Supprimer mystart / Searchinme / luckystarting

Aide à la désinfection pour supprimer les virus, adwares, ransomwares, trojans.

Modérateurs : Mods Windows, Helper

Brouette

Supprimer mystart / Searchinme / luckystarting

par Brouette »

Message par Brouette » 13 avr. 2017 08:45

Bonjour,

Voilà trois semaines que j'ai remarqué avoir été infecté pour la première fois par Luckystarting. J'ai suivi les tutoriels de votre site avec adwcleaner, malware bytes, etc, ce qui a semblé fonctionné.

Puis quelques jours plus tard un nouveau malware est apparu, et en vérifiant le dossier programfiles j'ai constaté que pleins de petit logiciels s'étaient à nouveau installés. J'ai donc recommencé le nettoyage mais même résultat.

auriez vous une solution?


Merci d'avance
Haut
Avatar de l’utilisateur
angelique
Messages : 31840
Inscription : 28 févr. 2008 13:58
Localisation : Breizhilienne

Re: Supprimer mystart / Searchinme / luckystarting

par angelique »

Bonjour,

  • Télécharge sur ton Bureau pas ailleurs FRST.EXE:



    La page de téléchargement : le tutoriel FRST




    !! Placez le programme sur le bureau et pas ailleurs!!
  • Exécute FRST.EXE, accepte le disclaimer , Cochez tous les options et cliquez sur le bouton Scan.
    Le scan se lance, les éléments scannés apparaissent en haut.
  • Une fois le scan terminé, une popup vous le signale et deux rapports sont générés : FRST.txt et Addition.txt ( Ces deux rapports se trouvent sur le bureau avec le programme FRST. )


    Utilise le site http://pjjoint.malekal.com/ pour envoyer ton rapport, et poste le lien dans ta prochaine réponse pour analyse.
Avec Gnu_Linux t'as un Noyau ... avec Ѡindows t'as que les pépins
https://helicium.altervista.org/
Supprimer les "virus" gratuitement http://www.supprimer-trojan.com/
Un p'tit Don à Angélique PDT_018 Merci.
Image
Haut
Brouette

Re: Supprimer mystart / Searchinme / luckystarting

par Brouette »

Bonjour,

Merci beaucoup pour votre aide. Voici les liens des deux documents du scan:

http://pjjoint.malekal.com/files.php?id ... v6o15f7g11
http://pjjoint.malekal.com/files.php?id ... 15g12k5p14
Haut
Avatar de l’utilisateur
angelique
Messages : 31840
Inscription : 28 févr. 2008 13:58
Localisation : Breizhilienne

Re: Supprimer mystart / Searchinme / luckystarting

par angelique »

Désinstalle si tu peux,via programmes et fonctionnalités, sinon continue:

Social2Search (HKLM\...\3d7ef63e8d0abe261452695e527abe5a) (Version: 11.13.1.23 (i1.0) - Social2Search) <==== ATTENTION

youndoo - Uninstall (HKLM-x32\...\{CD5FE113-DA36-4A7F-A871-E135C27ABF41}) (Version: - ) <==== ATTENTION

  • Ouvre le bloc-notes : Menu Démarrer / Tous les programmes / Accessoires et Bloc-Notes. (ou executer➫notepad)
    Copie/colle dedans ce qui suit :

    Code : Tout sélectionner

    HKU\S-1-5-21-3782603650-300011118-2582287585-1002\...\Run: [cacaoweb] => C:\Users\Sacha\AppData\Roaming\cacaoweb\cacaoweb.exe [568624 2017-04-02] ()
HKLM\...\Providers\2comkcvx: C:\Program Files (x86)\Baduvivuph Core\local64spl.dll
ShellExecuteHooks: Pas de nom - {C0FAA170-038A-11E7-9D7F-64006A5CFC23} - C:\Users\Sacha\AppData\Roaming\Aterhiyzuqek\Bawation.dll -> Pas de fichier
ShellExecuteHooks: Pas de nom - {522E1946-038B-11E7-BBEE-64006A5CFC23} - C:\Users\Sacha\AppData\Roaming\Shjuch\Gahokclwos.dll -> Pas de fichier
HKU\S-1-5-21-3782603650-300011118-2582287585-1002\...\ChromeHTML: -> C:\Program Files (x86)\Pearness\Application\chrome.exe (Google Inc.) <==== ATTENTION
HKU\S-1-5-21-3782603650-300011118-2582287585-1002\...\StartMenuInternet\ChromeHTML: -> C:\Program Files (x86)\Pearness\Application\chrome.exe (Google Inc.) <==== ATTENTION
Task: {0060A095-51C7-4E10-83D8-915C728DB3D8} - System32\Tasks\Traffic Exchange v2 - 1 => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe  <==== ATTENTION
Task: {1755E037-24CE-4E82-8731-54ABAFC1A117} - System32\Tasks\Online Application v209 Guardian => C:\Program Files (x86)\Microleaves\Online.io Application\Online-Guardian-v2.0.9.exe  <==== ATTENTION
Task: {3A44CEC3-AEE7-46A7-AF92-2F576C326F53} - System32\Tasks\Reuksy => "msiexec" /i hxxp://d2buh1bf1g584w.cloudfront.net/msi/rel.php?u=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55&v=20170314 /q <==== ATTENTION
Task: {3C41855E-FBCC-4282-8F79-6737D8C29F65} - System32\Tasks\Stitught Adapter => C:\Program Files (x86)\Grtase\xgerjaph.exe 
Task: {40BC6381-BD0E-4DB7-818D-C641672F9724} - System32\Tasks\Online Application v209 Guard => C:\Program Files (x86)\Microleaves\Online.io Application\Online-Guardian-v2.0.9.exe  <==== ATTENTION
Task: {6105DFCC-0318-4682-A062-AC423BBF9D15} - System32\Tasks\Samsung Update => msiexec /i hxxp://D2Buh1bF1G584W.CLouDfRoNT.net/mmtsk/occup.php?p=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55&d=20170413 /q
Task: {61A7E922-1F44-4DBC-95CB-12A95D150509} - System32\Tasks\Milimili => C:\Program Files (x86)\MIO\MIO.exe [2017-04-13] ()
Task: {68F1A4EE-DC5B-4753-AED1-97D67A20A901} - System32\Tasks\Traffic Exchange v209 - 1 => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe  <==== ATTENTION
Task: {69F5A00C-65A9-4CD2-97B2-9FB7E0CBD2BC} - System32\Tasks\Traffic Exchange v209 - 2 => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe  <==== ATTENTION
Task: {719DD087-F6A0-4CD7-A6DC-1ABE5199E66A} - System32\Tasks\Traffic Exchange v2 - 3 => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe  <==== ATTENTION
Task: {A51CB716-4971-444B-92B6-683B83A46AA5} - System32\Tasks\Baduvivuph Core => C:\Program Files (x86)\Grtase\xfulerse.exe 
Task: {AEC0ADC7-A920-48D2-863C-89154AB09ECC} - System32\Tasks\Traffic Exchange v2 - 2 => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe  <==== ATTENTION
Task: {C5132CB2-867F-48AE-8D11-649DF5A3F6FC} - System32\Tasks\Windows-PG => powershell.exe C:\Update\psgo\psgo.ps1
Task: {D5C06E80-B084-4537-A503-5C967190F776} - System32\Tasks\Traffic Exchange v209 - 3 => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe  <==== ATTENTION
Task: {D6E61843-28B9-4A59-AC41-D25DF770A344} - System32\Tasks\Online Application v209 => C:\Program Files (x86)\Microleaves\Online.io Application\Online-Guardian-v2.0.9.exe  <==== ATTENTION
Task: C:\Windows\Tasks\Online Application v209 Guard.job => C:\Program Files (x86)\Microleaves\Online.io Application\Online-Guardian-v2.0.9.exe <==== ATTENTION
Task: C:\Windows\Tasks\Online Application v209 Guardian.job => C:\Program Files (x86)\Microleaves\Online.io Application\Online-Guardian-v2.0.9.exe <==== ATTENTION
Task: C:\Windows\Tasks\Online Application v209.job => C:\Program Files (x86)\Microleaves\Online.io Application\Online-Guardian-v2.0.9.exe <==== ATTENTION
Task: C:\Windows\Tasks\Traffic Exchange v2 - 1.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe <==== ATTENTION
Task: C:\Windows\Tasks\Traffic Exchange v2 - 2.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe <==== ATTENTION
Task: C:\Windows\Tasks\Traffic Exchange v2 - 3.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe <==== ATTENTION
Task: C:\Windows\Tasks\Traffic Exchange v209 - 1.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe <==== ATTENTION
Task: C:\Windows\Tasks\Traffic Exchange v209 - 2.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe <==== ATTENTION
Task: C:\Windows\Tasks\Traffic Exchange v209 - 3.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe <==== ATTENTION
Shortcut: C:\Users\Sacha\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Pearness\Application\chrome.exe (Google Inc.)
Shortcut: C:\Users\Sacha\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Pearness\Application\chrome.exe (Google Inc.)
Shortcut: C:\Users\Sacha\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\225bb61db2f318c1\Google Chrome.lnk -> C:\Program Files (x86)\Pearness\Application\chrome.exe (Google Inc.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Pearness\Application\chrome.exe (Google Inc.)
Shortcut: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Pearness\Application\chrome.exe (Google Inc.)
ShortcutWithArgument: C:\Users\Sacha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.startpageing123.com/?type=sc&ts=1490022578&z=128cdd5221c8d022d18bc7ag0z8tde8eeobo8wfmew&from=che0812&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55
ShortcutWithArgument: C:\Users\Sacha\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.startpageing123.com/?type=sc&ts=1490022578&z=128cdd5221c8d022d18bc7ag0z8tde8eeobo8wfmew&from=che0812&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.startpageing123.com/?type=hp&ts=1490771989&z=e6193d5ae10d635f840815fg7zatcecmdmeg8t3bem&from=che0812&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.startpageing123.com/?type=hp&ts=1490771989&z=e6193d5ae10d635f840815fg7zatcecmdmeg8t3bem&from=che0812&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.startpageing123.com/search/?type=ds&ts=1490022578&z=128cdd5221c8d022d18bc7ag0z8tde8eeobo8wfmew&from=che0812&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.startpageing123.com/search/?type=ds&ts=1490022578&z=128cdd5221c8d022d18bc7ag0z8tde8eeobo8wfmew&from=che0812&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.startpageing123.com/?type=hp&ts=1490771989&z=e6193d5ae10d635f840815fg7zatcecmdmeg8t3bem&from=che0812&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.startpageing123.com/?type=hp&ts=1490771989&z=e6193d5ae10d635f840815fg7zatcecmdmeg8t3bem&from=che0812&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.startpageing123.com/search/?type=ds&ts=1490022578&z=128cdd5221c8d022d18bc7ag0z8tde8eeobo8wfmew&from=che0812&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.startpageing123.com/search/?type=ds&ts=1490022578&z=128cdd5221c8d022d18bc7ag0z8tde8eeobo8wfmew&from=che0812&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55&q={searchTerms}
HKU\S-1-5-21-3782603650-300011118-2582287585-1002\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.startpageing123.com/search/?type=ds&ts=1490771989&z=e6193d5ae10d635f840815fg7zatcecmdmeg8t3bem&from=che0812&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55&q={searchTerms}
HKU\S-1-5-21-3782603650-300011118-2582287585-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.startpageing123.com/?type=hp&ts=1490771989&z=e6193d5ae10d635f840815fg7zatcecmdmeg8t3bem&from=che0812&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55
HKU\S-1-5-21-3782603650-300011118-2582287585-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.startpageing123.com/?type=hp&ts=1490771989&z=e6193d5ae10d635f840815fg7zatcecmdmeg8t3bem&from=che0812&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55
HKU\S-1-5-21-3782603650-300011118-2582287585-1002\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.startpageing123.com/search/?type=ds&ts=1490771989&z=e6193d5ae10d635f840815fg7zatcecmdmeg8t3bem&from=che0812&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55&q={searchTerms}
URLSearchHook: [S-1-5-21-3782603650-300011118-2582287585-1001] ATTENTION => URLSearchHook par défaut est absent
FF NewTab: Mozilla\Firefox\Profiles\zcZZbPIG.default -> hxxp://www.youndoo.com/?z=050d8eeb81eb01589c3233ag5z9b2taw3ebeag4b9g&from=cmefy&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55&type=hp
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\zcZZbPIG.default -> youndoo
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\zcZZbPIG.default -> youndoo
FF Homepage: Mozilla\Firefox\Profiles\zcZZbPIG.default -> hxxp://www.startpageing123.com/?type=hp&ts=1490022578&z=128cdd5221c8d022d18bc7ag0z8tde8eeobo8wfmew&from=che0812&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55
FF NewTab: Firefox\Firefox\Profiles\zcZZbPIG.default -> hxxp://www.youndoo.com/?z=050d8eeb81eb01589c3233ag5z9b2taw3ebeag4b9g&from=cmefy&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55&type=hp
FF SelectedSearchEngine: Firefox\Firefox\Profiles\zcZZbPIG.default -> youndoo
FF Extension: (SimilarWeb) - C:\Users\Sacha\AppData\Roaming\Firefox\Firefox\Profiles\zcZZbPIG.default\Extensions\@DA3566E2-F709-11E5-8E87-A604BC8E7F8B.xpi [2017-04-08] [non signé]
FF Extension: (FF Adr) - C:\Users\Sacha\AppData\Roaming\Firefox\Firefox\Profiles\zcZZbPIG.default\Extensions\@H99KV4DO-UCCF-9PFO-9ZLK-8RRP4FVOKD9O.xpi [2017-03-23] [non signé]
FF Extension: (Français Language Pack) - C:\Users\Sacha\AppData\Roaming\Firefox\Firefox\Profiles\zcZZbPIG.default\Extensions\[email protected] [2017-04-11] [non signé]
FF SearchPlugin: C:\Users\Sacha\AppData\Roaming\Firefox\Firefox\Profiles\zcZZbPIG.default\searchplugins\startpageing123.xml [2017-03-20]
FF SearchPlugin: C:\Users\Sacha\AppData\Roaming\Firefox\Firefox\Profiles\zcZZbPIG.default\searchplugins\startsearch.xml [2017-04-11]
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor => non trouvé(e)
StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.startpageing123.com/?type=sc&ts=1490022578&z=128cdd5221c8d022d18bc7ag0z8tde8eeobo8wfmew&from=che0812&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55
CHR HomePage: Default -> hxxp://www.startpageing123.com/?type=hp&ts=1490022578&z=128cdd5221c8d022d18bc7ag0z8tde8eeobo8wfmew&from=che0812&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55
CHR StartupUrls: Default -> "hxxp://www.startpageing123.com/?type=hp&ts=1490022578&z=128cdd5221c8d022d18bc7ag0z8tde8eeobo8wfmew&from=che0812&uid=WDCXWD10JPVX-22JC3T0_WD-WXE1E24EPJ55EPJ55"
R2 Installer; C:\Users\Sacha\AppData\Local\Temp\ds93_l\DisplayService.exe [8192 2017-03-06] () [Fichier non signé] <==== ATTENTION
R2 Kitty; C:\Users\Sacha\AppData\Local\Kitty\cat.exe [230912 2017-04-13] (kitty.exe) [Fichier non signé]
R2 WinSAPSvc; C:\Users\Sacha\AppData\Roaming\WinSAPSvc\WinSAP.dll [553984 2017-04-13] (winsap) [Fichier non signé]
S2 WINSNARE; C:\Windows\System32\svchost.exe [38792 2014-10-29] (Microsoft Corporation) <==== ATTENTION
S2 WINSNARE; C:\Windows\SysWOW64\svchost.exe [33088 2014-10-29] (Microsoft Corporation) <==== ATTENTION
S2 ed2kidle; "C:\Program Files (x86)\amulell\ed2k.exe" -downloadwhenidle [X]
S2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\siteadvisor\mcsacore.exe [X]
S1 p1490022294am; \??\C:\Users\Sacha\AppData\Local\Temp\bk9521.tmp\p1490022294am.sys [X] <==== ATTENTION
S1 p1490262950am; \??\C:\Users\Sacha\AppData\Local\Temp\bk1A4D.tmp\p1490262950am.sys [X] <==== ATTENTION
S1 p1490771687am; \??\C:\Users\Sacha\AppData\Local\Temp\bkDA08.tmp\p1490771687am.sys [X] <==== ATTENTION
S1 p1490853658am; \??\C:\Users\Sacha\AppData\Local\Temp\bk9990.tmp\p1490853658am.sys [X] <==== ATTENTION
S1 p1490853713am; \??\C:\Users\Sacha\AppData\Local\Temp\bk778C.tmp\p1490853713am.sys [X] <==== ATTENTION
S1 p1490853770am; \??\C:\Users\Sacha\AppData\Local\Temp\bk5142.tmp\p1490853770am.sys [X] <==== ATTENTION
2017-04-13 08:07 - 2017-04-13 08:07 - 00003966 _____ C:\Windows\System32\Tasks\Samsung Update
2017-04-13 08:06 - 2017-04-13 08:06 - 00003502 _____ C:\Windows\System32\Tasks\Windows-PG
2017-04-13 08:06 - 2017-04-13 08:06 - 00000000 ____D C:\Users\Sacha\AppData\Roaming\WinSAPSvc
2017-04-13 08:06 - 2017-04-13 08:06 - 00000000 ____D C:\Users\Sacha\AppData\Local\SNARE
2017-04-13 08:06 - 2017-04-13 08:06 - 00000000 ____D C:\Users\Sacha\AppData\Local\Kitty
2017-04-12 18:22 - 2017-04-12 18:22 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign9ffc614658b6456b
2017-04-12 18:21 - 2017-04-12 18:21 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignb196e08234d68a05
2017-04-12 18:00 - 2017-04-12 18:00 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigne734efb656c390a8
2017-04-12 17:59 - 2017-04-12 17:59 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign60bb0720355af7c4
2017-04-12 09:12 - 2017-04-12 09:12 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignb712d1a678369c81
2017-04-12 09:12 - 2017-04-12 09:12 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign9c1a0ec7c207798b
2017-04-12 09:11 - 2017-04-12 09:11 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign71a039fd54639a27
2017-04-10 18:49 - 2017-04-10 18:49 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign029eb705d86b4bb5
2017-04-10 14:05 - 2017-04-10 14:05 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign941552b2906fef9d
2017-04-10 14:05 - 2017-04-10 14:05 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign57b7fc75da6a6151
2017-04-10 14:05 - 2017-04-10 14:05 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign4e9691953b7bfe3d
2017-04-06 17:08 - 2017-04-06 17:08 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigne81e0c559c7cb37f
2017-04-06 17:08 - 2017-04-06 17:08 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigne11a5192144d98e8
2017-04-06 17:08 - 2017-04-06 17:08 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignba2a863b51d25934
2017-04-05 15:32 - 2017-04-05 15:32 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignc034839ace82b3c0
2017-04-05 15:32 - 2017-04-05 15:32 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign7131d0050fd6dc76
2017-04-05 15:31 - 2017-04-05 15:31 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignd7d8bfc2a148fa3e
2017-04-05 09:57 - 2017-04-05 09:57 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign7846fdf3bc6fbc04
2017-04-05 09:57 - 2017-04-05 09:57 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign5197e762604d2244
2017-04-05 09:56 - 2017-04-05 09:56 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign07a0b4411dabae59
2017-04-03 13:40 - 2017-04-03 13:40 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign1ab998e58858f8c4
2017-04-03 13:30 - 2017-04-03 13:30 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigncbb225361e5a5d76
2017-04-03 13:29 - 2017-04-03 13:29 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign9725762e4344a35d
2017-03-30 23:44 - 2017-03-30 23:44 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignd8bea7392617847f
2017-03-30 23:44 - 2017-03-30 23:44 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign86c7ea12dac567b2
2017-03-30 23:44 - 2017-03-30 23:44 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign75f6c4998c082b17
2017-03-30 08:06 - 2017-03-30 08:06 - 00000000 ____D C:\Update
2017-03-28 02:55 - 2017-03-28 02:55 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignbd4a8b169ee40ecd
2017-03-28 02:55 - 2017-03-28 02:55 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignaabc676f382162ca
2017-03-28 02:55 - 2017-03-28 02:55 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign89a6efd60ef3120e
2017-03-27 15:41 - 2017-03-27 15:41 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigne8ca795bdc2b19ba
2017-03-27 15:41 - 2017-03-27 15:41 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigncec005f655c93744
2017-03-27 15:40 - 2017-03-27 15:40 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign0434878bb9d6c35f
2017-03-27 10:15 - 2017-03-27 10:15 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignc506d8a9b25cecbc
2017-03-27 10:15 - 2017-03-27 10:15 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign078e84a55b95281c
2017-03-24 14:24 - 2017-03-24 14:24 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign457807443471c713
2017-03-24 14:24 - 2017-03-24 14:24 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign41ea8318219d0cca
2017-03-24 14:22 - 2017-04-06 14:09 - 00000000 _____ C:\Windows\SysWOW64\4
2017-03-24 14:22 - 2017-04-01 17:33 - 00000000 _____ C:\Windows\SysWOW64\3
2017-03-24 14:19 - 2017-03-24 14:19 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignafe047a17b0a7d27
2017-03-24 14:19 - 2017-03-24 14:19 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign54fe8ef8cec9da92
2017-03-24 14:19 - 2017-03-24 14:19 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign07d499d553e6bdd5
2017-03-24 14:08 - 2017-03-24 14:08 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigncc033d19ad1c6280
2017-03-24 14:07 - 2017-03-24 14:34 - 00329973 _____ C:\Users\Sacha\Desktop\mug.ai
2017-03-24 13:48 - 2017-03-24 13:48 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign786f0b83c6e512cd
2017-03-24 13:48 - 2017-03-24 13:48 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign3fea72d2dca6c69f
2017-03-24 13:46 - 2017-03-24 13:46 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign89c21237455ff90e
2017-03-24 13:46 - 2017-03-24 13:46 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign837bf779fa0044d4
2017-03-24 13:46 - 2017-03-24 13:46 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign00b7b42b1d2cbbd5
2017-03-24 12:16 - 2017-03-24 12:16 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigne2de6c435dd632b9
2017-03-24 12:07 - 2017-03-24 12:07 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignd2bc2d9fa987f284
2017-03-24 12:07 - 2017-03-24 12:07 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign6c7f196e3d1a2556
2017-03-24 12:06 - 2017-03-24 12:06 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigna627f95affca64f1
2017-03-24 12:06 - 2017-03-24 12:06 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign4f47ed326a8b553b
2017-03-23 23:24 - 2017-03-23 23:24 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign9f79ab965499d946
2017-03-23 23:24 - 2017-03-23 23:24 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign90bf351e6b44162c
2017-03-23 23:24 - 2017-03-23 23:24 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign79aede643a0c9f9c
2017-03-23 18:33 - 2017-03-23 18:33 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignd895b9cb48d92fbe
2017-03-23 18:33 - 2017-03-23 18:33 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign81c3ebb13a0faa98
2017-03-23 18:33 - 2017-03-23 18:33 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign60cc2f5249d4e039
2017-03-23 17:31 - 2017-03-23 17:31 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2017-03-23 17:23 - 2017-03-23 17:23 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign5bdb437bc66abccb
2017-03-23 17:23 - 2017-03-23 17:23 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign17ec564cb48b2f2d
2017-03-23 17:23 - 2017-03-23 17:23 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign1216ed54cded6c73
2017-03-23 17:10 - 2017-03-23 17:10 - 00000000 ____D C:\Users\Sacha\AppData\Local\Pearness
2017-03-23 17:09 - 2017-03-23 17:09 - 00000000 ____D C:\Users\Sacha\AppData\Roaming\Firefox
2017-03-23 17:09 - 2017-03-23 17:09 - 00000000 ____D C:\Users\Sacha\AppData\Local\Firefox
2017-03-23 17:09 - 2017-03-23 17:09 - 00000000 ____D C:\Program Files (x86)\Pearness
2017-03-23 17:01 - 2017-04-13 10:21 - 00000000 _____ C:\Users\Public\Documents\report.dat
2017-03-23 16:57 - 2017-04-05 18:07 - 00000000 ____D C:\Program Files (x86)\deskapp
2017-03-23 12:04 - 2017-03-23 12:04 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignf17a2dee1f2decc0
2017-03-23 12:04 - 2017-03-23 12:04 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignc973286b58a10250
2017-03-23 12:04 - 2017-03-23 12:04 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign3fdb8be7fd092e29
2017-03-23 12:00 - 2017-04-05 08:51 - 00000000 ____D C:\Program Files (x86)\amulell
2017-03-22 18:35 - 2017-03-22 18:35 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigna5185ae915fa0eda
2017-03-22 12:52 - 2017-03-22 12:52 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignf212a5dfbfa8d766
2017-03-22 12:52 - 2017-03-22 12:52 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignd01248fb36fa2f6b
2017-03-22 12:52 - 2017-03-22 12:52 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign62cb8b2d241c8148
2017-03-22 09:48 - 2017-03-22 09:48 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign51639504a8c90a4f
2017-03-22 09:48 - 2017-03-22 09:48 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign41c6a140fe048314
2017-03-22 09:48 - 2017-03-22 09:48 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign037ceb479d7dade8
2017-03-21 22:58 - 2017-03-21 22:58 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignaeb60f15abc54494
2017-03-21 22:58 - 2017-03-21 22:58 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign327b1e15b122145b
2017-03-21 22:57 - 2017-03-21 22:57 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign3fe3bcb7fbdecca4
2017-03-17 15:47 - 2017-04-13 08:06 - 00003596 _____ C:\Windows\System32\Tasks\Milimili
2017-03-17 15:47 - 2017-04-01 22:58 - 00000000 ____D C:\Program Files (x86)\BikaQRss
2017-03-17 15:47 - 2017-03-17 15:47 - 00000000 ____D C:\Program Files (x86)\MIO
2017-03-17 15:41 - 2017-04-05 16:35 - 00000000 ____D C:\Program Files (x86)\MK
2017-03-16 11:02 - 2017-03-16 11:02 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign8faa21efcb7aecb1
2017-03-16 11:02 - 2017-03-16 11:02 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign7885a151b4abe7c4
2017-03-16 11:02 - 2017-03-16 11:02 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign59a96b7a56a277a5
2017-03-14 16:03 - 2017-04-13 08:06 - 00000000 ____D C:\Program Files (x86)\Mokagecerpuly
2017-03-14 16:03 - 2017-03-14 16:09 - 00000000 ____D C:\Users\Sacha\AppData\Local\Shokerchcoagerk
2017-03-14 16:02 - 2017-03-14 16:02 - 00005068 _____ C:\Windows\System32\Tasks\Reuksy
2017-03-14 15:21 - 2017-03-14 15:21 - 00006068 _____ C:\Windows\System32\Tasks\Stitught Adapter
2017-03-14 14:25 - 2017-03-16 21:36 - 00000000 ____D C:\AdwCleaner
2017-03-13 00:27 - 2017-03-13 00:27 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign8b92dfca2803fc83
2017-03-13 00:27 - 2017-03-13 00:27 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign4dd8b5d8d31e9f2b
2017-03-13 00:25 - 2017-03-13 00:25 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign91801d973959513f
2017-03-12 16:21 - 2017-03-12 16:21 - 00000000 ____D C:\Users\Sacha\AppData\Roaming\FiraxisLive
2017-03-12 14:02 - 2017-04-13 11:12 - 00000360 _____ C:\Windows\Tasks\Online Application v209 Guardian.job
2017-03-12 14:02 - 2017-04-13 11:12 - 00000360 _____ C:\Windows\Tasks\Online Application v209 Guard.job
2017-03-12 14:02 - 2017-04-13 11:12 - 00000350 _____ C:\Windows\Tasks\Traffic Exchange v209 - 3.job
2017-03-12 14:02 - 2017-04-13 11:12 - 00000350 _____ C:\Windows\Tasks\Traffic Exchange v209 - 2.job
2017-03-12 14:02 - 2017-04-13 11:12 - 00000350 _____ C:\Windows\Tasks\Traffic Exchange v209 - 1.job
2017-03-12 14:02 - 2017-04-13 11:12 - 00000340 _____ C:\Windows\Tasks\Traffic Exchange v2 - 3.job
2017-03-12 14:02 - 2017-04-13 11:12 - 00000340 _____ C:\Windows\Tasks\Traffic Exchange v2 - 2.job
2017-03-12 14:02 - 2017-04-13 11:12 - 00000340 _____ C:\Windows\Tasks\Traffic Exchange v2 - 1.job
2017-03-12 14:02 - 2017-03-12 14:02 - 00003166 _____ C:\Windows\System32\Tasks\Online Application v209 Guardian
2017-03-12 14:02 - 2017-03-12 14:02 - 00003166 _____ C:\Windows\System32\Tasks\Online Application v209 Guard
2017-03-12 14:02 - 2017-03-12 14:02 - 00003156 _____ C:\Windows\System32\Tasks\Traffic Exchange v209 - 3
2017-03-12 14:02 - 2017-03-12 14:02 - 00003156 _____ C:\Windows\System32\Tasks\Traffic Exchange v209 - 2
2017-03-12 14:02 - 2017-03-12 14:02 - 00003156 _____ C:\Windows\System32\Tasks\Traffic Exchange v209 - 1
2017-03-12 14:02 - 2017-03-12 14:02 - 00003146 _____ C:\Windows\System32\Tasks\Traffic Exchange v2 - 3
2017-03-12 14:02 - 2017-03-12 14:02 - 00003146 _____ C:\Windows\System32\Tasks\Traffic Exchange v2 - 2
2017-03-12 14:02 - 2017-03-12 14:02 - 00003146 _____ C:\Windows\System32\Tasks\Traffic Exchange v2 - 1
2017-03-12 14:01 - 2017-04-13 11:12 - 00000360 _____ C:\Windows\Tasks\Online Application v209.job
2017-03-12 14:01 - 2017-03-12 14:02 - 00000000 ____D C:\Users\Default\AppData\Local\AdvinstAnalytics
2017-03-12 14:01 - 2017-03-12 14:02 - 00000000 ____D C:\Users\Default User\AppData\Local\AdvinstAnalytics
2017-03-12 14:01 - 2017-03-12 14:01 - 00037552 _____ (Basil) C:\Windows\system32\Drivers\WinDivert64.sys
2017-03-12 14:01 - 2017-03-12 14:01 - 00003166 _____ C:\Windows\System32\Tasks\Online Application v209
2017-03-12 13:55 - 2017-03-16 21:36 - 00000000 ____D C:\Program Files (x86)\h6imf83GOa
2017-03-12 13:54 - 2017-03-12 13:54 - 00000000 ____D C:\Windows\system32\SSL
2017-03-12 13:53 - 2017-03-17 02:24 - 00000000 ____D C:\Program Files\3d7ef63e8d0abe261452695e527abe5a
2017-03-09 11:05 - 2017-03-09 11:05 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignc7b8c3a942516371
2017-03-09 11:05 - 2017-03-09 11:05 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign8c5abac146577e3e
2017-03-09 11:05 - 2017-03-09 11:05 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign26ef73d141f5436b
2017-03-07 19:14 - 2017-03-07 19:14 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigne1204af9cc27ef58
2017-03-07 19:14 - 2017-03-07 19:14 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign3ac7746539a49d38
2017-03-07 19:14 - 2017-03-07 19:14 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign2f2ab3a627cdc78c
2017-03-06 15:05 - 2017-03-06 15:05 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignb5698aaa318f916a
2017-03-06 15:05 - 2017-03-06 15:05 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign3d510d037787b9e0
2017-03-06 15:04 - 2017-03-06 15:04 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign8e1201afc40c4036
2017-03-04 20:05 - 2017-03-04 20:05 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignfb2a59441d534e2f
2017-03-04 20:05 - 2017-03-04 20:05 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigneb1700506d4f10d4
2017-03-04 20:04 - 2017-03-04 20:04 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign379e746aa9c3822c
2017-03-04 11:14 - 2017-03-04 11:14 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignd3e32826036e6082
2017-03-04 11:14 - 2017-03-04 11:14 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigna694854197761caa
2017-03-04 03:18 - 2017-03-04 03:18 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigna65189ea94bb278e
2017-03-04 03:18 - 2017-03-04 03:18 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign56f26aaf3a7a6a85
2017-02-26 18:29 - 2017-02-26 18:29 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignec3cc3172d137d87
2017-02-26 18:29 - 2017-02-26 18:29 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign6ee58643e9879b66
2017-02-26 18:28 - 2017-02-26 18:28 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign907906e0ed5a7137
2017-02-25 20:12 - 2017-02-25 20:12 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign5e1837bafbf020d4
2017-02-25 20:12 - 2017-02-25 20:12 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign3c198bfa3fc5f56b
2017-02-25 20:12 - 2017-02-25 20:12 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign0edbfde93be5b794
2017-02-21 16:40 - 2017-02-21 16:40 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign5fa235d6cfdfb289
2017-02-21 16:40 - 2017-02-21 16:40 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign1c8af96955f3929e
2017-02-21 16:40 - 2017-02-21 16:40 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign15e184d68c276610
2017-02-20 16:52 - 2017-02-20 16:52 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign61ebbccf3463682c
2017-02-20 16:51 - 2017-02-20 16:51 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign5d6956d683b1b25b
2017-02-20 16:50 - 2017-02-20 16:50 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign1275e3318ad4869d
2017-02-20 16:40 - 2017-02-20 16:40 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignd61c8c291c5cb200
2017-02-20 16:40 - 2017-02-20 16:40 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigncd7276be40f04b35
2017-02-20 16:40 - 2017-02-20 16:40 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign907d3193f49c394f
2017-02-20 16:38 - 2017-02-20 16:38 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign946ffa9c9ba64766
2017-02-20 16:38 - 2017-02-20 16:38 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign35dd0bb0637b3c2d
2017-02-20 16:38 - 2017-02-20 16:38 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign2db1a97995c8f99e
2017-02-17 21:58 - 2017-02-17 21:58 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigncf5aff5e92977daa
2017-02-17 21:58 - 2017-02-17 21:58 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign8493c9687f23ddc5
2017-02-17 20:05 - 2017-02-17 20:05 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign918bc85a32cd53c2
2017-02-17 20:05 - 2017-02-17 20:05 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign5fed81bb1b702198
2017-02-17 20:05 - 2017-02-17 20:05 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign2df67736af36a54c
2017-02-17 20:05 - 2017-02-17 20:05 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign264795e38f68e869
2017-02-15 18:53 - 2017-02-15 18:53 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigne7f91bb334758bb8
2017-02-15 18:53 - 2017-02-15 18:53 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign2822fa461d4e7b53
2017-02-15 18:53 - 2017-02-15 18:53 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign0fe481d553d461ad
2017-02-10 15:30 - 2017-02-10 15:30 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignac8c857568092866
2017-02-10 15:30 - 2017-02-10 15:30 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigna5fd5179837f3541
2017-02-10 15:30 - 2017-02-10 15:30 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign2b1df8ac5f015f24
2017-02-10 15:18 - 2017-02-10 15:18 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignd987841d8f85a6d5
2017-02-10 15:18 - 2017-02-10 15:18 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign9064027ffefd210d
2017-02-10 15:18 - 2017-02-10 15:18 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign72ecb5df2f9f6787
2017-02-10 15:07 - 2017-02-10 15:07 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigne706127eb6fdcc3f
2017-02-10 15:07 - 2017-02-10 15:07 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigndba6a45e94a575bf
2017-02-10 15:06 - 2017-02-10 15:06 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignf2c279e2d256ffea
2017-02-08 19:11 - 2017-02-08 19:11 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign9bbe108298a16dfa
2017-02-08 19:11 - 2017-02-08 19:11 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign1e16dbde65f9041c
2017-02-08 19:10 - 2017-02-08 19:10 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign08b5855aa3ade6f1
2017-02-08 14:31 - 2017-02-08 14:31 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigne6b628b838d6bfd3
2017-02-08 14:31 - 2017-02-08 14:31 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign6dc9ccbf6275435a
2017-02-08 14:31 - 2017-02-08 14:31 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign57b4fd6aa1ec1c38
2017-02-08 14:27 - 2017-02-08 14:27 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigne074f997667997a9
2017-02-08 14:16 - 2017-02-08 14:16 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigne964030ad440555b
2017-02-08 14:14 - 2017-02-08 14:14 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign9d831c07d05a7991
2017-02-08 14:14 - 2017-02-08 14:14 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign98bba375622952e1
2017-02-08 14:14 - 2017-02-08 14:14 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign22580bebed80949e
2017-02-08 14:14 - 2017-02-08 14:14 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign204704dc8d087c3e
2017-02-08 11:23 - 2017-02-08 11:23 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignb26e4f646b9db1af
2017-02-08 11:22 - 2017-02-08 11:22 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign193612df4b84712b
2017-02-08 11:22 - 2017-02-08 11:22 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign0521b33a5b634bb2
2017-02-07 23:11 - 2017-02-07 23:11 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign751eff83279952ae
2017-02-07 23:11 - 2017-02-07 23:11 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign3f598964f0e4552b
2017-02-07 23:10 - 2017-02-07 23:10 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignacae44c24078f962
2017-02-06 17:59 - 2017-02-06 17:59 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign673c116cdf375673
2017-02-06 17:59 - 2017-02-06 17:59 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign350ccc129a81dc2b
2017-02-06 17:59 - 2017-02-06 17:59 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign0b4473ab817c700a
2017-02-04 13:06 - 2017-02-04 13:06 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignb4dff1c52e0ac79c
2017-02-04 13:06 - 2017-02-04 13:06 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigna6e4a2c11be68b5f
2017-02-04 13:06 - 2017-02-04 13:06 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign3fb1b4216e4e675a
2017-02-03 15:37 - 2017-02-03 15:37 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign5d643e2a740949e9
2017-02-03 15:37 - 2017-02-03 15:37 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign28f4b7e05b0cf594
2017-02-03 15:37 - 2017-02-03 15:37 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign180012cce7735e03
2017-02-03 14:14 - 2017-02-03 14:14 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigne6453ba913631056
2017-02-03 14:14 - 2017-02-03 14:14 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigndc11bf9835d51402
2017-02-03 14:14 - 2017-02-03 14:14 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigna3125bd25367c98d
2017-02-02 16:13 - 2017-02-02 16:13 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignde0c0f33017ad8dc
2017-02-02 16:13 - 2017-02-02 16:13 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigna5d8828d24c8abbd
2017-02-02 16:13 - 2017-02-02 16:13 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign297615f067a2ad5f
2017-02-01 12:33 - 2017-02-01 12:33 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignc01e2573bd7c2d82
2017-02-01 12:33 - 2017-02-01 12:33 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign4f75e5e4d1cf0528
2017-02-01 12:32 - 2017-02-01 12:32 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign5dbd51e11fac101f
2017-02-01 12:32 - 2017-02-01 12:32 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign1385cf1817eb7200
2017-02-01 11:54 - 2017-02-01 11:54 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignf6d169e8f7c4cf5c
2017-02-01 11:54 - 2017-02-01 11:54 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign75176a1379fd89c6
2017-02-01 11:54 - 2017-02-01 11:54 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign2077bb65a3d248e7
2017-01-31 15:33 - 2017-01-31 15:33 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign66ddd6b550cf8b63
2017-01-31 15:33 - 2017-01-31 15:33 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign43ffdc0b4d040fb2
2017-01-31 15:33 - 2017-01-31 15:33 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign3da03e701b39be68
2017-01-28 04:23 - 2017-01-28 04:23 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign4d295c8310ecc910
2017-01-27 20:13 - 2017-01-27 20:13 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign7fddc78665bc6221
2017-01-27 20:13 - 2017-01-27 20:13 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign070f848c8906b133
2017-01-27 20:12 - 2017-01-27 20:12 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignc7ae6dfe1bd41119
2017-01-27 12:17 - 2017-01-27 12:17 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign82c58926d869d21a
2017-01-27 12:17 - 2017-01-27 12:17 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign76da771fc35c6e5e
2017-01-27 12:17 - 2017-01-27 12:17 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign5add50d8dc6932d6
2017-01-27 11:32 - 2017-01-27 11:32 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigne1d548b0c5257a6e
2017-01-27 11:32 - 2017-01-27 11:32 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign56d3907591d7df05
2017-01-27 11:32 - 2017-01-27 11:32 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign0848a7dccc7a7dc7
2017-01-25 01:22 - 2017-01-25 01:22 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignba27788cd91e49b1
2017-01-25 01:22 - 2017-01-25 01:22 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign532e75ad597c1718
2017-01-25 01:21 - 2017-01-25 01:21 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigne632a86716f5e8d0
2017-01-25 01:21 - 2017-01-25 01:21 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsigna32fd3e19b174c60
2017-01-25 01:14 - 2017-01-25 01:14 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign9d1b16dc989dd97c
2017-01-25 01:14 - 2017-01-25 01:14 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign8751bd45a610159d
2017-01-25 01:14 - 2017-01-25 01:14 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign62ead097947d2d6d
2017-01-24 22:21 - 2017-01-24 22:21 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignb1f5b23802ed2f9d
2017-01-24 22:21 - 2017-01-24 22:21 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign6a9e33435ed9cd2c
2017-01-24 22:21 - 2017-01-24 22:21 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign40bf4143a60aee39
2017-01-24 14:59 - 2017-01-24 14:59 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsignf80dac79a5b7677b
2017-01-24 14:59 - 2017-01-24 14:59 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign71b82361f18afd1b
2017-01-24 14:59 - 2017-01-24 14:59 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign048a747ffd3d606c
2017-01-24 14:22 - 2017-01-24 14:22 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign6c4a95284f047a60
2017-01-24 14:22 - 2017-01-24 14:22 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign3ffbe125cb54ecbe
2017-01-24 14:22 - 2017-01-24 14:22 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign033cb3c8457c681d
2017-01-16 15:13 - 2017-01-16 15:13 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign98737d3952fe1725
2017-01-16 15:13 - 2017-01-16 15:13 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign487c559f9a0ef4a2
2017-01-16 15:13 - 2017-01-16 15:13 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign40b4108a9dca4d6e
2017-01-16 12:45 - 2017-01-16 12:45 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign7b8d548bf08e91d5
2017-01-16 12:45 - 2017-01-16 12:45 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign6a9c6334ac58035c
2017-01-16 12:44 - 2017-01-16 12:44 - 00000000 ____D C:\Users\Sacha\AppData\Local\Tempzxpsign517e7a4405465748
C:\Program Files (x86)\Baduvivuph Core
C:\Users\Sacha\AppData\Roaming\Aterhiyzuqek
C:\Users\Sacha\AppData\Roaming\Shjuch
EmptyTemp:
  • Menu Fichier / Enregistrer-sous
    Place toi sur le bureau.
    Dans le champs en bas, nom du fichier mets : fixlist.txt
    Clic sur Enregistrer - cela va créer un fichier fixlist.txt sur le bureau.
  • Ferme toutes les applications, y compris ton navigateur
  • Double-clique sur FRST.exe
    Image Sous Vista, Windows 7, 8,10, etc.... il faut lancer le fichier par clic-droit ➫ Exécuter en tant qu'administrateur
    Sur le menu principal, clique une seule fois sur Corriger/Fix et patiente le temps de la correction


    Un redémarrage peut être nécessaire (pas obligatoire).
  • L'outil va créer un rapport de correction Fixlog.txt. Poste ce rapport dans ta réponse avec ton commentaire si c'est mieux !
2°)
Réinitialise/Répare les navigateurs WEB concerné(s) par les problèmes :
* réparer Mozilla Firefox (premier paragraphe)
* réparer Google Chrome (premier paragraphe)
* Réinitialiser et réparer Internet Explorer
Avec Gnu_Linux t'as un Noyau ... avec Ѡindows t'as que les pépins
https://helicium.altervista.org/
Supprimer les "virus" gratuitement http://www.supprimer-trojan.com/
Un p'tit Don à Angélique PDT_018 Merci.
Image
Haut
Brouette

Re: Supprimer mystart / Searchinme / luckystarting

par Brouette »

Je n'ai pas pu désinstaller youndoo,

Voilà le fixlog: http://pjjoint.malekal.com/files.php?id ... s8r12r10k6

J'ai réparé, désinstallé réinstallé chrome, tout semble net pour l'instant, mais il en était de même lors de mes précédentes tentatives, et de nouveaux adware apparaissaient après chaque démarrage...
Haut
Malekal_morte
Messages : 113153
Inscription : 10 sept. 2005 13:57

Re: Supprimer mystart / Searchinme / luckystarting

par Malekal_morte »

Bonsoir,

Tu peux supprimer le dossier C:\FRST =)

Termine par un nettoyage Malwarebytes Anti-Malware (MBAM ) version gratuite
Première règle élémentaire de sécurité : on réfléchit puis on clic et pas l'inverse - Les fichiers/programmes c'est comme les bonbons, quand ça vient d'un inconnu, on n'accepte pas !
➔ Comment protéger son PC des virus
➔ Windows 11 : Compatibilité, Configuration minimale requise, télécharger ISO et installer Windows 11

Comment demander de l'aide sur le forum
Partagez malekal.com : n'hésitez pas à partager les articles qui vous plaisent sur la page Facebook du site.
Haut
Brouette

Re: Supprimer mystart / Searchinme / luckystarting

par Brouette »

Bonjour,

Tout semble avoir fonctionné à merveille.

Merci infiniment!!
Haut
Malekal_morte
Messages : 113153
Inscription : 10 sept. 2005 13:57

Re: Supprimer mystart / Searchinme / luckystarting

par Malekal_morte »

:cheers:

Tu peux supprimer le dossier C:\FRST =)

Termine par un nettoyage Malwarebytes Anti-Malware (MBAM ) version gratuite


Quelques conseils :

Pour ne plus te faire avoir.
A lire - Programmes parasites / PUPs : Dossier Adwares/PUPs : programmes indésirables et parasites
(Surtout active les détections LPIs pour détecter les programmes parasites et publicitaires)
Première règle élémentaire de sécurité : on réfléchit puis on clic et pas l'inverse - Les fichiers/programmes c'est comme les bonbons, quand ça vient d'un inconnu, on n'accepte pas !
➔ Comment protéger son PC des virus
➔ Windows 11 : Compatibilité, Configuration minimale requise, télécharger ISO et installer Windows 11

Comment demander de l'aide sur le forum
Partagez malekal.com : n'hésitez pas à partager les articles qui vous plaisent sur la page Facebook du site.
Haut
  • Sujets similaires
    Réponses
    Vues
    Dernier message

Revenir à « Supprimer/Desinfecter les virus (Trojan, Adwares, Ransomwares, Backdoor, Spywares) »