Plusieurs virus puissants

Résolu
Bonjour,
Mon fils fait appel à moi pour nettoyer son PC, salement infesté ! j'ai eu bcp de mal à venir poster ici, des pages s'ouvrent, très indésidérables, et par contre Comment ça marche se fermait tout seul. J'ai pu y arriver en désinstallant laborieusement quelques barres de recherche ... Mais le souci est là.
Je vous demande donc de l'aide, selon votre bonne volonté - et ce qu'il me sera possible de faire. Merci d'avance.

8 réponses

  1. Modérateur
    Salut,

    Tu as installé des adwares et programmes parasites sur ton PC qui ouvrent des publicités et ralentissent l'ordinateur et les navigateurs WEB.
    Voici la procédure à suivre pour les supprimer :

    Suis la procédure suivante donnée dans ce lien :
    ==> https://www.commentcamarche.net/faq/2490-supprimer-les-adwares-publicites-intempestives-pop-up-etc <===
    Clic sur le lien ci-dessus et suis la procédure à la lettre.
    Fournis les rapports AdwCleaner et OTL via le site pjjoint comme cela est demandé.

    Tu dois :
    1/ Faire un nettoyage AdwCleaner et fournir le rapport.
    2/ Réinitialiser les navigateurs
    3/ Faire un scan OTL et fournir le ou les rapports.

    1. re !
      j'ai commencé à faire ce que vous disiez, péniblement, et ô miracle ça a fonctionné !
      le scan s'est effecté, j'ai cliqué sur nettoyer.
      l'ordi de mon fils a redémarré et là impossible de se connecter à internet au redémarrage (ça me met : impossible de se connecter au serveur proxy)
      suis dépassée ! alors que ça me met bien qu'il est connecté à la box !
      1. Modérateur
        Le rapport OTL est à donner via pjoint
    2. Modérateur
      Désinstalle GoogleToolbar.

      Relance OTL.
      o sous Personnalisation (Custom Scan), copie_colle le contenu du cadre ci dessous (bien prendre :OTL en début).
      Clic Correction (Fix), un rapport apparraitra, copie/colle le contenu ici:

      :OTL
      O2:[b]64bit:[/b] - BHO: (HomeTab) - {0d687747-ed29-4f98-ae2d-ea537ec4ea34} - C:\Program Files\HomeTab\IE\HomeTab.dll File not found
      O2:[b]64bit:[/b] - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
      O2 - BHO: (HomeTab) - {0d687747-ed29-4f98-ae2d-ea537ec4ea34} - C:\Program Files (x86)\HomeTab\IE\HomeTab.dll File not found
      O2 - BHO: (Re-markit) - {AE96960D-6E92-AC5C-C7C6-63AACE80F66E} - C:\Program Files (x86)\Re-markit-soft\174.dll File not found
      CHR - Extension: Re-markit = C:\Users\Mon-pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbdmfhakmcfhnhcbcegncngjnojijla\1.174.0.0_0\
      O4 - HKU\S-1-5-21-3169868141-61559304-314896198-1000..\Run: [PennyBee] C:\Users\Mon-pc\AppData\Local\PennyBee\pennybee\1.3.8.3\pennybee.exe (Pay By Ads LTD)
      [2014/06/18 15:27:20 | 000,000,000 | ---D | C] -- C:\Users\Mon-pc\AppData\Local\PennyBee
      [2014/06/18 15:20:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JFileManager
      [2014/06/18 15:20:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\JFileManager
      [2014/06/18 15:19:59 | 000,000,000 | ---D | C] -- C:\Users\Mon-pc\AppData\Local\JFileManager
      [2014/06/18 15:17:19 | 000,000,000 | ---D | C] -- C:\Users\Mon-pc\AppData\Local\Genesis_06181317
      [2014/06/18 14:39:51 | 000,000,000 | ---D | C] -- C:\Users\Mon-pc\AppData\Local\Diagnostics
      [2014/06/18 14:33:30 | 000,000,000 | ---D | C] -- C:\Users\Mon-pc\AppData\Local\Genesis_06181233
      DRV:[b]64bit:[/b] - [2014/04/24 12:21:40 | 000,061,112 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\{c047df5e-0fda-4055-b5db-a96a8a34a094}w64.sys -- ({c047df5e-0fda-4055-b5db-a96a8a34a094}w64)
      O4 - HKLM..\Run: [Bench Communicator Watcher] C:\Program Files (x86)\Bench\Proxy\pwdg.exe File not found
      O4 - HKLM..\Run: [Bench Settings Cleaner] C:\Program Files (x86)\Bench\Proxy\cl.exe File not found
      :files
      C:\Users\Mon-pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbdmfhakmcfhnhcbcegncngjnojijla\

      * poste le rapport ici

      Redémarre l'ordinateur

      Like the angel you are, you laugh creating a lightness in my chest,
      Your eyes they penetrate me,
      (Your answer's always 'maybe')
      That's when I got up and left
      1. voici le rapport : (le PC a redémarré avant l'affichage du rapport)

        ========== OTL ==========
        Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0d687747-ed29-4f98-ae2d-ea537ec4ea34}\ deleted successfully.
        Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0d687747-ed29-4f98-ae2d-ea537ec4ea34}\ deleted successfully.
        Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE96960D-6E92-AC5C-C7C6-63AACE80F66E}\ deleted successfully.
        Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AE96960D-6E92-AC5C-C7C6-63AACE80F66E}\ deleted successfully.
        C:\Users\Mon-pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbdmfhakmcfhnhcbcegncngjnojijla\1.174.0.0_0 folder moved successfully.
        Registry value HKEY_USERS\S-1-5-21-3169868141-61559304-314896198-1000\Software\Microsoft\Windows\CurrentVersion\Run\\PennyBee deleted successfully.
        C:\Users\Mon-pc\AppData\Local\PennyBee\pennybee\1.3.8.3\pennybee.exe moved successfully.
        Folder move failed. C:\Users\Mon-pc\AppData\Local\PennyBee\pennybee\1.3.8.3 scheduled to be moved on reboot.
        Folder move failed. C:\Users\Mon-pc\AppData\Local\PennyBee\pennybee scheduled to be moved on reboot.
        Folder move failed. C:\Users\Mon-pc\AppData\Local\PennyBee scheduled to be moved on reboot.
        C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JFileManager folder moved successfully.
        C:\Program Files (x86)\JFileManager\Languages folder moved successfully.
        C:\Program Files (x86)\JFileManager folder moved successfully.
        C:\Users\Mon-pc\AppData\Local\JFileManager\Downloads\Torrents folder moved successfully.
        C:\Users\Mon-pc\AppData\Local\JFileManager\Downloads folder moved successfully.
        C:\Users\Mon-pc\AppData\Local\JFileManager folder moved successfully.
        C:\Users\Mon-pc\AppData\Local\Genesis_06181317 folder moved successfully.
        C:\Users\Mon-pc\AppData\Local\Diagnostics\733862231\2014061812.000 folder moved successfully.
        C:\Users\Mon-pc\AppData\Local\Diagnostics\733862231 folder moved successfully.
        C:\Users\Mon-pc\AppData\Local\Diagnostics\460911090\2014061815.003 folder moved successfully.
        C:\Users\Mon-pc\AppData\Local\Diagnostics\460911090\2014061815.002 folder moved successfully.
        C:\Users\Mon-pc\AppData\Local\Diagnostics\460911090\2014061815.001 folder moved successfully.
        C:\Users\Mon-pc\AppData\Local\Diagnostics\460911090\2014061815.000 folder moved successfully.
        C:\Users\Mon-pc\AppData\Local\Diagnostics\460911090 folder moved successfully.
        C:\Users\Mon-pc\AppData\Local\Diagnostics\1158610846\2014061815.000 folder moved successfully.
        C:\Users\Mon-pc\AppData\Local\Diagnostics\1158610846 folder moved successfully.
        C:\Users\Mon-pc\AppData\Local\Diagnostics folder moved successfully.
        C:\Users\Mon-pc\AppData\Local\Genesis_06181233 folder moved successfully.
        Service {c047df5e-0fda-4055-b5db-a96a8a34a094}w64 stopped successfully!
        Service {c047df5e-0fda-4055-b5db-a96a8a34a094}w64 deleted successfully!
        C:\Windows\SysNative\drivers\{c047df5e-0fda-4055-b5db-a96a8a34a094}w64.sys moved successfully.
        Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Bench Communicator Watcher deleted successfully.
        Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Bench Settings Cleaner deleted successfully.
        ========== FILES ==========
        C:\Users\Mon-pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbdmfhakmcfhnhcbcegncngjnojijla folder moved successfully.

        OTL by OldTimer - Version 3.2.69.0 log created on 06202014_094022

        Files\Folders moved on Reboot...
        C:\Users\Mon-pc\AppData\Local\PennyBee\pennybee\1.3.8.3 folder moved successfully.
        C:\Users\Mon-pc\AppData\Local\PennyBee\pennybee folder moved successfully.
        C:\Users\Mon-pc\AppData\Local\PennyBee folder moved successfully.

        PendingFileRenameOperations files...

        Registry entries deleted on Reboot...