Ad by TV Wizard

[Roxy CH]

Bonjour,

Malgré le nettoyage avec Adw cleaner, mon pc reste infecté : très lent et ouverture intempestive de pages " Ad by TV Wizard ".
J'ai fait un scan avec Farbar Recovery Scan Tool (FRST) et j'ai enregistré les liens sur http://pjjoint.malekal.com

Qui aurait la gentillesse de m'aider s'il vous plait pour suivre la procédure de désinfection de mon PC?
Merci d'avance!

[Roxy CH]

Voici les liens

 http://pjjoint.malekal.com/files.php?id ... 9j7n6n7s14
http://pjjoint.malekal.com/files.php?id ... k10s9q9e10
http://pjjoint.malekal.com/files.php?id ... o9w156h5z9
http://pjjoint.malekal.com/files.php?id ... 15c5z6f9v8

[angelique]

• Ouvre le bloc-notes : Menu Démarrer / Tous les programmes / Accessoires et Bloc-Notes. (ou executer---> notepad)
  Copie/colle dedans ce qui suit :
  
  

  R2 ybSBeyXMSxn; C:\ProgramData\mTftZvblTaH\ybSBeyXMSxn.exe [2726256 2015-01-08] (Small Island Development)
  Task: {A4BDDACD-5988-4C96-99DE-C51FFEEC4E1A} - System32\Tasks\{A812A8AD-DBD2-4DA8-A027-0275998F15E1} => pcalua.exe -a C:\Users\Roxy\AppData\Roaming\omiga-plus\UninstallManager.exe -c -ptid=tugs <==== ATTENTION
  Task: {B97C2784-8801-4089-A293-079CAEF229BC} - System32\Tasks\{DF7EF6A0-0FC0-47CD-82F4-F1FE87F7D286} => pcalua.exe -a C:\ProgramData\TVWizard\uninstall.exe -c /kb=y /ic=1 <==== ATTENTION
  HKLM-x32\...\Run: [Denzi] => C:\Program Files (x86)\Denzi\Launcher.bat --wait
  HKLM-x32\...\Run: [gmsd_fr_70] => [X]
  CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
  CHR StartupUrls: Default -> "hxxp://www.delta-search.com/?affID=119370&tt=1 ... B70DC0A694", "hxxp://isearch.omiga-plus.com/?type=hp&ts=1420732721&from=tugs&uid=WDCXWD5000BPVT-22A1YT0_WD-WX81CC1A4224A4224"
  CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
  2015-03-01 21:44 - 2015-03-01 21:44 - 00003226 _____ () C:\Windows\System32\Tasks\{B4E33B47-18EB-4938-A80A-C2EB27471B4F}
  2015-03-01 20:43 - 2015-03-01 20:43 - 00000000 ____D () C:\Users\Roxy\AppData\Roaming\YDP
  2015-03-01 20:29 - 2015-03-01 20:29 - 00000000 ____D () C:\Users\Roxy\Downloads\9782091726489
  2015-02-27 21:45 - 2015-02-27 21:45 - 00038817 _____ () C:\Users\Roxy\Downloads\6821.tmp
  2015-02-26 14:11 - 2015-02-26 14:13 - 00504112 _____ () C:\Users\Roxy\Downloads\cacaoweb (3).exe
  2015-02-15 19:17 - 2015-02-15 19:18 - 00504112 _____ () C:\Users\Roxy\Downloads\cacaoweb (2).exe
  2015-01-13 22:24 - 2015-01-13 22:24 - 00504112 _____ () C:\Users\Roxy\Downloads\cacaoweb.exe
  2015-01-08 17:49 - 2015-01-08 17:49 - 00003142 _____ () C:\Windows\System32\Tasks\{A812A8AD-DBD2-4DA8-A027-0275998F15E1}
  2015-01-08 17:40 - 2015-01-08 17:40 - 00003094 _____ () C:\Windows\System32\Tasks\{DF7EF6A0-0FC0-47CD-82F4-F1FE87F7D286}
  2015-01-08 17:40 - 2015-01-08 17:40 - 00000000 ____D () C:\ProgramData\2355320829
  2015-01-08 16:59 - 2015-01-08 16:59 - 00000000 ____D () C:\ProgramData\mTftZvblTaH
  2015-01-08 16:58 - 2015-01-08 17:52 - 00000000 ____D () C:\Program Files (x86)\gmsd_fr_70
  C:\Users\Roxy\AppData\Local\Temp\BackupSetup.exe
  C:\Users\Roxy\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpgdf_hh.dll
  C:\Users\Roxy\AppData\Local\Temp\EpsonInkjetDriverDownloader.EXE
  C:\Users\Roxy\AppData\Local\Temp\MSETUP4.EXE
  C:\Users\Roxy\AppData\Local\Temp\Quarantine.exe
  C:\Users\Roxy\AppData\Local\Temp\sqlite3.dll
  C:\Users\Roxy\AppData\Local\Temp\supoptsetup.exe
  C:\Users\Roxy\AppData\Local\Temp\s_boy85r.dll
  C:\Users\Roxy\AppData\Local\Temp\uninst1.exe
  C:\Users\Roxy\AppData\Local\Temp\vcredist_x64.exe
  C:\Users\Roxy\AppData\Local\Temp\vlc-2.1.3-win32.exe
  C:\Users\Roxy\AppData\Local\Temp\vlc-2.1.5-win32.exe
  C:\ProgramData\mTftZvblTaH
  EmptyTemp:
  

• Menu Fichier / Enregistrer-sous
  Place toi sur le bureau.
  Dans le champs en bas, nom du fichier mets : fixlist.txt
  Clic sur Enregistrer - cela va créer un fichier fixlist.txt sur le bureau.
• Ferme toutes les applications, y compris ton navigateur
• Double-clique sur FRST.exe
  /!\ Sous Vista, Windows 7 et 8, il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur
  Sur le menu principal, clique une seule fois sur Fix et patiente le temps de la correction
  
  
  Un redémarrage peut être nécessaire (pas obligatoire).
• L'outil va créer un rapport de correction Fixlog.txt. Poste ce rapport dans ta réponse.
• Réinitialise ton navigateur:
  
  Internet Explorer et modules complémentaires / moteurs de recherche : http://forum.malekal.com/
  Firefox : http://forum.malekal.com/firefox-extens ... 36057.html
  Google Chrome : http://forum.malekal.com/google-chrome- ... 35837.html

[Roxy CH]

Merci bcp!
Voici le rapport fixlog.txt:


Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015
Ran by Roxy at 2015-03-21 15:27:34 Run:1
Running from C:\Users\Roxy\Desktop
Loaded Profiles: UpdatusUser & Roxy (Available profiles: UpdatusUser & Roxy)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
R2 ybSBeyXMSxn; C:\ProgramData\mTftZvblTaH\ybSBeyXMSxn.exe [2726256 2015-01-08] (Small Island Development)
Task: {A4BDDACD-5988-4C96-99DE-C51FFEEC4E1A} - System32\Tasks\{A812A8AD-DBD2-4DA8-A027-0275998F15E1} => pcalua.exe -a C:\Users\Roxy\AppData\Roaming\omiga-plus\UninstallManager.exe -c -ptid=tugs <==== ATTENTION
Task: {B97C2784-8801-4089-A293-079CAEF229BC} - System32\Tasks\{DF7EF6A0-0FC0-47CD-82F4-F1FE87F7D286} => pcalua.exe -a C:\ProgramData\TVWizard\uninstall.exe -c /kb=y /ic=1 <==== ATTENTION
HKLM-x32\...\Run: [Denzi] => C:\Program Files (x86)\Denzi\Launcher.bat --wait
HKLM-x32\...\Run: [gmsd_fr_70] => [X]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR StartupUrls: Default -> "hxxp://www.delta-search.com/?affID=119370&tt=1 ... B70DC0A694", "hxxp://isearch.omiga-plus.com/?type=hp&ts=1420732721&from=tugs&uid=WDCXWD5000BPVT-22A1YT0_WD-WX81CC1A4224A4224"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
2015-03-01 21:44 - 2015-03-01 21:44 - 00003226 _____ () C:\Windows\System32\Tasks\{B4E33B47-18EB-4938-A80A-C2EB27471B4F}
2015-03-01 20:43 - 2015-03-01 20:43 - 00000000 ____D () C:\Users\Roxy\AppData\Roaming\YDP
2015-03-01 20:29 - 2015-03-01 20:29 - 00000000 ____D () C:\Users\Roxy\Downloads\9782091726489
2015-02-27 21:45 - 2015-02-27 21:45 - 00038817 _____ () C:\Users\Roxy\Downloads\6821.tmp
2015-02-26 14:11 - 2015-02-26 14:13 - 00504112 _____ () C:\Users\Roxy\Downloads\cacaoweb (3).exe
2015-02-15 19:17 - 2015-02-15 19:18 - 00504112 _____ () C:\Users\Roxy\Downloads\cacaoweb (2).exe
2015-01-13 22:24 - 2015-01-13 22:24 - 00504112 _____ () C:\Users\Roxy\Downloads\cacaoweb.exe
2015-01-08 17:49 - 2015-01-08 17:49 - 00003142 _____ () C:\Windows\System32\Tasks\{A812A8AD-DBD2-4DA8-A027-0275998F15E1}
2015-01-08 17:40 - 2015-01-08 17:40 - 00003094 _____ () C:\Windows\System32\Tasks\{DF7EF6A0-0FC0-47CD-82F4-F1FE87F7D286}
2015-01-08 17:40 - 2015-01-08 17:40 - 00000000 ____D () C:\ProgramData\2355320829
2015-01-08 16:59 - 2015-01-08 16:59 - 00000000 ____D () C:\ProgramData\mTftZvblTaH
2015-01-08 16:58 - 2015-01-08 17:52 - 00000000 ____D () C:\Program Files (x86)\gmsd_fr_70
C:\Users\Roxy\AppData\Local\Temp\BackupSetup.exe
C:\Users\Roxy\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpgdf_hh.dll
C:\Users\Roxy\AppData\Local\Temp\EpsonInkjetDriverDownloader.EXE
C:\Users\Roxy\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Roxy\AppData\Local\Temp\Quarantine.exe
C:\Users\Roxy\AppData\Local\Temp\sqlite3.dll
C:\Users\Roxy\AppData\Local\Temp\supoptsetup.exe
C:\Users\Roxy\AppData\Local\Temp\s_boy85r.dll
C:\Users\Roxy\AppData\Local\Temp\uninst1.exe
C:\Users\Roxy\AppData\Local\Temp\vcredist_x64.exe
C:\Users\Roxy\AppData\Local\Temp\vlc-2.1.3-win32.exe
C:\Users\Roxy\AppData\Local\Temp\vlc-2.1.5-win32.exe
C:\ProgramData\mTftZvblTaH
EmptyTemp:

*****************

ybSBeyXMSxn => Unable to stop service
ybSBeyXMSxn => Service deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A4BDDACD-5988-4C96-99DE-C51FFEEC4E1A}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A4BDDACD-5988-4C96-99DE-C51FFEEC4E1A}" => Key deleted successfully.
C:\Windows\System32\Tasks\{A812A8AD-DBD2-4DA8-A027-0275998F15E1} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{A812A8AD-DBD2-4DA8-A027-0275998F15E1}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B97C2784-8801-4089-A293-079CAEF229BC}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B97C2784-8801-4089-A293-079CAEF229BC}" => Key deleted successfully.
C:\Windows\System32\Tasks\{DF7EF6A0-0FC0-47CD-82F4-F1FE87F7D286} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{DF7EF6A0-0FC0-47CD-82F4-F1FE87F7D286}" => Key deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Denzi => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\gmsd_fr_70 => value deleted successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
Chrome StartupUrls deleted successfully.
Chrome DefaultSuggestURL deleted successfully.
C:\Windows\System32\Tasks\{B4E33B47-18EB-4938-A80A-C2EB27471B4F} => Moved successfully.
C:\Users\Roxy\AppData\Roaming\YDP => Moved successfully.
C:\Users\Roxy\Downloads\9782091726489 => Moved successfully.
C:\Users\Roxy\Downloads\6821.tmp => Moved successfully.
C:\Users\Roxy\Downloads\cacaoweb (3).exe => Moved successfully.
C:\Users\Roxy\Downloads\cacaoweb (2).exe => Moved successfully.
C:\Users\Roxy\Downloads\cacaoweb.exe => Moved successfully.
"C:\Windows\System32\Tasks\{A812A8AD-DBD2-4DA8-A027-0275998F15E1}" => File/Directory not found.
"C:\Windows\System32\Tasks\{DF7EF6A0-0FC0-47CD-82F4-F1FE87F7D286}" => File/Directory not found.
C:\ProgramData\2355320829 => Moved successfully.

"C:\ProgramData\mTftZvblTaH" directory move:

Could not move "C:\ProgramData\mTftZvblTaH" directory. => Scheduled to move on reboot.

C:\Program Files (x86)\gmsd_fr_70 => Moved successfully.
C:\Users\Roxy\AppData\Local\Temp\BackupSetup.exe => Moved successfully.
C:\Users\Roxy\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpgdf_hh.dll => Moved successfully.
C:\Users\Roxy\AppData\Local\Temp\EpsonInkjetDriverDownloader.EXE => Moved successfully.
C:\Users\Roxy\AppData\Local\Temp\MSETUP4.EXE => Moved successfully.
C:\Users\Roxy\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Roxy\AppData\Local\Temp\sqlite3.dll => Moved successfully.
C:\Users\Roxy\AppData\Local\Temp\supoptsetup.exe => Moved successfully.
C:\Users\Roxy\AppData\Local\Temp\s_boy85r.dll => Moved successfully.
C:\Users\Roxy\AppData\Local\Temp\uninst1.exe => Moved successfully.
C:\Users\Roxy\AppData\Local\Temp\vcredist_x64.exe => Moved successfully.
C:\Users\Roxy\AppData\Local\Temp\vlc-2.1.3-win32.exe => Moved successfully.
C:\Users\Roxy\AppData\Local\Temp\vlc-2.1.5-win32.exe => Moved successfully.

"C:\ProgramData\mTftZvblTaH" directory move:

Could not move "C:\ProgramData\mTftZvblTaH" directory. => Scheduled to move on reboot.

EmptyTemp: => Removed 8.4 GB temporary data.

=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2015-03-21 16:54:49)<=

C:\ProgramData\mTftZvblTaH => Is moved successfully.
C:\ProgramData\mTftZvblTaH => Is moved successfully.

==== End of Fixlog 16:54:49 ====

[angelique]

Tu as réinitialisé ton navigateur ?

ça devrait être OK ?


➫ supprime frst.exe, ses rapports et C:\FRST



➫ Quelques conseils :


Pour prévenir les sites malicieux, tu peux installer Blockulicious : http://forum.malekal.com/blockulicious- ... 46656.html


Pour ne plus te faire avoir.
A lire - Programmes parasites / PUPs : https://www.malekal.com/adwares-pup-protection/

[Roxy CH]

Bonjour Angélique,

J'ai bien réinitialisé mon navigateur .
Oui c'est vraiment mieux : je n'ai plus de pages intempestives Ad by TV Wizard.
J'aurai bien voulu que mon PC soit plus rapide (je vais chercher sur le site comment je peux améliorer ce point)
J'ai supprimé les fichiers frst.exe et ses rapports.
Je n'ai pas installé Blockulicious car les avis étaient assez partagés à son sujet.
Par contre, j'ai installé WOT.

Merci beaucoup de ton aide Angélique!
Très bon WE!