Salut,
Ouaip plein de trojan car tu télécharges un peu tout et n'importe quoi.
Beaucoup d'adwares installés en effet :
Date: 2025-04-13 11:27:41
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
Name: Trojan:Win32/OffLoader.AIQA!MTB
Severity: Severe
Category: Trojan
Path: file:_C:\$Recycle.Bin\S-1-5-21-3014066026-204843163-3296722137-1001\$RAIMCRN.exe
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Process Name: C:\Windows\explorer.exe
Security intelligence Version: AV: 1.427.220.0, AS: 1.427.220.0, NIS: 1.427.220.0
Engine Version: AM: 1.1.25030.1, NIS: 1.1.25030.1\00
Date: 2025-04-11 20:23:25
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
Name: Adware:Win32/AdUpdater
Severity: High
Category: Adware
Path: file:_C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe; file:_C:\WINDOWS\System32\Tasks\AdvancedUpdater->(UTF-16LE); regkey:_HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C71AD4F5-7643-41DF-B42B-CD8414813FB0}; regkey:_HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdvancedUpdater; taskscheduler:_C:\WINDOWS\System32\Tasks\AdvancedUpdater
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Process Name: C:\Program Files\Avast Software\Cleanup\TuneupSvc.exe
Security intelligence Version: AV: 1.427.172.0, AS: 1.427.172.0, NIS: 1.427.172.0
Engine Version: AM: 1.1.25030.1, NIS: 1.1.25030.1\00
Date: 2025-04-11 20:22:59
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
Name: Adware:Win32/AdUpdater
Severity: High
Category: Adware
Path: file:_C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Real-Time Protection
Process Name: C:\Program Files\Avast Software\Cleanup\TuneupSvc.exe
Security intelligence Version: AV: 1.427.172.0, AS: 1.427.172.0, NIS: 1.427.172.0
Engine Version: AM: 1.1.25030.1, NIS: 1.1.25030.1\00
Date: 2025-04-11 20:22:54
Description:
Microsoft Defender Antivirus has detected malware or other potentially unwanted software.
Name: PUA:Win32/Packunwan
Severity: Low
Category: Potentially Unwanted Software
Path: file:_C:\Windows\Installer\bfa63fc.msi
Detection Origin: Local machine
Detection Type: FastPath
Detection Source: Real-Time Protection
Process Name: C:\Program Files\Avast Software\Cleanup\TuneupSvc.exe
Security intelligence Version: AV: 1.427.172.0, AS: 1.427.172.0, NIS: 1.427.172.0
Engine Version: AM: 1.1.25030.1, NIS: 1.1.25030.1\00
Voici la correction à effectuer avec FRST. Tu peux t'aider de cette Voici la correction à effectuer avec FRST. Tu peux t'aider de cette
#fix note explicative avec des captures d'écran.
Relance FRST puis sur ton clavier appuyer sur la touche
CTRL + Y.
Le bloc-note va s'ouvrir, copie/colle ceci.
Code : Tout sélectionner
Start:
CloseProcesses:
CreateRestorePoint:
C:\Program Files (x86)\AW Manager
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center: Restriction <==== ATTENTION
Startup: C:\Users\mariu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcDriver.lnk [2025-03-14]
ShortcutTarget: EcDriver.lnk -> C:\Users\mariu\AppData\Roaming\Comauth\EcDriver.exe () [Fichier non signé] [Fichier en cours d'utilisation]
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ProW File Compressor.lnk [2024-11-14] <==== ATTENTION
ShortcutTarget: ProW File Compressor.lnk -> C:\Program Files (x86)\pwac\ProW\ProW File Compressor.exe (CyberKick Ltd -> ProW) <==== ATTENTION
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WavesLocalServer.lnk [2024-12-11]
2025-04-13 16:49 - 2025-04-13 16:49 - 000000008 _____ C:\Users\mariu\AppData\Roaming\8ee6df9696d67d1fcfe63c7c4b4506e7
2025-04-11 20:16 - 2025-04-11 20:16 - 000000000 ____D C:\Users\mariu\AppData\Roaming\GM1upM0XxU
2025-04-11 20:17 - 2025-04-11 20:17 - 000000000 ____D C:\Program Files (x86)\AW Manager
2025-04-11 20:16 - 2025-04-11 20:16 - 000000000 ____D C:\Users\mariu\AppData\Roaming\GM1upM0XxU
2025-04-07 13:08 - 2025-04-07 13:08 - 000000000 __HDC C:\ProgramData\{A42245E7-E6E7-4170-BFA9-F79FC7ACAF72}
2025-04-07 13:08 - 2025-04-07 13:08 - 000000000 __HDC C:\ProgramData\{A42245E7-E6E7-4170-BFA9-F79FC7ACAF72}
2025-03-18 22:03 - 2025-03-18 22:03 - 000000000 __HDC C:\ProgramData\{434E746B-11DC-4CE5-A7F5-7DAA5A44A6AD}
2025-03-09 17:03 - 2025-03-13 20:52 - 000055017 _____ C:\Users\mariu\AppData\LocalLow\7d122aa2d4d10d4fa566fb2531109bea3090fd059ba869491474a08ff8b7ee84
2025-03-09 17:03 - 2025-03-13 20:52 - 000000130 _____ C:\Users\mariu\AppData\LocalLow\5d88161f05168f14e98153c2ddb9ee26d2cd2b8226afb6293c3593c4cc008128
2025-02-27 17:16 - 2025-02-27 17:16 - 000000000 ___HD C:\ProgramData\CDPResource
2025-02-27 17:16 - 2025-02-27 17:16 - 000000000 ____D C:\WINDOWS\system32\Tasks\u70nsy
2025-02-27 17:16 - 2025-02-27 17:16 - 000000000 ____D C:\WINDOWS\system32\Tasks\thwh90
2025-02-27 17:16 - 2025-02-27 17:16 - 000000000 ____D C:\WINDOWS\system32\Tasks\okl687
2025-02-27 17:16 - 2025-02-27 17:16 - 000000000 ____D C:\WINDOWS\system32\Tasks\o3dpi9
2025-02-27 17:16 - 2025-02-27 17:16 - 000000000 ____D C:\WINDOWS\system32\Tasks\k4jmt5
2025-02-27 17:16 - 2025-02-27 17:16 - 000000000 ____D C:\WINDOWS\system32\Tasks\3t94cw
2025-02-27 17:16 - 2025-02-27 17:16 - 000000000 ____D C:\WINDOWS\system32\Tasks\1nmpgs
2025-02-27 17:16 - 2025-02-27 17:16 - 000000000 ____D C:\WINDOWS\system32\Tasks\07010k
2025-02-27 17:16 - 2025-02-27 17:16 - 000000000 ____D C:\WINDOWS\runtimes
2025-02-27 17:16 - 2025-02-27 17:16 - 000000000 ____D C:\Program Files (x86)\unset
2025-02-27 17:15 - 2025-03-06 18:27 - 000000000 ____D C:\Program Files (x86)\gourde
2025-02-27 17:15 - 2025-03-06 13:46 - 000000000 ___HD C:\Program Files (x86)\Jennings
2025-02-27 17:15 - 2025-02-27 17:15 - 000000000 ____D C:\WINDOWS\system32\Tasks\vm5dfi
2025-02-27 17:15 - 2025-02-27 17:15 - 000000000 ____D C:\WINDOWS\system32\Tasks\ci11h6
2025-02-27 17:15 - 2025-02-27 17:15 - 000000000 ____D C:\WINDOWS\system32\Tasks\beocwz
2025-02-27 17:15 - 2025-02-27 17:15 - 000000000 ____D C:\WINDOWS\system32\Tasks\6ot2hn
2025-02-27 17:15 - 2025-02-27 17:15 - 000000000 ____D C:\WINDOWS\system32\Tasks\3b2xrp
2025-02-27 17:15 - 2025-02-27 17:15 - 000000000 ____D C:\Users\mariu\AppData\Local\runtimes
2025-02-27 16:58 - 2025-02-27 16:58 - 000000000 __HDC C:\ProgramData\{B9B919DC-6E9D-4518-9160-0E76314F7605}
2025-02-27 16:58 - 2025-02-27 16:58 - 000000000 __HDC C:\ProgramData\{60783180-91A8-42F8-A719-001451290459}
2025-02-27 16:53 - 2025-02-27 16:53 - 000016896 _____ () C:\WINDOWS\balladeer.exe
2025-02-27 16:53 - 2025-02-27 16:53 - 000016896 _____ () C:\Users\mariu\AppData\Local\Waterwheel.exe
2025-02-27 13:36 - 2025-02-27 13:36 - 000000000 __HDC C:\ProgramData\{EE3D8839-9A45-41F0-99CD-79E63804C5E5}
2025-02-24 16:45 - 2025-02-24 16:45 - 000000000 __HDC C:\ProgramData\{128D3F36-97CD-4C41-B515-F138FECC62B3}
2025-01-14 00:53 - 2025-01-14 00:53 - 000000604 ____H () C:\Program Files (x86)\APi1
2025-04-13 16:49 - 2025-04-13 16:49 - 000000008 _____ () C:\Users\mariu\AppData\Roaming\8ee6df9696d67d1fcfe63c7c4b4506e7
2024-11-12 13:39 - 2024-11-12 13:40 - 005997851 _____ () C:\Users\mariu\AppData\Roaming\8ZN5V2.tmp
2025-01-14 00:52 - 2025-01-14 00:56 - 000520894 _____ () C:\Users\mariu\AppData\Roaming\AvidLink_Install.log
2024-11-12 13:43 - 2024-11-12 13:43 - 005997851 _____ () C:\Users\mariu\AppData\Roaming\JZNHYJ.dif
2024-11-27 23:06 - 2025-03-05 20:34 - 000000016 _____ () C:\Users\mariu\AppData\Roaming\msregsvv.dll
2024-11-12 13:41 - 2024-11-12 13:41 - 005997851 _____ () C:\Users\mariu\AppData\Roaming\VRIMBM.vob
2024-02-09 21:57 - 2024-02-09 21:57 - 000000182 _____ () C:\Users\mariu\AppData\Local\App.exe.config
2023-12-26 16:18 - 2023-12-26 16:18 - 000004096 _____ (Class) C:\Users\mariu\AppData\Local\Class.dll
2024-02-09 21:57 - 2024-02-09 21:57 - 000000182 _____ () C:\Users\mariu\AppData\Local\Kagawa.exe.config
2021-11-20 18:07 - 2021-11-20 18:07 - 000274848 _____ (Microsoft) C:\Users\mariu\AppData\Local\Microsoft.Web.WebView2.Core.dll
2021-11-20 18:07 - 2021-11-20 18:07 - 000033704 _____ (Microsoft) C:\Users\mariu\AppData\Local\Microsoft.Web.WebView2.WinForms.dll
2021-11-20 18:07 - 2021-11-20 18:07 - 000039864 _____ (Microsoft) C:\Users\mariu\AppData\Local\Microsoft.Web.WebView2.Wpf.dll
2025-02-27 16:53 - 2025-02-27 16:53 - 000016896 _____ () C:\Users\mariu\AppData\Local\Waterwheel.exe
2024-02-09 21:57 - 2024-02-09 21:57 - 000000182 _____ () C:\Users\mariu\AppData\Local\Waterwheel.exe.config
2024-12-11 23:06 - 2024-12-27 01:25 - 000176674 _____ () C:\Users\mariu\AppData\Local\wle.log
ShortcutTarget: WavesLocalServer.lnk -> C:\ProgramData\Waves Audio\WavesLocalServer\WavesLocalServer.bundle\Contents\Win64\WavesLocalServer.exe (Waves Inc -> Waves Audio Ltd.)
Task: {0BA3CB04-25F2-49B6-86DD-DC072A5C89E8} - System32\Tasks\07010k\ax79pi\96rfn4\tbozjx\29nkkr\xyfo93\w2z1pt\sz81yb\9adet1\j7gdrd\b5dq99\2l6xgi\Microsoft.Transactions.Bard.ni => C:\Windows\SysWOW64\rundll32.exe [52736 2025-01-30] (Microsoft Windows -> Microsoft Corporation) -> C:\Program Files (x86)\Common Files\ConnectionFont\ExtenkionlActuvation\"C:\Program Files (x86)\Common Files\ConnectionFont\ExtenkionlActuvation\JyncmentS331.dll",wpdildXTs081a <==== ATTENTION
Task: {812E994D-E1A9-46D8-AF0F-82F269CB6170} - System32\Tasks\1nmpgs\vah520\7yg3i3\jbzzyt\gqb79u\ux9spk\4i5r5r\shj5c0\q553u2\cqn3yq\hd76m3\qmqoul\ejghkd\c9nakh\so82no\psgz7u\y0fnfi => %localappdata%\Kagawa.exe "1b8h1b8t1b8t1b8p1b8:1b8/1b8/1b8w1b8w1b8w1b8.1b8t1b8o1b8m1b8o1b8o1b8n1b8g1b8l1b8a1b8r1b8e1b8.1b8c1b8o1b8m1b8/1b8m2b0b2b5b01b8t2t2m7mbht1b8m10KibagTU1b8l595sbZ4Wz1b8Q" (Pas de fichier) <==== ATTENTION
Task: {CADC9F78-AFAB-465A-BA6E-352738CC4318} - System32\Tasks\3b2xrp\yiog1c\4shf81\tj1445\gg7va4\ckuw6z\hz3wm9\xxne8f\n7z77v\lg0tnd\toepyj\rhy8yj\pnpv8v\wtgox5\3m8o0v\tf247q\jxe856 => %localappdata%\Kagawa.exe "1b8h1b8t1b8t1b8p1b8:1b8/1b8/1b8w1b8w1b8w1b8.1b8t1b8o1b8m1b8o1b8o1b8n1b8g1b8l1b8a1b8r1b8e1b8.1b8c1b8o1b8m1b8/1b8m2b0b2b5b01b8t2t2m7mbht1b8m10KibagTU1b8l595sbZ4Wz1b8Q" (Pas de fichier) <==== ATTENTION
Task: {D0B5EC1E-0126-407E-A4E3-C7412B978954} - System32\Tasks\3t94cw\o3dhre\yo3ghc\at5zqt\7jtazg\viq7wj\9j0ppm\vk5vdc\6ity8a\wzt87g\874057\s9va2s\ocn5d9\dcayyd\m4mjga\j141t8\v7nl2t => %PROGRAMFILES(x86)%\Jennings\Kagawa.exe "1b8h1b8t1b8t1b8p1b8:1b8/1b8/1b8w1b8w1b8w1b8.1b8t1b8o1b8m1b8o1b8o1b8n1b8g1b8l1b8a1b8r1b8e1b8.1b8c1b8o1b8m1b8/1b8m2b0b2b5b01b8t2t2m7mbht1b8m10KibagTU1b8l595sbZ4Wz1b8Q" (Pas de fichier) <==== ATTENTION
Task: {3F8A6A02-C58D-4E3B-B000-6C2B897E3AD5} - System32\Tasks\6ot2hn\frcgaq\fe5vxb\l612or\qw9itd\hjp086\arl19m\f0zoor\cyoyo4\2bbz5x\30h47j\pd159x\sr8y47\w1ovq4\5fyt7i\bktuuw\yimzax => %localappdata%\destroying.exe (Pas de fichier) <==== ATTENTION
Task: {2C209E2A-D658-484B-8C0B-A1036CEB4DB0} - System32\Tasks\Adblock360StartUpdated => C:\WINDOWS\system32\conhost.exe [1032192 2025-03-06] (Microsoft Windows -> Microsoft Corporation) -> --headless "%LOCALAPPDATA%\Adblock360\updates\start-updated.cmd" <==== ATTENTION
Task: {7820D8BB-CB85-4FBD-9A9F-2CE7BA50810C} - System32\Tasks\Adblock360UpdatesDownloader => C:\WINDOWS\system32\conhost.exe [1032192 2025-03-06] (Microsoft Windows -> Microsoft Corporation) -> --headless "C:\Users\mariu\AppData\Local\Adblock360\updates\download-and-update.cmd" <==== ATTENTION
Task: {6EB38F15-7B50-4A53-929B-D411906C306B} - System32\Tasks\ci11h6\zxypa0\wx3q5d\ppmp3l\0yakio\5dbc4c\pzxp58\jjjoi7\zs9jzb\wys0h4\hwqlqx\sfxqtr\dd3ijg\y211g3\io605d\o6r575\datdo4 => %PROGRAMFILES(x86)%\Ais\delineating.exe (Pas de fichier) <==== ATTENTION
Task: {A4FF69A3-1A72-4750-9D9D-1168D6DCE4EA} - System32\Tasks\GDA Helper => C:\Users\mariu\AppData\Roaming\Comauth\EcDriver.exe [846325235 2024-12-28] () [Fichier non signé] [Fichier en cours d'utilisation] <==== ATTENTION
Task: {2BC4BE33-5F6B-432A-A6D2-C47A76D69A86} - System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem136.0.7079.0{C476709A-F60B-4C3A-889A-0A4ED94E62B1} => C:\Program Files (x86)\Google\GoogleUpdater\136.0.7079.0\updater.exe [7017568 2025-03-20] (Google LLC -> Google LLC)
Task: {873E27AB-2A21-4590-97F5-67D14A5348B5} - System32\Tasks\k4jmt5\lbp8ne\09ceoo\qhs782\jd2q59\wq41ed\tbbekd\grznah\251mok\ab1mtn\qenzgu\6wde3c\nhb8wy\q1nda5\qyebkh\p2x67y\138g5w => %PROGRAMFILES(x86)%\Ais\Kagawa.exe "1b8h1b8t1b8t1b8p1b8:1b8/1b8/1b8w1b8w1b8w1b8.1b8t1b8o1b8m1b8o1b8o1b8n1b8g1b8l1b8a1b8r1b8e1b8.1b8c1b8o1b8m1b8/1b8m2b0b2b5b01b8t2t2m7mbht1b8m10KibagTU1b8l595sbZ4Wz1b8Q" (Pas de fichier) <==== ATTENTION
Task: {AB7E0A18-59C2-409C-9ED0-69E80FB731C5} - System32\Tasks\thwh90\oyp7vz\mki26y\j4f56t\x0rkn1\wb95dd\f30lsq\4cmla9\f6eg1j\h7aejy\dlovnz\oqzo24\qijf5n\mpaxno\7il65g\cqkmy9\tkh36e => %PROGRAMFILES(x86)%\Ais\quem.exe (Pas de fichier) <==== ATTENTION
Task: {752245A8-2F89-49FD-B4C4-9523D58B0A77} - System32\Tasks\u70nsy\gf705s\pkif0c\ug3qb1\draqlv\93plej\2pnmbe\ycey9w\9z57rt\t1hu5n\m0svji\82zs0p\x8mm1g\sb8hg5\j5qyh9\8fefuj\thj3kc => C:\Program Files (x86)\unset\cooperating.exe [0 2025-02-27] () [Accès refusé] "hz7tz7tz7pz7:z7/z7/z7wz7wz7wz7.z7tz7oz7mz7oz7oz7nz7gz7lz7az7rz7ez7.z7cz7oz7mz7/z7gz7?z7iz7dz7=z71z70z7Kz7iz7bz7az7gz7Tz7Uz7lz75z79z75z7sz7bz7Zz74z7Wz7zz7Qz7" (Accès refusé) <==== ATTENTION <==== ATTENTION
Task: {E6EDE216-7D82-4D87-B14C-7D5F83192C4E} - System32\Tasks\vm5dfi\xxe6p6\2t4nta\oqs3gz\jraqoq\ley8ci\4l6ir5\22d9n8\txqaff\fbt9z1\94sccz\hi7pji\adhul6\e69n6t\0xdfos\jrem0a\m5afl0 => C:\Users\mariu\AppData\Local\Waterwheel.exe [16896 2025-02-27] () [Fichier non signé] <==== ATTENTION
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
reg: reg delete HKLM\SOFTWARE\Policies /f
reg: reg delete HKCU\SOFTWARE\Policies /f
reg: reg add "HKLM\Software\Microsoft\Windows Script Host\Settings" /v Enabled /d 0 /f
reg: reg add "HKCU\Software\Microsoft\Windows Script Host\Settings" /v Enabled /d 0 /f
Hosts:
EmptyTemp:
RemoveProxy:
Reboot:
End:
Ferme le bloc-note, retourne sur FRST et clique sur le bouton "Corriger / Fix"
Un redémarrage sera peut-être nécessaire et automatique.
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.
Redémarre l'ordinateur.
(L'ordinateur peut redémarrer tout seul, si le rapport de correction ne s'ouvre pas, cherche un fichier fixlog.txt qui se trouve dans le même dossier que FRST)
Important :
Le contenu de la correction ne doit pas être vide et doit refléter le script donné précédemment.
Dans le cas où la correction est vide, essaye de faire la correction FRST comme ceci :
Place le programme FRST sur le bureau
Ouvre le bloc-note.
Colle le script donné plus haut.
Enregistre le fichier sur le sur le bureau de Windows (pas ailleurs) sous le nom de fixlist.txt.
Relance FRST puis Corriger.
2) réinitialiser les navigateurs:
==================================
Réinitialise tes navigateurs et/ou re-paramètre manuellement tes navigateurs WEB (
page de démarrage, moteur de recherche, etc ) mais aussi supprimer/désactiver les extensions inutiles/parasites.
Pour t'aider à effectuer ce ménage, clique ci-dessous sur le nom du navigateur WEB que tu utilises :
3) Désinstalle tous ces programmes inutiles qui ralentissent le PC :
Adblock360
Avast Cleanup Premium (sert à rien et fout le bazar dans le système)
GridinSoft Anti-Malware
Opera
Outbyte LhSvc Service
4) Refais un scan FRST et donne les nouveaux rapports via pjjoint
