Infecté par EdealsPop

[Fga33]

Bonjour,

Infecté par EdealPop, j'ai passé les outils suivants :
- adwcleaner_4.102
- malwarebytes-anti-malware_2-0-2-1012_fr_215092
- Scan Avast
- Nettoyage ccleaner

A priori le malware a disparu mais dans le doute voici un log OTL pour analyse :

http://pjjoint.malekal.com/files.php?id ... e128t10s12

Merci par avance pour vos retours

[Malekal_morte]

Salut,

Relance OTL.
o sous Personnalisation (Custom Scan), copie_colle le contenu du cadre ci dessous (bien prendre :OTL en début).
Clic Correction (Fix), un rapport apparraitra, copie/colle le contenu ici:

:OTL
[2014/11/25 12:02:51 | 000,000,000 | ---D | C] -- C:\Users\michel\AppData\Roaming\4glIsii
[2014/11/27 11:02:56 | 000,001,688 | ---- | M] () -- C:\Windows\tasks\IIMVGSU.job
[2014/11/27 11:02:56 | 000,001,340 | ---- | M] () -- C:\Windows\tasks\SILPL.job
[2014/11/27 11:02:56 | 000,001,340 | ---- | M] () -- C:\Windows\tasks\CPEPH.job
[2014/11/27 11:02:56 | 000,001,338 | ---- | M] () -- C:\Windows\tasks\LPNU.job
[2014/11/27 11:02:56 | 000,001,336 | ---- | M] () -- C:\Windows\tasks\TLY.job
[2014/11/06 15:22:56 | 000,001,656 | ---- | C] () -- C:\Windows\SysWow64\${LOGFILE}
[2014/09/01 09:18:44 | 000,002,086 | ---- | C] () -- C:\Users\michel\AppData\Roaming\TLY
[2014/09/01 09:18:44 | 000,002,086 | ---- | C] () -- C:\Users\michel\AppData\Roaming\SILPL
[2014/09/01 09:18:44 | 000,002,086 | ---- | C] () -- C:\Users\michel\AppData\Roaming\PLX
[2014/09/01 09:18:44 | 000,001,248 | ---- | C] () -- C:\Users\michel\AppData\Roaming\LPNU
[2014/09/01 09:18:44 | 000,001,248 | ---- | C] () -- C:\Users\michel\AppData\Roaming\IIMVGSU
[2014/09/01 09:18:44 | 000,001,248 | ---- | C] () -- C:\Users\michel\AppData\Roaming\CPEPH
[2013/11/14 14:01:42 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\11086
[2014/05/02 16:26:17 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\11889
[2014/08/18 22:13:51 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\11986
[2014/06/17 09:44:45 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\1340
[2014/07/16 17:36:49 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\18534
[2013/10/26 10:58:04 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\21051
[2014/01/30 15:25:58 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\27658
[2014/07/27 13:46:55 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\29671
[2013/10/08 08:58:07 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\30728
[2014/06/24 17:04:46 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\30961
[2014/09/25 15:02:41 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\32223
[2014/11/25 12:02:54 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\4glIsii
[2014/11/06 15:28:06 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\4ymHbu7
[2013/12/12 16:02:55 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\5070
[2014/09/02 15:39:09 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\5305
[2014/03/20 13:55:03 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\6905
[2014/04/24 15:51:47 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\8952
[2014/10/16 16:21:56 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\9042
[2014/11/06 19:05:12 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\AdvancedSystemProtector
[2010/06/14 14:46:31 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\CoSoSys
[2014/11/25 12:02:55 | 000,000,000 | ---D | M] -- C:\Users\michel\AppData\Roaming\DJQ1g4S
[2014/10/03 08:32:52 | 000,000,000 | ---D | M] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2014/11/07 15:12:09 | 000,000,000 | ---D | M] -- C:\ProgramData\86998342-aefb-4bdb-96ce-74be1e808b51

* poste le rapport ici

~~

Tu as Adware.Pirrit

Déjà note la procédure pour supprimer les proxys sur Internet Explorer : http://forum.malekal.com/supprimer-prox ... 47404.html

Affiche les fichiers cachés et systèmes : http://www.commentcamarche.net/faq/825- ... us-windows

Ensuite télécharge et installe Unlocker.
Lis bien ce qui est écrit sur la page suivante car des programmes parasites te seront proposés, suis les explications ne pas les installer.

http://forum.malekal.com/unlocker-t49478.html

Navigue dans tes dossiers et supprime ces dossiers avec unlocker, ne redémarre pas l'ordinateur, demande à tout supprimer d'un coup :
C:\Windows\SysWow64\CompilerFirmwareUtility
C:\Users\michel\AppData\Local\IconMetafileRuntime

Une fois que c'est fait.

Redémarre l'ordinateur s'il te dit qu'il faut redémarrer pour que la suppression se fasse.

Au redémarrage, si le proxy est active, désactive le.

Refais un scan FRST et donne le rapport.

[Fga33]

Voici le rapport de désinfection :

========== OTL ==========
C:\Users\michel\AppData\Roaming\4glIsii folder moved successfully.
C:\Windows\Tasks\IIMVGSU.job moved successfully.
C:\Windows\Tasks\SILPL.job moved successfully.
C:\Windows\Tasks\CPEPH.job moved successfully.
C:\Windows\Tasks\LPNU.job moved successfully.
C:\Windows\Tasks\TLY.job moved successfully.
C:\Windows\SysWOW64\${LOGFILE} moved successfully.
C:\Users\michel\AppData\Roaming\TLY moved successfully.
C:\Users\michel\AppData\Roaming\SILPL moved successfully.
C:\Users\michel\AppData\Roaming\PLX moved successfully.
C:\Users\michel\AppData\Roaming\LPNU moved successfully.
C:\Users\michel\AppData\Roaming\IIMVGSU moved successfully.
C:\Users\michel\AppData\Roaming\CPEPH moved successfully.
C:\Users\michel\AppData\Roaming\11086 folder moved successfully.
C:\Users\michel\AppData\Roaming\11889 folder moved successfully.
C:\Users\michel\AppData\Roaming\11986 folder moved successfully.
C:\Users\michel\AppData\Roaming\1340 folder moved successfully.
C:\Users\michel\AppData\Roaming\18534 folder moved successfully.
C:\Users\michel\AppData\Roaming\21051 folder moved successfully.
C:\Users\michel\AppData\Roaming\27658 folder moved successfully.
C:\Users\michel\AppData\Roaming\29671 folder moved successfully.
C:\Users\michel\AppData\Roaming\30728 folder moved successfully.
C:\Users\michel\AppData\Roaming\30961 folder moved successfully.
C:\Users\michel\AppData\Roaming\32223 folder moved successfully.
Folder C:\Users\michel\AppData\Roaming\4glIsii\ not found.
C:\Users\michel\AppData\Roaming\4ymHbu7 folder moved successfully.
C:\Users\michel\AppData\Roaming\5070 folder moved successfully.
C:\Users\michel\AppData\Roaming\5305 folder moved successfully.
C:\Users\michel\AppData\Roaming\6905 folder moved successfully.
C:\Users\michel\AppData\Roaming\8952 folder moved successfully.
C:\Users\michel\AppData\Roaming\9042 folder moved successfully.
C:\Users\michel\AppData\Roaming\AdvancedSystemProtector\ASP\2.1.1000.14211 folder moved successfully.
C:\Users\michel\AppData\Roaming\AdvancedSystemProtector\ASP folder moved successfully.
C:\Users\michel\AppData\Roaming\AdvancedSystemProtector folder moved successfully.
C:\Users\michel\AppData\Roaming\CoSoSys\CarryItEasy folder moved successfully.
C:\Users\michel\AppData\Roaming\CoSoSys folder moved successfully.
C:\Users\michel\AppData\Roaming\DJQ1g4S folder moved successfully.
C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\x64 folder moved successfully.
C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69\x64 folder moved successfully.
C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 folder moved successfully.
C:\ProgramData\86998342-aefb-4bdb-96ce-74be1e808b51 folder moved successfully.

OTL by OldTimer - Version 3.2.69.0 log created on 11272014_140852


Le proxy est désactivé

Les répertoires supprimés

Voici le log analyse OTL, suite au nettoyage :

http://pjjoint.malekal.com/files.php?id ... r13e8c15b9


Merci pour votre aide, le problème semble résolu.

Cordialement

[Malekal_morte]

yep rapport niquel


Quelques conseils :

Installe Malwarebyte's Anti-Malware : https://www.malekal.com/malwarebyte-ant ... les-virus/
Fais des scans réguliers avec, il est efficace.



Pour prévenir les sites malicieux, tu peux installer Blockulicious : http://forum.malekal.com/blockulicious- ... 46656.html


Pour ne plus te faire avoir.
A lire - Programmes parasites / PUPs : https://www.malekal.com/adwares-pup-protection/

[Fga33]

Merci beaucoup pour votre aide.

Cordialement