Supprimé edeals

Résolu

vynk -
Malekal_morte- Messages postés 178136 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention - 20 févr. 2015 à 23:47

Bonjour,
J'ai également choper cette saleté de edeals et malgré plusieurs tentative je n arrive pas a m'en débarrassé.
Aider moi SVP

voici les log FRST
http://pjjoint.malekal.com/files.php?id=FRST_20150220_t11c14w5p13g14
http://pjjoint.malekal.com/files.php?id=20150220_m8w5k11x8s10
http://pjjoint.malekal.com/files.php?id=20150220_k10u10j14b7q11

voici les log OTL
http://pjjoint.malekal.com/files.php?id=OTL_20150220_x9i14l14z8l7

Afficher la suite

4 réponses

Réponse 1 / 4
Malekal_morte- Messages postés 178136 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 24 712

Salut,

Je regarde cela =)
0
Réponse 2 / 4
Malekal_morte- Messages postés 178136 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 24 712

Désinstalle Spybot,

Déjà note la procédure pour supprimer les proxys sur Internet Explorer : https://forum.malekal.com/viewtopic.php?t=47404&start=

Voici la correction à effectuer avec FRST.
Tu peux t'inspirer de cette note explicative avec des captures d'écran pour t'aider: https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/#fix

Ouvre le bloc-notes : Touche Windows + R, dans le champs executer, tape notepad et OK.
Copie/colle dedans ce qui suit :

ProxyEnable: [S-1-5-21-947683397-3693180056-1511922470-1000] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-21-947683397-3693180056-1511922470-1000] => http=127.0.0.1:10676 [Attention - Possible Proxy Malicieux]
R2 importmbr32.exe; C:\Users\DUREAU\AppData\Local\importmbr32\importmbr32.exe [211968 2015-02-15] () [File not signed]
S2 copyocrGUI.exe; C:\Users\DUREAU\AppData\Local\copyocrGUI\copyocrGUI.exe [X]
S2 desktoppublicx86.exe; C:\Users\DUREAU\AppData\Local\desktoppublicx86\desktoppublicx86.exe [X]
2014-09-01 09:18 - 2014-09-01 09:18 - 0001248 _____ () C:\Users\DUREAU\AppData\Roaming\VNTGEDGU
2014-09-01 09:18 - 2014-09-01 09:18 - 0001248 _____ () C:\Users\DUREAU\AppData\Roaming\XBPD
2014-09-01 09:18 - 2014-09-01 09:18 - 0001248 _____ () C:\Users\DUREAU\AppData\Roaming\ZFUE
C:\Users\DUREAU\AppData\Local\desktoppublicx86
C:\Users\DUREAU\AppData\Local\copyocrGUI
C:\Users\DUREAU\AppData\Local\importmbr32

Une fois, le texte coller dans le bloc-note.
Menu Fichier puis Enregistrer sous.
A gauche, place toi sur le bureau.

Dans le champs en bas, nom du fichier mets : fixlist.txt
Clic sur Enregistrer - cela va créer un fichier fixlist.txt sur le bureau.

Relance FRST et clic sur le bouton Fix
Selon comment un redémarrage est nécessaire (pas obligatoire).
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

Redémarre l'ordinateur

Si la connexion ne fonctionne pas, suis la procédure donnée au départ.
0
1. vynk
  
  ça c'est ce que j appel de la réactivité.
  voici le log
  
  Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 18-02-2015 01
  Ran by DUREAU at 2015-02-20 23:28:25 Run:2
  Running from C:\Users\DUREAU\Desktop
  Loaded Profiles: DUREAU (Available profiles: DUREAU)
  Boot Mode: Normal
  ==============================================
  
  Content of fixlist:
  
  ProxyEnable: [S-1-5-21-947683397-3693180056-1511922470-1000] => Internet Explorer proxy is enabled.
  ProxyServer: [S-1-5-21-947683397-3693180056-1511922470-1000] => http=127.0.0.1:10676 [Attention - Possible Proxy Malicieux]
  R2 importmbr32.exe; C:\Users\DUREAU\AppData\Local\importmbr32\importmbr32.exe [211968 2015-02-15] () [File not signed]
  S2 copyocrGUI.exe; C:\Users\DUREAU\AppData\Local\copyocrGUI\copyocrGUI.exe [X]
  S2 desktoppublicx86.exe; C:\Users\DUREAU\AppData\Local\desktoppublicx86\desktoppublicx86.exe [X]
  2014-09-01 09:18 - 2014-09-01 09:18 - 0001248 _____ () C:\Users\DUREAU\AppData\Roaming\VNTGEDGU
  2014-09-01 09:18 - 2014-09-01 09:18 - 0001248 _____ () C:\Users\DUREAU\AppData\Roaming\XBPD
  2014-09-01 09:18 - 2014-09-01 09:18 - 0001248 _____ () C:\Users\DUREAU\AppData\Roaming\ZFUE
  C:\Users\DUREAU\AppData\Local\desktoppublicx86
  C:\Users\DUREAU\AppData\Local\copyocrGUI
  C:\Users\DUREAU\AppData\Local\importmbr32
  
  HKU\S-1-5-21-947683397-3693180056-1511922470-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
  HKU\S-1-5-21-947683397-3693180056-1511922470-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
  importmbr32.exe => Unable to stop service
  importmbr32.exe => Service deleted successfully.
  copyocrGUI.exe => Service deleted successfully.
  desktoppublicx86.exe => Service deleted successfully.
  C:\Users\DUREAU\AppData\Roaming\VNTGEDGU => Moved successfully.
  C:\Users\DUREAU\AppData\Roaming\XBPD => Moved successfully.
  C:\Users\DUREAU\AppData\Roaming\ZFUE => Moved successfully.
  "C:\Users\DUREAU\AppData\Local\desktoppublicx86" => File/Directory not found.
  "C:\Users\DUREAU\AppData\Local\copyocrGUI" => File/Directory not found.
  
  "C:\Users\DUREAU\AppData\Local\importmbr32" directory move:
  
  C:\Users\DUREAU\AppData\Local\importmbr32\dashboardusbceipx64.exe => Moved successfully.
  C:\Users\DUREAU\AppData\Local\importmbr32\importmbr32.exe => Moved successfully.
  C:\Users\DUREAU\AppData\Local\importmbr32\msvcp100.dll => Moved successfully.
  C:\Users\DUREAU\AppData\Local\importmbr32\msvcr100.dll => Moved successfully.
  C:\Users\DUREAU\AppData\Local\importmbr32\qjson0.dll => Moved successfully.
  C:\Users\DUREAU\AppData\Local\importmbr32\QtCore4.dll => Moved successfully.
  C:\Users\DUREAU\AppData\Local\importmbr32\QtNetwork4.dll => Moved successfully.
  C:\Users\DUREAU\AppData\Local\importmbr32\SrDt.exe => Moved successfully.
  C:\Users\DUREAU\AppData\Local\importmbr32\service\importmbr32.exe-(PID-1900)-9299656\AdsFix.exe-(PID-300).dmp_PROCESS_SUBMITTED => Moved successfully.
  C:\Users\DUREAU\AppData\Local\importmbr32\service\importmbr32.exe-(PID-1900)-9299656\importmbr32.exe-(PID-1900).dmp => Moved successfully.
  C:\Users\DUREAU\AppData\Local\importmbr32\service\importmbr32.exe-(PID-1888)-563288\importmbr32.exe-(PID-1888).dmp => Moved successfully.
  C:\Users\DUREAU\AppData\Local\importmbr32\service\importmbr32.exe-(PID-1888)-563288\RogueKillerX64.exe-(PID-1140).dmp_PROCESS_SUBMITTED => Moved successfully.
  C:\Users\DUREAU\AppData\Local\importmbr32\desktop\dashboardusbceipx64.exe-(PID-620)-513383\adwcleaner_4.110.exe-(PID-3376).dmp_PROCESS_SUBMITTED => Moved successfully.
  C:\Users\DUREAU\AppData\Local\importmbr32\desktop\dashboardusbceipx64.exe-(PID-620)-513383\dashboardusbceipx64.exe-(PID-620).dmp => Moved successfully.
  C:\Users\DUREAU\AppData\Local\importmbr32\desktop\dashboardusbceipx64.exe-(PID-5268)-9300514\AdsFix.exe-(PID-300).dmp_PROCESS_SUBMITTED => Moved successfully.
  C:\Users\DUREAU\AppData\Local\importmbr32\desktop\dashboardusbceipx64.exe-(PID-5268)-9300514\dashboardusbceipx64.exe-(PID-5268).dmp => Moved successfully.
  C:\Users\DUREAU\AppData\Local\importmbr32\desktop\dashboardusbceipx64.exe-(PID-3744)-590276\dashboardusbceipx64.exe-(PID-3744).dmp => Moved successfully.
  C:\Users\DUREAU\AppData\Local\importmbr32\desktop\dashboardusbceipx64.exe-(PID-3744)-590276\RogueKillerX64.exe-(PID-1140).dmp_PROCESS_SUBMITTED => Moved successfully.
  C:\Users\DUREAU\AppData\Local\importmbr32\desktop\dashboardusbceipx64.exe-(PID-1548)-828084\dashboardusbceipx64.exe-(PID-1548).dmp => Moved successfully.
  C:\Users\DUREAU\AppData\Local\importmbr32\desktop\dashboardusbceipx64.exe-(PID-1548)-828084\taskkill.exe-(PID-4060).dmp_PROCESS_SUBMITTED => Moved successfully.
  Could not move "C:\Users\DUREAU\AppData\Local\importmbr32" directory. => Scheduled to move on reboot.
  > Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2015-02-20 23:30:34)<
  C:\Users\DUREAU\AppData\Local\importmbr32 => Is moved successfully.
  End of Fixlog 23:30:35
  
  0
Réponse 3 / 4
Malekal_morte- Messages postés 178136 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 24 712

as-tu encore des pubs edeals ?
0
1. vynk
  
  je viens de tester j ai plus de pub. Un grand MERCI a toi ça fessait 1 semaine que j essayé de m'en débarrassé et toi en 10 min c'est fait. SUPER merci
  
  0
Réponse 4 / 4
Malekal_morte- Messages postés 178136 Date d'inscription Statut Modérateur, Contributeur sécurité Dernière intervention 24 712

super =)

Quelques conseils :

Installe Malwarebyte's Anti-Malware : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Fais des scans réguliers avec, il est efficace.

Pour prévenir les sites malicieux, tu peux installer Blockulicious : https://forum.malekal.com/viewtopic.php?t=46656&start=

Pour ne plus te faire avoir.
A lire - Programmes parasites / PUPs : https://www.malekal.com/adwares-pup-protection/

Le reste de la sécurité : http://forum.malekal.com/comment-securiser-son-ordinateur.html

~~
0

Supprimé edeals

4 réponses

> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2015-02-20 23:30:34)<

End of Fixlog 23:30:35

Discussions similaires

Newsletters