- Vous m'avez envoyé le rapport CLEAN n°3 de Ad-Remover, alors que c'était le n°1 (de
18:53:26) que j'attendais. Mais bon, ça ira.
- Selon ZHPDiag il reste toujours 58 malwares et 47 traces de toolbars parasites, soit ces 105 lignes à nettoyer :
O2 - BHO: Complitly [64Bits] - {0FB6A909-6086-458F-BD92-1F8EE10042A0} . (...) -- C:\Users\Emilie\AppData\Roaming\Complitly\64\Complitly64.dll => Infection BT (Adware.PredictAd)
O2 - BHO: Babylon toolbar helper [64Bits] - {2EECD738-5844-4a99-B4B6-146BF802613B} . (.Babylon BHO - Pas de description.) -- C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll => Infection BT (Toolbar.Babylon)
[MD5.00000000000000000000000000000000] [APT] [{29FF685C-485F-4B77-A19F-9D1FA608C3A9}] (...) -- C:\Users\Emilie\AppData\Local\Babylon\Setup\Setup.exe (.not file.) => Infection BT (Toolbar.Babylon)
O42 - Logiciel: Babylon toolbar on IE - (.Pas de propriétaire.) [HKLM] -- BabylonToolbar => Infection BT (Toolbar.Babylon)
O42 - Logiciel: BrightBreeze - (.Pinball Corporation..) [HKCU] -- BrightBreezeSA => Infection BT (Adware.Hotbar)
[HKCU\Software\BabylonToolbar] => Infection BT (Toolbar.Babylon)
[HKLM\Software\Software]
O43 - CFD: 05/01/2012 - 17:35:28 - [0] ----D- C:\Program Files\Babylon => Infection BT (Toolbar.Babylon)
O43 - CFD: 20/12/2011 - 19:07:36 - [1,725] ----D- C:\Program Files (x86)\BabylonToolbar => Infection BT (Toolbar.Babylon)
O43 - CFD: 05/01/2012 - 10:06:54 - [0] ----D- C:\Program Files (x86)\BrightBreeze => Infection BT (Adware.Hotbar)
O69 - SBI: SearchScopes [HKUS.DEFAULT] {4B8C28A7-A9BC-45F8-990D-21499EED643C} - (QuestScan) -
http://www.questscan.com => Infection BT (Adware.QuestScan)
O69 - SBI: SearchScopes [HKUS\S-1-5-18] {4B8C28A7-A9BC-45F8-990D-21499EED643C} - (QuestScan) -
http://www.questscan.com => Infection BT (Adware.QuestScan)
[HKLM\Software\WOW6432Node\Classes\AppID\esrv.EXE]
[HKLM\Software\WOW6432Node\Classes\AppID{09C554C3-109B-483C-A06B-F14172F1A947}] => Infection BT (Adware.Agent)
[HKLM\Software\WOW6432Node\Classes\CLSID{291BCCC1-6890-484a-89D3-318C928DAC1B}] => Infection BT (Toolbar.Babylon)
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats{2EECD738-5844-4a99-B4B6-146BF802613B}] => Infection BT (Toolbar.Babylon)
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings{2EECD738-5844-4a99-B4B6-146BF802613B}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\CLSID{2EECD738-5844-4a99-B4B6-146BF802613B}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{2EECD738-5844-4a99-B4B6-146BF802613B}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\AppID{35C1605E-438B-4D64-AAB1-8885F097A9B1}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\Classes\TypeLib{35C1605E-438B-4D64-AAB1-8885F097A9B1}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\AppID{442f13bc-2031-42d5-9520-437f65271153}] => Infection PUP (Adware.PredictAd)
[HKLM\Software\WOW6432Node\Classes\Interface{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\AppID{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\Classes\TypeLib{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\Classes\TypeLib{6E8BF012-2C85-4834-B10A-1B31AF173D70}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\Interface{706D4A4B-184A-4434-B331-296B07493D2D}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\Interface{8BE10F21-185F-4CA0-B789-9921674C3993}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\Interface{94C0B25D-3359-4B10-B227-F96A77DB773F}] => Infection BT (Toolbar.Babylon)
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings{97F2FF5B-260C-4ccf-834A-2DDA4E29E39E}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\CLSID{97F2FF5B-260C-4ccf-834A-2DDA4E29E39E}] => Infection BT (Toolbar.Babylon)
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats{98889811-442D-49dd-99D7-DC866BE87DBC}] => Infection BT (Toolbar.Babylon)
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings{98889811-442D-49dd-99D7-DC866BE87DBC}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\CLSID{98889811-442D-49dd-99D7-DC866BE87DBC}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\Interface{A439801C-961D-452C-AB42-7848E9CBD289}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\Interface{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\AppID{B12E99ED-69BD-437C-86BE-C862B9E5444D}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\Interface{B173667F-8395-4317-8DD6-45AD1FE00047}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\Interface{B32672B3-F656-46E0-B584-FE61C0BB6037}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\CLSID{B8276A94-891D-453C-9FF3-715C042A2575}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\AppID{BDB69379-802F-4eaf-B541-F8DE92DD98DB}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\Interface{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\Interface{C2996524-2187-441F-A398-CD6CB6B3D020}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\AppID{D7EE8177-D51E-4F89-92B6-83EA2EC40800}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\Classes\TypeLib{D7EE8177-D51E-4F89-92B6-83EA2EC40800}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\Interface{E047E227-5342-4D94-80F7-CFB154BF55BD}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\Interface{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\CLSID{E46C8196-B634-44a1-AF6E-957C64278AB1}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\Interface{E77EEF95-3E83-4BB8-9C0D-4A5163774997}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\Interface{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Classes\CLSID{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\Google\Chrome\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok]
[HKCU\Software\BabylonToolbar] => Infection BT (Toolbar.Babylon)
[HKLM\Software\WOW6432Node\BabylonToolbar] => Infection BT (Toolbar.Babylon)
C:\Program Files\Babylon => Infection BT (Toolbar.Babylon)
C:\Program Files (x86)\BabylonToolbar => Infection BT (Toolbar.Babylon)
C:\Program Files (x86)\BrightBreeze => Infection BT (Adware.Hotbar)
R3 - URLSearchHook: uTorrentBar_FR Toolbar [64Bits] - {05eeb91a-aef7-4f8a-978f-fb83e7b03f8e} . (.Conduit Ltd. - Conduit Toolbar.) (6.4.0.0) -- C:\Program Files (x86)\uTorrentBar_FR\prxtbuTor.dll
R3 - URLSearchHook: uTorrentBar_FR Toolbar [64Bits] - {05eeb91a-aef7-4f8a-978f-fb83e7b03f8e} . (.Conduit Ltd. - Conduit Toolbar.) (6.4.0.0) -- C:\Program Files (x86)\uTorrentBar_FR\prxtbuTor.dll
O2 - BHO: uTorrentBar_FR [64Bits] - {05eeb91a-aef7-4f8a-978f-fb83e7b03f8e} . (.Conduit Ltd. - Conduit Toolbar.) -- C:\Program Files (x86)\uTorrentBar_FR\prxtbuTor.dll
O2 - BHO: SWEETIE [64Bits] - {EEE6C35C-6118-11DC-9C72-001320C79847} . (.SweetIM Technologies Ltd. - SweetIM Toolbar for Internet Explorer.) -- C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM..\Wow6432Node\Run: [SweetIM] . (.SweetIM Technologies Ltd. - SweetIM Instant Messenger Enhancer.) -- C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe => Macrogaming®SweetIM
O8 - Extra context menu item: Rechercher sur le Web . (...) -- C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\MenuExt.html
[MD5.00000000000000000000000000000000] [APT] [Scheduled Update for Ask Toolbar] (...) -- C:\Program Files (x86)\Ask.com\UpdateTask.exe (.not file.) => Toolbar.Ask
O42 - Logiciel: SweetIM Toolbar for Internet Explorer 4.2 - (.SweetIM Technologies Ltd..) [HKLM] -- {A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3} => Toolbar.SweetIM
O42 - Logiciel: SweetIM for Messenger 3.6 - (.SweetIM Technologies Ltd..) [HKLM] -- {A81A974F-8A22-43E6-9243-5198FF758DA1} => Toolbar.SweetIM
O42 - Logiciel: uTorrentBar_FR Toolbar - (.uTorrentBar_FR.) [HKLM] -- uTorrentBar_FR Toolbar => Toolbar.Conduit
[HKCU\Software\AppDataLow\Software\ConduitSearchScopes] => Toolbar.Conduit
[HKCU\Software\AppDataLow\Software\uTorrentBar_FR] => Toolbar.Conduit
[HKCU\Software\SweetIM] => Toolbar.SweetIM
[HKLM\Software\SweetIM] => Toolbar.SweetIM
[HKLM\Software\uTorrentBar_FR] => Toolbar.Conduit
O43 - CFD: 29/10/2011 - 18:20:04 - [0,246] ----D- C:\ProgramData\SweetIM => Toolbar.SweetIM
O43 - CFD: 29/10/2011 - 18:20:12 - [8,360] ----D- C:\Program Files (x86)\SweetIM => Toolbar.SweetIM
O43 - CFD: 15/10/2011 - 15:24:18 - [4,748] ----D- C:\Program Files (x86)\uTorrentBar_FR => Toolbar.Conduit
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats{05EEB91A-AEF7-4F8A-978F-FB83E7B03F8E}] => Toolbar.Agent
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings{05EEB91A-AEF7-4F8A-978F-FB83E7B03F8E}] => Toolbar.Agent
[HKLM\Software\WOW6432Node\Classes\CLSID{05EEB91A-AEF7-4F8A-978F-FB83E7B03F8E}] => Toolbar.Agent
[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{05EEB91A-AEF7-4F8A-978F-FB83E7B03F8E}] => Toolbar.Agent
[HKLM\Software\Classes\TypeLib{4d3b167e-5fd8-4276-8fd7-9df19c1e4d19}] => Toolbar.SweetIM
[HKLM\Software\WOW6432Node\Classes\CLSID{82ac53b4-164c-4b07-a016-437a8388b81a}] => Toolbar.SweetIM
[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}] => Toolbar.SweetIM
[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall{A81A974F-8A22-43E6-9243-5198FF758DA1}] => Toolbar.SweetIM
[HKLM\Software\WOW6432Node\Classes\Interface{eee6c358-6118-11dc-9c72-001320c79847}] => Toolbar.SweetIM
[HKLM\Software\WOW6432Node\Classes\Interface{eee6c35a-6118-11dc-9c72-001320c79847}] => Toolbar.SweetIM
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats{eee6c35b-6118-11dc-9c72-001320c79847}] => Toolbar.SweetIM
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings{eee6c35b-6118-11dc-9c72-001320c79847}] => Toolbar.SweetIM
[HKLM\Software\WOW6432Node\Classes\CLSID{eee6c35b-6118-11dc-9c72-001320c79847}] => Toolbar.SweetIM
[HKLM\Software\Classes\TypeLib{eee6c35e-6118-11dc-9c72-001320c79847}] => Toolbar.SweetIM
[HKLM\Software\Classes\TypeLib{eee6c35f-6118-11dc-9c72-001320c79847}] => Toolbar.SweetIM
[HKCU\Software\Microsoft\Internet Explorer\SearchScopes{eee6c360-6118-11dc-9c72-001320c79847}] => Toolbar.SweetIM
[HKLM\Software\WOW6432Node\Microsoft\Internet Explorer\SearchScopes{eee6c360-6118-11dc-9c72-001320c79847}] => Toolbar.SweetIM
[HKLM\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{EEE6C367-6118-11DC-9C72-001320C79847}] => Toolbar.SweetIM
[HKCU\Software\AppDataLow\Software\ConduitSearchScopes] => Toolbar.Conduit
[HKCU\Software\SweetIM] => Toolbar.SweetIM
[HKLM\Software\WOW6432Node\SweetIM] => Toolbar.SweetIM
[HKCU\Software\AppDataLow\Software\uTorrentBar_FR] => Toolbar.Conduit
[HKLM\Software\WOW6432Node\uTorrentBar_FR] => Toolbar.Conduit
C:\ProgramData\SweetIM => Toolbar.SweetIM
C:\Users\Emilie\AppData\LocalLow\SweetIM => SweetIM Toolbar
C:\Users\Emilie\AppData\LocalLow\uTorrentBar_FR => Toolbar.Conduit
C:\Program Files (x86)\SweetIM => Toolbar.SweetIM
C:\Program Files (x86)\uTorrentBar_FR => Toolbar.Conduit
C:\Windows\system32\Tasks\Scheduled Update for Ask Toolbar => Toolbar.Ask
3) Méthode de nettoyage en 4 étapes avec ZHPFix
A) Lancer d'abord ZHPDiag (icône en forme de parchemin), puis cliquer sur la flèche verte du menu pour rechercher si mise à jour disponible.
Si oui, faire la mise à jour proposée,
puis refermer ZHPDiag.
B) Maintenant, lancer ZHPFix (Icône en forme de seringue) (Si vous êtes en W7 ou en Vista, après un
clic droit, l'Exécuter en tant qu'administrateur )
Pour bien comprendre la procédure en 4 étapes, consultez les images repérées de ZHPFix sur cette page =>
http://saamu.net/topic1545.html
Allez dans ma liste ci-dessus et copier le bloc de 105 lignes.
- Etape 1 : Dans ZHPFix, cliquer sur le 2ème bouton du menu (repère 1)
Les lignes copiées de la liste vont être collées dans le champ jaune clair.
Vérifier ces lignes.
- Etape 2 : Ensuite, cliquer sur le bouton OK, en bas à droite (repère 2)
A ce moment, des cases vont se mettre devant les lignes collées.
- Etape 3 : Ensuite, cliquer sur le bouton "Tous" en bas à droite (repère 3)
Les cases vont devenir cochées.
(Attention : Fermez maintenant toutes vos autres fenêtres ouvertes et enregistrer vos travaux en cours, car à l'étape suivante, toutes les fenêtres vont se fermer durant la phase de nettoyage)
- Etape 4 : En final, cliquer sur le bouton "GO" en bas à gauche.
Les fenêtres ouvertes vont se fermer et le bureau va disparaitre quelques instants durant le nettoyage par ZHPFix.
=> Me refaire un rapport ZHPDiag, que je vois les améliorations.
(Il reste du boulot, à demain)