ADWCleaner bloqué par administrateur

Salut,

Tu as téléchargé un crack KMSPico vérolé... en fait c'est un faux...

Voici la correction à effectuer avec FRST. Tu peux t'aider de cette note explicative avec des captures d'écran.

Ouvre le bloc-notes : Touche Windows + R,
Dans le champs "Exécuter", saisir notepad et OK.
Copie/Colle dedans ce qui suit :

CreateRestorePoint:
CloseProcesses:
Task: {01AB4A2B-E6FA-4AF1-B302-133EA8A6F9F5} - System32\Tasks\PPI Update => C:\WINDOWS\explorer.exe "hxxp://windowsdefender.site/download/download.php?mn=9996" <==== ATTENTION
Task: {7F5A05B2-DA24-4777-9B13-4717BDFA7679} - System32\Tasks\942fed9bb0165829810e255dd1780418 => sc start 942fed9bb0165829810e255dd1780418 <==== ATTENTION
Task: {9033130E-893F-4C20-9951-93EA9A84689F} - System32\Tasks\SVC Update => C:\WINDOWS\explorer.exe "hxxp://sh.st/AeotZ" <==== ATTENTION
Task: C:\WINDOWS\Tasks\One System CarePeriod.job => C:\Program Files (x86)\OneSystemCare\OneSystemCare.exe <==== ATTENTION
Shortcut: C:\Users\Cath\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Intеrnеt Ехplоrеr.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.bat ()
Shortcut: C:\Users\Cath\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Gооglе Сhrоmе.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.bat ()
Shortcut: C:\Users\Cath\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Lаunсh Intеrnеt Ехplоrеr Вrоwsеr.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.bat ()
Shortcut: C:\Users\Cath\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Gооglе Сhrоmе.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.bat ()
Shortcut: C:\Users\Cath\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Моzillа Firеfох (2).lnk -> C:\Program Files\Mozilla Firefox\firefox.bat ()
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Моzillа Firеfох.lnk -> C:\Program Files\Mozilla Firefox\firefox.bat () 
C:\Program Files\Mozilla Firefox\firefox.bat
C:\Program Files (x86)\Internet Explorer\iexplore.bat
 C:\Program Files (x86)\Internet Explorer\iexplore.bat
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gооglе Сhrоmе.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.bat () -> --disable-quic <==== Cyrillic
Task: {7D134909-C6DF-410F-BEB0-D9FAAE2E5BDF} - System32\Tasks\e6f240a19573f3ebd7a663950760a677 => sc start e6f240a19573f3ebd7a663950760a677 <==== ATTENTION
Task: {7EE2C094-E307-4049-83E8-623071E52DCF} - System32\Tasks\SoftUpgrade => C:\Program Files (x86)\SoftUpgrade\softup.exe [2017-07-31] () <==== ATTENTION
 R2 AdsService; C:\Users\Cath\AppData\Local\AdService\AdService.dll [781312 2017-08-21] () [Fichier non signé] 
2017-08-21 22:19 - 2017-08-21 22:19 - 000000000 ____D C:\Users\Cath\AppData\Roaming\BrowserModule 
 2017-08-21 22:18 - 2017-08-21 22:18 - 009791816 _____ (Piriform Ltd) C:\Users\Cath\Downloads\ccsetup533.exe  
 2017-08-21 22:17 - 2017-08-21 22:17 - 000000284 _____ C:\WINDOWS\Tasks\One System CarePeriod.job 
 2017-08-21 22:16 - 2017-08-21 22:16 - 000000000 ____D C:\Users\Cath\AppData\Local\AdService 
2017-08-21 22:15 - 2017-08-21 22:15 - 001611944 _____ (Secure Download Ltd. ) C:\Users\Cath\Downloads\windows_reg_ac 
 2017-08-21 22:11 - 2017-08-22 16:39 - 000000000 ____D C:\Program Files (x86)\Microsoft Toolkit Final 
 2017-08-21 22:11 - 2017-08-21 22:11 - 000003592 _____ C:\WINDOWS\System32\Tasks\PPI Update 
 2017-08-21 21:00 - 2017-08-21 21:00 - 000003300 _____ C:\WINDOWS\System32\Tasks\AutoKMSCustom 
 2017-08-21 20:16 - 2017-08-21 20:16 - 000004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task  
 2017-08-21 20:15 - 2017-08-21 20:15 - 000002457 ____N C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk  
 2017-08-21 19:22 - 2017-08-21 19:22 - 000000000 ____D C:\Program Files\Common Files\DESIGNER  
 2017-08-21 19:07 - 2017-08-21 19:41 - 000000000 ____D C:\WINDOWS\AutoKMS  
2017-08-21 18:48 - 2017-08-21 18:48 - 001611944 _____ (Secure Download Ltd. ) C:\Users\Cath\Downloads\Registry_Activation 
 2017-08-21 18:47 - 2017-08-22 15:55 - 000000000 ____D C:\Users\Cath\AppData\Local\Emfdtion 
 2017-08-21 18:45 - 2017-08-21 21:44 - 000000000 ____D C:\Program Files (x86)\ProxyGate 
 2017-08-21 18:45 - 2017-08-21 19:18 - 000000000 ____D C:\Users\Cath\AppData\Local\AppTrailers 
 2017-08-21 18:44 - 2017-08-21 18:44 - 000003760 _____ C:\WINDOWS\System32\Tasks\SoftUpgrade 
 2017-08-21 18:44 - 2017-08-21 18:44 - 000000000 ____D C:\Users\Cath\AppData\Roaming\Interstatnogui 
 2017-08-21 18:44 - 2017-08-21 18:44 - 000000000 ____D C:\Program Files (x86)\SoftUpgrade 
 2017-08-21 18:43 - 2017-08-21 22:24 - 000000000 ____D C:\Program Files (x86)\devnull 
 2017-08-21 18:43 - 2017-08-21 20:35 - 000031443 _____ C:\WINDOWS\20619a9c8fec641b01112001750e8268.ps1  
 2017-08-21 18:43 - 2017-08-21 18:43 - 000000000 ____D C:\Users\Cath\AppData\Roaming\devnull 
 2017-08-21 18:43 - 2017-08-21 18:43 - 000000000 ____D C:\Users\Cath\AppData\Local\AdvinstAnalytics 
 2017-08-21 18:42 - 2017-08-21 22:21 - 000003266 _____ C:\WINDOWS\System32\Tasks\942fed9bb0165829810e255dd1780418  
 2017-08-21 18:42 - 2017-08-21 22:21 - 000000000 ____D C:\WINDOWS\SysWOW64\SSL 
 2017-08-21 18:39 - 2017-08-21 18:39 - 000003514 _____ C:\WINDOWS\System32\Tasks\SVC Update 
 HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-07-14] (Apple Inc.)  
 HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [3487032 2017-08-10] (Dropbox, Inc.)  
HKU\S-1-5-21-3381602575-2356762224-395764257-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9832152 2017-08-03] (Piriform Ltd)  
HKLM\ DisallowedCertificates: 03D22C9C66915D58C88912B64C1F984B8344EF09 (Comodo Security Solutions) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 0F684EC1163281085C6AF20528878103ACEFCAAB (F-Secure Corporation) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 1667908C9E22EFBD0590E088715CC74BE4C60884 (FRISK Software International/F-Prot) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 18DEA4EFA93B06AE997D234411F3FD72A677EECE (Bitdefender SRL) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 2026D13756EB0DB753DF26CB3B7EEBE3E70BB2CF (G DATA Software AG) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 249BDA38A611CD746A132FA2AF995A2D3C941264 (Malwarebytes Corporation) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 31AC96A6C17C425222C46D55C3CCA6BA12E54DAF (Symantec Corporation) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 331E2046A1CCA7BFEF766724394BE6112B4CA3F7 (Trend Micro) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 3353EA609334A9F23A701B9159E30CB6C22D4C59 (Webroot Inc.) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 373C33726722D3A5D1EDD1F1585D5D25B39BEA1A (SUPERAntiSpyware.com) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 3850EDD77CC74EC9F4829AE406BBF9C21E0DA87F (Kaspersky Lab) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 3D496FA682E65FC122351EC29B55AB94F3BB03FC (AVG Technologies CZ) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 4243A03DB4C3C15149CEA8B38EEA1DA4F26BD159 (PC Tools) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 42727E052C0C2E1B35AB53E1005FD9EDC9DE8F01 (K7 Computing Pvt Ltd) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 4420C99742DF11DD0795BC15B7B0ABF090DC84DF (Doctor Web Ltd.) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 4C0AF5719009B7C9D85C5EAEDFA3B7F090FE5FFF (Emsisoft Ltd) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 5240AB5B05D11B37900AC7712A3C6AE42F377C8C (Check Point Software Technologies Ltd.) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 5DD3D41810F28B2A13E9A004E6412061E28FA48D (Emsisoft Ltd) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 7457A3793086DBB58B3858D6476889E3311E550E (K7 Computing Pvt Ltd) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 76A9295EF4343E12DFC5FE05DC57227C1AB00D29 (BullGuard Ltd) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 775B373B33B9D15B58BC02B184704332B97C3CAF (McAfee) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 872CD334B7E7B3C3D1C6114CD6B221026D505EAB (Comodo Security Solutions) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 88AD5DFE24126872B33175D1778687B642323ACF (McAfee) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 9132E8B079D080E01D52631690BE18EBC2347C1E (Adaware Software) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 982D98951CF3C0CA2A02814D474A976CBFF6BDB1 (Safer Networking Ltd.) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 9A08641F7C5F2CCA0888388BE3E5DBDDAAA3B361 (Webroot Inc.) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 9C43F665E690AB4D486D4717B456C5554D4BCEB5 (ThreatTrack Security) <==== ATTENTION  
 HKLM\ DisallowedCertificates: 9E3F95577B37C74CA2F70C1E1859E798B7FC6B13 (CURIOLAB S.M.B.A.) <==== ATTENTION  
 HKLM\ DisallowedCertificates: A1F8DCB086E461E2ABB4B46ADCFA0B48C58B6E99 (Avira Operations GmbH & Co. KG) <==== ATTENTION  
 HKLM\ DisallowedCertificates: A5341949ABE1407DD7BF7DFE75460D9608FBC309 (BullGuard Ltd) <==== ATTENTION  
 HKLM\ DisallowedCertificates: A59CC32724DD07A6FC33F7806945481A2D13CA2F (ESET) <==== ATTENTION  
 HKLM\ DisallowedCertificates: AB7E760DA2485EA9EF5A6EEE7647748D4BA6B947 (AVG Technologies CZ) <==== ATTENTION  
 HKLM\ DisallowedCertificates: AD4C5429E10F4FF6C01840C20ABA344D7401209F (Avast Antivirus/Software) <==== ATTENTION  
 HKLM\ DisallowedCertificates: AD96BB64BA36379D2E354660780C2067B81DA2E0 (Symantec Corporation) <==== ATTENTION  
 HKLM\ DisallowedCertificates: B8EBF0E696AF77F51C96DB4D044586E2F4F8FD84 (Malwarebytes Corporation) <==== ATTENTION  
 HKLM\ DisallowedCertificates: CDC37C22FE9272D8F2610206AD397A45040326B8 (Trend Micro) <==== ATTENTION  
 HKLM\ DisallowedCertificates: D3F78D747E7C5D6D3AE8ABFDDA7522BFB4CBD598 (Kaspersky Lab) <==== ATTENTION  
 HKLM\ DisallowedCertificates: DB303C9B61282DE525DC754A535CA2D6A9BD3D87 (ThreatTrack Security) <==== ATTENTION  
 HKLM\ DisallowedCertificates: DB77E5CFEC34459146748B667C97B185619251BA (Avast Antivirus/Software) <==== ATTENTION  
 HKLM\ DisallowedCertificates: E22240E837B52E691C71DF248F12D27F96441C00 (Total Defense, Inc.) <==== ATTENTION  
 HKLM\ DisallowedCertificates: E513EAB8610CFFD7C87E00BCA15C23AAB407FCEF (AVG Technologies CZ) <==== ATTENTION  
 HKLM\ DisallowedCertificates: ED841A61C0F76025598421BC1B00E24189E68D54 (Bitdefender SRL) <==== ATTENTION  
 HKLM\ DisallowedCertificates: F83099622B4A9F72CB5081F742164AD1B8D048C9 (ESET) <==== ATTENTION  
 HKLM\ DisallowedCertificates: FBB42F089AF2D570F2BF6F493D107A3255A9BB1A (Panda Security S.L) <==== ATTENTION  
 HKLM\ DisallowedCertificates: FFFA650F2CB2ABC0D80527B524DD3F9FC172C138 (Doctor Web Ltd.) <==== ATTENTION  
EmptyTemp:
RemoveProxy:
Reboot:

Une fois, le texte collé dans le Bloc-notes,
Menu "Fichier" puis "Enregistrer sous",
A gauche, place toi sur le Bureau,
Dans le champs en bas, nom du fichier mets : fixlist.txt
Clique sur "Enregistrer", cela va créer fixlist.txt sur le Bureau.

Relance FRST et clique sur le bouton "Corriger / Fix"
Un redémarrage sera peut-être nécessaire ( pas obligatoire )
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

Redémarre l'ordinateur.

2°)
Réinitialise/Répare les navigateurs WEB concernés par les problèmes :

• Réparer Mozilla Firefox (premier paragraphe)
• Réparer Google Chrome (seulement le premier paragraphe).
• Réinitialiser et réparer Internet Explorer

3°)
Termine par un nettoyage Malwarebytes - Tutoriel Malwarebytes Anti-Malware version gratuite

4°)
Vois ce que cela donne et si des améliorations ont eu lieu.
Si ce n'est pas le cas, si tu as encore des pages de pubs intempestives, précise sur quel navigateur WEB.
Refais un scan FRST et donne les nouveaux rapports via pjjoint.

Bonsoir,

il me semblait avoir répondu mais je ne vois pas mon message.
Cela a bien fonctionné, merci.
Le fixlog : https://pjjoint.malekal.com/files.php?id=20170822_t11o8t12d8h10

AdwCleaner fonctionne, merci pour le travail !

Cath

Oui je vais le faire, je mettrai les résultats ici, merci encore.

Cath

Bonsoir,

j'ai donc lancé un Malwarebytes puis un scan FRST.
Voici le résultat, j'ai l'impression qu'il en reste encore deux ou trois ?
En tous cas tous semble bien fonctionner.

Cath

https://pjjoint.malekal.com/files.php?id=FRST_20170822_h7e5t13z14b8

https://pjjoint.malekal.com/files.php?id=20170822_x14i12s11g6q9

https://pjjoint.malekal.com/files.php?id=20170822_t11j15j5q8x5

ca a l'air bon =)

Hello,

alors c'est génial.
Merci pour l'aide apportée !

Cath