View original (French)

Script hôte de la fenêtre : impossible de trouver c/kernel/r00t3r

Solved
Kfest -  
For the past few days, the message "windows host script: can not find c/kernel/r00t3r" appears each time I start my laptop running Windows 7. Please help me, sincerely I am overwhelmed. I've been searching tirelessly for a solution but to no avail.
Any solution is welcome.
Thank you!!!

3 answers

  1.  Malekal_morte- Moderator
    Yep, that should be good =)

    Here is the correction to be made with FRST. You can refer to this explanatory note with screenshots.

    Open Notepad: Windows Key + R,
    In the "Run" field, type notepad and OK.
    Copy/Paste the following into it: 

    CreateRestorePoint:
    CloseProcesses:
     C:\Users\Utilisateur\AppData\Roaming\Browsers
    Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnеt Еxрlorеr.lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic
    Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Intеrnet Eхрlorer (Nо Аdd-оns).lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic
    Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Lаunсh Internеt Еxрlorеr Вrоwsеr.lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic
    Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Intеrnеt Ехрlоrеr.lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic
    Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Intеrnеt Eхplorеr.lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic

    Hosts:
    EmptyTemp:
    RemoveProxy:
    Reboot:


    Once the text is pasted in Notepad,
    Go to "File" menu then "Save As",
    On the left, navigate to the Desktop,
    In the field below, file name enter: fixlist.txt
    Click on "Save", this will create fixlist.txt on the Desktop.

    Restart FRST and click on the "Fix" button
    A reboot may be necessary ( not mandatory )
    A text file will appear, copy/paste the content here in a new message.

    Restart the computer.

    --
    Please press a key to continue the disinfection...
    0
    1. Malekal_morte- Moderator
      this computer is completely infested..
      Trojan, Adwares..
      You need to stop downloading cracks.

      Uninstall Wise Registry Cleaner
      It's useless.

      Here is the correction to be made with FRST. You can use this explanatory note with screenshots.

      Open Notepad: Press Windows + R,
      In the "Run" field, type notepad and OK.
      Copy/Paste the following into it: 

      CreateRestorePoint:
      CloseProcesses:
      S2 Windows; C:\Windows\svchost.exe [177152 2017-08-09] () [Unsigned file]
      S2 ReimageRealTimeProtector; C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [X]
      S2 XobniService; "C:\Program Files (x86)\Xobni\XobniService.exe" [X]
      2017-08-09 15:35 - 2017-08-09 15:35 - 000001481 ___RS C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnеt Еxрlorеr.lnk
      2017-08-09 15:35 - 2017-08-09 15:35 - 000000000 ____D C:\Users\Utilisateur\AppData\Roaming\SPI
      2017-08-09 15:34 - 2017-08-12 16:07 - 000000000 ____D C:\Users\Utilisateur\AppData\Roaming\Valit
      2017-08-09 15:34 - 2017-08-09 15:35 - 000000000 ____D C:\Users\Utilisateur\AppData\Roaming\1337
      2017-08-09 15:34 - 2017-08-09 15:34 - 000000000 ___HD C:\ProgramData\MicrosoftCorporation
      2017-08-09 15:33 - 2017-08-09 15:33 - 000177152 _____ C:\Windows\svchost.exe
      2017-08-09 15:33 - 2017-08-09 15:33 - 000073216 _____ C:\Windows\taskmgr.exe
      2017-08-09 20:56 - 2017-08-09 20:56 - 000003470 _____ C:\Windows\System32\Tasks\Reimage Reminder
      2017-08-09 20:54 - 2017-08-09 20:54 - 000004298 _____ C:\Windows\System32\Tasks\ReimageUpdater
      2017-08-09 20:54 - 2017-08-09 20:54 - 000000004 _____ C:\ProgramData\_lg.3sap
      2017-08-09 20:53 - 2017-08-09 20:54 - 000000000 ____D C:\ProgramData\Reimage Protector
      2017-08-09 20:51 - 2017-08-09 20:56 - 000000140 _____ C:\Windows\Reimage.ini
      2017-08-09 19:48 - 2017-08-09 19:56 - 000000000 ____D C:\Program Files\TNod User & Password Finder
      HKLM\...\Policies\Explorer\Run: [Updates] => C:\system32\SystemProtection.exe [168960 2009-07-14] (Microsoft Corporation)
      HKLM\ DisallowedCertificates: 03D22C9C66915D58C88912B64C1F984B8344EF09 (Comodo Security Solutions) <==== WARNING
      HKLM\ DisallowedCertificates: 0F684EC1163281085C6AF20528878103ACEFCAAB (F-Secure Corporation) <==== WARNING
      HKLM\ DisallowedCertificates: 1667908C9E22EFBD0590E088715CC74BE4C60884 (FRISK Software International/F-Prot) <==== WARNING
      HKLM\ DisallowedCertificates: 18DEA4EFA93B06AE997D234411F3FD72A677EECE (Bitdefender SRL) <==== WARNING
      HKLM\ DisallowedCertificates: 2026D13756EB0DB753DF26CB3B7EEBE3E70BB2CF (G DATA Software AG) <==== WARNING
      HKLM\ DisallowedCertificates: 249BDA38A611CD746A132FA2AF995A2D3C941264 (Malwarebytes Corporation) <==== WARNING
      HKLM\ DisallowedCertificates: 31AC96A6C17C425222C46D55C3CCA6BA12E54DAF (Symantec Corporation) <==== WARNING
      HKLM\ DisallowedCertificates: 331E2046A1CCA7BFEF766724394BE6112B4CA3F7 (Trend Micro) <==== WARNING
      HKLM\ DisallowedCertificates: 3353EA609334A9F23A701B9159E30CB6C22D4C59 (Webroot Inc.) <==== WARNING
      HKLM\ DisallowedCertificates: 373C33726722D3A5D1EDD1F1585D5D25B39BEA1A (SUPERAntiSpyware.com) <==== WARNING
      HKLM\ DisallowedCertificates: 3850EDD77CC74EC9F4829AE406BBF9C21E0DA87F (Kaspersky Lab) <==== WARNING
      HKLM\ DisallowedCertificates: 3D496FA682E65FC122351EC29B55AB94F3BB03FC (AVG Technologies CZ) <==== WARNING
      HKLM\ DisallowedCertificates: 4243A03DB4C3C15149CEA8B38EEA1DA4F26BD159 (PC Tools) <==== WARNING
      HKLM\ DisallowedCertificates: 42727E052C0C2E1B35AB53E1005FD9EDC9DE8F01 (K7 Computing Pvt Ltd) <==== WARNING
      HKLM\ DisallowedCertificates: 4420C99742DF11DD0795BC15B7B0ABF090DC84DF (Doctor Web Ltd.) <==== WARNING
      HKLM\ DisallowedCertificates: 4C0AF5719009B7C9D85C5EAEDFA3B7F090FE5FFF (Emsisoft Ltd) <==== WARNING
      HKLM\ DisallowedCertificates: 5240AB5B05D11B37900AC7712A3C6AE42F377C8C (Check Point Software Technologies Ltd.) <==== WARNING
      HKLM\ DisallowedCertificates: 5DD3D41810F28B2A13E9A004E6412061E28FA48D (Emsisoft Ltd) <==== WARNING
      HKLM\ DisallowedCertificates: 7457A3793086DBB58B3858D6476889E3311E550E (K7 Computing Pvt Ltd) <==== WARNING
      HKLM\ DisallowedCertificates: 76A9295EF4343E12DFC5FE05DC57227C1AB00D29 (BullGuard Ltd) <==== WARNING
      HKLM\ DisallowedCertificates: 775B373B33B9D15B58BC02B184704332B97C3CAF (McAfee) <==== WARNING
      HKLM\ DisallowedCertificates: 872CD334B7E7B3C3D1C6114CD6B221026D505EAB (Comodo Security Solutions) <==== WARNING
      HKLM\ DisallowedCertificates: 88AD5DFE24126872B33175D1778687B642323ACF (McAfee) <==== WARNING
      HKLM\ DisallowedCertificates: 9132E8B079D080E01D52631690BE18EBC2347C1E (Adaware Software) <==== WARNING
      HKLM\ DisallowedCertificates: 982D98951CF3C0CA2A02814D474A976CBFF6BDB1 (Safer Networking Ltd.) <==== WARNING
      HKLM\ DisallowedCertificates: 9A08641F7C5F2CCA0888388BE3E5DBDDAAA3B361 (Webroot Inc.) <==== WARNING
      HKLM\ DisallowedCertificates: 9C43F665E690AB4D486D4717B456C5554D4BCEB5 (ThreatTrack Security) <==== WARNING
      HKLM\ DisallowedCertificates: 9E3F95577B37C74CA2F70C1E1859E798B7FC6B13 (CURIOLAB S.M.B.A.) <==== WARNING
      HKLM\ DisallowedCertificates: A1F8DCB086E461E2ABB4B46ADCFA0B48C58B6E99 (Avira Operations GmbH & Co. KG) <==== WARNING
      HKLM\ DisallowedCertificates: A5341949ABE1407DD7BF7DFE75460D9608FBC309 (BullGuard Ltd) <==== WARNING
      HKLM\ DisallowedCertificates: A59CC32724DD07A6FC33F7806945481A2D13CA2F (ESET) <==== WARNING
      HKLM\ DisallowedCertificates: AB7E760DA2485EA9EF5A6EEE7647748D4BA6B947 (AVG Technologies CZ) <==== WARNING
      HKLM\ DisallowedCertificates: AD4C5429E10F4FF6C01840C20ABA344D7401209F (Avast Antivirus/Software) <==== WARNING
      HKLM\ DisallowedCertificates: AD96BB64BA36379D2E354660780C2067B81DA2E0 (Symantec Corporation) <==== WARNING
      HKLM\ DisallowedCertificates: B8EBF0E696AF77F51C96DB4D044586E2F4F8FD84 (Malwarebytes Corporation) <==== WARNING
      HKLM\ DisallowedCertificates: CDC37C22FE9272D8F2610206AD397A45040326B8 (Trend Micro) <==== WARNING
      HKLM\ DisallowedCertificates: D3F78D747E7C5D6D3AE8ABFDDA7522BFB4CBD598 (Kaspersky Lab) <==== WARNING
      HKLM\ DisallowedCertificates: DB303C9B61282DE525DC754A535CA2D6A9BD3D87 (ThreatTrack Security) <==== WARNING
      HKLM\ DisallowedCertificates: DB77E5CFEC34459146748B667C97B185619251BA (Avast Antivirus/Software) <==== WARNING
      HKLM\ DisallowedCertificates: E22240E837B52E691C71DF248F12D27F96441C00 (Total Defense, Inc.) <==== WARNING
      HKLM\ DisallowedCertificates: E513EAB8610CFFD7C87E00BCA15C23AAB407FCEF (AVG Technologies CZ) <==== WARNING
      HKLM\ DisallowedCertificates: ED841A61C0F76025598421BC1B00E24189E68D54 (Bitdefender SRL) <==== WARNING
      HKLM\ DisallowedCertificates: F83099622B4A9F72CB5081F742164AD1B8D048C9 (ESET) <==== WARNING
      HKLM\ DisallowedCertificates: FBB42F089AF2D570F2BF6F493D107A3255A9BB1A (Panda Security S.L) <==== WARNING
      HKLM\ DisallowedCertificates: FFFA650F2CB2ABC0D80527B524DD3F9FC172C138 (Doctor Web Ltd.) <==== WARNING
      HKU\S-1-5-21-2356778116-2662926543-2747011829-1000\...\Run: [Valit.vbs] => C:\Users\Utilisateur\AppData\Roaming\Valit\Valit.vbs [275 2017-08-09] ()
      Hosts:
      EmptyTemp:
      RemoveProxy:
      Reboot:


      Once the text is pasted in Notepad,
      Menu "File" then "Save As",
      On the left, go to the Desktop,
      In the bottom field, for the file name enter: fixlist.txt
      Click "Save", this will create fixlist.txt on the Desktop.

      Restart FRST and click on the "Fix" button
      A restart may be necessary ( not mandatory )
      A text file appears, copy/paste the content here in a new message.

      Restart the computer.

      2°)
      Reset/Repair the WEB browsers concerned by the issues:


      Here is the correction to be made with FRST. You can use this explanatory note with screenshots.

      Open Notepad: Press Windows + R,
      In the "Run" field, type notepad and OK.
      Copy/Paste the following into it: 

      CreateRestorePoint:
      CloseProcesses:
      S2 Windows; C:\Windows\svchost.exe [177152 2017-08-09] () [Unsigned file]
      S2 ReimageRealTimeProtector; C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [X]
      S2 XobniService; "C:\Program Files (x86)\Xobni\XobniService.exe" [X]
      2017-08-09 15:35 - 2017-08-09 15:35 - 000001481 ___RS C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnеt Еxрlorеr.lnk
      2017-08-09 15:35 - 2017-08-09 15:35 - 000000000 ____D C:\Users\Utilisateur\AppData\Roaming\SPI
      2017-08-09 15:34 - 2017-08-12 16:07 - 000000000 ____D C:\Users\Utilisateur\AppData\Roaming\Valit
      2017-08-09 15:34 - 2017-08-09 15:35 - 000000000 ____D C:\Users\Utilisateur\AppData\Roaming\1337
      2017-08-09 15:34 - 2017-08-09 15:34 - 000000000 ___HD C:\ProgramData\MicrosoftCorporation
      2017-08-09 15:33 - 2017-08-09 15:33 - 000177152 _____ C:\Windows\svchost.exe
      2017-08-09 15:33 - 2017-08-09 15:33 - 000073216 _____ C:\Windows\taskmgr.exe
      2017-08-09 20:56 - 2017-08-09 20:56 - 000003470 _____ C:\Windows\System32\Tasks\Reimage Reminder
      2017-08-09 20:54 - 2017-08-09 20:54 - 000004298 _____ C:\Windows\System32\Tasks\ReimageUpdater
      2017-08-09 20:54 - 2017-08-09 20:54 - 000000004 _____ C:\ProgramData\_lg.3sap
      2017-08-09 20:53 - 2017-08-09 20:54 - 000000000 ____D C:\ProgramData\Reimage Protector
      2017-08-09 20:51 - 2017-08-09 20:56 - 000000140 _____ C:\Windows\Reimage.ini
      2017-08-09 19:48 - 2017-08-09 19:56 - 000000000 ____D C:\Program Files\TNod User & Password Finder
      HKLM\...\Policies\Explorer\Run: [Updates] => C:\system32\SystemProtection.exe [168960 2009-07-14] (Microsoft Corporation)
      HKLM\ DisallowedCertificates: 03D22C9C66915D58C88912B64C1F984B8344EF09 (Comodo Security Solutions) <==== WARNING
      HKLM\ DisallowedCertificates: 0F684EC1163281085C6AF20528878103ACEFCAAB (F-Secure Corporation) <==== WARNING
      HKLM\ DisallowedCertificates: 1667908C9E22EFBD0590E088715CC74BE4C60884 (FRISK Software International/F-Prot) <==== WARNING
      HKLM\ DisallowedCertificates: 18DEA4EFA93B06AE997D234411F3FD72A677EECE (Bitdefender SRL) <==== WARNING
      HKLM\ DisallowedCertificates: 2026D13756EB0DB753DF26CB3B7EEBE3E70BB2CF (G DATA Software AG) <==== WARNING
      HKLM\ DisallowedCertificates: 249BDA38A611CD746A132FA2AF995A2D3C941264 (Malwarebytes Corporation) <==== WARNING
      HKLM\ DisallowedCertificates: 31AC96A6C17C425222C46D55C3CCA6BA12E54DAF (Symantec Corporation) <==== WARNING
      HKLM\ DisallowedCertificates: 331E2046A1CCA7BFEF766724394BE6112B4CA3F7 (Trend Micro) <==== WARNING
      HKLM\ DisallowedCertificates: 3353EA609334A9F23A701B9159E30CB6C22D4C59 (Webroot Inc.) <==== WARNING
      HKLM\ DisallowedCertificates: 373C33726722D3A5D1EDD1F1585D5D25B39BEA1A (SUPERAntiSpyware.com) <==== WARNING
      HKLM\ DisallowedCertificates: 3850EDD77CC74EC9F4829AE406BBF9C21E0DA87F (Kaspersky Lab) <==== WARNING
      HKLM\ DisallowedCertificates: 3D496FA682E65FC122351EC29B55AB94F3BB03FC (AVG Technologies CZ) <==== WARNING
      HKLM\ DisallowedCertificates: 4243A03DB4C3C15149CEA8B38EEA1DA4F26BD159 (PC Tools) <==== WARNING
      HKLM\ DisallowedCertificates: 42727E052C0C2E1B35AB53E1005FD9EDC9DE8F01 (K7 Computing Pvt Ltd) <==== WARNING
      HKLM\ DisallowedCertificates: 4420C99742DF11DD0795BC15B7B0ABF090DC84DF (Doctor Web Ltd.) <==== WARNING
      HKLM\ DisallowedCertificates: 4C0AF5719009B7C9D85C5EAEDFA3B7F090FE5FFF (Emsisoft Ltd) <==== WARNING
      HKLM\ DisallowedCertificates: 5240AB5B05D11B37900AC7712A3C6AE42F377C8C (Check Point Software Technologies Ltd.) <==== WARNING
      HKLM\ DisallowedCertificates: 5DD3D41810F28B2A13E9A004E6412061E28FA48D (Emsisoft Ltd) <==== WARNING
      HKLM\ DisallowedCertificates: 7457A3793086DBB58B3858D6476889E3311E550E (K7 Computing Pvt Ltd) <==== WARNING
      HKLM\ DisallowedCertificates: 76A9295EF4343E12DFC5FE05DC57227C1AB00D29 (BullGuard Ltd) <==== WARNING
      HKLM\ DisallowedCertificates: 775B373B33B9D15B58BC02B184704332B97C3CAF (McAfee) <==== WARNING
      HKLM\ DisallowedCertificates: 872CD334B7E7B3C3D1C6114CD6B221026D505EAB (Comodo Security Solutions) <==== WARNING
      HKLM\ DisallowedCertificates: 88AD5DFE24126872B33175D1778687B642323ACF (McAfee) <==== WARNING
      HKLM\ DisallowedCertificates: 9132E8B079D080E01D52631690BE18EBC2347C1E (Adaware Software) <==== WARNING
      HKLM\ DisallowedCertificates: 982D98951CF3C0CA2A02814D474A976CBFF6BDB1 (Safer Networking Ltd.) <==== WARNING
      HKLM\ DisallowedCertificates: 9A08641F7C5F2CCA0888388BE3E5DBDDAAA3B361 (Webroot Inc.) <==== WARNING
      HKLM\ DisallowedCertificates: 9C43F665E690AB4D486D4717B456C5554D4BCEB5 (ThreatTrack Security) <==== WARNING
      HKLM\ DisallowedCertificates: 9E3F95577B37C74CA2F70C1E1859E798B7FC6B13 (CURIOLAB S.M.B.A.) <==== WARNING
      HKLM\ DisallowedCertificates: A1F8DCB086E461E2ABB4B46ADCFA0B48C58B6E99 (Avira Operations GmbH & Co. KG) <==== WARNING
      HKLM\ DisallowedCertificates: A5341949ABE1407DD7BF7DFE75460D9608FBC309 (BullGuard Ltd) <==== WARNING
      HKLM\ DisallowedCertificates: A59CC32724DD07A6FC33F7806945481A2D13CA2F (ESET) <==== WARNING
      HKLM\ DisallowedCertificates: AB7E760DA2485EA9EF5A6EEE7647748D4BA6B947 (AVG Technologies CZ) <==== WARNING
      HKLM\ DisallowedCertificates: AD4C5429E10F4FF6C01840C20ABA344D7401209F (Avast Antivirus/Software) <==== WARNING
      HKLM\ DisallowedCertificates: AD96BB64BA36379D2E354660780C2067B81DA2E0 (Symantec Corporation) <==== WARNING
      HKLM\ DisallowedCertificates: B8EBF0E696AF77F51C96DB4D044586E2F4F8FD84 (Malwarebytes Corporation) <==== WARNING
      HKLM\ DisallowedCertificates: CDC37C22FE9272D8F2610206AD397A45040326B8 (Trend Micro) <==== WARNING
      HKLM\ DisallowedCertificates: D3F78D747E7C5D6D3AE8ABFDDA7522BFB4CBD598 (Kaspersky Lab) <==== WARNING
      HKLM\ DisallowedCertificates: DB303C9B61282DE525DC754A535CA2D6A9BD3D87 (ThreatTrack Security) <==== WARNING
      HKLM\ DisallowedCertificates: DB77E5CFEC34459146748B667C97B185619251BA (Avast Antivirus/Software) <==== WARNING
      HKLM\ DisallowedCertificates: E22240E837B52E691C71DF248F12D27F96441C00 (Total Defense, Inc.) <==== WARNING
      HKLM\ DisallowedCertificates: E513EAB8610CFFD7C87E00BCA15C23AAB407FCEF (AVG Technologies CZ) <==== WARNING
      HKLM\ DisallowedCertificates: ED841A61C0F76025598421BC1B00E24189E68D54 (Bitdefender SRL) <==== WARNING
      HKLM\ DisallowedCertificates: F83099622B4A9F72CB5081F742164AD1B8D048C9 (ESET) <==== WARNING
      HKLM\ DisallowedCertificates: FBB42F089AF2D570F2BF6F493D107A3255A9BB1A (Panda Security S.L) <==== WARNING
      HKLM\ DisallowedCertificates: FFFA650F2CB2ABC0D80527B524DD3F9FC172C138 (Doctor Web Ltd.) <==== WARNING
      HKU\S-1-5-21-2356778116-2662926543-2747011829-1000\...\Run: [Valit.vbs] => C:\Users\Utilisateur\AppData\Roaming\Valit\Valit.vbs [275 2017-08-09] ()
      Task: {36F0DA6E-11C3-4698-A28F-08DC944093E2} - System32\Tasks\Reimage Reminder => C:\Program Files\Reimage\Reimage Repair\ReimageReminder.exe <==== WARNING
      2017-08-09 15:36 - 2017-08-09 15:36 - 000635941 _____ (ZoZM9UAMB5DqfnM7q5Bj ) C:\Users\Utilisateur\AppData\Local\Temp\browmodule.exe
      Task: {B4556426-032B-4DB4-AD3E-6A81CC597AF0} - System32\Tasks\ReimageUpdater => C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe <==== WARNING
      Task: {B759D607-EB40-408F-8A32-3861C3B71B49} - System32\Tasks\Learning Channel Basic Editor => C:\Windows\system32\rundll32.exe "C:\Program Files\Learning Channel Basic Editor\Learning Channel Basic Editor.dll",oJRbHhhpgpQ <==== WARNING
      C:\Program Files\Learning Channel Basic Editor
      Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnеt Еxрlorеr.lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic
      Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Intеrnet Eхрlorer (Nо Аdd-оns).lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic
      Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Lаunсh Internеt Еxрlorеr Вrоwsеr.lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic
      Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Intеrnеt Ехрlоrеr.lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic
      Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Мozillа Firefoх.lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.xoferif.bat (No file) <==== Cyrillic
      Shortcut: C:\Users\Utilisateur\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Intеrnеt Eхplorеr.lnk -> C:\Users\Utilisateur\AppData\Roaming\Browsers\exe.erolpxei.bat (No file) <==== Cyrillic
      C:\Users\Utilisateur\AppData\Roaming\Browsers
      Hosts:
      EmptyTemp:
      RemoveProxy:
      Reboot:


      Once the text is pasted in Notepad,
      Menu "File" then "Save As",
      On the left, go to the Desktop,
      In the bottom field, for the file name enter: fixlist.txt
      Click "Save", this will create fixlist.txt on the Desktop.

      Restart FRST and click on the "Fix" button
      A restart may be necessary ( not mandatory )
      A text file appears, copy/paste the content here in a new message.

      Restart the computer.

      <bold>3°)
      Finish with a cleanup using Malwarebytes - Malwarebytes Anti-Malware free version tutorial

      4°)
      Download and run https://forum.malekal.com/viewtopic.php?t=28637&start=TDSSKiller]
      Click "Skip" on detections. Click on the top right "reports".
      Send the content of the TDSSKiller report to https://pjjoint.malekal.com/
      Provide the link of the pjjoint report in a new message for review.

      --
      Please press any key to continue the disinfection...
      1
      2. Malekal_morte- Moderator
        @KfestD'accord, partage le texte à traduire et je m'en occuperai.
        0
      3. Kfest Author
        @Malekal_morte-Alright Boss,
        Thank you, one last thing?
        Can we be more in touch, I mean privately?
        0
      4. Malekal_morte- Moderator
        @KfestWhere is the TDSSkiller report?
        0
    2. Malekal_morte- Moderator
      Hello,

      Follow the FRST tutorial. ( take the time to read it carefully - everything is well explained ).

      Download and run the FRST scan,
      Wait for the scan to finish, a message will indicate that the analysis is complete.

      Three FRST reports will be generated:
      • FRST.txt
      • Shortcut.txt
      • Additionnal.txt


      Send these 3 reports to the website https://pjjoint.malekal.com/ and return with the 3 pjjoint links leading to the reports here in a new response so we can review them.

      --
      Please press any key to continue the disinfection...
      1