Message d'erreur au démarrage de windows

ok merci bien !

Salut,

Pour vérifier ton ordinateur, pour d'éventuels infections et avoir un état général du système :

Suis tutoriel FRST en cliquant sur ce lien bleu. ( prends le temps de lire attentivement - tout y est bien expliqué ).

Télécharge et lance le scan FRST,
Attendre la fin du scan, un message indique que l'analyse est terminée.

Trois rapports FRST seront générés :

• FRST.txt
• Shortcut.
• Additionnal.txt

Envoie ces 3 rapports sur le site https://pjjoint.malekal.com/ et en retour donne les 3 liens pjjoint qui mènent aux rapports ici dans une nouvelle réponse afin que l'on puisse les consulter.

https://pjjoint.malekal.com/files.php?id=FRST_20181122_q10h15h8b12g10
https://pjjoint.malekal.com/files.php?id=20181122_l11d7q11w10x6
https://pjjoint.malekal.com/files.php?id=20181122_o6l5w14x15q7

Il s'agit d'un Trojan RAT... il y a aussi d'autres infections.
Tout cela vient par les cracks que tu télécharges sur le premier site venu.

Faudra changer tes mots de passe, ils ont été volés.

Voici la correction à effectuer avec FRST. Tu peux t'aider de cette note explicative avec des captures d'écran.
Relance FRST puis sur ton clavier appuyer sur la touche CTRL + Y.
Le bloc-note va s'ouvrir, copie/colle ceci.

CreateRestorePoint:
CloseProcesses:
  Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ftfrcwgg.lnk [2018-11-15] 
   2018-11-13 18:30 - 2018-11-15 10:59 - 000000000 ____D C:\WINDOWS\SysWOW64\ugguejzs 
   Task: {13B50FF7-D10B-4BCF-A2ED-2F6952012BEB} - System32\Tasks\DRPNPS => Command(1): mshta.exe -> "http://update.drp.su/nps/online/bin/tools/run.hta" "17.7.62 Online" "1501514624390" "408e42ce-6393-4723-ab6e-a4ccfb4a27d4"
Task: {13B50FF7-D10B-4BCF-A2ED-2F6952012BEB} - System32\Tasks\DRPNPS => Command(2): SCHTASKS -> /Delete /TN DRPNPS /F
Task: {57C7B157-4DA9-4843-A6F7-6F40C486D14E} - System32\Tasks\Online Application V2G4 => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
C:\Program Files (x86)\Microleaves
Task: C:\WINDOWS\Tasks\Online Application V2G1.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G2.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G3.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G4.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G5.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G6.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Updater_Online_Application.job => C:\Program Files (x86)\Microleaves\Online Application\Online Application Updater.exe <==== ATTENTION

EmptyTemp:
RemoveProxy:
Reboot:

Enregistre le contenu par le menu fichier puis enregistrer.

Ferme le bloc-note, retourne sur FRST et clique sur le bouton "Corriger / Fix"
Un redémarrage sera peut-être nécessaire et automatique.
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

Redémarre l'ordinateur

Merci pour ces explications super claires !

Voici le résultat avec le nouveau fichier texte crée :
ix result of Farbar Recovery Scan Tool (x64) Version: 21.11.2018
Ran by Admin (22-11-2018 17:59:25) Run:1
Running from C:\Users\Admin\Desktop
Loaded Profiles: Admin (Available Profiles: Admin)
Boot Mode: Normal
==============================================

fixlist content:
CreateRestorePoint:
CloseProcesses:
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ftfrcwgg.lnk [2018-11-15]
2018-11-13 18:30 - 2018-11-15 10:59 - 000000000 ____D C:\WINDOWS\SysWOW64\ugguejzs
Task: {13B50FF7-D10B-4BCF-A2ED-2F6952012BEB} - System32\Tasks\DRPNPS => Command(1): mshta.exe -> "http://update.drp.su/nps/online/bin/tools/run.hta" "17.7.62 Online" "1501514624390" "408e42ce-6393-4723-ab6e-a4ccfb4a27d4"
Task: {13B50FF7-D10B-4BCF-A2ED-2F6952012BEB} - System32\Tasks\DRPNPS => Command(2): SCHTASKS -> /Delete /TN DRPNPS /F
Task: {57C7B157-4DA9-4843-A6F7-6F40C486D14E} - System32\Tasks\Online Application V2G4 => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
C:\Program Files (x86)\Microleaves
Task: C:\WINDOWS\Tasks\Online Application V2G1.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G2.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G3.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G4.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G5.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G6.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Updater_Online_Application.job => C:\Program Files (x86)\Microleaves\Online Application\Online Application Updater.exe <==== ATTENTION

EmptyTemp:
RemoveProxy:
Reboot:

Restore point was successfully created.
Processes closed successfully.
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ftfrcwgg.lnk => moved successfully
C:\WINDOWS\SysWOW64\ugguejzs => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{13B50FF7-D10B-4BCF-A2ED-2F6952012BEB}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{13B50FF7-D10B-4BCF-A2ED-2F6952012BEB}" => removed successfully
C:\WINDOWS\System32\Tasks\DRPNPS => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DRPNPS" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{13B50FF7-D10B-4BCF-A2ED-2F6952012BEB}" => not found
"C:\WINDOWS\System32\Tasks\DRPNPS" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DRPNPS" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{57C7B157-4DA9-4843-A6F7-6F40C486D14E}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{57C7B157-4DA9-4843-A6F7-6F40C486D14E}" => removed successfully
C:\WINDOWS\System32\Tasks\Online Application V2G4 => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Online Application V2G4" => removed successfully
C:\Program Files (x86)\Microleaves => moved successfully
C:\WINDOWS\Tasks\Online Application V2G1.job => moved successfully
C:\WINDOWS\Tasks\Online Application V2G2.job => moved successfully
C:\WINDOWS\Tasks\Online Application V2G3.job => moved successfully
C:\WINDOWS\Tasks\Online Application V2G4.job => moved successfully
C:\WINDOWS\Tasks\Online Application V2G5.job => moved successfully
C:\WINDOWS\Tasks\Online Application V2G6.job => moved successfully
C:\WINDOWS\Tasks\Updater_Online_Application.job => moved successfully

========= RemoveProxy: =========

"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully
"HKU\S-1-5-21-307312644-570513866-2913308433-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\S-1-5-21-307312644-570513866-2913308433-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully

========= End of RemoveProxy: =========

=========== EmptyTemp: ==========

BITS transfer queue => 9461760 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 248717567 B
Java, Flash, Steam htmlcache => 410 B
Windows/system/drivers => 7795734 B
Edge => 2369217 B
Chrome => 0 B
Firefox => 149342481 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 18014 B
LocalService => 0 B
NetworkService => 2938 B
NetworkService => 0 B
Admin => 165973488 B

RecycleBin => 2749488171 B
EmptyTemp: => 3.1 GB temporary data Removed.

================================

The system needed a reboot.

End of Fixlog 18:01:47

Le reste ?

ha oui manque la suite effectivement,

Supprime le dossier C:\FRST

Termine par un nettoyage MBAM :

• Télécharger Malwarebytes
• Tutoriel Malwarebytes Anti-Malware version gratuite

Evite les analyses et nettoyages réguliers ZHPCleaner, AdwCleaner, pas utile.

Change tous tes mots de passe.