Aller au contenu

  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

PC portable, invasion de pubs, pop-ups, malwares...

Lectal

Par Lectal
dans Analyses et éradication malwares

 Partager

Messages recommandés

Lectal Junior Member

Lectal

Posté(e)
Posté(e)

Bonjour à tous

 

Ma copine à un PC portable, qui devient de plus en plus inutilisable tant y a des pubs, des barres de recherches vérolées, des pop up intempestives....

 

Bien entendu, la plupart des antivirus / malware ne sont pas top, et je suppose que seul des outils type Hijackthis, ou ce genre de choses pourront régler les choses.

 

Que me conseillez vous de faire ?

 

Merci

 

 

Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

Bonjour,

 

ZHPDiag :

  • Télécharge ZHPDiag de Nicolas Coolman. et enregistre-le sur le BUREAU.
    http://www.nicolascoolman.fr/download/zhpdiag/
  • Double-clique sur ZHPDiag.exe pour lancer l'installation
    • Important:
      Sous Vista et Windows 7/8 : il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur


N'oublie pas de cocher la case qui permet de mettre un raccourci sur le Bureau.

[*]L'outil a créé 2 icônes ZHPDiag et ZHPFix sur le Bureau.

[*]Double-clique sur ZHPDiag pour lancer l'exécution

  • Important:
    Sous Vista et Windows 7 : il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur

Clique sur Complet (Full options)

[*]ZhpDiagcomplet_zps7fd29cfc.jpg

[*]Tu patientes jusqu'à ce que le scan affiche 100%
Tu refermes ZHPDiag

[*]Le rapport ZHPDiag.txt se trouve sur le Bureau. (et sous c:\ZHP\ZHPDiag.txt)
Ce rapport étant trop long pour le forum, héberge le :

ou http://dl.free.fr/

http://www.rue-du-montceau.fr/tuto_cjoint.html >> tuto de Nardino pour héberger.

16-01-201400-29-39_zpsaee22218.jpg

@++

Apollo Devil Member !

Apollo

Posté(e)
Posté(e) (modifié)

Bonjour,

 

1)

ZHPFix :

 

  • Ferme toutes les applications ouvertes

     

     

  • Double-clique sur ZHPFix, raccourci installé par ZHPDiag sur le Bureau
    Important:
    Sous Vista et Windows 7/8 : il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur.

     

     

  • Copie les lignes ci-dessous dans la fenêtre

sauf le mot citation.

 

 

 

Script ZHPFix

FirewallRaz
EmptyPrefetch
ProxyFix

ShortcutFix
EmptyTemp
EmptyFlash
IFEOFix
[MD5.FC6EFBC1FAD19D5E028E31288570DF7C] - (...) -- C:\Users\Marine\AppData\Local\fst_fr_304\upfst_fr_304.exe [3321312] [PID.4924]
[MD5.D8CA8792B92D25A7A965CFAB8801400A] - (.Smart PC Solutions - PC Speed Maximizer.) -- C:\Program Files (x86)\PC Speed Maximizer\PCSpeedMaximizer.exe [22241592] [PID.5240]
[MD5.FDA9F5DD73C917D77B22A15D507E3D2D] - (.AnyProtect.com - AnyProtect.) -- C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [16986624] [PID.5252]
[MD5.E6D76E14D6E27EB476704FE8364D95DB] - (.Smart PC Solutions - PC Speed Maximizer Smart Scan.) -- C:\Program Files (x86)\PC Speed Maximizer\SPMSmartScan.exe [424760] [PID.5512]
[MD5.0000CE63FCE940E27564BBCFEA0AFC2B] - (.FST - FST Setup.) -- C:\Users\Marine\AppData\Local\fst_fr_304\Download\majfstfr.exe [8364080] [PID.8048]
[MD5.11E157B82F5BBB30E9B44EB571E9B82A] - (...) -- C:\Users\Marine\AppData\Local\Temp\is-FJB8U.tmp\InstallManagerR.exe [226392] [PID.5184]
[MD5.E91C669DB45EC0F1D18185A9B7006E44] - (.Cherished Technololgy LIMITED - IePlugin Service.) -- C:\ProgramData\IePluginService\PluginService.exe [705136] [PID.1804]
[MD5.BA4DA4299310F4A54CBBA25221072D70] - (.Fuyu LIMITED - WindowsProtectManger Service.) -- C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [535936] [PID.1864]
[MD5.7A5EEEA218C730439C0D8FBFC8BF60DD] - (.Cherished Technololgy LIMITED - WPM Service.) -- C:\ProgramData\WPM\wprotectmanager.exe [510608] [PID.624]
[MD5.307F2D70023CE3F892904165D3DA8D3B] - (...) -- C:\Users\Marine\AppData\Roaming\VOPackage\VOsrv.exe [71168] [PID.2964]
G0 - GCSP: Preference [user Data\Default][HomePage] http://www.sweet-page.com
G2 - GCE: Preference [user Data\Default] [amfclgbdpgndipgoegfpkkgobahigbcl] Yahoo Community Smartbar v.1.4, (Désactivé)
G2 - GCE: Preference [user Data\Default] [bkomkajifikmkfnjgphkjcfeepbnojok] PriceGong v.5.6.11 (Désactivé)
G2 - GCE: Preference [user Data\Default] [booedmolknjekdopkepjjeckmjkdpfgl] Extutil v.0.1 (Activé)
G2 - GCE: Preference [user Data\Default] [dhdppnagkklahjmblgdojadgbiffhejd] Deeal_fr 0.2 v.1.25.7, (Désactivé)
G2 - GCE: Preference [user Data\Default] [flpcjncodpafbgdpnkljologafpionhb] Managera v.0.1 (Activé)
G2 - GCE: Preference [user Data\Default] [halffneccaebicfdfajnbfgpglahfgoe] Giant Savings Extension v.1.25.59, (Désactivé)
G2 - GCE: Preference [user Data\Default] [ifohbjbgfchkkfhphahclmkpgejiplfo] Lightning Newtab v.1.3.0.5, (Désactivé)
G2 - GCE: Preference [user Data\Default] [ogfjmhfnldnajmfaofeiaepghjenbgjo] Extended Protection v.3.4.2 (Désactivé)
G2 - GCE: Preference [user Data\Default] [pelmeidfhdlhlbjimpabfcbnnojbboma] Quick start v.4.5.1, (Activé)
G2 - EXT: C:\Users\Marine\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl [Yahoo Community Smartbar]
G2 - EXT: C:\Users\Marine\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok [PriceGong]
G2 - EXT: C:\Users\Marine\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdppnagkklahjmblgdojadgbiffhejd [Deeal_fr 0.2]
G2 - EXT: C:\Users\Marine\AppData\Local\Google\Chrome\User Data\Default\Extensions\halffneccaebicfdfajnbfgpglahfgoe [Giant Savings Extension]
G2 - EXT: C:\Users\Marine\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo [Lightning Newtab]
G2 - EXT: C:\Users\Marine\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo [Extended Protection]
G2 - EXT: C:\Users\Marine\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma [Quick start]
M3 - MFPP: Plugins - [Marine] -- C:\Users\Marine\AppData\Roaming\Mozilla\Firefox\Profiles\rn37akus.default\searchplugins\trovi-search.xml
M3 - MFPP: Plugins - [Marine] -- C:\Users\Marine\AppData\Roaming\Mozilla\Firefox\Profiles\rn37akus.default\searchplugins\Web Search.xml
M3 - MFPP: Plugins - [Marine] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\nationzoom.xml
M3 - MFPP: Plugins - [Marine] -- C:\Program Files (x86)\Mozilla FireFox\searchplugins\sweet-page.xml
M0 - MFSP: prefs.js [Marine - rn37akus.default] http://www.trovi.com
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.trovi.com
R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.sweet-page.com
R0 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.sweet-page.com
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.nationzoom.com
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nationzoom.com
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com
O2 - BHO: CrossriderApp0060346 [64Bits] - {11111111-1111-1111-1111-110611031146} . (.app - Browseri_Appe 1.2 BHO.) -- C:\Program Files (x86)\Browseri_Appe 1.2\Browseri_Appe 1.2-bho.dll
O2 - BHO: IETabPage Class [64Bits] - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} . (.Thinknice Co. Limited - SupTab setup package.) -- C:\Program Files (x86)\SupTab\SupTab.dll
O2 - BHO: DataMngr [64Bits] - {B939CF93-F2CB-443d-956C-DC523D85C9DB} . (.MusicLab, LLC - Url Helper.) -- C:\Program Files (x86)\BearShare Applications\Mediabar\Datamngr\BrowserConnection.dll
O2 - BHO: CrossriderApp0043960 [64Bits] - {11111111-1111-1111-1111-110411391160} Clé orpheline
O2 - BHO: (no name) [64Bits] - {31ad400d-1b06-4e33-a59a-90c2c140cba0} Clé orpheline
O3 - Toolbar: Yahoo Community Smartbar (by Linkury) - [HKLM]{ae07101b-46d4-4a98-af68-0333ea26e113} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll
O4 - GS\Desktop [Public]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.istart123.com
O4 - GS\Desktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe http://www.istart123.com
O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe http://www.istart123.com
O4 - GS\QuickLaunch [Marine]: 337 GAMES.lnk . (.337 Technology Limited - 337 Games.) -- C:\Users\Marine\AppData\Roaming\337Games\337Games.exe http://goo.mx/aEBnEf"
O4 - GS\QuickLaunch [Marine]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.istart123.com
O4 - GS\QuickLaunch [Marine]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe http://www.istart123.com
O4 - GS\TaskBar [Marine]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.istart123.com
O4 - GS\TaskBar [Marine]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe http://www.istart123.com
O4 - GS\Program [Marine]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe http://www.istart123.com
O4 - GS\Program [Marine]: Search.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.istart123.com
O4 - GS\SystemTools [Marine]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe http://www.istart123.com
O4 - GS\Desktop [Marine]: AnyProtect.lnk . (.AnyProtect.com - AnyProtect.) -- C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe
O4 - GS\Desktop [Marine]: Continue VuuPC Installation.lnk . (...) -- C:\Users\Marine\AppData\Local\Temp\ICReinstall_nsr56AB.tmp \RR (.not file.)
O4 - GS\Desktop [Marine]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe http://www.istart123.com
O4 - GS\Desktop [Marine]: MyPC Backup.lnk . (.MyPCBackup.com - MyPC Backup.) -- C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe
O4 - GS\Desktop [Marine]: PC Speed Maximizer.lnk . (.Smart PC Solutions - PC Speed Maximizer.) -- C:\Program Files (x86)\PC Speed Maximizer\PCSpeedMaximizer.exe
O4 - HKCU\..\Run: [PC Speed Maximizer] . (.Smart PC Solutions - Fix PC problems and optimize performance.) -- C:\Program Files (x86)\PC Speed Maximizer\SPMLauncher.exe
O4 - HKLM\..\Wow6432Node\Run: [mobilegeni daemon] C:\Program Files (x86)\Mobogenie\DaemonProcess.exe (.not file.)
O4 - HKLM\..\Wow6432Node\Run: [AnyProtect Scanner] . (.AnyProtect.com - AnyProtect.) -- C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe
O4 - HKLM\..\Wow6432Node\RunOnce: [upfst_fr_304.exe] . (...) -- C:\Users\Marine\AppData\Local\fst_fr_304\upfst_fr_304.exe
O4 - HKUS\S-1-5-21-943484837-3547648776-227057934-1000\..\Run: [PC Speed Maximizer] . (.Smart PC Solutions - Fix PC problems and optimize performance.) -- C:\Program Files (x86)\PC Speed Maximizer\SPMLauncher.exe
O23 - Service: Computer Backup (MyPC Backup) (BackupStack) . (.Just Develop It - Backup Stack.) - C:\Program Files (x86)\MyPC Backup\BackupStack.exe
O23 - Service: Search Protect Service (CltMngSvc) . (.Client Connect LTD - Search Protect.) - C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe
O23 - Service: F06DEFF2-5B9C-490D-910F-35D3A91196222 (F06DEFF2-5B9C-490D-910F-35D3A91196222) . (.SafetyNut Inc - SafetyNut Configuration.) - C:\Program Files (x86)\Browser Tab Search by Ask\SafetyNut\x64\configmgrc2.cfg
O23 - Service: IePlugin Service (IePluginService) . (.Cherished Technololgy LIMITED - IePlugin Service.) - C:\ProgramData\IePluginService\PluginService.exe
O23 - Service: VO Service component (servervo) . (...) - C:\Users\Marine\AppData\Roaming\VOPackage\VOsrv.exe
O23 - Service: WindowsMangerProtect Service (WindowsMangerProtect) . (.Fuyu LIMITED - WindowsProtectManger Service.) - C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
O23 - Service: Wpm Service (Wpm) . (.Cherished Technololgy LIMITED - WPM Service.) - C:\ProgramData\WPM\wprotectmanager.exe
O36 - AppCertDlls: (x64) . (...) -- C:\Program Files (x86)\Browser Tab Search by Ask\SafetyNut\x64\safetycrt.dll
[MD5.FDA9F5DD73C917D77B22A15D507E3D2D] [APT] [APSnotifierPP1] (.AnyProtect.com.) -- C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [16986624]
[MD5.FDA9F5DD73C917D77B22A15D507E3D2D] [APT] [APSnotifierPP2] (.AnyProtect.com.) -- C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [16986624]
[MD5.FDA9F5DD73C917D77B22A15D507E3D2D] [APT] [APSnotifierPP3] (.AnyProtect.com.) -- C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [16986624]
[MD5.00000000000000000000000000000000] [APT] [Dealply] (...) -- C:\Users\Marine\AppData\Roaming\Dealply\UPDATE~1\UPDATE~1.exe (.not file.) [0]
[MD5.9EAAD334532B269862366F20049F3694] [APT] [Deeal_fr 0.2-chromeinstaller] (.Corporate Inc.) -- C:\Program Files (x86)\Deeal_fr 0.2\Deeal_fr 0.2-chromeinstaller.exe [484864]
[MD5.BB08F23CD23047090B7C52EE82937E33] [APT] [Deeal_fr 0.2-codedownloader] (.Corporate Inc.) -- C:\Program Files (x86)\Deeal_fr 0.2\Deeal_fr 0.2-codedownloader.exe [487424]
[MD5.5D58D53A1DDF4986A6DF72C61E3ADC6D] [APT] [Deeal_fr 0.2-enabler] (.Corporate Inc.) -- C:\Program Files (x86)\Deeal_fr 0.2\Deeal_fr 0.2-enabler.exe [346624]
[MD5.7F03FAA5F58A4221EFE8C237190B204E] [APT] [Deeal_fr 0.2-firefoxinstaller] (.Corporate Inc.) -- C:\Program Files (x86)\Deeal_fr 0.2\Deeal_fr 0.2-firefoxinstaller.exe [722944]
[MD5.00000000000000000000000000000000] [APT] [Desk 365 RunAsStdUser] (...) -- C:\Program Files (x86)\Desk 365\desk365.exe (.not file.) [0]
[MD5.166E3193456B473CA73270C62E253158] [APT] [PC Speed Maximizer Schedule] (.Smart PC Solutions.) -- C:\Program Files (x86)\PC Speed Maximizer\SPMLauncher.exe [134968]
[MD5.52143C0A10231B04A4E494731F9D62BF] [APT] [Protected Search] (.Simplygen.) -- C:\Program Files (x86)\Protected Search\ProtectedSearch.exe [67656]
O39 - APT: APSnotifierPP1 - (.AnyProtect.com.) -- C:\Windows\Tasks\APSnotifierPP1.job [378]
O39 - APT: APSnotifierPP1 - (.AnyProtect.com.) -- C:\Windows\System32\Tasks\APSnotifierPP1 [378]
O39 - APT: APSnotifierPP2 - (.AnyProtect.com.) -- C:\Windows\Tasks\APSnotifierPP2.job [376]
O39 - APT: APSnotifierPP2 - (.AnyProtect.com.) -- C:\Windows\System32\Tasks\APSnotifierPP2 [376]
O39 - APT: APSnotifierPP3 - (.AnyProtect.com.) -- C:\Windows\Tasks\APSnotifierPP3.job [376]
O39 - APT: APSnotifierPP3 - (.AnyProtect.com.) -- C:\Windows\System32\Tasks\APSnotifierPP3 [376]
O39 - APT: be1f9fff-c717-4ce9-8574-a7629575b77a-1 - (.app.) -- C:\Windows\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-1.job [1618]
O39 - APT: be1f9fff-c717-4ce9-8574-a7629575b77a-1 - (.app.) -- C:\Windows\System32\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-1 [1618]
O39 - APT: be1f9fff-c717-4ce9-8574-a7629575b77a-2 - (.app.) -- C:\Windows\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-2.job [1376]
O39 - APT: be1f9fff-c717-4ce9-8574-a7629575b77a-2 - (.app.) -- C:\Windows\System32\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-2 [1376]
O39 - APT: be1f9fff-c717-4ce9-8574-a7629575b77a-3 - (.app.) -- C:\Windows\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-3.job [3124]
O39 - APT: be1f9fff-c717-4ce9-8574-a7629575b77a-3 - (.app.) -- C:\Windows\System32\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-3 [3124]
O39 - APT: be1f9fff-c717-4ce9-8574-a7629575b77a-4 - (.app.) -- C:\Windows\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-4.job [2308]
O39 - APT: be1f9fff-c717-4ce9-8574-a7629575b77a-4 - (.app.) -- C:\Windows\System32\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-4 [2308]
O39 - APT: be1f9fff-c717-4ce9-8574-a7629575b77a-5 - (.app.) -- C:\Windows\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-5.job [1460]
O39 - APT: be1f9fff-c717-4ce9-8574-a7629575b77a-5 - (.app.) -- C:\Windows\System32\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-5 [1460]
O39 - APT: be1f9fff-c717-4ce9-8574-a7629575b77a-6 - (.app.) -- C:\Windows\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-6.job [1622]
O39 - APT: be1f9fff-c717-4ce9-8574-a7629575b77a-6 - (.app.) -- C:\Windows\System32\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-6 [1622]
O39 - APT: be1f9fff-c717-4ce9-8574-a7629575b77a-7 - (.app.) -- C:\Windows\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-7.job [1550]
O39 - APT: be1f9fff-c717-4ce9-8574-a7629575b77a-7 - (.app.) -- C:\Windows\System32\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-7 [1550]
O39 - APT: Dealply - (...) -- C:\Windows\Tasks\Dealply.job [294]
O39 - APT: Dealply - (...) -- C:\Windows\System32\Tasks\Dealply [294]
O39 - APT: Deeal_fr 0.2-chromeinstaller - (.Corporate Inc.) -- C:\Windows\Tasks\Deeal_fr 0.2-chromeinstaller.job [1914]
O39 - APT: Deeal_fr 0.2-chromeinstaller - (.Corporate Inc.) -- C:\Windows\System32\Tasks\Deeal_fr 0.2-chromeinstaller [1914]
O39 - APT: Deeal_fr 0.2-codedownloader - (.Corporate Inc.) -- C:\Windows\Tasks\Deeal_fr 0.2-codedownloader.job [1206]
O39 - APT: Deeal_fr 0.2-codedownloader - (.Corporate Inc.) -- C:\Windows\System32\Tasks\Deeal_fr 0.2-codedownloader [1206]
O39 - APT: Deeal_fr 0.2-enabler - (.Corporate Inc.) -- C:\Windows\Tasks\Deeal_fr 0.2-enabler.job [1106]
O39 - APT: Deeal_fr 0.2-enabler - (.Corporate Inc.) -- C:\Windows\System32\Tasks\Deeal_fr 0.2-enabler [1106]
O39 - APT: Deeal_fr 0.2-firefoxinstaller - (.Corporate Inc.) -- C:\Windows\Tasks\Deeal_fr 0.2-firefoxinstaller.job [1840]
O39 - APT: Deeal_fr 0.2-firefoxinstaller - (.Corporate Inc.) -- C:\Windows\System32\Tasks\Deeal_fr 0.2-firefoxinstaller [1840]
O41 - Driver: (F06DEFF2-5B9C-490D-910F-35D3A91196222) . (.SafetyNut Inc - SafetyNut Configuration.) - C:\Program Files (x86)\Browser Tab Search by Ask\SafetyNut\x64\configmgrc2.cfg
O41 - Driver: ({5178f938-0bd5-47c1-8242-71f6e3e72925}Gw64) . (.StdLib - StdLib.) - C:\Windows\System32\drivers\{5178f938-0bd5-47c1-8242-71f6e3e72925}Gw64.sys
O41 - Driver: ({55dce8ba-9dec-4013-937e-adbf9317d990}Gw64) . (.StdLib - StdLib.) - C:\Windows\System32\drivers\{55dce8ba-9dec-4013-937e-adbf9317d990}Gw64.sys
O42 - Logiciel: AnyProtect - (.CMI Limited.) [HKLM][64Bits] -- AnyProtect
O42 - Logiciel: Browsebeyond 2013.11.07.204627 - (.Browsebeyond.) [HKLM][64Bits] -- Browsebeyond
O42 - Logiciel: Browser Tab Search by Ask for Google Chrome - (.IAC Search and Media.) [HKLM][64Bits] -- Browser Tab Search by Ask_Chrome
O42 - Logiciel: Deeal_fr 0.2 - (.Corporate Inc.) [HKLM][64Bits] -- Deeal_fr 0.2
O42 - Logiciel: FreeSoftToday 001.304 - (.FREESOFTTODAY.) [HKLM][64Bits] -- fst_fr_304_is1
O42 - Logiciel: GreyGray 2013.11.07.204235 - (.GreyGray.) [HKLM][64Bits] -- GreyGray
O42 - Logiciel: Iminent - (.Iminent.) [HKLM][64Bits] -- {CF687AD3-80CD-431E-A50F-25DD8F9C96C3}
O42 - Logiciel: MyPC Backup - (.MyPC Backup.) [HKLM][64Bits] -- MyPC Backup
O42 - Logiciel: PC Speed Maximizer v3.2 - (.Smart PC Solutions.) [HKLM][64Bits] -- PC Speed Maximizer_is1
O42 - Logiciel: PriceGong 2.6.11 - (.PriceGong.) [HKLM][64Bits] -- PriceGong
O42 - Logiciel: Protected Search 1.1 - (.Protected Search.) [HKLM][64Bits] -- Protected Search_is1
O42 - Logiciel: Remote Desktop Access (VuuPC) - (.CMI Limited.) [HKLM][64Bits] -- VOPackage
O42 - Logiciel: Search Protect - (.Client Connect LTD.) [HKLM][64Bits] -- SearchProtect
O42 - Logiciel: SupTab - (...) [HKLM][64Bits] -- SupTab
O42 - Logiciel: VisualBee for Microsoft PowerPoint - (.VisualBee.com.) [HKCU][64Bits] -- VisualBee for Microsoft PowerPoint
O42 - Logiciel: WindowsMangerProtect20.0.0.502 - (.WindowsProtect LIMITED.) [HKLM][64Bits] -- WindowsMangerProtect
O42 - Logiciel: Yahoo Community Smartbar - (.Linkury Inc..) [HKLM][64Bits] -- {B5945149-A282-42E9-B43A-815E404F0580}
O42 - Logiciel: Yahoo Community Smartbar Engine - (.Linkury Inc..) [HKCU][64Bits] -- {3d4bc718-6c52-45ae-8660-d7b933f50f77}
O42 - Logiciel: eoJet 1.1 - (.EoRezo.) [HKLM][64Bits] -- eoJet_is1
O42 - Logiciel: istart123 uninstall - (.istart123.) [HKLM][64Bits] -- istart123 uninstall
O42 - Logiciel: sweet-page uninstall - (.sweet-page.) [HKLM][64Bits] -- sweet-page uninstall
[HKCU\Software\AnyProtect]
[HKCU\Software\AppDataLow\Software\Crossrider]
[HKCU\Software\AppDataLow\Software\Deeal_fr 0.2]
[HKCU\Software\AppDataLow\Software\Giant Savings Extension]
[HKCU\Software\AppDataLow\Software\PriceGong]
[HKCU\Software\BearShare]
[HKCU\Software\Browsebeyond]
[HKCU\Software\Cr_Installer]
[HKCU\Software\InstallCore]
[HKCU\Software\InstalledBrowserExtensions]
[HKCU\Software\PC Speed Maximizer]
[HKCU\Software\ProtectedSearch]
[HKCU\Software\SafetyNut]
[HKCU\Software\SmartbarBackup]
[HKCU\Software\SmartbarLog]
[HKCU\Software\Smartbar]
[HKCU\Software\TutoTag]
[HKCU\Software\Tutorials]
[HKCU\Software\Visualbee]
[HKCU\Software\eojet]
[HKLM\Software\DataMngr]
[HKLM\Software\IACSearchAndMedia]
[HKLM\Software\InstalledBrowserExtensions]
[HKLM\Software\Wow6432Node\BearShareSRTB]
[HKLM\Software\Wow6432Node\Browsebeyond]
[HKLM\Software\Wow6432Node\FREESOFTTODAY]
[HKLM\Software\Wow6432Node\IACSearchAndMedia]
[HKLM\Software\Wow6432Node\IePlugin]
[HKLM\Software\Wow6432Node\InstalledBrowserExtensions]
[HKLM\Software\Wow6432Node\SProtector]
[HKLM\Software\Wow6432Node\SafetyNut]
[HKLM\Software\Wow6432Node\SupDp]
[HKLM\Software\Wow6432Node\Trymedia Systems]
[HKLM\Software\Wow6432Node\Tutorials]
[HKLM\Software\Wow6432Node\V9]
[HKLM\Software\Wow6432Node\VBMZ]
[HKLM\Software\Wow6432Node\Visualbee]
[HKLM\Software\Wow6432Node\Wpm]
[HKLM\Software\Wow6432Node\deskSvc]
[HKLM\Software\Wow6432Node\nationzoomSoftware]
[HKLM\Software\Wow6432Node\supTab]
[HKLM\Software\Wow6432Node\supWPM]
[HKLM\Software\Wow6432Node\supWindowsMangerProtect]
[HKLM\Software\Wow6432Node\sweet-pageSoftware]
C:\Program Files (x86)\AnyProtectEx
C:\Program Files (x86)\BearShare Applications
C:\Program Files (x86)\Browser Tab Search by Ask
C:\Program Files (x86)\DealPly
C:\Program Files (x86)\Deeal_fr 0.2
C:\Program Files (x86)\Desk 365
C:\Program Files (x86)\fst_fr_304
C:\Program Files (x86)\Mobogenie
C:\Program Files (x86)\MyPC Backup
C:\Program Files (x86)\PC Speed Maximizer
C:\Program Files (x86)\PriceGong
C:\Program Files (x86)\Protected Search
C:\Program Files (x86)\Red Sky
C:\Program Files (x86)\SearchProtect
C:\Program Files (x86)\SupTab
C:\Program Files (x86)\WebSearch
C:\Program Files (x86)\Common Files\Umbrella
C:\ProgramData\IePluginService
C:\ProgramData\Iminent
C:\ProgramData\InstallMate
C:\ProgramData\SafetyNut
C:\ProgramData\VisualBee
C:\ProgramData\WindowsMangerProtect
C:\ProgramData\WPM
C:\Users\Marine\AppData\Roaming\337Games
C:\Users\Marine\AppData\Roaming\Browser Tab Search by Ask
C:\Users\Marine\AppData\Roaming\Desk 365
C:\Users\Marine\AppData\Roaming\Iminent
C:\Users\Marine\AppData\Roaming\iSafe
C:\Users\Marine\AppData\Roaming\istart123
C:\Users\Marine\AppData\Roaming\Nosibay
C:\Users\Marine\AppData\Roaming\PC Speed Maximizer
C:\Users\Marine\AppData\Roaming\SupTab
C:\Users\Marine\AppData\Roaming\sweet-page
C:\Users\Marine\AppData\Roaming\VOPackage
C:\Users\Marine\AppData\Local\DownTango
C:\Users\Marine\AppData\Local\eojet
C:\Users\Marine\AppData\Local\fst_fr_304
C:\Users\Marine\AppData\Local\Giant Savings Extension
C:\Users\Marine\AppData\Local\Ilivid Player
C:\Users\Marine\AppData\Local\Mobogenie
C:\Users\Marine\AppData\Local\SearchProtect
C:\Users\Marine\AppData\Local\SwvUpdater
C:\Users\Marine\AppData\Local\VisualBeeClient
C:\Users\Marine\AppData\Local\VisualBeeExe
C:\Users\Marine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\337Games
C:\Users\Marine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup
C:\Users\Marine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
C:\Users\Marine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
O44 - LFC:[MD5.06E764F93D5285D44F1B399EC0327802] - 09/07/2014 - 15:34:20 ---A- . (.StdLib - StdLib.) -- C:\Windows\System32\Drivers\{5178f938-0bd5-47c1-8242-71f6e3e72925}Gw64.sys [61120]
O44 - LFC:[MD5.8FCAE39A4959F802C05A565D2ED84BDA] - 18/07/2014 - 05:01:14 ---A- . (.StdLib - StdLib.) -- C:\Windows\System32\Drivers\{55dce8ba-9dec-4013-937e-adbf9317d990}Gw64.sys [61120]
O45 - LFCP:[MD5.3212A5CA1EBE3CFB03CA260CC5505D86] - 22/07/2014 - 12:07:10 ---A- - C:\Windows\Prefetch\ANYPROTECT.EXE-1996592C.pf
O45 - LFCP:[MD5.3EA84391B6532AC505AADA6D772FF551] - 22/07/2014 - 17:27:05 ---A- - C:\Windows\Prefetch\DEEAL_FR 0.2-CHROMEINSTALLER.-52F21AAA.pf
O45 - LFCP:[MD5.9D8A1C79D2138A8E1D52C9B1F4844256] - 22/07/2014 - 10:55:00 ---A- - C:\Windows\Prefetch\DEEAL_FR 0.2-CODEDOWNLOADER.E-B7C2BE38.pf
O45 - LFCP:[MD5.CDD5836CEF63F8F77935588E4E3DE59D] - 22/07/2014 - 17:26:59 ---A- - C:\Windows\Prefetch\DEEAL_FR 0.2-ENABLER.EXE-CDE842EB.pf
O45 - LFCP:[MD5.A9D3138B91DA57BA6F1D959877164972] - 22/07/2014 - 10:55:01 ---A- - C:\Windows\Prefetch\DEEAL_FR 0.2-FIREFOXINSTALLER-DBA70123.pf
O45 - LFCP:[MD5.ACB93F649EFAE530639276FDA09C27D6] - 22/07/2014 - 17:27:40 ---A- - C:\Windows\Prefetch\PCSPEEDMAXIMIZER.EXE-50818875.pf
O45 - LFCP:[MD5.DC547A85D892D72762AD67A4AEC39FA7] - 22/07/2014 - 17:30:17 ---A- - C:\Windows\Prefetch\UPFST_FR_304.EXE-7EC51AD4.pf
O58 - SDL:09/07/2014 - 15:34:20 ---A- . (.StdLib - StdLib.) -- C:\Windows\System32\Drivers\{5178f938-0bd5-47c1-8242-71f6e3e72925}Gw64.sys [61120]
O58 - SDL:18/07/2014 - 05:01:14 ---A- . (.StdLib - StdLib.) -- C:\Windows\System32\Drivers\{55dce8ba-9dec-4013-937e-adbf9317d990}Gw64.sys [61120]
O61 - LFC: 15/07/2014 - 18:34:55 ----- . (...) -- C:\Users\Marine\AppData\Local\Temp\is45637729\1152688_stp\July15_www.sweet-page.com.exe [586832]
O61 - LFC: 15/07/2014 - 18:34:56 ---A- . (.Skytech Co., Ltd..) -- C:\Users\Marine\AppData\Roaming\istart123\UninstallManager.exe [1856512]
O61 - LFC: 15/07/2014 - 18:34:56 ---A- . (.Skytech Co., Ltd..) -- C:\Users\Marine\AppData\Roaming\sweet-page\UninstallManager.exe [1856512]
O61 - LFC: 16/07/2014 - 18:34:54 ---A- . (.ClickMeIn Limited.) -- C:\Users\Marine\AppData\Local\AnyProtectScannerSetup.exe [573339]
O61 - LFC: 16/07/2014 - 18:34:55 ----- . (.ClickMeIn Limited.) -- C:\Users\Marine\AppData\Local\Temp\is45637729\1152400_stp\AnyProtectScannerSetup.exe [573339]
O61 - LFC: 16/07/2014 - 18:34:55 ----- . (.ClickMeIn Limited.) -- C:\Users\Marine\AppData\Local\Temp\is45637729\2351115_stp\AnyProtectScannerSetup.exe [573339]
O61 - LFC: 16/07/2014 - 18:34:55 ----- . (.ClickMeIn Limited.) -- C:\Users\Marine\AppData\Local\Temp\is45637729\288471_stp\AnyProtectScannerSetup.exe [573339]
O61 - LFC: 16/07/2014 - 18:34:55 ----- . (.ClickMeIn Limited.) -- C:\Users\Marine\AppData\Local\Temp\is45637729\3575736_stp\AnyProtectScannerSetup.exe [573339]
O61 - LFC: 16/07/2014 - 18:34:55 ----- . (.ClickMeIn Limited.) -- C:\Users\Marine\AppData\Local\Temp\is45637729\4781035_stp\AnyProtectScannerSetup.exe [573339]
O61 - LFC: 17/07/2014 - 18:34:54 ---A- . (...) -- C:\Users\Marine\AppData\Local\fst_fr_304\upfst_fr_304.exe [3321312]
O61 - LFC: 18/07/2014 - 18:34:54 ---A- . (...) -- C:\Users\Marine\AppData\Local\Temp\17Ftmp\freesofttoday.exe [3300288]
O61 - LFC: 18/07/2014 - 18:34:55 ---A- . (...) -- C:\Users\Marine\AppData\Local\Temp\1EEtmp\vopackage.exe [289500]
O61 - LFC: 18/07/2014 - 18:34:56 ---A- . (...) -- C:\Users\Marine\AppData\Roaming\VOPackage\Uninstall.exe [118593]
O61 - LFC: 18/07/2014 - 18:34:56 ---A- . (...) -- C:\Users\Marine\AppData\Roaming\VOPackage\VOPackage.exe [289500]
O61 - LFC: 18/07/2014 - 18:34:56 ---A- . (...) -- C:\Users\Marine\AppData\Roaming\VOPackage\VOsrv.exe [71168]
O61 - LFC: 18/07/2014 - 18:34:56 ---A- . (...) -- C:\Users\Marine\AppData\Roaming\VOPackage\runasu.exe [48640]
O61 - LFC: 22/07/2014 - 18:34:54 ---A- . (.FST.) -- C:\Users\Marine\AppData\Local\fst_fr_304\Download\majfstfr.exe [8364080]
O61 - LFC: 22/07/2014 - 18:34:55 ---A- . (...) -- C:\Users\Marine\AppData\Local\Temp\is-FJB8U.tmp\InstallManagerR.exe [226392]
O64 - Services: CurCS - 03/07/2014 - C:\Program Files (x86)\Browser Tab Search by Ask\SafetyNut\x64\configmgrc2.cfg (F06DEFF2-5B9C-490D-910F-35D3A91196222) .(.SafetyNut Inc - SafetyNut Configuration.) - LEGACY_F06DEFF2-5B9C-490D-910F-35D3A91196222
O64 - Services: CurCS - 09/07/2014 - C:\Windows\System32\drivers\{5178f938-0bd5-47c1-8242-71f6e3e72925}Gw64.sys ({5178f938-0bd5-47c1-8242-71f6e3e72925}Gw64) .(.StdLib - StdLib.) - LEGACY_{5178F938-0BD5-47C1-8242-71F6E3E72925}GW64
O64 - Services: CurCS - 18/07/2014 - C:\Windows\System32\drivers\{55dce8ba-9dec-4013-937e-adbf9317d990}Gw64.sys ({55dce8ba-9dec-4013-937e-adbf9317d990}Gw64) .(.StdLib - StdLib.) - LEGACY_{55DCE8BA-9DEC-4013-937E-ADBF9317D990}GW64
O69 - SBI: prefs.js [Marine - rn37akus.default] user_pref("CT3242339.http___pricegong_conduitapps_com_v4.APP_WIN_FEATURES.enc", "cmVzaXphYmxlPTAsc2F2ZWxvY2F0aW9uPTAsb3BlbnBvc2l0a[...]
O69 - SBI: prefs.js [Marine - rn37akus.default] user_pref("Smartbar.ConduitHomepagesList", "http://search.conduit.com/?ctid=CT3242339&SearchSource=13&CUI=UN40641441752689483");
O69 - SBI: prefs.js [Marine - rn37akus.default] user_pref("Smartbar.ConduitSearchEngineList", "");
O69 - SBI: prefs.js [Marine - rn37akus.default] user_pref("Smartbar.ConduitSearchUrlList", "");
O69 - SBI: prefs.js [Marine - rn37akus.default] user_pref("extensions.crossrider.bic", "14373046d7214d2e0165a8fd82ed2625");
O69 - SBI: prefs.js [Marine - rn37akus.default] user_pref("extensions.crossriderapp21810.adsOldValue", -1);
O69 - SBI: prefs.js [Marine - rn37akus.default] user_pref("smartbar.conduitHomepageList", "http://search.conduit.com/?ctid=CT3242339&SearchSource=13&CUI=UN40641441752689483");
O69 - SBI: prefs.js [Marine - rn37akus.default] user_pref("smartbar.conduitSearchAddressUrlList", "http://search.conduit.com/ResultsExt.aspx?ctid=CT3242339&SearchSource=2&CUI=UN4[...]
O69 - SBI: SearchScopes [HKCU] {006ee092-9658-4fd6-bd8e-a21a348e59f5} - (Web Search) - http://feed.helperbar.com
O69 - SBI: SearchScopes [HKCU] {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} [DefaultScope] - (Trovi search) - http://www.trovi.com
O69 - SBI: SearchScopes [HKCU] {33BB0A4E-99AF-4226-BDF6-49120163DE86} - (sweet-page) - http://www.sweet-page.com
O69 - SBI: SearchScopes [HKCR] {afdbddaa-5d3f-42ee-b79c-185a7020515b} - (Web Search) - http://search.certified-toolbar.com
O87 - FAEL: "{880ED531-61FC-4296-91FA-24B2A7497AB0}" | In - None - P17 - TRUE | .(.Simplygen - ProtectedSearch.) -- C:\Program Files (x86)\Protected Search\ProtectedSearch.exe
O87 - FAEL: "{B36B002B-154F-4481-AAB1-0A002F3F0D06}" | Out - None - P17 - TRUE | .(.Simplygen - ProtectedSearch.) -- C:\Program Files (x86)\Protected Search\ProtectedSearch.exe
O87 - FAEL: "{FB7D26CB-5552-4ABF-9639-3CA759F1BB25}" | In - None - P17 - TRUE | .(.Simplygen - ProtectedSearch.) -- C:\Program Files (x86)\Protected Search\ProtectedSearch.exe
O87 - FAEL: "{68638E71-13E4-473B-9576-97B22233AA39}" | Out - None - P17 - TRUE | .(.Simplygen - ProtectedSearch.) -- C:\Program Files (x86)\Protected Search\ProtectedSearch.exe
O87 - FAEL: "{0D672B4E-D526-49E9-80A0-F4B3940062D0}" | In - None - P17 - TRUE | .(.Simplygen - ProtectedSearch.) -- C:\Program Files (x86)\Protected Search\ProtectedSearch.exe
O87 - FAEL: "{BB05D016-0B4F-4E08-B14A-27AFC32E0434}" | Out - None - P17 - TRUE | .(.Simplygen - ProtectedSearch.) -- C:\Program Files (x86)\Protected Search\ProtectedSearch.exe
O87 - FAEL: "{A7DF63F3-4332-4D5E-9D0C-7F24FC0B6000}" | In - None - P17 - TRUE | .(.Simplygen - ProtectedSearch.) -- C:\Program Files (x86)\Protected Search\ProtectedSearch.exe
O87 - FAEL: "{92A0BD44-C192-448B-9397-F33CA848DEBE}" | Out - None - P17 - TRUE | .(.Simplygen - ProtectedSearch.) -- C:\Program Files (x86)\Protected Search\ProtectedSearch.exe
O90 - PUC: "3DA786FCDC08E1345AF052DDF8C9693C" . (.Iminent.) -- C:\Windows\Installer\{CF687AD3-80CD-431E-A50F-25DD8F9C96C3}\imbooster.ico
HKLM\SOFTWARE\Microsoft\Tracing\BackupStack_RASAPI32
HKLM\SOFTWARE\Microsoft\Tracing\BackupStack_RASMANCS
HKLM\SOFTWARE\Microsoft\Tracing\InstTracker_RASAPI32
HKLM\SOFTWARE\Microsoft\Tracing\InstTracker_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BearShareMediaBar_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BearShareMediaBar_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BearShare_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BearShare_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BearShare_V10_fr_Setup_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\BearShare_V10_fr_Setup_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\conduitinstaller_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\conduitinstaller_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\datamngrUI_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\datamngrUI_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\eojet_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\eojet_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\eorezo_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\eorezo_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\giant savings extension-bg_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\giant savings extension-bg_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Giant Savings Extension-InternalInstaller_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Giant Savings Extension-InternalInstaller_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Giant Savings Extension_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Giant Savings Extension_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\iLividSetupV1[1]_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\iLividSetupV1[1]_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Iminent_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Iminent_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\ProtectedSearch_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\ProtectedSearch_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Searchqu Toolbar uninstall_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Searchqu Toolbar uninstall_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SearchquMediaBar_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SearchquMediaBar_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Smartbar_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\Smartbar_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\updateBrowsebeyond_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\updateBrowsebeyond_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\updateGreyGray_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\updateGreyGray_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\vbmz10_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\vbmz10_RASMANCS
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\VisualBeeSilent_RASAPI32
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\VisualBeeSilent_RASMANCS
[HKCR\CLSID\{11111111-1111-1111-1111-110411391160}] (Deeal_fr 0.2)
[HKCR\CLSID\{22222222-2222-2222-2222-220422392260}] (CrossriderApp0043960.Sandbox)
[HKCR\CLSID\{22222222-2222-2222-2222-220622032246}] (CrossriderApp0060346.Sandbox)
[HKCR\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}] (Yahoo Community Smartbar (by Linkury)Engine)
[HKCR\CLSID\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}] (SafetyNut)
[HKCR\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}] (Yahoo Community Smartbar (by Linkury))
[HKCR\CLSID\{B939CF93-F2CB-443d-956C-DC523D85C9DB}] (DataMngr)
SS - | Auto 19/09/2013 38440 | (BackupStack) . (.Just Develop It.) - C:\Program Files (x86)\MyPC Backup\BackupStack.exe
SR - | Auto 16/07/2014 2682152 | (CltMngSvc) . (.Client Connect LTD.) - C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe
SR - | System 03/07/2014 42064 | (F06DEFF2-5B9C-490D-910F-35D3A91196222) . (.SafetyNut Inc.) - C:\Program Files (x86)\Browser Tab Search by Ask\SafetyNut\x64\configmgrc2.cfg
SR - | Auto 11/04/2014 705136 | (IePluginService) . (.Cherished Technololgy LIMITED.) - C:\ProgramData\IePluginService\PluginService.exe
SR - | Auto 18/07/2014 71168 | (servervo) . (...) - C:\Users\Marine\AppData\Roaming\VOPackage\VOsrv.exe
SR - | Auto 18/07/2014 535936 | (WindowsMangerProtect) . (.Fuyu LIMITED.) - C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
SR - | Auto 05/03/2014 510608 | (Wpm) . (.Cherished Technololgy LIMITED.) - C:\ProgramData\WPM\wprotectmanager.exe
[HKLM\Software\Google\Chrome\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl]
[HKLM\Software\Google\Chrome\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok]
[HKLM\Software\Google\Chrome\Extensions\booedmolknjekdopkepjjeckmjkdpfgl]
[HKLM\Software\Google\Chrome\Extensions\dhdppnagkklahjmblgdojadgbiffhejd]
[HKLM\Software\Google\Chrome\Extensions\flpcjncodpafbgdpnkljologafpionhb]
[HKLM\Software\Google\Chrome\Extensions\halffneccaebicfdfajnbfgpglahfgoe]
[HKLM\Software\Google\Chrome\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo]
[HKLM\Software\Google\Chrome\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo]
[HKLM\Software\Google\Chrome\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611031146}]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B939CF93-F2CB-443D-956C-DC523D85C9DB}]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110411391160}]
[HKLM\SYSTEM\CurrentControlSet\Services\MyPC Backup) (BackupStack]
[HKLM\SYSTEM\CurrentControlSet\Services\CltMngSvc]
[HKLM\SYSTEM\CurrentControlSet\Services\F06DEFF2-5B9C-490D-910F-35D3A91196222]
[HKLM\SYSTEM\CurrentControlSet\Services\IePluginService]
[HKLM\SYSTEM\CurrentControlSet\Services\servervo]
[HKLM\SYSTEM\CurrentControlSet\Services\WindowsMangerProtect]
[HKLM\SYSTEM\CurrentControlSet\Services\Wpm]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\AnyProtect]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Browsebeyond]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Browser Tab Search by Ask_Chrome]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Deeal_fr 0.2]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\fst_fr_304_is1]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\GreyGray]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{CF687AD3-80CD-431E-A50F-25DD8F9C96C3}]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\MyPC Backup]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PC Speed Maximizer_is1]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PriceGong]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Protected Search_is1]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\SupTab]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\VisualBee for Microsoft PowerPoint]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\WindowsMangerProtect]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\eoJet_is1]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\sweet-page uninstall]
[HKLM\Software\Classes\AppID\{01994268-3C10-4044-A1EA-7A9C1B739A11}]
[HKLM\Software\Wow6432Node\Classes\AppID\{01994268-3C10-4044-A1EA-7A9C1B739A11}]
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}]
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}]
[HKLM\Software\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}]
[HKLM\Software\Wow6432Node\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}]
[HKLM\Software\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}]
[HKLM\Software\Wow6432Node\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}]
[HKLM\Software\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}]
[HKLM\Software\Wow6432Node\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}]
[HKLM\Software\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}]
[HKLM\Software\Wow6432Node\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}]
[HKLM\Software\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}]
[HKLM\Software\Wow6432Node\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}]
[HKLM\Software\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}]
[HKLM\Software\Wow6432Node\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}]
[HKLM\Software\Classes\TypeLib\{18AF7201-4F14-4BCF-93FE-45617CF259FF}]
[HKLM\Software\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}]
[HKLM\Software\Wow6432Node\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}]
[HKLM\Software\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}]
[HKLM\Software\Wow6432Node\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}]
[HKLM\Software\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}]
[HKLM\Software\Wow6432Node\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}]
[HKLM\Software\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}]
[HKLM\Software\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}]
[HKLM\Software\Wow6432Node\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}]
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}]
[HKLM\Software\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}]
[HKLM\Software\Wow6432Node\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}]
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
[HKLM\Software\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}]
[HKLM\Software\Wow6432Node\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}]
[HKLM\Software\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}]
[HKLM\Software\Wow6432Node\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}]
[HKLM\Software\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}]
[HKLM\Software\Wow6432Node\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}]
[HKLM\Software\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}]
[HKLM\Software\Wow6432Node\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}]
[HKLM\Software\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}]
[HKLM\Software\Wow6432Node\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}]
[HKLM\Software\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}]
[HKLM\Software\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}]
[HKLM\Software\Wow6432Node\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}]
[HKLM\Software\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}]
[HKLM\Software\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}]
[HKLM\Software\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}]
[HKLM\Software\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}]
[HKLM\Software\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}]
[HKLM\Software\Wow6432Node\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}]
[HKLM\Software\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}]
[HKLM\Software\Wow6432Node\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}]
[HKLM\Software\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}]
[HKLM\Software\Wow6432Node\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}]
[HKLM\Software\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}]
[HKLM\Software\Wow6432Node\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}]
[HKLM\Software\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}]
[HKLM\Software\Wow6432Node\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}]
[HKLM\Software\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}]
[HKLM\Software\Wow6432Node\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}]
[HKLM\Software\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}]
[HKLM\Software\Wow6432Node\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}]
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}]
[HKLM\Software\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}]
[HKLM\Software\Wow6432Node\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}]
[HKLM\Software\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}]
[HKLM\Software\Classes\CLSID\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}]
[HKLM\Software\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}]
[HKLM\Software\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}]
[HKLM\Software\Wow6432Node\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}]
[HKLM\Software\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}]
[HKLM\Software\Wow6432Node\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}]
[HKLM\Software\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}]
[HKLM\Software\Wow6432Node\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{ae07101b-46d4-4a98-af68-0333ea26e113}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{ae07101b-46d4-4a98-af68-0333ea26e113}]
[HKLM\Software\Classes\CLSID\{ae07101b-46d4-4a98-af68-0333ea26e113}]
[HKLM\Software\Classes\AppID\{AFBB7970-789A-4264-BA70-E8127DECE400}]
[HKLM\Software\Wow6432Node\Classes\AppID\{AFBB7970-789A-4264-BA70-E8127DECE400}]
[HKLM\Software\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}]
[HKLM\Software\Wow6432Node\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}]
[HKLM\Software\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}]
[HKLM\Software\Wow6432Node\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}]
[HKLM\Software\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}]
[HKLM\Software\Wow6432Node\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}]
[HKLM\Software\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}]
[HKLM\Software\Classes\Interface\{C58D664A-3DBC-4925-AE74-0382007DF113}]
[HKLM\Software\Classes\Interface\{C776D7F4-BA85-4B75-AAFC-3A0A11FE6E36}]
[HKLM\Software\Wow6432Node\Classes\Interface\{C776D7F4-BA85-4B75-AAFC-3A0A11FE6E36}]
[HKLM\Software\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}]
[HKLM\Software\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}]
[HKLM\Software\Wow6432Node\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}]
[HKLM\Software\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}]
[HKLM\Software\Wow6432Node\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}]
[HKLM\Software\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}]
[HKLM\Software\Wow6432Node\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}]
[HKLM\Software\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}]
[HKLM\Software\Wow6432Node\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}]
[HKLM\Software\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}]
[HKLM\Software\Wow6432Node\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}]
[HKLM\Software\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}]
[HKLM\Software\Wow6432Node\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}]
[HKLM\Software\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}]
[HKLM\Software\Wow6432Node\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}]
[HKLM\Software\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}]
[HKLM\Software\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}]
[HKLM\Software\Wow6432Node\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}]
[HKLM\Software\Classes\Interface\{DF76E9B7-35EC-46FC-AF56-5B79DED9D64F}]
[HKLM\Software\Wow6432Node\Classes\Interface\{DF76E9B7-35EC-46FC-AF56-5B79DED9D64F}]
[HKLM\Software\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}]
[HKLM\Software\Wow6432Node\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}]
[HKLM\Software\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}]
[HKLM\Software\Wow6432Node\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}]
[HKLM\Software\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}]
[HKLM\Software\Wow6432Node\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}]
[HKLM\Software\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}]
[HKLM\Software\Wow6432Node\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}]
[HKLM\Software\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}]
[HKLM\Software\Wow6432Node\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}]
[HKLM\Software\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}]
[HKLM\Software\Wow6432Node\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}]
[HKLM\Software\Classes\AppID\BrowserConnection.dll]
[HKLM\Software\Classes\AppID\eoenginebho.dll]
[HKLM\Software\Classes\BrowserConnection.Loader]
[HKLM\Software\Classes\BrowserConnection.Loader.1]
[HKLM\Software\Classes\SearchQUIEHelper.DNSGuard]
[HKLM\Software\Classes\SearchQUIEHelper.DNSGuard.1]
[HKLM\Software\Wow6432Node\Google\Chrome\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok]
[HKLM\Software\Wow6432Node\Microsoft\Tracing\Iminent_RASAPI32]
[HKLM\Software\Wow6432Node\Microsoft\Tracing\Iminent_RASMANCS]
[HKLM\Software\Wow6432Node\Microsoft\Tracing\Searchqu Toolbar uninstall_RASAPI32]
[HKLM\Software\Wow6432Node\Microsoft\Tracing\Searchqu Toolbar uninstall_RASMANCS]
[HKLM\Software\Wow6432Node\Microsoft\Tracing\SearchquMediaBar_RASAPI32]
[HKLM\Software\Wow6432Node\Microsoft\Tracing\SearchquMediaBar_RASMANCS]
[HKLM\Software\Wow6432Node\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32]
[HKLM\Software\Wow6432Node\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS]
[HKLM\Software\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}]
[HKLM\Software\Wow6432Node\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}]
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP]
[HKLM\Software\Classes\Interface\{8DA8B89E-0C65-403B-8231-AB22ECFA0687}]
[HKLM\Software\Classes\Interface\{A928E66C-F501-4E66-9953-855C712F93B2}]
[HKLM\Software\Classes\Interface\{B0E28FA0-DF07-44B6-95CE-48BE26DB9266}]
[HKLM\Software\Classes\Interface\{E6B4EE8F-C38E-4994-BE28-229A3F92262C}]
[HKLM\Software\Classes\Interface\{FCA8936E-403A-4487-A966-70F80F1D5A6A}]
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\eoJet_is1]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5]
[HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\desksvc]
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Protected Search_is1]
[HKCU\Software\InstalledBrowserExtensions\]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F1057DD419AED0B468AD8888429E139A]
[HKLM\Software\Wow6432Node\Google\Chrome\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo]
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6E47D688-85EC-465A-9946-EC58220F14FC}]
[HKLM\Software\Classes\CrossriderApp0060346.BHO]
[HKLM\Software\Classes\CrossriderApp0060346.BHO.1]
[HKLM\Software\Classes\CrossriderApp0060346.Sandbox]
[HKLM\Software\Classes\CrossriderApp0060346.Sandbox.1]
[HKLM\Software\Classes\iminent]
[HKLM\Software\Classes\CLSID\{11111111-1111-1111-1111-110411391160}]
[HKLM\Software\Classes\CLSID\{11111111-1111-1111-1111-110611031146}]
[HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220422392260}]
[HKLM\Software\Classes\CLSID\{22222222-2222-2222-2222-220622032246}]
[HKLM\Software\Wow6432Node\Classes\CrossriderApp0060346.BHO]
[HKLM\Software\Wow6432Node\Classes\CrossriderApp0060346.BHO.1]
[HKLM\Software\Wow6432Node\Classes\CrossriderApp0060346.Sandbox]
[HKLM\Software\Wow6432Node\Classes\CrossriderApp0060346.Sandbox.1]
[HKLM\Software\Wow6432Node\Classes\iminent]
[HKLM\Software\Wow6432Node\Classes\SearchQUIEHelper.DNSGuard]
[HKLM\Software\Wow6432Node\Classes\SearchQUIEHelper.DNSGuard.1]
[HKLM\Software\Wow6432Node\Classes\CLSID\{11111111-1111-1111-1111-110611031146}]
[HKLM\Software\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220222182210}]
[HKLM\Software\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220422392260}]
[HKLM\Software\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220622032246}]
[HKLM\Software\Wow6432Node\Classes\AppID\EoEngineBHO.DLL]
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611031146}]
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD22}]
[HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2488}]
[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{ae07101b-46d4-4a98-af68-0333ea26e113}
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:mobilegeni daemon
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]:upfst_fr_304.exe
C:\Users\Marine\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl
C:\Users\Marine\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok
C:\Users\Marine\AppData\Local\Google\Chrome\User Data\Default\Extensions\booedmolknjekdopkepjjeckmjkdpfgl
C:\Users\Marine\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdppnagkklahjmblgdojadgbiffhejd
C:\Users\Marine\AppData\Local\Google\Chrome\User Data\Default\Extensions\flpcjncodpafbgdpnkljologafpionhb
C:\Users\Marine\AppData\Local\Google\Chrome\User Data\Default\Extensions\halffneccaebicfdfajnbfgpglahfgoe
C:\Users\Marine\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo
C:\Users\Marine\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo
C:\Users\Marine\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PriceGong
C:\Users\Marine\AppData\LocalLow\DownTangoFTToolbar
C:\Users\Marine\AppData\Local\Temp\Smartbar
C:\Users\Marine\AppData\Local\Temp\Desk365
C:\Users\Marine\AppData\Roaming\Mozilla\Firefox\Profiles\rn37akus.default\Smartbar
C:\Users\Marine\AppData\Local\fst_fr_304\upfst_fr_304.exe
C:\Program Files (x86)\PC Speed Maximizer\PCSpeedMaximizer.exe
C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe
C:\Program Files (x86)\PC Speed Maximizer\SPMSmartScan.exe
C:\Users\Marine\AppData\Local\fst_fr_304\Download\majfstfr.exe
C:\Users\Marine\AppData\Local\Temp\is-FJB8U.tmp\InstallManagerR.exe
C:\ProgramData\IePluginService\PluginService.exe
C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
C:\ProgramData\WPM\wprotectmanager.exe
C:\Users\Marine\AppData\Roaming\VOPackage\VOsrv.exe
C:\Program Files (x86)\Deeal_fr 0.2\Deeal_fr 0.2-chromeinstaller.exe
C:\Program Files (x86)\Deeal_fr 0.2\Deeal_fr 0.2-codedownloader.exe
C:\Program Files (x86)\Deeal_fr 0.2\Deeal_fr 0.2-enabler.exe
C:\Program Files (x86)\Deeal_fr 0.2\Deeal_fr 0.2-firefoxinstaller.exe
C:\Program Files (x86)\PC Speed Maximizer\SPMLauncher.exe
C:\Program Files (x86)\Protected Search\ProtectedSearch.exe
C:\Windows\Tasks\APSnotifierPP1.job
C:\Windows\System32\Tasks\APSnotifierPP1
C:\Windows\Tasks\APSnotifierPP2.job
C:\Windows\System32\Tasks\APSnotifierPP2
C:\Windows\Tasks\APSnotifierPP3.job
C:\Windows\System32\Tasks\APSnotifierPP3
C:\Windows\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-1.job
C:\Windows\System32\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-1
C:\Windows\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-2.job
C:\Windows\System32\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-2
C:\Windows\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-3.job
C:\Windows\System32\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-3
C:\Windows\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-4.job
C:\Windows\System32\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-4
C:\Windows\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-5.job
C:\Windows\System32\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-5
C:\Windows\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-6.job
C:\Windows\System32\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-6
C:\Windows\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-7.job
C:\Windows\System32\Tasks\be1f9fff-c717-4ce9-8574-a7629575b77a-7
C:\Windows\Tasks\Dealply.job
C:\Windows\System32\Tasks\Dealply
C:\Windows\Tasks\Deeal_fr 0.2-chromeinstaller.job
C:\Windows\System32\Tasks\Deeal_fr 0.2-chromeinstaller
C:\Windows\Tasks\Deeal_fr 0.2-codedownloader.job
C:\Windows\System32\Tasks\Deeal_fr 0.2-codedownloader
C:\Windows\Tasks\Deeal_fr 0.2-enabler.job
C:\Windows\System32\Tasks\Deeal_fr 0.2-enabler
C:\Windows\Tasks\Deeal_fr 0.2-firefoxinstaller.job
C:\Windows\System32\Tasks\Deeal_fr 0.2-firefoxinstaller

Cliquer sur IMPORTER., cela devrait coller le contenu du presse papier dans la fenêtre ZHPFix.

 

  • Le script doit automatiquement apparaitre dans ZHPFix.

     

    Clique sur le bouton GO pour lancer le nettoyage

 

 

  • Valide par Oui la désinstallation des programmes si demandé.

     

     

  • Laisse l'outil travailler. Si un redémarrage est demandé, accepte et redémarre le PC

     

     

  • Le rapport ZHPFixReport.txt s'affiche. Copie-colle le contenu de ce rapport dans ta réponse.
    Le rapport ZHPFixReport.txt est enregistré sous C:\ZHP\ZHPFix.txt

 

Si le Bureau ne réapparaît pas presse Ctrl + Alt + Suppr , Onglet Fichier , Nouvelle tâche , tape explorer.exe et valide.

 

--------------------------------------

2)

*** Si tu as une ancienne version d'AdwCleaner, lance-le et clique sur désinstaller.***

Télécharge AdwCleaner par Xplode: [*]

https://toolslib.net/downloads/viewdownload/1-adwcleaner/

Enregistre-le sur le bureau (et pas ailleurs).

Afin de ne pas fausser le rapport, ne passer l'outil qu'une seule fois svp!

Si tu es sous XP double clique sur AdwCleaner pour lancer l'outil.
Si tu es sous Vista/Seven, clique droit sur AdwCleaner et choisis exécuter en temps qu'administrateur.

Clique sur Scanner et laisse travailler l'outil.

Cliquer sur Nettoyer , le bouton sera accessible.

Le rapport va s'ouvrir en fichier texte; copie la totalité de son contenu et colle-le dans ta réponse.

Le rapport est en outre sauvegardé sous C:\AdwCleaner[s0]

NB: Si l'outil "cale" en mode normal, le lancer en mode sans échec: http://www.vista-xp.fr/forum/topic93.html

A lire absolument: http://www.vista-xp.fr/forum/topic5482.html
http://www.vista-xp.fr/forum/topic10389.html

-------------------------

 

3)

Télécharge Junkware Removal Tool sur le bureau: http://www.bleepingcomputer.com/download/junkware-removal-tool/

jrt02-4364c79.jpg

>>>Site éditeur: http://thisisudax.org/

Sous XP, double-clique sur l'icône et presse une touche lorsque cela sera demandé.

Sous Vista/7/8, clic droit/exécuter en temps qu'administrateur.

L'outil peut demander si on souhaite vérifier la présence d'une nouvelle version Y/N >> taper Y.
S'il découvre une version obsolète, il le dira et devrez presser une touche. L'outil se fermera. Mettez-le à la corbeille et téléchargez la dernière version.

Renomme JRT_NEW en JRT.

Si c'est déjà la bonne version , il commencera sa recherche de malwares normalement. Patience svp.

Afin de ne pas fausser les rapports, ne passer l'outil qu'une seule fois svp!

Si l'antivirus fait des siennes: désactive-le provisoirement. Si tu ne sais pas comment faire, reporte-toi à cet article.

Poste le rapport généré à la fin de l'analyse.

NB: Le bureau disparaitra un instant, c'est normal.

>>>Si le rapport est long, l'héberger ici: http://cjoint.com ou http://dl.free.fr/

capture1-3bf0deb_zpsf4ca5241.jpg

capture2-3bf0dfa_zps7abd8f5a.jpg

 

@++

Modifié par Apollo
Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

Bonjour,

 

Téléchargez Malwarebytes Anti-Malware et enregistrez-le sur le Bureau.

http://fr.malwarebytes.org/mwb-download/

Faites un double clic sur mbam-setup-2.0.2..exe et suivez les invites pour installer le programme.

A la fin, vérifiez que ces cases sont cochées:

Lancer Malwarebytes Anti-Malware

Un essai gratuit de 14 jours des fonctions de la version Premium est pré-sélectionné. Si vous le désirez, vous pouvez dé-cocher cette case, et cela ne diminuera pas les capacités d'analyse et de suppression du programme.

Examen "Menaces" + Recherche de Rootkits:

Dans l'onglet Paramètres > Sous-onglet Détection et Protection, Options de détection, cochez la case située devant Recherche de Rootkits.

Cliquez sur l'onglet Examen, puis cliquez sur Examiner maintenant >>. Si une mise à jour est disponible, cliquez sur le bouton Mettre à jour maintenant.

Un Examen "Menaces" va démarrer.

Avec certaines infections, vous pouvez voir l'affichage de ce message:

'Malwarebytes n'a pas pu charger le pilote Anti-Rootkit DDA'

Cliquez sur 'Oui' sur ce message, pour permettre le chargement du pilote après un redémarrage.

Laissez l'ordinateur redémarrer. Continuez avec le reste de ces instructions.

Quand l'examen est terminé, click Appliquer les actions.

Attendez l'affichage du message vous invitant à faire redémarrer le PC, puis cliquez sur Oui.

Le rapport de trouve dans l'Historique de MBAM, le prendre après le redémarrage.

Langage:

langage-mbam-45cf7e4.jpg

Cocher recherche rootkits:

mbam-rech-rootkits-45cf7ec.jpg

 

@++

 

  • 3 semaines après...
Apollo Devil Member !

Apollo

Posté(e)
Posté(e)

Bonjour,

 

Aucune action entreprise?

 

Rappel:

Quand l'examen est terminé, click Appliquer les actions.

 

Attendez l'affichage du message vous invitant à faire redémarrer le PC, puis cliquez sur Oui.

 

Le rapport de trouve dans l'Historique de MBAM, le prendre après le redémarrage.

 

@++

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

×
 Partager
Aller sur la liste des sujets

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...