Infecté par Cryptowall...

Mat -  
Bonjour,

Malheureusement, j'ai été infecté par cryptowall, très probablement par l'ouverture d'une page publicitaire malveillante (exploit web). La casi-totalité de mes fichiers image et texte sont donc illisibles, à l''exception de quelques dossiers complet ou certains fichiers qui ont échappés au cryptage.

Comme conseillé dans d'autre sujets du même cas que moi :
- J'ai changé tous mes mot de passe web (via mon téléphone sur un autre réseau).
- J'ai réalisé une analyse malwarebytes anti-malware.
- Je suis le tutoriel FRST (je transmettrais les rapports sous peu).

Etant donné que certain de mes fichiers sont intacts, j'aimerais effectué une sauvegarde sur un disque dur externe, pour les mettre en sécurité. Est-ce dangereux de connecter un support usb pour les fichiers contenus dans celui-ci ?

Comment m'assurer que mon ordinateur est nettoyé ?

Merci d'avance pour votre aide...

7 réponses

  1.  Malekal_morte- Modérateur
    Salut,

    C'est dangereux tant que le ransomware est actif.
    Donne les rapports FRST via http://pjjoint.malekal.com dans une nouvelle réponse.
    0
    1. Mat
      Merci de votre réponse, voici les fichiers :

      FRST
      http://pjjoint.malekal.com/files.php?id=FRST_20160307_w11s814e14e8

      Addition
      http://pjjoint.malekal.com/files.php?id=20160307_i15p14s14s7i15

      Shortcut
      http://pjjoint.malekal.com/files.php?id=20160307_j13n10f12q9m5
      0
      1. Malekal_morte- Modérateur
        Je confirme, il s'agit bien de CryptoWall.

        Voici la correction à effectuer avec FRST. Tu peux t'aider de cette note explicative avec des captures d'écran.

        Ouvre le bloc-notes : Touche Windows + R,
        Dans le champs "Exécuter", saisir notepad et OK.
        Copie/Colle dedans ce qui suit : 


        C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\721b81\c38a721b81.exe  
        C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\30f260\61a30f2.exe  
         HKU\S-1-5-18\...\Run: [721b81] => C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\721b81\c38a721b81.exe  
         HKU\S-1-5-18\...\Run: [30f260] => C:\WINDOWS\system32\config\systemprofile\AppData\Roaming\30f260\61a30f2.exe  
         S2 Direct3dFileWin32.exe; C:\Users\Mat\AppData\Local\Direct3dFileWin32\Direct3dFileWin32.exe [X] 
        ProxyServer: [S-1-5-21-4021538044-80149600-2449887256-1001] => http=127.0.0.1:33465 [Attention - Possible Proxy Malicieux]
         2016-03-07 10:01 - 2016-03-07 10:04 - 680534740 _____ C:\Users\Mat\Downloads\guvz9jb0k5.2cqev 
         2016-03-07 10:01 - 2016-03-07 10:01 - 19103660 _____ C:\Users\Mat\Downloads\vsi8n95.4d 
         2016-03-07 10:01 - 2016-03-07 10:01 - 08825468 _____ C:\Users\Mat\Downloads\2qm3lr5h.bl0 
         2016-03-07 10:01 - 2016-03-07 10:01 - 03310804 _____ C:\Users\Mat\Downloads\z5zah0.n4h6a 
         2016-03-07 10:01 - 2016-03-07 10:01 - 00178876 _____ C:\Users\Mat\Downloads\fgdv8uh.8ld 
         2016-03-07 10:01 - 2016-03-07 10:01 - 00068988 _____ C:\Users\Mat\Downloads\yng717.r01rj 
         2016-03-07 10:01 - 2016-03-07 10:01 - 00039084 _____ C:\Users\Mat\Downloads\v0kanguegv.qm2h8 
         2016-03-07 10:01 - 2016-03-07 10:01 - 00033244 _____ C:\Users\Mat\Downloads\mp30ql666.6e 
         2016-03-07 10:01 - 2016-03-07 10:01 - 00032524 _____ C:\Users\Mat\Downloads\t02aj.c1z 
         2016-03-07 10:01 - 2016-03-07 10:01 - 00030540 _____ C:\Users\Mat\Downloads\6whn3i.l4q 
         2016-03-07 10:01 - 2016-03-07 10:01 - 00021916 _____ C:\Users\Mat\Downloads\uwvnuz9m3n.u5r9k 
         2016-03-07 10:01 - 2016-03-07 10:01 - 00014236 _____ C:\Users\Mat\Downloads\05vlui.e0lp 
         2016-03-07 10:00 - 2016-03-07 10:01 - 183482352 _____ C:\Users\Mat\Downloads\1bx8w.b9ovx 
         2016-03-07 10:00 - 2016-03-07 10:01 - 178923984 _____ C:\Users\Mat\Downloads\j76w6.6z7d 
         2016-03-07 09:59 - 2016-03-07 10:00 - 186725868 _____ C:\Users\Mat\Downloads\thhm7ukf.olm6 
         2016-03-07 09:59 - 2016-03-07 10:00 - 186500120 _____ C:\Users\Mat\Downloads\na9yvo.2lt 
         2016-03-07 09:58 - 2016-03-07 09:59 - 184422648 _____ C:\Users\Mat\Downloads\7bluwj7.s4br 
         2016-03-07 09:58 - 2016-03-07 09:59 - 182999280 _____ C:\Users\Mat\Downloads\i9xm2o22p.6c 
         2016-03-07 09:58 - 2016-03-07 09:58 - 01492468 _____ C:\Users\Mat\Downloads\4m36349jt.w12qw 
         2016-03-07 09:57 - 2016-03-07 09:58 - 176112648 _____ C:\Users\Mat\Downloads\b2416u.20ek 
         2016-03-07 09:57 - 2016-03-07 09:57 - 13604016 _____ C:\Users\Mat\Downloads\9l90mu94.h20h 
         2016-03-07 09:52 - 2016-03-07 09:58 - 1469558196 _____ C:\Users\Mat\Downloads\3kh4sw0w.18nee 
         2016-03-07 09:52 - 2016-03-07 09:57 - 1137863604 _____ C:\Users\Mat\Downloads\q4ykcthxf.8z4x7 
         2016-03-07 09:52 - 2016-03-07 09:52 - 00862144 _____ C:\Users\Mat\Downloads\34zx0.gq0x2 
         2016-03-07 09:52 - 2016-03-07 09:52 - 00512316 _____ C:\Users\Mat\Downloads\s1dh9kld.dx2l 
         2016-03-07 09:52 - 2016-03-07 09:52 - 00219020 _____ C:\Users\Mat\Downloads\gho30.vz0 
         2016-03-07 09:52 - 2016-03-07 09:52 - 00130396 _____ C:\Users\Mat\Downloads\94472l.468sy 
         2016-03-07 09:52 - 2016-03-07 09:52 - 00039308 _____ C:\Users\Mat\Downloads\p47z4b0m.jb46 
         2016-03-07 09:52 - 2016-03-07 09:52 - 00027852 _____ C:\Users\Mat\Downloads\pep2n3r.r9 
         2016-03-07 09:51 - 2016-03-07 09:51 - 06467516 _____ C:\Users\Mat\Downloads\yectzv0e.6msx 
         2016-03-07 09:51 - 2016-03-07 09:51 - 00606992 _____ C:\Users\Mat\Downloads\qh0agpoyv2.wp71 
         2016-03-07 09:51 - 2016-03-07 09:51 - 00583744 _____ C:\Users\Mat\Downloads\e4g87z6.e5 
         2016-03-07 09:50 - 2016-03-07 09:51 - 00042332 _____ C:\Users\Mat\Downloads\btdovz7e4f.r3 
         2016-03-07 09:49 - 2016-03-07 09:51 - 374803268 _____ C:\Users\Mat\Downloads\n64gf8.rdw1 
         2016-03-07 09:48 - 2016-03-07 09:50 - 420447840 _____ C:\Users\Mat\Downloads\wl2796ww.4r2j 
         2016-03-07 09:47 - 2016-03-07 09:49 - 472221724 _____ C:\Users\Mat\Downloads\6yyih.0v5 
         2016-03-07 09:46 - 2016-03-07 09:48 - 470382560 _____ C:\Users\Mat\Downloads\qadmshq12.n0 
         2016-03-07 09:45 - 2016-03-07 09:47 - 580186900 _____ C:\Users\Mat\Downloads\zf518t.8q 
         2016-03-07 09:45 - 2016-03-07 09:46 - 367545552 _____ C:\Users\Mat\Downloads\kyzmum0gp.zra8a 
         2016-03-07 09:45 - 2016-03-07 09:45 - 04399180 _____ C:\Users\Mat\Downloads\zzdk7qzk1m.8q8b 
         2016-03-07 09:45 - 2016-03-07 09:45 - 00256876 _____ C:\Users\Mat\Downloads\rvl46vu.f6sbl 
         2016-03-07 09:40 - 2016-03-07 09:42 - 567574804 _____ C:\Users\Mat\Downloads\2fsqhbwbd6.n3 
         2016-03-07 09:40 - 2016-03-07 09:40 - 30109136 _____ C:\Users\Mat\Downloads\kjl9u286m7.0k 
         2016-03-07 09:40 - 2016-03-07 09:40 - 18513240 _____ C:\Users\Mat\Downloads\shd9guyo.99vg 
         2016-03-07 09:40 - 2016-03-07 09:40 - 03615988 _____ C:\Users\Mat\Downloads\83qc4p.dvgy9 
         2016-03-07 09:40 - 2016-03-07 09:40 - 00565808 _____ C:\Users\Mat\Downloads\i3o193.n0 
         2016-03-07 09:40 - 2016-03-07 09:40 - 00494604 _____ C:\Users\Mat\Downloads\el2ir1f34.2rz 
         2016-03-07 09:40 - 2016-03-07 09:40 - 00276812 _____ C:\Users\Mat\Downloads\dlq8cy.72eg 
         2016-03-07 09:40 - 2016-03-07 09:40 - 00220412 _____ C:\Users\Mat\Downloads\dfp3ubfgcw.1c 
         2016-03-07 09:40 - 2016-03-07 09:40 - 00149068 _____ C:\Users\Mat\Downloads\1ep2owg3r2.11 
         2016-03-07 09:40 - 2016-03-07 09:40 - 00045996 _____ C:\Users\Mat\Downloads\gtf1pywdp.y7 
         2016-03-07 09:40 - 2016-03-07 09:40 - 00037324 _____ C:\Users\Mat\Downloads\0bav3bln.5zb2 
         2016-03-07 09:40 - 2016-03-07 09:40 - 00016380 _____ C:\Users\Mat\Downloads\7emt9hv.6zc 
         2016-03-07 09:37 - 2016-03-07 09:40 - 568045000 _____ C:\Users\Mat\Downloads\z77forjml.qn20 
         2016-03-07 09:37 - 2016-03-07 09:40 - 567933272 _____ C:\Users\Mat\Downloads\wq9bmf.86an 
         2016-03-07 09:37 - 2016-03-07 09:37 - 04625532 _____ C:\Users\Mat\Downloads\sqv2alxb.mz4n8 
         2016-03-07 09:37 - 2016-03-07 09:37 - 02415164 _____ C:\Users\Mat\Downloads\z5rfsr.j2 
         2016-03-07 09:37 - 2016-03-07 09:37 - 00181612 _____ C:\Users\Mat\Downloads\g8lbbiadd.5uh 
         2016-03-07 09:37 - 2016-03-07 09:37 - 00079164 _____ C:\Users\Mat\Downloads\4pc604a.4j 
         2016-03-07 09:37 - 2016-03-07 09:37 - 00051692 _____ C:\Users\Mat\Downloads\2vp6p6w69.cq3 
         2016-03-07 09:37 - 2016-03-07 09:37 - 00042652 _____ C:\Users\Mat\Downloads\kns69.a6a 
         2016-03-07 09:37 - 2016-03-07 09:37 - 00021052 _____ C:\Users\Mat\Downloads\nkh4j.2e8g5 
         2016-03-07 09:36 - 2016-03-07 09:37 - 03659508 _____ C:\Users\Mat\Downloads\g28zes272u.e5xpf 
         2016-03-07 09:36 - 2016-03-07 09:36 - 01362228 _____ C:\Users\Mat\Downloads\rdwr3.33 
         2016-03-07 09:36 - 2016-03-07 09:36 - 00590944 _____ C:\Users\Mat\Downloads\nnx7hi.5fs2 
         2016-03-07 09:36 - 2016-03-07 09:36 - 00335612 _____ C:\Users\Mat\Downloads\2r22g.67t 
         2016-03-07 09:36 - 2016-03-07 09:36 - 00143676 _____ C:\Users\Mat\Downloads\1ttqfwkal.204e 
         2016-03-07 09:36 - 2016-03-07 09:36 - 00098684 _____ C:\Users\Mat\Downloads\bif6xai.x5op 
         2016-03-07 09:36 - 2016-03-07 09:36 - 00056300 _____ C:\Users\Mat\Downloads\e52nn6.4xlk 
         2016-03-07 09:35 - 2016-03-07 09:37 - 616215784 _____ C:\Users\Mat\Downloads\worw9u.p1 
         2016-03-07 09:34 - 2016-03-07 09:36 - 562844560 _____ C:\Users\Mat\Downloads\6mypf0fh.oaa6z 
         2016-03-07 09:32 - 2016-03-07 09:35 - 567858872 _____ C:\Users\Mat\Downloads\01j0nxn.zrja3 
         2016-03-07 09:32 - 2016-03-07 09:34 - 510397152 _____ C:\Users\Mat\Downloads\wgr3y86.fd2tc 
         2016-03-07 09:30 - 2016-03-07 09:32 - 554635280 _____ C:\Users\Mat\Downloads\8b4ltuf2.1vq5 
         2016-03-07 09:30 - 2016-03-07 09:32 - 463620668 _____ C:\Users\Mat\Downloads\p0jhh2f94.n4dt 
         2016-03-07 09:28 - 2016-03-07 09:30 - 503340940 _____ C:\Users\Mat\Downloads\k6ocolfpyu.7o31j 
         2016-03-07 09:28 - 2016-03-07 09:30 - 478113912 _____ C:\Users\Mat\Downloads\rl5el.r8cn 
         2016-03-07 09:28 - 2016-03-07 09:28 - 04974736 _____ C:\Users\Mat\Documents\a7bfopgm0v.i8e1 
         2016-03-07 09:28 - 2016-03-07 09:28 - 03999528 _____ C:\Users\Mat\Downloads\t1ebr6.qt3gg 
         2016-03-07 09:28 - 2016-03-07 09:28 - 01849896 _____ C:\Users\Mat\Documents\j6t1stu16s.s3a2 
         2016-03-07 09:28 - 2016-03-07 09:28 - 01459940 _____ C:\Users\Mat\Downloads\0vv9l96h00.42 
         2016-03-07 09:28 - 2016-03-07 09:28 - 01362484 _____ C:\Users\Mat\Downloads\pr6esi2ax.2h 
         2016-03-07 09:28 - 2016-03-07 09:28 - 01160260 _____ C:\Users\Mat\Downloads\ogc9ikcp0.j82k 
         2016-03-07 09:28 - 2016-03-07 09:28 - 01126980 _____ C:\Users\Mat\Downloads\sd751.4s 
         2016-03-07 09:28 - 2016-03-07 09:28 - 01069828 _____ C:\Users\Mat\Downloads\lamz5ite.79 
         2016-03-07 09:28 - 2016-03-07 09:28 - 01068548 _____ C:\Users\Mat\Documents\r6bv7nbvzd.yv9 
         2016-03-07 09:28 - 2016-03-07 09:28 - 01005712 _____ C:\Users\Mat\Downloads\fzqm4xk2e.6v 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00946112 _____ C:\Users\Mat\Downloads\0npkjjbb.ar0m9 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00715872 _____ C:\Users\Mat\Documents\5bpew9bhv.i1u 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00672528 _____ C:\Users\Mat\Documents\fi82dns.e6 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00665760 _____ C:\Users\Mat\Documents\3zw1rs.a2v 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00620208 _____ C:\Users\Mat\Documents\keihck2nxd.8vg 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00618704 _____ C:\Users\Mat\Documents\pn91l.6vdqv 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00616464 _____ C:\Users\Mat\Documents\r53zhy.6wn 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00615584 _____ C:\Users\Mat\Documents\zbefvn8x.kl98s 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00615584 _____ C:\Users\Mat\Documents\v1t1ex12l.q7y 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00611440 _____ C:\Users\Mat\Documents\cm711bdda.q7ddf 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00610944 _____ C:\Users\Mat\Documents\9ox9ef9.x04 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00605664 _____ C:\Users\Mat\Documents\0e5xzd.7ivpq 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00572528 _____ C:\Users\Mat\Documents\de20xfg.6s 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00565088 _____ C:\Users\Mat\Documents\b3u0k.4js 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00560176 _____ C:\Users\Mat\Documents\l1qqx.35 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00554112 _____ C:\Users\Mat\Documents\61ul7.u4yz 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00542784 _____ C:\Users\Mat\Documents\ybs8n.c5 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00497164 _____ C:\Users\Mat\Documents\l4gth8q59q.pi0f 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00472748 _____ C:\Users\Mat\Documents\88i8o.i0 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00460444 _____ C:\Users\Mat\Documents\7izl7.q2v3 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00456684 _____ C:\Users\Mat\Documents\6348eql.4mj 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00434156 _____ C:\Users\Mat\Documents\ddno5.7rd 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00370892 _____ C:\Users\Mat\Documents\v30gp.1nx 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00370300 _____ C:\Users\Mat\Documents\uxgru1.qs0yi 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00355116 _____ C:\Users\Mat\Documents\8m0xevb.qy4m1 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00353980 _____ C:\Users\Mat\Documents\pz8sen9gw8.h6 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00298268 _____ C:\Users\Mat\Documents\sv0npw.7m 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00294604 _____ C:\Users\Mat\Documents\i4zp0aiy.fm2 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00033772 _____ C:\Users\Mat\Downloads\686zu96pu.fk8 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00003152 _____ C:\Users\Mat\Documents\HELP_FILE_8C38A721.html 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00003152 _____ C:\Users\Mat\Documents\HELP_FILE_7C38A721.html 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00003152 _____ C:\Users\Mat\Documents\HELP_FILE_6C38A721.html 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00003152 _____ C:\Users\Mat\Documents\HELP_FILE_5C38A721.html 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00003152 _____ C:\Users\Mat\Documents\HELP_FILE_4C38A721.html 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00003152 _____ C:\Users\Mat\Documents\HELP_FILE_3C38A721.html 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00003152 _____ C:\Users\Mat\Documents\HELP_FILE_2C38A721.html 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00003152 _____ C:\Users\Mat\Documents\HELP_FILE_1C38A721.html 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00003150 _____ C:\Users\Mat\Documents\HELP_FILE_810179.html 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00003150 _____ C:\Users\Mat\Documents\HELP_FILE_710179.html 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00003150 _____ C:\Users\Mat\Documents\HELP_FILE_610179.html 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00003150 _____ C:\Users\Mat\Documents\HELP_FILE_510179.html 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00003150 _____ C:\Users\Mat\Documents\HELP_FILE_410179.html 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00003150 _____ C:\Users\Mat\Documents\HELP_FILE_310179.html 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00003150 _____ C:\Users\Mat\Documents\HELP_FILE_210179.html 
         2016-03-07 09:28 - 2016-03-07 09:28 - 00003150 _____ C:\Users\Mat\Documents\HELP_FILE_110179.html 
         2016-03-07 09:26 - 2016-03-07 09:26 - 00074060 _____ C:\Users\Mat\Documents\n911vqa82.4z 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\Roaming\HELP_FILE_810179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\Roaming\HELP_FILE_710179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\Roaming\HELP_FILE_610179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\Roaming\HELP_FILE_510179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\Roaming\HELP_FILE_410179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\Roaming\HELP_FILE_310179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\Roaming\HELP_FILE_210179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\Roaming\HELP_FILE_110179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\LocalLow\HELP_FILE_810179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\LocalLow\HELP_FILE_710179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\LocalLow\HELP_FILE_610179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\LocalLow\HELP_FILE_510179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\LocalLow\HELP_FILE_410179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\LocalLow\HELP_FILE_310179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\LocalLow\HELP_FILE_210179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\LocalLow\HELP_FILE_110179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\Local\HELP_FILE_810179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\Local\HELP_FILE_710179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\Local\HELP_FILE_610179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\Local\HELP_FILE_510179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\Local\HELP_FILE_410179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\Local\HELP_FILE_310179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\Local\HELP_FILE_210179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\Local\HELP_FILE_110179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\HELP_FILE_810179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\HELP_FILE_710179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\HELP_FILE_610179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\HELP_FILE_510179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\HELP_FILE_410179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\HELP_FILE_310179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\HELP_FILE_210179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\Users\Mat\AppData\HELP_FILE_110179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\ProgramData\HELP_FILE_810179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\ProgramData\HELP_FILE_710179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\ProgramData\HELP_FILE_610179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\ProgramData\HELP_FILE_510179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\ProgramData\HELP_FILE_410179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\ProgramData\HELP_FILE_310179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\ProgramData\HELP_FILE_210179.html 
         2016-03-07 09:14 - 2016-03-07 09:14 - 00003150 _____ C:\ProgramData\HELP_FILE_110179.html 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00728784 _____ C:\Users\Mat\Documents\8zs4ltadr.lxgr9 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00722864 _____ C:\Users\Mat\Documents\4e67j.dfit7 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00721040 _____ C:\Users\Mat\Documents\h4zzuph.b7ti 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00700352 _____ C:\Users\Mat\Documents\9ndug.w2k 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00699856 _____ C:\Users\Mat\Documents\q8zeecvfzb.40 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00696144 _____ C:\Users\Mat\Documents\50c9n7t9yv.a1q 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00693872 _____ C:\Users\Mat\Documents\uu11uer4.rj0v1 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00680688 _____ C:\Users\Mat\Documents\7sofet.epn0f 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00679984 _____ C:\Users\Mat\Documents\uw4x336c.2qt6 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00673808 _____ C:\Users\Mat\Documents\jt5l5.1wz 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00668400 _____ C:\Users\Mat\Documents\20a01.rl9 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00665520 _____ C:\Users\Mat\Documents\9j270x7ojr.f7i 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00662320 _____ C:\Users\Mat\Documents\klbxev5a3.5l0 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00661328 _____ C:\Users\Mat\Documents\i50iqtlh.4t 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00653376 _____ C:\Users\Mat\Documents\du0lvp5y.2j 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00631360 _____ C:\Users\Mat\Documents\0j4swvo3.7601q 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00630992 _____ C:\Users\Mat\Documents\y6ky5zb.ztux6 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00628032 _____ C:\Users\Mat\Documents\phc7z.ui6u4 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00620144 _____ C:\Users\Mat\Documents\7f77y5.9j5 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00611472 _____ C:\Users\Mat\Documents\wck6g5fatq.p3oc 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00606464 _____ C:\Users\Mat\Documents\56hab.n6p1d 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00520668 _____ C:\Users\Mat\Documents\x4ha42rko.p3m 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00512652 _____ C:\Users\Mat\Documents\9fl79y9.o90 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00401388 _____ C:\Users\Mat\Documents\kmreap2orl.229a 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00345004 _____ C:\Users\Mat\Documents\75s6j.n9ya 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00304748 _____ C:\Users\Mat\Documents\3tv2w6.271qx 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00299708 _____ C:\Users\Mat\Documents\r042oga.7mtt 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00274844 _____ C:\Users\Mat\Documents\n7lq1w7.8qgbu 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00251100 _____ C:\Users\Mat\Documents\zipeo4yjd.nsa89 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00237100 _____ C:\Users\Mat\Documents\6lva0yxo.v43 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00233372 _____ C:\Users\Mat\Documents\38hjz60y1w.1o02 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00209692 _____ C:\Users\Mat\Documents\ovvnjzgh9i.z20 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00194188 _____ C:\Users\Mat\Documents\dj8i7.1r2qp 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00193964 _____ C:\Users\Mat\Documents\y9tvhf3fe1.f36f 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00187292 _____ C:\Users\Mat\Documents\r05dy.3t0h 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00184220 _____ C:\Users\Mat\Documents\0la51j90vg.v4 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00180188 _____ C:\Users\Mat\Documents\7ox6oe92z.7tjt 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00177676 _____ C:\Users\Mat\Documents\7tu0mmc.ac0o 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00165788 _____ C:\Users\Mat\Documents\s40p14sd.p7apu 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00154284 _____ C:\Users\Mat\Documents\tbino0a7.1a1 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00091820 _____ C:\Users\Mat\Documents\8713mt3.vm0 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00078460 _____ C:\Users\Mat\Desktop\31o4oli1mp.0f1i 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00058636 _____ C:\Users\Mat\Documents\o53ix.st8f9 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00050444 _____ C:\Users\Mat\Documents\jc97k.jp15 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00030044 _____ C:\Users\Mat\Desktop\q05je5q3.8302 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00025084 _____ C:\Users\Mat\Desktop\l38hn.ph46 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00023468 _____ C:\Users\Mat\Desktop\u3vexu8q3.d8 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00020844 _____ C:\Users\Mat\Desktop\lhz32he1h.ur80 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00009228 _____ C:\Users\Mat\Desktop\0hpw037d48.yq7 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00004348 _____ C:\Users\Mat\Desktop\na8b7.45d 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00003852 _____ C:\Users\Mat\Desktop\6ulvacs4o.cwgs5 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00003152 _____ C:\Users\Mat\AppData\Roaming\HELP_FILE_8C38A721.html 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00003152 _____ C:\Users\Mat\AppData\Roaming\HELP_FILE_7C38A721.html 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00003152 _____ C:\Users\Mat\AppData\Roaming\HELP_FILE_6C38A721.html 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00003152 _____ C:\Users\Mat\AppData\Roaming\HELP_FILE_5C38A721.html 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00003152 _____ C:\Users\Mat\AppData\Roaming\HELP_FILE_4C38A721.html 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00003152 _____ C:\Users\Mat\AppData\Roaming\HELP_FILE_3C38A721.html 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00003152 _____ C:\Users\Mat\AppData\Roaming\HELP_FILE_2C38A721.html 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00003152 _____ C:\Users\Mat\AppData\Roaming\HELP_FILE_1C38A721.html 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00003152 _____ C:\Users\Mat\AppData\HELP_FILE_8C38A721.html 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00003152 _____ C:\Users\Mat\AppData\HELP_FILE_7C38A721.html 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00003152 _____ C:\Users\Mat\AppData\HELP_FILE_6C38A721.html 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00003152 _____ C:\Users\Mat\AppData\HELP_FILE_5C38A721.html 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00003152 _____ C:\Users\Mat\AppData\HELP_FILE_4C38A721.html 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00003152 _____ C:\Users\Mat\AppData\HELP_FILE_3C38A721.html 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00003152 _____ C:\Users\Mat\AppData\HELP_FILE_2C38A721.html 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00003152 _____ C:\Users\Mat\AppData\HELP_FILE_1C38A721.html 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00002828 _____ C:\Users\Mat\Desktop\mbzaqbs8fs.h3m 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00002828 _____ C:\Users\Mat\Desktop\c8n6o.3jl 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00000652 _____ C:\Users\Mat\Documents\j5guzcbxz.ih9 
         2016-03-07 09:12 - 2016-03-07 09:12 - 00000508 _____ C:\Users\Mat\Desktop\hnu8zwlu.97jc 
         2016-02-20 23:27 - 2016-02-20 23:27 - 00003152 _____ C:\Users\Mat\AppData\LocalLow\HELP_FILE_8C38A721.html 
         2016-02-20 23:27 - 2016-02-20 23:27 - 00003152 _____ C:\Users\Mat\AppData\LocalLow\HELP_FILE_7C38A721.html 
         2016-02-20 23:27 - 2016-02-20 23:27 - 00003152 _____ C:\Users\Mat\AppData\LocalLow\HELP_FILE_6C38A721.html 
         2016-02-20 23:27 - 2016-02-20 23:27 - 00003152 _____ C:\Users\Mat\AppData\LocalLow\HELP_FILE_5C38A721.html 
         2016-02-20 23:27 - 2016-02-20 23:27 - 00003152 _____ C:\Users\Mat\AppData\LocalLow\HELP_FILE_4C38A721.html 
         2016-02-20 23:27 - 2016-02-20 23:27 - 00003152 _____ C:\Users\Mat\AppData\LocalLow\HELP_FILE_3C38A721.html 
         2016-02-20 23:27 - 2016-02-20 23:27 - 00003152 _____ C:\Users\Mat\AppData\LocalLow\HELP_FILE_2C38A721.html 
         2016-02-20 23:27 - 2016-02-20 23:27 - 00003152 _____ C:\Users\Mat\AppData\LocalLow\HELP_FILE_1C38A721.html 
         2016-02-20 23:26 - 2016-02-20 23:26 - 00003152 _____ C:\Users\Mat\AppData\Local\HELP_FILE_8C38A721.html 
         2016-02-20 23:26 - 2016-02-20 23:26 - 00003152 _____ C:\Users\Mat\AppData\Local\HELP_FILE_7C38A721.html 
         2016-02-20 23:26 - 2016-02-20 23:26 - 00003152 _____ C:\Users\Mat\AppData\Local\HELP_FILE_6C38A721.html 
         2016-02-20 23:26 - 2016-02-20 23:26 - 00003152 _____ C:\Users\Mat\AppData\Local\HELP_FILE_5C38A721.html 
         2016-02-20 23:26 - 2016-02-20 23:26 - 00003152 _____ C:\Users\Mat\AppData\Local\HELP_FILE_4C38A721.html 
         2016-02-20 23:26 - 2016-02-20 23:26 - 00003152 _____ C:\Users\Mat\AppData\Local\HELP_FILE_3C38A721.html 
         2016-02-20 23:26 - 2016-02-20 23:26 - 00003152 _____ C:\Users\Mat\AppData\Local\HELP_FILE_2C38A721.html 
         2016-02-20 23:26 - 2016-02-20 23:26 - 00003152 _____ C:\Users\Mat\AppData\Local\HELP_FILE_1C38A721.html 
         2016-02-20 23:26 - 2016-02-20 23:26 - 00003152 _____ C:\ProgramData\HELP_FILE_8C38A721.html 
         2016-02-20 23:26 - 2016-02-20 23:26 - 00003152 _____ C:\ProgramData\HELP_FILE_7C38A721.html 
         2016-02-20 23:26 - 2016-02-20 23:26 - 00003152 _____ C:\ProgramData\HELP_FILE_6C38A721.html 
         2016-02-20 23:26 - 2016-02-20 23:26 - 00003152 _____ C:\ProgramData\HELP_FILE_5C38A721.html 
         2016-02-20 23:26 - 2016-02-20 23:26 - 00003152 _____ C:\ProgramData\HELP_FILE_4C38A721.html 
         2016-02-20 23:26 - 2016-02-20 23:26 - 00003152 _____ C:\ProgramData\HELP_FILE_3C38A721.html 
         2016-02-20 23:26 - 2016-02-20 23:26 - 00003152 _____ C:\ProgramData\HELP_FILE_2C38A721.html 
         2016-02-20 23:26 - 2016-02-20 23:26 - 00003152 _____ C:\ProgramData\HELP_FILE_1C38A721.html


        Une fois, le texte collé dans le Bloc-notes,
        Menu "Fichier" puis "Enregistrer sous",
        A gauche, place toi sur le Bureau,
        Dans le champs en bas, nom du fichier mets : fixlist.txt
        Clique sur "Enregistrer", cela va créer fixlist.txt sur le Bureau.

        Relance FRST et clique sur le bouton "Corriger / Fix"
        Un redémarrage sera peut-être nécessaire ( pas obligatoire )
        Un fichier texte apparait, copie/colle le contenu ici dans un nouveau message.

        Like the angel you are, you laugh creating a lightness in my chest,
        Your eyes they penetrate me,
        (Your answer's always 'maybe')
        That's when I got up and left
        0
        1. Mat
          Voilà le rapport de correction :
          http://pjjoint.malekal.com/files.php?id=20160307_r15v8x15t13q12
          0
          2. Malekal_morte- Modérateur
            Ouvre "Mon Ordinateur " puis le disque "C" puis le dossier "FRST"
            Dedans se trouve, le dossier "Quarantine", fais un clique droit dessus,
            Puis sélectionne dans le menu "Envoyer vers le dossier compressé"
            Envoie ensuite le "Quarantine.zip" sur http://upload.malekal.com/

            puis :

            Fais un scan en ligne avec NOD32 puis enregistre le rapport. Envoie le sur http://pjjoint.malekal.com/ et donne le lien ici.

            Like the angel you are, you laugh creating a lightness in my chest,
            Your eyes they penetrate me,
            (Your answer's always 'maybe')
            That's when I got up and left
            0
            1. Mat
              Je n'ai pas assez de place sur mon disque dur pour faire le zip, le dossier "quarantaine" fait 12Go... Il me serait impossible de l'upload ensuite :s

              Le scan en ligne ne fonctionne pas, il fait planté IE à chaque fois...
              0
            2. Mat
              Après plusieurs tentatives, le scan NOD32 commence....
              0
            4. Mat
              Le scan NOD32 est toujours en cours...

              La recherche n'a trouvé aucun fichier "HELP_FILE_"
              0
          3. Mat
            La scan en ligne NOD32 est enfin terminé...

            Voilà le rapport :
            http://pjjoint.malekal.com/files.php?id=20160307_k11z6y6l7b13
            0
            1. Malekal_morte- Modérateur
              C:\_OTL\ tu peux le supprimer.

              Après cela, ça doit être bon, je pense.

              Sécuriser ton ordinateur, notamment contre les Web Exploit et attention aux emails.

              Renforce la sécurité de ton Windows : Comment sécuriser mon Windows

              0
              1. Mat
                D'accord... Merci beaucoup pour votre aide ^^

                Et donc, j'imagine qu'il n'y a aucun moyen de récupérer le moindre fichier, meme partiellement ? Les points de restauration ont-ils été supprimés par le virus ?
                0
              2. Mat
                Est-il normal qu'il reste des fichiers "HELP_FILE_" et des fichiers cryptés ?
                0
              3. Malekal_morte- Modérateur
                @Matoui, si tu n'as pas fait la recherche pour supprimer les HELP_FILE_
                pour les fichiers chiffrés, à toi de voir, si tu veux les garder sachant qu'à priori, il ne devrait pas y avoir de solution pour récupérer ces derniers.
                0

            Discussions similaires

            Infecte par un virus
            sapard

            3 réponses
            Mon ordinateur a été infecté par un virus ou
            henry4002

            6 réponses
            cryptowall 3.0
            caps

            19 réponses
            infecté par InstantAccess
            mimi22

            22 réponses
            infecté par brontok
            yannick

            27 réponses