Bonjour johndeere86,
Bienvenue sur Security-X,
Tu as effectivement plusieurs adwares, sponsors publicitaires installés "
volontairement" car tu n'es pas assez vigilant et n'as pas décoché les sponsors proposé à l'installation de certains programmes "gratuit"
Nous allons nettoyer cela :
1) Désinstalle les programmes suivants dans ta liste des programmes (si présents) :Note : Si tu rencontres une erreur passe au suivant et poursuis la procédure- HiDef Media Player 1.1.12 (sauf réelle utilité)
- Oryte Games 1.15 Toolbar (idem)
- ToolbarFR (barre d'outil Orange, sauf réelle utilité)
-
Boxore Client (adware)
-
DMUninstaller (idem)
-
Iminent (idem)
-
Iminent Toolbar on IE and Chrome (idem)
-
melondrea (idem)
-
Re-markit (idem)
-
SavingsBull (idem)
-
Shopping Helper Smartbar (idem)
-
ValueApps (idem)
[Info]Suite Windows Live : Windows live messenger ayant été remplacé par Skype, il peut être intéressant dès à présent de supprimer les logiciels devenus inutile de la suite Windows Live.
Pour cela, dans la liste des programmes, cliquer sur "Windows Live"/"Installation Windows Live" puis "Désinstaller" et choisir les logiciels à supprimer (ex : Windows Live Messenger, Complément Messenger, Windows Live Writer, Windows Live Mesh, etc ...)
/!\ Crée un point de restauration manuel avant d'appliquer le correctif - Tutoriel en images /!\- Ouvre le Bloc-notes (Démarrer => Tous les programmes => Accessoires => Bloc-notes)
- Copie/colle la totalité du contenu de la zone Code ci-dessous dans le Bloc-notes
start
() C:\Users\yolande\AppData\Local\PirritSuggestor\PirritService.exe
() C:\Users\yolande\AppData\Local\PirritSuggestor\PirritDesktop.exe
() C:\Users\yolande\AppData\Local\fst_fr_105\upfst_fr_105.exe
() C:\Users\yolande\AppData\Roaming\cacaoweb\cacaoweb.exe
HKLM-x32\...\Run: [Allin1Convert_8h Browser Plugin Loader 64] - C:\Program Files (x86)\Allin1Convert_8h\bar\1.bin\8hbrmon64.exe
HKLM-x32\...\RunOnce: [upfst_fr_105.exe] - C:\Users\yolande\AppData\Local\fst_fr_105\upfst_fr_105.exe -runonce [3234256 2014-02-24] ()
HKU\S-1-5-21-472419791-3820867611-3958039869-1000\...\Run: [cacaoweb] - C:\Users\yolande\AppData\Roaming\cacaoweb\cacaoweb.exe [471552 2014-01-13] ()
HKU\S-1-5-21-472419791-3820867611-3958039869-1000\...\Run: [Optimizer Pro] - C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll File Not Found
AppInit_DLLs: C:\PROGRA~2\OPTIMI~1\OPTPRO~2.DLL => C:\PROGRA~2\OPTIMI~1\OPTPRO~2.DLL File Not Found
AppInit_DLLs-x32: c:\progra~2\searchprotect\searchprotect\bin\spvc32loader.dll => "c:\progra~2\searchprotect\searchprotect\bin\spvc32loader.dll" File Not Found
AppInit_DLLs-x32: c:\progra~2\optimi~1\optpro~1.dll => "c:\progra~2\optimi~1\optpro~1.dll" File Not Found
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=http://127.0.0.1:9881
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.awesomehp.com/web/?type=ds&ts=1394642955&from=tugs&uid=395049983_1052515_128E57AE&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.awesomehp.com/?type=hp&ts=1394642955&from=tugs&uid=395049983_1052515_128E57AE
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&a=tele_14_12_ch&cd=2XzuyEtN2Y1L1QzuyBtDyBtC0B0CtCtCyCtDtDtByDyB0A0EtN0D0Tzu0SzztDyCtN1L2XzutBtFtCzztFtBtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StBtAyD0A0AtAtB0BtG0CyEzzyCtGtD0FtD0CtG0FzzzyyEtGyEtD0FyDyCtCzztD0CyCtA0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCzyyE0EzztA0AyBtG0DyByD0EtGtCzyyByBtG0D0F0DtCtGyD0AtA0FtDtB0A0DzyyEtBtC2Q&cr=569893012&ir=
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.awesomehp.com/web/?type=ds&ts=1394642955&from=tugs&uid=395049983_1052515_128E57AE&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.awesomehp.com/web/?type=ds&ts=1394642955&from=tugs&uid=395049983_1052515_128E57AE&q={searchTerms}
URLSearchHook: HKLM-x32 - (No Name) - {d2f11d8b-3eb5-4b42-9511-370dbec707fb} - No File
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.awesomehp.com/web/?type=ds&ts=1394642955&from=tugs&uid=395049983_1052515_128E57AE&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.awesomehp.com/web/?type=ds&ts=1394642955&from=tugs&uid=395049983_1052515_128E57AE&q={searchTerms}
SearchScopes: HKLM - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL =
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = http://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZLPTi8JOzLs49de9jeC3TpQCgy_dy83GkOkMrRwzz4v-8JbEDJPC3MzhAm-tpnDHdAJgqKzpDLml9i3ENBKVU1LP1JxVdswaK__nwja_q5dwOQQHTTpyLy-wo1Z85gDQ8A0DtceQ7bsWA,,&q={searchTerms}
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = http://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJlBATeRnAqXYyYJDXLfK6eZLPTi8JOzLs49de9jeC3TpQCgy_dy83GkOkMrRwzz4v-8JbEDJPC3MzhAm-tpnDHdAJgqKzpDLml9i3ENBKVU1LP1JxVdswaK__nwja_q5dwOQQHTTpyLy-wo1Z85gDQ8A0DtceQ7bsWA,,&q={searchTerms}
BHO: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll No File
BHO: media enhance - {11111111-1111-1111-1111-110411411150} - C:\Program Files (x86)\media enhance\media enhance-bho64.dll No File
BHO: free ven - {11111111-1111-1111-1111-110511161178} - C:\Program Files (x86)\free ven\free ven-bho64.dll No File
BHO: HQ-Video-Pro-1.5 - {11111111-1111-1111-1111-110511291122} - C:\Program Files (x86)\HQ-Video-Pro-1.5\HQ-Video-Pro-1.5-bho64.dll No File
BHO: SmartbarInternetExplorerBHOEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: ValueApps - {93DBF2BB-A2B3-4683-A92E-57E60751F346} - C:\Program Files\Conduit\ValueApps\IE\ValueAppsLoader.dll No File
BHO: No Name - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - No File
BHO-x32: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO-x32: No Name - {1d970ed5-3eda-438d-bffd-715931e2775b} - No File
BHO-x32: No Name - {d2f11d8b-3eb5-4b42-9511-370dbec707fb} - No File
BHO-x32: IEExtension.Extension - {d40c654d-7c51-4eb3-95b2-1e23905c2a2d} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM - Shopping Helper Smartbar - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - No Name - {D3028143-6145-4318-99D3-3EDCE54A95A9} - No File
Toolbar: HKLM-x32 - No Name - {c9a6357b-25cc-4bcf-96c1-78736985d412} - No File
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKCU - No Name - {D3028143-6145-4318-99D3-3EDCE54A95A9} - No File
Toolbar: HKCU - No Name - {D2F11D8B-3EB5-4B42-9511-370DBEC707FB} - No File
FF Plugin-x32: @tools.Software.com/Software Update;version=3 - C:\Program Files (x86)\Software\Update\1.3.25.0\npSoftwareUpdate3.dll (The Software Group)
FF Plugin-x32: @tools.Software.com/Software Update;version=9 - C:\Program Files (x86)\Software\Update\1.3.25.0\npSoftwareUpdate3.dll (The Software Group)
FF Extension: Widget context - C:\Users\yolande\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-03-12]
FF Extension: Pirrit Suggestor - C:\Users\yolande\AppData\Roaming\Mozilla\Firefox\profiles\extensions\suggestor@suggestor.pirrit.com.xpi [2014-03-12]
FF HKCU\...\Firefox\Extensions: [{88849db3-dcd8-4efe-bcbb-af92b5c8ec55}] - C:\Program Files (x86)\Re-markit-soft\157.xpi
CHR HKCU\...\Chrome\Extension: [leahdjjpjmnamomgpojikeapflgbmjab] - C:\Users\yolande\AppData\Roaming\cacaoweb\cacaoweb.crx [2014-03-22]
CHR HKLM-x32\...\Chrome\Extension: [pelmeidfhdlhlbjimpabfcbnnojbboma] - C:\Users\yolande\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx [2014-03-12]
U2 PirritDesktop; C:\Users\yolande\AppData\Local\PirritSuggestor\PirritService.exe [52568 2014-02-20] ()
S2 Software_update; C:\Program Files (x86)\Software\Update\SoftwareUpdate.exe [119408 2014-03-12] (The Software Group)
S3 Software_update_m; C:\Program Files (x86)\Software\Update\SoftwareUpdate.exe [119408 2014-03-12] (The Software Group)
S2 70e6ca8c; "C:\Windows\system32\rundll32.exe" "c:\progra~2\optimi~1\OptProCrashSvc.dll",ServiceMain
S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [X]
S2 PirritUpdater; C:\Program Files (x86)\Pirrit\AutoUpdater.exe [X]
S2 WinRST; C:\Program Files (x86)\WinRST\WinRST.exe [X]
2014-03-22 13:40 - 2014-03-22 13:42 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-03-22 13:38 - 2014-03-22 13:39 - 40658208 _____ (Safer-Networking Ltd. ) C:\Users\yolande\Downloads\spybot-2.2.exe
2014-03-17 11:14 - 2014-03-17 11:14 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-03-17 11:13 - 2014-03-17 11:13 - 00000000 ____D () C:\Windows\Tasks\ImCleanDisabled
2014-03-17 11:12 - 2014-03-17 11:12 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\yolande\Downloads\SpyHunter-Installer.exe
2014-03-17 10:59 - 2014-03-17 11:03 - 00000000 ____D () C:\ProgramData\IObit
2014-03-17 10:59 - 2014-03-17 11:00 - 00000000 ____D () C:\Users\yolande\AppData\Roaming\IObit
2014-03-17 10:57 - 2014-03-17 10:58 - 41736680 _____ (IObit ) C:\Users\yolande\Downloads\advanced-systemcare-setup.exe
2014-03-12 18:44 - 2014-03-12 18:44 - 00000000 ____D () C:\Users\yolande\AppData\Local\WinRST
2014-03-12 18:44 - 2014-03-12 18:44 - 00000000 ____D () C:\Users\yolande\AppData\Local\PirritSuggestor
2014-03-12 18:41 - 2014-03-12 15:04 - 00955488 _____ (AnyProtect.com) C:\Users\yolande\AppData\Local\AnyProtectScannerSetup.exe
2014-03-12 18:14 - 2014-03-22 12:17 - 00000300 _____ () C:\Windows\Tasks\SaveSense.job
2014-03-12 18:14 - 2014-03-13 10:17 - 00003248 _____ () C:\Windows\System32\Tasks\SaveSense
2014-03-12 17:56 - 2014-03-17 16:23 - 00000000 ____D () C:\ProgramData\WPM
2014-03-12 17:56 - 2014-03-17 12:54 - 00000000 ____D () C:\Users\yolande\AppData\Roaming\SupTab
2014-03-12 17:54 - 2014-03-22 13:59 - 00000920 _____ () C:\Windows\Tasks\SoftwareUpdateTaskMachineUA.job
2014-03-12 17:54 - 2014-03-22 13:45 - 00000916 _____ () C:\Windows\Tasks\SoftwareUpdateTaskMachineCore.job
2014-03-12 17:54 - 2014-03-17 12:55 - 00000000 ____D () C:\Program Files\Conduit
2014-03-12 17:54 - 2014-03-12 17:54 - 00003916 _____ () C:\Windows\System32\Tasks\SoftwareUpdateTaskMachineUA
2014-03-12 17:54 - 2014-03-12 17:54 - 00003664 _____ () C:\Windows\System32\Tasks\SoftwareUpdateTaskMachineCore
2014-03-12 17:54 - 2014-03-12 17:54 - 00000000 ____D () C:\Users\yolande\Documents\Optimizer Pro
2014-03-12 17:54 - 2014-03-12 17:54 - 00000000 ____D () C:\Users\yolande\AppData\Roaming\Optimizer Pro
2014-03-12 17:53 - 2014-03-12 17:54 - 00000000 ____D () C:\Program Files (x86)\Software
2014-03-12 17:53 - 2014-03-12 17:53 - 00000000 ____D () C:\Users\yolande\AppData\Local\Tuguu_SL
2014-03-12 17:53 - 2014-03-12 17:53 - 00000000 ____D () C:\Users\yolande\AppData\Local\Software
2014-03-12 17:51 - 2014-03-19 18:46 - 00000378 _____ () C:\Windows\Tasks\APSnotifierCA.job
2014-03-12 17:50 - 2014-03-12 18:45 - 00000584 _____ () C:\Users\yolande\AppData\Roaming\aps.scan.quick.results
2014-03-12 17:50 - 2014-03-12 17:50 - 00000000 ____D () C:\Users\yolande\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup
2014-03-12 17:49 - 2014-03-12 17:49 - 00955488 _____ (AnyProtect.com) C:\Users\yolande\AppData\Local\nsc1CB1.tmp
2014-03-10 10:16 - 2014-03-10 10:16 - 00127088 _____ (Rentabiliweb) C:\Users\yolande\Downloads\yesmessenger (12).exe
2014-03-10 10:15 - 2014-03-10 10:15 - 00127088 _____ (Rentabiliweb) C:\Users\yolande\Downloads\yesmessenger (9).exe
2014-03-10 10:15 - 2014-03-10 10:15 - 00127088 _____ (Rentabiliweb) C:\Users\yolande\Downloads\yesmessenger (8).exe
2014-03-10 10:15 - 2014-03-10 10:15 - 00127088 _____ (Rentabiliweb) C:\Users\yolande\Downloads\yesmessenger (7).exe
2014-03-10 10:15 - 2014-03-10 10:15 - 00127088 _____ (Rentabiliweb) C:\Users\yolande\Downloads\yesmessenger (6).exe
2014-03-10 10:15 - 2014-03-10 10:15 - 00127088 _____ (Rentabiliweb) C:\Users\yolande\Downloads\yesmessenger (5).exe
2014-03-10 10:15 - 2014-03-10 10:15 - 00127088 _____ (Rentabiliweb) C:\Users\yolande\Downloads\yesmessenger (4).exe
2014-03-10 10:15 - 2014-03-10 10:15 - 00127088 _____ (Rentabiliweb) C:\Users\yolande\Downloads\yesmessenger (3).exe
2014-03-10 10:15 - 2014-03-10 10:15 - 00127088 _____ (Rentabiliweb) C:\Users\yolande\Downloads\yesmessenger (2).exe
2014-03-10 10:15 - 2014-03-10 10:15 - 00127088 _____ (Rentabiliweb) C:\Users\yolande\Downloads\yesmessenger (11).exe
2014-03-10 10:15 - 2014-03-10 10:15 - 00127088 _____ (Rentabiliweb) C:\Users\yolande\Downloads\yesmessenger (10).exe
2014-03-10 10:14 - 2014-03-10 10:14 - 00127088 _____ (Rentabiliweb) C:\Users\yolande\Downloads\yesmessenger.exe
2014-03-10 10:14 - 2014-03-10 10:14 - 00127088 _____ (Rentabiliweb) C:\Users\yolande\Downloads\yesmessenger (1).exe
2014-03-07 09:26 - 2014-03-07 09:26 - 00000000 ____D () C:\Users\yolande\AppData\Local\SearchProtect
2014-03-06 10:23 - 2014-03-22 13:50 - 00000000 ____D () C:\Users\yolande\AppData\Local\fst_fr_105
2014-03-06 10:23 - 2014-03-17 11:13 - 00000000 ____D () C:\Users\yolande\AppData\Roaming\systweak
2014-03-06 10:23 - 2014-03-17 10:27 - 00000000 ____D () C:\Users\yolande\AppData\Local\Lollipop
C:\Users\yolande\AppData\Local\Temp\promote-upx.exe
C:\Users\yolande\AppData\Local\Temp\SaveSenseUpdateVer.exe
C:\Program Files\Conduit
C:\Program Files (x86)\free ven
C:\Program Files (x86)\IObit
C:\Program Files (x86)\media enhance
C:\Program Files (x86)\Optimizer Pro
C:\Program Files (x86)\Software
C:\Program Files (x86)\AnyProtectEx
C:\Users\yolande\AppData\Local\PirritSuggestor
C:\Users\yolande\AppData\Local\fst_fr_105
C:\Users\yolande\AppData\Roaming\cacaoweb
C:\Program Files (x86)\Allin1Convert_8h\bar
Task: {A1E9A1E5-1DAE-4DD6-A87A-A5FAEA10D9F2} - System32\Tasks\SoftwareUpdateTaskMachineCore => C:\Program Files (x86)\Software\Update\SoftwareUpdate.exe [2014-03-12] (The Software Group) <==== ATTENTION
Task: {BA32115D-AF84-41FE-AC0C-853F4FEF2760} - System32\Tasks\APSnotifierCA => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {DB24283D-51FC-469A-B54D-38A0656CF4F1} - System32\Tasks\SaveSense => C:\Users\yolande\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierCA.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe
Task: C:\Windows\Tasks\SaveSense.job => C:\Users\yolande\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\SoftwareUpdateTaskMachineCore.job => C:\Program Files (x86)\Software\Update\SoftwareUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\SoftwareUpdateTaskMachineUA.job => C:\Program Files (x86)\Software\Update\SoftwareUpdate.exe <==== ATTENTION
Task: {4EAB1212-22D3-44F6-8811-C38B02B7CBC2} - System32\Tasks\SoftwareUpdateTaskMachineUA => C:\Program Files (x86)\Software\Update\SoftwareUpdate.exe [2014-03-12] (The Software Group) <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Temp:D1B5B4F1
end- Enregistre le fichier sur ton Bureau (au même endroit que FRST) sous le nom fixlist.txt
- Ferme toutes les applications, y compris ton navigateur
- Double-clique sur FRST.exe
/!\ Sous Vista, Windows 7 et 8, il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur
- Sur le menu principal, clique une seule fois sur Fix et patiente le temps de la correction

- L'outil va créer un rapport de correction Fixlog.txt. Poste ce rapport dans ta réponse.
/!\ Ce script a été établi pour cet utilisateur, il ne doit, en aucun cas, être appliqué sur un autre système, au risque de provoquer de graves dysfonctionnement et endommager Windows /!\
Télécharge AdwCleaner (de Xplode) sur ton Bureau.- Double-clique sur adwcleaner.exe pour lancer le programme.
(Utilisateur de Vista/Windows 7/8, clique-droit sur le fichier adwcleaner.exe -> Exécuter en tant qu'administrateur)
- Dans la fenêtre principal, choisis l'option Scanner.
- Attend la fin de la recherche puis clique sur l'option Rapport.
- Un fichier texte apparaitra (sinon, il est situé ici C:\AdwCleaner[Rx].txt). Poste-le dans ta prochaine réponse.
