Storm Alert persiste Après AdwCleanerRésolu/Fermé

Question

Bonjour, voila j'ai le fameux virus storm alert qui semble être un adware, j'ai donc utilisé Adwclaner, qui le supprime mais qui revient par la suite assez rapidement, c'est à dire dans l'heure qui suit, je souhaiterais donc savoir comment le supprimer définitivement...

Malekal_morte- · Answer

Salut,


Suis ce tutorial : https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/
Cela va générer deux rapports FRST.
Envoie comme expliqué, ces deux rapports sur le site http://pjjoint.malekal.com et donne les trois liens pjjoint de ces rapports afin qu'ils puissent être consultés.

AustinOGC · Answer

Je suis en train d'effectuer le scan, merci pour ta réponse !

AustinOGC · Answer

Addition --> https://pjjoint.malekal.com/files.php?id=20141230_m11u13w14d13x8
FRST --> https://pjjoint.malekal.com/files.php?id=20141230_g11o15w14i14b7
Shortcut--> https://pjjoint.malekal.com/files.php?id=20141230_z13e14n13o6f13
Voila, tu as précisé 2 mais le tutoriel parle de 3 rapports, j'imagine que le shortcut est en trop vu que j'ai dû le cocher mais je te le donne comme même :)

AustinOGC · Answer

J'espère qu'avec ceci je n'expose rien de compromettant :3

Malekal_morte- · Answer

Voici la correction à effectuer avec FRST.
Tu peux t'inspirer de cette note explicative avec des captures d'écran pour t'aider: https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/#fix

Ouvre le bloc-notes : Touche Windows + R, dans le champs executer, tape notepad et OK.
Copie/colle dedans ce qui suit : 

HKU\S-1-5-18\...\Run: [BackgroundContainer] => C:\Windows\SysWOW64\Rundll32.exe C:\Users\Austin\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll,DllRun <===== ATTENTION  
 ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled. 
ProxyServer: [.DEFAULT] => http=127.0.0.1:8879;https=127.0.0.1:8879 
ProxyEnable: [S-1-5-19] => Internet Explorer proxy is enabled. 
ProxyServer: [S-1-5-19] => http=127.0.0.1:8879;https=127.0.0.1:8879 
ProxyEnable: [S-1-5-20] => Internet Explorer proxy is enabled. 
ProxyServer: [S-1-5-20] => http=127.0.0.1:8879;https=127.0.0.1:8879 
ProxyServer: [S-1-5-21-1205964606-2941361082-3043000874-1003] => http=127.0.0.1:6230;https=127.0.0.1:6230 
 CHR Extension: (Bubble Elements) - C:\Users\Austin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcijkonhppildbjgkdaglmeoeemcldha [2014-11-18]  
  CHR Extension: (easytoshop) - C:\Users\Austin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bmljgckjdofhaeampofpbknnolikikol [2014-11-19]  
  R2 boDDSWLOm; C:\ProgramData\uUjnaoRKUsi\boDDSWLOm.exe [2726776 2014-12-26] (Rational Thought Solutions) 
  S2 cae99edb; C:\Windows\system32\rundll32.exe c:\Program Files (x86)\Super Optimizer\SupOptCrash.dll,ENT 
   2014-12-30 16:03 - 2014-12-30 17:23 - 00000000 ____D () C:\Users\Austin\AppData\Local\StormAlert  
    2014-12-26 15:18 - 2014-12-26 15:18 - 00000000 ____D () C:\ProgramData\1078601655 
   C:\ProgramData\uUjnaoRKUsi

Une fois, le texte coller dans le bloc-note.
Menu Fichier puis Enregistrer sous.
A gauche, place toi sur le bureau.
Dans le champs en bas, nom du fichier mets : fixlist.txt
Clic sur Enregistrer - cela va créer un fichier fixlist.txt sur le bureau.

Relance FRST et clic sur le bouton Fix
Selon comment un redémarrage est nécessaire (pas obligatoire).
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message. 

Redémarre l'ordinateur
 
 
Like the angel you are, you laugh creating a lightness in my chest,
Your eyes they penetrate me,
(Your answer's always 'maybe')
That's when I got up and left

AustinOGC · Answer

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 28-12-2014 Ran by Austin at 2014-12-30 17:54:14 Run:1 Running from C:\Users\Austin\Desktop Loaded Profile: Austin (Available profiles: Christine & Austin) Boot Mode: Normal ============================================== Content of fixlist: ***************** HKU\S-1-5-18\...\Run: [BackgroundContainer] => C:\Windows\SysWOW64\Rundll32.exe C:\Users\Austin\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll,DllRun <===== ATTENTION ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled. ProxyServer: [.DEFAULT] => http=127.0.0.1:8879;https=127.0.0.1:8879 ProxyEnable: [S-1-5-19] => Internet Explorer proxy is enabled. ProxyServer: [S-1-5-19] => http=127.0.0.1:8879;https=127.0.0.1:8879 ProxyEnable: [S-1-5-20] => Internet Explorer proxy is enabled. ProxyServer: [S-1-5-20] => http=127.0.0.1:8879;https=127.0.0.1:8879 ProxyServer: [S-1-5-21-1205964606-2941361082-3043000874-1003] => http=127.0.0.1:6230;https=127.0.0.1:6230 CHR Extension: (Bubble Elements) - C:\Users\Austin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcijkonhppildbjgkdaglmeoeemcldha [2014-11-18] CHR Extension: (easytoshop) - C:\Users\Austin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bmljgckjdofhaeampofpbknnolikikol [2014-11-19] R2 boDDSWLOm; C:\ProgramData\uUjnaoRKUsi\boDDSWLOm.exe [2726776 2014-12-26] (Rational Thought Solutions) S2 cae99edb; C:\Windows\system32 undll32.exe c:\Program Files (x86)\Super Optimizer\SupOptCrash.dll,ENT 2014-12-30 16:03 - 2014-12-30 17:23 - 00000000 ____D () C:\Users\Austin\AppData\Local\StormAlert 2014-12-26 15:18 - 2014-12-26 15:18 - 00000000 ____D () C:\ProgramData\1078601655 C:\ProgramData\uUjnaoRKUsi ***************** HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run\BackgroundContainer => value deleted successfully. HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable => value deleted successfully. HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer => value deleted successfully. HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable => value deleted successfully. HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer => value deleted successfully. HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable => value deleted successfully. HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer => value deleted successfully. HKU\S-1-5-21-1205964606-2941361082-3043000874-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer => value deleted successfully. C:\Users\Austin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcijkonhppildbjgkdaglmeoeemcldha => Moved successfully. C:\Users\Austin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bmljgckjdofhaeampofpbknnolikikol => Moved successfully. boDDSWLOm => Unable to stop service boDDSWLOm => Service deleted successfully. cae99edb => Service deleted successfully. C:\Users\Austin\AppData\Local\StormAlert => Moved successfully. C:\ProgramData\1078601655 => Moved successfully. "C:\ProgramData\uUjnaoRKUsi" directory move: Could not move "C:\ProgramData\uUjnaoRKUsi\boDDSWLOm.dat" => Scheduled to move on reboot. C:\ProgramData\uUjnaoRKUsi\boDDSWLOm.exe => Moved successfully. C:\ProgramData\uUjnaoRKUsi\boDDSWLOm.exe.config => Moved successfully. Could not move "C:\ProgramData\uUjnaoRKUsi\info.dat" => Scheduled to move on reboot. Could not move "C:\ProgramData\uUjnaoRKUsi\dat\DjaJCdqKW.exe" => Scheduled to move on reboot. Could not move "C:\ProgramData\uUjnaoRKUsi\dat\DjaJCdqKW.exe.config" => Scheduled to move on reboot. Could not move "C:\ProgramData\uUjnaoRKUsi\dat\lsvHVYk.dll" => Scheduled to move on reboot. Could not move "C:\ProgramData\uUjnaoRKUsi\dat\ludmFnJWpu.exe" => Scheduled to move on reboot. Could not move "C:\ProgramData\uUjnaoRKUsi\dat\ludmFnJWpu.exe.config" => Scheduled to move on reboot. Could not move "C:\ProgramData\uUjnaoRKUsi\dat\XpnGREqyiJQ.dll" => Scheduled to move on reboot. Could not move "C:\ProgramData\uUjnaoRKUsi" directory. => Scheduled to move on reboot. => Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-12-30 17:57:28)<= C:\ProgramData\uUjnaoRKUsi\boDDSWLOm.dat => Is moved successfully. C:\ProgramData\uUjnaoRKUsi\info.dat => Is moved successfully.

Malekal_morte- · Answer

Vois ce que cela donne.

AustinOGC · Answer

Storm alert n'intervient plus sur mes pages, enfin pour le moment...

Malekal_morte- · Answer

good :)


Quelques conseils :

Installe Malwarebyte's Anti-Malware : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Fais des scans réguliers avec, il est efficace.


Pour prévenir les sites malicieux, tu peux installer Blockulicious : https://forum.malekal.com/viewtopic.php?t=46656&start=


Pour ne plus te faire avoir.
A lire - Programmes parasites / PUPs : https://www.malekal.com/adwares-pup-protection/

Storm Alert persiste Après AdwCleaner

9 réponses

Discussions similaires

Newsletters