plusieurs virus puissants Résolu/Fermé

Question

Bonjour, 
Mon fils fait appel à moi pour nettoyer son PC, salement infesté ! j'ai eu bcp de mal à venir poster ici, des pages s'ouvrent, très indésidérables, et par contre Comment ça marche se fermait tout seul. J'ai pu y arriver en désinstallant laborieusement quelques barres de recherche ... Mais le souci est là.
Je vous demande donc de l'aide, selon votre bonne volonté - et ce qu'il me sera possible de faire. Merci d'avance.

Malekal_morte- · Answer

Salut,

Tu as installé des adwares et programmes parasites sur ton PC qui ouvrent des publicités et ralentissent l'ordinateur et les navigateurs WEB.
Voici la procédure à suivre pour les supprimer :

Suis la procédure suivante donnée dans ce lien :
==>  https://www.commentcamarche.net/faq/2490-supprimer-les-adwares-publicites-intempestives-pop-up-etc <===
Clic sur le lien ci-dessus et suis la procédure à la lettre.
Fournis les rapports AdwCleaner et OTL via le site pjjoint comme cela est demandé.

Tu dois :
1/ Faire un nettoyage AdwCleaner et fournir le rapport.
2/ Réinitialiser les navigateurs
3/ Faire un scan OTL et fournir le ou les rapports.

jiconnaisrien · Answer

re !
j'ai commencé à faire ce que vous disiez, péniblement, et ô miracle ça a fonctionné !
le scan s'est effecté, j'ai cliqué sur nettoyer. 
l'ordi de mon fils a redémarré et là impossible de se connecter à internet au redémarrage (ça me met : impossible de se connecter au serveur proxy)
suis dépassée ! alors que ça me met bien qu'il est connecté à la box !

Malekal_morte- · Answer

Désinstalle GoogleToolbar.


Relance OTL. 
o sous Personnalisation (Custom Scan), copie_colle le contenu du cadre ci dessous (bien prendre :OTL en début).
Clic Correction (Fix), un rapport apparraitra, copie/colle le contenu ici:  



:OTL
O2:[b]64bit:[/b] - BHO: (HomeTab) - {0d687747-ed29-4f98-ae2d-ea537ec4ea34} - C:\Program Files\HomeTab\IE\HomeTab.dll File not found
O2:[b]64bit:[/b] - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (HomeTab) - {0d687747-ed29-4f98-ae2d-ea537ec4ea34} - C:\Program Files (x86)\HomeTab\IE\HomeTab.dll File not found
O2 - BHO: (Re-markit) - {AE96960D-6E92-AC5C-C7C6-63AACE80F66E} - C:\Program Files (x86)\Re-markit-soft\174.dll File not found 
 CHR - Extension: Re-markit = C:\Users\Mon-pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbdmfhakmcfhnhcbcegncngjnojijla\1.174.0.0_0\ 
 O4 - HKU\S-1-5-21-3169868141-61559304-314896198-1000..\Run: [PennyBee] C:\Users\Mon-pc\AppData\Local\PennyBee\pennybee\1.3.8.3\pennybee.exe (Pay By Ads LTD) 
 [2014/06/18 15:27:20 | 000,000,000 | ---D | C] -- C:\Users\Mon-pc\AppData\Local\PennyBee
[2014/06/18 15:20:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JFileManager
[2014/06/18 15:20:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\JFileManager
[2014/06/18 15:19:59 | 000,000,000 | ---D | C] -- C:\Users\Mon-pc\AppData\Local\JFileManager
[2014/06/18 15:17:19 | 000,000,000 | ---D | C] -- C:\Users\Mon-pc\AppData\Local\Genesis_06181317
[2014/06/18 14:39:51 | 000,000,000 | ---D | C] -- C:\Users\Mon-pc\AppData\Local\Diagnostics
[2014/06/18 14:33:30 | 000,000,000 | ---D | C] -- C:\Users\Mon-pc\AppData\Local\Genesis_06181233 
 DRV:[b]64bit:[/b] - [2014/04/24 12:21:40 | 000,061,112 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\{c047df5e-0fda-4055-b5db-a96a8a34a094}w64.sys -- ({c047df5e-0fda-4055-b5db-a96a8a34a094}w64) 
 O4 - HKLM..\Run: [Bench Communicator Watcher] C:\Program Files (x86)\Bench\Proxy\pwdg.exe File not found
O4 - HKLM..\Run: [Bench Settings Cleaner] C:\Program Files (x86)\Bench\Proxy\cl.exe File not found 
:files
C:\Users\Mon-pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbdmfhakmcfhnhcbcegncngjnojijla\

* poste le rapport ici 



Redémarre l'ordinateur

 
 
Like the angel you are, you laugh creating a lightness in my chest,
Your eyes they penetrate me,
(Your answer's always 'maybe')
That's when I got up and left

jiconnaisrien · Answer

voici le rapport : (le PC a redémarré avant l'affichage du rapport)

========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0d687747-ed29-4f98-ae2d-ea537ec4ea34}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0d687747-ed29-4f98-ae2d-ea537ec4ea34}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE96960D-6E92-AC5C-C7C6-63AACE80F66E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AE96960D-6E92-AC5C-C7C6-63AACE80F66E}\ deleted successfully.
C:\Users\Mon-pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbdmfhakmcfhnhcbcegncngjnojijla\1.174.0.0_0 folder moved successfully.
Registry value HKEY_USERS\S-1-5-21-3169868141-61559304-314896198-1000\Software\Microsoft\Windows\CurrentVersion\Run\PennyBee deleted successfully.
C:\Users\Mon-pc\AppData\Local\PennyBee\pennybee\1.3.8.3\pennybee.exe moved successfully.
Folder move failed. C:\Users\Mon-pc\AppData\Local\PennyBee\pennybee\1.3.8.3 scheduled to be moved on reboot.
Folder move failed. C:\Users\Mon-pc\AppData\Local\PennyBee\pennybee scheduled to be moved on reboot.
Folder move failed. C:\Users\Mon-pc\AppData\Local\PennyBee scheduled to be moved on reboot.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JFileManager folder moved successfully.
C:\Program Files (x86)\JFileManager\Languages folder moved successfully.
C:\Program Files (x86)\JFileManager folder moved successfully.
C:\Users\Mon-pc\AppData\Local\JFileManager\Downloads\Torrents folder moved successfully.
C:\Users\Mon-pc\AppData\Local\JFileManager\Downloads folder moved successfully.
C:\Users\Mon-pc\AppData\Local\JFileManager folder moved successfully.
C:\Users\Mon-pc\AppData\Local\Genesis_06181317 folder moved successfully.
C:\Users\Mon-pc\AppData\Local\Diagnostics\733862231\2014061812.000 folder moved successfully.
C:\Users\Mon-pc\AppData\Local\Diagnostics\733862231 folder moved successfully.
C:\Users\Mon-pc\AppData\Local\Diagnostics\460911090\2014061815.003 folder moved successfully.
C:\Users\Mon-pc\AppData\Local\Diagnostics\460911090\2014061815.002 folder moved successfully.
C:\Users\Mon-pc\AppData\Local\Diagnostics\460911090\2014061815.001 folder moved successfully.
C:\Users\Mon-pc\AppData\Local\Diagnostics\460911090\2014061815.000 folder moved successfully.
C:\Users\Mon-pc\AppData\Local\Diagnostics\460911090 folder moved successfully.
C:\Users\Mon-pc\AppData\Local\Diagnostics\1158610846\2014061815.000 folder moved successfully.
C:\Users\Mon-pc\AppData\Local\Diagnostics\1158610846 folder moved successfully.
C:\Users\Mon-pc\AppData\Local\Diagnostics folder moved successfully.
C:\Users\Mon-pc\AppData\Local\Genesis_06181233 folder moved successfully.
Service {c047df5e-0fda-4055-b5db-a96a8a34a094}w64 stopped successfully!
Service {c047df5e-0fda-4055-b5db-a96a8a34a094}w64 deleted successfully!
C:\Windows\SysNative\drivers\{c047df5e-0fda-4055-b5db-a96a8a34a094}w64.sys moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Bench Communicator Watcher deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Bench Settings Cleaner deleted successfully.
========== FILES ==========
C:\Users\Mon-pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbdmfhakmcfhnhcbcegncngjnojijla folder moved successfully.
 
OTL by OldTimer - Version 3.2.69.0 log created on 06202014_094022

Files\Folders moved on Reboot...
C:\Users\Mon-pc\AppData\Local\PennyBee\pennybee\1.3.8.3 folder moved successfully.
C:\Users\Mon-pc\AppData\Local\PennyBee\pennybee folder moved successfully.
C:\Users\Mon-pc\AppData\Local\PennyBee folder moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Malekal_morte- · Answer

y a du mieux ?

jiconnaisrien · Answer

nettement ! quelle différence ! merci beaucoup !

Malekal_morte- · Answer

cool :)

Installe Malwarebyte's Anti-Malware : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Fais des scans réguliers avec, il est efficace.



Pour ne plus te faire avoir.
A lire - Programmes parasites / PUPs : https://www.malekal.com/adwares-pup-protection/

jiconnaisrien · Answer

merci ; bonne journée !

Plusieurs virus puissants

8 réponses

Discussions similaires