Chat land

Résolu
Bonsoir ,chat land a envahis mon pc ,pouvez vous m'aidés svp merci

http://pjjoint.malekal.com/files.php?id=OTL_20130609_b15e10g11q6o12

http://pjjoint.malekal.com/files.php?id=OTL_Extras_20130609_h9s15r6i12q13

http://pjjoint.malekal.com/files.php?id=20130609_b13n6f14s7p7

18 réponses

  1. Modérateur
    "Aucune action effectuée."

    --> As-tu supprimé les infections trouvées par Malwarebytes Anti-Malware ?
    1. All processes killed
      ========== OTL ==========
      HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
      C:\Documents and Settings\Touati\Application Data\Mozilla\Firefox\Profiles\bqvf5hc6.default\extensions\extension21806@extension21806.com\skin folder moved successfully.
      C:\Documents and Settings\Touati\Application Data\Mozilla\Firefox\Profiles\bqvf5hc6.default\extensions\extension21806@extension21806.com\locale\en-US folder moved successfully.
      C:\Documents and Settings\Touati\Application Data\Mozilla\Firefox\Profiles\bqvf5hc6.default\extensions\extension21806@extension21806.com\locale folder moved successfully.
      C:\Documents and Settings\Touati\Application Data\Mozilla\Firefox\Profiles\bqvf5hc6.default\extensions\extension21806@extension21806.com\defaults\preferences folder moved successfully.
      C:\Documents and Settings\Touati\Application Data\Mozilla\Firefox\Profiles\bqvf5hc6.default\extensions\extension21806@extension21806.com\defaults folder moved successfully.
      C:\Documents and Settings\Touati\Application Data\Mozilla\Firefox\Profiles\bqvf5hc6.default\extensions\extension21806@extension21806.com\chrome\content\extensionCode folder moved successfully.
      C:\Documents and Settings\Touati\Application Data\Mozilla\Firefox\Profiles\bqvf5hc6.default\extensions\extension21806@extension21806.com\chrome\content\core folder moved successfully.
      C:\Documents and Settings\Touati\Application Data\Mozilla\Firefox\Profiles\bqvf5hc6.default\extensions\extension21806@extension21806.com\chrome\content\api folder moved successfully.
      C:\Documents and Settings\Touati\Application Data\Mozilla\Firefox\Profiles\bqvf5hc6.default\extensions\extension21806@extension21806.com\chrome\content folder moved successfully.
      C:\Documents and Settings\Touati\Application Data\Mozilla\Firefox\Profiles\bqvf5hc6.default\extensions\extension21806@extension21806.com\chrome folder moved successfully.
      C:\Documents and Settings\Touati\Application Data\Mozilla\Firefox\Profiles\bqvf5hc6.default\extensions\extension21806@extension21806.com folder moved successfully.
      Use Chrome's Settings page to change the HomePage.
      File C:\Documents and Settings\Touati\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbhgoadfgiandmaieopaphefbhcdpfaf\1.23.47_0\crossrider not found.
      File C:\Documents and Settings\Touati\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbhgoadfgiandmaieopaphefbhcdpfaf\1.23.47_0 not found.
      Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Updater21806.exe deleted successfully.
      C:\Documents and Settings\Touati\Local Settings\Application Data\Updater21806\Updater21806.exe moved successfully.
      C:\Documents and Settings\Touati\Menu Démarrer\Programmes\Démarrage\Chat-Land Messenger.LNK moved successfully.
      Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
      Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
      Starting removal of ActiveX control {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
      Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
      Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
      Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
      Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
      Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:C:\WINDOWS\system32\__c006A5D1.dat deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\awvtu\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mljge\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mllji\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pmnlj\ deleted successfully.
      C:\Documents and Settings\Touati\Local Settings\Application Data\Updater21806 folder moved successfully.
      C:\Documents and Settings\Touati\Local Settings\Application Data\IminentMinibar.exe moved successfully.
      C:\Documents and Settings\Touati\Local Settings\Application Data\PricePeep.exe moved successfully.
      File C:\Documents and Settings\Touati\Bureau\Chat-Land Messenger.LNK not found.
      C:\Documents and Settings\Touati\Bureau\Chat-Land_site_de_chat_et_de_rencontre_gratuit.Url moved successfully.
      File C:\Documents and Settings\Touati\Menu Démarrer\Programmes\Démarrage\Chat-Land Messenger.LNK not found.
      C:\Documents and Settings\Touati\Bureau\Telecharger-gratuit.Url moved successfully.
      Registry value HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\lrcsTube@hansanddeta.com deleted successfully.
      C:\Program Files\LyricsTube\FF\chrome\content folder moved successfully.
      C:\Program Files\LyricsTube\FF\chrome folder moved successfully.
      C:\Program Files\LyricsTube\FF folder moved successfully.
      Registry value HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\LrcsTb@hansenapps.com deleted successfully.
      File C:\Program Files\LyricsTube\FF\ not found.
      File C:\Documents and Settings\Touati\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bebdghdpchfhbbmfeddkijldlpnkbjkk\1.114_0 not found.
      Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B399EDE8-1525-458C-8DD9-31EADF632D06}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B399EDE8-1525-458C-8DD9-31EADF632D06}\ deleted successfully.
      C:\Program Files\LyricsTube\lrcstube.dll moved successfully.
      C:\Program Files\LyricsTube folder moved successfully.
      C:\WINDOWS\tasks\LyricsTube Update.job moved successfully.
      ========== FILES ==========
      File\Folder C:\Documents and Settings\Touati\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbhgoadfgiandmaieopaphefbhcdpfaf not found.
      ========== REGISTRY ==========
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29C7E8BE-FBD9-4D91-BC4F-B470C718D554}\ deleted successfully.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29C7E8BE-FBD9-4D91-BC4F-B470C718D554}\ not found.
      Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lrcsTube@hansanddeta.com\ deleted successfully.
      ========== COMMANDS ==========

      [EMPTYTEMP]

      User: All Users

      User: Default User
      ->Temp folder emptied: 0 bytes
      ->Temporary Internet Files folder emptied: 33170 bytes
      ->Flash cache emptied: 83 bytes

      User: LocalService
      ->Temp folder emptied: 66016 bytes
      ->Temporary Internet Files folder emptied: 13022053 bytes

      User: NetworkService
      ->Temp folder emptied: 0 bytes
      ->Temporary Internet Files folder emptied: 32902 bytes

      User: Touati
      ->Temp folder emptied: 401127187 bytes
      ->Temporary Internet Files folder emptied: 120649716 bytes
      ->Java cache emptied: 60818063 bytes
      ->FireFox cache emptied: 66871499 bytes
      ->Google Chrome cache emptied: 384284995 bytes
      ->Flash cache emptied: 425182 bytes

      %systemdrive% .tmp files removed: 0 bytes
      %systemroot% .tmp files removed: 3211881 bytes
      %systemroot%\System32 .tmp files removed: 3892988 bytes
      %systemroot%\System32\dllcache .tmp files removed: 0 bytes
      %systemroot%\System32\drivers .tmp files removed: 0 bytes
      Windows Temp folder emptied: 43063619 bytes
      %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 237265945 bytes
      %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33726 bytes
      RecycleBin emptied: 2962713628 bytes

      Total Files Cleaned = 4 098,00 mb

      OTL by OldTimer - Version 3.2.69.0 log created on 06102013_023658

      Files\Folders moved on Reboot...
      File\Folder C:\WINDOWS\temp\_avast5_\Webshlock.txt not found!

      PendingFileRenameOperations files...

      Registry entries deleted on Reboot...
      1. Modérateur
        --> Double-clique sur OTL pour le lancer.
        (Sous Vista/Win7/Win8, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)

        --> Sous l'onglet Personnalisation en bas de la fenêtre, copie-colle le texte en gras présent ci-dessous :

        :OTL
        IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.eo.st
        [2013/06/09 20:58:19 | 000,000,000 | ---D | M] ("Deals Plugin Extension") -- C:\Documents and Settings\Touati\Application Data\Mozilla\Firefox\Profiles\bqvf5hc6.default\extensions\extension21806@extension21806.com
        CHR - homepage: https://fr.ask.com/?l=dis&o=15506
        CHR - Extension: Deals Plugin Extension = C:\Documents and Settings\Touati\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbhgoadfgiandmaieopaphefbhcdpfaf\1.23.47_0\crossrider
        CHR - Extension: Deals Plugin Extension = C:\Documents and Settings\Touati\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbhgoadfgiandmaieopaphefbhcdpfaf\1.23.47_0\
        O4 - HKCU..\Run: [Updater21806.exe] C:\Documents and Settings\Touati\Local Settings\Application Data\Updater21806\Updater21806.exe (Innovative Apps)
        O4 - Startup: C:\Documents and Settings\Touati\Menu Démarrer\Programmes\Démarrage\Chat-Land Messenger.LNK = File not found
        O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
        O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Reg Error: Key error.)
        O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
        O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
        O20 - AppInit_DLLs: (C:\WINDOWS\system32\__c006A5D1.dat) - File not found
        O20 - Winlogon\Notify\awvtu: DllName - (C:\WINDOWS\system32\awvtu.dll) - File not found
        O20 - Winlogon\Notify\mljge: DllName - (C:\WINDOWS\system32\mljge.dll) - File not found
        O20 - Winlogon\Notify\mllji: DllName - (C:\WINDOWS\system32\mllji.dll) - File not found
        O20 - Winlogon\Notify\pmnlj: DllName - (C:\WINDOWS\system32\pmnlj.dll) - File not found
        [2013/06/09 20:58:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Touati\Local Settings\Application Data\Updater21806
        [2013/06/08 23:36:09 | 000,841,871 | ---- | C] (Iminent.com) -- C:\Documents and Settings\Touati\Local Settings\Application Data\IminentMinibar.exe
        [2013/06/08 23:36:07 | 000,635,596 | ---- | C] (PricePeep.com) -- C:\Documents and Settings\Touati\Local Settings\Application Data\PricePeep.exe
        [2013/06/09 16:08:16 | 000,000,676 | ---- | M] () -- C:\Documents and Settings\Touati\Bureau\Chat-Land Messenger.LNK
        [2013/06/09 16:08:16 | 000,000,054 | ---- | M] () -- C:\Documents and Settings\Touati\Bureau\Chat-Land_site_de_chat_et_de_rencontre_gratuit.Url
        [2013/06/08 23:38:51 | 000,000,688 | ---- | M] () -- C:\Documents and Settings\Touati\Menu Démarrer\Programmes\Démarrage\Chat-Land Messenger.LNK
        [2013/06/08 23:38:48 | 000,000,057 | ---- | C] () -- C:\Documents and Settings\Touati\Bureau\Telecharger-gratuit.Url
        FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\lrcsTube@hansanddeta.com: C:\Program Files\LyricsTube\FF\ [2013/06/08 23:36:17 | 000,000,000 | ---D | M]
        FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\LrcsTb@hansenapps.com: C:\Program Files\LyricsTube\FF\ [2013/06/08 23:36:17 | 000,000,000 | ---D | M]
        CHR - Extension: LyricsTube = C:\Documents and Settings\Touati\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bebdghdpchfhbbmfeddkijldlpnkbjkk\1.114_0\
        O2 - BHO: (LyricsTube) - {B399EDE8-1525-458C-8DD9-31EADF632D06} - C:\Program Files\LyricsTube\lrcstube.dll (Hansen & Destar Apps)
        [2013/06/08 23:36:17 | 000,000,000 | ---D | C] -- C:\Program Files\LyricsTube
        [2013/06/10 01:21:23 | 000,000,358 | ---- | M] () -- C:\WINDOWS\tasks\LyricsTube Update.job

        :files
        C:\Documents and Settings\Touati\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bbhgoadfgiandmaieopaphefbhcdpfaf

        :reg
        [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29C7E8BE-FBD9-4D91-BC4F-B470C718D554}]
        [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lrcsTube@hansanddeta.com]

        :commands
        [emptytemp]


        --> Puis clique sur le bouton Correction en haut de la fenêtre.

        --> Laisse le programme travailler, redémarre une fois le fix terminé.

        --> Poste le rapport qui s'affichera après redémarrage.
        1. Modérateur
          J'ai vu les deux rapports d'OTL et celui de Malwarebytes Anti-Malware.
          1. j'ai poster les 2 liens et aucune reponse a par la tienne je te remercie
            1. Modérateur
              Bonjour,

              --> Télécharge et lance AdwCleaner (d'Xplode), choisis l'option "Suppression" et poste le rapport.