impossible de se connecter à une session

Question

Bonjour,

mon frere n'arrive plus à acceder a sa session, elle s'ouvre et se referme directement. En mode sans echec, il y a accès . Je pense que c'est un probleme de registre, j'ai fait malwarebytes mais j'ai besoin d'aide. Merci!!

Malwarebytes Anti-Malware (Trial) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.08.04.07

Windows Vista Service Pack 2 x86 NTFS (Safe Mode)
Internet Explorer 8.0.6001.18943
françois :: PC-DE-FRANÇOIS [administrator]

Protection: Disabled

05/08/2012 00:23:43
mbam-log-2012-08-05 (00-23-43).txt

Scan type: Full scan (C:\|D:\|F:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 356794
Time elapsed: 51 minute(s), 42 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 91
HKCR\AppID\{0D82ACD6-A652-4496-A298-2BDE705F4227} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKCR\AppID\{7025E484-D4B0-441a-9F0B-69063BD679CE} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKCR\AppID\{8258B35C-05B8-4c0e-9525-9BCCC70F8F2D} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKCR\AppID\{A89256AD-EC17-4a83-BEF5-4B8BC4F39306} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKCR\CLSID\{09325003-167C-483d-A4BA-8B3122ABB432} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\TypeLib\{F1A1892C-2A6C-4817-98B4-FF81443CBA20} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\Interface\{E25DA6D6-C365-46CF-ABAF-DC5893135D7A} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.HbGuru.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.HbGuru (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{100EB1FD-D03E-47fd-81F3-EE91287F9465} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\TypeLib\{E343EDFC-1E6C-4cb5-AA29-E9C922641C80} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\Interface\{D8560AC2-21B5-4C1A-BDD4-BD12BC83B082} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.RprtCtrl.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.RprtCtrl (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{20EA9658-6BC3-4599-A87D-6371FE9295FC} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.HbAx.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.HbAx (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{2721A8E5-BFDB-4562-9912-9E0531CA616C} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\TypeLib\{5FE0CEAE-CB69-40AF-A323-40F94257DACB} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\Interface\{65A16874-2ED0-460E-A547-5FE2EC3A13A7} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.MozillaPSExecuter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.MozillaPSExecuter (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{396CFC12-932D-496b-A0A8-5D7201E105E1} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\TypeLib\{573F4ABB-A1A2-44ED-9BA9-A8DAD40AAC46} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\Interface\{71E02280-5212-45C3-B174-4D5A35DA254F} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.MozillaNvgtnTrpr.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.MozillaNvgtnTrpr (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{60DA826C-B1C6-4358-BDEC-4837CED45470} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.KOPFF.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.KOPFF (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{6DD76B7B-6423-4df0-9A07-84A6CAD973A0} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.Dwnldr.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.Dwnldr (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{74C22317-5B90-471f-9AD2-FEC049870A16} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.Scopes.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.Scopes (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{7F6CFB6A-9227-4bb8-B941-F2B067E76F51} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.TriggerImmidiateOrRandomTS.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.TriggerImmidiateOrRandomTS (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{A16AD1E9-F69A-45af-9462-B1C286708842} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.IEButtonA.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.IEButtonA (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.HbInfoBand.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.HbInfoBand (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{AB0EE208-DF60-4fa7-A617-C4269760033E} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.Reporter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.Reporter (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{C1089F63-7AFC-4538-B0EB-BEA0F4225A57} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.Stock.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.Stock (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{C9CCBB35-D123-4a31-AFFC-9B2933132116} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.IEButton.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.IEButton (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{CC7BD6F1-565C-47ce-A5BB-9C935E77B59D} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\TypeLib\{02AED140-2B62-4B49-8B3B-179020CC39B9} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\Interface\{17BF1E05-C0E8-413C-BD1F-A481EEA3B8E9} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.CntntDic.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.CntntDic (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{CFC16189-8A92-4a29-A940-60248385F426} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.CntntDisp.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.CntntDisp (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{DEE758B4-C3FB-4a5b-9939-848B9C77A2FB} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{E12AEAB6-7D12-4c07-8E36-5892EFB4DAFB} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.TriggerImmidiate.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.TriggerImmidiate (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{E2F2C137-A782-4fb5-81AF-086156F5EB0A} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.AsyncReporter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.AsyncReporter (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{F1D06C9F-51F0-4476-BEDE-5DDF91BE304E} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.ReportData.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.ReportData (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\CLSID\{F3A32DF2-7413-4fb1-B575-1AC920A17B76} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.TriggerOnceInDay.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\ShopperReports.TriggerOnceInDay (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\Typelib\{ACC62306-9A63-4864-BD2F-C8825D2D7EA6} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKCR\Interface\{21BA420E-161C-413A-B21E-4E42AE1F4226} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKCR\Typelib\{CDCA70D8-C6A6-49EE-9BED-7429D6C477A2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\Interface\{8AD9AD05-36BE-4E40-BA62-5422EB0D02FB} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKCR\Typelib\{D136987F-E1C4-4CCC-A220-893DF03EC5DF} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{89F88394-3828-4d03-A0CF-8203604C3DA6} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D4233F04-1789-483c-A137-731E8F113DD5} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKCR\AppID\BRNstIE.DLL (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKCR\AppID\CmndFF.DLL (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKCR\AppID\mozillaps.dll (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKCR\AppID\Pltfrm.DLL (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\QuestBrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\ShopperReports3 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuestBrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShopperReportsSA (Adware.ShopperReports) -> Quarantined and deleted successfully.

Registry Values Detected: 3
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform|ShopperReports 3.0.517.0 (Adware.HotBar) -> Data: -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform|SRS_IT_E8790474B1765C5736AB93 (Malware.Trace) -> Data: -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Mozilla\Firefox\extensions|ShopperReports@ShopperReports.com (ShopperReports) -> Data: C:\Program Files\ShopperReports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions -> Quarantined and deleted successfully.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 13
C:\Users\françois\AppData\Roaming\ShopperReports3 (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3 (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.517.0 (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.517.0\firefox (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.517.0\firefox\firefoxtoolbar (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions\chrome (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions\components (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShopperReports (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\ProgramData\QuestBrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.
C:\Program Files\QuestBrowse (Adware.QuestBrowse) -> Quarantined and deleted successfully.
C:\ProgramData\QuestBrwSearch (Adware.QuestBrowse) -> Quarantined and deleted successfully.

Files Detected: 15
C:\Program Files\ShopperReports3\bin\3.0.517.0\mozillaps.dll (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.517.0\CmndFF.dll (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.517.0\CntntCntr.dll (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.517.0\BRNstIE.dll (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions\components\BRNstFF.dll (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.517.0\LaunchHelp.dll (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.517.0\link.ico (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions\chrome.manifest (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions\install.rdf (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions\chrome\firefoxtoolbar.jar (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\ShopperReports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions\components\BRNstFF.xpt (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShopperReports\About Us.lnk (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShopperReports\Customer Support.lnk (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShopperReports\ShopperReports Uninstall Instructions.lnk (Adware.ShopperReports) -> Quarantined and deleted successfully.
C:\Program Files\QuestBrowse\uninstall.exe (Adware.QuestBrowse) -> Quarantined and deleted successfully.

Destrio5 · Answer

Bonjour,

--> Télécharge et lance  AdwCleaner (d'Xplode), choisis l'option "Suppression" et poste le rapport.

katouille · Answer

# AdwCleaner v1.800 - Rapport créé le 07/08/2012 à 12:24:31
# Mis à jour le 01/08/2012 par Xplode
# Système d'exploitation : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Nom d'utilisateur : françois - PC-DE-FRANÇOIS
# Exécuté depuis : C:\Users\françois\Downloads\adwcleaner.exe
# Option [Recherche]


***** [Services] *****


***** [Fichiers / Dossiers] *****

Dossier Présent : C:\Program Files\Conduit
Dossier Présent : C:\Program Files\ConduitEngine
Dossier Présent : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Fichier Présent : C:\Program Files\Mozilla FireFox\Components\AskSearch.js

***** [Registre] *****

[*] Clé Présente : HKLM\SOFTWARE\Classes\Toolbar.CT2786678
Clé Présente : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Clé Présente : HKLM\SOFTWARE\Classes\Conduit.Engine
Clé Présente : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Clé Présente : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Clé Présente : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Clé Présente : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Clé Présente : HKLM\SOFTWARE\Conduit
Clé Présente : HKLM\SOFTWARE\conduitEngine
Clé Présente : HKLM\SOFTWARE\conduitEngine
Clé Présente : HKLM\SOFTWARE\DT Soft
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine
Clé Présente : HKLM\SOFTWARE\myBabylon_English4
Clé Présente : HKLM\SOFTWARE\uTorrentBar

***** [Registre - GUID] *****

Clé Présente : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Clé Présente : HKLM\SOFTWARE\Classes\Interface\{B32966A2-F7C2-4362-A6CF-399EC8B44110}
Clé Présente : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Clé Présente : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Clé Présente : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4D9123FC-0C28-4C9D-B024-1A661849456F}
Clé Présente : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F17D4169-D1C5-4567-977A-970D3E1D629D}
Clé Présente : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC600575-3013-4E8E-941C-4B00DAFCE730}
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FC600575-3013-4E8E-941C-4B00DAFCE730}
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}
Clé Présente : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{BC9B7783-ABD0-4F6E-9DD5-D35564532844}
Valeur Présente : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Valeur Présente : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{FC600575-3013-4E8E-941C-4B00DAFCE730}]
Valeur Présente : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{30F9B915-B755-4826-820B-08FBA6BD249D}]
Valeur Présente : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{FC600575-3013-4E8E-941C-4B00DAFCE730}]
Valeur Présente : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}]
Valeur Présente : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{FC600575-3013-4E8E-941C-4B00DAFCE730}]
Valeur Présente : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{FC600575-3013-4E8E-941C-4B00DAFCE730}]
Valeur Présente : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}]

***** [Navigateurs] *****

-\ Internet Explorer v8.0.6001.18943

[OK] Le registre ne contient aucune entrée illégitime.

*************************

AdwCleaner[R1].txt - [4834 octets] - [07/08/2012 12:24:31]

########## EOF - \AdwCleaner[R1].txt - [4962 octets] ##########

Destrio5 · Answer

Tu as utilisé l'option "Recherche", utilise maintenant l'option "Suppression" puis poste le rapport.

katouille · Answer

oops désolée, le probleme c'est qu'ils disent qu'il faut redemarrer le pc apres la suppression mais il se remet sur la page de session et non pas sur le mode sans echec, je ne peux donc pas avoir accès au rapport :/

katouille · Answer

qu'est ce que je fais?

Destrio5 · Answer

--> Télécharge ZHPDiag (de Nicolas Coolman).

--> Double-clique sur le fichier d'installation. Installe ZHPDiag avec les paramètres par défaut (N'oublie pas de cocher "Créer une icône sur le Bureau").

--> Lance ZHPDiag en double-cliquant sur le raccourci présent sur ton Bureau.
(Sous Vista/Win7, il faut cliquer droit sur le raccourci de ZHPDiag et choisir Exécuter en tant qu'administrateur)

--> Clique sur la loupe (Lancer le diagnostic) puis laisse l'outil scanner.

--> Une fois le scan terminé, clique sur l'icône en forme de disquette et enregistre le fichier (le rapport de l'analyse) sur ton Bureau. 

--> Utilise le site http://pjjoint.malekal.com/ pour me transmettre le rapport ZHPDiag car il est plutôt long. Copie-colle le lien donné par le site ici.

Je m'absente.

katouille · Answer

bon appétit! 

voici le lien: https://pjjoint.malekal.com/files.php?id=ZHPDiag_20120807_d9d7e15s15i15

Destrio5 · Answer

Merci.

--> Copie tout le texte présent en gras ci-dessous (Sélectionne-le, clique droit dessus et choisis "Copier").


SysRestore
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Clé orpheline  
O3 - Toolbar: (no name) - [HKLM]{66886C4D-B307-4ECA-A228-52CA9B9851A4} . (...) --  (.not file.)    
OPT:O4 - HKLM\..\RunOnce: [aswAhAScr.dll] . (.AVAST Software - avast! RegSvr.) -- C:\Program Files\Alwil Software\Avast5\aswRegSvr.exe  
OPT:O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware] . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe  
OPT:O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (cleanup)] . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll  
O39 - APT:Automatic Planified Task  - C:\Windows\Tasks\Norton Security Scan for françois.job  
O42 - Logiciel: Favorit (mrxnt) - (.Pas de propriétaire.) [HKLM] -- mrxnt 
[HKLM\Software\Games-Attack]  
[HKLM\Software\SmartPCFixer]  
O43 - CFD: 20/09/2009 - 00:51:34 - [0] ----D C:\ProgramData\Games-Attack   
O43 - CFD: 20/09/2009 - 00:51:54 - [5,342] ----D C:\Users\françois\AppData\Roaming\Games-Attack   
O43 - CFD: 27/09/2010 - 11:26:06 - [1,331] ----D C:\Users\françois\AppData\Local\AskToolbar 
O59 - HSMI:Heuristic Search MagicControl Infection - (...) -- C:\Users\françois\AppData\Local\dbsqhf_nav.dat 
O59 - HSMI:Heuristic Search MagicControl Infection - (...) -- C:\Users\françois\AppData\Local\dbsqhf_navps.dat  
O59 - HSMI:Heuristic Search MagicControl Infection - (...) -- C:\Users\françois\AppData\Local\jefkfad_nav.dat  
O59 - HSMI:Heuristic Search MagicControl Infection - (...) -- C:\Users\françois\AppData\Local\jefkfad_navps.dat 
O59 - HSMI:Heuristic Search MagicControl Infection - (...) -- C:\Users\françois\AppData\Local\dbsqhf.dat      
O59 - HSMI:Heuristic Search MagicControl Infection - (...) -- C:\Users\françois\AppData\Local\jefkfad.dat      
C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar   
EmptyCLSID
EmptyFlash
EmptyTemp


--> Puis lance ZHPFix depuis le raccourci situé sur ton Bureau.
(Sous Vista/Win7, il faut cliquer droit sur le raccourci de ZHPFix et choisir Exécuter en tant qu'administrateur)

--> Une fois ZHPFix ouvert, clique sur le bouton "H" (Coller les lignes Helper). 

--> Dans l'encadré principal, tu verras donc les lignes que tu as copié précédemment apparaître. Vérifie que toutes les lignes que je t'ai demandé de copier (et seulement elles) sont dans la fenêtre.

--> Clique sur "GO" pour lancer le nettoyage. Laisse l'outil travailler et ne touche à rien.

--> Une fois terminé, copie-colle le rapport dans ton prochain message.

katouille · Answer

Rapport de ZHPFix 1.2.07 par Nicolas Coolman, Update du 20/07/2012
Fichier d'export Registre : C:\ZHP\ZHPExportRegistry-07-08-2012-14-40-26.txt
Run by SYSTEM at 07/08/2012 14:40:26
Windows Vista Home Premium Edition, 32-bit Service Pack 2 (Build 6002)
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html
Web site : http://nicolascoolman.skyrock.com/

========== Logiciel(s) ==========
SUPPRIME Favorit (mrxnt)

========== Clé(s) du Registre ==========
SUPPRIME [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mrxnt]
SUPPRIME Key*: CLSID BHO: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
SUPPRIME Key*: HKLM\Software\Games-Attack
SUPPRIME Key*: HKLM\Software\SmartPCFixer

========== Valeur(s) du Registre ==========
SUPPRIME Toolbar: {66886C4D-B307-4ECA-A228-52CA9B9851A4}
SUPPRIME RunValue: aswAhAScr.dll
SUPPRIME RunValue: Malwarebytes Anti-Malware
SUPPRIME RunValue: Malwarebytes Anti-Malware (cleanup)

========== Dossier(s) ==========
SUPPRIME Flash Cookies:
SUPPRIME Temporaires Windows:

========== Fichier(s) ==========
SUPPRIME File: c:\windows	asks
orton security scan for françois.job
SUPPRIME File: c:\users\françois\appdata\local\dbsqhf_nav.dat (Adware.Navipromo)
SUPPRIME File: c:\users\françois\appdata\local\dbsqhf_navps.dat (Adware.Navipromo)
SUPPRIME File: c:\users\françois\appdata\local\jefkfad_nav.dat (Adware.Navipromo)
SUPPRIME File: c:\users\françois\appdata\local\jefkfad_navps.dat (Adware.Navipromo)
SUPPRIME File: c:\users\françois\appdata\local\dbsqhf.dat
SUPPRIME File: c:\users\françois\appdata\local\jefkfad.dat
SUPPRIME File: C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar
SUPPRIME Flash Cookies:
SUPPRIME Temporaires Windows:

========== Restauration Système ==========
Point de restauration non crée


========== Récapitulatif ==========
4 : Clé(s) du Registre
4 : Valeur(s) du Registre
2 : Dossier(s)
10 : Fichier(s)
1 : Logiciel(s)
1 : Restauration Système


End of clean in 00mn 10s

========== Chemin de fichier rapport ==========
C:\ZHP\ZHPFix[R1].txt - 07/08/2012 14:40:26 [2010]

katouille · Answer

que dois-je faire à présent?

Destrio5 · Answer

Le mode normal fonctionne ?

katouille · Answer

toujours pas je n'arrive pas à acceder a la session. Ca met "bienvenue" et directement apres "fermeture"

katouille · Answer

que puis-je faire pour que ca marche à nouveau?

Destrio5 · Answer

Ce problème est apparu "comme ça" ?

katouille · Answer

il aurait telecharger un film (sans commentaire) et le lendemain son pc etait comme ca

Destrio5 · Answer

Tente une restauration du système en choisissant un point de restauration datant d'avant le problème.

Menu Démarrer > Tous les programmes > Accessoires > Outils système > Restauration du système.

katouille · Answer

il n'y a aucun point de restauration! :'(

Destrio5 · Answer

Je voudrais un nouveau rapport ZHPDiag.

katouille · Answer

je le fais de suite

katouille · Answer

https://pjjoint.malekal.com/files.php?id=ZHPDiag_20120807_o6o13c9s12c10

voilà le lien

katouille · Answer

que dois-je faire?

Destrio5 · Answer

Désinstalle Avast et essaie de démarrer en mode normal.

Si ça ne fonctionne toujours pas, utilise ComboFix et poste le rapport :
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

katouille · Answer

j'ai désinstallé avast mais ca ne marche toujours pas :( j'essaie combofix.

katouille · Answer

combofix refuse de s'installer!

Destrio5 · Answer

Clique droit sur ComboFix et choisis "Exécuter en tant qu'administrateur".

Sinon, essaie de le renommer en katouille.

katouille · Answer

le problème c'est qu'etant en mode sans echec il refuse de s'enregistrer sur le pc.

Destrio5 · Answer

Tu as essayé avec tes deux navigateurs (Internet Explorer, Google Chrome) ?

katouille · Answer

non juste avec google. Je vais essayer avec IE

katouille · Answer

j'ai réussi à l'installer, l'ai démarrer mais refuse de se lancer car pas en administrateur pourtant j'ai fait executer en tant qu'administrateur...

Destrio5 · Answer

As-tu un message d'erreur ? Si oui, lequel ?

L'as-tu renommé ?

katouille · Answer

oui (je traduis en gros car c'est en anglais qu'il apparait)acces refuse, le logiciel doit être lancé par l'administrateur afin d'avoir accès aux options.
Il essaie alors de faire une restauration mais là aussi accès refusé

katouille · Answer

n'y a t il pas autre chose que je puisse faire?

Destrio5 · Answer

En dernier recours, sauvegarde les documents que tu veux garder sur un disque dur externe par exemple et réinstalle proprement le système :
https://www.commentcamarche.net/faq/8775-restaurer-un-ordinateur-acer-a-son-etat-d-usine

Impossible de se connecter à une session

33 réponses

Discussions similaires

Newsletters