Windows explorer ouvre des pages seul Résolu

Question

Bonjour, 
Mon explorateur Windows explorer ouvre des pages tout seul sans mon avis ou à ma demande
Que faire pour bloquer cela définitivement?


Configuration: Windows / Opera Next 49.0.2725.47

Malekal_morte- · Answer

Salut,

Quelles pages ?

Commence par FRST :


Suis le tutoriel FRST. ( prends le temps de lire attentivement - tout y est bien expliqué ).

Télécharge et lance le scan FRST, 
Attendre la fin du scan, un message indique que l'analyse est terminée.

Trois rapports FRST seront générés :

 FRST.txt
 Shortcut.txt
 Additionnal.txt

Envoie ces 3 rapports sur le site https://pjjoint.malekal.com/ afin de les partager.
En retour donne les 3 liens pjjoint qui mènent aux rapports ici dans une nouvelle réponse afin que l'on puisse les consulter.

Malekal_morte- · Answer

Effectivement, infecté, surement suite au téléchargement d'un crack.

Désinstalle :
CCleaner
Google Toolbar for Internet Explorer
Java
Tu as aussi Trend-Micro qui tourne, si tu en l'as pas acheté, tu peux le désinstaller.

Voici la correction à effectuer avec FRST. Tu peux t'aider de cette note explicative avec des captures d'écran.

Ouvre le bloc-notes : Touche Windows + R,
Dans le champs "Exécuter", saisir notepad et OK.
Copie/Colle dedans ce qui suit :

CreateRestorePoint:
CloseProcesses:() 
HKLM-x32\...\Run: [] => [X] 
R2 AppriabuS; C:\ProgramData\\AppriabuS\\AppriabuS.exe [1814528 2017-12-21] (TODO: <Company name>) [File not signed]
R2 HNService; D:\Users\PBF32560\AppData\Local\AdService\AdService.dll [711168 2017-12-21] (HNService) [File not signed]
R2 Nettrans; C:\ProgramData\PrefsSecure\Nettrans.exe [43520 2017-12-21] () [File not signed] <==== ATTENTION
R2 SecureIM; C:\ProgramData\SecureIM.exe [2900632 2017-10-06] (Adobe Systems Incorporated) <==== ATTENTION
R2 tiser; C:\ProgramData\tiser\run.exe [14848 2017-11-06] () [File not signed]
 HKLM\...\RunOnce: [Lahin_Raw_barra_al3eb_b3id_YWWFYVGMUR.exe] => C:\Program Files\Windows Photo Viewer\OJGLUUFNAA\YWWFYVGMUR.exe [984064 2017-12-21] (Sa7u@JUnb) 
 HKLM\ DisallowedCertificates: 03D22C9C66915D58C88912B64C1F984B8344EF09 (Comodo Security Solutions) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 0F684EC1163281085C6AF20528878103ACEFCAAB (F-Secure Corporation) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 1667908C9E22EFBD0590E088715CC74BE4C60884 (FRISK Software International/F-Prot) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 18DEA4EFA93B06AE997D234411F3FD72A677EECE (Bitdefender SRL) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 2026D13756EB0DB753DF26CB3B7EEBE3E70BB2CF (G DATA Software AG) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 249BDA38A611CD746A132FA2AF995A2D3C941264 (Malwarebytes Corporation) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 31AC96A6C17C425222C46D55C3CCA6BA12E54DAF (Symantec Corporation) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 331E2046A1CCA7BFEF766724394BE6112B4CA3F7 (Trend Micro) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 3353EA609334A9F23A701B9159E30CB6C22D4C59 (Webroot Inc.) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 373C33726722D3A5D1EDD1F1585D5D25B39BEA1A (SUPERAntiSpyware.com) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 3850EDD77CC74EC9F4829AE406BBF9C21E0DA87F (Kaspersky Lab) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 3D496FA682E65FC122351EC29B55AB94F3BB03FC (AVG Technologies CZ) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 4243A03DB4C3C15149CEA8B38EEA1DA4F26BD159 (PC Tools) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 42727E052C0C2E1B35AB53E1005FD9EDC9DE8F01 (K7 Computing Pvt Ltd) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 4420C99742DF11DD0795BC15B7B0ABF090DC84DF (Doctor Web Ltd.) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 4C0AF5719009B7C9D85C5EAEDFA3B7F090FE5FFF (Emsisoft Ltd) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 5240AB5B05D11B37900AC7712A3C6AE42F377C8C (Check Point Software Technologies Ltd.) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 5DD3D41810F28B2A13E9A004E6412061E28FA48D (Emsisoft Ltd) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 7457A3793086DBB58B3858D6476889E3311E550E (K7 Computing Pvt Ltd) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 76A9295EF4343E12DFC5FE05DC57227C1AB00D29 (BullGuard Ltd) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 775B373B33B9D15B58BC02B184704332B97C3CAF (McAfee) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 872CD334B7E7B3C3D1C6114CD6B221026D505EAB (Comodo Security Solutions) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 88AD5DFE24126872B33175D1778687B642323ACF (McAfee) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 9132E8B079D080E01D52631690BE18EBC2347C1E (Adaware Software) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 982D98951CF3C0CA2A02814D474A976CBFF6BDB1 (Safer Networking Ltd.) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 9A08641F7C5F2CCA0888388BE3E5DBDDAAA3B361 (Webroot Inc.) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 9C43F665E690AB4D486D4717B456C5554D4BCEB5 (ThreatTrack Security) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 9E3F95577B37C74CA2F70C1E1859E798B7FC6B13 (CURIOLAB S.M.B.A.) <==== ATTENTION  
 HKLM\ DisallowedCertificates: A1F8DCB086E461E2ABB4B46ADCFA0B48C58B6E99 (Avira Operations GmbH & Co. KG) <==== ATTENTION  
 HKLM\ DisallowedCertificates: A5341949ABE1407DD7BF7DFE75460D9608FBC309 (BullGuard Ltd) <==== ATTENTION  
 HKLM\ DisallowedCertificates: A59CC32724DD07A6FC33F7806945481A2D13CA2F (ESET) <==== ATTENTION  
 HKLM\ DisallowedCertificates: AB7E760DA2485EA9EF5A6EEE7647748D4BA6B947 (AVG Technologies CZ) <==== ATTENTION  
 HKLM\ DisallowedCertificates: AD4C5429E10F4FF6C01840C20ABA344D7401209F (Avast Antivirus/Software) <==== ATTENTION  
 HKLM\ DisallowedCertificates: AD96BB64BA36379D2E354660780C2067B81DA2E0 (Symantec Corporation) <==== ATTENTION  
 HKLM\ DisallowedCertificates: B8EBF0E696AF77F51C96DB4D044586E2F4F8FD84 (Malwarebytes Corporation) <==== ATTENTION  
 HKLM\ DisallowedCertificates: CDC37C22FE9272D8F2610206AD397A45040326B8 (Trend Micro) <==== ATTENTION  
 HKLM\ DisallowedCertificates: D3F78D747E7C5D6D3AE8ABFDDA7522BFB4CBD598 (Kaspersky Lab) <==== ATTENTION  
 HKLM\ DisallowedCertificates: DB303C9B61282DE525DC754A535CA2D6A9BD3D87 (ThreatTrack Security) <==== ATTENTION  
 HKLM\ DisallowedCertificates: DB77E5CFEC34459146748B667C97B185619251BA (Avast Antivirus/Software) <==== ATTENTION  
 HKLM\ DisallowedCertificates: E22240E837B52E691C71DF248F12D27F96441C00 (Total Defense, Inc.) <==== ATTENTION  
 HKLM\ DisallowedCertificates: E513EAB8610CFFD7C87E00BCA15C23AAB407FCEF (AVG Technologies CZ) <==== ATTENTION  
 HKLM\ DisallowedCertificates: ED841A61C0F76025598421BC1B00E24189E68D54 (Bitdefender SRL) <==== ATTENTION  
 HKLM\ DisallowedCertificates: F83099622B4A9F72CB5081F742164AD1B8D048C9 (ESET) <==== ATTENTION  
 HKLM\ DisallowedCertificates: FBB42F089AF2D570F2BF6F493D107A3255A9BB1A (Panda Security S.L) <==== ATTENTION  
 HKLM\ DisallowedCertificates: FFFA650F2CB2ABC0D80527B524DD3F9FC172C138 (Doctor Web Ltd.) <==== ATTENTION  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\Run: [hNckT6aw.exe] => D:\Users\PBF32560\AppData\Local\Temp\4b6c936931b6475aab2d6ee7dfb372db\hNckT6aw.exe [805376 2017-12-22] (9ni) <==== ATTENTION  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\Run: [mCfaceqzwu.exe] => C:\ProgramData\cd300c8f40df43b8947fec35d744526c\mCfaceqzwu.exe [932864 2017-12-22] (FyF0)  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\Run: [RRDRfEJIQHy.exe] => C:\ProgramData\a0bef962d5e4479cbd9abf5aef058616\RRDRfEJIQHy.exe [820736 2017-12-22] (wG5kHEE)  
  HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\Run: [GoogleChromeAutoLaunch_6C6FA4DC6AB32237489A069D614D33BD] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1592664 2017-12-06] (Google Inc.)  
  HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [CCOTDHUCQJ.exe] => C:\Program Files\CanonBJ\FLQTILQWUQ\CCOTDHUCQJ.exe [1074176 2017-12-21] (0) 
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [rHy4HZRt.exe] => D:\Users\PBF32560\AppData\Local\Temp\2f6ec478d7db46c085c96c4fdaa942fd\rHy4HZRt.exe [748032 2017-12-21] () <==== ATTENTION  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [Rs19YiFlY2.exe] => C:\ProgramData\e2370a6cf9ec404bbbebcc1692a5d0a6\Rs19YiFlY2.exe [1074176 2017-12-21] (0) <==== ATTENTION  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [XWVEXGPBNT.exe] => D:\Users\PBF32560\AppData\Roaming\86b39862322c4eb0904b4e455d56b4a4\XWVEXGPBNT.exe [748032 2017-12-21] ()  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [I1v0ODl.exe] => D:\Users\PBF32560\AppData\Local\Temp\6dc47eff2806425280872de3e2fff85d\I1v0ODl.exe [1068032 2017-12-21] (M) <==== ATTENTION  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [AMhyRS3Ek.exe] => D:\Users\PBF32560\AppData\Roaming\815028cca7c1412992bb94313cf84b80\AMhyRS3Ek.exe [1074176 2017-12-21] (0)  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [AUKh9k20W8.exe] => D:\Users\PBF32560\AppData\Roaming\bb0fda926da241239c461de7b7558825\AUKh9k20W8.exe [748032 2017-12-21] ()  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [ZbXTJJ1Cl9.exe] => D:\Users\PBF32560\AppData\Roaming\02ea52ee39b941ddbb6b00b9c1136b51\ZbXTJJ1Cl9.exe [748032 2017-12-21] ()  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [NO413fOUbpZ.exe] => C:\ProgramData\810f8b146ed6468faa4e4f874cf28d04\NO413fOUbpZ.exe [1068032 2017-12-21] (M) <==== ATTENTION  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [Y18C24X.exe] => D:\Users\PBF32560\AppData\Local\cd097352c0b2427e821eb8363eacd186\Y18C24X.exe [748032 2017-12-21] ()  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [hw63nfww2fOTKt.exe] => D:\Users\PBF32560\AppData\Local\8a8fa20b77334799a59a93b5884961df\hw63nfww2fOTKt.exe [748032 2017-12-21] ()  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [zCClwznjzt3PE.exe] => D:\Users\PBF32560\AppData\Local\87b21600ceb44b3ab3b34a5cc8a90559\zCClwznjzt3PE.exe [748032 2017-12-21] ()  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [RESNvHMPOYlBx.exe] => D:\Users\PBF32560\AppData\Local\5e6ff2a769f6400c99119a63700c0f24\RESNvHMPOYlBx.exe [1068032 2017-12-21] (M)  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [pnKIDfzLiD49.exe] => C:\ProgramData\a619983e4b7947b4a3e3c23ab18c9610\pnKIDfzLiD49.exe [1068032 2017-12-21] (M) <==== ATTENTION  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [aZntiOgAPYqZv.exe] => D:\Users\PBF32560\AppData\Local\288f99dc19c94569849995e9374c1303\aZntiOgAPYqZv.exe [748032 2017-12-21] ()  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [TGJbR7tUjd3B1G.exe] => D:\Users\PBF32560\AppData\Local\7aaeda1da0df4861a7b813a62487d753\TGJbR7tUjd3B1G.exe [1068032 2017-12-21] (M)  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [XWV0fRl.exe] => D:\Users\PBF32560\AppData\Local\Temp\26255397b4794a5a8f7e1b4b4edcde44\XWV0fRl.exe [748032 2017-12-21] () <==== ATTENTION  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [3I15HAa.exe] => D:\Users\PBF32560\AppData\Local\Temp\da641e532ed74fcfbe3ac1da85645798\3I15HAa.exe [1068032 2017-12-21] (M) <==== ATTENTION  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [y6qXKzYfaY.exe] => D:\Users\PBF32560\AppData\Local\Temp\23ec989a83044eadac771e9ce6753737\y6qXKzYfaY.exe [1172480 2017-12-21] (VlN2) <==== ATTENTION  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [GkTMwEI.exe] => D:\Users\PBF32560\AppData\Local\Temp\54f9a7a59b8c4c5683d883c05c5ac548\GkTMwEI.exe [748032 2017-12-21] () <==== ATTENTION  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [mRwpnBWsFK8SQ.exe] => D:\Users\PBF32560\AppData\Local\fdf32f809d2d4691b48ebc4a79b9adf1\mRwpnBWsFK8SQ.exe [1192960 2017-12-22] (A)  
 HKU\S-1-5-21-405680416-1421812660-549785860-18928\...\RunOnce: [5Z9YzXnp7LQT.exe] => C:\ProgramData\4b5033ae24b3428ab6d13535ba847a47\5Z9YzXnp7LQT.exe [748032 2017-12-22] () <==== ATTENTION  
 AppInit_DLLs: C:\ProgramData\AppriabuS\Viaex.dll => C:\ProgramData\AppriabuS\Viaex.dll [342528 2017-12-21] ()  
 AppInit_DLLs-x32: C:\ProgramData\AppriabuS\Yearzap.dll => C:\ProgramData\AppriabuS\Yearzap.dll [460800 2017-12-21] ()  
 2017-12-22 10:45 - 2017-12-22 10:47 - 000000000 ____D D:\Users\PBF32560\AppData\Local\fdf32f809d2d4691b48ebc4a79b9adf1
2017-12-22 10:44 - 2017-12-22 10:44 - 000003266 _____ C:\Windows\System32\Tasks\psv_Medlux
2017-12-22 10:41 - 2017-12-22 10:41 - 000003288 _____ C:\Windows\System32\Tasks\psv_Xxx-lam
2017-12-22 10:41 - 2017-12-22 10:41 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\34318924cc4b4c09a1976547915a2a91
2017-12-22 10:40 - 2017-12-22 10:41 - 000000000 ____D D:\Users\PBF32560\AppData\Local\384c23ef35be44cd94fb6c8d3ee2c364
2017-12-21 23:21 - 2017-12-21 23:21 - 000003274 _____ C:\Windows\System32\Tasks\psv_MathHold
2017-12-21 23:05 - 2017-12-21 23:05 - 000003274 _____ C:\Windows\System32\Tasks\psv_OpeTop
2017-12-21 22:00 - 2017-12-21 22:00 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\ZTEMTUI
2017-12-21 21:23 - 2017-12-21 21:24 - 000000000 ____D D:\Users\PBF32560\AppData\Local\758ca9f1ca434addab8c4af365fe2f21
2017-12-21 20:54 - 2017-12-21 20:54 - 000003198 _____ C:\Windows\System32\Tasks\{7D4516FF-FB97-4A2D-B896-D8E2335E4C74}
2017-12-21 20:37 - 2017-12-21 20:37 - 000000000 ____D D:\Users\PBF32560\AppData\Local\288f99dc19c94569849995e9374c1303
2017-12-21 20:36 - 2017-12-21 20:36 - 000003266 _____ C:\Windows\System32\Tasks\psv_K-toning
2017-12-21 20:34 - 2017-12-21 20:35 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\5f6855aa1aa249219f2810ddf82530a3
2017-12-21 20:33 - 2017-12-21 20:33 - 000003416 ____N C:\bootsqm.dat
2017-12-21 20:16 - 2017-12-21 20:16 - 000000000 ____D D:\Users\PBF32560\AppData\Local\87b21600ceb44b3ab3b34a5cc8a90559
2017-12-21 20:14 - 2017-12-21 20:14 - 000003266 _____ C:\Windows\System32\Tasks\psv_TanTip
2017-12-21 20:13 - 2017-12-21 20:14 - 000000000 ____D D:\Users\PBF32560\AppData\Local\da4e97da9c094e72a0fbfac81f54f902
2017-12-21 20:08 - 2017-12-21 20:08 - 000003284 _____ C:\Windows\System32\Tasks\psv_Stanantop
2017-12-21 20:07 - 2017-12-21 20:07 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\962a3d24fcfb41f08315934cea59c23a
2017-12-21 20:03 - 2017-12-21 20:04 - 000000000 ____D D:\Users\PBF32560\AppData\Local\536428eeb3144df0a05e83cceb390ca6
2017-12-21 20:02 - 2017-12-21 20:03 - 000000000 ____D D:\Users\PBF32560\AppData\Local\da75009a69dc408db86393ff493b39b1
2017-12-21 20:02 - 2017-12-21 20:02 - 000000000 ____D D:\Users\PBF32560\AppData\Local\d9fc0fbec3ae40f59c14d873eef4afd6
2017-12-21 19:51 - 2017-12-21 19:51 - 000003294 _____ C:\Windows\System32\Tasks\psv_Gravetip
2017-12-21 19:50 - 2017-12-21 19:51 - 000000000 ____D D:\Users\PBF32560\AppData\Local\5e6ff2a769f6400c99119a63700c0f24
2017-12-21 19:39 - 2017-12-21 19:39 - 000003274 _____ C:\Windows\System32\Tasks\psv_Unodax
2017-12-21 19:39 - 2017-12-21 19:39 - 000000000 ____D D:\Users\PBF32560\AppData\Local\8a8fa20b77334799a59a93b5884961df
2017-12-21 19:38 - 2017-12-21 19:39 - 000000000 ____D D:\Users\PBF32560\AppData\Local\7aaeda1da0df4861a7b813a62487d753
2017-12-21 19:37 - 2017-12-21 19:38 - 000000000 ____D D:\Users\PBF32560\AppData\Local\5c6b5a2540f24860ba3adfd5bde40f31
2017-12-21 19:36 - 2017-12-21 19:37 - 000000000 ____D D:\Users\PBF32560\AppData\Local\796416f490534eaf9ef329459103bc88
2017-12-21 19:13 - 2017-12-21 19:13 - 000003266 _____ C:\Windows\System32\Tasks\psv_Lamcof
2017-12-21 19:13 - 2017-12-21 19:13 - 000000000 ____D D:\Users\PBF32560\AppData\Local\cd097352c0b2427e821eb8363eacd186
2017-12-21 19:10 - 2017-12-21 19:11 - 000000000 ____D D:\Users\PBF32560\AppData\Local\f28d513fc16346efabdfa4902c91886c
2017-12-21 18:23 - 2017-12-21 18:24 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\bb0fda926da241239c461de7b7558825
2017-12-21 18:20 - 2017-12-21 18:21 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\23d6f1b731d34e3195b60dabe5636f45
2017-12-21 18:19 - 2017-12-21 18:20 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\21cb5ff088e64cd68e26a2a652a8b24c
2017-12-21 18:05 - 2017-12-21 18:08 - 000003256 _____ C:\Windows\System32\Tasks\snf
2017-12-21 18:04 - 2017-12-21 18:08 - 000003678 _____ C:\Windows\System32\Tasks\snp
2017-12-21 17:58 - 2017-12-21 17:58 - 000278509 _____ D:\Users\PBF32560\AppData\Local\Qvonix.bin
2017-12-21 17:39 - 2017-12-21 17:40 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth Devices
2017-12-21 17:31 - 2017-12-21 17:32 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\02ea52ee39b941ddbb6b00b9c1136b51
2017-12-21 17:29 - 2017-12-21 17:31 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\815028cca7c1412992bb94313cf84b80
2017-12-21 17:26 - 2017-12-21 17:29 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\b6333e54767a425fb2538cf0ff50e93c
2017-12-21 17:22 - 2017-12-21 17:26 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\3fedc89e8cc04b1ea00e4d740ed3356c
2017-12-21 17:19 - 2017-12-21 17:19 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\ea622c5eba7a4420a5598edba04cfbfe
2017-12-21 16:56 - 2017-12-21 16:56 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\506755f6f4a34786a208773233409fb9
2017-12-21 16:46 - 2017-12-21 18:07 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\gplyra
2017-12-21 16:45 - 2017-12-21 16:45 - 000000000 ____D D:\Users\PBF32560\AppData\Local\FastDataX
2017-12-21 16:45 - 2017-12-21 16:45 - 000000000 ____D D:\Users\PBF32560\AppData\Local\AdService
2017-12-21 16:45 - 2017-12-21 16:32 - 001814528 _____ (TODO: <Company name>) D:\Users\PBF32560\AppData\Local\Greentam.exe
2017-12-21 16:42 - 2017-12-21 16:42 - 000003984 _____ C:\Windows\System32\Tasks\GoogleUpdateSecurityTaskMachine_DF
2017-12-21 16:41 - 2017-12-21 16:41 - 000003046 _____ C:\Windows\System32\Tasks\hostTask
2017-12-21 16:40 - 2017-12-21 16:46 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\86b39862322c4eb0904b4e455d56b4a4
2017-12-21 16:39 - 2017-12-21 16:39 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\8c1976166cd8446a88f344599c6bb520
2017-12-21 16:38 - 2017-12-21 16:38 - 000003908 _____ C:\Windows\System32\Tasks\GoogleUpdateSecurityTaskMachine_WF
2017-12-21 16:37 - 2017-12-21 16:37 - 000278510 _____ D:\Users\PBF32560\AppData\Local\YearIt.bin
2017-12-21 16:37 - 2017-12-21 16:37 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\8188634ac0bd448c91be29868d5b3407
2017-12-21 16:33 - 2017-12-21 22:03 - 000930816 _____ D:\Users\PBF32560\AppData\Local\po.db
2017-12-21 16:33 - 2017-12-21 17:53 - 000016080 _____ D:\Users\PBF32560\AppData\Local\InstallationConfiguration.xml
2017-12-21 16:33 - 2017-12-21 16:34 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\75c84a4049fc43a79e41264f1e14d5d3
2017-12-21 16:33 - 2017-12-21 16:33 - 000140800 _____ D:\Users\PBF32560\AppData\Local\installer.dat
2017-12-21 16:33 - 2017-12-21 16:33 - 000003996 _____ C:\Windows\System32\Tasks\GoogleUpdateSecurityTaskMachine_ZN
2017-12-21 16:31 - 2017-12-22 12:00 - 000016692 _____ C:\Windows\System32\Tasks\LogMaster
2017-12-21 16:28 - 2017-12-21 16:50 - 000000000 ____D C:\Program Files (x86)\driverupdaterplus
2017-12-21 16:28 - 2017-12-21 16:29 - 000000000 ____D D:\Users\PBF32560\AppData\Roaming\rz3vcoeuzow
2017-12-21 16:26 - 2017-12-21 16:27 - 000000000 ____D C:\Program Files (x86)\WeatherInspect
2017-12-21 16:26 - 2017-12-21 16:26 - 000001810 _____ D:\Users\PBF32560\AppData\Roaming\77WY9SW.exe.config
2017-12-21 16:26 - 2017-12-21 16:26 - 000001810 _____ () D:\Users\PBF32560\AppData\Roaming\77WY9SW.exe.config
2014-10-13 09:23 - 2016-09-22 13:16 - 000002212 _____ () D:\Users\PBF32560\AppData\Local\CPAUTO.tmp
2017-03-09 16:48 - 2017-03-09 16:48 - 000002377 _____ () D:\Users\PBF32560\AppData\Local\CPAUTO.tmp.fhcdvc
2016-04-18 10:06 - 2016-04-18 10:06 - 000003325 _____ () D:\Users\PBF32560\AppData\Local\CPAUTO.tmp.j358og
2017-03-13 12:13 - 2017-03-13 12:13 - 000002377 _____ () D:\Users\PBF32560\AppData\Local\CPAUTO.tmp.j3h5md
2016-02-26 16:41 - 2016-02-26 16:41 - 000003325 _____ () D:\Users\PBF32560\AppData\Local\CPAUTO.tmp.rnk3wz
2014-10-13 09:24 - 2016-09-22 13:16 - 000007174 _____ () D:\Users\PBF32560\AppData\Local\CPREBUILT.tmp
2017-12-21 16:45 - 2017-12-21 16:32 - 001814528 _____ (TODO: <Company name>) D:\Users\PBF32560\AppData\Local\Greentam.exe
2017-12-21 16:33 - 2017-12-21 17:53 - 000016080 _____ () D:\Users\PBF32560\AppData\Local\InstallationConfiguration.xml
2017-12-21 16:33 - 2017-12-21 16:33 - 000140800 _____ () D:\Users\PBF32560\AppData\Local\installer.dat
2017-12-21 16:33 - 2017-12-21 22:03 - 000930816 _____ () D:\Users\PBF32560\AppData\Local\po.db
2017-12-21 17:58 - 2017-12-21 17:58 - 000278509 _____ () D:\Users\PBF32560\AppData\Local\Qvonix.bin
2017-12-21 16:37 - 2017-12-21 16:37 - 000278510 _____ () D:\Users\PBF32560\AppData\Local\YearIt.bin
2017-02-22 01:07 - 2017-02-22 01:07 - 000000000 _____ () D:\Users\PBF32560\AppData\Local\{B026183D-9FEB-4F46-924C-7EB6823643EE}
2016-03-02 18:59 - 2016-03-02 18:59 - 000000000 _____ () D:\Users\PBF32560\AppData\Local\{FFFC5384-965C-46FE-A8C7-AF9E6EC040AE}
Task: {032957DA-0174-4022-B65E-267E47E9B212} - System32\Tasks\{7D4516FF-FB97-4A2D-B896-D8E2335E4C74} => C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanionInstaller.exe" -c --uninstall
Task: {089B5AAA-4199-4DF2-ADE9-129F630012D4} - System32\Tasks\psv_K-toning => cmd.exe /c regedit.exe /s "C:\ProgramData\AppriabuS\Joytex.reg" & del "C:\ProgramData\AppriabuS\Joytex.reg" & SCHTASKS /Delete /TN "psv_K-toning" /F <==== ATTENTION
Task: {1BD53690-C367-4A6C-B73A-716C58D1F865} - System32\Tasks\psv_TanTip => cmd.exe /c regedit.exe /s "C:\ProgramData\AppriabuS\Mat-Kix.reg" & del "C:\ProgramData\AppriabuS\Mat-Kix.reg" & SCHTASKS /Delete /TN "psv_TanTip" /F <==== ATTENTION
Task: {1F5BE3A5-7ED3-49E5-BC98-F92B272364B4} - System32\Tasks\{409F8E79-03EE-4601-BBEA-D2BD1C799253} => C:\Windows\system32\pcalua.exe -a D:\Users\PBF32560\Downloads\Programs\Download_SpyHunter-Installer.exe -d D:\Users\PBF32560\Downloads\Programs
Task: {20046E77-BFE4-4393-9660-4827C9AA8F9E} - System32\Tasks\psv_OpeTop => cmd.exe /c regedit.exe /s "C:\ProgramData\AppriabuS\Fasehotis.reg" & del "C:\ProgramData\AppriabuS\Fasehotis.reg" & SCHTASKS /Delete /TN "psv_OpeTop" /F <==== ATTENTION
Task: {2FE53393-FEBA-48B5-BB6D-A1B31E0D9D75} - System32\Tasks\GoogleUpdateSecurityTaskMachine_BJ => C:\ProgramData\1d849d7e0d2f41c8a95ba5be2ca95cec\chipset.exe exec hide KGELWHAAEN.cmd  <==== ATTENTION
Task: {3D451D21-387A-4250-B9E3-20F3F1682823} - System32\Tasks\GoogleUpdateSecurityTaskMachine_ZN => D:\Users\PBF32560\AppData\Local\Temp\9801bf0dc8df4b9cb20695b9033fa650\chipset.exe exec hide HXVYHTVUEW.cmd  <==== ATTENTION
Task: {41244E02-17F1-40AA-BF55-8BE808409D6B} - System32\Tasks\hostTask => C:\ProgramData\PrefsSecure\bush.exe [2017-12-21] () <==== ATTENTION
Task: {4B32D4AC-C8D2-4B31-A4F4-58B31B3D36CA} - System32\Tasks\psv_Lamcof => cmd.exe /c regedit.exe /s "C:\ProgramData\AppriabuS\Dingtop.reg" & del "C:\ProgramData\AppriabuS\Dingtop.reg" & SCHTASKS /Delete /TN "psv_Lamcof" /F <==== ATTENTION
Task: {55D354A5-0BAF-41FC-B1EC-A7C9D8FA125B} - System32\Tasks\Microsoft\Windows\Windows Error Reporting\ErrorReporting => D:\\Users\\PBF32560\\AppData\\Roaming\\ErrorReporting\\ermgr.exe [2017-10-06] ()
Task: {62D0B01A-79B5-486F-B9BC-0E991877E3CE} - System32\Tasks\LogMaster => C:\Windows\system32\rundll32.exe "C:\Program Files\LogMaster\LogMaster.dll",gziUSLNO <==== ATTENTION
Task: {745F8EBC-D944-4E12-AECC-1185588AFB39} - System32\Tasks\GoogleUpdateSecurityTaskMachine_DF => D:\Users\PBF32560\AppData\Roaming\86b39862322c4eb0904b4e455d56b4a4\chipset.exe exec hide XWVEXGPBNT.cmd  <==== ATTENTION
Task: {8791318D-E189-4FBA-A4A5-5EF6A88E9ABF} - System32\Tasks\psv_Medlux => cmd.exe /c regedit.exe /s "C:\ProgramData\AppriabuS\Lexijob.reg" & del "C:\ProgramData\AppriabuS\Lexijob.reg" & SCHTASKS /Delete /TN "psv_Medlux" /F <==== ATTENTION
Task: {8D199399-DA2D-42CA-87B7-0C1D98BF84FD} - System32\Tasks\psv_Stanantop => cmd.exe /c regedit.exe /s "C:\ProgramData\AppriabuS\Ronjayhold.reg" & del "C:\ProgramData\AppriabuS\Ronjayhold.reg" & SCHTASKS /Delete /TN "psv_Stanantop" /F <==== ATTENTION
Task: {8DD36786-63CF-4440-B1A4-D0AB5A240C27} - System32\Tasks\psv_MathHold => cmd.exe /c regedit.exe /s "C:\ProgramData\AppriabuS\Stockdex.reg" & del "C:\ProgramData\AppriabuS\Stockdex.reg" & SCHTASKS /Delete /TN "psv_MathHold" /F <==== ATTENTION
Task: {9A0E8331-9F04-48F9-828D-61A00FE4816A} - System32\Tasks\GoogleUpdateSecurityTaskMachine_TK => D:\Users\PBF32560\AppData\Roaming\8188634ac0bd448c91be29868d5b3407\chipset.exe exec hide FXVYZZYTYJ.cmd  <==== ATTENTION
Task: {B2D36112-7304-4E15-95CA-D13739E2790D} - System32\Tasks\psv_Gravetip => cmd.exe /c regedit.exe /s "C:\ProgramData\AppriabuS\TranTraxstock.reg" & del "C:\ProgramData\AppriabuS\TranTraxstock.reg" & SCHTASKS /Delete /TN "psv_Gravetip" /F <==== ATTENTION
Task: {BEE40615-F268-4BAF-9550-5508B43A3440} - System32\Tasks\{882552FC-FDE4-449F-AFC6-869C84C97779} => "c:\program files\internet explorer\iexplore.exe" hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=6.22.64.107&LastError=12002
Task: {E05EAC6F-F991-4544-A1C4-523BCA10A924} - System32\Tasks\snf => C:\ProgramData\AppriabuS\AppriabuS.exe [2017-12-21] (TODO: <Company name>) <==== ATTENTION
ShortcutWithArgument: D:\Users\PBF32560\AppData\Local\Google\Chrome\User Data\Lanceur d'applications Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --show-app-list
ShortcutWithArgument: D:\Users\PBF32560\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Lanceur d'applications Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --show-app-list
ShortcutWithArgument: D:\Users\PBF32560\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Applications Chrome\Google Hangouts.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --profile-directory=Default --app-id=knipolnnllmklapflnccelgolnpehhpl
ShortcutWithArgument: D:\Users\PBF32560\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Lanceur d'applications Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --show-app-list
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> %SNP%
Task: {EE5D5387-E38A-4BE1-98E6-2B2021944AE0} - System32\Tasks\psv_Xxx-lam => cmd.exe /c regedit.exe /s "C:\ProgramData\AppriabuS\Zoomsiltouch.reg" & del "C:\ProgramData\AppriabuS\Zoomsiltouch.reg" & SCHTASKS /Delete /TN "psv_Xxx-lam" /F <==== ATTENTION
Task: {F92868AC-25E4-4617-8984-48E4E35760A3} - System32\Tasks\snp => C:\ProgramData\AppriabuS\AppriabuS.exe [2017-12-21] (TODO: <Company name>) <==== ATTENTION
MSCONFIG\startupreg: 1IkzjpQxKcfcq2.exe => C:\ProgramData\c5bb54eb95c640149ade34b61d928d51\1IkzjpQxKcfcq2.exe 
MSCONFIG\startupreg: 3cPtjPV.exe => D:\Users\PBF32560\AppData\Local\Temp\5db26e739546411c9056e58898663a58\3cPtjPV.exe 
MSCONFIG\startupreg: 3RNPPMvXmmODT.exe => D:\Users\PBF32560\AppData\Roaming\3fedc89e8cc04b1ea00e4d740ed3356c\3RNPPMvXmmODT.exe 
MSCONFIG\startupreg: 5AUEvr2un.exe => D:\Users\PBF32560\AppData\Local\d9fc0fbec3ae40f59c14d873eef4afd6\5AUEvr2un.exe 
MSCONFIG\startupreg: dn2YoWn.exe => D:\Users\PBF32560\AppData\Local\Temp\4a260b1b04ae4244834c6d989476708c\dn2YoWn.exe 
MSCONFIG\startupreg: dUhWWnU.exe => D:\Users\PBF32560\AppData\Local\Temp\1eec0d17e195448bb383b9bbc2d7f0f0\dUhWWnU.exe 
MSCONFIG\startupreg: efTkcASZZj.exe => C:\ProgramData\6cdfd83eb5b5435fb6c1033924344721\efTkcASZZj.exe 
MSCONFIG\startupreg: gHhpcmErc2vF.exe => D:\Users\PBF32560\AppData\Roaming\b6333e54767a425fb2538cf0ff50e93c\gHhpcmErc2vF.exe 
MSCONFIG\startupreg: GoogleChromeAutoLaunch_6C6FA4DC6AB32237489A069D614D33BD => "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window /prefetch:5
MSCONFIG\startupreg: gplyra => D:\Users\PBF32560\AppData\Roaming\gplyra\gplyra.exe
MSCONFIG\startupreg: HKEEYQQLVP.exe => C:\Program Files\CanonBJ\FLQTILQWUQ\HKEEYQQLVP.exe 
MSCONFIG\startupreg: mDbYYQNF.exe => D:\Users\PBF32560\AppData\Roaming\75c84a4049fc43a79e41264f1e14d5d3\mDbYYQNF.exe 
MSCONFIG\startupreg: nK6b1jZDrrXWY.exe => D:\Users\PBF32560\AppData\Local\5c6b5a2540f24860ba3adfd5bde40f31\nK6b1jZDrrXWY.exe 
MSCONFIG\startupreg: O8S5pp5xv9oo7.exe => D:\Users\PBF32560\AppData\Roaming\23d6f1b731d34e3195b60dabe5636f45\O8S5pp5xv9oo7.exe 
MSCONFIG\startupreg: QBapRyMjdCelWG.exe => C:\ProgramData\48f39a33289d4cc0ab22430485e5ba40\QBapRyMjdCelWG.exe 
MSCONFIG\startupreg: RESTART_STICKY_NOTES => C:\Windows\System32\StikyNot.exe
MSCONFIG\startupreg: RlgVasLiZkXIU.exe => D:\Users\PBF32560\AppData\Local\f28d513fc16346efabdfa4902c91886c\RlgVasLiZkXIU.exe 
MSCONFIG\startupreg: rwtXwCbx.exe => D:\Users\PBF32560\AppData\Roaming\21cb5ff088e64cd68e26a2a652a8b24c\rwtXwCbx.exe 
MSCONFIG\startupreg: UyKxC6rh7.exe => D:\Users\PBF32560\AppData\Local\758ca9f1ca434addab8c4af365fe2f21\UyKxC6rh7.exe 
MSCONFIG\startupreg: vmK6loSpx5ypDY.exe => D:\Users\PBF32560\AppData\Local\da4e97da9c094e72a0fbfac81f54f902\vmK6loSpx5ypDY.exe 
MSCONFIG\startupreg: w76wSRZxNI1.exe => C:\ProgramData\bc6128c7a80742c0b7f3143e58c3a9a3\w76wSRZxNI1.exe 
MSCONFIG\startupreg: wBTa43zch0O3T.exe => D:\Users\PBF32560\AppData\Roaming\5f6855aa1aa249219f2810ddf82530a3\wBTa43zch0O3T.exe 
MSCONFIG\startupreg: ZcR7os97iRO.exe => C:\ProgramData\5a82750361904e8aaf383310dbf097bd\ZcR7os97iRO.exe 
MSCONFIG\startupreg: ZJsLbLj9wwfQg.exe => D:\Users\PBF32560\AppData\Local\796416f490534eaf9ef329459103bc88\ZJsLbLj9wwfQg.exe 
  Hosts:
EmptyTemp:
RemoveProxy:
Reboot:

Une fois, le texte collé dans le Bloc-notes,
Menu "Fichier" puis "Enregistrer sous",
A gauche, place toi sur le Bureau,
Dans le champs en bas, nom du fichier mets : fixlist.txt
Clique sur "Enregistrer", cela va créer fixlist.txt sur le Bureau.

Relance FRST et clique sur le bouton "Corriger / Fix"
Un redémarrage sera peut-être nécessaire ( pas obligatoire )
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

Redémarre l'ordinateur.

2°)
Réinitialise/Répare les navigateurs WEB concernés par les problèmes :

Réparer Mozilla Firefox (premier paragraphe)
Réparer Google Chrome (seulement le premier paragraphe).
Réinitialiser et réparer Internet Explorer

3°)
Termine par un nettoyage Malwarebytes - Tutoriel Malwarebytes Anti-Malware version gratuite

4°)
Refais un scan FRST et donne les nouveaux rapports.

Malekal_morte- · Answer

Parfait =)

Supprime le dossier C:\FRST


Termine par un nettoyage Malwarebytes -  Tutoriel Malwarebytes Anti-Malware version gratuite 
Evite les analyses et nettoyages réguliers ZHPCleaner, AdwCleaner, pas utile.

Quelques conseils : 

Pour ne plus te faire avoir. 
A lire - Programmes parasites / PUPs : Dossier Adwares/PUPs : programmes indésirables et parasites
(Surtout active les détections LPIs pour détecter les programmes parasites et publicitaires)

Windows explorer ouvre des pages seul

3 réponses

End of Fixlog 12:58:15

Discussions similaires

Newsletters