FORUM D’ENTRAIDE INFORMATIQUE (FEI)Site d’assistance et de sécurité informatique

[vert]

Bonjour j'ai essaye de supprimer beamrise comme indiquer sur le forum.
J'ai suivi les etapes mais des icones sont restees sur le bureau. depuis la 1ere etape avec adwcleaner, les icones avec les logos de beamrise sur mon bureau se sont changees en icones sans logos. Mais meme apres les 6 etapes elles sont restees sur le bureau. Alors je me demande si tout a ete vraiment supprimer. Q'en pensez-vous? Que dois-je faire?

[g3n-h@ckm@n]

salut

• Désactive ton antivirus
• Télécharge Shortcut_Module (de g3n-h@ckm@n) sur ton bureau.
  
  Note : Enregistrer votre travail avant de continuer !
  
  
• Lance Shortcut_Module,
• Clic sur Nettoyer
  
  Note : Patiente le temps du scan
• Après le redémarrage relance l'outil et clique sur le petit "R" pour ouvrir le rapport , puis poste son contenu

[vert]

salut
Je te remercie bcp ca a marche beamrise a l'air d'etre detruit MAIS il n'etait pas venu seul! Il y a d'autres logiciels tel que FTdownloader, pinterest et facebook qui sont restes...pareil le meme phenomene avec des icones sans logos. Qu'est-ce qu'il y a a faire?
Je te donne le rapport
¤¤¤¤¤¤¤¤¤¤ | Shortcut_Module | g3n-h@ckm@n | 24.02.2014.5

¤¤¤¤¤ XP | Vista | 7 | 8 - 32/64 bits ¤¤¤¤¤ - Start 22:32:35 - 24/02/2014

update on : 24/02/2014 | 14.00 by g3n-h@ckm@n

Contact : http://www.sosvirus.net

Boot : Normal

System : Microsoft Windows XP (32 bits) Service Pack 3

RAM memory = Total (MB) : 1039 | Free (MB) : 388
Pagefile = Total (MB) : 2500 | Free (MB) : 1937
Virtual = Total (MB) : 2097 | Free (MB) : 2018


Registry saved, to restore : C:\Shortcut_Module\Save\Clean\ERDNT.exe

¤¤¤¤¤¤¤¤¤¤ | Windows Updates

Last détection : 2014-02-24 21:18:01
Last downloaded : 2014-02-24 21:17:57
Last installation : 2014-02-14 14:03:17
Next search : 2014-02-25 15:36:40

¤¤¤¤¤¤¤¤¤¤ | Killed processes

1904 | C:\WINDOWS\system32\spoolsv.exe (.Microsoft Corporation - Spooler SubSystem App.) - (5.1.2600.6024) - C:\WINDOWS\system32\spoolsv.exe
200 | C:\WINDOWS\Explorer.EXE (.Microsoft Corporation - Windows Explorer.) - (6.0.2900.5512) - C:\WINDOWS\Explorer.EXE
848 | C:\WINDOWS\stsystra.exe (.SigmaTel, Inc. - Sigmatel Audio system tray application.) - (1.0.4995.1) - "C:\WINDOWS\stsystra.exe"
864 | C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (.Synaptics, Inc. - Synaptics TouchPad Enhancements.) - (8.2.4.3) - "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
436 | C:\WINDOWS\system32\igfxtray.exe (.Intel Corporation - igfxTray Module.) - (6.14.10.4926) - "C:\WINDOWS\system32\igfxtray.exe"
876 | C:\WINDOWS\system32\hkcmd.exe (.Intel Corporation - hkcmd Module.) - (6.14.10.4926) - "C:\WINDOWS\system32\hkcmd.exe"
888 | C:\WINDOWS\system32\igfxpers.exe (.Intel Corporation - persistence Module.) - (6.14.10.4926) - "C:\WINDOWS\system32\igfxpers.exe"
1160 | C:\WINDOWS\system32\igfxsrvc.exe (.Intel Corporation - igfxsrvc Module.) - (6.14.10.4926) - C:\WINDOWS\system32\igfxsrvc.exe -Embedding
1360 | C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) - (1.7.4.0) - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
1452 | C:\WINDOWS\system32\ctfmon.exe (.Microsoft Corporation - CTF Loader.) - (5.1.2600.5512) - "C:\WINDOWS\system32\ctfmon.exe"
2092 | C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (.Apple Inc. - Apple Mobile Device Service.) - (16.57.0.11) - "C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
2108 | C:\Program Files\Bonjour\mDNSResponder.exe (.Apple Inc. - Bonjour Service.) - (2.0.1.2) - "C:\Program Files\Bonjour\mDNSResponder.exe"
2532 | C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) - (1.70.0.0) - "C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe"
3076 | C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) - (1.70.0.0) - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
2408 | C:\Program Files\Internet Explorer\iexplore.exe (.Microsoft Corporation - Internet Explorer.) - (8.0.6001.18702) - "C:\Program Files\Internet Explorer\iexplore.exe"
3224 | C:\Program Files\Internet Explorer\iexplore.exe (.Microsoft Corporation - Internet Explorer.) - (8.0.6001.18702) - "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2408 CREDAT:79873
2620 | C:\WINDOWS\system32\wuauclt.exe (.Microsoft Corporation - Windows Update.) - (7.6.7600.256) - "C:\WINDOWS\system32\wuauclt.exe"
2724 | C:\Program Files\Internet Explorer\iexplore.exe (.Microsoft Corporation - Internet Explorer.) - (8.0.6001.18702) - "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2408 CREDAT:14344
1516 | C:\WINDOWS\system32\wscntfy.exe (.Microsoft Corporation - Windows Security Center Notification App.) - (5.1.2600.5512) - C:\WINDOWS\system32\wscntfy.exe

¤¤¤¤¤¤¤¤¤¤ | Running processes


[04/08/2004 11:00:00] - 812 | C:\WINDOWS\System32\smss.exe (.Microsoft Corporation - Windows NT Session Manager.) - (5.1.2600.5512) - \SystemRoot\System32\smss.exe [50688 Ko]
[04/08/2004 11:00:00] - 932 | C:\WINDOWS\system32\winlogon.exe (.Microsoft Corporation - Windows NT Logon Application.) - (5.1.2600.5512) - winlogon.exe [507904 Ko]
[04/08/2004 11:00:00] - 976 | C:\WINDOWS\system32\services.exe (.Microsoft Corporation - Services and Controller app.) - (5.1.2600.5755) - C:\WINDOWS\system32\services.exe [110592 Ko]
[04/08/2004 11:00:00] - 988 | C:\WINDOWS\system32\lsass.exe (.Microsoft Corporation - LSA Shell (Export Version).) - (5.1.2600.5512) - C:\WINDOWS\system32\lsass.exe [13312 Ko]
[04/08/2004 11:00:00] - 1152 | C:\WINDOWS\system32\svchost.exe (.Microsoft Corporation - Generic Host Process for Win32 Services.) - (5.1.2600.5512) - C:\WINDOWS\system32\svchost -k DcomLaunch [14336 Ko]
[04/08/2004 11:00:00] - 1260 | C:\WINDOWS\System32\svchost.exe (.Microsoft Corporation - Generic Host Process for Win32 Services.) - (5.1.2600.5512) - C:\WINDOWS\System32\svchost.exe -k netsvcs [14336 Ko]
[26/04/2010 11:11:24] - 1768 | C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (.AVAST Software - avast! Service.) - (7.0.1466.549) - "C:\Program Files\Alwil Software\Avast5\AvastSvc.exe" [44808 Ko]
[26/04/2010 11:11:24] - 1368 | C:\Program Files\Alwil Software\Avast5\avastUI.exe (.AVAST Software - avast! Antivirus.) - (7.0.1466.549) - "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui [4282728 Ko]
[23/02/2014 14:01:04] - 2712 | C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) - (1.70.0.0) - "C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe" [701512 Ko]
[04/08/2004 11:00:00] - 2828 | C:\WINDOWS\system32\svchost.exe (.Microsoft Corporation - Generic Host Process for Win32 Services.) - (5.1.2600.5512) - C:\WINDOWS\system32\svchost.exe -k imgsvc [14336 Ko]
[23/04/2010 22:29:44] - 2724 | C:\Program Files\Internet Explorer\iexplore.exe (.Microsoft Corporation - Internet Explorer.) - (8.0.6001.18702) - "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2408 CREDAT:14344 [638816 Ko]
[24/02/2014 22:30:57] - 3732 | C:\Documents and Settings\Clement\Local Settings\Temporary Internet Files\Content.IE5\RV3Q0L07\Shortcut_Module[1].exe (. - Shortcut_Module.) - (24.2.2014.5) - "C:\Documents and Settings\Clement\Local Settings\Temporary Internet Files\Content.IE5\RV3Q0L07\Shortcut_Module[1].exe" [2136576 Ko]

¤¤¤¤¤¤¤¤¤¤ | Services


¤¤¤¤¤¤¤¤¤¤ | Hosts

C:\WINDOWS\System32\Drivers\etc\hosts : Reseted successfully

¤¤¤¤¤¤¤¤¤¤ | Register

Deleted successfully : HKLM\Software\Classes\AMtoolbar.AMtoolbar
Deleted successfully : HKLM\Software\Classes\AMtoolbar.AMtoolbar.1
Deleted successfully : HKLM\Software\Classes\protector_dll.Protector
Deleted successfully : HKLM\Software\Classes\protector_dll.Protector.1
Deleted successfully : HKLM\Software\Classes\protector_dll.ProtectorLib.1
Deleted successfully : HKLM\Software\Classes\SoftwareUpdate.CoCreateAsync
Deleted successfully : HKLM\Software\Classes\SoftwareUpdate.CoreMachineClass
Deleted successfully : HKLM\Software\Classes\SoftwareUpdate.CoreMachineClass.1
Deleted successfully : HKLM\Software\Classes\SoftwareUpdate.CredentialDialogMachine.1.0
Deleted successfully : HKLM\Software\Classes\SoftwareUpdate.OnDemandCOMClassMachineFallback.1.0
Deleted successfully : HKLM\Software\Classes\SoftwareUpdate.OnDemandCOMClassSvc.1.0
Deleted successfully : HKLM\Software\Classes\SoftwareUpdate.ProcessLauncher.1.0
Deleted successfully : HKLM\Software\Classes\SoftwareUpdate.Update3COMClassService.1.0
Deleted successfully : HKLM\Software\Classes\SoftwareUpdate.Update3WebMachine.1.0
Deleted successfully : HKLM\Software\Classes\SoftwareUpdate.Update3WebMachineFallback.1.0
Deleted successfully : HKLM\Software\Classes\SoftwareUpdate.Update3WebSvc.1.0
Deleted successfully : HKLM\Software\Classes\protector_dll.ProtectorLib
Deleted successfully : HKLM\Software\Classes\SoftwareUpdate.CoCreateAsync.1.0
Deleted successfully : HKLM\Software\Classes\SoftwareUpdate.OnDemandCOMClassMachineFallback
Deleted successfully : HKLM\Software\Classes\SoftwareUpdate.ProcessLauncher
Deleted successfully : HKLM\Software\Classes\SoftwareUpdate.Update3WebMachine
Deleted successfully : HKLM\Software\Classes\SoftwareUpdate.Update3WebSvc
Deleted successfully : HKLM\Software\Classes\AppID\{6A070EEA-E3F8-411E-9D3A-F3814ED6D1A8} : SoftwareUpdateApp
Deleted successfully : HKLM\Software\Classes\AppID\{96FBC13C-8214-4100-88E0-FF74D7A1CB4D} : protector_dll
Deleted successfully : HKU\S-1-5-21-1085031214-1390067357-839522115-1003\Software\Beamrise
Deleted successfully : HKLM\Software\Classes\Installer\Products\0DC1503A46F231838AD88BCDDC8E8F7C : C:\DOCUME~1\Clement\LOCALS~1\Temp\dotnetfx3530729.01\1033\dotnetfx30\
Deleted successfully : HKLM\Software\Classes\Installer\Products\26DDC2EC4210AC63483DF9D4FCC5B59D : C:\DOCUME~1\Clement\LOCALS~1\Temp\IXP05C65.tmp\dotnetfx35\x86\
Deleted successfully : HKLM\Software\Classes\Installer\Products\30EB1ED92EFABDC4FBBE0DD637C60DA1 : C:\DOCUME~1\Clement\LOCALS~1\Temp\IXP255.TMP\
Deleted successfully : HKLM\Software\Classes\Installer\Products\54A306F2659DB694185B057D28249467 : C:\DOCUME~1\Clement\LOCALS~1\Temp\{BE28F43F-3677-4982-830C-5FFCA513F05D}\
Deleted successfully : HKLM\Software\Classes\Installer\Products\8F021BF4C2260624BA94F0345AC9FCA2 : C:\DOCUME~1\Clement\LOCALS~1\Temp\IXP255.TMP\
Deleted successfully : HKLM\Software\Classes\Installer\Products\926352A811504584B8E4645EE76600C5 : C:\DOCUME~1\Clement\LOCALS~1\Temp\IXP255.TMP\
Deleted successfully : HKLM\Software\Classes\Installer\Products\9B00314CD581E574FBCE93FE37F2911B : C:\DOCUME~1\Clement\LOCALS~1\Temp\IXP255.TMP\
Deleted successfully : HKLM\Software\Classes\Installer\Products\DC3BF90CC0D3D2F398A9A6D1762F70F3 : C:\DOCUME~1\Clement\LOCALS~1\Temp\dotnetfx3530729.01\1033\dotnetfx20\
Deleted successfully : HKLM\Software\Classes\Installer\Products\E603EB826AD5C9F4DB0BBD3A8C6CFFDF : C:\DOCUME~1\Clement\LOCALS~1\Temp\IXP255.TMP\
Deleted successfully : HKLM\Software\Classes\Installer\Products\2BC4C58B253B8DB418C8CB3E35951970 : C:\DOCUME~1\Clement\LOCALS~1\Temp\{DD757888-8A11-4760-B230-EF12C81D60C3}\
Deleted successfully : HKLM\Software\Classes\Installer\Products\5C1093C35543A0E32A41B090A305076A : C:\DOCUME~1\Clement\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\
Deleted successfully : HKLM\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a : C:\WINDOWS\TEMP\IXP000.TMP\
Deleted successfully : HKLM\Software\Classes\Installer\Products\FCDAC0A0AD874C333A05DC1548B97920 : C:\DOCUME~1\Clement\LOCALS~1\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\
Deleted successfully : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094] : C:\Program Files\SweetIM\Messenger\msvcr71.dll
Deleted successfully : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\24D4E9A30476A184E9FBAF8014095AAA] : C:\DOCUME~1\Clement\LOCALS~1\Temp\SetupDataMngr_iMesh.exe
Deleted successfully : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536] : C:\Program Files\SweetIM\Messenger\msvcp71.dll
Deleted successfully : [HKLM\Software\Microsoft\Command Processor]|[AutoRun] :
Deleted successfully : [HKU\S-1-5-21-1085031214-1390067357-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run]|[swg] : "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

¤¤¤¤¤¤¤¤¤¤ | IFEO


¤¤¤¤¤¤¤¤¤¤ | Folders

Deleted successfully : C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
Deleted successfully : C:\Documents and Settings\Clement\Desktop\Beamrise Photobooth.lnk
Deleted successfully : C:\Documents and Settings\Clement\Desktop\Beamrise Videochat.lnk
Deleted successfully : C:\Documents and Settings\Clement\Desktop\Beamrise.lnk
Deleted successfully : C:\Documents and Settings\Clement\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\3372725252.data
Deleted successfully : C:\Documents and Settings\Clement\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\3372725252.quar

¤¤¤¤¤¤¤¤¤¤ | Hijack.Shortcut

Disinfected : C:\Documents and Settings\Clement\Desktop\Pinterest.lnk : C:\Documents and Settings\Clement\Local Settings\Application Data\Beamrise\Application\beamrise.exe (hxxp://search2.beamrise.com/pinterest)

¤¤¤¤¤¤¤¤¤¤ | Hijack.Internet Explorer

Repaired : [HKU\S-1-5-21-1085031214-1390067357-839522115-1003\Software\Microsoft\Internet Explorer\Main]|[Start Page] : https://www.google.fr/ - http://www.google.com/
Repaired : [HKLM\Software\Microsoft\Internet Explorer\Search]|[SearchAssistant] : http://www.google.com - http://www.google.com/ie
Repaired : [HKLM\Software\Microsoft\Internet Explorer\Main]|[Default_Search_URL] : http://www.google.com - http://go.microsoft.com/fwlink/?LinkId=54896
Repaired : [HKLM\Software\Microsoft\Internet Explorer\Main]|[Search Page] : http://www.google.com - http://go.microsoft.com/fwlink/?LinkId=54896
Repaired : [HKU\S-1-5-21-1085031214-1390067357-839522115-1003\Software\Microsoft\Internet Explorer\PhishingFilter]|[Enabled] : 1 - 2
Repaired : [HKU\S-1-5-21-1085031214-1390067357-839522115-1003\Software\Microsoft\Internet Explorer\PhishingFilter]|[EnabledV8] : 0 - 1
Repaired : [HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet settings]|[MigrateProxy] : 0 - 1
Repaired : [HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet settings]|[MigrateProxy] : 0 - 1
Repaired : [HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet settings]|[MigrateProxy] : 0 - 1
Repaired : [HKU\S-1-5-21-1085031214-1390067357-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet settings]|[WarnonZoneCrossing] : 0 - 1

¤¤¤¤¤¤¤¤¤¤ | Hijack.Google Chrome


¤¤¤¤¤¤¤¤¤¤ | Hijack.Firefox


¤¤¤¤¤¤¤¤¤¤ | Hijack.StartMenuInternet

Repaired : [HKLM\Software\Clients\StartMenuInternet\IExplore.exe\shell\open\command] : iexplore.exe - "C:\Program Files\Internet Explorer\iexplore.exe"

¤¤¤¤¤¤¤¤¤¤ | AppInit_DLLs


[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]|[LoadAppInit_DLLs] : 1

¤¤¤¤¤¤¤¤¤¤ | Hijack.Javascript


¤¤¤¤¤¤¤¤¤¤ | Firewall


¤¤¤¤¤¤¤¤¤¤ | Temporary files

[All Users] Temporary files deleted : 0 Ko
[Default User] Temporary files deleted : 0 Ko
[NetworkService] Temporary files deleted : 0 Ko
[LocalService] Temporary files deleted : 0 Ko
[Clement] Temporary files deleted : 0 Ko


¤¤¤¤¤¤¤¤¤¤ |EOF| ¤¤¤¤¤¤¤¤¤¤ | 22:37:19

[g3n-h@ckm@n]

comment ca se fait que ton ordinateur est en anglais ?

[vert]

Je l'avais achete aux usa.

[g3n-h@ckm@n]

fais voir ton rapport d'adwcleaner ?

[vert]

voila
# AdwCleaner v3.019 - Report created 25/02/2014 at 01:01:24
# Updated 17/02/2014 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Clement - CLEMENT-AF1098E
# Running from : C:\Documents and Settings\Clement\Local Settings\Temporary Internet Files\Content.IE5\F30VT8Y4\adwcleaner[1].exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702


-\\ Google Chrome v33.0.1750.117

[ File : C:\Documents and Settings\Clement\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [17848 octets] - [23/02/2014 12:39:17]
AdwCleaner[R1].txt - [839 octets] - [23/02/2014 12:45:45]
AdwCleaner[R2].txt - [3912 octets] - [23/02/2014 22:03:45]
AdwCleaner[R3].txt - [1286 octets] - [25/02/2014 00:51:32]
AdwCleaner[R4].txt - [981 octets] - [25/02/2014 01:01:24]
AdwCleaner[S0].txt - [18129 octets] - [23/02/2014 12:40:39]
AdwCleaner[S1].txt - [899 octets] - [23/02/2014 12:46:55]
AdwCleaner[S2].txt - [3668 octets] - [23/02/2014 22:04:37]
AdwCleaner[S3].txt - [556 octets] - [25/02/2014 00:52:54]

########## EOF - C:\AdwCleaner\AdwCleaner[R4].txt - [1279 octets] ##########

[vert]

voila le premier rapport

# AdwCleaner v3.019 - Report created 23/02/2014 at 12:39:17
# Updated 17/02/2014 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Clement - CLEMENT-AF1098E
# Running from : C:\Documents and Settings\Clement\Local Settings\Temporary Internet Files\Content.IE5\PN6D90ZE\adwcleaner[1].exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\Documents and Settings\All Users\Desktop\iLivid.lnk
Folder Found C:\DOCUME~1\Clement\LOCALS~1\Temp\Iminent
Folder Found C:\Documents and Settings\All Users\Application Data\SweetIM
Folder Found C:\Documents and Settings\Clement\Application Data\dvdvideosoftiehelpers
Folder Found C:\Documents and Settings\Clement\Application Data\OpenCandy
Folder Found C:\Documents and Settings\Clement\Local Settings\Application Data\Beamrise
Folder Found C:\Documents and Settings\Clement\Local Settings\Application Data\BeamriseUninstall
Folder Found C:\Documents and Settings\Clement\Local Settings\Application Data\cool_mirage
Folder Found C:\Documents and Settings\Clement\Local Settings\Application Data\iMesh
Folder Found C:\Documents and Settings\Clement\Local Settings\Application Data\OpenCandy
Folder Found C:\Documents and Settings\Clement\Local Settings\Application Data\PackageAware
Folder Found C:\Documents and Settings\Clement\Start Menu\Programs\Beamrise
Folder Found C:\Documents and Settings\Clement\Start Menu\Programs\FTDownloader.com
Folder Found C:\Program Files\Seeearch
Folder Found C:\Program Files\SweetIM

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\1ClickDownload
Key Found : HKCU\Software\AppDataLow\Software\Crossrider
Key Found : HKCU\Software\Imesh
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{4B8C28A7-A9BC-45F8-990D-21499EED643C}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0FFD0EF2-DBE9-483A-80C4-D2C331DA1CE4}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1631550F-191D-4826-B069-D9439253D926}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{258C9770-1713-4021-8D7E-1F184A2BD754}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BDEA95CF-F0E6-41E0-BD3D-B00F39A4E939}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DB38E21A-0133-419D-92AD-ECDFD5244D6D}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EB620C54-E229-4942-87CE-E717109FC8C6}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0FFD0EF2-DBE9-483A-80C4-D2C331DA1CE4}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1631550F-191D-4826-B069-D9439253D926}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BDEA95CF-F0E6-41E0-BD3D-B00F39A4E939}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Found : HKCU\Software\PriceGong
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\Iminent
Key Found : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Key Found : HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
Key Found : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils
Key Found : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1
Key Found : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator
Key Found : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1
Key Found : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Key Found : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Key Found : HKLM\SOFTWARE\Classes\sim-packages
Key Found : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar
Key Found : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1
Key Found : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook
Key Found : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1
Key Found : HKLM\SOFTWARE\Classes\TBSB06155.IEToolbar
Key Found : HKLM\SOFTWARE\Classes\TBSB06155.IEToolbar.1
Key Found : HKLM\SOFTWARE\Classes\Toolbar3.sweetie
Key Found : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1
Key Found : HKLM\SOFTWARE\Classes\Toolbar3.TBSB06155
Key Found : HKLM\SOFTWARE\Classes\Toolbar3.TBSB06155
Key Found : HKLM\SOFTWARE\Classes\Toolbar3.TBSB06155.1
Key Found : HKLM\SOFTWARE\Classes\Toolbar3.TBSB06155.1
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{DCABB943-792E-44C4-9029-ECBEE6265AF9}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
Key Found : HKLM\Software\Conduit
Key Found : HKLM\Software\Iminent
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{2F603A45-D956-496B-81B5-50D782424976}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{B85C4CB2-B352-4BD8-818C-BCE353599107}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ShoppingReport2
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02F47BF73B948514FAACADD8CBBDF37D
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\080D9F5E1E95FEE4794CE438E635239E
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1E264E0A5959A1C46BA9175A878B12EA
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2E6768B6932D112438F047C54D180635
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\351716A953E21214898904032EAE2E81
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\427EA997C413D1D47907CBFC7B2DB432
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4318DF19719275242801CBE292063A4C
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\69D6A6B2ED56AF24EA6335EAD6E91CA4
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\75D5168E5E176C24981B4E5DBD991078
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FFA128C2B0FF414D805FC5627883401
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EDC790504E1834DBC20C9A04328FD2
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8724E58E6C7D00C48A0D4F3345EB2C26
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\97C3D0F82E712E241A2F969F45E3351C
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9E7F556BF224D804D96A96F0F6344789
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A189D17A469616C4688D23E192996267
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AB676B0E1B9EFA049B9F7DDDA9645734
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B31BBB0B825EDEF45AB0FE7099C68C81
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B471D8D7319336B4CA89374ED0D7B806
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BC30043663AA2CA4DA1DAA9CA5FDCC75
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF4F885EDEE45644EB1E0C99E0162399
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CE21F3FD57B244142880EF15A165A156
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E1C820A74ED67374BA048B52CB3C3804
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F754C503375A13344B22388E18DFE87E
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9
Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FDC83385E6C239F4C876A77A37DF581D
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2F603A45-D956-496B-81B5-50D782424976}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B85C4CB2-B352-4BD8-818C-BCE353599107}
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{84FF7BD6-B47F-46F8-9130-01B2696B36CB}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EEE6C35D-6118-11DC-9C72-001320C79847}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Iminent]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [IminentMessenger]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SweetIM]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll]
Value Found : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List [C:\Program Files\iMesh Applications\iMesh\iMesh.exe]
Value Found : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [C:\Documents and Settings\Clement\Local Settings\Temporary Internet Files\Content.IE5\I1H54MSN\SweetImSetup[1].exe]
Value Found : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [C:\Program Files\iMesh Applications\iMesh\iMesh.exe]

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702

Setting Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [SearchAssistant] - hxxp://seeearch.com

*************************

AdwCleaner[R0].txt - [17706 octets] - [23/02/2014 12:39:17]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [17767 octets] ##########

[g3n-h@ckm@n]

ah...et tu comptais faire l'option nettoyer quand ? la semaine prochaine ? mdr !

[vert]

Et pourtant je l'ai bien lance le nettoyage je t'asssure! C'est etrange, tu as pu voir je me suis un peu acharne avec adwcleaner a force de le relancer. Mais a chaque fois dans le tableau des resultats apres le scan il n'y avait rien. Je c pas si c normal? alors je lancais qd meme le nettoyage.
Les icones des logiciels Ftdownloader, pinterest et facebook sont tjrs la.
Aussi les 2 derniers fois que j'ai lance le nettoyage en plein milieu mon ordi a plante completement.

[g3n-h@ckm@n]

supprime les manuellement

   

• Télécharge MalwareBytes Anti-Malware
• Installe le. Décoche "Activer l'essai gratuit de Malwarebytes Anti-Malware PRO"
• Lance Malwarebytes' Anti-Malware.
• Clic sur l'onglet "Mises à jours" puis sur "Rechercher des mises à jours"
• Clic sur l'onglet "Recherche", coche "éxécuter un examen complet" puis clic sur Rechercher
  
  
• A la fin de l'analyse, si MBAM n'a rien trouvé :
• Clic sur OK, le rapport s'ouvre spontanément

• Si des menaces ont été détectées :
• Clic sur OK puis "Afficher les résultats"
• Choisis l'option "Supprimer la sélection"
• Si MBAM demande le redémarrage de Windows : Clic sur "Oui"
• Une fois le PC redémarré, le rapport se trouve dans l'onglet "Rapports/Logs"
• Sinon le rapport s'ouvre automatiquement après la suppression
• Poste le rapport dans ta prochaine réponse

[vert]

Malwarebytes Anti-Malware (Essai) 1.75.0.1300
http://www.malwarebytes.org

Version de la base de données: v2014.02.25.05

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Clement :: CLEMENT-AF1098E [administrateur]

Protection: Activé

25/02/2014 15:01:56
mbam-log-2014-02-25 (15-01-56).txt

Type d'examen: Examen complet (C:\|D:\|)
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 248625
Temps écoulé: 49 minute(s), 39 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 3
C:\System Volume Information\_restore{A9E892AB-B536-4D40-89C6-46696C1DF025}\RP635\A0073423.msi (PUP.Optional.SweetIM) - Mis en quarantaine et supprimé avec succès.
C:\System Volume Information\_restore{A9E892AB-B536-4D40-89C6-46696C1DF025}\RP635\A0073424.msi (PUP.Optional.SweetIM) - Mis en quarantaine et supprimé avec succès.
C:\System Volume Information\_restore{A9E892AB-B536-4D40-89C6-46696C1DF025}\RP635\A0073425.msi (Adware.Boxore) - Mis en quarantaine et supprimé avec succès.

(fin)

[vert]

quand tu me dis de les supprimer manuellement c juste envoyer les icones a la corbeille c ca?

[g3n-h@ckm@n]

oui

• Copie le script ci dessous :
  
  HKCU\Software
      HKLM\Software
      HKCU\Software\Microsoft\Command Processor /s
      HKLM\Software\Microsoft\Command Processor /s
      %Homedrive%\*
      %Homedrive%\*.
      %Userprofile%\*
      %Userprofile%\*.
      %Allusersprofile%\*
      %Allusersprofile%\*.
      %LocalAppData%\*
      %LocalAppData%\*.
      %Userprofile%\Local Settings\Application Data\*
      %Userprofile%\Local Settings\Application Data\*.
      %programFiles%\*
      %programfiles%\Google\Desktop\Install /s
      %programFiles%\*.
      %Systemroot%\Installer\*.
      %Systemroot%\Temp\*.exe /s
      %systemroot%\system32\*.dll /lockedfiles
      %systemroot%\system32\*.exe /lockedfiles
      %systemroot%\system32\*.in*
      %systemroot%\Tasks\*
      %systemroot%\Tasks\*.
      %systemroot%\system32\Tasks\*
      %systemroot%\system32\Tasks\*.
      %systemroot%\system32\drivers\*.sy* /lockedfiles
      %systemroot%\system32\config\*.exe /s
      %Systemroot%\ServiceProfiles\*.exe /s
      %systemroot%\system32\*.sys
      dir %Homedrive%\* /S /A:L /C
      msconfig
      activex
      /md5start
      explorer.exe
      winlogon.exe
      wininit.exe
      volsnap.sys
      atapi.sys
      ndis.sys
      cdrom.sys
      i8042prt.sys
      iastor.sys
      tdx.sys
      netbt.sys
      afd.sys
      /md5stop
      netsvcs
      safebootminimal
      safebootnetwork
      CREATERESTOREPOINT
• Télécharge OTL (by OldTimer) sur ton bureau.
• Lance OTL, exécuter en tant qu'administrateur sous Windows : 7/8 et Vista
• Coche/Sélectionne les cases comme l'image ci dessous
• Colle le Script copié plus haut dans la partie inférieure d'OTL "Personnalisation"
• Clique sur Analyse
  
  
• Une fois le scan terminé 1 ou 2 rapports vont s'ouvrir OTL.txt et Extras.txt.
• Héberge les rapports OTL.txt et Extras.txt sur SosUpload, puis copie/colle le lien fourni dans ta prochaine réponse sur le forum
  
  Note : Au cas où, tu peux les retrouver dans le dossier C:\OTL ou sur ton bureau en fonction des cas rencontrés
  
  En cas de problème avec SOSUpload, utiliser Cjoint

[vert]

http://cjoint.com/?3Bzx26E88tF
http://cjoint.com/?3Bzx325dW7Q

[g3n-h@ckm@n]

• Télécharge Junkware Removal Tool (de thisisu) sur ton bureau.
• Lance Junkware Removal Tool, exécuter en tant qu'administrateur sous Windows : 7/8 et Vista
• Appuie sur n'importe quelle touche.
  
  
• Une fois le scan terminé rends toi sur le bureau, le fichier JRT.txt à été créé.
• Héberge le rapport JRT.txt surSosUpload, puis copie/colle le lien fourni dans ta prochaine réponse sur le forum

[vert]

http://cjoint.com/?3BAohzNTfyT
Impossible de transferer le doc sur sosupload.

[g3n-h@ckm@n]

pourquoi tu m'as pas dit que tu l'avais déjà passé dimanche?

Ran by Clement on 23/02/2014 at 13:31:14,76

[vert]

En fait je te l'avais dit dans mon premier message qd je disais que j'avais fait tte les etapes comme indique sur le site. J'ai remarque que tu me faisais repasser certains logiciels mais jusque la je me suis dit que c'etait le procede. C pr ca que je t'ai envoye le rapport de dimanche de jrt.

[g3n-h@ckm@n]

relance shortcut_module puis clique sur le petit "u" pour le desinstaller puis retelecharge-le et refais un nettoyage avec...pas normal que ces clés aient pas sauté !

http://www.telecharger.sosvirus.net/dow ... ut_module/

[vert]

¤¤¤¤¤¤¤¤¤¤ | Shortcut_Module | g3n-h@ckm@n | 27.02.2014.5

¤¤¤¤¤ XP | Vista | 7 | 8 - 32/64 bits ¤¤¤¤¤ - Start 22:25:56 - 27/02/2014

update on : 27/02/2014 | 21.50 by g3n-h@ckm@n

Contact : http://www.sosvirus.net

Boot : Normal

System : Microsoft Windows XP (32 bits) Service Pack 3

RAM memory = Total (MB) : 1039 | Free (MB) : 332
Pagefile = Total (MB) : 2500 | Free (MB) : 1876
Virtual = Total (MB) : 2097 | Free (MB) : 2018


Registry saved, to restore : C:\Shortcut_Module\Save\Clean\ERDNT.exe

¤¤¤¤¤¤¤¤¤¤ | Windows Updates

Last détection : 2014-02-27 14:03:13
Last downloaded : 2014-02-24 21:17:57
Last installation : 2014-02-25 00:23:20
Next search : 2014-02-28 07:42:14

¤¤¤¤¤¤¤¤¤¤ | Killed processes

1900 | C:\WINDOWS\Explorer.EXE (.Microsoft Corporation - Windows Explorer.) - (6.0.2900.5512) - C:\WINDOWS\Explorer.EXE
184 | C:\WINDOWS\system32\spoolsv.exe (.Microsoft Corporation - Spooler SubSystem App.) - (5.1.2600.6024) - C:\WINDOWS\system32\spoolsv.exe
264 | C:\WINDOWS\stsystra.exe (.SigmaTel, Inc. - Sigmatel Audio system tray application.) - (1.0.4995.1) - "C:\WINDOWS\stsystra.exe"
272 | C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (.Synaptics, Inc. - Synaptics TouchPad Enhancements.) - (8.2.4.3) - "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
276 | C:\WINDOWS\system32\igfxtray.exe (.Intel Corporation - igfxTray Module.) - (6.14.10.4926) - "C:\WINDOWS\system32\igfxtray.exe"
328 | C:\WINDOWS\system32\hkcmd.exe (.Intel Corporation - hkcmd Module.) - (6.14.10.4926) - "C:\WINDOWS\system32\hkcmd.exe"
336 | C:\WINDOWS\system32\igfxpers.exe (.Intel Corporation - persistence Module.) - (6.14.10.4926) - "C:\WINDOWS\system32\igfxpers.exe"
404 | C:\WINDOWS\system32\igfxsrvc.exe (.Intel Corporation - igfxsrvc Module.) - (6.14.10.4926) - C:\WINDOWS\system32\igfxsrvc.exe -Embedding
728 | C:\WINDOWS\system32\ctfmon.exe (.Microsoft Corporation - CTF Loader.) - (5.1.2600.5512) - "C:\WINDOWS\system32\ctfmon.exe"
776 | C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (.Google Inc. - GoogleToolbarNotifier.) - (4.1.509.1944) - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
1740 | C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (.Apple Inc. - Apple Mobile Device Service.) - (16.57.0.11) - "C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
816 | C:\Program Files\Bonjour\mDNSResponder.exe (.Apple Inc. - Bonjour Service.) - (2.0.1.2) - "C:\Program Files\Bonjour\mDNSResponder.exe"
1452 | C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) - (1.70.0.0) - "C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe"
2628 | C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) - (1.70.0.0) - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
3656 | C:\WINDOWS\System32\alg.exe (.Microsoft Corporation - Application Layer Gateway Service.) - (5.1.2600.5512) - C:\WINDOWS\System32\alg.exe
2440 | C:\Program Files\Internet Explorer\iexplore.exe (.Microsoft Corporation - Internet Explorer.) - (8.0.6001.18702) - "C:\Program Files\Internet Explorer\iexplore.exe"
360 | C:\Program Files\Internet Explorer\iexplore.exe (.Microsoft Corporation - Internet Explorer.) - (8.0.6001.18702) - "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2440 CREDAT:79873
3408 | C:\WINDOWS\system32\wscntfy.exe (.Microsoft Corporation - Windows Security Center Notification App.) - (5.1.2600.5512) - C:\WINDOWS\system32\wscntfy.exe
1104 | C:\Program Files\Internet Explorer\iexplore.exe (.Microsoft Corporation - Internet Explorer.) - (8.0.6001.18702) - "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2440 CREDAT:145410

¤¤¤¤¤¤¤¤¤¤ | Running processes


[04/08/2004 11:00:00] - 512 | C:\WINDOWS\System32\smss.exe (.Microsoft Corporation - Windows NT Session Manager.) - (5.1.2600.5512) - \SystemRoot\System32\smss.exe [50688 Ko]
[04/08/2004 11:00:00] - 880 | C:\WINDOWS\system32\csrss.exe (.Microsoft Corporation - Client Server Runtime Process.) - (5.1.2600.5512) - C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 [6144 Ko]
[04/08/2004 11:00:00] - 904 | C:\WINDOWS\system32\winlogon.exe (.Microsoft Corporation - Windows NT Logon Application.) - (5.1.2600.5512) - winlogon.exe [507904 Ko]
[04/08/2004 11:00:00] - 948 | C:\WINDOWS\system32\services.exe (.Microsoft Corporation - Services and Controller app.) - (5.1.2600.5755) - C:\WINDOWS\system32\services.exe [110592 Ko]
[04/08/2004 11:00:00] - 960 | C:\WINDOWS\system32\lsass.exe (.Microsoft Corporation - LSA Shell (Export Version).) - (5.1.2600.5512) - C:\WINDOWS\system32\lsass.exe [13312 Ko]
[04/08/2004 11:00:00] - 1136 | C:\WINDOWS\system32\svchost.exe (.Microsoft Corporation - Generic Host Process for Win32 Services.) - (5.1.2600.5512) - C:\WINDOWS\system32\svchost -k DcomLaunch [14336 Ko]
[04/08/2004 11:00:00] - 1204 | C:\WINDOWS\system32\svchost.exe (.Microsoft Corporation - Generic Host Process for Win32 Services.) - (5.1.2600.5512) - C:\WINDOWS\system32\svchost -k rpcss [14336 Ko]
[04/08/2004 11:00:00] - 1244 | C:\WINDOWS\System32\svchost.exe (.Microsoft Corporation - Generic Host Process for Win32 Services.) - (5.1.2600.5512) - C:\WINDOWS\System32\svchost.exe -k netsvcs [14336 Ko]
[04/08/2004 11:00:00] - 1368 | C:\WINDOWS\system32\svchost.exe (.Microsoft Corporation - Generic Host Process for Win32 Services.) - (5.1.2600.5512) - C:\WINDOWS\system32\svchost.exe -k NetworkService [14336 Ko]
[04/08/2004 11:00:00] - 1396 | C:\WINDOWS\system32\svchost.exe (.Microsoft Corporation - Generic Host Process for Win32 Services.) - (5.1.2600.5512) - C:\WINDOWS\system32\svchost.exe -k LocalService [14336 Ko]
[26/04/2010 11:11:24] - 1648 | C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (.AVAST Software - avast! Service.) - (9.0.2013.292) - "C:\Program Files\Alwil Software\Avast5\AvastSvc.exe" [50344 Ko]
[26/04/2010 11:11:24] - 640 | C:\Program Files\Alwil Software\Avast5\AvastUI.exe (.AVAST Software - avast! Antivirus.) - (9.0.2013.292) - "C:\Program Files\Alwil Software\Avast5\AvastUI.exe" /nogui [3767096 Ko]
[04/08/2004 11:00:00] - 764 | C:\WINDOWS\system32\svchost.exe (.Microsoft Corporation - Generic Host Process for Win32 Services.) - (5.1.2600.5512) - C:\WINDOWS\system32\svchost.exe -k LocalService [14336 Ko]
[23/02/2014 14:01:04] - 2068 | C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) - (1.70.0.0) - "C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe" [701512 Ko]
[04/08/2004 11:00:00] - 2368 | C:\WINDOWS\system32\svchost.exe (.Microsoft Corporation - Generic Host Process for Win32 Services.) - (5.1.2600.5512) - C:\WINDOWS\system32\svchost.exe -k imgsvc [14336 Ko]
[23/04/2010 22:29:44] - 1104 | C:\Program Files\Internet Explorer\iexplore.exe (.Microsoft Corporation - Internet Explorer.) - (8.0.6001.18702) - "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2440 CREDAT:145410 [638816 Ko]
[27/02/2014 22:25:05] - 772 | C:\Documents and Settings\Clement\Local Settings\Temporary Internet Files\Content.IE5\F30VT8Y4\Shortcut_Module[1].exe (. - Shortcut_Module.) - (27.2.2014.5) - "C:\Documents and Settings\Clement\Local Settings\Temporary Internet Files\Content.IE5\F30VT8Y4\Shortcut_Module[1].exe" [2139136 Ko]
[23/04/2010 22:27:39] - 564 | C:\WINDOWS\system32\wbem\wmiprvse.exe (.Microsoft Corporation - WMI.) - (5.1.2600.5755) - C:\WINDOWS\system32\wbem\wmiprvse.exe [227840 Ko]
[04/08/2004 11:00:00] - 708 | C:\WINDOWS\system32\wscntfy.exe (.Microsoft Corporation - Windows Security Center Notification App.) - (5.1.2600.5512) - C:\WINDOWS\system32\wscntfy.exe [13824 Ko]

¤¤¤¤¤¤¤¤¤¤ | Services


¤¤¤¤¤¤¤¤¤¤ | Hosts

C:\WINDOWS\System32\Drivers\etc\hosts : Reseted successfully

¤¤¤¤¤¤¤¤¤¤ | Register

Deleted successfully : HKLM\Software\Classes\SoftwareUpdate.CredentialDialogMachine
Deleted successfully : HKLM\Software\Classes\SoftwareUpdate.Update3COMClassService
Deleted successfully : HKLM\Software\Classes\SoftwareUpdate.OnDemandCOMClassSvc
Deleted successfully : HKLM\Software\Classes\CLSID\{08230486-CBAF-4000-8036-447C3852D034} : "C:\Program Files\Software\Update\1.3.25.0\SoftwareUpdateBroker.exe"
Deleted successfully : HKLM\Software\Classes\CLSID\{13809C03-DE3B-47E5-96A3-2D8F83693A50} : "C:\Program Files\Software\Update\1.3.25.0\SoftwareUpdateOnDemand.exe"
Deleted successfully : HKLM\Software\Classes\CLSID\{3B96B5D3-4A8D-42DC-9CDE-E9B94B3CFE5D} : C:\Program Files\Software\Update\1.3.25.0\npSoftwareUpdate3.dll
Deleted successfully : HKLM\Software\Classes\CLSID\{3D976BD4-0B6A-4757-9D2B-65AA20F4B4EA} : "C:\Program Files\Software\Update\1.3.25.0\SoftwareUpdateBroker.exe"
Deleted successfully : HKLM\Software\Classes\CLSID\{76894207-241A-473B-B111-FAA75608F1D9} : "C:\Program Files\Software\Update\1.3.25.0\SoftwareUpdateOnDemand.exe"
Deleted successfully : HKLM\Software\Classes\CLSID\{ACCC747B-2A59-4F30-BA7C-D26333DE65F5} : C:\Program Files\Software\Update\1.3.25.0\npSoftwareUpdate3.dll
Deleted successfully : HKLM\Software\Classes\CLSID\{AE2506E3-0F75-44EE-B552-CFF3BFF4D50F} : "C:\Program Files\Software\Update\1.3.25.0\SoftwareUpdateOnDemand.exe"
Deleted successfully : HKLM\Software\Classes\CLSID\{B6CD3C31-ABF4-4C7A-8CB7-29960BC7017C} : "C:\Program Files\Software\Update\1.3.25.0\SoftwareUpdateOnDemand.exe"
Deleted successfully : HKLM\Software\Classes\CLSID\{C24C3824-63D8-42CD-BB5A-77631072FDB2} : "C:\Program Files\Software\Update\1.3.25.0\SoftwareUpdateBroker.exe"
Deleted successfully : HKLM\Software\Classes\CLSID\{D3388703-5092-487C-8217-11ADA1CA68B5} : "C:\DOCUME~1\Clement\LOCALS~1\Temp\DownloadManager.exe"
Deleted successfully : HKLM\Software\Classes\CLSID\{EB41B92A-3A76-4237-9E6B-A5DDC2EAA771} : "C:\Program Files\Software\Update\1.3.25.0\SoftwareUpdateOnDemand.exe"
Deleted successfully : HKLM\Software\Classes\CLSID\{F9A8326E-9C90-4BF2-ACC7-D0883D16AA82} : "C:\Program Files\Software\Update\1.3.25.0\SoftwareUpdateBroker.exe"
Deleted successfully : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3B96B5D3-4A8D-42DC-9CDE-E9B94B3CFE5D}
Deleted successfully : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{ACCC747B-2A59-4F30-BA7C-D26333DE65F5}
Deleted successfully : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3B96B5D3-4A8D-42DC-9CDE-E9B94B3CFE5D}
Deleted successfully : HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{4B8C28A7-A9BC-45F8-990D-21499EED643C} : QuestScan
Deleted successfully : HKLM\Software\Classes\Installer\Products\3F552355DF871F046A8F8628412056EF : C:\DOCUME~1\Clement\LOCALS~1\Temp\IXP255.TMP\
Deleted successfully : [HKU\S-1-5-21-1085031214-1390067357-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run]|[Beamrise] : "C:\Documents and Settings\Clement\Local Settings\Application Data\Beamrise\Application\beamrise.exe" --no-startup-window --auto-launch-at-startup --profile-directory="Default"

¤¤¤¤¤¤¤¤¤¤ | IFEO


¤¤¤¤¤¤¤¤¤¤ | Folders


¤¤¤¤¤¤¤¤¤¤ | Hijack.Shortcut


¤¤¤¤¤¤¤¤¤¤ | Hijack.Internet Explorer

Repaired : [HKU\S-1-5-21-1085031214-1390067357-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet settings]|[WarnonZoneCrossing] : 0 - 1

¤¤¤¤¤¤¤¤¤¤ | Hijack.Google Chrome

[Clement] Reseted successfully : SearchURL
[Clement] Reseted successfully : Preferences

¤¤¤¤¤¤¤¤¤¤ | Hijack.Firefox


¤¤¤¤¤¤¤¤¤¤ | Hijack.StartMenuInternet


¤¤¤¤¤¤¤¤¤¤ | AppInit_DLLs


[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]|[LoadAppInit_DLLs] : 1

¤¤¤¤¤¤¤¤¤¤ | Hijack.Javascript


¤¤¤¤¤¤¤¤¤¤ | Firewall


¤¤¤¤¤¤¤¤¤¤ | Temporary files

[All Users] Temporary files deleted : 0 Ko
[Default User] Temporary files deleted : 0 Ko
[NetworkService] Temporary files deleted : 0 Ko
[LocalService] Temporary files deleted : 0 Ko
[Clement] Temporary files deleted : 0 Ko


¤¤¤¤¤¤¤¤¤¤ |EOF| ¤¤¤¤¤¤¤¤¤¤ | 22:31:16

[vert]

c bon maintenant? Il y a d'autres choses qu'on puisse faire?

[vert]

g3n-h@ckm@n? Je veux juste que tu me dises si c ok maintenant?

[vert]

salut.
bon... jcomprends pas le silence mais merci pr l'aide.

[g3n-h@ckm@n]

hello je t'ai perdu en route désolé on a un souci avec les retours mail

refais OTL comme precedemment

[clem22]

Salut.
ouais jme posais des questions..

voici les liens
http://cjoint.com/?3CmmwLreEXl
http://cjoint.com/?3CmmAtr93OX

[g3n-h@ckm@n]

ok les rapport sont propres t'as encore des soucis ?

[clem22]

non je pense que c bon.

[g3n-h@ckm@n]

alors tu peux relancer shortcut_module , cliquer sur le petit "u" en bas à droite pour le desinstaller completement ( ou le garder pour le passer de temps en tems , toutes facons il a une mise à jour automatique à son lancement )

fais ce ménage pour finir : http://gen-hackman.purforum.com/t50-fin-de-desinfection

[clem22]

ok merci et bonne continuation.

[g3n-h@ckm@n]

prudence ^^