Un Adware contrôle mon P.C.

Neol -  
Malekal_morte- Messages postés 178136 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   -
Bonjour,

Alors voilà, ça arrive à tout le monde et ça m'est arrivé...
En voulant télécharger un logiciel, j'ai malencontreusement télécharger un Adware avec, manque de chance je n'avais ni Malwarebytes ou même Adwcleaner. Donc l'Adware s'est installé à ouvert une fenêtre cmd pendant quelques secondes et puis hop!

l'Adware je ne sais pas comment, s'est crée un compte Administrateur et me refuse l'accès a chaque fois que j'essaye de télécharger malwarebytes ou autres programmes d'anti-malwares/adwares.

Donc j'ai essayé de désactiver l'UAC, je l'ai fait, j'ai redémarrer mais vous n'allez pas le croire... ça bloque quand même le téléchargement!

Donc j'ai aucun moyens d'enlever l'adware...

SCANS:
FRST: https://pjjoint.malekal.com/files.php?id=FRST_20171001_r15d13b13c6z7
Addition: https://pjjoint.malekal.com/files.php?id=20171001_14t1313p5w13

Voilà, si quelqu'un aurais la solution... car j'utilise ce P.C. pour mes cours et c'est vraiment chiant quand des fenêtres de pubs se lance en pleins cour...

1 réponse

  1.
    Malekal_morte- Messages postés 178136 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   24 712
     
    Bonsoir,

    Voici la correction à effectuer avec FRST. Tu peux t'aider de cette note explicative avec des captures d'écran.

    Ouvre le bloc-notes : Touche Windows + R,
    Dans le champs "Exécuter", saisir notepad et OK.
    Copie/Colle dedans ce qui suit : 

    CreateRestorePoint:
     2017-09-27 17:11 - 2017-09-27 17:11 - 000000000 ____D C:\Users\zahmi\AppData\Local\6f9e87b192634d40b4e3d033e325fd0a  
    2017-10-01 21:18 - 2017-10-01 21:18 - 128537072 _____ (Bitnami) C:\Users\zahmi\Downloads\xampp-win32-7.1.9-0-VC14-installer.exe 
     2017-10-01 21:15 - 2017-10-01 21:16 - 001908360 _____ (Adobe Systems Incorporated) C:\Users\zahmi\Downloads\Photoshop_Set-Up (2).exe 
     2017-10-01 21:12 - 2017-10-01 21:12 - 001908336 _____ (Adobe Systems Incorporated) C:\Users\zahmi\Downloads\Photoshop_Set-Up (1).exe 
     2017-10-01 21:03 - 2017-10-01 21:03 - 000016856 _____ C:\windows\System32\Tasks\Disktips Scale Viewer 
     2017-10-01 21:02 - 2017-10-01 21:02 - 000000000 ____D C:\Users\zahmi\AppData\Local\e4dfd9e3d2684e57abd49a3101d88be5  
     2017-10-01 21:02 - 2017-10-01 21:02 - 000000000 ____D C:\ProgramData\eddb51a99a034668ac0d91f929e020db  
     2017-09-29 19:20 - 2017-09-29 19:20 - 000016904 _____ C:\windows\System32\Tasks\Windows Tom Cable Builder XE2 
     2017-09-29 19:19 - 2017-09-29 19:20 - 000000000 ____D C:\Users\zahmi\AppData\Roaming\5750425e948041cc9dd5962f86c6cd03  
     2017-09-29 19:19 - 2017-09-29 19:19 - 000000000 ____D C:\Users\zahmi\AppData\Local\92b5b187caee467687436f7db0be046c  
     2017-09-29 16:17 - 2017-09-29 17:40 - 000000000 ____D C:\Users\zahmi\Documents\oefeningen 
     2017-09-29 14:46 - 2017-09-29 14:46 - 000000000 ____D C:\Users\zahmi\AppData\Local\7761d63a7c354250a451dc7cf23f6538  
     2017-09-29 10:56 - 2017-09-29 10:56 - 000000000 ____D C:\Users\zahmi\Desktop\zhp 
     2017-09-28 16:19 - 2017-09-28 16:19 - 000000000 ____D C:\ProgramData\d1369c1b2c464849ad6fa61441c0bd95  
     2017-09-28 11:40 - 2017-09-28 11:40 - 000000000 ____D C:\Users\zahmi\AppData\Local\Tempzxpsigne67187184e95c3d1 
     2017-09-28 11:40 - 2017-09-28 11:40 - 000000000 ____D C:\Users\zahmi\AppData\Local\Tempzxpsignc6bea8399ab12dcf 
     2017-09-28 11:39 - 2017-09-28 11:39 - 000003676 _____ C:\windows\System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-zahmidi.oussama@gmail.com 
     2017-09-28 11:32 - 2017-09-28 11:32 - 000494029 _____ C:\Users\zahmi\Downloads\oussama_zahmidi_inspiratie.pdf  
     2017-09-28 11:29 - 2017-09-29 19:21 - 000000000 ____D C:\Users\zahmi\Documents\Inspiratie 
     2017-09-28 11:16 - 2017-09-28 11:16 - 000284039 _____ C:\Users\zahmi\Documents\http.odt  
     2017-09-28 11:16 - 2017-09-28 11:16 - 000000000 ____D C:\Users\zahmi\Documents\Modèles Office personnalisés 
     2017-09-28 10:39 - 2017-10-01 21:30 - 000000000 ___RD C:\Users\zahmi\Creative Cloud Files 
     2017-09-28 10:38 - 2017-10-01 21:30 - 000000000 ____D C:\Users\zahmi\Documents\Adobe  
     2017-09-28 10:36 - 2017-09-28 10:36 - 000000000 ____D C:\ProgramData\AMD  
     2017-09-28 10:22 - 2017-09-28 10:22 - 000347435 _____ C:\Users\zahmi\Downloads\ann_peeters_inspiratie.pdf  
     2017-09-28 10:03 - 2017-09-28 10:03 - 001908336 _____ (Adobe Systems Incorporated) C:\Users\zahmi\Downloads\Photoshop_Set-Up.exe  
     2017-09-27 22:03 - 2017-09-27 22:03 - 000021600 _____ C:\windows\System32\Tasks\c3lPLnyveGEB 
     2017-09-27 22:03 - 2017-09-27 22:03 - 000000000 ____D C:\Program Files (x86)\c3lPLnyveGEB 
     2017-09-27 22:02 - 2017-09-27 22:02 - 000016770 _____ C:\windows\System32\Tasks\Pearl 
     2017-09-27 21:51 - 2017-09-27 21:51 - 001792640 _____ (Bleeping Computer, LLC) C:\Users\zahmi\Downloads\rkill.com  
     2017-09-27 21:51 - 2017-09-27 21:51 - 000983168 _____ (Bleeping Computer, LLC) C:\Users\zahmi\Downloads\rkill64.com  
     2017-09-27 21:49 - 2017-09-27 21:49 - 008182736 _____ (Malwarebytes) C:\Users\zahmi\Downloads\adwcleaner_7.0.2.1 (1).exe 
     2017-09-27 21:48 - 2017-09-27 21:49 - 001790024 _____ (Malwarebytes) C:\Users\zahmi\Downloads\JRT.exe  
     2017-09-27 21:32 - 2017-09-27 21:32 - 000000000 ____D C:\Users\zahmi\AppData\Roaming\Macromedia  
     2017-09-27 21:29 - 2017-09-27 21:37 - 000000000 ____D C:\Users\zahmi\AppData\Roaming\ZHP  
     2017-09-27 21:29 - 2017-09-27 21:30 - 000000000 ____D C:\Users\zahmi\AppData\Local\ZHP 
     2017-09-27 21:29 - 2017-09-27 21:29 - 002892160 _____ C:\Users\zahmi\Downloads\ZHPDiag3.exe  
     2017-09-27 20:34 - 2017-09-27 20:34 - 008182736 _____ (Malwarebytes) C:\Users\zahmi\Downloads\adwcleaner_7.0.2.1.exe 
     2017-09-27 20:29 - 2017-09-27 20:29 - 000000000 ____D C:\ProgramData\Microleaves 
     2017-09-27 20:26 - 2017-09-27 20:55 - 000000414 _____ C:\windows\Tasks\Updater_Online_Application.job  
     2017-09-27 20:26 - 2017-09-27 20:55 - 000000382 _____ C:\windows\Tasks\Online Application V2G3.job 
     2017-09-27 20:26 - 2017-09-27 20:55 - 000000382 _____ C:\windows\Tasks\Online Application V2G2.job 
     2017-09-27 20:26 - 2017-09-27 20:55 - 000000382 _____ C:\windows\Tasks\Online Application V2G1.job 
     2017-09-27 20:26 - 2017-09-27 20:26 - 000003308 _____ C:\windows\System32\Tasks\Updater_Online_Application 
     2017-09-27 20:26 - 2017-09-27 20:26 - 000003272 _____ C:\windows\System32\Tasks\Online Application V2G3 
     2017-09-27 20:26 - 2017-09-27 20:26 - 000003272 _____ C:\windows\System32\Tasks\Online Application V2G2 
     2017-09-27 20:26 - 2017-09-27 20:26 - 000003272 _____ C:\windows\System32\Tasks\Online Application V2G1 
     2017-09-27 20:26 - 2017-09-27 20:26 - 000000000 ____D C:\Program Files (x86)\Microleaves 
     2017-09-27 20:25 - 2017-09-27 20:25 - 000000000 ____D C:\Users\zahmi\AppData\Local\c7607a5606d1475a92ac718f77dbda4a  
    2017-10-01 21:30 - 2017-10-01 21:30 - 000000000 ____D C:\Users\zahmi\AppData\Local\Tempzxpsignb61f07b1210da74b 
     2017-10-01 21:30 - 2017-10-01 21:30 - 000000000 ____D C:\Users\zahmi\AppData\Local\Tempzxpsign9307eae4f2eaa3f7 
     2017-10-01 21:30 - 2017-10-01 21:30 - 000000000 ____D C:\Users\zahmi\AppData\Local\Tempzxpsign00456091e6445f99 
    Task: {DC199DD0-9D5B-40DB-9B89-5D2DC13C1C2B} - System32\Tasks\Disktips Scale Viewer =>  [Argument = "C:\Program Files\Disktips Scale Viewer\Disktips Scale Viewer.dll",dWGILG]
    Task: {C125875E-2439-4572-B0F6-C6CF78BE11ED} - System32\Tasks\jJKowXmxzIFxIuj =>  [Argument = "C:\Program Files (x86)\TQoarIXzU\agViMW.dll",#1]
    Task: {0080C5C4-AA20-4FA4-A2B3-D51913C59923} - System32\Tasks\LSjUFtTofwjkxN =>  [Argument = "C:\Program Files (x86)\ICBaloCIDxXU2\ysMicZkBjjtlL.dll",#1]
    Task: {5CA48D63-7CC5-4DDA-93E5-5B0628E534D6} - System32\Tasks\jJKowXmxzIFxIuj2 =>  [Argument = "C:\Program Files (x86)\TQoarIXzU\siZBjl.dll",#1]
    HKLM\...\RunOnce: [Lahin_Raw_barra_al3eb_b3id_NXRYKJNLVP.exe] => C:\Program Files\Uninstall Information\FGUGGEKGAX\NXRYKJNLVP.exe [1310720 2017-09-27] () 
     HKLM\ DisallowedCertificates: 03D22C9C66915D58C88912B64C1F984B8344EF09 (Comodo Security Solutions) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 0F684EC1163281085C6AF20528878103ACEFCAAB (F-Secure Corporation) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 1667908C9E22EFBD0590E088715CC74BE4C60884 (FRISK Software International/F-Prot) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 18DEA4EFA93B06AE997D234411F3FD72A677EECE (Bitdefender SRL) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 2026D13756EB0DB753DF26CB3B7EEBE3E70BB2CF (G DATA Software AG) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 249BDA38A611CD746A132FA2AF995A2D3C941264 (Malwarebytes Corporation) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 31AC96A6C17C425222C46D55C3CCA6BA12E54DAF (Symantec Corporation) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 331E2046A1CCA7BFEF766724394BE6112B4CA3F7 (Trend Micro) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 3353EA609334A9F23A701B9159E30CB6C22D4C59 (Webroot Inc.) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 373C33726722D3A5D1EDD1F1585D5D25B39BEA1A (SUPERAntiSpyware.com) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 3850EDD77CC74EC9F4829AE406BBF9C21E0DA87F (Kaspersky Lab) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 3D496FA682E65FC122351EC29B55AB94F3BB03FC (AVG Technologies CZ) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 4243A03DB4C3C15149CEA8B38EEA1DA4F26BD159 (PC Tools) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 42727E052C0C2E1B35AB53E1005FD9EDC9DE8F01 (K7 Computing Pvt Ltd) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 4420C99742DF11DD0795BC15B7B0ABF090DC84DF (Doctor Web Ltd.) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 4C0AF5719009B7C9D85C5EAEDFA3B7F090FE5FFF (Emsisoft Ltd) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 5240AB5B05D11B37900AC7712A3C6AE42F377C8C (Check Point Software Technologies Ltd.) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 5DD3D41810F28B2A13E9A004E6412061E28FA48D (Emsisoft Ltd) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 7457A3793086DBB58B3858D6476889E3311E550E (K7 Computing Pvt Ltd) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 76A9295EF4343E12DFC5FE05DC57227C1AB00D29 (BullGuard Ltd) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 775B373B33B9D15B58BC02B184704332B97C3CAF (McAfee) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 872CD334B7E7B3C3D1C6114CD6B221026D505EAB (Comodo Security Solutions) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 88AD5DFE24126872B33175D1778687B642323ACF (McAfee) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 9132E8B079D080E01D52631690BE18EBC2347C1E (Adaware Software) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 982D98951CF3C0CA2A02814D474A976CBFF6BDB1 (Safer Networking Ltd.) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 9A08641F7C5F2CCA0888388BE3E5DBDDAAA3B361 (Webroot Inc.) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 9C43F665E690AB4D486D4717B456C5554D4BCEB5 (ThreatTrack Security) <==== ATTENTION  
     HKLM\ DisallowedCertificates: 9E3F95577B37C74CA2F70C1E1859E798B7FC6B13 (CURIOLAB S.M.B.A.) <==== ATTENTION  
     HKLM\ DisallowedCertificates: A1F8DCB086E461E2ABB4B46ADCFA0B48C58B6E99 (Avira Operations GmbH & Co. KG) <==== ATTENTION  
     HKLM\ DisallowedCertificates: A5341949ABE1407DD7BF7DFE75460D9608FBC309 (BullGuard Ltd) <==== ATTENTION  
     HKLM\ DisallowedCertificates: A59CC32724DD07A6FC33F7806945481A2D13CA2F (ESET) <==== ATTENTION  
     HKLM\ DisallowedCertificates: AB7E760DA2485EA9EF5A6EEE7647748D4BA6B947 (AVG Technologies CZ) <==== ATTENTION  
     HKLM\ DisallowedCertificates: AD4C5429E10F4FF6C01840C20ABA344D7401209F (Avast Antivirus/Software) <==== ATTENTION  
     HKLM\ DisallowedCertificates: AD96BB64BA36379D2E354660780C2067B81DA2E0 (Symantec Corporation) <==== ATTENTION  
     HKLM\ DisallowedCertificates: B8EBF0E696AF77F51C96DB4D044586E2F4F8FD84 (Malwarebytes Corporation) <==== ATTENTION  
     HKLM\ DisallowedCertificates: CDC37C22FE9272D8F2610206AD397A45040326B8 (Trend Micro) <==== ATTENTION  
     HKLM\ DisallowedCertificates: D3F78D747E7C5D6D3AE8ABFDDA7522BFB4CBD598 (Kaspersky Lab) <==== ATTENTION  
     HKLM\ DisallowedCertificates: DB303C9B61282DE525DC754A535CA2D6A9BD3D87 (ThreatTrack Security) <==== ATTENTION  
     HKLM\ DisallowedCertificates: DB77E5CFEC34459146748B667C97B185619251BA (Avast Antivirus/Software) <==== ATTENTION  
     HKLM\ DisallowedCertificates: E22240E837B52E691C71DF248F12D27F96441C00 (Total Defense, Inc.) <==== ATTENTION  
     HKLM\ DisallowedCertificates: E513EAB8610CFFD7C87E00BCA15C23AAB407FCEF (AVG Technologies CZ) <==== ATTENTION  
     HKLM\ DisallowedCertificates: ED841A61C0F76025598421BC1B00E24189E68D54 (Bitdefender SRL) <==== ATTENTION  
     HKLM\ DisallowedCertificates: F83099622B4A9F72CB5081F742164AD1B8D048C9 (ESET) <==== ATTENTION  
     HKLM\ DisallowedCertificates: FBB42F089AF2D570F2BF6F493D107A3255A9BB1A (Panda Security S.L) <==== ATTENTION  
     HKLM\ DisallowedCertificates: FFFA650F2CB2ABC0D80527B524DD3F9FC172C138 (Doctor Web Ltd.) <==== ATTENTION  
    HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION 
     HKU\S-1-5-21-2926115484-2077927034-2968094822-1001\...\Run: [OZNTPBSCVK.exe] => C:\Program Files\Synaptics\IBELRIXPBQ\OZNTPBSCVK.exe [469504 2017-09-27] () 
     HKU\S-1-5-21-2926115484-2077927034-2968094822-1001\...\Run: [45br6wtR.exe] => C:\ProgramData\05793f9eeac84c8faaaee8bd734358d8\45br6wtR.exe  
     HKU\S-1-5-21-2926115484-2077927034-2968094822-1001\...\Run: [MatXJbQ.exe] => C:\Users\zahmi\AppData\Roaming\14ad2d7b102c4433acc46fe4f0662dd3\MatXJbQ.exe 
     HKU\S-1-5-21-2926115484-2077927034-2968094822-1001\...\Run: [ZMzW0fCdIjM.exe] => C:\ProgramData\df01308b3d2045c59e47007b86e87a17\ZMzW0fCdIjM.exe  
     HKU\S-1-5-21-2926115484-2077927034-2968094822-1001\...\Run: [Ckc8WLS4.exe] => C:\Users\zahmi\AppData\Roaming\1019622b7fc64a1498a83079adf7ffb9\Ckc8WLS4.exe  
     HKU\S-1-5-21-2926115484-2077927034-2968094822-1001\...\Run: [hIT1kzdGz0roI.exe] => C:\ProgramData\0f57e3f177aa42e09eafc24fedf1615e\hIT1kzdGz0roI.exe  
     HKU\S-1-5-21-2926115484-2077927034-2968094822-1001\...\Run: [Ery2lHyIi4J.exe] => C:\ProgramData\e50a3733272c40b5b15e00dbc4454fd4\Ery2lHyIi4J.exe  
     HKU\S-1-5-21-2926115484-2077927034-2968094822-1001\...\Run: [doav3tL62.exe] => C:\ProgramData\d1369c1b2c464849ad6fa61441c0bd95\doav3tL62.exe [416256 2017-09-28] ()  
     HKU\S-1-5-21-2926115484-2077927034-2968094822-1001\...\Run: [3Zn2pkEgEP98Y.exe] => C:\Users\zahmi\AppData\Local\92b5b187caee467687436f7db0be046c\3Zn2pkEgEP98Y.exe [342528 2017-09-29] (please)  
     HKU\S-1-5-21-2926115484-2077927034-2968094822-1001\...\Run: [zE1l6R0vn7tLVp.exe] => C:\Users\zahmi\AppData\Local\e4dfd9e3d2684e57abd49a3101d88be5\zE1l6R0vn7tLVp.exe [342528 2017-10-01] (please)  
    RemoveProxy:
    Hosts:
    EmptyTemp:
    RemoveProxy:
    Reboot:


    Une fois, le texte collé dans le Bloc-notes,
    Menu "Fichier" puis "Enregistrer sous",
    A gauche, place toi sur le Bureau,
    Dans le champs en bas, nom du fichier mets : fixlist.txt
    Clique sur "Enregistrer", cela va créer fixlist.txt sur le Bureau.

    Relance FRST et clique sur le bouton "Corriger / Fix"
    Un redémarrage sera peut-être nécessaire ( pas obligatoire )
    Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

    Redémarre l'ordinateur.

    2°)
    Réinitialise/Répare les navigateurs WEB concernés par les problèmes :

    3°)
    Termine par un nettoyage Malwarebytes - Tutoriel Malwarebytes Anti-Malware version gratuite

    4°)
    Vois ce que cela donne et si des améliorations ont eu lieu.
    Si ce n'est pas le cas, si tu as encore des pages de pubs intempestives, précise sur quel navigateur WEB.
    Refais un scan FRST et donne les nouveaux rapports via pjjoint.

    0

Discussions similaires

Contrôle d’accès Bbox
Granny -
brupala -

1 réponse
passer outre le contrôle parental
Jeuls21 -
giselledurand -

12 réponses
touche CTRL Bloquée
biilyboy85 -
DameVio -

32 réponses