB753DF26CB3B7EEBE3E70BB2CF (G DATA Software AG) <==== WARNING
    HKLM\ DisallowedCertificates: 249BDA38A611CD746A132FA2AF995A2D3C941264 (Malwarebytes Corporation) <==== WARNING
    HKLM\ DisallowedCertificates: 31AC96A6C17C425222C46D55C3CCA6BA12E54DAF (Symantec Corporation) <==== WARNING
    HKLM\ DisallowedCertificates: 331E2046A1CCA7BFEF766724394BE6112B4CA3F7 (Trend Micro) <==== WARNING
    HKLM\ DisallowedCertificates: 3353EA609334A9F23A701B9159E30CB6C22D4C59 (Webroot Inc.) <==== WARNING
    HKLM\ DisallowedCertificates: 373C33726722D3A5D1EDD1F1585D5D25B39BEA1A (SUPERAntiSpyware.com) <==== WARNING
    HKLM\ DisallowedCertificates: 3850EDD77CC74EC9F4829AE406BBF9C21E0DA87F (Kaspersky Lab) <==== WARNING
    HKLM\ DisallowedCertificates: 3D496FA682E65FC122351EC29B55AB94F3BB03FC (AVG Technologies CZ) <==== WARNING
    HKLM\ DisallowedCertificates: 4243A03DB4C3C15149CEA8B38EEA1DA4F26BD159 (PC Tools) <==== WARNING
    HKLM\ DisallowedCertificates: 42727E052C0C2E1B35AB53E1005FD9EDC9DE8F01 (K7 Computing Pvt Ltd) <==== WARNING
    HKLM\ DisallowedCertificates: 4420C99742DF11DD0795BC15B7B0ABF090DC84DF (Doctor Web Ltd.) <==== WARNING
    HKLM\ DisallowedCertificates: 4C0AF5719009B7C9D85C5EAEDFA3B7F090FE5FFF (Emsisoft Ltd) <==== WARNING
    HKLM\ DisallowedCertificates: 5240AB5B05D11B37900AC7712A3C6AE42F377C8C (Check Point Software Technologies Ltd.) <==== WARNING
    HKLM\ DisallowedCertificates: 5DD3D41810F28B2A13E9A004E6412061E28FA48D (Emsisoft Ltd) <==== WARNING
    HKLM\ DisallowedCertificates: 7457A3793086DBB58B3858D6476889E3311E550E (K7 Computing Pvt Ltd) <==== WARNING
    HKLM\ DisallowedCertificates: 76A9295EF4343E12DFC5FE05DC57227C1AB00D29 (BullGuard Ltd) <==== WARNING
    HKLM\ DisallowedCertificates: 775B373B33B9D15B58BC02B184704332B97C3CAF (McAfee) <==== WARNING
    HKLM\ DisallowedCertificates: 872CD334B7E7B3C3D1C6114CD6B221026D505EAB (Comodo Security Solutions) <==== WARNING
    HKLM\ DisallowedCertificates: 88AD5DFE24126872B33175D1778687B642323ACF (McAfee) <==== WARNING
    HKLM\ DisallowedCertificates: 9132E8B079D080E01D52631690BE18EBC2347C1E (Adaware Software) <==== WARNING
    HKLM\ DisallowedCertificates: 982D98951CF3C0CA2A02814D474A976CBFF6BDB1 (Safer Networking Ltd.) <==== WARNING
    HKLM\ DisallowedCertificates: 9A08641F7C5F2CCA0888388BE3E5DBDDAAA3B361 (Webroot Inc.) <==== WARNING
    HKLM\ DisallowedCertificates: 9C43F665E690AB4D486D4717B456C5554D4BCEB5 (ThreatTrack Security) <==== WARNING
    HKLM\ DisallowedCertificates: 9E3F95577B37C74CA2F70C1E1859E798B7FC6B13 (CURIOLAB S.M.B.A.) <==== WARNING
    HKLM\ DisallowedCertificates: A1F8DCB086E461E2ABB4B46ADCFA0B48C58B6E99 (Avira Operations GmbH & Co. KG) <==== WARNING
    HKLM\ DisallowedCertificates: A5341949ABE1407DD7BF7DFE75460D9608FBC309 (BullGuard Ltd) <==== WARNING
    HKLM\ DisallowedCertificates: A59CC32724DD07A6FC33F7806945481A2D13CA2F (ESET) <==== WARNING
    HKLM\ DisallowedCertificates: AB7E760DA2485EA9EF5A6EEE7647748D4BA6B947 (AVG Technologies CZ) <==== WARNING
    HKLM\ DisallowedCertificates: AD4C5429E10F4FF6C01840C20ABA344D7401209F (Avast Antivirus/Software) <==== WARNING
    HKLM\ DisallowedCertificates: AD96BB64BA36379D2E354660780C2067B81DA2E0 (Symantec Corporation) <==== WARNING
    HKLM\ DisallowedCertificates: B8EBF0E696AF77F51C96DB4D044586E2F4F8FD84 (Malwarebytes Corporation) <==== WARNING
    HKLM\ DisallowedCertificates: CDC37C22FE9272D8F2610206AD397A45040326B8 (Trend Micro) <==== WARNING
    HKLM\ DisallowedCertificates: D3F78D747E7C5D6D3AE8ABFDDA7522BFB4CBD598 (Kaspersky Lab) <==== WARNING
    HKLM\ DisallowedCertificates: DB303C9B61282DE525DC754A535CA2D6A9BD3D87 (ThreatTrack Security) <==== WARNING
    HKLM\ DisallowedCertificates: DB77E5CFEC34459146748B667C97B185619251BA (Avast Antivirus/Software) <==== WARNING
    HKLM\ DisallowedCertificates: E22240E837B52E691C71DF248F12D27F96441C00 (Total Defense, Inc.) <==== WARNING
    HKLM\ DisallowedCertificates: E513EAB8610CFFD7C87E00BCA15C23AAB407FCEF (AVG Technologies CZ) <==== WARNING
    HKLM\ DisallowedCertificates: ED841A61C0F76025598421BC1B00E24189E68D54 (Bitdefender SRL) <==== WARNING
    HKLM\ DisallowedCertificates: F83099622B4A9F72CB5081F742164AD1B8D048C9 (ESET) <==== WARNING
    HKLM\ DisallowedCertificates: FBB42F089AF2D570F2BF6F493D107A3255A9BB1A (Panda Security S.L) <==== WARNING
    HKLM\ DisallowedCertificates: FFFA650F2CB2ABC0D80527B524DD3F9FC172C138 (Doctor Web Ltd.) <==== WARNING
    HKU\S-1-5-21-2356778116-2662926543-2747011829-1000\...\Run: [Valit.vbs] => C:\Users\Utilisateur\AppData\Roaming\Valit\Valit.vbs [275 2017-08-09] ()
    Hosts:
    EmptyTemp:
    RemoveProxy:
    Reboot:


    Once the text is pasted in Notepad,
    Menu "File" then "Save As",
    On the left, go to the Desktop,
    In the bottom field, for the file name enter: fixlist.txt
    Click "Save", this will create fixlist.txt on the Desktop.

    Restart FRST and click on the "Fix" button
    A restart may be necessary ( not mandatory )
    A text file appears, copy/paste the content here in a new message.

    Restart the computer.

    2°)
    Reset/Repair the WEB browsers concerned by the issues:


    Here is the correction to be made with FRST. You can use this explanatory note with screenshots.

    Open Notepad: Press Windows + R,
    In the "Run" field, type notepad and OK.
    Copy/Paste the following into it: 

    CreateRestorePoint:
    CloseProcesses:
    S2 Windows; C:\Windows\svchost.exe [177152 2017-08-09] () [Unsigned file]
    S2 ReimageRealTimeProtector; C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [X]
    S2 XobniService; "C:\Program Files (x86)\Xobni\XobniService.exe" [X]
    2017-08-09 15:35 - 2017-08-09 15:35 - 000001481 ___RS C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnеt Еxрlorеr.lnk
    2017-08-09 15:35 - 2017-08-09 15:35 - 000000000 ____D C:\Users\Utilisateur\AppData\Roaming\SPI
    2017-08-09 15:34 - 2017-08-12 16:07 - 000000000 ____D C:\Users\Utilisateur\AppData\Roaming\Valit
    2017-08-09 15:34 - 2017-08-09 15:35 - 000000000 ____D C:\Users\Utilisateur\AppData\Roaming\1337
    2017-08-09 15:34 - 2017-08-09 15:34 - 000000000 ___HD C:\ProgramData\MicrosoftCorporation
    2017-08-09 15:33 - 2017-08-09 15:33 - 000177152 _____ C:\Windows\svchost.exe
    2017-08-09 15:33 - 2017-08-09 15:33 - 000073216 _____ C:\Windows\taskmgr.exe
    2017-08-09 20:56 - 2017-08-09 20:56 - 000003470 _____ C:\Windows\System32\Tasks\Reimage Reminder
    2017-08-09 20:54 - 2017-08-09 20:54 - 000004298 _____ C:\Windows\System32\Tasks\ReimageUpdater
    2017-08-09 20:54 - 2017-08-09 20:54 - 000000004 _____ C:\ProgramData\_lg.3sap
    2017-08-09 20:53 - 2017-08-09 20:54 - 000000000 ____D C:\ProgramData\Reimage Protector
    2017-08-09 20:51 - 2017-08-09 20:56 - 000000140 _____ C:\Windows\Reimage.ini
    2017-08-09 19:48 - 2017-08-09 19:56 - 000000000 ____D C:\Program Files\TNod User & Password Finder
    HKLM\...\Policies\Explorer\Run: [Updates] => C:\system32\SystemProtection.exe [168960 2009-07-14] (Microsoft Corporation)
    HKLM\ DisallowedCertificates: 03D22C9C66915D58C88912B64C1F984B8344EF09 (Comodo Security Solutions) <==== WARNING
    HKLM\ DisallowedCertificates: 0F684EC1163281085C6AF20528878103ACEFCAAB (F-Secure Corporation) <==== WARNING
    HKLM\ DisallowedCertificates: 1667908C9E22EFBD0590E088715CC74BE4C60884 (FRISK Software International/F-Prot) <==== WARNING
    HKLM\ DisallowedCertificates: 18DEA4EFA93B06AE997D234411F3FD72A677EECE (Bitdefender SRL) <==== WARNING
    HKLM\ DisallowedCertificates: 2026D13756EB0DB753DF26CB3B7EEBE3E70BB2CF (G DATA Software AG) <==== WARNING
    HKLM\ DisallowedCertificates: 249BDA38A611CD746A132FA2AF995A2D3C941264 (Malwarebytes Corporation) <==== WARNING
    HKLM\ DisallowedCertificates: 31AC96A6C17C425222C46D55C3CCA6BA12E54DAF (Symantec Corporation) <==== WARNING
    HKLM\ DisallowedCertificates: 331E2046A1CCA7BFEF766724394BE6112B4CA3F7 (Trend Micro) <==== WARNING
    HKLM\ DisallowedCertificates: 3353EA609334A9F23A701B9159E30CB6C22D4C59 (Webroot Inc.) <==== WARNING
    HKLM\ DisallowedCertificates: 373C33726722D3A5D1EDD1F1585D5D25B39BEA1A (SUPERAntiSpyware.com) <==== WARNING
    HKLM\ DisallowedCertificates: 3850EDD77CC74EC9F4829AE406BBF9C21E0DA87F (Kaspersky Lab) <==== WARNING
    HKLM\ DisallowedCertificates: 3D496FA682E65FC122351EC29B55AB94F3BB03FC (AVG Technologies CZ) <==== WARNING
    HKLM\ DisallowedCertificates: 4243A03DB4C3C15149CEA8B38EEA1DA4F26BD159 (PC Tools) <==== WARNING
    HKLM\ DisallowedCertificates: 42727E052C0C2E1B35AB53E1005FD9EDC9DE8F01 (K7 Computing Pvt Ltd) <==== WARNING
    HKLM\ DisallowedCertificates: 4420C99742DF11DD0795BC15B7B0ABF090DC84DF (Doctor Web Ltd.) <==== WARNING
    HKLM\ DisallowedCertificates: 4C0AF5719009B7C9D85C5EAEDFA3B7F090FE5FFF (Emsisoft Ltd) <==== WARNING
    HKLM\ DisallowedCertificates: 5240AB5B05D11B37900AC7712A3C6AE42F377C8C (Check Point Software Technologies Ltd.) <==== WARNING
    HKLM\ DisallowedCertificates: 5DD3D41810F28B2A13E9A004E6412061E28FA48D (Emsisoft Ltd) <==== WARNING
    HKLM\ DisallowedCertificates: 7457A3793086DBB58B3858D6476889E3311E550E (K7 Computing Pvt Ltd) <==== WARNING
    HKLM\ DisallowedCertificates: 76A9295EF4343E12DFC5FE05DC57227C1AB00D29 (BullGuard Ltd) <==== WARNING
    HKLM\ DisallowedCertificates: 775B373B33B9D15B58BC02B184704332B97C3CAF (McAfee) <==== WARNING
    HKLM\ DisallowedCertificates: 872CD334B7E7B3C3D1C6114CD6B221026D505EAB (Comodo Security Solutions) <==== WARNING
    HKLM\ DisallowedCertificates: 88AD5DFE24126872B33175D1778687B642323ACF (McAfee) <==== WARNING
    HKLM\ DisallowedCertificates: 9132E8B079D080E01D52631690BE18EBC2347C1E (Adaware Software) <==== WARNING
    HKLM\ DisallowedCertificates: 982D98951CF3C0CA2A02814D474A976CBFF6BDB1 (Safer Networking Ltd.) <==== WARNING
    HKLM\ DisallowedCertificates: 9A08641F7C5F2CCA0888388BE3E5DBDDAAA3B361 (Webroot Inc.) <==== WARNING
    HKLM\ DisallowedCertificates: 9C43F665E690AB4D486D4717B456C5554D4BCEB5 (ThreatTrack Security) <==== WARNING
    HKLM\ DisallowedCertificates: 9E3F95577B37C74CA2F70C1E1859E798B7FC6B13 (CURIOLAB S.M.B.A.) <==== WARNING
    HKLM\ DisallowedCertificates: A1F8DCB086E461E2ABB4B46ADCFA0B48C58B6E99 (Avira Operations GmbH & Co. KG) <==== WARNING
    HKLM\ DisallowedCertificates: A5341949ABE1407DD7BF7DFE75460D9608FBC309 (BullGuard Ltd) <==== WARNING
    HKLM\ DisallowedCertificates: A59CC32724DD07A6FC33F7806945481A2D13CA2F (ESET) <==== WARNING
    HKLM\ DisallowedCertificates: AB7E760DA2485EA9EF5A6EEE7647748D4BA6B947 (AVG Technologies CZ) <==== WARNING
    HKLM\ DisallowedCertificates: AD4C5429E10F4FF6C01840C20ABA344D7401209F (Avast Antivirus/Software) <==== WARNING
    HKLM\ DisallowedCertificates: AD96BB64BA36379D2E354660780C2067B81DA2E0 (Symantec Corporation) <==== WARNING
    HKLM\ DisallowedCertificates: B8EBF0E696AF77F51C96DB4D044586E2F4F8FD84 (Malwarebytes Corporation) <==== WARNING
    HKLM\ DisallowedCertificates: CDC37C22FE9272D8F2610206AD397A45040326B8 (Trend Micro) <==== WARNING
    HKLM\ DisallowedCertificates: D3F78D747E7C5D6D3AE8ABFDDA7522BFB4CBD598 (Kaspersky Lab) <==== WARNING
    HKLM\ DisallowedCertificates: DB303C9B61282DE525DC754A535CA2D6A9BD3D87 (ThreatTrack Security) <==== WARNING
    HKLM\ DisallowedCertificates: DB77E5CFEC34459146748B667C97B185619251BA (Avast Antivirus/Software) <==== WARNING
    HKLM\ DisallowedCertificates: E22240E837B52E691C71DF248F12D27F96441C00 (Total Defense, Inc.) <==== WARNING
    HKLM\ DisallowedCertificates: E513EAB8610CFFD7C87E00BCA15C23AAB407FCEF (AVG Technologies CZ) <==== WARNING
    HKLM\ DisallowedCertificates: ED841A61C0F76025598421BC1B00E24189E68D54 (Bitdefender SRL) <==== WARNING
    HKLM\ DisallowedCertificates: F83099622B4A9F72CB5081F742164AD1B8D048C9 (ESET) <==== WARNING
    HKLM\ DisallowedCertificates: FBB42F089AF2D570F2BF6F493D107A3255A9BB1A (Panda Security S.L) <==== WARNING
    HKLM\ DisallowedCertificates: FFFA650F2CB2ABC0D80527B524DD3F9FC172C138 (Doctor Web Ltd.) <==== WARNING
    HKU\S-1-5-21-2356778116-2662926543-2747011829-1000\...\Run: [Valit.vbs] => C:\Users\Utilisateur\AppData\Roaming\Valit\Valit.vbs [275 2017-08-09] ()
    Task: {36F0DA6E-11C3-4698-A28F-08DC944093E2} - System32\Tasks\Reimage Reminder => C:\Program Files\Reimage\Reimage Repair\ReimageReminder.exe <==== WARNING
    2017-08-09 15:36 - 2017-08-09 15:36 - 000635941 _____ (ZoZM9UAMB5DqfnM7q5Bj ) C:\Users\Utilisateur\AppData\Local\Temp\browmodule.exe
    Task: {B4556426-032B-4DB4-AD3E-6A81CC597AF0} - System32\Tasks\ReimageUpdater => C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe <==== WARNING
    Task: {B759D607-EB40-408F-8A32-3861C3B71B49} - System32\Tasks\Learning Channel Basic Editor => C:\Windows\system32\rundll32.exe "C:\Program Files\Learning Channel Basic Editor\Learning Channel Basic Editor.dll",oJRbHhhpgpQ <==== WARNING
    C:\Program Files\Learning Channel Basic Editor
    Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnеt Еxрlorеr.lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic
    Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Intеrnet Eхрlorer (Nо Аdd-оns).lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic
    Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Lаunсh Internеt Еxрlorеr Вrоwsеr.lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic
    Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Intеrnеt Ехрlоrеr.lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic
    Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Мozillа Firefoх.lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.xoferif.bat (No file) <==== Cyrillic
    Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Intеrnеt Eхplorеr.lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic
    C:\Users\Utilisateur\AppData\Roaming\Browsers
    Hosts:
    EmptyTemp:
    RemoveProxy:
    Reboot:


    Once the text is pasted in Notepad,
    Menu "File" then "Save As",
    On the left, go to the Desktop,
    In the bottom field, for the file name enter: fixlist.txt
    Click "Save", this will create fixlist.txt on the Desktop.

    Restart FRST and click on the "Fix" button
    A restart may be necessary ( not mandatory )
    A text file appears, copy/paste the content here in a new message.

    Restart the computer.

    <bold>3°)
    Finish with a cleanup using Malwarebytes - Malwarebytes Anti-Malware free version tutorial

    4°)
    Download and run https://forum.malekal.com/viewtopic.php?t=28637&start=TDSSKiller]
    Click "Skip" on detections. Click on the top right "reports".
    Send the content of the TDSSKiller report to https://pjjoint.malekal.com/
    Provide the link of the pjjoint report in a new message for review.

    --
    Please press any key to continue the disinfection...
    1
    2. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712 > Kfest Posted messages 9 Status Member
       
      D'accord, partage le texte à traduire et je m'en occuperai.
      0
    3. Kfest Posted messages 9 Status Member > Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention  
       
      Alright Boss,
      Thank you, one last thing?
      Can we be more in touch, I mean privately?
      0
    4. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712 > Kfest Posted messages 9 Status Member
       
      Where is the TDSSkiller report?
      0
  3. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Yep, that should be good =)

    Here is the correction to be made with FRST. You can refer to this explanatory note with screenshots.

    Open Notepad: Windows Key + R,
    In the "Run" field, type notepad and OK.
    Copy/Paste the following into it: 

    CreateRestorePoint:
    CloseProcesses:
     C:\Users\Utilisateur\AppData\Roaming\Browsers
    Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnеt Еxрlorеr.lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic
    Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Intеrnet Eхрlorer (Nо Аdd-оns).lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic
    Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Lаunсh Internеt Еxрlorеr Вrоwsеr.lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic
    Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Intеrnеt Ехрlоrеr.lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic
    Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Intеrnеt Eхplorеr.lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic

    Hosts:
    EmptyTemp:
    RemoveProxy:
    Reboot:


    Once the text is pasted in Notepad,
    Go to "File" menu then "Save As",
    On the left, navigate to the Desktop,
    In the field below, file name enter: fixlist.txt
    Click on "Save", this will create fixlist.txt on the Desktop.

    Restart FRST and click on the "Fix" button
    A reboot may be necessary ( not mandatory )
    A text file will appear, copy/paste the content here in a new message.

    Restart the computer.

    --
    Please press a key to continue the disinfection...
    0