View original (French)

Avast message - block WindowsDefender.club

Solved
boubou83190 Posted messages 61 Status Member -  
Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   -
Hello,

Recently I keep getting a message saying that AVAST has deleted http://windowsdefender.club, so I don’t know if this is a virus or not, if you can help me please thank you

3 answers

  1.
    Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Hello/Good evening,

    Here is the procedure to follow. On the blue links you will find explanatory tutorials with all the details to follow the steps.

    1)
    Repair the WEB browsers concerned by the problems:
    - Repair Mozilla Firefox
    - Repair Google Chrome
    (only the first paragraph)

    (do not use zoek and perform a manual reset)

    2)
    To check your computer for possible infections and to get an overall status of the system:
    Follow the FRST tutorial by clicking on this blue link. (take the time to read carefully – everything is well explained).

    Download and run the FRST scan,
    Wait for the scan to finish, a message will indicate that the analysis is complete.

    Three FRST reports will be generated:
    - FRST.txt
    - Shortcut
    - Additionnal.txt

    Send these 3 reports to the site https://pjjoint.malekal.com/ and in return provide the 3 pjjoint links that lead to the reports here in a new reply so that we can review them.

    (The blue links lead to step-by-step explanatory tutorials; click them to get more precise instructions to follow).

    --
    Please press any key to continue with the disinfection...
    0
  2. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Yep, you infected your PC. You have programs that were installed when you bought the computer or afterwards and which aren’t necessarily useful. They clutter Windows and can slow it down. So you can uninstall them. Go to the Control Panel, then Programs and Features. Uninstall: CyberLink WildTangent Games Wondershare PS: CCleaner isn’t really useful, even if it’s recommended everywhere. If you insist on keeping it, disable CCleaner monitoring—it's pointless, it starts with Windows and slows things down with incessant cleans, see: https://www.malekal.com/supprimer-ccleaner-demarrage-windows/ Here is the correction to perform with FRST. You can use this explanatory note with screenshots: https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/#fix. Run FRST again, then on your keyboard press CTRL + Y. Notepad will open; copy/paste the following. 
    Start:
CloseProcesses:
CreateRestorePoint:
Task: {045A4683-A7D1-4381-B18B-C9568D3DE107} - System32\Tasks\KMSActivate => C:\WINDOWS\explorer.exe "hxxp://mstoolkitfiles.xyz/warning/download.php?mn=7788" <==== ATTENTION
Task: {B478BD55-0AFD-44F8-AF29-32CF4764C510} - System32\Tasks\PPI Update => C:\WINDOWS\explorer.exe "hxxp://windowsdefender.club/warning/download.php?mn=5623" <==== ATTENTION
Task: {B478BD55-0AFD-44F8-AF29-32CF4764C510} - System32\Tasks\PPI Update => C:\WINDOWS\explorer.exe "hxxp://windowsdefender.club/warning/download.php?mn=5623" <==== ATTENTION
Task: {B9C3B468-0E74-4B73-8075-44D1AD177BE0} - System32\Tasks\App Explorer => C:\Users\pbous\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe <==== ATTENTION
EmptyTemp:
RemoveProxy:
Hosts:
Reboot:
End:
    Enregistre le contenu par le menu Fichier puis Enregistrer. Ferme le bloc-notes, retourne sur FRST et clique sur le bouton "Corriger / Fix". Un redémarrage peut être nécessaire et se faire automatiquement. Un fichier texte apparaît; copie-colle le contenu ici dans un nouveau message. Redémarre l’ordinateur. -- Veuillez appuyer sur une touche pour continuer la désinfection...
    0
    1. boubou83190 Posted messages 61 Status Member 6
       
      Farbar Recovery Scan Tool (x64) Version: 02-10-2019 Ran by boubou (02-10-2019 13:17:25) Run:1 From: C:\Users\pbous\Desktop Loaded profiles: boubou (Available profiles: boubou) Boot Mode: Normal ============================================== fixlist contents: Start: CloseProcesses: CreateRestorePoint: Task: {045A4683-A7D1-4381-B18B-C9568D3DE107} - System32\Tasks\KMSActivate => C:\WINDOWS\explorer.exe "hxxp://mstoolkitfiles.xyz/warning/download.php?mn=7788" <==== ATTENTION Task: {B478BD55-0AFD-44F8-AF29-32CF4764C510} - System32\Tasks\PPI Update => C:\WINDOWS\explorer.exe "hxxp://windowsdefender.club/warning/download.php?mn=5623" <==== ATTENTION Task: {B478BD55-0AFD-44F8-AF29-32CF4764C510} - System32\Tasks\PPI Update => C:\WINDOWS\explorer.exe "hxxp://windowsdefender.club/warning/download.php?mn=5623" <==== ATTENTION Task: {B9C3B468-0E74-4B73-8075-44D1AD177BE0} - System32\Tasks\App Explorer => C:\Users\pbous\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe <==== ATTENTION EmptyTemp: RemoveProxy: Hosts: Reboot: End: ========= RemoveProxy: ========= "HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings" => removed successfully "HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings" => removed successfully "HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings" => removed successfully "HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings" => removed successfully "HKU\S-1-5-21-724782549-2129030118-2332504145-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings" => removed successfully "HKU\S-1-5-21-724782549-2129030118-2332504145-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings" => removed successfully ========= Fin de RemoveProxy: ========= C:\Windows\System32\Drivers\etc\hosts => moved successfully Hosts restored successfully. =========== EmptyTemp: ========== BITS transfer queue => 10772480 B DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 141210138 B Java, Flash, Steam htmlcache => 1277 B Windows/system/drivers => 210616 B Edge => 673639 B Chrome => 442713501 B Firefox => 0 B Opera => 161186 B Temp, IE cache, history, cookies, recent: Default => 0 B Users => 0 B ProgramData => 0 B Public => 0 B systemprofile => 0 B systemprofile32 => 0 B LocalService => 47148 B LocalService => 0 B NetworkService => 22936 B NetworkService => 0 B pbous => 45263914 B RecycleBin => 0 B EmptyTemp: => 611.4 MB of temporary data deleted. ================================ The system must be rebooted.

      End of Fixlog 13:19:44

      0
    2. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      okay, see what it looks like in terms of Avast! alerts
      0
    3. boubou83190 Posted messages 61 Status Member 6
       
      Listen, everything looks flawless to me, great job, thank you.
      0
  3. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Perfect =)

    Read to avoid being fooled again since it's surely by one of these methods that ads arrived.

    --
    Please press a key to continue disinfection...
    0