Virus Mail.ru page d'accueil Google et Pop-ups

Salut,

Apparemment tu as choppé cela en essayant de cracker Windows ...

Voici la correction à effectuer avec FRST. Tu peux t'aider de cette note explicative avec des captures d'écran.
Relance FRST puis sur ton clavier appuyer sur la touche CTRL + Y.
Le bloc-note va s'ouvrir, copie/colle ceci.

CreateRestorePoint:
CloseProcesses:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
GroupPolicy: Restriction - Chrome <==== ATTENTION
GroupPolicy\User: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
2017-12-03 15:27 - 2017-12-05 14:31 - 000000000 ____D C:\Program Files (x86)\vknAtWNPMhpU2
2017-12-03 15:27 - 2017-12-03 15:37 - 000000000 ____D C:\Program Files (x86)\FpGcSjfNZDUn
2017-12-03 15:27 - 2017-12-03 15:27 - 001895382 _____ C:\Users\mehdi\AppData\Local\Santip.bin
2017-12-03 15:27 - 2017-12-03 15:27 - 000015606 _____ C:\Windows\SysWOW64\findit.xml
2017-12-03 15:27 - 2017-12-03 15:27 - 000003568 _____ C:\Windows\System32\Tasks\FastDataX Task
2017-12-03 15:27 - 2017-12-03 15:27 - 000000000 ____D C:\Program Files (x86)\OGqwJxyzdjgEZIvrFER
2017-12-03 15:26 - 2017-12-05 14:15 - 000000000 ____D C:\Program Files (x86)\ExRIRmygU
2017-12-03 15:26 - 2017-12-03 15:30 - 000000000 ____D C:\Users\mehdi\AppData\Roaming\67add09b14184344af380f82983f9bf9
2017-12-03 15:26 - 2017-12-03 15:30 - 000000000 ____D C:\ProgramData\086b34fa0b934cf4bd8c4f2b0445cc87
2017-12-03 15:26 - 2017-12-03 15:29 - 000000288 _____ C:\Windows\Tasks\jVVcebPoCjhHKmi.job
2017-12-03 15:26 - 2017-12-03 15:28 - 000016692 _____ C:\Windows\System32\Tasks\AutoWzD
2017-12-03 15:26 - 2017-12-03 15:27 - 000000394 _____ C:\Windows\Tasks\bku3622105787239036.job
2017-12-03 15:26 - 2017-12-03 15:27 - 000000000 _____ C:\END
2017-12-03 15:26 - 2017-12-03 15:26 - 007348224 _____ C:\Users\mehdi\AppData\Local\agent.dat
2017-12-03 15:26 - 2017-12-03 15:26 - 001902825 _____ C:\Users\mehdi\AppData\Local\Matsolstock.tst
2017-12-03 15:26 - 2017-12-03 15:26 - 000278507 _____ C:\Users\mehdi\AppData\Local\Touchcore.bin
2017-12-03 15:26 - 2017-12-03 15:26 - 000126464 _____ C:\Users\mehdi\AppData\Local\noah.dat
2017-12-03 15:26 - 2017-12-03 15:26 - 000070800 _____ C:\Users\mehdi\AppData\Local\Config.xml
2017-12-03 15:26 - 2017-12-03 15:26 - 000018432 _____ C:\Users\mehdi\AppData\Local\Main.dat
2017-12-03 15:26 - 2017-12-03 15:26 - 000005568 _____ C:\Users\mehdi\AppData\Local\md.xml
2017-12-03 15:26 - 2017-12-03 15:26 - 000003968 _____ C:\Windows\System32\Tasks\GoogleUpdateSecurityTaskMachine_KO
2017-12-03 15:26 - 2017-12-03 15:26 - 000003968 _____ C:\Windows\System32\Tasks\GoogleUpdateSecurityTaskMachine_KN
2017-12-03 15:26 - 2017-12-03 15:26 - 000003968 _____ C:\Windows\System32\Tasks\GoogleUpdateSecurityTaskMachine_FN
2017-12-03 15:26 - 2017-12-03 15:26 - 000003038 _____ C:\Windows\System32\Tasks\hostTask
2017-12-03 15:26 - 2017-12-03 15:26 - 000003004 _____ C:\Windows\System32\Tasks\bku3622105787239036
2017-12-03 15:26 - 2017-12-03 15:26 - 000000290 __RSH C:\Users\mehdi\ntuser.pol
2017-12-03 15:25 - 2017-12-03 15:38 - 000000000 ____D C:\Users\mehdi\AppData\Local\AdService
2017-12-03 15:25 - 2017-12-03 15:31 - 000930816 _____ C:\Users\mehdi\AppData\Local\po.db
2017-12-03 15:25 - 2017-12-03 15:30 - 000000000 ____D C:\Users\mehdi\AppData\Local\ifgker
2017-12-03 15:25 - 2017-12-03 15:30 - 000000000 ____D C:\Users\mehdi\AppData\Local\f172037a96744cb897c83f13dfc8ac00
2017-12-03 15:25 - 2017-12-03 15:26 - 000016176 _____ C:\Users\mehdi\AppData\Local\InstallationConfiguration.xml
2017-12-03 15:25 - 2017-12-03 15:25 - 000140800 _____ C:\Users\mehdi\AppData\Local\installer.dat
2017-12-03 15:25 - 2017-12-03 15:25 - 000003968 _____ C:\Windows\System32\Tasks\GoogleUpdateSecurityTaskMachine_MF
2017-12-03 15:25 - 2017-12-03 15:25 - 000003904 _____ C:\Windows\System32\Tasks\GoogleUpdateSecurityTaskMachine_NL
2017-12-03 15:25 - 2017-12-03 15:25 - 000003412 _____ C:\Windows\System32\Tasks\ifgker
2017-12-03 15:23 - 2017-12-03 15:23 - 000003568 _____ C:\Windows\System32\Tasks\OneSystemCare Task
2017-12-03 15:23 - 2017-12-03 15:23 - 000000000 ____D C:\Users\mehdi\AppData\Local\Поиcк в Интeрнете
2017-12-03 15:22 - 2017-12-03 15:26 - 000000000 ____D C:\Users\mehdi\AppData\Local\Mail.Ru
2017-12-03 15:22 - 2017-12-03 15:22 - 000003320 _____ C:\Windows\System32\Tasks\space(title, t_monitor)
2017-12-03 15:22 - 2017-12-03 15:22 - 000003310 _____ C:\Windows\System32\Tasks\space(title, t_delayed)
2017-12-03 15:21 - 2017-12-03 15:25 - 000000000 ____D C:\ProgramData\Mail.Ru
2017-12-03 15:20 - 2017-12-03 15:20 - 001768136 _____ C:\Users\mehdi\Downloads\windows loader v2 2 2.zip
2017-12-03 15:20 - 2017-08-15 22:25 - 002883091 _____ C:\Users\mehdi\Desktop\Windows 7 Loader.zip
2017-12-03 15:19 - 2017-12-03 15:20 - 002883863 _____ C:\Users\mehdi\Downloads\Windows_7_Loader.zip
Task: C:\Windows\Tasks\bku3622105787239036.job => C:\Users\mehdi\AppData\Local\Temp\cff45tya.pi5\ytab_m_1_big.exe/comm=we C:\Users\mehdi\AppData\Local\Temp\cff45tya.pi <==== ATTENTION
Task: C:\Windows\Tasks\jVVcebPoCjhHKmi.job => C:\Program Files (x86)\ExRIRmygU\BQFKNb.dll
Task: {F666FA9C-E851-4C1D-97C3-736CB3580EC8} - System32\Tasks\{8B9D1DB9-C5E3-4A05-B0CE-0283C4B84118} => C:\Windows\system32\pcalua.exe -a "C:\Users\mehdi\Desktop\Windows 7 Loader.exe" -d C:\Users\mehdi\Desktop
Task: {FCE40CD1-4579-4D33-B6A2-127D18FC00B3} - C:\Windows\System32\Tasks\Microsoft\Windows\RAI\RaiTask => Command(1): net.exe -> stop sppsvc
Task: {FCE40CD1-4579-4D33-B6A2-127D18FC00B3} - C:\Windows\System32\Tasks\Microsoft\Windows\RAI\RaiTask => Command(2): reg.exe -> delete HKLM\SYSTEM\WPA /f
Task: {56140189-677C-4E85-9741-F05F3B3AA482} - System32\Tasks\AutoWzD => C:\Windows\system32\rundll32.exe "C:\Program Files\AutoWzD\AutoWzD.dll",TMsCvjgbfnKa <==== ATTENTION
C:\Program Files\AutoWzD
ShortcutWithArgument: C:\Users\mehdi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> %SNP%
ShortcutWithArgument: C:\Users\mehdi\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> %SNP%
ShortcutWithArgument: C:\Users\mehdi\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> %SNP%
ShortcutWithArgument: C:\Users\mehdi\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mail.Ru.lnk -> C:\Windows\System32\rundll32.exe (Microsoft Corporation) -> url,FileProtocolHandler "hxxp://www.mail.ru/cnt/20775012?gp=855000"
ShortcutWithArgument: C:\Users\mehdi\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> %SNP%
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> %SNP%
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> %SNP%
Hosts:
EmptyTemp:
RemoveProxy:
Reboot:

Enregistre le contenu par le menu fichier puis enregistrer.

Ferme le bloc-note, retourne sur FRST et clique sur le bouton "Corriger / Fix"
Un redémarrage sera peut-être nécessaire et automatique.
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

Redémarre l'ordinateur.

2°)
Réinitialise/Répare les navigateurs WEB concernés par les problèmes :

• Réparer Mozilla Firefox (premier paragraphe)
• Réparer Google Chrome (seulement le premier paragraphe).
• Réinitialiser et réparer Internet Explorer

3°)
Termine par un nettoyage Malwarebytes - Tutoriel Malwarebytes Anti-Malware version gratuite

Veuillez appuyer sur une touche pour continuer la désinfection...