Ordinateur ralenti, malware présent - Chatzum toolbarRésolu/Fermé

Question

Bonjour, 

L'ordinateur ralenti de plus en plus. J'ai trouvé la chatzum toolbar dont je n'arrive pas à me defaire. Voici le rapport zhpdiag.
https://www.cjoint.com/?3KtkyL7SQag

et le rapport de Malwarebytes Anti Malware qui a supprimé les "pup funmoods" mais n'ai pas supprimé chatzum. 
https://www.cjoint.com/?3KtkTTk0pwr 

1. Comment me débarasser de Chatzum toolbar
2. Y a-t il autre chose qui cloche ? 


Au secours !
Merci d'avance pour votre aide
loudou





Configuration: Windows 7 / Internet Explorer 9.0

^Abel^ · Answer

Téléchargez et installez sur le bureau en administrateur (pour Vista & 7) AdwCleaner (merci à Xplode)
Lancez AdwCleaner
Cliquez sur le bouton [Suppression] 
Laissez travailler, l'ordinateur sera redémarré produisant un rapport de désinfection que vous copiez/coller dans votre prochaine réponse.
(Le rapport est sauvegardé aussi sous C:\ AdwCleaner[SX].Txt)

loudou · Answer

Merci Abel, 
J ai fait ce que vous m'avez conseillé. 
Voici le rapport de Adw cleaner:

# AdwCleaner v2.008 - Logfile created 11/21/2012 at 14:02:51
# Updated 17/11/2012 by Xplode
# Operating system : Windows 7 Ultimate Service Pack 1 (32 bits)
# User : user - MNIF-VAIO
# Boot Mode : Normal
# Running from : C:\Users\Dasha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\77VQ947P\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

File Deleted : \user.js
File Deleted : C:\Users\Public\Desktop\iLivid.lnk
Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\Babylon

***** [Registry] *****

Key Deleted : HKCU\Software\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj
Key Deleted : HKCU\Software\Iminent
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\Software\ChatZum Toolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj
Key Deleted : HKLM\Software\Iminent
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Key Deleted : HKU\S-1-5-21-3999815118-3144068814-2252246041-1001\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}

***** [Internet Browsers] *****

-\ Internet Explorer v9.0.8112.16421

Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://start.funmoods.com/?f=1&a=ironpub&chnl=ironpub&cd=2XzuyEtN2Y1L1QzutDtDtCtA0AzytDzytBtCtByByE0FyC0CtN0D0Tzu0StByCtBtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1048918475 --> hxxp://www.google.com

*************************

AdwCleaner[R1].txt - [8017 octets] - [21/11/2012 14:01:31]
AdwCleaner[S1].txt - [8006 octets] - [21/11/2012 14:02:51]

########## EOF - \AdwCleaner[S1].txt - [8066 octets] ##########

VOICI LE NOUVEAU RAPPORT ZHPDIAG.


https://www.cjoint.com/?0Kvh5rZq9qO

Il doit y avoir encore quelque chose. Internet explorer est toujours extremement lent, Windows Explorer rame aussi (tout commence par .... ne répond pas) 
C'est quoi toutes ces clés orphelines dans le rapport? En plus le disque dur tourne tout le temps... 

D'avance merci 
Bonne journée 
Dasha

^Abel^ · Answer

Bonjour,
1.  Créer un point de restauration
    voir ici comment faire
2.  Copier le texte en gras ci-dessous (Sélectionner + clic droit --->>> copier)

                        ---------------------------------------------------------
C:\Users\user\AppData\LocalLow\AskToolbar    => Toolbar.Ask
O43 - CFD: 31/08/2012 - 14:50:17 - [0,007] ----D C:\Users\user\AppData\Roaming\Babylon    => Infection BT (Toolbar.Babylon)
C:\Users\user\AppData\Roaming\Babylon    => Infection BT (Toolbar.Babylon)
EmptyTemp
EmptyFlash
EmptyCLSID

			---------------------------------------------------------

3. Ouvrir ZHPFix qui se trouve sur le bureau (clic droit -> exécuter en tant qu'administrateur)
   - En haut clic sur : "Coller le presse papier"
   - En bas clic sur "Go" --->>> "oui"

4. Copier/coller le rapport dans le prochain message.

loudou · Answer

Bonjour,
voici le rapport:
question idiote, c'est clean maintenant? 

j'ai refait un zhpdiag aussi :

https://www.cjoint.com/?0KwdlHjBTTl 

merci 


Rapport de ZHPFix 1.3.06 par Nicolas Coolman, Update du 09/11/2012
 
Fichier d'export Registre : 

Run by user at 22/11/2012 09:38:37
 
Windows 7 Ultimate Edition, 32-bit Service Pack 1 (Build 7601)

?
 
?
 
========== Repertory ==========
 
========== File ==========
 
NOT FOUND Folder/File: c:\users\user\appdata\roaming\babylon
 
DELETED Window Temporary:
 
DELETED Flash Cookies:

?
 
========== Summary ==========
 
3 : File

?
 
End of clean in 00mn 04s

========== Report File ==========
 
C:\ZHP\ZHPFix[R1].txt - 19/11/2012 19:01:35 [4110]
 
C:\ZHP\ZHPFix[R2].txt - 22/11/2012 09:38:39 [544]

^Abel^ · Answer

Bonjour loudou,
Non, il n'y a pas de questions idiotes...

A présent, pour supprimer les outils et fichiers de désinfection devenus inutiles, une dernière action s'impose :

Téléchargez DelFix à cette adresse.
Lancez DelFix puis cliquez sur le bouton [Suppression]
Le rapport est sauvegardé à la racine du disque dur (C:\DelFixSuppr.txt)
Désinstallation
Afin de ne laisser aucune trace de DelFix sur votre PC, vous pouvez le relancer et cliquer sur [Désinstallation].

A l'avenir lors de téléchargements, privilégiez les sites officiels, evitez Softonic et 01Net.com, et décochez les toolbars, elles ne sont pas obligatoires !
Un peu de lecture ici... et ici.

Pour la maintenance (nettoyage et correction des registres) utilisez Ccleaner

Bonne navigation :)

PS : En dernier lieu, pensez à marquer Sujet Résolu.

loudou · Answer

Bonjour, 
Avant de procéder : pourquoi faut-il supprimer mcagent.exe. Cela ne fait il pas partie de l antivirus? Et est ce que ça affectera le fonctionnement de McAfee?
Merci

Ordinateur ralenti, malware présent - Chatzum toolbar

6 réponses

Discussions similaires

Newsletters