PC Infecté

.

super =)

Voila, c'est terminé, tu peux supprimer les programmes utilisés.

Quelques conseils :

Pour prévenir les sites malicieux, tu peux installer Blockulicious : https://forum.malekal.com/viewtopic.php?t=46656&start=

Pour ne plus te faire avoir.
A lire - Programmes parasites / PUPs : https://www.malekal.com/adwares-pup-protection/
(Surtout active les détections LPIs pour détecter les programmes parasites et publicitaires)

Le reste de la sécurité : http://forum.malekal.com/comment-securiser-son-ordinateur.html

si tu redémarres, tu en as encore ?

Bonsoir,

Au redémarrage de l'ordinateur, j'ai eu plein de messages type "dos". J'ai fini par m'échaper... j'espère que cela n'aura pas compromis ton travail. Voici le dernier rapport demandé :

Fix result of Farbar Recovery Scan Tool (x86) Version: 05-07-2015
Ran by jill at 2015-07-09 22:39:58 Run:1
Running from C:\Documents and Settings\jill\Bureau
Loaded Profiles: jill (Available Profiles: jill)
Boot Mode: Normal

==============================================

fixlist content:
R2 vfPjYfccU; C:\Documents and Settings\All Users.WINDOWS\Application Data\uYDeQad\vfPjYfccU.exe [2732024 2015-07-08] (Irrational Number Applications)
2015-07-08 21:55 - 2015-07-08 21:55 - 00000000 ____D C:\Documents and Settings\jill\Local Settings\Application Data\WebShield
2015-07-08 18:31 - 2015-07-08 18:31 - 00000000 ____D C:\Documents and Settings\LocalService.AUTORITE NT\Local Settings\Application Data\WebBar
2015-07-08 18:17 - 2015-07-08 18:17 - 00000000 ____D C:\Documents and Settings\NetworkService.AUTORITE NT\Local Settings\Application Data\WebBar
2015-07-08 17:20 - 2015-07-08 18:36 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Mrevlupagnoh
2015-07-08 17:20 - 2015-07-08 18:36 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Mrevlupagnoh
2015-07-08 17:09 - 2015-07-08 17:15 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\uYDeQad
2015-07-08 17:09 - 2015-07-08 17:15 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\uYDeQad
2015-07-08 16:55 - 2015-07-08 16:58 - 00000000 ____D C:\Program Files\MaxDrivrUpdater
2015-07-08 16:55 - 2015-07-08 16:55 - 00000000 ____D C:\Program Files\MaxDrivrUpdater_v62.967
C:\Documents and Settings\jill\Application Data\nitionto
CustomCLSID: HKU\S-1-5-21-1547161642-362288127-1417001333-1003_Classes\CLSID\{3050f406-98b5-11cf-bb82-00aa00bdce0b}\InprocServer32 -> C:\Documents and Settings\jill\Application Data\nitionto\calmucle.dll No File
CustomCLSID: HKU\S-1-5-21-1547161642-362288127-1417001333-1003_Classes\CLSID\{33C53A50-F456-4884-B049-85FD643ECFED}\InprocServer32 -> C:\Documents and Settings\jill\Application Data\nitionto\calmucle.dll No File
C:\Documents and Settings\All Users.WINDOWS\Application Data\uYDeQad

vfPjYfccU => Unable to stop service.
vfPjYfccU => Service removed successfully.
C:\Documents and Settings\jill\Local Settings\Application Data\WebShield => moved successfully.
C:\Documents and Settings\LocalService.AUTORITE NT\Local Settings\Application Data\WebBar => moved successfully.
C:\Documents and Settings\NetworkService.AUTORITE NT\Local Settings\Application Data\WebBar => moved successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Mrevlupagnoh => moved successfully.
"C:\Documents and Settings\All Users.WINDOWS\Application Data\Mrevlupagnoh" => File/Folder not found.

"C:\Documents and Settings\All Users.WINDOWS\Application Data\uYDeQad" folder move:

Could not move "C:\Documents and Settings\All Users.WINDOWS\Application Data\uYDeQad" folder => Scheduled to move on reboot.

"C:\Documents and Settings\All Users.WINDOWS\Application Data\uYDeQad" folder move:

Could not move "C:\Documents and Settings\All Users.WINDOWS\Application Data\uYDeQad" folder => Scheduled to move on reboot.

C:\Program Files\MaxDrivrUpdater => moved successfully.
C:\Program Files\MaxDrivrUpdater_v62.967 => moved successfully.
"C:\Documents and Settings\jill\Application Data\nitionto" => File/Folder not found.
"HKU\S-1-5-21-1547161642-362288127-1417001333-1003_Classes\CLSID\{3050f406-98b5-11cf-bb82-00aa00bdce0b}" => key removed successfully.
"HKU\S-1-5-21-1547161642-362288127-1417001333-1003_Classes\CLSID\{33C53A50-F456-4884-B049-85FD643ECFED}" => key removed successfully.

"C:\Documents and Settings\All Users.WINDOWS\Application Data\uYDeQad" folder move:

Could not move "C:\Documents and Settings\All Users.WINDOWS\Application Data\uYDeQad" folder => Scheduled to move on reboot.

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2015-07-09 22:43:46)<=

C:\Documents and Settings\All Users.WINDOWS\Application Data\uYDeQad => moved successfully
C:\Documents and Settings\All Users.WINDOWS\Application Data\uYDeQad => is moved successfully
C:\Documents and Settings\All Users.WINDOWS\Application Data\uYDeQad => is moved successfully

End of Fixlog 22:43:47

Merci d'avance,

Voici la correction à effectuer avec FRST.
Tu peux t'inspirer de cette note explicative avec des captures d'écran pour t'aider: https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/#fix

Ouvre le bloc-notes : Touche Windows + R, dans le champs executer, tape notepad et OK.
Copie/colle dedans ce qui suit :

R2 vfPjYfccU; C:\Documents and Settings\All Users.WINDOWS\Application Data\uYDeQad\vfPjYfccU.exe [2732024 2015-07-08] (Irrational Number Applications)
2015-07-08 21:55 - 2015-07-08 21:55 - 00000000 ____D C:\Documents and Settings\jill\Local Settings\Application Data\WebShield
2015-07-08 18:31 - 2015-07-08 18:31 - 00000000 ____D C:\Documents and Settings\LocalService.AUTORITE NT\Local Settings\Application Data\WebBar
2015-07-08 18:17 - 2015-07-08 18:17 - 00000000 ____D C:\Documents and Settings\NetworkService.AUTORITE NT\Local Settings\Application Data\WebBar
2015-07-08 17:20 - 2015-07-08 18:36 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Mrevlupagnoh
2015-07-08 17:20 - 2015-07-08 18:36 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\Mrevlupagnoh
2015-07-08 17:09 - 2015-07-08 17:15 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\uYDeQad
2015-07-08 17:09 - 2015-07-08 17:15 - 00000000 ____D C:\Documents and Settings\All Users.WINDOWS\Application Data\uYDeQad
2015-07-08 16:55 - 2015-07-08 16:58 - 00000000 ____D C:\Program Files\MaxDrivrUpdater
2015-07-08 16:55 - 2015-07-08 16:55 - 00000000 ____D C:\Program Files\MaxDrivrUpdater_v62.967
C:\Documents and Settings\jill\Application Data\nitionto
CustomCLSID: HKU\S-1-5-21-1547161642-362288127-1417001333-1003_Classes\CLSID\{3050f406-98b5-11cf-bb82-00aa00bdce0b}\InprocServer32 -> C:\Documents and Settings\jill\Application Data\nitionto\calmucle.dll No File
CustomCLSID: HKU\S-1-5-21-1547161642-362288127-1417001333-1003_Classes\CLSID\{33C53A50-F456-4884-B049-85FD643ECFED}\InprocServer32 -> C:\Documents and Settings\jill\Application Data\nitionto\calmucle.dll No File
C:\Documents and Settings\All Users.WINDOWS\Application Data\uYDeQad

Une fois, le texte coller dans le bloc-note.
Menu Fichier puis Enregistrer sous.
A gauche, place toi sur le bureau.
Dans le champs en bas, nom du fichier mets : fixlist.txt
Clic sur Enregistrer - cela va créer un fichier fixlist.txt sur le bureau.

Relance FRST et clic sur le bouton Fix
Selon comment un redémarrage est nécessaire (pas obligatoire).
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

Redémarre l'ordinateur

puis réinitialise tes navigateurs:
==================================
Réinitialise tes navigateurs et ou manuellement reparamètre tes navigateurs WEB (page de démarrage, moteur de recherche etc) mais aussi supprimer/désactiver les extensions inutiles/parasites :

• Internet Explorer et modules complémentaires / moteurs de recherche : https://forum.malekal.com/viewtopic.php?t=41399&start=
• Firefox : https://www.malekal.com/reparer-firefox/?t=36057&start=
• Google Chrome : https://www.malekal.com/reparer-google-chrome/?t=35837&start=

Like the angel you are, you laugh creating a lightness in my chest,
Your eyes they penetrate me,
(Your answer's always 'maybe')
That's when I got up and left

Et voici les trois rapports générés par FRST :

https://pjjoint.malekal.com/files.php?id=FRST_20150708_b10m8y15r6k7
https://pjjoint.malekal.com/files.php?id=20150708_m9i10e9w6g5
https://pjjoint.malekal.com/files.php?id=20150708_s5x9h7o15x11

Merci d'avance...
Cela va déjà beaucoup mieux mais l'ordi est encore lent...

Voici le premier rapport : celui de adwcleaner.
Désolée pour les délais : le PC rame vraiment...

# AdwCleaner v4.207 - Logfile created 08/07/2015 at 21:33:37
# Updated 21/06/2015 by Xplode
# Database : 2015-07-05.2 [Server]
# Operating system : Microsoft Windows XP Service Pack 3 (x86)
# Username : jill - JILL-FF92945788
# Running from : C:\Documents and Settings\jill\Mes documents\Téléchargements\adwcleaner_4.207.exe
# Option : Cleaning

• • • • • [ Services ] *****

[#] Service Deleted : wbsvc

• • • • • [ Files / Folders ] *****

Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Application Data\InstallSightSDK
Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Application Data\WebShield
Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\GAMESDESKTOP
Folder Deleted : C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\MixVideoPlayer
Folder Deleted : C:\Program Files\WebBar
Folder Deleted : C:\Program Files\gmsd_fr_004010025
Folder Deleted : C:\Program Files\MixVideoPlayer
Folder Deleted : C:\DOCUME~1\jill\LOCALS~1\Temp\Primary Color
Folder Deleted : C:\Documents and Settings\jill\Local Settings\Application Data\WebBar
Folder Deleted : C:\Documents and Settings\jill\Local Settings\Application Data\BrowserWeb
Folder Deleted : C:\Documents and Settings\jill\Local Settings\Application Data\WebShield
Folder Deleted : C:\Documents and Settings\jill\Local Settings\Application Data\gmsd_fr_004010025
Folder Deleted : C:\Documents and Settings\jill\Application Data\pdfforge
Folder Deleted : C:\Documents and Settings\jill\Application Data\nitionto
Folder Deleted : C:\Documents and Settings\Bureau\Application Data\Mozilla\Firefox\Profiles\dr7fwu7w.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
File Deleted : C:\END
File Deleted : C:\Documents and Settings\Bureau\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
File Deleted : C:\Documents and Settings\Bureau\Application Data\GDIPFONTCACHEV1.DAT
File Deleted : C:\Documents and Settings\jill\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

• • • • • [ Scheduled tasks ] *****

Task Deleted : WebBarLaunchTask
Task Deleted : WebBarUpdateTask

• • • • • [ Shortcuts ] *****
        • [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\Applications\MixVideoPlayer.exe
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [gmsd_fr_004010025]
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [upgmsd_fr_004010025.exe]
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{051E9166-B275-4683-907B-372FAE22BC7C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E5A7A645-8318-4895-B85C-EDC606B80DB6}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9C4EFBD5-1ADF-41E6-BE26-AF44326E30E4}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Key Deleted : HKCU\Software\DynConIE
Key Deleted : HKCU\Software\Tutorials
Key Deleted : HKCU\Software\TutoTag
Key Deleted : HKCU\Software\canortic
Key Deleted : HKLM\SOFTWARE\istartsurfSoftware
Key Deleted : HKLM\SOFTWARE\Tutorials
Key Deleted : HKLM\SOFTWARE\GAMESDESKTOP
Key Deleted : HKLM\SOFTWARE\WebBar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0BCE8B0A-1E76-44E5-9909-3CF804D92E4D}_is1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebShield
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{46d699b3-6a25-4071-6078-4e96aeed2e07}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7ADF667E-E14D-4D2C-827C-B0108F0D93BC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gmsd_fr_004010025_is1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{0BCE8B0A-1E76-44E5-9909-3CF804D92E4D}_is1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\WebShield
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\gmsd_fr_004010025_is1

• • • • • [ Web browsers ] *****

-\\ Internet Explorer v8.0.6001.18702

Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [SearchAssistant]
Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [CustomizeSearch]

-\\ Mozilla Firefox v39.0 (x86 fr)

[dr7fwu7w.default\prefs.js] - Line Deleted : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\"I[...]
[dr7fwu7w.default\prefs.js] - Line Deleted : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");
[fgmkzx27.default\prefs.js] - Line Deleted : user_pref("browser.startup.homepage", "hxxp://www.istartsurf.com/?type=hp&ts=1436367555&z=7de067398302eb399984071gfz5cbq0c7qem2w7zcb&from=tugs&uid=MaxtorX6L080L0_L21Q9S8H");

AdwCleaner[R0].txt - [6863 bytes] - [08/07/2015 21:27:13]
AdwCleaner[S0].txt - [5793 bytes] - [08/07/2015 21:33:37]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5852 bytes] ##########

Salut,

Tu as installé des adwares et programmes parasites sur ton PC qui ouvrent des publicités et ralentissent l'ordinateur et les navigateurs WEB.
Voici la procédure à suivre pour les supprimer :

Commence par ceci :

Suis le tutorial AdwCleaner https://www.malekal.com/adwcleaner-supprimer-virus-adwares-pup/?t=33839&start= ( d'Xplode )
Télécharge le sur ton bureau ou dossier de téléchargement.
Lance AdwCleaner, clique sur [Scanner].
L'analyse peux durer plusieurs minutes, patiente.
Une fois le scan terminé, ne décoche rien, clique sur [Nettoyer]

Une fois le nettoyage terminé, un rapport s'ouvrira. Copie/colle le contenu du rapport dans ta prochaine réponse par un copier/coller.
Si cela ne fonctionne pas, utilise le site http://pjjoint.malekal.com pour héberger le rapport, donne le lien du rapport dans un nouveau message.

Note : Le rapport est également sauvegardé sous C:\AdwCleaner[S1].txt

puis :

Suis ce tutoriel FRST: https://www.malekal.com/tutoriel-farbar-recovery-scan-tool-frst/
(et bien prendre le temps de lire afin d'appliquer correctement - tout y est expliqué).
Télécharge et lance le scan FRST, cela va générer trois rapports FRST :

• FRST.txt
• Shortcut.txt
• Additionnal.txt

Envoie, comme expliqué, ces trois rapports sur le site http://pjjoint.malekal.com et en retour donne les trois liens pjjoint qui mènent à ses rapports ici dans une nouvelle réponse afin que l'on puisse les consulter.