I concurr. I'm running WIndows Version 7 Ultimate.
I run JRT before hand - it executes without issue.
Then run ADWCLEANER and the machine is crashing with Blue Screen of Death!
Bonjour,
La clé HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C} semble être une vaccination Spybot et devrait être ignorée, cordialement.
How to remove this?
***** [ Services ] *****
***** [ Bestanden / Mappen ] *****
***** [ Geplande taken ] *****
Taak Gevonden : Dealply
Taak Gevonden : DealPlyUpdate
Taak Gevonden : Express FilesUpdate
Taak Gevonden : globalUpdateUpdateTaskMachineCore
Taak Gevonden : globalUpdateUpdateTaskMachineUA
Taak Gevonden : Searchya
***** [ Snelkoppelingen ] *****
***** [ Register ] *****
***** [ Webbrowsers ] *****
-\\ Internet Explorer v9.0.8112.16659
-\\ Mozilla Firefox v38.0.5 (x86 nl)
-\\ Google Chrome v43.0.2357.124
*************************
AdwCleaner[R45].txt - [1060 bytes] - [12/05/2015 18:00:12]
AdwCleaner[R46].txt - [1120 bytes] - [25/05/2015 17:57:22]
AdwCleaner[R47].txt - [1181 bytes] - [02/06/2015 10:10:28]
AdwCleaner[R48].txt - [1334 bytes] - [12/06/2015 10:19:03]
AdwCleaner[R49].txt - [1162 bytes] - [12/06/2015 10:33:10]
AdwCleaner[S13].txt - [1184 bytes] - [12/06/2015 10:26:55]
########## EOF - C:\AdwCleaner\AdwCleaner[R49].txt - [1282 bytes] ##########
IRON67 Mach eine Ausnahme rein dann macht Avast es nicht mehr.
Hi
I have downloaded a newer version of adwcleaner 4.113, still it cannot detect and remove the infected Babylon registry keys...
secman.DLL\
HKLM\SOFTWARE\Classes\AppID\
secman.OutlookSecurityManager.1\
HKLM\SOFTWARE\Classes\
secman.OutlookSecurityManager\
HKLM\SOFTWARE\Classes\
secman.DLL\
HKLM\SOFTWARE\Classes\Wow6432Node\AppID\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
"DllName"="BabylonToolbarTlbr.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
"DllName"="BabylonToolbarTlbr.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
"DllName"="BabylonToolbarTlbr.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
"DllName"="BabylonToolbarTlbr.dll"
Bonjour,
AdwCleaner v4.110, v.4.111 et la nouvelle version v4.112 mentionnent 3 clés appartenant à AVS dont je reprend le contenu partiel ci-dessous.
[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeClassesCLSID{28C02550-6572-401a-A2AE-5BC703C9BBA6}InprocServer32]
@="C:Program Files (x86)Common FilesAVSMediaActiveXAVSAudioDXPlayer3.dll"
[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeClassesCLSID{A1CCCE0D-AE21-42A2-BE58-8E6109410995}InprocServer32]
@="C:Program Files (x86)Common FilesAVSMediaActiveXAVSAudioDxPlayer4.dll"
[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeClassesCLSID{CD4D7B0F-45C6-4bb2-A1E7-54D1754E7FC5}InprocServer32]
@="C:Program Files (x86)Common FilesAVSMediaActiveXAVSAudioDXTransform3.dll"
Je l'ai ai déjà signalés auparavant et pense qu'il s'agit de faux positifs car ces clés semblent nécessaires au logiciel AVS4YOU.
Pourriez vous me renseigner, s'il vous plait, par email
D'avance merci
Bonjour,
AdwCleaner v4.110 et la nouvelle version v4.111 mentionnent 3 clés appartenant à AVS dont je reprend le contenu partiel ci-dessous.
[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeClassesCLSID{28C02550-6572-401a-A2AE-5BC703C9BBA6}InprocServer32]
@="C:Program Files (x86)Common FilesAVSMediaActiveXAVSAudioDXPlayer3.dll"
[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeClassesCLSID{A1CCCE0D-AE21-42A2-BE58-8E6109410995}InprocServer32]
@="C:Program Files (x86)Common FilesAVSMediaActiveXAVSAudioDxPlayer4.dll"
[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeClassesCLSID{CD4D7B0F-45C6-4bb2-A1E7-54D1754E7FC5}InprocServer32]
@="C:Program Files (x86)Common FilesAVSMediaActiveXAVSAudioDXTransform3.dll"
Je pense qu'il s'agit de faux positifs car ces clés semblent nécessaires.
D'avance merci
Bonjour,
Prévoyez vous de faire une version en ligne de commande et qui se met a jour automatiquement?
Nous voudrions utiliser ce soft sur un parc de milliers de machines.
Merci
New Malware
===========
Name: Searchult
Action: Change home page of Firefox/Chrome
Location: %UserProfile%\AppData\Roaming\Macwebtoise
*Need to close explorer.exe to disinfect
