Bonjour,
Le répertoire protected créé par une de mes applications est systématiquement mis en quarantaine. Est-ce normal ?
Ci-après un extrait du log:
# AdwCleaner v4.112 - Logfile created 18/03/2015 at 18:01:18
# Updated 09/03/2015 by Xplode
# Database : 2015-03-15.1 [Server]
# Operating system : Windows 7 Enterprise Service Pack 1 (x64)
# Username : XXXXXXX - XXXXXXXXXXXX
# Running from : C:\My Program Files\adwcleaner_4-112_fr_430277.exe
# Option : Cleaning
***** [ Services ] *****
***** [ Files / Folders ] *****
Folder Deleted : C:\Users\XXXXXXX\Documents\protected
***** [ Scheduled tasks ] *****
…
Par avance merci de votre aide.
Je confirme :
La suppression du dossier "C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\***.default\Extensions\{3b56bcc7-54e5-44a2-9b44-66c3ef58c13e}" enlève le module de Firefox HTML Validator et la supression du dossier "C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\icpgjfneehieebagbmdbhnlpiopdcmna" "casse" sans enlever le module de Chrome New Tab Redirect.
Ça se corrige facilement, mais ce n'est pas très propre pour ce petit utilitaire sympathique.
Bonjour ,
Si quelqu'un me m'aider !!!! dans le rapport avec AdwCleaner ,il ressors les virus ci dessous !!! Comment faut-il que je fasse pour les supprimer? merci à vous .
Dossier Trouvé : C:\Users\armant\AppData\Local\HealthAlert
Clé Trouvée : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
Clé Trouvée : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.superfish.com
As far as I can see from log,it looks like scanning is stuck at Pale Moon.
IE11 and Firefox 36 are scanned.Everything was fine 7 days ago.Maybe something is wrong with
database.
Bonjour malgré la derniere version d'AdwCleaner il y a toujours 3 faux positifs concerant 3 logiciels sain.
Il s'agit de LastPass (je n ai pas de rapport car un ami m a dit qu il y avait faux positifs.
Concernant les 2 autres il s'agit d'IDM http://www.internetdownloadmanager.com/download.html
Clé Trouvée : HKLM\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}
Clé Trouvée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}
Clé Trouvée : [x64] HKLM\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}
Clé Trouvée : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}
et de la nouvelle version 15 de Driver Genius http://www.driver-soft.com/
Dossier Trouvé : C:\Program Files (x86)\driver-soft
Dossier Trouvé : C:\ProgramData\drivergenius
Dossier Trouvé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\driver genius
Fichier Trouvé : C:\Users\m\Desktop\Driver Genius.lnk
***** [ Tâches planifiées ] *****
***** [ Raccourcis ] *****
***** [ Registre ] *****
Clé Trouvée : HKLM\SOFTWARE\Classes\CLSID\{059EACC2-1ABE-49E8-928D-DC8BD355B7A9}
Clé Trouvée : HKLM\SOFTWARE\Driver-Soft
Clé Trouvée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Driver Genius_is1
Super utilitaire, Xplode tu es un dieu ^^
Un petit faux positif ...à mon humble avis le dossier C:\Users\moi\AppData\Local\CrashRpt
Ce dossier, dans mon cas, contient juste un dossier de rapport du jeu Red orchestra2.
False positives (it's a legitimate VPN extension):
C:\Users\User\AppData\Local\Hola
HKLM\SOFTWARE\Google\Chrome\Extensions\ncffjdbbodifgldkcbhmiiljfcbgjag
If I remember correctly there's also a false positive for the Hola Unblocker Firefox add-on. However, the Firefox add-on stopped working for me - possibly due to AdwCleaner cleaning away files needed for it to work - and re-installing it doesn't help, so I can't submit a report for that add-on. The add-on can be installed from here if anyone wants to have a look at it: http://hola.org/
The following entries are false positives:
C:\Documents and Settings\User\Application Data\ProgSense (included with some software to look for updates - nothing malicious or deceiving)
C:\Documents and Settings\User\Application Data\Simple Adblock (adblocker now known as Adblock Plus knowingly installed by user for Internet Explorer)
C:\Documents and Settings\User\Local Settings\Application Data\Hola (knowingly installed by user)
HKCU\Software\ProgSense (included with some software to look for updates - nothing malicious or deceiving)
HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762} (belongs to ZoomBrowser EX, a Canon camera utility)
The following are proxy settings knowingly added by user:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyEnable] - 1
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - socks=localhost:1234
Thanks in advance for correcting the issue.
@cocochepeau
Here are most of the entries I could find. I believe the Hotspot Shield drivers might be the culprit. One user had a driver inside Device Manager. Replacing that driver with one from another working computer seems to have corrected the connection issue.
Folder Deleted : C:\ProgramData\hotspot shield
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hotspot shield
Folder Deleted : C:\Program Files (x86)\hotspot shield
Folder Deleted : C:\Windows\SysWOW64\hotspot shield
File Deleted : C:\Windows\System32\drivers\taphss6.sys
File Deleted : C:\Windows\System32\drivers\hssdrv6.sys
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\hotspotshield
Key Deleted : HKLM\SOFTWARE\hotspotshield
Key Deleted : HKCU\Software\anchorfree
Folder Found : C:\Users\Sid\AppData\Roaming\hotspot shield
Folder Found : C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\hotspot shield
New Malware
===========
Name: Searchult
Action: Change home page of Firefox/Chrome
Location: %UserProfile%\AppData\Roaming\Macwebtoise
*Need to close explorer.exe to disinfect
