PUP : bsdriver.sys - PUP-FBX
RésoluJe poste une nouvelle question car il y a trop de réponses diverses ...
Désespérée, l'anti-virus détecte le programme indésirable pup mais non supprimé ??
Que puis-je faire ??
Vraiment merci .
26 réponses
La problématique est que l'antivirus détecte des programmes indésirables (PUP) sans les supprimer, suscitant des interrogations sur les meilleures actions à entreprendre dans ce contexte particulier. Plusieurs éléments de réponse préconisent l’utilisation de Malwarebytes Anti-Malware pour analyser les menaces et placer les PUP en quarantaine, puis supprimer ou programmer la suppression au redémarrage selon les entrées détectées. D'autres avertissent du risque de perte de données lors de suppressions multiples et recommandent de sauvegarder les fichiers importants avant toute action, puis de vérifier chaque élément avant validation. En complément, des éléments listés appartiennent parfois à des logiciels légitimes et exigent une désactivation sélective plutôt qu'une suppression intégrale afin d’éviter des dysfonctionnements système.
-
Bonjour,
J'ai le même probleme que saramarcel.
J'ai lancé du coup une analyse malwarebyte et j'ai le rapport:
https://pjjoint.malekal.com/files.php?id=20160512_t10u8w9m14v12
Je voulais savoir maintenant ce que je devais faire parce que j'avoue que je suis un peu perdu dans tout ça.-
Voila le rapport de Adwcleaner aussi:
# AdwCleaner v5.023 - Rapport créé le 30/11/2015 à 19:20:07
# Mis à jour le 30/11/2015 par Xplode
# Base de données : 2015-11-30.1 [Serveur]
# Système d'exploitation : Windows 10 Home (x64)
# Nom d'utilisateur : jmore - DESKTOP-73TPG65
# Exécuté depuis : C:\Users\jmore\Downloads\adwcleaner_5.023 (1).exe
# Option : Nettoyer
# Support : https://toolslib.net/forum- [ Services ] *****
[-] Service Supprimé : bsdriver
[-] Service Supprimé : cherimoya
[-] Service Supprimé : csrcc
[-] Service Supprimé : SPBIUpd
[-] Service Supprimé : SPBIUpdd
[-] Service Supprimé : SSFK
[-] Service Supprimé : acengine
[-] Service Supprimé : WdsManPro
[-] Service Supprimé : acwfp
[-] Service Supprimé : WNEn Monitor
[-] Service Supprimé : pupivyhi
[-] Service Supprimé : tiboreso
[-] Service Supprimé : swsedrvr_vw_1_10_0_25
[-] Service Supprimé : swsesrvc_1.10.0.25
[-] Service Supprimé : Update Primary Color
[-] Service Supprimé : Util Primary Color
[-] Service Supprimé : B1B7A63B-D2F9-444C-9A89-3A90E92668B4
[!] Service Non Supprimé : csrcc
[-] Service Supprimé : groover291120151832 Updater
[-] Service Supprimé : Lagperpe
[-] Service Supprimé : NosnojIrak
[!] Service Non Supprimé : B1B7A63B-D2F9-444C-9A89-3A90E92668B4- [ Dossiers ] *****
[-] Dossier Supprimé : C:\Program Files\WNEn
[#] Dossier Supprimé : C:\Program Files\groover291120151832
[-] Dossier Supprimé : C:\Program Files (x86)\Object Browser
[-] Dossier Supprimé : C:\Program Files (x86)\ShopperPro
[-] Dossier Supprimé : C:\Program Files (x86)\RinoReader
[-] Dossier Supprimé : C:\Program Files (x86)\SFK
[-] Dossier Supprimé : C:\Program Files (x86)\Fast-Search
[-] Dossier Supprimé : C:\Program Files (x86)\35444335-1448821096-3337-5739-9457A5DDA83D
[-] Dossier Supprimé : C:\Program Files (x86)\35444335-1448904591-3337-5739-9457A5DDA83D
[-] Dossier Supprimé : C:\Program Files (x86)\35444335-1448907206-3337-5739-9457A5DDA83D
[-] Dossier Supprimé : C:\Program Files (x86)\SwiftSearch_1.10.0.25
[+] Dossier Supprimé : C:\Program Files (x86)\Primary Color
[!] Dossier Non Supprimé : C:\Program Files (x86)\Object Browser
[-] Dossier Supprimé : C:\Program Files (x86)\spaceeplus_v144.10011
[-] Dossier Supprimé : C:\Program Files (x86)\gmsd_fr_005010161
[-] Dossier Supprimé : C:\Program Files (x86)\gmsd_fr_005010162
[-] Dossier Supprimé : C:\Program Files (x86)\mpck_en_004090161
[-] Dossier Supprimé : C:\Program Files (x86)\rec_en_77
[!] Dossier Non Supprimé : C:\Program Files (x86)\spaceeplus_v144.10011
[-] Dossier Supprimé : C:\Program Files\Common Files\ShopperPro
[-] Dossier Supprimé : C:\ProgramData\Browser
[-] Dossier Supprimé : C:\ProgramData\ShopperPro
[-] Dossier Supprimé : C:\ProgramData\WebShield
[!] Dossier Non Supprimé : C:\ProgramData\WebShield
[-] Dossier Supprimé : C:\ProgramData\BWMiniProB
[-] Dossier Supprimé : C:\ProgramData\lWMiniProl
[-] Dossier Supprimé : C:\ProgramData\XWMiniProX
[-] Dossier Supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GAMESDESKTOP
[-] Dossier Supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WNEn
[-] Dossier Supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MOBILEPCSTARTERKIT
[-] Dossier Supprimé : C:\Users\jmore\AppData\Local\BrowserHelper
[-] Dossier Supprimé : C:\Users\jmore\AppData\Local\WebShield
[!] Dossier Non Supprimé : C:\Users\jmore\AppData\Local\WebShield
[-] Dossier Supprimé : C:\Users\jmore\AppData\Local\gmsd_fr_005010161
[-] Dossier Supprimé : C:\Users\jmore\AppData\Local\gmsd_fr_005010162
[-] Dossier Supprimé : C:\Users\jmore\AppData\Local\mpck_en_004090161
[-] Dossier Supprimé : C:\Users\jmore\AppData\Local\rec_en_77
[-] Dossier Supprimé : C:\Users\jmore\AppData\Local\Installer\Install_11947
[-] Dossier Supprimé : C:\Users\jmore\AppData\Local\Installer\Install_18166
[-] Dossier Supprimé : C:\Users\jmore\AppData\Local\Temp\Primary Color
[-] Dossier Supprimé : C:\Users\jmore\AppData\LocalLow\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}
[-] Dossier Supprimé : C:\Users\jmore\AppData\Roaming\istartsurf
[-] Dossier Supprimé : C:\Users\jmore\AppData\Roaming\Nosibay
[-] Dossier Supprimé : C:\Users\jmore\AppData\Roaming\Store
[-] Dossier Supprimé : C:\Users\jmore\AppData\Roaming\VOPackage
[-] Dossier Supprimé : C:\Users\jmore\AppData\Roaming\WTools
[-] Dossier Supprimé : C:\Users\jmore\AppData\Roaming\ASPackage
[-] Dossier Supprimé : C:\Users\jmore\AppData\Roaming\istartpageing
[-] Dossier Supprimé : C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
[-] Dossier Supprimé : C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASPackage
[-] Dossier Supprimé : C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RinoReader
[-] Dossier Supprimé : C:\Users\Public\Documents\ShopperPro
[#] Dossier Supprimé : C:\Windows\SysNative\Tasks\WindApp Update
[-] Dossier Supprimé : C:\Windows\SysWOW64\config\systemprofile\AppData\Local\acengine- [ Fichiers ] *****
[-] Fichier Supprimé : C:\END
[-] Fichier Supprimé : C:\task.vbs
[-] Fichier Supprimé : C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
[-] Fichier Supprimé : C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.pricepeep00.pricepeep.net_0.localstorage
[-] Fichier Supprimé : C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.pricepeep00.pricepeep.net_0.localstorage-journal
[-] Fichier Supprimé : C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.boostsaves.com_0.localstorage
[-] Fichier Supprimé : C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.boostsaves.com_0.localstorage-journal
[-] Fichier Supprimé : C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.boostsaves.com_0.localstorage
[-] Fichier Supprimé : C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.boostsaves.com_0.localstorage-journal
[-] Fichier Supprimé : C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_nps.pastaleads.com_0.localstorage
[-] Fichier Supprimé : C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_nps.pastaleads.com_0.localstorage-journal
[-] Fichier Supprimé : C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_pstatic.bestpriceninja.com_0.localstorage
[-] Fichier Supprimé : C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_pstatic.bestpriceninja.com_0.localstorage-journal
[-] Fichier Supprimé : C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.re-markable00.re-markable.net_0.localstorage
[-] Fichier Supprimé : C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.re-markable00.re-markable.net_0.localstorage-journal
[-] Fichier Supprimé : C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_hdapp1008-a.akamaihd.net_0.localstorage
[-] Fichier Supprimé : C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_hdapp1008-a.akamaihd.net_0.localstorage-journal
[-] Fichier Supprimé : C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.istartpageing.com_0.localstorage
[-] Fichier Supprimé : C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.istartpageing.com_0.localstorage-journal
[-] Fichier Supprimé : C:\Users\jmore\AppData\Local\Temp\task.vbs
[-] Fichier Supprimé : C:\Users\jmore\AppData\Local\Temp\lengine.ini.log
[-] Fichier Supprimé : C:\Users\jmore\AppData\Local\Temp\acengine.log
[-] Fichier Supprimé : C:\Users\jmore\AppData\Roaming\Bubble Dock.boostrap.log
[-] Fichier Supprimé : C:\Users\jmore\AppData\Roaming\Bubble Dock.installation.log
[-] Fichier Supprimé : C:\Users\jmore\AppData\Roaming\Selection Tools.installation.log
[-] Fichier Supprimé : C:\Users\jmore\AppData\Roaming\WindApp.boostrap.log
[-] Fichier Supprimé : C:\Users\jmore\AppData\Roaming\WindApp.installation.log
[-] Fichier Supprimé : C:\Windows\SysNative\acengineOff.ini
[-] Fichier Supprimé : C:\Windows\SysNative\acengine64.dll
[-] Fichier Supprimé : C:\Windows\SysNative\Lagperpe64.dll
[-] Fichier Supprimé : C:\Windows\SysNative\drivers\bsdriver.sys
[-] Fichier Supprimé : C:\Windows\SysNative\drivers\cherimoya.sys
[-] Fichier Supprimé : C:\Windows\SysNative\drivers\swsedrvr_vt_1_10_0_25.sys
[-] Fichier Supprimé : C:\Windows\SysNative\drivers\swsedrvr_vw_1_10_0_25.sys
[-] Fichier Supprimé : C:\Windows\SysWOW64\acengineOff.ini
[-] Fichier Supprimé : C:\Windows\SysWOW64\acengine.dll
[-] Fichier Supprimé : C:\Windows\SysWOW64\Lagperpe.dll- [ DLLs ] *****
[-] Fichier Désinfecté : C:\Windows\SysNative\dnsapi.dll
[-] Fichier Désinfecté : C:\Windows\SysWOW64\dnsapi.dll- [ Raccourcis ] *****
- [ Tâches planifiées ] *****
[-] Tâche Supprimée : ShopperProJSUpd
[-] Tâche Supprimée : WindApp Update
[-] Tâche Supprimée : LaunchPreSignup
[-] Tâche Supprimée : SwiftSearch Auto Updater 1.10.0.25 Core
[-] Tâche Supprimée : SwiftSearch Auto Updater 1.10.0.25 Pending Update
[-] Tâche Supprimée : WindApp Update
[-] Tâche Supprimée : 97517cee-6c0c-44d1-b0ad-2f72c325843e-1-6
[-] Tâche Supprimée : 97517cee-6c0c-44d1-b0ad-2f72c325843e-1-7
[-] Tâche Supprimée : 97517cee-6c0c-44d1-b0ad-2f72c325843e-13
[-] Tâche Supprimée : 97517cee-6c0c-44d1-b0ad-2f72c325843e-14
[-] Tâche Supprimée : 97517cee-6c0c-44d1-b0ad-2f72c325843e-5
[-] Tâche Supprimée : 97517cee-6c0c-44d1-b0ad-2f72c325843e-5_user
[-] Tâche Supprimée : 97517cee-6c0c-44d1-b0ad-2f72c325843e-6
[-] Tâche Supprimée : 97517cee-6c0c-44d1-b0ad-2f72c325843e-7
[-] Tâche Supprimée : 97517cee-6c0c-44d1-b0ad-2f72c325843e-1-6
[-] Tâche Supprimée : 97517cee-6c0c-44d1-b0ad-2f72c325843e-1-7
[-] Tâche Supprimée : 97517cee-6c0c-44d1-b0ad-2f72c325843e-13
[-] Tâche Supprimée : 97517cee-6c0c-44d1-b0ad-2f72c325843e-14
[-] Tâche Supprimée : 97517cee-6c0c-44d1-b0ad-2f72c325843e-5
[-] Tâche Supprimée : 97517cee-6c0c-44d1-b0ad-2f72c325843e-5_user
[-] Tâche Supprimée : 97517cee-6c0c-44d1-b0ad-2f72c325843e-6
[-] Tâche Supprimée : 97517cee-6c0c-44d1-b0ad-2f72c325843e-7
[-] Tâche Supprimée : SPBIW_UpdateTask_Time_333530313837353330312d5737325a786c5a3237344541
[-] Tâche Supprimée : YCMServiceAgent- [ Registre ] *****
[-] Valeur Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [WindApp]
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\driverscanner
[-] Valeur Supprimée : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [YTDownloader]
[-] Valeur Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [YTDownloader]
[-] Valeur Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Selection Tools]
[-] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ShopperPro.exe
[-] Clé Supprimée : HKLM\SOFTWARE\CLASSES\acengineLib.ReadOnlyManager.1
[-] Clé Supprimée : HKLM\SOFTWARE\CLASSES\acengineLib.ReadOnlyManager
[-] Clé Supprimée : HKLM\SOFTWARE\CLASSES\acengineLib.LSPLogic.1
[-] Clé Supprimée : HKLM\SOFTWARE\CLASSES\acengineLib.LSPLogic
[-] Clé Supprimée : HKLM\SOFTWARE\CLASSES\acengineLib.DataTableHolder.1
[-] Clé Supprimée : HKLM\SOFTWARE\CLASSES\acengineLib.DataTableHolder
[-] Clé Supprimée : HKLM\SOFTWARE\CLASSES\acengineLib.DataTableFields.1
[-] Clé Supprimée : HKLM\SOFTWARE\CLASSES\acengineLib.DataTableFields
[-] Clé Supprimée : HKLM\SOFTWARE\CLASSES\acengineLib.DataTable.1
[-] Clé Supprimée : HKLM\SOFTWARE\CLASSES\acengineLib.DataTable
[-] Clé Supprimée : HKLM\SOFTWARE\CLASSES\acengineLib.DataController.1
[-] Clé Supprimée : HKLM\SOFTWARE\CLASSES\acengineLib.DataController
[-] Clé Supprimée : HKLM\SOFTWARE\CLASSES\acengineLib.DataContainer.1
[-] Clé Supprimée : HKLM\SOFTWARE\CLASSES\acengineLib.DataContainer
[-] Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\acengine
[-] Clé Supprimée : HKLM\SOFTWARE\CLASSES\acengineLib.WFPController
[-] Clé Supprimée : HKLM\SOFTWARE\CLASSES\acengineLib.WFPController.1
[-] Clé Supprimée : HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RinoReader.exe
[-] Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\acwfp
[-] Clé Supprimée : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WdsManPro
[-] Clé Supprimée : HKLM\SOFTWARE\CLASSES\APPID\acengine.EXE
[-] Clé Supprimée : HKLM\System\CurrentControlSet\Services\Eventlog\Application\Update Primary Color
[-] Clé Supprimée : HKLM\System\CurrentControlSet\Services\Eventlog\Application\Util Primary Color
[-] Valeur Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [mpck_en_004090161]
[-] Valeur Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [gmsd_fr_005010161]
[-] Valeur Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [rec_en_77]
[-] Valeur Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [gmsd_fr_005010162]
[-] Valeur Supprimée : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{01EA9CB1-4846-4FD8-925B-D36C1BA24095}]
[-] Valeur Supprimée : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{01EA9CB1-4846-4FD8-925B-D36C1BA24095}]
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{425F4ABF-B8E4-402D-9E49-06E494EB8DBF}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{9F2949D6-977B-4B61-B513-0C2EE52C2B4F}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\3045035B-3C14-4698-8AC4-ADB18CC42C1E
[-] Clé Supprimée : HKCU\Software\Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{051E9166-B275-4683-907B-372FAE22BC7C}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{E5A7A645-8318-4895-B85C-EDC606B80DB6}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{7D8DAE88-BC05-4578-8C29-E541FFBA5757}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{351A01B5-849A-ECA5-2760-EE9665E223C3}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{593D67B9-3A50-EBAA-17BE-61A5EC986A22}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{B0A28F54-B08F-4049-A9BF-8D33BD1E9222}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{08ACFB57-8187-47F0-AF93-56360D03634A}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{34EBA76A-E745-4B18-96C9-2B8E2BA8B246}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{3A8E009B-E66D-4016-87CF-EC57FA9A4BC1}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{4D4D0357-0376-4656-A040-65AC089E84A2}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{6D5AF218-5F7E-40E0-B49D-54FFAFE2001A}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{89E46EA6-2F87-4D79-8FFA-8B264F93F54A}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{9ECCDEFC-1C26-4BB3-B6DF-252672D9FFFA}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{F1BC674D-15D8-46C5-AC51-12AB16D67616}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{F811C371-1DC7-4E2F-8676-D96B85BE4AF1}
[!] Clé Non Supprimée : HKLM\SOFTWARE\Classes\CLSID\{b0a28f54-b08f-4049-a9bf-8d33bd1e9222}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{01EA9CB1-4846-4FD8-925B-D36C1BA24095}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{376256F0-ED45-492A-872D-93C9518752AA}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{444E93F7-55D8-438C-bE6E-93BBC1AC18EB}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{6BF4B945-92E8-4992-88AA-C0561DE65A31}
[!] Clé Non Supprimée : HKLM\SOFTWARE\Classes\CLSID\{7D8DAE88-BC05-4578-8C29-E541FFBA5757}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{8187D179-93F9-4ADC-a943-0DAE295D7324}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{86337906-573F-421B-8A49-6A24AFC94858}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{D9BD2D8F-0123-4512-a7C2-7AB8BB15BDAD}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{E4C3E50F-5761-4BF8-95A0-939A819DF1C3}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{A9582D7B-F24A-441D-9D26-450D58F3CD17}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{EE0D8859-2ED4-4B0D-9812-16865B9AFD65}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{83E07061-02D1-41EC-8751-BB176B823C38}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{7C4D6CD3-DBBE-479C-B094-4492B67F2D42}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{1C8A72C0-D317-45BC-98D5-6CCC4D5E6C41}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{255D8BF1-5A7A-4E5A-ABC5-4F54D506F8F9}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{2CB775B4-EC2D-4C7E-82BB-9716D23DC463}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{6E0EFF7F-AA4E-47FE-8D37-0379FF8255D3}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{854BC76A-1925-43BD-9DC0-39236E5DB9A1}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\Interface\{9142AE85-BAAD-4DF4-8EC0-C116F44F0818}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{9AE7A6AE-162E-44C4-9A2B-A6B4EF19909D}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{14EF423E-3EE8-44AE-9337-07AC3F27B744}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{029AF757-A988-4BDD-A744-A4C7BCEBB011}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{A2D2064A-5E24-4D7F-A627-D85B6E5038B9}
[!] Clé Non Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{14EF423E-3EE8-44AE-9337-07AC3F27B744}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{6B040623-38AD-454E-8095-66F9E89570C8}
[!] Clé Non Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{9AE7A6AE-162E-44C4-9A2B-A6B4EF19909D}
[-] Clé Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{E8947FDC-396F-4090-AC86-FDBEB2BF0616}
[-] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B0A28F54-B08F-4049-A9BF-8D33BD1E9222}
[!] Clé Non Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b0a28f54-b08f-4049-a9bf-8d33bd1e9222}
[-] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01EA9CB1-4846-4FD8-925B-D36C1BA24095}
[-] Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B0A28F54-B08F-4049-A9BF-8D33BD1E9222}
[!] Clé Non Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{b0a28f54-b08f-4049-a9bf-8d33bd1e9222}
[-] Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01EA9CB1-4846-4FD8-925B-D36C1BA24095}
[-] Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B0A28F54-B08F-4049-A9BF-8D33BD1E9222}
[!] Clé Non Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{b0a28f54-b08f-4049-a9bf-8d33bd1e9222}
[-] Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{01EA9CB1-4846-4FD8-925B-D36C1BA24095}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\CLSID\{051E9166-B275-4683-907B-372FAE22BC7C}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\CLSID\{E5A7A645-8318-4895-B85C-EDC606B80DB6}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\CLSID\{08ACFB57-8187-47F0-AF93-56360D03634A}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\CLSID\{01EA9CB1-4846-4FD8-925B-D36C1BA24095}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{E4C3E50F-5761-4BF8-95A0-939A819DF1C3}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{A9582D7B-F24A-441D-9D26-450D58F3CD17}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{EE0D8859-2ED4-4B0D-9812-16865B9AFD65}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{3323765B-5B83-4406-841E-473DBA4B8F29}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{389562C4-59D9-40C4-966E-28DA91725FFE}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{3F8D3B31-AEB8-4ED7-8B05-5556068D6B54}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{6ED1EF08-DFF4-4252-8986-691D06C54131}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{83E07061-02D1-41EC-8751-BB176B823C38}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{9F0948E7-227A-4F1B-9849-2D8912F185A7}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{A471A4AA-5C18-429F-81BF-6C760941DB74}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{C0A7C2B3-86D6-42AF-8221-79C9E4AD50BA}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{F2FB003D-07C7-4E4D-80E3-00B49468A6F4}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{F7971E81-FC71-4659-8CCE-C903576E0924}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{00E3D575-A24C-4BBC-A708-BCDB8BBCA6C7}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{024BF4C8-B53D-45B9-957F-D3BA9655FF39}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{074DCA49-F6A1-417F-B79E-D5E3ADC30330}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{7C4D6CD3-DBBE-479C-B094-4492B67F2D42}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{1C8A72C0-D317-45BC-98D5-6CCC4D5E6C41}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{255D8BF1-5A7A-4E5A-ABC5-4F54D506F8F9}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{2CB775B4-EC2D-4C7E-82BB-9716D23DC463}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{6E0EFF7F-AA4E-47FE-8D37-0379FF8255D3}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{854BC76A-1925-43BD-9DC0-39236E5DB9A1}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{9142AE85-BAAD-4DF4-8EC0-C116F44F0818}
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01EA9CB1-4846-4FD8-925B-D36C1BA24095}
[-] Clé Supprimée : HKCU\Software\InstalledBrowserExtensions
[-] Clé Supprimée : HKCU\Software\Nosibay
[-] Clé Supprimée : HKCU\Software\ShopperPro
[-] Clé Supprimée : HKCU\Software\Store
[-] Clé Supprimée : HKCU\Software\Tutorials
[-] Clé Supprimée : HKCU\Software\TutoTag
[-] Clé Supprimée : HKCU\Software\GAMESDESKTOP
[-] Clé Supprimée : HKCU\Software\WajIEnhance
[-] Clé Supprimée : HKCU\Software\WTools
[-] Clé Supprimée : HKCU\Software\RinoReader
[-] Clé Supprimée : HKCU\Software\Primary Color
[-] Clé Supprimée : HKCU\Software\tstamptoken
[-] Clé Supprimée : HKCU\Software\spaceplus
[!] Clé Non Supprimée : HKCU\Software\Primary Color
[-] Clé Supprimée : HKCU\Software\Object Browser-nv
[-] Clé Supprimée : HKCU\Software\Object Browser-nv-ie
[-] Clé Supprimée : HKCU\Software\{6CDBC034-BC88-46DD-8E15-6C304892E4D4}
[-] Clé Supprimée : HKCU\Software\AppDataLow\Software\Crossrider
[-] Clé Supprimée : HKCU\Software\AppDataLow\Software\DynConIE
[-] Clé Supprimée : HKLM\SOFTWARE\AppDataLow\SOFTWARE\Crossrider
[-] Clé Supprimée : HKLM\SOFTWARE\GlobalUpdate
[-] Clé Supprimée : HKLM\SOFTWARE\InstalledBrowserExtensions
[-] Clé Supprimée : HKLM\SOFTWARE\Object Browser
[-] Clé Supprimée : HKLM\SOFTWARE\Tutorials
[-] Clé Supprimée : HKLM\SOFTWARE\Uniblue
[-] Clé Supprimée : HKLM\SOFTWARE\GAMESDESKTOP
[-] Clé Supprimée : HKLM\SOFTWARE\Primary Color
[-] Clé Supprimée : HKLM\SOFTWARE\WdsManPro
[-] Clé Supprimée : HKLM\SOFTWARE\Fast-Search
[-] Clé Supprimée : HKLM\SOFTWARE\SVH
[-] Clé Supprimée : HKLM\SOFTWARE\WNEn
[-] Clé Supprimée : HKLM\SOFTWARE\MOBILEPCSTARTERKIT
[-] Clé Supprimée : HKLM\SOFTWARE\SOUNDPLUS
[-] Clé Supprimée : HKLM\SOFTWARE\istartpageingSoftware
[-] Clé Supprimée : HKLM\SOFTWARE\SwiftSearch_1.10.0.25
[!] Clé Non Supprimée : HKLM\SOFTWARE\Primary Color
[!] Clé Non Supprimée : HKLM\SOFTWARE\Object Browser
[-] Clé Supprimée : HKLM\SOFTWARE\Object Browser-nv
[-] Clé Supprimée : HKLM\SOFTWARE\Object Browser-nv-ie
[-] Clé Supprimée : HKLM\SOFTWARE\groover291120151832
[-] Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\windapp
[-] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Object Browser
[-] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShopperPro
[-] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage
[-] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ASPackage
[-] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RinoReader
[-] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebShield
[-] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7ADF667E-E14D-4D2C-827C-B0108F0D93BC}
[-] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SU
[-] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C42C5197-0EE9-4940-893B-F4EF047DFF0F}
[-] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fast-Search
[-] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNEn
[-] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SwiftSearch_1.10.0.25
[!] Clé Non Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebShield
[!] Clé Non Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Object Browser
[-] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_fr_005010161_is1
[-] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_fr_005010162_is1
[-] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mpck_en_004090161_is1
[-] Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rec_en_77_is1
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\ShopperPro
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\WebBar
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\WNEn
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\groover291120151832
[-] Clé Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Primary Color
[!] Clé Non Supprimée : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Primary Color
[-] Clé Supprimée : HKU\.DEFAULT\Software\{6CDBC034-BC88-46DD-8E15-6C304892E4D4}
[-] Clé Supprimée : HKU\S-1-5-19\Software\{6CDBC034-BC88-46DD-8E15-6C304892E4D4}
[-] Clé Supprimée : HKU\S-1-5-20\Software\{6CDBC034-BC88-46DD-8E15-6C304892E4D4}
[-] Clé Supprimée : HKU\S-1-5-21-2865881956-1137169681-342651765-1001_Classes\Software\{6CDBC034-BC88-46DD-8E15-6C304892E4D4}
[-] Donnée Restaurée : HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command []
[-] Donnée Restaurée : HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command []
[-] Donnée Restaurée : HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{0e4e375a-b29a-4eaf-b778-b420f8d7c731} [NameServer]
[-] Donnée Restaurée : HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{142896e7-72b2-4551-9bed-2b58b7ad6253} [NameServer]
[-] Donnée Restaurée : HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{26b11a49-585f-4b43-a90c-9af3c3d7b25b} [NameServer]
[-] Donnée Restaurée : HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{6bb4f047-2706-11e5-9bbe-806e6f6e6963} [NameServer]
[-] Donnée Restaurée : HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{6bb84159-4639-444d-afbc-e65714c495b3} [NameServer]
[-] Donnée Restaurée : HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{a58d162a-3d82-4835-9d9c-dd8567bdfa0b} [NameServer]
[-] Donnée Restaurée : HKLM\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{0e4e375a-b29a-4eaf-b778-b420f8d7c731} [NameServer]
[-] Donnée Restaurée : HKLM\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{142896e7-72b2-4551-9bed-2b58b7ad6253} [NameServer]
[-] Donnée Restaurée : HKLM\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{26b11a49-585f-4b43-a90c-9af3c3d7b25b} [NameServer]
[-] Donnée Restaurée : HKLM\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{6bb4f047-2706-11e5-9bbe-806e6f6e6963} [NameServer]
[-] Donnée Restaurée : HKLM\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{6bb84159-4639-444d-afbc-e65714c495b3} [NameServer]
[-] Donnée Restaurée : HKLM\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{a58d162a-3d82-4835-9d9c-dd8567bdfa0b} [NameServer]
[-] Clé Supprimée : HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\re-markit.co
[-] Clé Supprimée : HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\static.re-markit00.re-markit.co
[-] Clé Supprimée : HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\re-markit.co
[-] Clé Supprimée : HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\static.re-markit00.re-markit.co- [ Navigateurs ] *****
[-] [C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Supprimé : hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&from=newgdp&uid=WDCXWD3200BEVT-22ZCT0_WD-WXE408KA4640A4640&ts=1373219389
[-] [C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Supprimé : hxxp://www.istartpageing.com/?type=hp&ts=1448820617&z=bbd55ec9e18e8912931cb96gcz9z6bdb9o7eeq4g4m&from=tugss&uid=HGSTXHTS541010A9E680_JA1086SB07HWVT07HWVTX
[-] [C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Default_Search_Provider] Supprimé : hxxp://www.istartpageing.com/webfavicon.ico
:: Clés "Tracing" supprimées
:: Paramètres Winsock réinitialisés
########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [32025 octets] ##########
# AdwCleaner v5.116 - Rapport créé le 12/05/2016 à 17:02:25
# Mis à jour le 09/05/2016 par Xplode
# Base de données : 2016-05-09.1 [Serveur]
# Système d'exploitation : Windows 10 Home (X64)
# Nom d'utilisateur : jmore - DESKTOP-73TPG65
# Exécuté depuis : C:\Users\jmore\Desktop\Téléchargements\adwcleaner_5.116.exe
# Option : Nettoyer
# Support : https://toolslib.net/forum- [ Services ] *****
- [ Dossiers ] *****
[-] Dossier supprimé : C:\ProgramData\Browser
[-] Dossier supprimé : C:\ProgramData\Bletehavnu
[#] Dossier supprimé : C:\ProgramData\Application Data\Browser
[#] Dossier supprimé : C:\ProgramData\Application Data\Bletehavnu- [ Fichiers ] *****
[-] Fichier supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Booking.com.lnk
[-] Fichier supprimé : C:\Users\jmore\Desktop\cacaoweb.exe
[-] Fichier supprimé : C:\WINDOWS\SysNative\drivers\bsdriver.sys- [ DLLs ] *****
- [ WMI ] *****
- [ Raccourcis ] *****
- [ Tâches planifiées ] *****
[-] Tâche supprimée : Bletehavnu- [ Registre ] *****
[-] Clé supprimée : HKLM\SOFTWARE\Classes\AniGIFCtrl.AniGIF
[-] Clé supprimée : HKLM\SOFTWARE\Classes\AniGIFPpg.AniGIFPpg
[-] Clé supprimée : HKLM\SOFTWARE\Classes\AniGIFPpg.AniGIFPpg.1
[-] Clé supprimée : HKLM\SOFTWARE\Classes\AniGIFPpg2.AniGIFPpg2
[-] Clé supprimée : HKLM\SOFTWARE\Classes\AniGIFPpg2.AniGIFPpg2.1
[-] Clé supprimée : HKLM\SOFTWARE\Classes\CLSID\{593D67B9-3A50-EBAA-17BE-61A5EC986A22}
[-] Clé supprimée : HKLM\SOFTWARE\Classes\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}
[-] Clé supprimée : HKCU\Software\cacaoweb
[-] Clé supprimée : HKCU\Software\Microsoft\Tinstalls
[-] Clé supprimée : HKU\S-1-5-21-2865881956-1137169681-342651765-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\Installer
[-] Valeur supprimée : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [TCP Query User{7E2DE7AF-DF8E-41DD-B6F9-C2FEB8E718D9}C:\users\jmore\appdata\roaming\cacaoweb\cacaoweb.exe]
[-] Valeur supprimée : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [UDP Query User{4B484BED-9C30-42B7-9BAA-DD648DC19582}C:\users\jmore\appdata\roaming\cacaoweb\cacaoweb.exe]
[-] Valeur supprimée : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{65F80DE6-4801-4EBF-9DFA-C3CA27093030}]
[-] Valeur supprimée : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{11198F19-E608-41B1-8D8F-DDC0399A5F22}]
[-] Clé supprimée : HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\akamaihd.net
[-] Clé supprimée : HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\bestpriceninja.com
[-] Clé supprimée : HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\hdapp1008-a.akamaihd.net
[-] Clé supprimée : HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\pstatic.bestpriceninja.com
[-] Clé supprimée : HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\akamaihd.net
[-] Clé supprimée : HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\bestpriceninja.com
[-] Clé supprimée : HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\hdapp1008-a.akamaihd.net
[-] Clé supprimée : HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\pstatic.bestpriceninja.com
[-] Valeur supprimée : HKU\S-1-5-21-2865881956-1137169681-342651765-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run [cacaoweb]- [ Navigateurs ] *****
[-] [C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] supprimé : hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&from=newgdp&uid=WDCXWD3200BEVT-22ZCT0_WD-WXE408KA4640A4640&ts=1373219389
[-] [C:\Users\jmore\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] supprimé : hxxp://www.istartpageing.com/?type=hp&ts=1448820617&z=bbd55ec9e18e8912931cb96gcz9z6bdb9o7eeq4g4m&from=tugss&uid=HGSTXHTS541010A9E680_JA1086SB07HWVT07HWVTX
:: Clés "Tracing" supprimées
:: Paramètres Winsock réinitialisés
C:\AdwCleaner\AdwCleaner[C1].txt - [37610 octets] - [30/11/2015 20:20:07]
C:\AdwCleaner\AdwCleaner[S1].txt - [35941 octets] - [30/11/2015 20:17:57]
########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [37760 octets] ########## -
Modérateur@jumolienSalut,
il est bien infecté, fais ceci :
Réinitialise manuellement tes navigateurs :- Réinitialiser et réparer Mozilla Firefox
- Réinitialiser et réparer Google Chrome
- Réinitialiser et réparer Internet Explorer
puis :
Suis le tutoriel FRST. ( prends le temps de lire attentivement - tout y est bien expliqué ).
Télécharge et lance le scan FRST, 3 rapports FRST seront générés :- FRST.txt
- Shortcut.txt
- Additionnal.txt
Envoie ces 3 rapports sur le site http://pjjoint.malekal.com/ et en retour donne les 3 liens pjjoint qui mènent aux rapports ici dans une nouvelle réponse afin que l'on puisse les consulter. -
shortcut.txt:
Résultats d'analyse des raccourcis de l'utilisateur (x64) Version:09-05-2016
Exécuté par jmore (2016-05-12 17:36:48)
Exécuté depuis C:\Users\jmore\Desktop\Téléchargements
Mode d'amorçage: Normal
==================== Raccourcis =============================
(Les éléments sont susceptibles d'être inscrits dans le fichier fixlist.txt afin d'être supprimés ou restaurés.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu Places\01 - File Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu Places\03 - Documents.lnk -> C:\Users\jmore\Documents ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu Places\04 - Downloads.lnk -> C:\Users\jmore\Downloads ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu Places\05 - Music.lnk -> C:\Users\jmore\Music ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu Places\06 - Pictures.lnk -> C:\Users\jmore\Pictures ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu Places\07 - Videos.lnk -> C:\Users\jmore\Videos ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu Places\10 - UserProfile.lnk -> C:\Users\jmore ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access 2016.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\MSACCESS.EXE (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk -> C:\Windows\Installer\{AC76BA86-7AD7-1036-7B44-AB0000000001}\SC_Reader.ico ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Devices Flow.lnk -> C:\Windows\DevicesFlow\DevicesFlow.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel 2016.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\fc32h45r31o78m97e.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Immersive Control Panel.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MiracastView.lnk -> C:\Windows\MiracastView\MiracastView.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook 2016.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint 2016.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PrintDialog.lnk -> C:\Windows\PrintDialog\PrintDialog.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher 2016.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\MSPUB.EXE (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word 2016.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warships\Désinstaller World of Warships.lnk -> C:\Games\World_of_Warships\unins000.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warships\World of Warships.lnk -> C:\Games\World_of_Warships\WoWSLauncher.exe (Wargaming.net)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks\Dernières mises à jour.lnk -> C:\Games\World_of_Tanks\readme.url ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks\Désinstaller World of Tanks.lnk -> C:\Games\World_of_Tanks\unins000.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks\Encyclopédie.lnk -> C:\Games\World_of_Tanks\wiki.url ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks\Manuel du jeu.lnk -> C:\Games\World_of_Tanks\game_manual.url ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks\Site officiel.lnk -> C:\Games\World_of_Tanks\website.url ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks\World of Tanks.lnk -> C:\Games\World_of_Tanks\WoTLauncher.exe (Wargaming.net)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Documentation.lnk -> C:\Program Files (x86)\VideoLAN\VLC\Documentation.url ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Release Notes.lnk -> C:\Program Files (x86)\VideoLAN\VLC\NEWS.txt ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VideoLAN Website.lnk -> C:\Program Files (x86)\VideoLAN\VLC\VideoLAN Website.url ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player.lnk -> C:\Program Files (x86)\VideoLAN\VLC\vlc.exe (VideoLAN)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom\Désinstaller TomTom MyDrive Connect.lnk -> C:\Program Files (x86)\MyDrive Connect\Uninstall TomTom MyDrive Connect.exe (TomTom International B.V.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Windows Defender.lnk -> C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam\Steam.lnk -> C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security and Protection\Avast SecureLine.lnk -> C:\Program Files\AVAST Software\SecureLine\SecureLine.exe (AVAST Software)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Productivity and Tools\CyberLink YouCam 6.lnk -> C:\Program Files (x86)\CyberLink\YouCam6\Youcam6_webcam_camera_video.exe (CyberLink Corp.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Productivity and Tools\Evernote.lnk -> C:\Windows\Installer\{FEDC7C10-EF67-11E4-9B07-00505695D7B0}\Evernote.ico ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outils Microsoft Office 2016\Préférences linguistiques d’Office 2016.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin\Désinstaller Origin.lnk -> C:\Program Files (x86)\Origin\OriginUninstall.exe (Electronic Arts, Inc.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin\Origin Error Reporter.lnk -> C:\Program Files (x86)\Origin\OriginER.exe (Electronic Arts)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin\Origin.lnk -> C:\Program Files (x86)\Origin\Origin.exe (Electronic Arts)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation\GeForce Experience.lnk -> C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\LaunchGFExperience.exe (NVIDIA Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Désinstaller Malwarebytes Anti-Malware.lnk -> C:\Program Files (x86)\Malwarebytes Anti-Malware\unins000.exe ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Malwarebytes Anti-Malware Notifications.lnk -> C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Malwarebytes)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Malwarebytes Anti-Malware.lnk -> C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Malwarebytes)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk -> C:\Program Files (x86)\Malwarebytes Anti-Malware\Chameleon\Windows\chameleon.chm ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support\HP Recovery Manager\HP Recovery Manager.lnk -> C:\Program Files (x86)\Hewlett-Packard\HP Recovery Manager\rebecca.exe (Hewlett-Packard Development Company, L.P.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Command and Conquer Tiberium Alliances.lnk -> C:\Program Files (x86)\WildTangent Games\Web Link - Command and Conquer Tiberium Alliances\launcher.exe (WildTangent)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Mahjongg Dark Dimensions.lnk -> C:\Program Files (x86)\WildTangent Games\Web Link - Mahjongg Dark Dimensions\launcher.exe (WildTangent)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Seafight.lnk -> C:\Program Files (x86)\WildTangent Games\Web Link - Seafight\launcher.exe (WildTangent)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Component Services.lnk -> C:\Windows\System32\comexp.msc ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\dfrgui.lnk -> C:\Windows\System32\dfrgui.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Disk Cleanup.lnk -> C:\Windows\System32\cleanmgr.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\iSCSI Initiator.lnk -> C:\Windows\System32\iscsicpl.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Memory Diagnostics Tool.lnk -> C:\Windows\System32\MdSched.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\ODBC Data Sources (32-bit).lnk -> C:\Windows\SysWOW64\odbcad32.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\ODBC Data Sources (64-bit).lnk -> C:\Windows\System32\odbcad32.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk -> C:\Windows\System32\services.msc ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk -> C:\Windows\System32\msconfig.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Information.lnk -> C:\Windows\System32\msinfo32.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Windows Firewall with Advanced Security.lnk -> C:\Windows\System32\WF.msc ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Math Input Panel.lnk -> C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk -> C:\Windows\System32\mspaint.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk -> C:\Windows\System32\mstsc.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk -> C:\Windows\System32\SnippingTool.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Steps Recorder.lnk -> C:\Windows\System32\psr.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Sticky Notes.lnk -> C:\Windows\System32\StikyNot.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Fax and Scan.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Wordpad.lnk -> C:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\XPS Viewer.lnk -> C:\Windows\System32\xpsrchvw.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Windows Journal.lnk -> C:\Program Files\Windows Journal\Journal.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Character Map.lnk -> C:\Windows\System32\charmap.exe (Microsoft Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\GameExplorer\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}\PlayTasks\3\Support technique.lnk -> C:\Program Files (x86)\Origin Games\The Sims 3\Support\EA Help\Electronic_Arts_Technical_Support.htm ()
Shortcut: C:\ProgramData\Microsoft\Windows\GameExplorer\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}\PlayTasks\2\Contrat de licence d'utilisateur final.lnk -> C:\Program Files (x86)\Origin Games\The Sims 3\Support\fr-fr_EULA.rtf ()
Shortcut: C:\ProgramData\Microsoft\Windows\GameExplorer\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}\PlayTasks\1\LisezMoi.lnk -> C:\Program Files (x86)\Origin Games\The Sims 3\Support\LisezMoi.txt ()
Shortcut: C:\ProgramData\Microsoft\Windows\GameExplorer\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}\PlayTasks\0\Les Sims™ 3.lnk -> C:\Program Files (x86)\Origin Games\The Sims 3\Game\Bin\Sims3Launcher.exe (Electronic Arts Inc.)
Shortcut: C:\ProgramData\Microsoft\Windows\GameExplorer\{A1D652AC-EB94-48A6-B616-3A81F1BA52A6}\PlayTasks\0\Launch.lnk -> C:\Program Files (x86)\Steam\steamapps\common\Dawn of War 2\DOW2.exe (Sega Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\GameExplorer\{92AF956C-4AFB-4504-941E-324DD9F36B6C}\PlayTasks\0\Launch.lnk -> C:\Program Files (x86)\Steam\steamapps\common\Dawn of War II - Retribution\DOW2.exe (Sega Corporation)
Shortcut: C:\ProgramData\Microsoft\Windows\GameExplorer\{71828142-5A24-4BD0-97E7-976DA08CE6CF}\PlayTasks\3\Support technique.lnk -> C:\Program Files (x86)\Electronic Arts\Les Sims 3 Inspiration Loft Kit\Support\EA Help\Electronic_Arts_Technical_Support.htm ()
Shortcut: C:\ProgramData\Microsoft\Windows\GameExplorer\{71828142-5A24-4BD0-97E7-976DA08CE6CF}\PlayTasks\2\Contrat de licence d'utilisateur final.lnk -> C:\Program Files (x86)\Electronic Arts\Les Sims 3 Inspiration Loft Kit\Support\fr-fr_EULA.rtf ()
Shortcut: C:\ProgramData\Microsoft\Windows\GameExplorer\{71828142-5A24-4BD0-97E7-976DA08CE6CF}\PlayTasks\1\LisezMoi.lnk -> C:\Program Files (x86)\Electronic Arts\Les Sims 3 Inspiration Loft Kit\Support\LisezMoi.txt ()
Shortcut: C:\ProgramData\Microsoft\Windows\GameExplorer\{71828142-5A24-4BD0-97E7-976DA08CE6CF}\PlayTasks\0\Les Sims™ 3 Inspiration Loft Kit.lnk -> C:\Program Files (x86)\Electronic Arts\Les Sims 3 Inspiration Loft Kit\Game\Bin\Sims3Launcher.exe (EA.com)
Shortcut: C:\ProgramData\Microsoft\Windows\GameExplorer\{29318ECB-6C3C-4C8B-B9B6-15C5800831E8}\PlayTasks\0\Launch.lnk -> C:\Program Files (x86)\Steam\steamapps\common\Dawn of War 2\DOW2.exe (Sega Corporation)
Shortcut: C:\ProgramData\Hewlett-Packard\Recovery\Links\RM.lnk -> C:\Program Files (x86)\Hewlett-Packard\HP Recovery Manager\rebecca.exe (Hewlett-Packard Development Company, L.P.)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk -> C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell ISE (x86).lnk -> C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell_ISE.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell ISE.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell_ISE.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Windows Defender.lnk -> C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk -> C:\Windows\System32\notepad.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk -> C:\Windows\System32\Magnify.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk -> C:\Windows\System32\Narrator.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk -> C:\Windows\System32\osk.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk -> C:\Windows\System32\compmgmt.msc ()
Shortcut: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk -> C:\Windows\System32\diskmgmt.msc ()
Shortcut: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk -> C:\Windows\System32\eventvwr.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk -> C:\Windows\System32\mblctr.exe (Microsoft Corporation)
Shortcut: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation)
Shortcut: C:\Users\jmore\Links\Desktop.lnk -> C:\Users\jmore\Desktop ()
Shortcut: C:\Users\jmore\Links\Downloads.lnk -> C:\Users\jmore\Downloads ()
Shortcut: C:\Users\jmore\Links\Dropbox.lnk -> C:\Users\jmore\Dropbox ()
Shortcut: C:\Users\jmore\Desktop\µTorrent.lnk -> C:\Users\jmore\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc.)
Shortcut: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk -> C:\Users\jmore\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc.)
Shortcut: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk -> C:\Users\jmore\AppData\Local\Microsoft\OneDrive\OneDrive.exe (Microsoft Corporation)
Shortcut: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk -> C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)
Shortcut: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell ISE (x86).lnk -> C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell_ISE.exe (Microsoft Corporation)
Shortcut: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell ISE.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell_ISE.exe (Microsoft Corporation)
Shortcut: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)
Shortcut: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
Shortcut: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam\Steam.lnk -> C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
Shortcut: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
Shortcut: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk -> C:\Windows\System32\notepad.exe (Microsoft Corporation)
Shortcut: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk -> C:\Windows\System32\Magnify.exe (Microsoft Corporation)
Shortcut: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk -> C:\Windows\System32\Narrator.exe (Microsoft Corporation)
Shortcut: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk -> C:\Windows\System32\osk.exe (Microsoft Corporation)
Shortcut: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\SendTo\Dropbox.lnk -> C:\Users\jmore\Dropbox ()
Shortcut: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\SendTo\Transfert de fichiers Bluetooth.LNK -> C:\Windows\System32\fsquirt.exe (Microsoft Corporation)
Shortcut: C:\Users\jmore\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
Shortcut: C:\Users\jmore\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk -> C:\Users\jmore\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc.)
Shortcut: C:\Users\jmore\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
Shortcut: C:\Users\jmore\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
Shortcut: C:\Users\jmore\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)
Shortcut: C:\Users\jmore\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
Shortcut: C:\Users\jmore\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk -> C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Microsoft Corporation)
Shortcut: C:\Users\jmore\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk -> C:\Windows\System32\compmgmt.msc ()
Shortcut: C:\Users\jmore\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk -> C:\Windows\System32\diskmgmt.msc ()
Shortcut: C:\Users\jmore\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk -> C:\Windows\System32\eventvwr.exe (Microsoft Corporation)
Shortcut: C:\Users\jmore\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk -> C:\Windows\System32\mblctr.exe (Microsoft Corporation)
Shortcut: C:\Users\jmore\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation)
Shortcut: C:\Users\Public\Desktop\Adobe Reader XI.lnk -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe (Adobe Systems Incorporated)
Shortcut: C:\Users\Public\Desktop\Les Sims™ 3 Inspiration Loft Kit.lnk -> C:\Program Files (x86)\Electronic Arts\Les Sims 3 Inspiration Loft Kit\Game\Bin\Sims3Launcher.exe (EA.com)
Shortcut: C:\Users\Public\Desktop\Les Sims™ 3.lnk -> C:\Program Files (x86)\Origin Games\The Sims 3\Game\Bin\Sims3Launcher.exe (Electronic Arts Inc.)
Shortcut: C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk -> C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Malwarebytes)
Shortcut: C:\Users\Public\Desktop\Origin.lnk -> C:\Program Files (x86)\Origin\Origin.exe (Electronic Arts)
Shortcut: C:\Users\Public\Desktop\Steam.lnk -> C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
Shortcut: C:\Users\Public\Desktop\TankLeader.lnk -> C:\Users\jmore\Documents\TankLeader\TankLeader.exe (Bossland GmbH)
Shortcut: C:\Users\Public\Desktop\VLC media player.lnk -> C:\Program Files (x86)\VideoLAN\VLC\vlc.exe (VideoLAN)
Shortcut: C:\Users\Public\Desktop\World of Tanks.lnk -> C:\Games\World_of_Tanks\WoTLauncher.exe (Wargaming.net)
Shortcut: C:\Users\Public\Desktop\World of Warships.lnk -> C:\Games\World_of_Warships\WoWSLauncher.exe (Wargaming.net)
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --disable-quic
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk -> C:\Windows\System32\rundll32.exe (Microsoft Corporation) -> -sta {C90FB8CA-3295-4462-A721-2935E83694BA}
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk -> C:\Program Files (x86)\Windows Media Player\wmplayer.exe (Microsoft Corporation) -> /prefetch:1
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player - reset preferences and cache files.lnk -> C:\Program Files (x86)\VideoLAN\VLC\vlc.exe (VideoLAN) -> --reset-config --reset-plugins-cache vlc://quit
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player skinned.lnk -> C:\Program Files (x86)\VideoLAN\VLC\vlc.exe (VideoLAN) -> -Iskins
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom\TomTom MyDrive Connect.lnk -> C:\Program Files (x86)\MyDrive Connect\TomTom MyDrive Connect.exe (TomTom) -> "-startda"
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Default Programs.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.DefaultPrograms
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Task Manager.lnk -> C:\Windows\System32\Taskmgr.exe (Microsoft Corporation) -> /7
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outils Microsoft Office 2016\Centre de téléchargement Office 2016.lnk -> C:\Program Files (x86)\Microsoft Office\root\client\AppVLP.exe (Microsoft Corporation) -> "C:\Program Files (x86)\Microsoft Office\Root\Office16\MSOUC.EXE"
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Music, Photos and Videos\B&O Play.lnk -> C:\Windows\System32\rundll32.exe (Microsoft Corporation) -> shell32.dll,Control_RunDLL RTSnMg64.cpl,,
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee\McAfee LiveSafe.lnk -> C:\Program Files\mcafee.com\agent\mcagent.exe (McAfee, Inc.) -> /desktopicon /platui
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support\HP Documentation.lnk -> C:\Program Files\HP\Documentation\platform_guides\languages\index.html () -> /Arguments:Shortcut
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support\HP Support Assistant.lnk -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe (Hewlett-Packard Company) -> /p 1
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support\HP Recovery Manager\HP Recovery Media Creation.lnk -> C:\Program Files (x86)\Hewlett-Packard\HP Recovery Manager\rebecca.exe (Hewlett-Packard Development Company, L.P.) -> \CRM
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Aller aux jeux d’action et d’aventures.lnk -> C:\Program Files (x86)\WildTangent Games\Game Explorer Categories - genres\provider.exe (WildTangent) -> /id=26352374-af55-4b53-b07b-6b0288ed97df /src gamesmenuoem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Aller aux jeux familiaux.lnk -> C:\Program Files (x86)\WildTangent Games\Game Explorer Categories - genres\provider.exe (WildTangent) -> /id=d58eecb0-0816-11de-8c30-0800200c9a66 /src gamesmenuoem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Aller aux jeux généraux.lnk -> C:\Program Files (x86)\WildTangent Games\Game Explorer Categories - genres\provider.exe (WildTangent) -> /id=000d96f5-8034-4b74-a429-b6f0b04c75f4 /src gamesmenuoem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Aller aux jeux pour enfants.lnk -> C:\Program Files (x86)\WildTangent Games\Game Explorer Categories - genres\provider.exe (WildTangent) -> /id=3eda1e54-8889-41f5-a649-5a306789b7ef /src gamesmenuoem
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox\Dropbox.lnk -> C:\Program Files (x86)\Dropbox\Client\Dropbox.exe (Dropbox, Inc.) -> /home
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk -> C:\Windows\System32\compmgmt.msc () -> /s
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Event Viewer.lnk -> C:\Windows\System32\eventvwr.msc () -> /s
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Performance Monitor.lnk -> C:\Windows\System32\perfmon.msc () -> /s
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Resource Monitor.lnk -> C:\Windows\System32\perfmon.exe (Microsoft Corporation) -> /res
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Task Scheduler.lnk -> C:\Windows\System32\taskschd.msc () -> /s
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Media Player.lnk -> C:\Program Files (x86)\Windows Media Player\wmplayer.exe (Microsoft Corporation) -> /prefetch:1
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Speech Recognition.lnk -> C:\Windows\Speech\Common\sapisvr.exe (Microsoft Corporation) -> -SpeechUX
ShortcutWithArgument: C:\ProgramData\Hewlett-Packard\Recovery\Links\Apps.lnk -> C:\Program Files (x86)\Hewlett-Packard\HP Recovery Manager\rebecca.exe (Hewlett-Packard Development Company, L.P.) -> \SWR
ShortcutWithArgument: C:\ProgramData\Hewlett-Packard\Recovery\Links\BTR.lnk -> C:\Program Files (x86)\Hewlett-Packard\HP Recovery Manager\rebecca.exe (Hewlett-Packard Development Company, L.P.) -> \BTR
ShortcutWithArgument: C:\ProgramData\Hewlett-Packard\Recovery\Links\Driver.lnk -> C:\Program Files (x86)\Hewlett-Packard\HP Recovery Manager\rebecca.exe (Hewlett-Packard Development Company, L.P.) -> \SWR
ShortcutWithArgument: C:\ProgramData\Hewlett-Packard\Recovery\Links\RMC.lnk -> C:\Program Files (x86)\Hewlett-Packard\HP Recovery Manager\rebecca.exe (Hewlett-Packard Development Company, L.P.) -> \CRM
ShortcutWithArgument: C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation) -> /SendTo
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - Network Connections.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> ::{7007ACC7-3202-11D1-AAD2-00805FC1270E}
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.DeviceManager
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\06 - System.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.System
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\08 - Power Options.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.PowerOptions
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\10 - Programs and Features.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.ProgramsAndFeatures
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> shell:::{2559a1f8-21d7-11d4-bdaf-00c04f60b9f0}
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk -> C:\Windows\System32\Taskmgr.exe (Microsoft Corporation) -> /0
ShortcutWithArgument: C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> shell:::{3080F90D-D7AD-11D9-BD98-0000947B0257}
ShortcutWithArgument: C:\Users\jmore\Desktop\Dropbox.lnk -> C:\Program Files (x86)\Dropbox\Client\Dropbox.exe (Dropbox, Inc.) -> /home
ShortcutWithArgument: C:\Users\jmore\AppData\Roaming\Microsoft\Word\webmail.laposte.net%20(1)305163672067623853\webmail.laposte.net%20(1).odt.lnk -> C:\Users\jmore\Desktop\Téléchargements\webmail.laposte.net (1).odt () -> 20
ShortcutWithArgument: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\SendTo\Destinataire de télécopie.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation) -> /SendTo
ShortcutWithArgument: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk -> C:\Windows\System32\WFS.exe (Microsoft Corporation) -> /SendTo
ShortcutWithArgument: C:\Users\jmore\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Dropbox 25 GB.lnk -> C:\Program Files (x86)\Dropbox\DropboxOEM\DropboxOEM.exe () -> manual
ShortcutWithArgument: C:\Users\jmore\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - Network Connections.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> ::{7007ACC7-3202-11D1-AAD2-00805FC1270E}
ShortcutWithArgument: C:\Users\jmore\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.DeviceManager
ShortcutWithArgument: C:\Users\jmore\AppData\Local\Microsoft\Windows\WinX\Group3\06 - System.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.System
ShortcutWithArgument: C:\Users\jmore\AppData\Local\Microsoft\Windows\WinX\Group3\08 - Power Options.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.PowerOptions
ShortcutWithArgument: C:\Users\jmore\AppData\Local\Microsoft\Windows\WinX\Group3\10 - Programs and Features.lnk -> C:\Windows\System32\control.exe (Microsoft Corporation) -> /name Microsoft.ProgramsAndFeatures
ShortcutWithArgument: C:\Users\jmore\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}
ShortcutWithArgument: C:\Users\jmore\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> shell:::{2559a1f8-21d7-11d4-bdaf-00c04f60b9f0}
ShortcutWithArgument: C:\Users\jmore\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}
ShortcutWithArgument: C:\Users\jmore\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk -> C:\Windows\System32\Taskmgr.exe (Microsoft Corporation) -> /0
ShortcutWithArgument: C:\Users\jmore\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> shell:::{3080F90D-D7AD-11D9-BD98-0000947B0257}
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --disable-quic
ShortcutWithArgument: C:\Users\Public\Desktop\McAfee LiveSafe.lnk -> C:\Program Files\mcafee.com\agent\mcagent.exe (McAfee, Inc.) -> /desktopicon /platui
ShortcutWithArgument: C:\Users\Public\Desktop\TomTom MyDrive Connect.lnk -> C:\Program Files (x86)\MyDrive Connect\TomTom MyDrive Connect.exe (TomTom) -> "-startda"
InternetURL: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam\Steam Support Center.url -> hxxp://support.steampowered.com/
InternetURL: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox\Dropbox Website.URL -> 0
InternetURL: C:\Users\Default\Favorites\Links\Booking.com.url -> hxxp://www.booking.com/index.html?aid=398438&label=webslice
InternetURL: C:\Users\Default\Favorites\Links\TripAdvisor.url -> hxxp://js.redirect.hp.com/jumpstation?bd=all&c=none&locale=all&pf=cnnb&s=TripAdvisor_iefavsbar&tp=iefavs
InternetURL: C:\Users\Default\Favorites\HP\Booking.com.url -> hxxp://www.booking.com/index.html?aid=398438&label=iefav
InternetURL: C:\Users\Default\Favorites\HP\HP Store.url -> hxxp://js.redirect.hp.com/jumpstation?bd=all&c=none&locale=fr_fr&pf=cnnb&s=stemea_consumer_ie_nb&tp=iefavs
InternetURL: C:\Users\Default\Favorites\HP\Services et Support.url -> hxxp://js.redirect.hp.com/jumpstation?bd=all&c=143&locale=fr_fr&pf=cnnb&s=sf_volume_ie_nb&tp=iefavs
InternetURL: C:\Users\Default\Favorites\HP\TripAdvisor.url -> hxxp://js.redirect.hp.com/jumpstation?bd=all&c=none&locale=all&pf=cnnb&s=TripAdvisor_iefav&tp=iefavs
InternetURL: C:\Users\Default\Favorites\HP\WildTangent Games for HP.url -> hxxp://redirect.hp.com/svs/rdr?TYPE=4&tp=iefavs&s=myhpgames&pf=cnnb&locale=fr_fr&bd=all&c=154
InternetURL: C:\Users\jmore\OneDrive\Salon\Salon.url -> hxxps://onedrive.live.com/redir.aspx?cid=1cc947e33bc12bc9&resid=1CC947E33BC12BC9!134&type=3
InternetURL: C:\Users\jmore\OneDrive\Documents\Ordinateur portable de julien.url -> hxxps://onedrive.live.com/redir.aspx?cid=1cc947e33bc12bc9&resid=1CC947E33BC12BC9!116&type=3
InternetURL: C:\Users\jmore\Favorites\Bing.url -> hxxp://go.microsoft.com/fwlink/p/?LinkId=255142
InternetURL: C:\Users\jmore\Favorites\Téléphone\Rugby division.url -> hxxp://www.rugbydivision.com/
InternetURL: C:\Users\jmore\Favorites\Téléphone\RugbyShop.url -> hxxp://www.rugbyshop.com/rayons/haut-vetements-rugby/sweats-et-pulls-rugby.html/
InternetURL: C:\Users\jmore\Favorites\Téléphone\Sport.url -> hxxp://sport.mob1.orange.fr/
InternetURL: C:\Users\jmore\Favorites\Links\Booking.com.url -> hxxp://www.booking.com/index.html?aid=398438&label=webslice
InternetURL: C:\Users\jmore\Favorites\Links\TripAdvisor.url -> hxxp://js.redirect.hp.com/jumpstation?bd=all&c=none&locale=all&pf=cnnb&s=TripAdvisor_iefavsbar&tp=iefavs
InternetURL: C:\Users\jmore\Favorites\HP\Booking.com.url -> hxxp://www.booking.com/index.html?aid=398438&label=iefav
InternetURL: C:\Users\jmore\Favorites\HP\HP Store.url -> hxxp://js.redirect.hp.com/jumpstation?bd=all&c=none&locale=fr_fr&pf=cnnb&s=stemea_consumer_ie_nb&tp=iefavs
InternetURL: C:\Users\jmore\Favorites\HP\Services et Support.url -> hxxp://js.redirect.hp.com/jumpstation?bd=all&c=143&locale=fr_fr&pf=cnnb&s=sf_volume_ie_nb&tp=iefavs
InternetURL: C:\Users\jmore\Favorites\HP\TripAdvisor.url -> hxxp://js.redirect.hp.com/jumpstation?bd=all&c=none&locale=all&pf=cnnb&s=TripAdvisor_iefav&tp=iefavs
InternetURL: C:\Users\jmore\Favorites\HP\WildTangent Games for HP.url -> hxxp://redirect.hp.com/svs/rdr?TYPE=4&tp=iefavs&s=myhpgames&pf=cnnb&locale=fr_fr&bd=all&c=154
InternetURL: C:\Users\jmore\Desktop\Anno 1404.url -> steam://rungameid/33250
InternetURL: C:\Users\jmore\Desktop\Company of Heroes (New Steam Version).url -> steam://rungameid/228200
InternetURL: C:\Users\jmore\Desktop\Company of Heroes Opposing Fronts.url -> steam://rungameid/9340
InternetURL: C:\Users\jmore\Desktop\Company of Heroes Tales of Valor.url -> steam://rungameid/20540
InternetURL: C:\Users\jmore\Desktop\Warhammer 40,000 Dawn of War II Retribution.url -> steam://rungameid/56400
InternetURL: C:\Users\jmore\Desktop\Warhammer 40,000 Dawn of War II - Chaos Rising.url -> steam://rungameid/20570
InternetURL: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam\Company of Heroes (New Steam Version).url -> steam://rungameid/228200
InternetURL: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam\Company of Heroes Opposing Fronts.url -> steam://rungameid/9340
InternetURL: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam\Company of Heroes Tales of Valor.url -> steam://rungameid/20540
InternetURL: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam\Company of Heroes.url -> steam://rungameid/4560
InternetURL: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam\Total War ROME II - Emperor Edition.url -> steam://rungameid/214950
InternetURL: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam\Warhammer 40,000 Dawn of War II Retribution.url -> steam://rungameid/56400
InternetURL: C:\Users\jmore\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam\Warhammer 40,000 Dawn of War II - Chaos Rising.url -> steam://rungameid/20570
==================== Fin de Shortcut.txt ============================= -
-
Modérateur@jumolienLes rapports FRST sont à donner via pjjoint.
-
-
je sais, je sais que tu vas hurler ....
j'utilise Incred en parallèle et ma boîte reçoit mais n'envoye plus ?????-
-
Modérateur@saramarcelCréé un sujet dans la partie Logiciel si tu as des prob avec incredimail.
-
-
Ouais ! mais t'es doué en informatique ...
On ne sait pas tout savoir faire ! -
ModérateurHaaaa l'art plastique ok \o
J'étais nul :>
Pas de soucis !
Pour prévenir les sites malicieux, tu peux installer Blockulicious : https://forum.malekal.com/viewtopic.php?t=46656&start=
~~
Le reste de la sécurité : Sécuriser son ordinateur.
-
UN GRAND MERCI
( prof d'éducation plastique, de dessin quoi ... )
BONNE SOIREE
Et je pense que le pc a été infecté par un logiciel que j'ai téléchargé pour mon scanner qui ne fonctionne plus sous w10 ! -
je vérifie McAfee mais je pense que oui .
( je suis prof ;-) ) -
trop coollllllll
je ne vois plus de pup !
et mine, j'aurais du faire informaticienne, j'adore !
et on te remercie comment ???? -
Modérateurbsdriver.sys a bien sauté.
Il reste quel problème ?
Tu es vraiment certains que les définitions virales sur Mcafee sont à jour ?
Like the angel you are, you laugh creating a lightness in my chest,
Your eyes they penetrate me,
(Your answer's always 'maybe')
That's when I got up and left -
Modérateur
-
arytzzaytggggggggggggfffffffffff
Je récapitule :
analyse avec antimalware et effacé la quarantaine
adcleaner et effacé aussi
frst donne un rapport
ces pup sont tjrs là .
En fait, il faut que je me concentre à fond mais j'ai aussi un job
et je pense que mercredi, ça ira mieux .
je t'ai envoyé un rapport sur ton site .
( et j'ai compris le problème )
merci vraiment, j'y arriverai ... -
Ecoute, j'apprécie vraiment cette aide mais ça fait 3 jours que je rame !
Qu'est-ce que je peux faire ? tout est compliqué . -
je refais cleaner ???
je laisse coché ????
::
Rootkit.Komodia.PUA, C:\Windows\System32\drivers\bsdriver.sys, Supprimer au redémarrage, [b7645be04158fe38164ff5c01be61ae6],-
-
Modérateur@Malekal_morte-Les rapports sont à donner via pjjoint, c'est illisible directement sur CCM.
-
-
-
Modérateur@saramarcelil faut donner les liens ici, prends bien le temps de lire les instructions.
-
-
Modérateurvoila :
Rootkit.Komodia.PUA, C:\Windows\System32\drivers\bsdriver.sys, Supprimer au redémarrage, [b7645be04158fe38164ff5c01be61ae6],
pour voir s'il n'y a plus rien :
Suis le tutoriel FRST.
(et bien prendre le temps de lire afin d'appliquer correctement - tout y est expliqué).
Télécharge et lance le scan FRST, cela va générer trois rapports FRST :- FRST.txt
- Shortcut.txt
- Additionnal.txt
Envoie, comme expliqué, ces trois rapports sur le site http://pjjoint.malekal.com et en retour donne les trois liens pjjoint qui mènent à ses rapports ici dans une nouvelle réponse afin que l'on puisse les consulter.
-
Malwarebytes exécuté !
mais toujours les pup !
je fais adcleaner maintenant ??
ou je jette tout ....-
-
@saramarcel# AdwCleaner v5.030 - Rapport créé le 18/01/2016 à 16:12:12
# Mis à jour le 17/01/2016 par Xplode
# Base de données : 2016-01-17.3 [Serveur]
# Système d'exploitation : Windows 10 Home (x64)
# Nom d'utilisateur : Martine - MARTINEMM
# Exécuté depuis : C:\Users\Martine\AppData\Local\Microsoft\Windows\INetCache\IE\4D6RTQBU\adwcleaner_5.030.exe
# Option : Nettoyer
# Support : https://toolslib.net/forum- [ Services ] *****
- [ Dossiers ] *****
[x] Dossier Non Supprimé : C:\Program Files (x86)\4D0FE6FF-1450025770-3E4D-9C47-382C4A766255
[x] Dossier Non Supprimé : C:\ProgramData\MailUpdate
[x] Dossier Non Supprimé : C:\Users\Martine\AppData\Roaming\eCyber
[x] Dossier Non Supprimé : C:\Users\Martine\AppData\Roaming\MailUpdate- [ Fichiers ] *****
[x] Fichier Non Supprimé : C:\Users\Martine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Picexa.lnk- [ DLLs ] *****
- [ Raccourcis ] *****
- [ Tâches planifiées ] *****
- [ Registre ] *****
[x] Clé Non Supprimée : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}
[x] Clé Non Supprimée : HKLM\SOFTWARE\Classes\Interface\{73FA67CF-17F3-41F2-8919-B96213A4F3E5}
[x] Clé Non Supprimée : HKLM\SOFTWARE\Classes\TypeLib\{94C3A1AB-1C4A-476B-9079-A3E3CD620E04}
[x] Clé Non Supprimée : [x64] HKLM\SOFTWARE\Classes\Interface\{73FA67CF-17F3-41F2-8919-B96213A4F3E5}
[x] Clé Non Supprimée : HKCU\Software\IM
[x] Clé Non Supprimée : HKCU\Software\ImInstaller
[x] Clé Non Supprimée : HKCU\Software\TeleCharger
[x] Clé Non Supprimée : HKLM\SOFTWARE\hdcode
[x] Clé Non Supprimée : HKLM\SOFTWARE\ImInstaller
[x] Clé Non Supprimée : HKLM\SOFTWARE\TSv
[x] Clé Non Supprimée : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\yoursites123.com
[x] Clé Non Supprimée : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com
[x] Clé Non Supprimée : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.ask.com- [ Navigateurs ] *****
:: Clés "Tracing" supprimées
:: Paramètres Winsock réinitialisés
########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [2184 octets] ##########
-
-
Malwarebytes Anti-Malware
www.malwarebytes.org
Date de l'analyse: 18-01-16
Heure de l'analyse: 15:14
Fichier journal:
Administrateur: Oui
Version: 2.2.0.1024
Base de données de programmes malveillants: v2016.01.18.03
Base de données de rootkits: v2016.01.09.01
Licence: Gratuit
Protection contre les programmes malveillants: Désactivé
Protection contre les sites Web malveillants: Désactivé
Autoprotection: Désactivé
Système d'exploitation: Windows 10
Processeur: x64
Système de fichiers: NTFS
Utilisateur: Martine
Type d'analyse: Analyse des menaces
Résultat: Terminé
Objets analysés: 395735
Temps écoulé: 3 min, 13 s
Mémoire: Activé
Démarrage: Activé
Système de fichiers: Activé
Archives: Activé
Rootkits: Désactivé
Heuristique: Activé
PUP: Activé
PUM: Activé
Processus: 2
PUP.Optional.ChinAd, C:\Program Files (x86)\SFK\SSFK.exe, 2828, Supprimer au redémarrage, [36e5d4678c0d21159c6e3482e31e629e]
PUP.Optional.Elex, C:\Users\Martine\AppData\Roaming\TSv\TSvr.exe, 2416, Supprimer au redémarrage, [e833e6556e2bd4622391c20ffb073ec2]
Modules: 2
PUP.Optional.Elex, C:\Users\Martine\AppData\Roaming\TSv\msvcp100.dll, Supprimer au redémarrage, [e833e6556e2bd4622391c20ffb073ec2],
PUP.Optional.Elex, C:\Users\Martine\AppData\Roaming\TSv\msvcr100.dll, Supprimer au redémarrage, [e833e6556e2bd4622391c20ffb073ec2],
Clés du Registre: 66
PUP.Optional.ChinAd, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SSFK, En quarantaine, [36e5d4678c0d21159c6e3482e31e629e],
PUP.Optional.VBates, HKLM\SOFTWARE\CLASSES\APPID\{425F4ABF-B8E4-402D-9E49-06E494EB8DBF}, En quarantaine, [aa7145f66138be783b9e153f12f0be42],
PUP.Optional.VBates, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{425F4ABF-B8E4-402D-9E49-06E494EB8DBF}, En quarantaine, [aa7145f66138be783b9e153f12f0be42],
PUP.Optional.VBates, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\{425F4ABF-B8E4-402D-9E49-06E494EB8DBF}, En quarantaine, [aa7145f66138be783b9e153f12f0be42],
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{1ef422df-c387-4f0d-88d1-b75bdfd51013}, En quarantaine, [27f457e4653435017b66f75d80823bc5],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\TYPELIB\{00d02ec3-0b78-4444-bef9-57815bd8b29c}, En quarantaine, [27f457e4653435017b66f75d80823bc5],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\INTERFACE\{D8369F48-B190-4547-BF52-A80E2B4A98D3}, En quarantaine, [27f457e4653435017b66f75d80823bc5],
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{D8369F48-B190-4547-BF52-A80E2B4A98D3}, En quarantaine, [27f457e4653435017b66f75d80823bc5],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{D8369F48-B190-4547-BF52-A80E2B4A98D3}, En quarantaine, [27f457e4653435017b66f75d80823bc5],
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{00d02ec3-0b78-4444-bef9-57815bd8b29c}, En quarantaine, [27f457e4653435017b66f75d80823bc5],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{00d02ec3-0b78-4444-bef9-57815bd8b29c}, En quarantaine, [27f457e4653435017b66f75d80823bc5],
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1EF422DF-C387-4F0D-88D1-B75BDFD51013}, En quarantaine, [27f457e4653435017b66f75d80823bc5],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1EF422DF-C387-4F0D-88D1-B75BDFD51013}, En quarantaine, [27f457e4653435017b66f75d80823bc5],
PUP.Optional.Yontoo, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{1EF422DF-C387-4F0D-88D1-B75BDFD51013}, En quarantaine, [27f457e4653435017b66f75d80823bc5],
PUP.Optional.Yontoo, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{1EF422DF-C387-4F0D-88D1-B75BDFD51013}, En quarantaine, [27f457e4653435017b66f75d80823bc5],
PUP.Optional.VBates, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{7D8DAE88-BC05-4578-8C29-E541FFBA5757}, En quarantaine, [0516ef4cbbde092d7369cb89de2452ae],
PUP.Optional.VBates, HKLM\SOFTWARE\CLASSES\TYPELIB\{14EF423E-3EE8-44AE-9337-07AC3F27B744}, En quarantaine, [0516ef4cbbde092d7369cb89de2452ae],
PUP.Optional.VBates, HKLM\SOFTWARE\CLASSES\INTERFACE\{A9582D7B-F24A-441D-9D26-450D58F3CD17}, En quarantaine, [0516ef4cbbde092d7369cb89de2452ae],
PUP.Optional.VBates, HKLM\SOFTWARE\CLASSES\INTERFACE\{EE0D8859-2ED4-4B0D-9812-16865B9AFD65}, En quarantaine, [0516ef4cbbde092d7369cb89de2452ae],
PUP.Optional.VBates, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{A9582D7B-F24A-441D-9D26-450D58F3CD17}, En quarantaine, [0516ef4cbbde092d7369cb89de2452ae],
PUP.Optional.VBates, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{EE0D8859-2ED4-4B0D-9812-16865B9AFD65}, En quarantaine, [0516ef4cbbde092d7369cb89de2452ae],
PUP.Optional.VBates, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{A9582D7B-F24A-441D-9D26-450D58F3CD17}, En quarantaine, [0516ef4cbbde092d7369cb89de2452ae],
PUP.Optional.VBates, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{EE0D8859-2ED4-4B0D-9812-16865B9AFD65}, En quarantaine, [0516ef4cbbde092d7369cb89de2452ae],
PUP.Optional.VBates, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{14EF423E-3EE8-44AE-9337-07AC3F27B744}, En quarantaine, [0516ef4cbbde092d7369cb89de2452ae],
PUP.Optional.VBates, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{14EF423E-3EE8-44AE-9337-07AC3F27B744}, En quarantaine, [0516ef4cbbde092d7369cb89de2452ae],
PUP.Optional.VBates, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7D8DAE88-BC05-4578-8C29-E541FFBA5757}, En quarantaine, [0516ef4cbbde092d7369cb89de2452ae],
PUP.Optional.ResultsHub, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{be1a5d83-523d-4a57-bc56-65afe77fd42a}, En quarantaine, [43d807341c7df54107fde2738f73649c],
PUP.Optional.ResultsHub, HKLM\SOFTWARE\CLASSES\TYPELIB\{db1d8bff-d65b-47ea-8ac7-0cb8e28c6091}, En quarantaine, [43d807341c7df54107fde2738f73649c],
PUP.Optional.ResultsHub, HKLM\SOFTWARE\CLASSES\INTERFACE\{CD1FC859-A109-437D-9631-508B9DC3E8A0}, En quarantaine, [43d807341c7df54107fde2738f73649c],
PUP.Optional.ResultsHub, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{CD1FC859-A109-437D-9631-508B9DC3E8A0}, En quarantaine, [43d807341c7df54107fde2738f73649c],
PUP.Optional.ResultsHub, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{CD1FC859-A109-437D-9631-508B9DC3E8A0}, En quarantaine, [43d807341c7df54107fde2738f73649c],
PUP.Optional.ResultsHub, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{db1d8bff-d65b-47ea-8ac7-0cb8e28c6091}, En quarantaine, [43d807341c7df54107fde2738f73649c],
PUP.Optional.ResultsHub, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{db1d8bff-d65b-47ea-8ac7-0cb8e28c6091}, En quarantaine, [43d807341c7df54107fde2738f73649c],
PUP.Optional.ResultsHub, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{BE1A5D83-523D-4A57-BC56-65AFE77FD42A}, En quarantaine, [43d807341c7df54107fde2738f73649c],
PUP.Optional.ResultsHub, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BE1A5D83-523D-4A57-BC56-65AFE77FD42A}, En quarantaine, [43d807341c7df54107fde2738f73649c],
PUP.Optional.ResultsHub, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{BE1A5D83-523D-4A57-BC56-65AFE77FD42A}, En quarantaine, [43d807341c7df54107fde2738f73649c],
PUP.Optional.ResultsHub, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{BE1A5D83-523D-4A57-BC56-65AFE77FD42A}, En quarantaine, [43d807341c7df54107fde2738f73649c],
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{bfa55139-82af-4663-a19b-e135dac8d043}, En quarantaine, [23f81328108988ae30c4490b59a92dd3],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\TYPELIB\{04feaf9c-dc32-41c7-95ca-790e93488e7d}, En quarantaine, [23f81328108988ae30c4490b59a92dd3],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\INTERFACE\{395DA725-A162-43FF-B885-27BD92F112E8}, En quarantaine, [23f81328108988ae30c4490b59a92dd3],
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{395DA725-A162-43FF-B885-27BD92F112E8}, En quarantaine, [23f81328108988ae30c4490b59a92dd3],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{395DA725-A162-43FF-B885-27BD92F112E8}, En quarantaine, [23f81328108988ae30c4490b59a92dd3],
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{04feaf9c-dc32-41c7-95ca-790e93488e7d}, En quarantaine, [23f81328108988ae30c4490b59a92dd3],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{04feaf9c-dc32-41c7-95ca-790e93488e7d}, En quarantaine, [23f81328108988ae30c4490b59a92dd3],
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{BFA55139-82AF-4663-A19B-E135DAC8D043}, En quarantaine, [23f81328108988ae30c4490b59a92dd3],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BFA55139-82AF-4663-A19B-E135DAC8D043}, En quarantaine, [23f81328108988ae30c4490b59a92dd3],
PUP.Optional.Yontoo, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{BFA55139-82AF-4663-A19B-E135DAC8D043}, En quarantaine, [23f81328108988ae30c4490b59a92dd3],
PUP.Optional.Yontoo, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{BFA55139-82AF-4663-A19B-E135DAC8D043}, En quarantaine, [23f81328108988ae30c4490b59a92dd3],
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}, En quarantaine, [3be042f90a8f81b53fcd5104bb47e41c],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}, En quarantaine, [3be042f90a8f81b53fcd5104bb47e41c],
PUP.Optional.Elex, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IhPul, En quarantaine, [e833e6556e2bd4622391c20ffb073ec2],
PUP.Optional.YourSites123.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, En quarantaine, [8497a992a1f869cd042abc717e8604fc],
PUP.Optional.YourSearching.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\yoursearchingSoftware, En quarantaine, [76a5b8830f8aa591eca5280272928a76],
PUP.Optional.YourSites123.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\yoursites123Software, En quarantaine, [7aa116259ffabe78d858d55837cd9e62],
PUP.Optional.YourSites123.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, En quarantaine, [2cef51ea9ffa4cea9599f538fb0952ae],
PUP.Optional.WindowsMangerProtect, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\WindowsMangerProtect, En quarantaine, [b7648dae2b6e38fed839db0e788be917],
PUP.Optional.Shopperz.BrwsrFlsh, HKU\.DEFAULT\SOFTWARE\MICROSOFT\INTERNET EXPLORER\INTERNETREGISTRY\REGISTRY\USER\S-1-5-18\SOFTWARE\shopperz131220151732, En quarantaine, [b2691e1db8e1de58a6e7e14ceb1944bc],
PUP.Optional.Shopperz.BrwsrFlsh, HKU\S-1-5-18\SOFTWARE\{EC76CB29-0EEB-4E99-B0F8-A9F3E86C871E}, En quarantaine, [c85373c87128f3431680d0d7ad567090],
PUP.Optional.Shopperz.BrwsrFlsh, HKU\S-1-5-19\SOFTWARE\{EC76CB29-0EEB-4E99-B0F8-A9F3E86C871E}, En quarantaine, [af6c46f5c2d765d14b4b5e49a16232ce],
PUP.Optional.Shopperz.BrwsrFlsh, HKU\S-1-5-20\SOFTWARE\{EC76CB29-0EEB-4E99-B0F8-A9F3E86C871E}, En quarantaine, [0f0ce457c0d946f055417b2cc93a28d8],
PUP.Optional.InstallCore, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001\SOFTWARE\ICSW1.13, En quarantaine, [c853e556d9c01b1b2458ac192cd725db],
PUP.Optional.HoumPage.ShrtCln, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{CF34D395-9FF1-49A0-98A5-8DB1636431B1}, En quarantaine, [44d7b18a3168261080f7e14d0bf95aa6],
PUP.Optional.YourSites123.ShrtCln, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, En quarantaine, [7f9cb7841e7bce680b228aa354b0ab55],
PUP.Optional.DeskCut, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001\SOFTWARE\MOZILLA\EXTENDS, En quarantaine, [49d2b784ddbcdc5a56282b8e867dae52],
PUP.Optional.ProductSetup, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001\SOFTWARE\PRODUCTSETUP, En quarantaine, [bc5fc17a198095a1204feee724df2ed2],
PUP.Optional.Shopperz.BrwsrFlsh, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001\SOFTWARE\{EC76CB29-0EEB-4E99-B0F8-A9F3E86C871E}, En quarantaine, [c85350ebaeeb6acc01956a3de81b2ed2],
Valeurs du Registre: 16
PUP.Optional.YourSites123.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|URL, https://www.google.com/webhp?gws_rd=ssl{searchTerms}, En quarantaine, [8497a992a1f869cd042abc717e8604fc]
PUP.Optional.Shopperz.BrwsrFlsh, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{3B0D6851-3214-4591-98F2-3329E1A3355D}, C:\Program Files\shopperz131220151732\Firefox\{3B0D6851-3214-4591-98F2-3329E1A3355D}.xpi, En quarantaine, [b36872c9960323132889ebbc39cac23e]
PUP.Optional.YourSites123.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|URL, https://www.google.com/webhp?gws_rd=ssl{searchTerms}, En quarantaine, [2cef51ea9ffa4cea9599f538fb0952ae]
PUP.Optional.DeskCut, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|deskCutv2@gmail.com, C:\Users\Martine\AppData\Roaming\Mozilla\Firefox\Profiles\4t2sv08x.default\extensions\deskCutv2@gmail.com, En quarantaine, [1704f94299009f97b0cf8930dd26926e]
PUP.Optional.Shopperz.BrwsrFlsh, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|{3B0D6851-3214-4591-98F2-3329E1A3355D}, C:\Program Files\shopperz131220151732\Firefox\{3B0D6851-3214-4591-98F2-3329E1A3355D}.xpi, En quarantaine, [1308c3785a3ff0463e73c9de4db64fb1]
PUP.Optional.Elex, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IHPUL|ImagePath, C:\Users\Martine\AppData\Roaming\TSv\TSvr.exe, En quarantaine, [68b3e15afa9f7cba377e27aa3ec4817f]
PUP.Optional.Elex, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SSFK|ImagePath, C:\Program Files (x86)\SFK\SSFK.exe -s, En quarantaine, [18031a21a8f139fdea8da431db27bd43]
PUP.Optional.Shopperz.BrwsrFlsh, HKU\S-1-5-18\SOFTWARE\{EC76CB29-0EEB-4E99-b0F8-A9F3E86C871E}|Name, C:\Program Files\shopperz131220151732\Mette.exe, En quarantaine, [c85373c87128f3431680d0d7ad567090]
PUP.Optional.Shopperz.BrwsrFlsh, HKU\S-1-5-19\SOFTWARE\{EC76CB29-0EEB-4E99-b0F8-A9F3E86C871E}|Name, C:\Program Files\shopperz131220151732\Mette.exe, En quarantaine, [af6c46f5c2d765d14b4b5e49a16232ce]
PUP.Optional.Shopperz.BrwsrFlsh, HKU\S-1-5-20\SOFTWARE\{EC76CB29-0EEB-4E99-b0F8-A9F3E86C871E}|Name, C:\Program Files\shopperz131220151732\Mette.exe, En quarantaine, [0f0ce457c0d946f055417b2cc93a28d8]
PUP.Optional.HoumPage.ShrtCln, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{cf34d395-9ff1-49a0-98a5-8db1636431b1}|URL, https://www.google.com/webhp?gws_rd=ssl{searchTerms}&ssid=1450025684&a=1008661&uuid=cc53b465-b1d3-462b-897c-7e9875b96ac4, En quarantaine, [44d7b18a3168261080f7e14d0bf95aa6]
PUP.Optional.YourSites123.ShrtCln, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}|URL, https://www.google.com/webhp?gws_rd=ssl{searchTerms}, En quarantaine, [7f9cb7841e7bce680b228aa354b0ab55]
Hijack.AutoConfigURL.ShrtCln, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|AutoConfigUrl, http://unstopp.me/wpad.dat?15c1bf914cca1ffe0062341be348d9ba2558155, En quarantaine, [4ecd47f47128c076a87d42ea54b0cb35]
PUP.Optional.DeskCut, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001\SOFTWARE\MOZILLA\EXTENDS|appid, deskCutv2@gmail.com, En quarantaine, [49d2b784ddbcdc5a56282b8e867dae52]
PUP.Optional.ProductSetup, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001\SOFTWARE\PRODUCTSETUP|tb, En quarantaine, [bc5fc17a198095a1204feee724df2ed2],
PUP.Optional.Shopperz.BrwsrFlsh, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001\SOFTWARE\{EC76CB29-0EEB-4E99-b0F8-A9F3E86C871E}|Name, C:\Program Files\shopperz131220151732\Mette.exe, En quarantaine, [c85350ebaeeb6acc01956a3de81b2ed2]
Données du Registre: 12
PUP.Optional.YourSearching.ShrtCln, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe http://ww7.yoursearching.com Bon : (iexplore.exe), Mauvais : (C:\Program Files\Internet Explorer\iexplore.exe http://www.yoursearching.com/?type=sc&ts=1450025726&z=ca993f99631e0b299c9554cgaz8w5e0eao9w3meo7q&from=exp1&uid=KINGSTONXRBU-SC100S37128GD_50026B72511529B3),Remplacé,[ec2f0e2dc2d7e254bb8906b25fa53dc3]
PUP.Optional.YourSites123.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, http://www.isearch123.com/?type=hp&ts=1452679764&z=2e2445773c46470d08a9040gfz5w8o8q9mdtcm7q4q&from=ient07021&uid=KINGSTONXRBU-SC100S37128GD_50026B72511529B3&k=y Bon : (www.google.com), Mauvais : (http://www.yoursites123.com/?type=hp&ts=1452679764&z=2e2445773c46470d08a9040gfz5w8o8q9mdtcm7q4q&from=ient07021&uid=KINGSTONXRBU-SC100S37128GD_50026B72511529B3),Remplacé,[40dbc7749ffa0531183ff0c8020230d0]
PUP.Optional.YourSites123.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, https://www.google.com/webhp?gws_rd=ssl{searchTerms}, Bon : (www.google.com), Mauvais : (https://www.google.com/webhp?gws_rd=ssl{searchTerms}),Remplacé,[0219013a0a8fc076570054647490ef11]
PUP.Optional.YourSites123.ShrtCln, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, https://www.google.com/webhp?gws_rd=ssl{searchTerms}, Bon : (www.google.com), Mauvais : (https://www.google.com/webhp?gws_rd=ssl{searchTerms}),Remplacé,[42d9b6851c7d81b5c691704847bd758b]
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Bon : ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Mauvais : ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Remplacé,[3edd102b64353105bb28b8fb749018e8]
PUP.Optional.YourSearching.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe http://ww7.yoursearching.com Bon : (iexplore.exe), Mauvais : (C:\Program Files\Internet Explorer\iexplore.exe http://www.yoursearching.com/?type=sc&ts=1450025726&z=ca993f99631e0b299c9554cgaz8w5e0eao9w3meo7q&from=exp1&uid=KINGSTONXRBU-SC100S37128GD_50026B72511529B3),Remplacé,[3edd7bc0f7a2a2944bf95f5971933ac6]
PUP.Optional.YourSites123.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, http://www.isearch123.com/?type=hp&ts=1452679764&z=2e2445773c46470d08a9040gfz5w8o8q9mdtcm7q4q&from=ient07021&uid=KINGSTONXRBU-SC100S37128GD_50026B72511529B3&k=y Bon : (www.google.com), Mauvais : (http://www.yoursites123.com/?type=hp&ts=1452679764&z=2e2445773c46470d08a9040gfz5w8o8q9mdtcm7q4q&from=ient07021&uid=KINGSTONXRBU-SC100S37128GD_50026B72511529B3),Remplacé,[37e441fac8d1de5892c5e8d0d1335ea2]
PUP.Optional.YourSites123.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, https://www.google.com/webhp?gws_rd=ssl{searchTerms}, Bon : (www.google.com), Mauvais : (https://www.google.com/webhp?gws_rd=ssl{searchTerms}),Remplacé,[49d23ffc8c0dfa3cef68fbbd27ddf709]
PUP.Optional.YourSites123.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, https://www.google.com/webhp?gws_rd=ssl{searchTerms}, Bon : (www.google.com), Mauvais : (https://www.google.com/webhp?gws_rd=ssl{searchTerms}),Remplacé,[64b72813e2b713233c1b45735aaa51af]
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Bon : ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Mauvais : ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Remplacé,[3dde7fbcecad61d5bd26a0138084e61a]
PUP.Optional.YourSites123.ShrtCln, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, http://www.isearch123.com/?type=hp&ts=1452679764&z=2e2445773c46470d08a9040gfz5w8o8q9mdtcm7q4q&from=ient07021&uid=KINGSTONXRBU-SC100S37128GD_50026B72511529B3&k=y Bon : (www.google.com), Mauvais : (http://www.yoursites123.com/?type=hp&ts=1452679764&z=2e2445773c46470d08a9040gfz5w8o8q9mdtcm7q4q&from=ient07021&uid=KINGSTONXRBU-SC100S37128GD_50026B72511529B3),Remplacé,[94873cff32673cfa420d3880e51f05fb]
PUP.Optional.YourSites123.ShrtCln, HKU\S-1-5-21-3684131334-2239782793-2339384274-1001_Classes\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFT.MICROSOFTEDGE_8WEKYB3D8BBWE\MICROSOFTEDGE\MAIN|HomeButtonPage, http://www.isearch123.com/?type=hp&ts=1452679764&z=2e2445773c46470d08a9040gfz5w8o8q9mdtcm7q4q&from=ient07021&uid=KINGSTONXRBU-SC100S37128GD_50026B72511529B3&k=y Bon : (http://www.google.com), Mauvais : (http://www.yoursites123.com/?type=hp&ts=1452679764&z=2e2445773c46470d08a9040gfz5w8o8q9mdtcm7q4q&from=ient07021&uid=KINGSTONXRBU-SC100S37128GD_50026B72511529B3),Remplacé,[8497ac8f108976c0242a6f49fe06db25]
Dossiers: 13
PUP.Optional.Elex, C:\Users\Martine\AppData\Roaming\TSv, Supprimer au redémarrage, [e833e6556e2bd4622391c20ffb073ec2],
PUP.Optional.VBates, C:\Users\Martine\AppData\LocalLow\Company\Product\1.0, En quarantaine, [25f639025c3df640f761ea0bb94ae61a],
PUP.Optional.VBates, C:\Users\Martine\AppData\LocalLow\Company\Product, En quarantaine, [25f639025c3df640f761ea0bb94ae61a],
PUP.Optional.Elex, C:\Program Files (x86)\SFK, Supprimer au redémarrage, [9a81c477306985b1139f15e0e61dee12],
PUP.Optional.Yontoo, C:\ProgramData\4f596ec3-77fb-4fc3-82cb-691c42c71d77, En quarantaine, [6caf2e0dc1d8ba7cece09c2b06fcfc04],
PUP.Optional.VBates, C:\Users\Martine\AppData\LocalLow\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}, En quarantaine, [76a54bf00396be78d544ddeb976bfc04],
PUP.Optional.VBates, C:\Users\Martine\AppData\LocalLow\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}\{FBC0652C-7B29-4FB6-8ADA-91F54B267AD4}, En quarantaine, [76a54bf00396be78d544ddeb976bfc04],
PUP.Optional.VBates, C:\Users\Martine\AppData\LocalLow\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}\{FBC0652C-7B29-4FB6-8ADA-91F54B267AD4}\1.5, En quarantaine, [76a54bf00396be78d544ddeb976bfc04],
PUP.Optional.YourSearching.ShrtCln, C:\Users\Martine\AppData\Roaming\yoursearching, En quarantaine, [78a31625d8c19d99a29c9d2f2cd6e51b],
PUP.Optional.WindowsProtectManager, C:\ProgramData\Tmp0x0x, En quarantaine, [14079ba0d5c49a9c613d9834c33f5da3],
PUP.Optional.WindowsProtectManager, C:\ProgramData\Tmp0x0x\log, En quarantaine, [14079ba0d5c49a9c613d9834c33f5da3],
PUP.Optional.WindowsProtectManager, C:\ProgramData\Tmp0x0x\update, En quarantaine, [14079ba0d5c49a9c613d9834c33f5da3],
Adware.LaSuperba, C:\uninst, En quarantaine, [8695f04bfa9f37fffbccf5ec768ea957],
Fichiers: 29
PUP.Optional.ChinAd, C:\Program Files (x86)\SFK\SSFK.exe, Supprimer au redémarrage, [36e5d4678c0d21159c6e3482e31e629e],
PUP.Optional.Komodia.WnskRST, C:\Windows\System32\Sufdyrluoa64.dll, En quarantaine, [28f3310aa8f13ff7c57c8c15996848b8],
PUP.Optional.Komodia.WnskRST, C:\Windows\SysWOW64\Sufdyrluoa.dll, En quarantaine, [0219083338616dc9a067366bbb461be5],
Rootkit.Komodia.PUA, C:\Windows\System32\drivers\bsdriver.sys, Supprimer au redémarrage, [b7645be04158fe38164ff5c01be61ae6],
PUP.Optional.Cherimoya, C:\Windows\System32\drivers\cherimoya.sys, Supprimer au redémarrage, [110a3308861395a147e605d4f50f51af],
PUP.Optional.Yontoo, C:\Users\Martine\AppData\Local\Temp\dS3IBzAi7j.exe, En quarantaine, [40db3b0097023ff731da70e68b7636ca],
PUP.Optional.PennyBee, C:\Users\Martine\AppData\Local\Temp\pavP1iq7ok.exe, En quarantaine, [2dee64d7a8f1ac8a852412acc73aa15f],
PUP.Optional.YourSearching.ShrtCln, C:\Users\Martine\AppData\Local\Temp\TKL6j5fXYZ.exe, En quarantaine, [0b10d368d3c684b26ed5756339cb06fa],
PUP.Optional.Downloader, C:\Users\Martine\AppData\Local\Temp\~eqtmp142531\TrayDownloader.exe, En quarantaine, [9e7d1328f0a9d16550b85b76e21f669a],
PUP.Optional.Elex, C:\Users\Martine\AppData\Roaming\TSv\TSvr.exe, Supprimer au redémarrage, [e833e6556e2bd4622391c20ffb073ec2],
PUP.Optional.Elex, C:\Users\Martine\AppData\Roaming\TSv\msvcp100.dll, Supprimer au redémarrage, [e833e6556e2bd4622391c20ffb073ec2],
PUP.Optional.Elex, C:\Users\Martine\AppData\Roaming\TSv\msvcr100.dll, Supprimer au redémarrage, [e833e6556e2bd4622391c20ffb073ec2],
Rootkit.Agent.A, C:\Windows\System32\drivers\cherimoya.sys, Supprimer au redémarrage, [819a7cbf93064aecee1826b418eada26],
PUP.Optional.VBates, C:\Users\Martine\AppData\LocalLow\Company\Product\1.0\localStorageIE.txt, En quarantaine, [25f639025c3df640f761ea0bb94ae61a],
PUP.Optional.VBates, C:\Users\Martine\AppData\LocalLow\Company\Product\1.0\localStorageIE_backup.txt, En quarantaine, [25f639025c3df640f761ea0bb94ae61a],
PUP.Optional.Elex, C:\Program Files (x86)\SFK\SFK.ini, En quarantaine, [9a81c477306985b1139f15e0e61dee12],
PUP.Optional.Yontoo, C:\Users\Martine\AppData\Roaming\Mozilla\Firefox\Profiles\4t2sv08x.default\extensions\{c852b886-0e2e-4479-b3ff-0404d6001429}.xpi, En quarantaine, [88935dde544500366e1876aa47bd6997],
PUP.Optional.VBates.WnskRST, C:\Users\Martine\AppData\Local\Temp\shopperz131220151732_installer_1450025728.txt, En quarantaine, [4fcce655a4f511255397e938a95bd729],
PUP.Optional.VBates, C:\Users\Martine\AppData\LocalLow\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}\{FBC0652C-7B29-4FB6-8ADA-91F54B267AD4}\1.5\config.js, En quarantaine, [76a54bf00396be78d544ddeb976bfc04],
PUP.Optional.VBates, C:\Users\Martine\AppData\LocalLow\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}\{FBC0652C-7B29-4FB6-8ADA-91F54B267AD4}\1.5\tree.js, En quarantaine, [76a54bf00396be78d544ddeb976bfc04],
PUP.Optional.VBates, C:\Users\Martine\AppData\LocalLow\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}\{FBC0652C-7B29-4FB6-8ADA-91F54B267AD4}\1.5\wlist.js, En quarantaine, [76a54bf00396be78d544ddeb976bfc04],
PUP.Optional.WindowsProtectManager, C:\ProgramData\Tmp0x0x\log\ProtectWindowsManager_2015-12-13[17-55-37-739].log, En quarantaine, [14079ba0d5c49a9c613d9834c33f5da3],
PUP.Optional.WindowsProtectManager, C:\ProgramData\Tmp0x0x\log\ProtectWindowsManager_2016-01-13[11-08-41-751].log, En quarantaine, [14079ba0d5c49a9c613d9834c33f5da3],
PUP.Optional.WindowsProtectManager, C:\ProgramData\Tmp0x0x\update\conf, En quarantaine, [14079ba0d5c49a9c613d9834c33f5da3],
PUP.Optional.WindowsProtectManager, C:\ProgramData\Tmp0x0x\update\update.exe, En quarantaine, [14079ba0d5c49a9c613d9834c33f5da3],
Adware.LaSuperba, C:\uninst\uninstall.html, En quarantaine, [8695f04bfa9f37fffbccf5ec768ea957],
PUP.Optional.OurSearch, C:\Users\Martine\AppData\Roaming\Mozilla\Firefox\Profiles\4t2sv08x.default\prefs.js, Bon : (), Mauvais : (user_pref("browser.newtab.url", "http://ww7.yoursearching.com");), Remplacé,[c15acf6c673285b12153944811f38878]
PUP.Optional.OurSearch, C:\Users\Martine\AppData\Roaming\Mozilla\Firefox\Profiles\4t2sv08x.default\prefs.js, Bon : (user_pref("browser.startup.homepage", "https://www.malwarebytes.com/restorebrowser/index.html Mauvais : (user_pref("browser.startup.homepage", "http://www.yoursearching.com), Remplacé,[68b3a19a772282b419a319ca030137c9]
PUM.Optional.FireFoxSearchOverride, C:\Users\Martine\AppData\Roaming\Mozilla\Firefox\Profiles\4t2sv08x.default\user.js, En quarantaine, [f22944f7386140f6f7d7db06e4208977],
Secteurs physiques: 0
(Aucun élément malveillant détecté)
(end) -
OUI
mais plus aujourd'hui !
j'ai déjà trop travaillé ce matin ;-)
je te tiens au courant . -
mais McAfee peut l'autoriser .
-
Acheté !
-
rerere ....
McAfee me bloque Tutorial Malwarebytes version gratuite ?? -
re ...
on ne peut pas agir directos dans le dd sys32 ???
je l'ai analysé, c'est bien lui qui est infecté !
- 1
- 2