etude de scan FRST

[clecle]

Bonjour,

J'ai suivi votre tutoriel pour une desinfection par FRST, je vous transmets les données et vous remercie de votre aide
http://pjjoint.malekal.com/files.php?id ... 8d11f10z10
http://pjjoint.malekal.com/files.php?id ... d7w5n15s12

[angelique]

• Ouvre le bloc-notes : Menu Démarrer / Tous les programmes / Accessoires et Bloc-Notes. (ou executer---> notepad)
  Copie/colle dedans ce qui suit :
  
  

  Task: {7E6AFD42-CF7B-4FCB-AACE-BC32AC82D4A6} - System32\Tasks\HTBUI2eOLEgTCO => C:\Users\Utilisateur\AppData\Roaming\HTBUI2eOLEgTCO.exe <==== ATTENTION
  Task: {F0A68DDF-F70E-4732-B743-2441A17D4820} - System32\Tasks\{C1BF4378-7E8F-4FC3-B6F8-B0E34197E531} => pcalua.exe -a C:\ProgramData\WebShield\uninstall.exe -c /kb=y /ic=1
  Task: {F95DED26-B0E8-4A25-8781-8B8983FD8548} - System32\Tasks\D7ZMShSb2 => C:\Users\Utilisateur\AppData\Roaming\D7ZMShSb2.exe <==== ATTENTION
  Task: {FD62061A-BEF7-4DC1-B404-0EA2FCB52071} - System32\Tasks\Games\UpdateCheck_S-1-5-21-239028553-3652369879-2957087940-1000
  Task: C:\Windows\Tasks\D7ZMShSb2.job => C:\Users\Utilisateur\AppData\Roaming\D7ZMShSb2.exe <==== ATTENTION
  Task: C:\Windows\Tasks\HTBUI2eOLEgTCO.job => C:\Users\Utilisateur\AppData\Roaming\HTBUI2eOLEgTCO.exe <==== ATTENTION
  Task: {C966CC52-8EDE-48C9-832C-AD95CF41A45E} - System32\Tasks\{A1A063D0-9D68-48BA-A223-69D35E66547C} => pcalua.exe -a C:\Users\Utilisateur\AppData\Roaming\oursurfing\UninstallManager.exe -c -ptid=cmi
  HKU\S-1-5-21-239028553-3652369879-2957087940-1000\...\Run: [GoogleChromeAutoLaunch_A030E3BCB07369CBE6F7B214D340EADA] => "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe" --no-startup-window
  Task: {E1A7DC8F-7976-4D6F-A9BD-20D48926EFB4} - System32\Tasks\MixVideoPlayer Update => C:\Program Files (x86)\MixVideoPlayer\mixUpdater.exe
  ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled
  ProxyServer: [.DEFAULT] => http=127.0.0.1:51660;https=127.0.0.1:51660
  R2 gisidypy; C:\Users\Utilisateur\AppData\Roaming\801635B6-1432057616-DE11-8021-B05979046324\jnsh9040.tmp [245760 2015-05-19] () [File not signed]
  R2 WajaWebEnhance Service; C:\Program Files (x86)\WajaWebEnhance\WajaWebEnhance Internet Enhancer\InternetEnhancerService.exe [691200 2015-05-06] () [File not signed]
  R2 cynycopy; C:\Users\Utilisateur\AppData\Roaming\801635B6-1432057616-DE11-8021-B05979046324\nsm5A1D.tmpfs [X]
  S2 gerovizy; C:\Users\Utilisateur\AppData\Local\801635B6-1432065014-DE11-8021-B05979046324\cnsd4C91.tmp [X]
  S2 mihyfyzi; C:\Users\Utilisateur\AppData\Local\801635B6-1432065034-DE11-8021-B05979046324\snsn8F87.tmp [X]
  S2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [X]
  S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
  2015-05-19 21:30 - 2015-05-19 21:30 - 00003184 _____ () C:\Windows\System32\Tasks\{A1A063D0-9D68-48BA-A223-69D35E66547C}
  2015-05-19 21:19 - 2015-05-19 21:19 - 00003126 _____ () C:\Windows\System32\Tasks\{C1BF4378-7E8F-4FC3-B6F8-B0E34197E531}
  2015-05-19 20:16 - 2015-05-19 20:16 - 02224640 _____ () C:\Users\Utilisateur\Downloads\adwcleaner-4-202-multi-win.exe
  2015-05-19 19:49 - 2015-05-19 19:49 - 00000000 ____D () C:\Users\Utilisateur\AppData\Roaming\Opera Software
  2015-05-19 19:49 - 2015-05-19 19:49 - 00000000 ____D () C:\Users\Utilisateur\AppData\Local\Opera Software
  2015-05-19 19:47 - 2015-05-19 21:17 - 00000000 ____D () C:\Program Files (x86)\Opera
  2015-05-19 19:46 - 2015-05-19 20:06 - 00000000 ____D () C:\Users\Utilisateur\AppData\Roaming\801635B6-1432057616-DE11-8021-B05979046324
  2015-05-19 19:05 - 2015-05-19 19:07 - 00000004 _____ () C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
  2015-05-19 18:31 - 2015-05-19 18:33 - 04582228 _____ () C:\Users\Utilisateur\Downloads\virtue.2.4.7.zip
  2015-05-19 18:11 - 2015-05-20 08:10 - 00001024 _____ () C:\Windows\Tasks\HTBUI2eOLEgTCO.job
  2015-05-19 18:11 - 2015-05-20 08:10 - 00001014 _____ () C:\Windows\Tasks\D7ZMShSb2.job
  2015-05-19 18:11 - 2015-05-19 18:11 - 00004076 _____ () C:\Windows\System32\Tasks\HTBUI2eOLEgTCO
  2015-05-19 18:11 - 2015-05-19 18:11 - 00004066 _____ () C:\Windows\System32\Tasks\D7ZMShSb2
  2015-05-19 18:10 - 2015-05-19 18:10 - 00003094 _____ () C:\Windows\System32\Tasks\MixVideoPlayer Update
  2015-05-19 18:07 - 2015-05-19 18:07 - 00000000 ____D () C:\Users\Utilisateur\AppData\Local\WebShield
  2015-05-19 18:07 - 2015-05-19 18:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WajaWebEnhance
  2015-05-19 18:05 - 2015-05-19 21:16 - 00000000 ____D () C:\ProgramData\cWuORmWEcQ
  2015-05-19 18:05 - 2015-05-19 18:07 - 00000000 ____D () C:\Program Files (x86)\WajaWebEnhance
  2015-04-14 18:28 - 2015-04-14 18:28 - 0004387 _____ () C:\Users\Utilisateur\AppData\Roaming\D7ZMShSb2
  2015-04-14 18:28 - 2015-04-14 18:28 - 0004387 _____ () C:\Users\Utilisateur\AppData\Roaming\HTBUI2eOLEgTCO
  C:\Users\Utilisateur\AppData\Local\Temp\mytmpinstaller.exe
  C:\Users\Utilisateur\AppData\Local\Temp\Quarantine.exe
  C:\Users\Utilisateur\AppData\Local\Temp\ReimagePackage.exe
  C:\Users\Utilisateur\AppData\Local\Temp\ReiSysUpdate.exe
  C:\Users\Utilisateur\AppData\Local\Temp\sqlite3.dll
  C:\Users\Utilisateur\AppData\Local\Temp\Uninstall.exe
  C:\Users\Utilisateur\AppData\Local\Temp\UninstallModule.exe
  C:\Users\Utilisateur\AppData\Local\Temp\fe4b4cad99ce4bbd97d9cd28737dc83f390454.exe
  2015-05-19 19:47 - 2015-05-19 19:47 - 00166400 _____ () C:\Users\Utilisateur\AppData\Roaming\801635B6-1432057616-DE11-8021-B05979046324\nsm5A1D.tmpfs
  2015-05-19 19:47 - 2015-05-19 19:47 - 00245760 _____ () C:\Users\Utilisateur\AppData\Roaming\801635B6-1432057616-DE11-8021-B05979046324\jnsh9040.tmp
  2015-05-06 10:34 - 2015-05-06 10:34 - 00691200 ____N () C:\Program Files (x86)\WajaWebEnhance\WajaWebEnhance Internet Enhancer\InternetEnhancerService.exe
  C:\Program Files (x86)\WajaWebEnhance
  C:\Users\Utilisateur\AppData\Roaming\HTBUI2eOLEgTCO.exe
  C:\Users\Utilisateur\AppData\Roaming\oursurfing
  C:\Program Files (x86)\MixVideoPlayer
  C:\ProgramData\WebShield
  C:\Users\Utilisateur\AppData\Roaming\D7ZMShSb2.exe
  C:\Users\Utilisateur\AppData\Roaming\D7ZMShSb2.exe
  C:\Users\Utilisateur\AppData\Roaming\HTBUI2eOLEgTCO.exe
  EmptyTemp:
  

• Menu Fichier / Enregistrer-sous
  Place toi sur le bureau.
  Dans le champs en bas, nom du fichier mets : fixlist.txt
  Clic sur Enregistrer - cela va créer un fichier fixlist.txt sur le bureau.
• Ferme toutes les applications, y compris ton navigateur
• Double-clique sur FRST.exe
  /!\ Sous Vista, Windows 7 et 8, il faut lancer le fichier par clic-droit -> Exécuter en tant qu'administrateur
  Sur le menu principal, clique une seule fois sur Fix et patiente le temps de la correction
  
  
  Un redémarrage peut être nécessaire (pas obligatoire).
• L'outil va créer un rapport de correction Fixlog.txt. Poste ce rapport dans ta réponse.
• Passe un coup (nettoyer) de zhpcleaner > http://www.nicolascoolman.fr/download/zhpcleaner-2/

[clecle]

Ok, merci beaucoup.
J'ai vérifié ds les programmes, aparemment, les indésirables ont été supprimés.

Voici le rapport :

~ ZHPCleaner v2015.5.20.247 by Nicolas Coolman (2015\05\20)
~ Run by Utilisateur (Administrator) (21/05/2015 10:01:35)
~ Forum : http://forum.nicolascoolman.fr
~ Facebook : https://www.facebook.com/nicolascoolman1
~ State version : Version OK
~ Type : Netttoyer
~ Report : C:\Users\Utilisateur\Desktop\ZHPCleaner.txt
~ Quarantine : C:\Users\Utilisateur\AppData\Roaming\ZHP\ZHPCleaner_Quarantine.txt
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
~ Windows 7, 64-bit Service Pack 1 (Build 7601)


---\\ Service. (0)
~ Aucun élément malicieux trouvé.


---\\ Navigateur internet. (2)
SUPPRIMÉ donnée: HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings [Bad : Port=51660 <-Loopback>] (Hijacker.Proxy)
SUPPRIMÉ donnée: HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings [Bad : Port=51660 <-Loopback>] (Hijacker.Proxy)


---\\ Fichier hôte. (1)
~ Le fichier hôte est légitime. (21)


---\\ Tâche planifiée. (0)
~ Aucun élément malicieux trouvé.


---\\ Explorateur ( Dossiers, Fichiers ). (151)
DEPLACÉ fichier: C:\Windows\Installer\473ef8.msi [Pro PC Cleaner - Advanced Installer 11.5.1 build 60347] (PUP.DoctorPC)
DEPLACÉ fichier: C:\Windows\Installer\473efd.msi [globalupdate - Windows Installer XML Toolset (3.9.1208.0)] (PUP.GlobalUpdate)
DEPLACÉ fichier: C:\Windows\System32\Drivers\EsgScanner.sys (PUP.EnigmaSoftware)
DEPLACÉ fichier: C:\Windows\Installer\{67828A23-037C-49E6-ADAD-88DE9C2FEB2A}\Pro_PC_Cleaner_Icon.exe (PUP.DoctorPC)
DEPLACÉ dossier: C:\Program Files\Enigma Software Group (PUP.EnigmaSoftware)
DEPLACÉ dossier: C:\Windows\Installer\MSI1087.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI1F8.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI1F95.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI2C8.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI33BC.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI33F1.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI3681.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI36BE.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI38C5.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI3A77.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI4023.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI44D4.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI4745.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI47FD.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI4868.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI487E.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI4AD9.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI4C32.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI4C61.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI4C93.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI4DA9.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI4E68.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI5257.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI526E.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI53B9.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI5491.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI5702.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI58B0.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI592F.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI5AB5.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI5C90.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI5D45.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI5F10.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI5F68.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI60DF.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI61BE.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI639E.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI6593.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI66EB.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI672B.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI691D.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI6B4D.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI6BDA.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI6C4B.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI6CD4.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI6DDE.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI6FF4.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI7251.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI7650.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI7686.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI78A9.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI7984.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI7A01.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI7A18.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI7A8A.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI7BD2.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI7C8A.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI7D0E.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI7D9C.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI7E04.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI7E11.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI7EE2.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI7EE.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI7FD9.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI7FFC.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI8181.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI8287.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI82DA.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI8356.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI8363.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI84AF.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI8519.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI8547.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI85A8.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI86E8.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI874B.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI878A.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI87F8.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI880A.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI8931.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI89CC.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI8AE4.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI8B00.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI8D90.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI96A5.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI9CA0.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSI9EA4.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIA10E.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIA144.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIA336.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIA56A.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIA6AA.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIA78D.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIA81A.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIA8BC.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIA8F0.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIAA71.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIAAF7.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIAB0E.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIAC08.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIAD07.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIADCD.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIAE91.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIB08C.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIB1D8.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIB290.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIB426.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIB55C.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIB562.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIB6F3.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIB74D.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIB889.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIBBE8.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIBC04.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIBF82.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIC48C.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIC99C.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSICAE4.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSICBDD.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSICF64.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSID10C.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSID290.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSID2A2.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSID403.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSID6B8.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSID80D.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIDA50.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIDA58.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIDCC2.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIDD0F.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIDE96.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIDF38.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIE259.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIE2AC.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIE33E.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIE377.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIE53C.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIEA1.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIEBB4.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIECCC.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIECEB.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIEEE9.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIF2A7.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIF7B6.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIFB5F.tmp- (Empty)
DEPLACÉ dossier: C:\Windows\Installer\MSIFCA9.tmp- (Empty)


---\\ Base de Registres ( Clés, Valeurs, Données ). (9)
SUPPRIMÉ clé*: [X64] HKLM\Software\Classes\Installer\Products\32A82876C7306E94DADA88EDC9F2BEA2 [Pro PC Cleaner] (PUP.DoctorPC)
SUPPRIMÉ clé*: [X64] HKLM\Software\Classes\Installer\Products\93BAD29AC2E44034A96BCB446EB8552E [globalupdate Helper] (PUP.GlobalUpdate)
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\EnigmaSoftwareGroup [] (PUP.EnigmaSoftware)
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0561114BEB6140F4F8C8780B0391B5CB [01:\Software\Pro PC Cleaner\Pro PC Cleaner\Custom1 (Not File)] (PUP.DoctorPC)
SUPPRIMÉ clé*: [X64] HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{67828A23-037C-49E6-ADAD-88DE9C2FEB2A} [Pro PC Cleaner] (PUP.DoctorPC)
SUPPRIMÉ clé*: [X64] HKLM\Software\Classes\Installer\Features\32A82876C7306E94DADA88EDC9F2BEA2 [] (PUP.DoctorPC)
SUPPRIMÉ valeur: HKLM64\Software\Classes\.shtml\OpenWithProgIDs\\CRSBRWSHTML [] (PUP.CrossBrowse)
SUPPRIMÉ valeur: HKLM64\Software\Classes\.webp\OpenWithProgIDs\\CRSBRWSHTML [] (PUP.CrossBrowse)
SUPPRIMÉ valeur: HKLM64\Software\Classes\.xht\OpenWithProgIDs\\CRSBRWSHTML [] (PUP.CrossBrowse)


---\\ Bilan de la réparation
~ Réparation réalisée avec succès.
~ Ce navigateur est absent (Google Chrome)
~ Ce navigateur est absent (Opera Software)


---\\ Statistiques
~ Items scannés : 759
~ Items trouvés : 0
~ Items annulés : 0
~ Items réparés : 162


End of clean at 10:02:09
===================
ZHPCleaner-[R]-21052015-10_02_09.txt
ZHPCleaner-[S]-21052015-10_00_35.txt

[clecle]

Désolée, je me suis trompée de rapport.

Voici le bon :

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 19-05-2015
Ran by Utilisateur at 2015-05-21 09:31:50 Run:1
Running from C:\Users\Utilisateur\Desktop
Loaded Profiles: Utilisateur (Available profiles: Utilisateur)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Task: {7E6AFD42-CF7B-4FCB-AACE-BC32AC82D4A6} - System32\Tasks\HTBUI2eOLEgTCO => C:\Users\Utilisateur\AppData\Roaming\HTBUI2eOLEgTCO.exe <==== ATTENTION
Task: {F0A68DDF-F70E-4732-B743-2441A17D4820} - System32\Tasks\{C1BF4378-7E8F-4FC3-B6F8-B0E34197E531} => pcalua.exe -a C:\ProgramData\WebShield\uninstall.exe -c /kb=y /ic=1
Task: {F95DED26-B0E8-4A25-8781-8B8983FD8548} - System32\Tasks\D7ZMShSb2 => C:\Users\Utilisateur\AppData\Roaming\D7ZMShSb2.exe <==== ATTENTION
Task: {FD62061A-BEF7-4DC1-B404-0EA2FCB52071} - System32\Tasks\Games\UpdateCheck_S-1-5-21-239028553-3652369879-2957087940-1000
Task: C:\Windows\Tasks\D7ZMShSb2.job => C:\Users\Utilisateur\AppData\Roaming\D7ZMShSb2.exe <==== ATTENTION
Task: C:\Windows\Tasks\HTBUI2eOLEgTCO.job => C:\Users\Utilisateur\AppData\Roaming\HTBUI2eOLEgTCO.exe <==== ATTENTION
Task: {C966CC52-8EDE-48C9-832C-AD95CF41A45E} - System32\Tasks\{A1A063D0-9D68-48BA-A223-69D35E66547C} => pcalua.exe -a C:\Users\Utilisateur\AppData\Roaming\oursurfing\UninstallManager.exe -c -ptid=cmi
HKU\S-1-5-21-239028553-3652369879-2957087940-1000\...\Run: [GoogleChromeAutoLaunch_A030E3BCB07369CBE6F7B214D340EADA] => "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe" --no-startup-window
Task: {E1A7DC8F-7976-4D6F-A9BD-20D48926EFB4} - System32\Tasks\MixVideoPlayer Update => C:\Program Files (x86)\MixVideoPlayer\mixUpdater.exe
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled
ProxyServer: [.DEFAULT] => http=127.0.0.1:51660;https=127.0.0.1:51660
R2 gisidypy; C:\Users\Utilisateur\AppData\Roaming\801635B6-1432057616-DE11-8021-B05979046324\jnsh9040.tmp [245760 2015-05-19] () [File not signed]
R2 WajaWebEnhance Service; C:\Program Files (x86)\WajaWebEnhance\WajaWebEnhance Internet Enhancer\InternetEnhancerService.exe [691200 2015-05-06] () [File not signed]
R2 cynycopy; C:\Users\Utilisateur\AppData\Roaming\801635B6-1432057616-DE11-8021-B05979046324\nsm5A1D.tmpfs [X]
S2 gerovizy; C:\Users\Utilisateur\AppData\Local\801635B6-1432065014-DE11-8021-B05979046324\cnsd4C91.tmp [X]
S2 mihyfyzi; C:\Users\Utilisateur\AppData\Local\801635B6-1432065034-DE11-8021-B05979046324\snsn8F87.tmp [X]
S2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
2015-05-19 21:30 - 2015-05-19 21:30 - 00003184 _____ () C:\Windows\System32\Tasks\{A1A063D0-9D68-48BA-A223-69D35E66547C}
2015-05-19 21:19 - 2015-05-19 21:19 - 00003126 _____ () C:\Windows\System32\Tasks\{C1BF4378-7E8F-4FC3-B6F8-B0E34197E531}
2015-05-19 20:16 - 2015-05-19 20:16 - 02224640 _____ () C:\Users\Utilisateur\Downloads\adwcleaner-4-202-multi-win.exe
2015-05-19 19:49 - 2015-05-19 19:49 - 00000000 ____D () C:\Users\Utilisateur\AppData\Roaming\Opera Software
2015-05-19 19:49 - 2015-05-19 19:49 - 00000000 ____D () C:\Users\Utilisateur\AppData\Local\Opera Software
2015-05-19 19:47 - 2015-05-19 21:17 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-05-19 19:46 - 2015-05-19 20:06 - 00000000 ____D () C:\Users\Utilisateur\AppData\Roaming\801635B6-1432057616-DE11-8021-B05979046324
2015-05-19 19:05 - 2015-05-19 19:07 - 00000004 _____ () C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-05-19 18:31 - 2015-05-19 18:33 - 04582228 _____ () C:\Users\Utilisateur\Downloads\virtue.2.4.7.zip
2015-05-19 18:11 - 2015-05-20 08:10 - 00001024 _____ () C:\Windows\Tasks\HTBUI2eOLEgTCO.job
2015-05-19 18:11 - 2015-05-20 08:10 - 00001014 _____ () C:\Windows\Tasks\D7ZMShSb2.job
2015-05-19 18:11 - 2015-05-19 18:11 - 00004076 _____ () C:\Windows\System32\Tasks\HTBUI2eOLEgTCO
2015-05-19 18:11 - 2015-05-19 18:11 - 00004066 _____ () C:\Windows\System32\Tasks\D7ZMShSb2
2015-05-19 18:10 - 2015-05-19 18:10 - 00003094 _____ () C:\Windows\System32\Tasks\MixVideoPlayer Update
2015-05-19 18:07 - 2015-05-19 18:07 - 00000000 ____D () C:\Users\Utilisateur\AppData\Local\WebShield
2015-05-19 18:07 - 2015-05-19 18:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WajaWebEnhance
2015-05-19 18:05 - 2015-05-19 21:16 - 00000000 ____D () C:\ProgramData\cWuORmWEcQ
2015-05-19 18:05 - 2015-05-19 18:07 - 00000000 ____D () C:\Program Files (x86)\WajaWebEnhance
2015-04-14 18:28 - 2015-04-14 18:28 - 0004387 _____ () C:\Users\Utilisateur\AppData\Roaming\D7ZMShSb2
2015-04-14 18:28 - 2015-04-14 18:28 - 0004387 _____ () C:\Users\Utilisateur\AppData\Roaming\HTBUI2eOLEgTCO
C:\Users\Utilisateur\AppData\Local\Temp\mytmpinstaller.exe
C:\Users\Utilisateur\AppData\Local\Temp\Quarantine.exe
C:\Users\Utilisateur\AppData\Local\Temp\ReimagePackage.exe
C:\Users\Utilisateur\AppData\Local\Temp\ReiSysUpdate.exe
C:\Users\Utilisateur\AppData\Local\Temp\sqlite3.dll
C:\Users\Utilisateur\AppData\Local\Temp\Uninstall.exe
C:\Users\Utilisateur\AppData\Local\Temp\UninstallModule.exe
C:\Users\Utilisateur\AppData\Local\Temp\fe4b4cad99ce4bbd97d9cd28737dc83f390454.exe
2015-05-19 19:47 - 2015-05-19 19:47 - 00166400 _____ () C:\Users\Utilisateur\AppData\Roaming\801635B6-1432057616-DE11-8021-B05979046324\nsm5A1D.tmpfs
2015-05-19 19:47 - 2015-05-19 19:47 - 00245760 _____ () C:\Users\Utilisateur\AppData\Roaming\801635B6-1432057616-DE11-8021-B05979046324\jnsh9040.tmp
2015-05-06 10:34 - 2015-05-06 10:34 - 00691200 ____N () C:\Program Files (x86)\WajaWebEnhance\WajaWebEnhance Internet Enhancer\InternetEnhancerService.exe
C:\Program Files (x86)\WajaWebEnhance
C:\Users\Utilisateur\AppData\Roaming\HTBUI2eOLEgTCO.exe
C:\Users\Utilisateur\AppData\Roaming\oursurfing
C:\Program Files (x86)\MixVideoPlayer
C:\ProgramData\WebShield
C:\Users\Utilisateur\AppData\Roaming\D7ZMShSb2.exe
C:\Users\Utilisateur\AppData\Roaming\D7ZMShSb2.exe
C:\Users\Utilisateur\AppData\Roaming\HTBUI2eOLEgTCO.exe
EmptyTemp:

*****************

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{7E6AFD42-CF7B-4FCB-AACE-BC32AC82D4A6}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7E6AFD42-CF7B-4FCB-AACE-BC32AC82D4A6}" => Key deleted successfully.
C:\Windows\System32\Tasks\HTBUI2eOLEgTCO => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\HTBUI2eOLEgTCO" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F0A68DDF-F70E-4732-B743-2441A17D4820}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F0A68DDF-F70E-4732-B743-2441A17D4820}" => Key deleted successfully.
C:\Windows\System32\Tasks\{C1BF4378-7E8F-4FC3-B6F8-B0E34197E531} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{C1BF4378-7E8F-4FC3-B6F8-B0E34197E531}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{F95DED26-B0E8-4A25-8781-8B8983FD8548}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F95DED26-B0E8-4A25-8781-8B8983FD8548}" => Key deleted successfully.
C:\Windows\System32\Tasks\D7ZMShSb2 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\D7ZMShSb2" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{FD62061A-BEF7-4DC1-B404-0EA2FCB52071}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FD62061A-BEF7-4DC1-B404-0EA2FCB52071}" => Key deleted successfully.
C:\Windows\System32\Tasks\Games\UpdateCheck_S-1-5-21-239028553-3652369879-2957087940-1000 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Games\UpdateCheck_S-1-5-21-239028553-3652369879-2957087940-1000" => Key deleted successfully.
C:\Windows\Tasks\D7ZMShSb2.job => Moved successfully.
C:\Windows\Tasks\HTBUI2eOLEgTCO.job => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C966CC52-8EDE-48C9-832C-AD95CF41A45E}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C966CC52-8EDE-48C9-832C-AD95CF41A45E}" => Key deleted successfully.
C:\Windows\System32\Tasks\{A1A063D0-9D68-48BA-A223-69D35E66547C} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{A1A063D0-9D68-48BA-A223-69D35E66547C}" => Key deleted successfully.
HKU\S-1-5-21-239028553-3652369879-2957087940-1000\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_A030E3BCB07369CBE6F7B214D340EADA => value deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{E1A7DC8F-7976-4D6F-A9BD-20D48926EFB4}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E1A7DC8F-7976-4D6F-A9BD-20D48926EFB4}" => Key deleted successfully.
C:\Windows\System32\Tasks\MixVideoPlayer Update => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MixVideoPlayer Update" => Key deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
gisidypy => Service not found.
WajaWebEnhance Service => Service not found.
cynycopy => Service not found.
gerovizy => Service not found.
mihyfyzi => Service not found.
SpyHunter 4 Service => Service deleted successfully.
esgiguard => Service deleted successfully.
"C:\Windows\System32\Tasks\{A1A063D0-9D68-48BA-A223-69D35E66547C}" => File/Directory not found.
"C:\Windows\System32\Tasks\{C1BF4378-7E8F-4FC3-B6F8-B0E34197E531}" => File/Directory not found.
C:\Users\Utilisateur\Downloads\adwcleaner-4-202-multi-win.exe => Moved successfully.
C:\Users\Utilisateur\AppData\Roaming\Opera Software => Moved successfully.
C:\Users\Utilisateur\AppData\Local\Opera Software => Moved successfully.
C:\Program Files (x86)\Opera => Moved successfully.
"C:\Users\Utilisateur\AppData\Roaming\801635B6-1432057616-DE11-8021-B05979046324" => File/Directory not found.
C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7 => Moved successfully.
C:\Users\Utilisateur\Downloads\virtue.2.4.7.zip => Moved successfully.
"C:\Windows\Tasks\HTBUI2eOLEgTCO.job" => File/Directory not found.
"C:\Windows\Tasks\D7ZMShSb2.job" => File/Directory not found.
"C:\Windows\System32\Tasks\HTBUI2eOLEgTCO" => File/Directory not found.
"C:\Windows\System32\Tasks\D7ZMShSb2" => File/Directory not found.
"C:\Windows\System32\Tasks\MixVideoPlayer Update" => File/Directory not found.
C:\Users\Utilisateur\AppData\Local\WebShield => Moved successfully.
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WajaWebEnhance" => File/Directory not found.
"C:\ProgramData\cWuORmWEcQ" => File/Directory not found.
"C:\Program Files (x86)\WajaWebEnhance" => File/Directory not found.
C:\Users\Utilisateur\AppData\Roaming\D7ZMShSb2 => Moved successfully.
C:\Users\Utilisateur\AppData\Roaming\HTBUI2eOLEgTCO => Moved successfully.
C:\Users\Utilisateur\AppData\Local\Temp\mytmpinstaller.exe => Moved successfully.
C:\Users\Utilisateur\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Utilisateur\AppData\Local\Temp\ReimagePackage.exe => Moved successfully.
C:\Users\Utilisateur\AppData\Local\Temp\ReiSysUpdate.exe => Moved successfully.
C:\Users\Utilisateur\AppData\Local\Temp\sqlite3.dll => Moved successfully.
C:\Users\Utilisateur\AppData\Local\Temp\Uninstall.exe => Moved successfully.
C:\Users\Utilisateur\AppData\Local\Temp\UninstallModule.exe => Moved successfully.
C:\Users\Utilisateur\AppData\Local\Temp\fe4b4cad99ce4bbd97d9cd28737dc83f390454.exe => Moved successfully.
"C:\Users\Utilisateur\AppData\Roaming\801635B6-1432057616-DE11-8021-B05979046324\nsm5A1D.tmpfs" => File/Directory not found.
"C:\Users\Utilisateur\AppData\Roaming\801635B6-1432057616-DE11-8021-B05979046324\jnsh9040.tmp" => File/Directory not found.
"C:\Program Files (x86)\WajaWebEnhance\WajaWebEnhance Internet Enhancer\InternetEnhancerService.exe" => File/Directory not found.
"C:\Program Files (x86)\WajaWebEnhance" => File/Directory not found.
"C:\Users\Utilisateur\AppData\Roaming\HTBUI2eOLEgTCO.exe" => File/Directory not found.
"C:\Users\Utilisateur\AppData\Roaming\oursurfing" => File/Directory not found.
"C:\Program Files (x86)\MixVideoPlayer" => File/Directory not found.
"C:\ProgramData\WebShield" => File/Directory not found.
"C:\Users\Utilisateur\AppData\Roaming\D7ZMShSb2.exe" => File/Directory not found.
"C:\Users\Utilisateur\AppData\Roaming\D7ZMShSb2.exe" => File/Directory not found.
"C:\Users\Utilisateur\AppData\Roaming\HTBUI2eOLEgTCO.exe" => File/Directory not found.
EmptyTemp: => Removed 707.2 MB temporary data.


The system needed a reboot.

==== End of Fixlog 09:33:33 ====

[angelique]

➫ supp. frst.exe, ses rapports , C:\FRST


➫ supp zhpcleaner, son rapport

➫ executer --> %appdata%

supp dans le dossier Roaming\ZHP


➫ Quelques conseils :



Pour prévenir les sites malicieux, tu peux installer Blockulicious : http://forum.malekal.com/blockulicious- ... 46656.html


Pour ne plus te faire avoir.
A lire - Programmes parasites / PUPs : https://www.malekal.com/adwares-pup-protection/

[clecle]

Ok, merci beaucoup,
Bonne soirée.