Analyse avec FRST

[lilith00]

Bonjour à tous

Mon PC a des problèmes de connection très lente parfois et je soupçonne une infection. Cependant j'ai testé plusieurs outils gratuits et je n'ai pas eu de résultat probant. J'ai réalisé un scan avec FRST et j'aimerais beaucoup avoir votre avis. Voici les liens (je n'ai eu que 2 rapports)

https://pjjoint.malekal.com/files.php?i ... t14g511r11

https://pjjoint.malekal.com/files.php?i ... 13p5i11w12

C'est un portable d'un an (ASUSS Rog, sous Windows 10)

Merci d'avance !

[angelique]

Bonjour/Bonsoir

Sur Google Chrome : Menu en haut à droite puis Outils / Extensions

supprime:

Lilo Search

Lilo Tab

Lilo.org

• Voici la correction à effectuer avec FRST. Tu peux t'aider de cette Note explicative avec des captures d'écran.
  
  
  
  
  Double-clique sur FRST.exe
  Sous Vista, Windows 7, 8,10, etc.... il faut lancer le fichier par clic-droit ➫ Exécuter en tant qu'administrateur
  
  puis sur ton clavier appuyer sur la touche CTRL + Y.
  
  Le bloc-note va s'ouvrir, copie/colle ceci.
  
  

  Code : Tout sélectionner

  IFEO\taskmgr.exe: [Debugger] 
  ShellExecuteHooks: No Name - {7FBEA058-DE40-11E6-83E9-64006A5CFC23} -  -> No File
  CHR DefaultSearchURL: ChromeDefaultData2 -> hxxps://search.lilo.org/results.php?q={searchTerms}
  HKU\S-1-5-21-3319607906-963796463-1859508303-1001\...\StartMenuInternet\ChromeHTML: -> C:\Program Files (x86)\Dohat\Application\chrome.exe (Google Inc.) <==== ATTENTION
  FirewallRules: [{59F28FFC-9238-4ADA-B4F9-359D0963395C}] => (Allow) C:\Program Files (x86)\Dohat\Application\chrome.exe
  FF Homepage: Firefox\Firefox\Profiles\srztsqri.default -> hxxp://www.searchinme.com//?type=hp&ts=1495559991271&z=6c5437da27d76def6a0252ag1z4t7o8qcgag7wcqcc&from=official&uid=SanDiskXSD8SNAT128G1002_161758441208
  FF Extension: (SimilarWeb) - C:\Users\Lilith\AppData\Roaming\Firefox\Firefox\Profiles\srztsqri.default\Extensions\@DA3566E2-F709-11E5-8E87-A604BC8E7F8B.xpi [2017-04-20] [Legacy] [not signed]
  FF Extension: (HSearch) - C:\Users\Lilith\AppData\Roaming\Firefox\Firefox\Profiles\srztsqri.default\Extensions\@E97YHOMI-FU8L-IM23-VUT9-RVDZT7M8XL8H.xpi [2017-04-20] [not signed]
  Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "WINCOM1JO" /f
  Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "WINCOMS5X" /f
  Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "WINCOMESN" /f
  Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "WINCOM717" /f
  Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "WINCOMMX3" /f
  Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "WINCOM4JT" /f
  Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "WINCOMQ7X" /f
  Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "WINCOMSFU" /f
  Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "WINCOM790" /f
  Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "WINCOMUIT" /f
  Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "WINCOMUI5" /f
  Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "WINCOM39W" /f
  Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "WINCOMD0F" /f
  Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "WINCOMGII" /f
  Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "WINCOM9T3" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "9L0C4PG1JM" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "OJZU01EDUZ" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "WKLN76R7U6" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "6EN8CNZQ6Q" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "9JPGQUNPCW" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "74I80R9CTU" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "NUI64N4KV3" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "45IBQBKT1W" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "A5RDE0IZ4D" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "FA75ZGYEBD" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "G8Y06HIIUF" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "Y419ZMR1MR" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "GML9UUXOLC" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "IAVYKKH7QU" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "HWY5H9CL0D" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "Q6C6VMB9ZL" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "FBM7CITBNC" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "DY7EEA54S8" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "E96MR6H8LN" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "XABXqJ5wpg.exe" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "JBATGAX6P7" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "Yj4KbvE2H_.exe" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "ZSNLGZNRJH" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "NB4EPQRBMH" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "FMYUG7N8LM" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "PNQBHFFKNY" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "T7HX693MES" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "RV5D0NROX6" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "HKUE69W1TK" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "IOXOWG7LSM" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "D7CQIE5C9A" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "ZVVACTOPQ5" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "SDIM60H5O1" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "0NB45LB6Z0" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "UVGWDJA9EK" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "OIC71G0RYI" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "3B552ZNP3G" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "3XVPCLW44Y" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "IEH25XTD8E" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "FXIVQHRB0X" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "MVLCEFS1FR" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "MJYU0GW0UY" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "85I0PEQ2AI" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "OXQQWUAJPS" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "IA18KFEJYB" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "SI1KOK1HG6" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "2ANKT6URO6" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "I1JQQ9B9W2" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "2S3QMO64T9" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "B3S8HL6BUE" /f
  Reg: reg delete HKU\S-1-5-21-3319607906-963796463-1859508303-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "M9G0RWSF9O" /f
  Hosts:
  EmptyTemp:
  
  

• Ferme toutes les applications, y compris ton navigateur
• Ferme le bloc-note, retourne sur FRST et clique sur le bouton "Corriger / Fix"
• Sur le menu principal, clique une seule fois sur Corriger/Fix et patiente le temps de la correction
  
  
  Un redémarrage peut être nécessaire (pas obligatoire).
• L'outil va créer un rapport de correction Fixlog.txt. Poste ce rapport dans ta réponse avec ton commentaire si c'est mieux !

[lilith00]

Merci beaucoup pour ta réponse !
Je ne souhaite pas supprimer Lilo, mais j'ai executé le reste.
Difficile de dire si c'est mieux pour le moment, il faut que je teste un peu en jouant par exemple
J'ai joint le fichier fixlog
Merci encore !!

[angelique]

OK, le fixlist.txt sur le quel j'ai passé un peu de temps à faire a été correctement réalisé.

supprime C:\FRST et ses rapports et tiens au jus.