Storm Alert persiste Après AdwCleaner

Salut,

Suis ce tutorial : https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/
Cela va générer deux rapports FRST.
Envoie comme expliqué, ces deux rapports sur le site http://pjjoint.malekal.com et donne les trois liens pjjoint de ces rapports afin qu'ils puissent être consultés.

Je suis en train d'effectuer le scan, merci pour ta réponse !

Addition --> https://pjjoint.malekal.com/files.php?id=20141230_m11u13w14d13x8
FRST --> https://pjjoint.malekal.com/files.php?id=20141230_g11o15w14i14b7
Shortcut--> https://pjjoint.malekal.com/files.php?id=20141230_z13e14n13o6f13
Voila, tu as précisé 2 mais le tutoriel parle de 3 rapports, j'imagine que le shortcut est en trop vu que j'ai dû le cocher mais je te le donne comme même :)

J'espère qu'avec ceci je n'expose rien de compromettant :3

Voici la correction à effectuer avec FRST.
Tu peux t'inspirer de cette note explicative avec des captures d'écran pour t'aider: https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/#fix

Ouvre le bloc-notes : Touche Windows + R, dans le champs executer, tape notepad et OK.
Copie/colle dedans ce qui suit :

HKU\S-1-5-18\...\Run: [BackgroundContainer] => C:\Windows\SysWOW64\Rundll32.exe C:\Users\Austin\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll,DllRun <===== ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:8879;https=127.0.0.1:8879
ProxyEnable: [S-1-5-19] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-19] => http=127.0.0.1:8879;https=127.0.0.1:8879
ProxyEnable: [S-1-5-20] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-20] => http=127.0.0.1:8879;https=127.0.0.1:8879
ProxyServer: [S-1-5-21-1205964606-2941361082-3043000874-1003] => http=127.0.0.1:6230;https=127.0.0.1:6230
CHR Extension: (Bubble Elements) - C:\Users\Austin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcijkonhppildbjgkdaglmeoeemcldha [2014-11-18]
CHR Extension: (easytoshop) - C:\Users\Austin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bmljgckjdofhaeampofpbknnolikikol [2014-11-19]
R2 boDDSWLOm; C:\ProgramData\uUjnaoRKUsi\boDDSWLOm.exe [2726776 2014-12-26] (Rational Thought Solutions)
S2 cae99edb; C:\Windows\system32\rundll32.exe c:\Program Files (x86)\Super Optimizer\SupOptCrash.dll,ENT
2014-12-30 16:03 - 2014-12-30 17:23 - 00000000 ____D () C:\Users\Austin\AppData\Local\StormAlert
2014-12-26 15:18 - 2014-12-26 15:18 - 00000000 ____D () C:\ProgramData\1078601655
C:\ProgramData\uUjnaoRKUsi

Une fois, le texte coller dans le bloc-note.
Menu Fichier puis Enregistrer sous.
A gauche, place toi sur le bureau.
Dans le champs en bas, nom du fichier mets : fixlist.txt
Clic sur Enregistrer - cela va créer un fichier fixlist.txt sur le bureau.

Relance FRST et clic sur le bouton Fix
Selon comment un redémarrage est nécessaire (pas obligatoire).
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

Redémarre l'ordinateur

Like the angel you are, you laugh creating a lightness in my chest,
Your eyes they penetrate me,
(Your answer's always 'maybe')
That's when I got up and left

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 28-12-2014
Ran by Austin at 2014-12-30 17:54:14 Run:1
Running from C:\Users\Austin\Desktop
Loaded Profile: Austin (Available profiles: Christine & Austin)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKU\S-1-5-18\...\Run: [BackgroundContainer] => C:\Windows\SysWOW64\Rundll32.exe C:\Users\Austin\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll,DllRun <===== ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:8879;https=127.0.0.1:8879
ProxyEnable: [S-1-5-19] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-19] => http=127.0.0.1:8879;https=127.0.0.1:8879
ProxyEnable: [S-1-5-20] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-20] => http=127.0.0.1:8879;https=127.0.0.1:8879
ProxyServer: [S-1-5-21-1205964606-2941361082-3043000874-1003] => http=127.0.0.1:6230;https=127.0.0.1:6230
CHR Extension: (Bubble Elements) - C:\Users\Austin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcijkonhppildbjgkdaglmeoeemcldha [2014-11-18]
CHR Extension: (easytoshop) - C:\Users\Austin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bmljgckjdofhaeampofpbknnolikikol [2014-11-19]
R2 boDDSWLOm; C:\ProgramData\uUjnaoRKUsi\boDDSWLOm.exe [2726776 2014-12-26] (Rational Thought Solutions)
S2 cae99edb; C:\Windows\system32\rundll32.exe c:\Program Files (x86)\Super Optimizer\SupOptCrash.dll,ENT
2014-12-30 16:03 - 2014-12-30 17:23 - 00000000 ____D () C:\Users\Austin\AppData\Local\StormAlert
2014-12-26 15:18 - 2014-12-26 15:18 - 00000000 ____D () C:\ProgramData\1078601655
C:\ProgramData\uUjnaoRKUsi
*****************

HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run\\BackgroundContainer => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
HKU\S-1-5-21-1205964606-2941361082-3043000874-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
C:\Users\Austin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcijkonhppildbjgkdaglmeoeemcldha => Moved successfully.
C:\Users\Austin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bmljgckjdofhaeampofpbknnolikikol => Moved successfully.
boDDSWLOm => Unable to stop service
boDDSWLOm => Service deleted successfully.
cae99edb => Service deleted successfully.
C:\Users\Austin\AppData\Local\StormAlert => Moved successfully.
C:\ProgramData\1078601655 => Moved successfully.

"C:\ProgramData\uUjnaoRKUsi" directory move:

Could not move "C:\ProgramData\uUjnaoRKUsi\boDDSWLOm.dat" => Scheduled to move on reboot.
C:\ProgramData\uUjnaoRKUsi\boDDSWLOm.exe => Moved successfully.
C:\ProgramData\uUjnaoRKUsi\boDDSWLOm.exe.config => Moved successfully.
Could not move "C:\ProgramData\uUjnaoRKUsi\info.dat" => Scheduled to move on reboot.
Could not move "C:\ProgramData\uUjnaoRKUsi\dat\DjaJCdqKW.exe" => Scheduled to move on reboot.
Could not move "C:\ProgramData\uUjnaoRKUsi\dat\DjaJCdqKW.exe.config" => Scheduled to move on reboot.
Could not move "C:\ProgramData\uUjnaoRKUsi\dat\lsvHVYk.dll" => Scheduled to move on reboot.
Could not move "C:\ProgramData\uUjnaoRKUsi\dat\ludmFnJWpu.exe" => Scheduled to move on reboot.
Could not move "C:\ProgramData\uUjnaoRKUsi\dat\ludmFnJWpu.exe.config" => Scheduled to move on reboot.
Could not move "C:\ProgramData\uUjnaoRKUsi\dat\XpnGREqyiJQ.dll" => Scheduled to move on reboot.
Could not move "C:\ProgramData\uUjnaoRKUsi" directory. => Scheduled to move on reboot.

=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-12-30 17:57:28)<=

C:\ProgramData\uUjnaoRKUsi\boDDSWLOm.dat => Is moved successfully.
C:\ProgramData\uUjnaoRKUsi\info.dat => Is moved successfully.

Vois ce que cela donne.

Storm alert n'intervient plus sur mes pages, enfin pour le moment...

good :)

Quelques conseils :

Installe Malwarebyte's Anti-Malware : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Fais des scans réguliers avec, il est efficace.

Pour prévenir les sites malicieux, tu peux installer Blockulicious : https://forum.malekal.com/viewtopic.php?t=46656&start=

Pour ne plus te faire avoir.
A lire - Programmes parasites / PUPs : https://www.malekal.com/adwares-pup-protection/