PC probablement surinfecté...

[Vallis]

Bonjour,

Je fais appel a vous car je ne sais plus comment m'en sortir avec mon pc...

Je precise que je n'avais plus d'antivirus actif depuis un mois......
J'ai du telecharger un truc malsain il y a 3 jours, depuis ca a commencé avec au redémarrage l'apparition du fond d'ecran hp d'origine. Sentant le danger, j'ai voulu telecharger la version d'essai de kaspersky, mais ca n'a rien arrange, j'ai des messages d'erreur sur la licence kaspersky, et depuis plus aucun des navigateurs internet ne marche, chrome, ie, firefox.

J'ai essayé de nettoyer un peu avec ccleaner, mais les desinstallations commencent puis restent bloquees pendant des heures...

N'ayant plus acces a Internet via mon pc, je ne peux pas faire d'analyse en ligne ni telecharger de programme pour aider a detecter les aventuels malwares. Bref, je suis desemparee !

Si quelqu'un avait une piste pour m'aider a me sortir de cette impasse..?

[Malekal_morte]

Salut,

J'ai du telecharger un truc malsain il y a 3 jours, depuis ca a commencé avec au redémarrage l'apparition du fond d'ecran hp d'origine.

Pas compris, qu'est ce qui est arrivé avec le fond d'écran d'origine ?

Pour faire un checkup :


Suis ce tutoriel FRST: https://www.malekal.com/tutorial-farbar ... tool-frst/
(et bien prendre le temps de lire afin d'appliquer correctement - tout y est expliqué).
Télécharge et lance le scan FRST, cela va générer trois rapports FRST :
* FRST.txt
* Shortcut.txt
* Additionnal.txt

Envoie, comme expliqué, ces trois rapports sur le site http://pjjoint.malekal.com et en retour donne les trois liens pjjoint qui mènent à  ses rapports ici dans une nouvelle réponse afin que l'on puisse les consulter.

[Vallis]

Merci de m'aider.

Pour le fond d'ecran, je voulais dire que mon wallpaper du bureau a ete remplace au redemarrage pr un fond d ecran hp...

Alors voici les 3 liens :
Frst - http://pjjoint.malekal.com/files.php?id ... e12d9v9p15
Shortcut - http://pjjoint.malekal.com/files.php?id ... 11w14r15y6
Addition - http://pjjoint.malekal.com/files.php?id ... r8o5x11g13

[Malekal_morte]

yep beaucoup d'adwares : NavRight, StormWarnings, shopperz , oursurfing, etc.




Voici la correction à  effectuer avec FRST.
Tu peux t'inspirer de cette note explicative avec des captures d'écran pour t'aider: https://www.malekal.com/tutorial-farbar ... -frst/#fix

Ouvre le bloc-notes : Touche Windows + R, dans le champs executer, tape notepad et OK.
Copie/colle dedans ce qui suit :

HKLM-x32\...\RunOnce: [upgmsd_fr_005010027.exe] => C:\Users\Auré\AppData\Local\gmsd_fr_005010027\upgmsd_fr_005010027.exe [3298960 2015-07-10] ()
AppInit_DLLs: C:\ProgramData\NavRight\NavRight64.dll => C:\ProgramData\NavRight\NavRight64.dll [1008128 2015-07-09] (NavRight)
AppInit_DLLs-x32: C:\ProgramData\NavRight\NavRight32.dll => C:\ProgramData\NavRight\NavRight32.dll [804864 2015-07-09] (NavRight)
Task: C:\Windows\Tasks\AmiUpdXp.job => C:\Users\Auré\AppData\Local\7559\Updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\PCXBSEKNMU1.job => C:\ProgramData\NavRight\NavRight.exe <==== ATTENTION
Task: C:\Windows\Tasks\VYNRNXKJEKLRPWSB.job => C:\ProgramData\Service8609\Service8609.exe <==== ATTENTION
Task: {4754C6EF-5969-4DA4-9DE7-D35E776E1F01} - System32\Tasks\PCXBSEKNMU1 => C:\ProgramData\NavRight\NavRight.exe [2015-07-09] (NavRight) <==== ATTENTION
Task: {6300BC21-BCB1-4AAD-852E-86491D50C912} - System32\Tasks\VYNRNXKJEKLRPWSB => C:\ProgramData\Service8609\Service8609.exe [2015-06-28] () <==== ATTENTION
Task: {69A12E4B-FEAE-4565-8DFB-7637631559EC} - \AmiUpdXp No Task File <==== ATTENTION
Task: {712F0583-0761-43EB-811E-63C930DD02A2} - System32\Tasks\WordShark Auto Updater 1.10.0.20 Pending Update => C:\Program Files (x86)\WordShark_1.10.0.20\Update\WordSharkAutoUpdateClient.exe [2015-07-06] (WS) <==== ATTENTION
Task: {79F06A01-4989-444C-9493-3D7DBD5ACB29} - System32\Tasks\WindApp Update => C:\Users\Auré\AppData\Roaming\Store\WindApp\WindApp Update.exe [2015-03-20] (Nosibay) <==== ATTENTION
Task: {8C548EC4-9C88-4BC0-824A-6CF6ED0F2F42} - System32\Tasks\PenWes => C:\Program Files (x86)\PenWes\penwes.exe [2011-05-31] () <==== ATTENTION
Task: {C98AC647-111E-42A4-91BC-02F943AFF648} - System32\Tasks\WordShark Auto Updater 1.10.0.20 Core => C:\Program Files (x86)\WordShark_1.10.0.20\Update\WordSharkAutoUpdateClient.exe [2015-07-06] (WS) <==== ATTENTION
Task: {D3974686-0CED-4B7C-AB63-1C53B6F3DAF5} - System32\Tasks\Dlvfecrd => C:\Program Files\shopperz\Mlsaizwav.bat [2015-07-01] () <==== ATTENTION
Task: {E318DC4A-33E9-4003-B7F0-B80B2D1FA42C} - \tet3008 No Task File <==== ATTENTION
Winsock: Catalog9 01 C:\Program Files (x86)\StormWarnings\SW_Updater.dll [346928 2015-07-08] (Storm Warnings)
Winsock: Catalog9 02 C:\Program Files (x86)\StormWarnings\SW_Updater.dll [346928 2015-07-08] (Storm Warnings)
Winsock: Catalog9 03 C:\Program Files (x86)\StormWarnings\SW_Updater.dll [346928 2015-07-08] (Storm Warnings)
Winsock: Catalog9 04 C:\Program Files (x86)\StormWarnings\SW_Updater.dll [346928 2015-07-08] (Storm Warnings)
Winsock: Catalog9 05 C:\Program Files (x86)\StormWarnings\SW_Updater.dll [346928 2015-07-08] (Storm Warnings)
Winsock: Catalog9 06 C:\Windows\SysWOW64\Oexufafono.dll [278016 2015-07-10] ()
Winsock: Catalog9 07 C:\Windows\SysWOW64\Oexufafono.dll [278016 2015-07-10] ()
Winsock: Catalog9 08 C:\Windows\SysWOW64\Oexufafono.dll [278016 2015-07-10] ()
Winsock: Catalog9 09 C:\Windows\SysWOW64\Oexufafono.dll [278016 2015-07-10] ()
Winsock: Catalog9 10 C:\Program Files (x86)\StormWarnings\SW_Updater.dll [346928 2015-07-08] (Storm Warnings)
Winsock: Catalog9 11 C:\Windows\SysWOW64\Oexufafono.dll [278016 2015-07-10] ()
R2 8dadad2f-d980-4b45-ab50-b9af125601a7; C:\Program Files\shopperz\Polouxu.exe [285544 2015-07-01] ()
R2 csrcc; C:\Program Files\shopperz\csrcc.exe [1448808 2015-07-01] ()
R2 IHProtect Service; C:\Program Files (x86)\MiuiTab\ProtectService.exe [125112 2015-06-24] (XTab system)
R3 Oexufafono; C:\Program Files\shopperz\Oexufafono.exe [2020864 2015-06-23] () [File not signed]
R2 shopperz Updater; C:\Program Files\shopperz\Abwpdpquy.exe [174440 2015-07-01] ()
R2 StormWarnings Update Service; C:\Program Files (x86)\StormWarnings\StormWarningsSrv.exe [624816 2015-06-04] ()
R2 SW_Updater; C:\Program Files (x86)\StormWarnings\SW_Updater.exe [509744 2015-07-08] (Storm Warnings)
R2 UfockFuloxo; C:\Program Files\shopperz\LikumVutyp.exe [172480 2015-06-23] () [File not signed]
R2 zejytose; C:\Users\Auré\AppData\Roaming\087E14BC-1436560538-11DF-B701-7976F5AFFA82\jnsm7913.tmp [199168 2015-07-10] () [File not signed]
R1 cherimoya; C:\Windows\System32\drivers\cherimoya.sys [61336 2015-06-18] (Cherimoya Ltd)
S1 fzjbgzfa; \??\C:\Windows\system32\drivers\fzjbgzfa.sys [X]
U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X]
S1 ophjnfyk; \??\C:\Windows\system32\drivers\ophjnfyk.sys [X]
S1 vptbqyqk; \??\C:\Windows\system32\drivers\vptbqyqk.sys [X]
S1 wsfd_vt_1_10_0_20; system32\drivers\wsfd_vt_1_10_0_20.sys [X]
2015-07-10 23:13 - 2015-07-10 23:13 - 00000000 ____D C:\Users\Auré\AppData\Local\Storm_Warnings,_LLC
2015-07-10 23:12 - 2015-07-10 23:12 - 00000000 ____D C:\Users\Auré\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StormWarnings
2015-07-10 23:10 - 2015-07-13 13:50 - 00000000 ____D C:\Users\Auré\AppData\Local\gmsd_fr_005010027
2015-07-10 23:10 - 2015-07-13 11:27 - 00004664 _____ C:\Windows\SysWOW64\Oexufafono.ini
2015-07-10 23:10 - 2015-07-13 11:27 - 00002376 _____ C:\Windows\SysWOW64\OexufafonoOff.ini
2015-07-10 23:10 - 2015-07-13 11:27 - 00002376 _____ C:\Windows\system32\OexufafonoOff.ini
2015-07-10 23:10 - 2015-06-23 22:47 - 00348672 _____ C:\Windows\system32\Oexufafono64.dll
2015-07-10 23:10 - 2015-06-23 22:46 - 00278016 _____ C:\Windows\SysWOW64\Oexufafono.dll
2015-07-10 23:10 - 2002-01-01 03:33 - 00000000 ____D C:\Program Files (x86)\gmsd_fr_005010027
2015-07-10 23:09 - 2015-07-10 23:12 - 00000000 ____D C:\Program Files (x86)\StormWarnings
2015-07-10 23:09 - 2015-07-10 23:09 - 00000000 ____D C:\Users\Auré\AppData\Local\StormWarnings
2015-07-10 23:09 - 2015-07-10 23:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StormWarnings
2015-07-10 23:09 - 2015-07-10 23:09 - 00000000 _____ C:\dummy.htm
2015-07-10 23:08 - 2015-07-10 23:09 - 00000000 ____D C:\Program Files\shopperz
2015-07-10 23:08 - 2015-07-10 23:08 - 00003626 _____ C:\Windows\System32\Tasks\Dlvfecrd
2015-07-10 23:08 - 2015-07-10 23:08 - 00000000 ____D C:\Users\Auré\AppData\Roaming\mystartsearch
2015-07-10 23:08 - 2015-07-10 23:08 - 00000000 _____ C:\Windows\SysWOW64\Number of results
2015-07-10 23:08 - 2015-06-18 12:08 - 00061336 _____ (Cherimoya Ltd) C:\Windows\system32\Drivers\cherimoya.sys
2015-07-10 23:08 - 2002-01-01 03:33 - 00000000 ____D C:\Users\Auré\AppData\Local\SmartWeb
2015-07-10 22:52 - 2015-07-13 11:45 - 00000356 _____ C:\Windows\Tasks\AmiUpdXp.job
2015-07-10 22:52 - 2015-07-10 23:43 - 00000000 ____D C:\Users\Auré\AppData\Local\7559
2015-07-10 22:40 - 2015-07-10 22:40 - 00001089 _____ C:\Users\Auré\Desktop\Continue Live Installation.lnk
2015-07-10 22:37 - 2009-06-10 23:00 - 00000824 _____ C:\Windows\system32\Drivers\etc\hp.bak
2015-07-10 22:36 - 2015-07-10 23:51 - 00000000 ____D C:\Program Files (x86)\mbot_fr_014010027
2015-07-10 22:36 - 2015-07-10 22:41 - 00000000 ____D C:\Users\Auré\AppData\Local\mbot_fr_014010027
2015-07-10 22:36 - 2015-07-10 22:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MYBESTOFFERSTODAY
2015-07-10 22:35 - 2015-07-10 22:35 - 00000000 ____D C:\Users\Auré\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASPackage
2015-07-10 22:35 - 2002-01-01 00:28 - 00000000 ____D C:\Users\Auré\AppData\Roaming\ASPackage
2015-07-10 22:35 - 2002-01-01 00:28 - 00000000 ____D C:\Users\Auré\AppData\Roaming\087E14BC-1436560538-11DF-B701-7976F5AFFA82
2015-07-10 22:34 - 2015-07-10 23:09 - 00000000 ____D C:\Program Files (x86)\MiuiTab
2015-07-10 22:34 - 2015-07-10 22:34 - 00004176 _____ C:\Windows\System32\Tasks\WordShark Auto Updater 1.10.0.20 Pending Update
2015-07-10 22:34 - 2015-07-10 22:34 - 00004166 _____ C:\Windows\System32\Tasks\WordShark Auto Updater 1.10.0.20 Core
2015-07-10 22:34 - 2015-07-10 22:34 - 00000000 ____D C:\Users\Auré\AppData\Roaming\oursurfing
2015-07-10 22:34 - 2015-07-10 22:34 - 00000000 ____D C:\ProgramData\WindowsMangerProtect
2015-07-10 22:34 - 2015-07-10 22:34 - 00000000 ____D C:\ProgramData\IHProtectUpDate
2015-07-10 22:34 - 2015-07-10 22:34 - 00000000 ____D C:\Program Files (x86)\WordShark_1.10.0.20
2015-07-10 22:34 - 2015-07-10 22:34 - 00000000 _____ C:\Windows\prleth.sys
2015-07-10 22:34 - 2015-07-10 22:34 - 00000000 _____ C:\Windows\hgfs.sys
2015-07-10 22:33 - 2015-07-13 13:38 - 00000340 ____H C:\Windows\Tasks\VYNRNXKJEKLRPWSB.job
2015-07-10 22:33 - 2015-07-13 11:45 - 00000322 _____ C:\Windows\Tasks\PCXBSEKNMU1.job
2015-07-10 22:33 - 2015-07-10 22:33 - 00003372 _____ C:\Windows\System32\Tasks\VYNRNXKJEKLRPWSB
2015-07-10 22:33 - 2015-07-10 22:33 - 00002844 _____ C:\Windows\System32\Tasks\PCXBSEKNMU1
2015-07-10 22:33 - 2015-07-10 22:33 - 00000000 ____D C:\ProgramData\Service8609
2015-07-10 22:33 - 2015-07-10 22:33 - 00000000 ____D C:\ProgramData\NavRight
2015-07-10 22:33 - 2015-07-10 22:33 - 00000000 ____D C:\ProgramData\12db864551ae4c578eb17db1a9f5d3cf
2015-07-10 22:31 - 2015-07-10 22:32 - 00001305 _____ C:\Users\Auré\AppData\Roaming\Bubble Dock.boostrap.log
2015-07-10 22:31 - 2015-07-10 22:31 - 00005706 _____ C:\Users\Auré\AppData\Roaming\Bubble Dock.installation.log
2015-07-10 22:31 - 2015-07-10 22:31 - 00003736 _____ C:\Windows\System32\Tasks\Selection Tools Update
2015-07-10 22:31 - 2015-07-10 22:31 - 00003702 _____ C:\Windows\System32\Tasks\WindApp Update
2015-07-10 22:31 - 2015-07-10 22:31 - 00000097 _____ C:\Users\Auré\AppData\Roaming\WindApp.boostrap.log
2015-07-10 22:31 - 2015-07-10 22:31 - 00000078 _____ C:\Users\Auré\AppData\Roaming\WindApp.installation.log
2015-07-10 22:31 - 2015-07-10 22:31 - 00000078 _____ C:\Users\Auré\AppData\Roaming\Selection Tools.installation.log
2015-07-10 22:31 - 2015-07-10 22:31 - 00000000 ____D C:\Users\Auré\AppData\Roaming\WTools
2015-07-10 22:31 - 2015-07-10 22:31 - 00000000 ____D C:\Users\Auré\AppData\Roaming\Store
2015-07-10 22:31 - 2015-07-10 22:31 - 00000000 ____D C:\Users\Auré\AppData\Roaming\Nosibay
2015-07-10 22:31 - 2015-07-10 22:31 - 00000000 ____D C:\Users\Auré\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bubble Dock
2015-07-10 22:31 - 2015-07-10 22:31 - 00000000 ____D C:\Program Files (x86)\app_setup
cmd: netsh winsock reset

Une fois, le texte coller dans le bloc-note.
Menu Fichier puis Enregistrer sous.
A gauche, place toi sur le bureau.
Dans le champs en bas, nom du fichier mets : fixlist.txt
Clic sur Enregistrer - cela va créer un fichier fixlist.txt sur le bureau.

Relance FRST et clic sur le bouton Fix
Selon comment un redémarrage est nécessaire (pas obligatoire).
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

Redémarre l'ordinateur


puis réinitialise tes navigateurs:
==================================
Réinitialise tes navigateurs et ou manuellement reparamètre tes navigateurs WEB (page de démarrage, moteur de recherche etc) mais aussi supprimer/désactiver les extensions inutiles/parasites :
* Internet Explorer et modules complémentaires / moteurs de recherche : http://forum.malekal.com/
* Firefox : http://forum.malekal.com/firefox-extens ... 36057.html
* Google Chrome : http://forum.malekal.com/google-chrome- ... 35837.html

[Vallis]

Bonsoir,

Voici le resultat : (c'est un peu long !)

Fix result of Farbar Recovery Scan Tool (x64) Version:12-07-2015
Ran by Auré at 2015-07-13 23:18:40 Run:1
Running from C:\Users\Auré\Desktop
Loaded Profiles: Auré (Available Profiles: Auré & Invité)
Boot Mode: Normal
==============================================

fixlist content:
*****************
HKLM-x32\...\RunOnce: [upgmsd_fr_005010027.exe] => C:\Users\Auré\AppData\Local\gmsd_fr_005010027\upgmsd_fr_005010027.exe [3298960 2015-07-10] ()
AppInit_DLLs: C:\ProgramData\NavRight\NavRight64.dll => C:\ProgramData\NavRight\NavRight64.dll [1008128 2015-07-09] (NavRight)
AppInit_DLLs-x32: C:\ProgramData\NavRight\NavRight32.dll => C:\ProgramData\NavRight\NavRight32.dll [804864 2015-07-09] (NavRight)
Task: C:\Windows\Tasks\AmiUpdXp.job => C:\Users\Auré\AppData\Local\7559\Updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\PCXBSEKNMU1.job => C:\ProgramData\NavRight\NavRight.exe <==== ATTENTION
Task: C:\Windows\Tasks\VYNRNXKJEKLRPWSB.job => C:\ProgramData\Service8609\Service8609.exe <==== ATTENTION
Task: {4754C6EF-5969-4DA4-9DE7-D35E776E1F01} - System32\Tasks\PCXBSEKNMU1 => C:\ProgramData\NavRight\NavRight.exe [2015-07-09] (NavRight) <==== ATTENTION
Task: {6300BC21-BCB1-4AAD-852E-86491D50C912} - System32\Tasks\VYNRNXKJEKLRPWSB => C:\ProgramData\Service8609\Service8609.exe [2015-06-28] () <==== ATTENTION
Task: {69A12E4B-FEAE-4565-8DFB-7637631559EC} - \AmiUpdXp No Task File <==== ATTENTION
Task: {712F0583-0761-43EB-811E-63C930DD02A2} - System32\Tasks\WordShark Auto Updater 1.10.0.20 Pending Update => C:\Program Files (x86)\WordShark_1.10.0.20\Update\WordSharkAutoUpdateClient.exe [2015-07-06] (WS) <==== ATTENTION
Task: {79F06A01-4989-444C-9493-3D7DBD5ACB29} - System32\Tasks\WindApp Update => C:\Users\Auré\AppData\Roaming\Store\WindApp\WindApp Update.exe [2015-03-20] (Nosibay) <==== ATTENTION
Task: {8C548EC4-9C88-4BC0-824A-6CF6ED0F2F42} - System32\Tasks\PenWes => C:\Program Files (x86)\PenWes\penwes.exe [2011-05-31] () <==== ATTENTION
Task: {C98AC647-111E-42A4-91BC-02F943AFF648} - System32\Tasks\WordShark Auto Updater 1.10.0.20 Core => C:\Program Files (x86)\WordShark_1.10.0.20\Update\WordSharkAutoUpdateClient.exe [2015-07-06] (WS) <==== ATTENTION
Task: {D3974686-0CED-4B7C-AB63-1C53B6F3DAF5} - System32\Tasks\Dlvfecrd => C:\Program Files\shopperz\Mlsaizwav.bat [2015-07-01] () <==== ATTENTION
Task: {E318DC4A-33E9-4003-B7F0-B80B2D1FA42C} - \tet3008 No Task File <==== ATTENTION
Winsock: Catalog9 01 C:\Program Files (x86)\StormWarnings\SW_Updater.dll [346928 2015-07-08] (Storm Warnings)
Winsock: Catalog9 02 C:\Program Files (x86)\StormWarnings\SW_Updater.dll [346928 2015-07-08] (Storm Warnings)
Winsock: Catalog9 03 C:\Program Files (x86)\StormWarnings\SW_Updater.dll [346928 2015-07-08] (Storm Warnings)
Winsock: Catalog9 04 C:\Program Files (x86)\StormWarnings\SW_Updater.dll [346928 2015-07-08] (Storm Warnings)
Winsock: Catalog9 05 C:\Program Files (x86)\StormWarnings\SW_Updater.dll [346928 2015-07-08] (Storm Warnings)
Winsock: Catalog9 06 C:\Windows\SysWOW64\Oexufafono.dll [278016 2015-07-10] ()
Winsock: Catalog9 07 C:\Windows\SysWOW64\Oexufafono.dll [278016 2015-07-10] ()
Winsock: Catalog9 08 C:\Windows\SysWOW64\Oexufafono.dll [278016 2015-07-10] ()
Winsock: Catalog9 09 C:\Windows\SysWOW64\Oexufafono.dll [278016 2015-07-10] ()
Winsock: Catalog9 10 C:\Program Files (x86)\StormWarnings\SW_Updater.dll [346928 2015-07-08] (Storm Warnings)
Winsock: Catalog9 11 C:\Windows\SysWOW64\Oexufafono.dll [278016 2015-07-10] ()
R2 8dadad2f-d980-4b45-ab50-b9af125601a7; C:\Program Files\shopperz\Polouxu.exe [285544 2015-07-01] ()
R2 csrcc; C:\Program Files\shopperz\csrcc.exe [1448808 2015-07-01] ()
R2 IHProtect Service; C:\Program Files (x86)\MiuiTab\ProtectService.exe [125112 2015-06-24] (XTab system)
R3 Oexufafono; C:\Program Files\shopperz\Oexufafono.exe [2020864 2015-06-23] () [File not signed]
R2 shopperz Updater; C:\Program Files\shopperz\Abwpdpquy.exe [174440 2015-07-01] ()
R2 StormWarnings Update Service; C:\Program Files (x86)\StormWarnings\StormWarningsSrv.exe [624816 2015-06-04] ()
R2 SW_Updater; C:\Program Files (x86)\StormWarnings\SW_Updater.exe [509744 2015-07-08] (Storm Warnings)
R2 UfockFuloxo; C:\Program Files\shopperz\LikumVutyp.exe [172480 2015-06-23] () [File not signed]
R2 zejytose; C:\Users\Auré\AppData\Roaming\087E14BC-1436560538-11DF-B701-7976F5AFFA82\jnsm7913.tmp [199168 2015-07-10] () [File not signed]
R1 cherimoya; C:\Windows\System32\drivers\cherimoya.sys [61336 2015-06-18] (Cherimoya Ltd)
S1 fzjbgzfa; \??\C:\Windows\system32\drivers\fzjbgzfa.sys [X]
U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X]
S1 ophjnfyk; \??\C:\Windows\system32\drivers\ophjnfyk.sys [X]
S1 vptbqyqk; \??\C:\Windows\system32\drivers\vptbqyqk.sys [X]
S1 wsfd_vt_1_10_0_20; system32\drivers\wsfd_vt_1_10_0_20.sys [X]
2015-07-10 23:13 - 2015-07-10 23:13 - 00000000 ____D C:\Users\Auré\AppData\Local\Storm_Warnings,_LLC
2015-07-10 23:12 - 2015-07-10 23:12 - 00000000 ____D C:\Users\Auré\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StormWarnings
2015-07-10 23:10 - 2015-07-13 13:50 - 00000000 ____D C:\Users\Auré\AppData\Local\gmsd_fr_005010027
2015-07-10 23:10 - 2015-07-13 11:27 - 00004664 _____ C:\Windows\SysWOW64\Oexufafono.ini
2015-07-10 23:10 - 2015-07-13 11:27 - 00002376 _____ C:\Windows\SysWOW64\OexufafonoOff.ini
2015-07-10 23:10 - 2015-07-13 11:27 - 00002376 _____ C:\Windows\system32\OexufafonoOff.ini
2015-07-10 23:10 - 2015-06-23 22:47 - 00348672 _____ C:\Windows\system32\Oexufafono64.dll
2015-07-10 23:10 - 2015-06-23 22:46 - 00278016 _____ C:\Windows\SysWOW64\Oexufafono.dll
2015-07-10 23:10 - 2002-01-01 03:33 - 00000000 ____D C:\Program Files (x86)\gmsd_fr_005010027
2015-07-10 23:09 - 2015-07-10 23:12 - 00000000 ____D C:\Program Files (x86)\StormWarnings
2015-07-10 23:09 - 2015-07-10 23:09 - 00000000 ____D C:\Users\Auré\AppData\Local\StormWarnings
2015-07-10 23:09 - 2015-07-10 23:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StormWarnings
2015-07-10 23:09 - 2015-07-10 23:09 - 00000000 _____ C:\dummy.htm
2015-07-10 23:08 - 2015-07-10 23:09 - 00000000 ____D C:\Program Files\shopperz
2015-07-10 23:08 - 2015-07-10 23:08 - 00003626 _____ C:\Windows\System32\Tasks\Dlvfecrd
2015-07-10 23:08 - 2015-07-10 23:08 - 00000000 ____D C:\Users\Auré\AppData\Roaming\mystartsearch
2015-07-10 23:08 - 2015-07-10 23:08 - 00000000 _____ C:\Windows\SysWOW64\Number of results
2015-07-10 23:08 - 2015-06-18 12:08 - 00061336 _____ (Cherimoya Ltd) C:\Windows\system32\Drivers\cherimoya.sys
2015-07-10 23:08 - 2002-01-01 03:33 - 00000000 ____D C:\Users\Auré\AppData\Local\SmartWeb
2015-07-10 22:52 - 2015-07-13 11:45 - 00000356 _____ C:\Windows\Tasks\AmiUpdXp.job
2015-07-10 22:52 - 2015-07-10 23:43 - 00000000 ____D C:\Users\Auré\AppData\Local\7559
2015-07-10 22:40 - 2015-07-10 22:40 - 00001089 _____ C:\Users\Auré\Desktop\Continue Live Installation.lnk
2015-07-10 22:37 - 2009-06-10 23:00 - 00000824 _____ C:\Windows\system32\Drivers\etc\hp.bak
2015-07-10 22:36 - 2015-07-10 23:51 - 00000000 ____D C:\Program Files (x86)\mbot_fr_014010027
2015-07-10 22:36 - 2015-07-10 22:41 - 00000000 ____D C:\Users\Auré\AppData\Local\mbot_fr_014010027
2015-07-10 22:36 - 2015-07-10 22:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MYBESTOFFERSTODAY
2015-07-10 22:35 - 2015-07-10 22:35 - 00000000 ____D C:\Users\Auré\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASPackage
2015-07-10 22:35 - 2002-01-01 00:28 - 00000000 ____D C:\Users\Auré\AppData\Roaming\ASPackage
2015-07-10 22:35 - 2002-01-01 00:28 - 00000000 ____D C:\Users\Auré\AppData\Roaming\087E14BC-1436560538-11DF-B701-7976F5AFFA82
2015-07-10 22:34 - 2015-07-10 23:09 - 00000000 ____D C:\Program Files (x86)\MiuiTab
2015-07-10 22:34 - 2015-07-10 22:34 - 00004176 _____ C:\Windows\System32\Tasks\WordShark Auto Updater 1.10.0.20 Pending Update
2015-07-10 22:34 - 2015-07-10 22:34 - 00004166 _____ C:\Windows\System32\Tasks\WordShark Auto Updater 1.10.0.20 Core
2015-07-10 22:34 - 2015-07-10 22:34 - 00000000 ____D C:\Users\Auré\AppData\Roaming\oursurfing
2015-07-10 22:34 - 2015-07-10 22:34 - 00000000 ____D C:\ProgramData\WindowsMangerProtect
2015-07-10 22:34 - 2015-07-10 22:34 - 00000000 ____D C:\ProgramData\IHProtectUpDate
2015-07-10 22:34 - 2015-07-10 22:34 - 00000000 ____D C:\Program Files (x86)\WordShark_1.10.0.20
2015-07-10 22:34 - 2015-07-10 22:34 - 00000000 _____ C:\Windows\prleth.sys
2015-07-10 22:34 - 2015-07-10 22:34 - 00000000 _____ C:\Windows\hgfs.sys
2015-07-10 22:33 - 2015-07-13 13:38 - 00000340 ____H C:\Windows\Tasks\VYNRNXKJEKLRPWSB.job
2015-07-10 22:33 - 2015-07-13 11:45 - 00000322 _____ C:\Windows\Tasks\PCXBSEKNMU1.job
2015-07-10 22:33 - 2015-07-10 22:33 - 00003372 _____ C:\Windows\System32\Tasks\VYNRNXKJEKLRPWSB
2015-07-10 22:33 - 2015-07-10 22:33 - 00002844 _____ C:\Windows\System32\Tasks\PCXBSEKNMU1
2015-07-10 22:33 - 2015-07-10 22:33 - 00000000 ____D C:\ProgramData\Service8609
2015-07-10 22:33 - 2015-07-10 22:33 - 00000000 ____D C:\ProgramData\NavRight
2015-07-10 22:33 - 2015-07-10 22:33 - 00000000 ____D C:\ProgramData\12db864551ae4c578eb17db1a9f5d3cf
2015-07-10 22:31 - 2015-07-10 22:32 - 00001305 _____ C:\Users\Auré\AppData\Roaming\Bubble Dock.boostrap.log
2015-07-10 22:31 - 2015-07-10 22:31 - 00005706 _____ C:\Users\Auré\AppData\Roaming\Bubble Dock.installation.log
2015-07-10 22:31 - 2015-07-10 22:31 - 00003736 _____ C:\Windows\System32\Tasks\Selection Tools Update
2015-07-10 22:31 - 2015-07-10 22:31 - 00003702 _____ C:\Windows\System32\Tasks\WindApp Update
2015-07-10 22:31 - 2015-07-10 22:31 - 00000097 _____ C:\Users\Auré\AppData\Roaming\WindApp.boostrap.log
2015-07-10 22:31 - 2015-07-10 22:31 - 00000078 _____ C:\Users\Auré\AppData\Roaming\WindApp.installation.log
2015-07-10 22:31 - 2015-07-10 22:31 - 00000078 _____ C:\Users\Auré\AppData\Roaming\Selection Tools.installation.log
2015-07-10 22:31 - 2015-07-10 22:31 - 00000000 ____D C:\Users\Auré\AppData\Roaming\WTools
2015-07-10 22:31 - 2015-07-10 22:31 - 00000000 ____D C:\Users\Auré\AppData\Roaming\Store
2015-07-10 22:31 - 2015-07-10 22:31 - 00000000 ____D C:\Users\Auré\AppData\Roaming\Nosibay
2015-07-10 22:31 - 2015-07-10 22:31 - 00000000 ____D C:\Users\Auré\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bubble Dock
2015-07-10 22:31 - 2015-07-10 22:31 - 00000000 ____D C:\Program Files (x86)\app_setup
cmd: netsh winsock reset

*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\upgmsd_fr_005010027.exe => value removed successfully
"C:\ProgramData\NavRight\NavRight64.dll" => value data removed successfully.
"C:\ProgramData\NavRight\NavRight32.dll" => value data removed successfully.
C:\Windows\Tasks\AmiUpdXp.job => moved successfully.
C:\Windows\Tasks\PCXBSEKNMU1.job => moved successfully.
C:\Windows\Tasks\VYNRNXKJEKLRPWSB.job => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{4754C6EF-5969-4DA4-9DE7-D35E776E1F01}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4754C6EF-5969-4DA4-9DE7-D35E776E1F01}" => key removed successfully
C:\Windows\System32\Tasks\PCXBSEKNMU1 => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PCXBSEKNMU1" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{6300BC21-BCB1-4AAD-852E-86491D50C912}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6300BC21-BCB1-4AAD-852E-86491D50C912}" => key removed successfully
C:\Windows\System32\Tasks\VYNRNXKJEKLRPWSB => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\VYNRNXKJEKLRPWSB" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{69A12E4B-FEAE-4565-8DFB-7637631559EC}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{69A12E4B-FEAE-4565-8DFB-7637631559EC}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AmiUpdXp" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{712F0583-0761-43EB-811E-63C930DD02A2}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{712F0583-0761-43EB-811E-63C930DD02A2}" => key removed successfully
C:\Windows\System32\Tasks\WordShark Auto Updater 1.10.0.20 Pending Update => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WordShark Auto Updater 1.10.0.20 Pending Update" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{79F06A01-4989-444C-9493-3D7DBD5ACB29}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{79F06A01-4989-444C-9493-3D7DBD5ACB29}" => key removed successfully
C:\Windows\System32\Tasks\WindApp Update => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WindApp Update" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{8C548EC4-9C88-4BC0-824A-6CF6ED0F2F42}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8C548EC4-9C88-4BC0-824A-6CF6ED0F2F42}" => key removed successfully
C:\Windows\System32\Tasks\PenWes => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PenWes" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{C98AC647-111E-42A4-91BC-02F943AFF648}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C98AC647-111E-42A4-91BC-02F943AFF648}" => key removed successfully
C:\Windows\System32\Tasks\WordShark Auto Updater 1.10.0.20 Core => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WordShark Auto Updater 1.10.0.20 Core" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D3974686-0CED-4B7C-AB63-1C53B6F3DAF5}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D3974686-0CED-4B7C-AB63-1C53B6F3DAF5}" => key removed successfully
C:\Windows\System32\Tasks\Dlvfecrd => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Dlvfecrd" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{E318DC4A-33E9-4003-B7F0-B80B2D1FA42C}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E318DC4A-33E9-4003-B7F0-B80B2D1FA42C}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\tet3008" => key removed successfully
Winsock: Catalog entry 000000000001 => removed successfully
Winsock: Catalog entry 000000000002 => removed successfully
Winsock: Catalog entry 000000000003 => removed successfully
Winsock: Catalog entry 000000000004 => removed successfully
Winsock: Catalog entry 000000000005 => removed successfully
Winsock: Catalog entry 000000000006 => removed successfully
Winsock: Catalog entry 000000000007 => removed successfully
Winsock: Catalog entry 000000000008 => removed successfully
Winsock: Catalog entry 000000000009 => removed successfully
Winsock: Catalog entry 000000000010 => removed successfully
Winsock: Catalog entry 000000000011 => removed successfully
8dadad2f-d980-4b45-ab50-b9af125601a7 => Service stopped successfully.
8dadad2f-d980-4b45-ab50-b9af125601a7 => Service removed successfully
csrcc => Service stopped successfully.
csrcc => Service removed successfully
IHProtect Service => Service stopped successfully.
IHProtect Service => Service removed successfully
Oexufafono => Service stopped successfully.
Oexufafono => Service removed successfully
shopperz Updater => Service stopped successfully.
shopperz Updater => Service removed successfully
StormWarnings Update Service => Service stopped successfully.
StormWarnings Update Service => Service removed successfully
SW_Updater => Service stopped successfully.
SW_Updater => Service removed successfully
UfockFuloxo => Unable to stop service.
UfockFuloxo => Service removed successfully
zejytose => Service stopped successfully.
zejytose => Service removed successfully
cherimoya => Unable to stop service.
cherimoya => Service removed successfully
fzjbgzfa => Service removed successfully
klkbdflt2 => Service could not remove
ophjnfyk => Service removed successfully
vptbqyqk => Service removed successfully
wsfd_vt_1_10_0_20 => Service removed successfully
C:\Users\Auré\AppData\Local\Storm_Warnings,_LLC => moved successfully.
C:\Users\Auré\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StormWarnings => moved successfully.
C:\Users\Auré\AppData\Local\gmsd_fr_005010027 => moved successfully.
C:\Windows\SysWOW64\Oexufafono.ini => moved successfully.
C:\Windows\SysWOW64\OexufafonoOff.ini => moved successfully.
C:\Windows\system32\OexufafonoOff.ini => moved successfully.
C:\Windows\system32\Oexufafono64.dll => moved successfully.
C:\Windows\SysWOW64\Oexufafono.dll => moved successfully.
C:\Program Files (x86)\gmsd_fr_005010027 => moved successfully.
C:\Program Files (x86)\StormWarnings => moved successfully.
C:\Users\Auré\AppData\Local\StormWarnings => moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StormWarnings => moved successfully.
C:\dummy.htm => moved successfully.

"C:\Program Files\shopperz" folder move:

Could not move "C:\Program Files\shopperz" folder => Scheduled to move on reboot.

"C:\Windows\System32\Tasks\Dlvfecrd" => File/Folder not found.
C:\Users\Auré\AppData\Roaming\mystartsearch => moved successfully.
C:\Windows\SysWOW64\Number of results => moved successfully.
C:\Windows\system32\Drivers\cherimoya.sys => moved successfully.
C:\Users\Auré\AppData\Local\SmartWeb => moved successfully.
"C:\Windows\Tasks\AmiUpdXp.job" => File/Folder not found.
C:\Users\Auré\AppData\Local\7559 => moved successfully.
C:\Users\Auré\Desktop\Continue Live Installation.lnk => moved successfully.
C:\Windows\system32\Drivers\etc\hp.bak => moved successfully.
C:\Program Files (x86)\mbot_fr_014010027 => moved successfully.
C:\Users\Auré\AppData\Local\mbot_fr_014010027 => moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MYBESTOFFERSTODAY => moved successfully.
C:\Users\Auré\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASPackage => moved successfully.
C:\Users\Auré\AppData\Roaming\ASPackage => moved successfully.
C:\Users\Auré\AppData\Roaming\087E14BC-1436560538-11DF-B701-7976F5AFFA82 => moved successfully.
C:\Program Files (x86)\MiuiTab => moved successfully.
"C:\Windows\System32\Tasks\WordShark Auto Updater 1.10.0.20 Pending Update" => File/Folder not found.
"C:\Windows\System32\Tasks\WordShark Auto Updater 1.10.0.20 Core" => File/Folder not found.
C:\Users\Auré\AppData\Roaming\oursurfing => moved successfully.
C:\ProgramData\WindowsMangerProtect => moved successfully.
C:\ProgramData\IHProtectUpDate => moved successfully.

"C:\Program Files (x86)\WordShark_1.10.0.20" folder move:

Could not move "C:\Program Files (x86)\WordShark_1.10.0.20" folder => Scheduled to move on reboot.

C:\Windows\prleth.sys => moved successfully.
C:\Windows\hgfs.sys => moved successfully.
"C:\Windows\Tasks\VYNRNXKJEKLRPWSB.job" => File/Folder not found.
"C:\Windows\Tasks\PCXBSEKNMU1.job" => File/Folder not found.
"C:\Windows\System32\Tasks\VYNRNXKJEKLRPWSB" => File/Folder not found.
"C:\Windows\System32\Tasks\PCXBSEKNMU1" => File/Folder not found.

"C:\ProgramData\Service8609" folder move:

Could not move "C:\ProgramData\Service8609" folder => Scheduled to move on reboot.

"C:\ProgramData\NavRight" folder move:

Could not move "C:\ProgramData\NavRight" folder => Scheduled to move on reboot.

C:\ProgramData\12db864551ae4c578eb17db1a9f5d3cf => moved successfully.
C:\Users\Auré\AppData\Roaming\Bubble Dock.boostrap.log => moved successfully.
C:\Users\Auré\AppData\Roaming\Bubble Dock.installation.log => moved successfully.
C:\Windows\System32\Tasks\Selection Tools Update => moved successfully.
"C:\Windows\System32\Tasks\WindApp Update" => File/Folder not found.
C:\Users\Auré\AppData\Roaming\WindApp.boostrap.log => moved successfully.
C:\Users\Auré\AppData\Roaming\WindApp.installation.log => moved successfully.
C:\Users\Auré\AppData\Roaming\Selection Tools.installation.log => moved successfully.

"C:\Users\Auré\AppData\Roaming\WTools" folder move:

Could not move "C:\Users\Auré\AppData\Roaming\WTools" folder => Scheduled to move on reboot.

"C:\Users\Auré\AppData\Roaming\Store" folder move:

Could not move "C:\Users\Auré\AppData\Roaming\Store" folder => Scheduled to move on reboot.

C:\Users\Auré\AppData\Roaming\Nosibay => moved successfully.
C:\Users\Auré\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bubble Dock => moved successfully.
C:\Program Files (x86)\app_setup => moved successfully.

========= netsh winsock reset =========

Le catalogue Winsock a �t� r�initialis� correctement.
Vous devez red�marrer l'ordinateur afin de finaliser la r�initialisation.

========= End of CMD: =========

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2015-07-13 23:26:35)<=

C:\Program Files\shopperz => Is moved successfully
C:\Program Files (x86)\WordShark_1.10.0.20 => Is moved successfully
C:\ProgramData\Service8609 => Is moved successfully
C:\ProgramData\NavRight => Is moved successfully
C:\Users\Auré\AppData\Roaming\WTools => Is moved successfully
C:\Users\Auré\AppData\Roaming\Store => Is moved successfully

==== End of Fixlog 23:26:35 ====

Et, miracle, google chrome s'ouvre a nouveau ! Mais effectivement j'ai une nouvelle page d'accueil...

[Malekal_morte]

Finis par un nettoyage Malwarebyte : https://www.malekal.com/malwarebyte-ant ... les-virus/

Voila, c'est terminé, tu peux supprimer les programmes utilisés.

Quelques conseils :


Pour prévenir les sites malicieux, tu peux installer Blockulicious : http://forum.malekal.com/blockulicious- ... 46656.html


Pour ne plus te faire avoir.
A lire - Programmes parasites / PUPs : https://www.malekal.com/adwares-pup-protection/
(Surtout active les détections LPIs pour détecter les programmes parasites et publicitaires)


Le reste de la sécurité : http://forum.malekal.com/comment-securi ... ateur.html

[Vallis]

Bon et bien voila, nettoyage Malwarebyte effectué avec 283 fichiers supprimés...

J 'ai installé AVG, Blockulicious, ScriptSafe, et changé mon compte administrateur en compte standard
J'espère être un peu plus tranquille !

Merci beaucoup pour ton aide, tes conseils et tous les tutos très bien faits !

[Malekal_morte]