cryptowall 3.0

[fabu]

bonjour a tous je suis infecte par crypto 3.0 et pas tres fortiche en informatique
y a t il une ame charitable pour maider?
merci d avance

[Malekal_morte]

Salut,

Tu as été infecté par un Ransomware chiffreurs de fichiers.

Ces derniers vont essentiellement par des pièces jointes malicieux dans des emails ou des Exploits WEB.

Il n'y a pas vraiment de solution pour récupérer les documents.

Il faudra vérifier qu'aucun malware ne soit actif puis changer tous tes mots de passe.

~~


Suis ce tutoriel FRST: https://www.malekal.com/tutorial-farbar ... tool-frst/
(et bien prendre le temps de lire afin d'appliquer correctement - tout y est expliqué).
Télécharge et lance le scan FRST, cela va générer trois rapports FRST :
* FRST.txt
* Shortcut.txt
* Additionnal.txt

Envoie, comme expliqué, ces trois rapports sur le site http://pjjoint.malekal.com et en retour donne les trois liens pjjoint qui mènent à  ses rapports ici dans une nouvelle réponse afin que l'on puisse les consulter.

[fabu]

merci je commence mais ca a l air tres complexe et je suis vraiment nul
j espere que je vais y arriver

[fabu]

http://pjjoint.malekal.com/files.php?id ... 5q10g12z11

http://pjjoint.malekal.com/files.php?id ... s14z15c7d6

http://pjjoint.malekal.com/files.php?id ... k11u6o12h5

[fabu]

dans mon dernier message les rapports que dois je faire ensuite svp?

[Malekal_morte]

Pas mal de trucs,

Désinstalle BingBar
vshare toolbar
AOL Toolbar
Orange Toolbar
Askbar
bref tout ce qui porte le nom toolbar ou barre d'outils.

~~

Si tu veux envoyer les fichiers suivants sur http://upload.malekal.com :
C:\ProgramData\ActiveU0\dwvaztybt.exe
C:\Windows\system32\KBDDA7.dll

~~

puis :

Voici la correction à effectuer avec FRST.
Tu peux t'inspirer de cette note explicative avec des captures d'écran pour t'aider: https://www.malekal.com/tutorial-farbar ... -frst/#fix

Ouvre le bloc-notes : Touche Windows + R, dans le champs executer, tape notepad et OK.
Copie/colle dedans ce qui suit :


HKU\S-1-5-19\...\Run: [ActiveUpdate] => C:\ProgramData\ActiveU0\dwvaztybt.exe
HKU\S-1-5-20\...\Run: [ActiveUpdate] => C:\ProgramData\ActiveU0\dwvaztybt.exe
HKLM\...\AppCertDlls: [x64] -> c:\program files\settings manager\systemk\x64\sysapcrt.dll
CHR Extension: (Ask Search) - C:\Users\FABIO\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaaiabcopkplhgaedhbloeejhhankf [2015-05-16]
CHR Extension: (FineDeAalSoftt) - C:\Users\FABIO\AppData\Local\Google\Chrome\User Data\Default\Extensions\khinnbnbfoefcjajacldjdhmigkelmpf [2014-05-28]
CHR Extension: (vshare plugin) - C:\Users\FABIO\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj [2012-11-04]
2015-06-15 16:51 - 2015-06-15 16:51 - 00000304 _____ C:\Users\Public\HELP_DECRYPT.URL
2015-06-15 16:51 - 2015-06-15 16:51 - 00000304 _____ C:\Users\Public\Downloads\HELP_DECRYPT.URL
2015-06-15 16:50 - 2015-06-15 16:50 - 00000304 _____ C:\Users\FABIO\HELP_DECRYPT.URL
2015-06-13 15:59 - 2015-06-13 15:59 - 00008686 _____ C:\Users\FABIO\AppData\Roaming\HELP_DECRYPT.HTML
2015-06-13 15:59 - 2015-06-13 15:59 - 00008686 _____ C:\Users\FABIO\AppData\HELP_DECRYPT.HTML
2015-06-13 15:59 - 2015-06-13 15:59 - 00004286 _____ C:\Users\FABIO\AppData\Roaming\HELP_DECRYPT.TXT
2015-06-13 15:59 - 2015-06-13 15:59 - 00004286 _____ C:\Users\FABIO\AppData\HELP_DECRYPT.TXT
2015-06-13 15:59 - 2015-06-13 15:59 - 00000304 _____ C:\Users\FABIO\AppData\Roaming\HELP_DECRYPT.URL
2015-06-13 15:59 - 2015-06-13 15:59 - 00000304 _____ C:\Users\FABIO\AppData\HELP_DECRYPT.URL
2015-06-13 15:56 - 2015-06-13 15:56 - 00008686 _____ C:\Users\FABIO\AppData\Local\HELP_DECRYPT.HTML
2015-06-13 15:56 - 2015-06-13 15:56 - 00004286 _____ C:\Users\FABIO\AppData\Local\HELP_DECRYPT.TXT
2015-06-13 15:56 - 2015-06-13 15:56 - 00000304 _____ C:\Users\FABIO\AppData\Local\HELP_DECRYPT.URL
2015-06-13 15:40 - 2015-06-14 22:01 - 00008686 _____ C:\ProgramData\HELP_DECRYPT.HTML
2015-06-13 15:40 - 2015-06-14 22:01 - 00004286 _____ C:\ProgramData\HELP_DECRYPT.TXT
2015-06-13 15:40 - 2015-06-14 22:01 - 00000304 _____ C:\ProgramData\HELP_DECRYPT.URL
2015-06-15 23:26 - 2013-03-13 22:18 - 00000308 _____ C:\Windows\Tasks\luprtm.job
2012-04-03 22:33 - 2012-04-03 22:41 - 0000000 _____ () C:\Users\FABIO\AppData\Roaming\bibstats
Task: C:\Windows\Tasks\d2834d00-aad2-4352-b74a-0f61289b7e44-3.job => <==== ATTENTION
Task: C:\Windows\Tasks\ef794e2d-b6ee-4571-a663-4232521290ad-4.job => <==== ATTENTION
Task: {DC865805-ED7F-4AFA-967D-94D8EC9AE189} - System32\Tasks\ibqotovqsc => C:\ProgramData\mbT8EW.exe <==== ATTENTION
Task: {84CEBE4B-34D6-467F-814A-1B98370464B8} - System32\Tasks\Windows Update Check - 0x11D4037D => C:\PROGRA~2\ActiveU0\DWVAZT~1.EXE <==== ATTENTION
Task: {0EC4BB63-3195-4ABF-94F0-A66B6C7429CC} - System32\Tasks\wdkiwbqcru => C:\ProgramData\mbT8EW.exe <==== ATTENTION
Task: {18C88BBD-D317-44CF-9993-4C0EC98AEC64} - System32\Tasks\tntigsixtf => C:\ProgramData\mbT8EW.exe <==== ATTENTION
Task: {3F5F2CFF-E22F-4277-BF15-2CCA1AF7FADE} - System32\Tasks\{D8E5EB3A-C3E6-4AFF-AA59-BCD45105D8D6} => pcalua.exe -a C:\Users\FABIO\AppData\Roaming\VOPackage\uninstall.exe
Task: {4DA25568-93DF-419F-A046-C9EBFAEA0ED7} - System32\Tasks\vqlguayvdg => C:\ProgramData\mbT8EW.exe <==== ATTENTION
Task: {55D5AE4C-6889-4AE7-900B-916C998C4B4D} - System32\Tasks\luprtm => Rundll32.exe "C:\Windows\system32\KBDDA7.dll",OFEOYYBRZ
Task: {73B11387-0284-46B3-913D-14103724E2BF} - System32\Tasks\urreonaitd => C:\Users\FABIO\AppData\Local\mbT8EW.exe
Task: {7EC53EB7-860F-4D75-9E1D-ABE5E4879EC9} - System32\Tasks\uabotangnc => C:\ProgramData\mbT8EW.exe <==== ATTENTION
C:\Windows\system32\KBDDA7.dll
C:\ProgramData\ActiveU0


Une fois, le texte coller dans le bloc-note.
Menu Fichier puis Enregistrer sous.
A gauche, place toi sur le bureau.

Dans le champs en bas, nom du fichier mets : fixlist.txt
Clic sur Enregistrer - cela va créer un fichier fixlist.txt sur le bureau.

Relance FRST qui doit se trouver sur le bureau et clic sur le bouton Fix
Selon comment un redémarrage est nécessaire (pas obligatoire).
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

Redémarre l'ordinateur


puis réinitialise tes navigateurs:
==================================
Réinitialise tes navigateurs et ou manuellement reparamètre tes navigateurs WEB (page de démarrage, moteur de recherche etc) mais aussi supprimer/désactiver les extensions inutiles/parasites :
* Internet Explorer et modules complémentaires / moteurs de recherche : http://forum.malekal.com/
* Firefox : http://forum.malekal.com/firefox-extens ... 36057.html
* Google Chrome : http://forum.malekal.com/google-chrome- ... 35837.html

[Malekal_morte]

humm tes DNS sont mauvais aussi, donc à faire :

Remets/vérifie que tous les serveurs de noms (DNS) sont automatiques : http://forum.malekal.com/reinitialiser- ... 48312.html
PUIS ensuite vide le cache DNS et internet.
Les 3 étapes sont importantes et à  faire sinon les pubs vont continuer.

[fabu]

merci beaucoup pour l aide j attaque cette partie

[fabu]

voici le resultat

Fix result of Farbar Recovery Scan Tool (x86) Version: 13-06-2015
Ran by FABIO at 2015-06-20 15:14:23 Run:1
Running from C:\Users\FABIO\Desktop
Loaded Profiles: FABIO (Available Profiles: FABIO)
Boot Mode: Normal

==============================================

fixlist content:
*****************
HKU\S-1-5-19\...\Run: [ActiveUpdate] => C:\ProgramData\ActiveU0\dwvaztybt.exe
HKU\S-1-5-20\...\Run: [ActiveUpdate] => C:\ProgramData\ActiveU0\dwvaztybt.exe
HKLM\...\AppCertDlls: [x64] -> c:\program files\settings manager\systemk\x64\sysapcrt.dll
CHR Extension: (Ask Search) - C:\Users\FABIO\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaaiabcopkplhgaedhbloeejhhankf [2015-05-16]
CHR Extension: (FineDeAalSoftt) - C:\Users\FABIO\AppData\Local\Google\Chrome\User Data\Default\Extensions\khinnbnbfoefcjajacldjdhmigkelmpf [2014-05-28]
CHR Extension: (vshare plugin) - C:\Users\FABIO\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj [2012-11-04]
2015-06-15 16:51 - 2015-06-15 16:51 - 00000304 _____ C:\Users\Public\HELP_DECRYPT.URL
2015-06-15 16:51 - 2015-06-15 16:51 - 00000304 _____ C:\Users\Public\Downloads\HELP_DECRYPT.URL
2015-06-15 16:50 - 2015-06-15 16:50 - 00000304 _____ C:\Users\FABIO\HELP_DECRYPT.URL
2015-06-13 15:59 - 2015-06-13 15:59 - 00008686 _____ C:\Users\FABIO\AppData\Roaming\HELP_DECRYPT.HTML
2015-06-13 15:59 - 2015-06-13 15:59 - 00008686 _____ C:\Users\FABIO\AppData\HELP_DECRYPT.HTML
2015-06-13 15:59 - 2015-06-13 15:59 - 00004286 _____ C:\Users\FABIO\AppData\Roaming\HELP_DECRYPT.TXT
2015-06-13 15:59 - 2015-06-13 15:59 - 00004286 _____ C:\Users\FABIO\AppData\HELP_DECRYPT.TXT
2015-06-13 15:59 - 2015-06-13 15:59 - 00000304 _____ C:\Users\FABIO\AppData\Roaming\HELP_DECRYPT.URL
2015-06-13 15:59 - 2015-06-13 15:59 - 00000304 _____ C:\Users\FABIO\AppData\HELP_DECRYPT.URL
2015-06-13 15:56 - 2015-06-13 15:56 - 00008686 _____ C:\Users\FABIO\AppData\Local\HELP_DECRYPT.HTML
2015-06-13 15:56 - 2015-06-13 15:56 - 00004286 _____ C:\Users\FABIO\AppData\Local\HELP_DECRYPT.TXT
2015-06-13 15:56 - 2015-06-13 15:56 - 00000304 _____ C:\Users\FABIO\AppData\Local\HELP_DECRYPT.URL
2015-06-13 15:40 - 2015-06-14 22:01 - 00008686 _____ C:\ProgramData\HELP_DECRYPT.HTML
2015-06-13 15:40 - 2015-06-14 22:01 - 00004286 _____ C:\ProgramData\HELP_DECRYPT.TXT
2015-06-13 15:40 - 2015-06-14 22:01 - 00000304 _____ C:\ProgramData\HELP_DECRYPT.URL
2015-06-15 23:26 - 2013-03-13 22:18 - 00000308 _____ C:\Windows\Tasks\luprtm.job
2012-04-03 22:33 - 2012-04-03 22:41 - 0000000 _____ () C:\Users\FABIO\AppData\Roaming\bibstats
Task: C:\Windows\Tasks\d2834d00-aad2-4352-b74a-0f61289b7e44-3.job => <==== ATTENTION
Task: C:\Windows\Tasks\ef794e2d-b6ee-4571-a663-4232521290ad-4.job => <==== ATTENTION
Task: {DC865805-ED7F-4AFA-967D-94D8EC9AE189} - System32\Tasks\ibqotovqsc => C:\ProgramData\mbT8EW.exe <==== ATTENTION
Task: {84CEBE4B-34D6-467F-814A-1B98370464B8} - System32\Tasks\Windows Update Check - 0x11D4037D => C:\PROGRA~2\ActiveU0\DWVAZT~1.EXE <==== ATTENTION
Task: {0EC4BB63-3195-4ABF-94F0-A66B6C7429CC} - System32\Tasks\wdkiwbqcru => C:\ProgramData\mbT8EW.exe <==== ATTENTION
Task: {18C88BBD-D317-44CF-9993-4C0EC98AEC64} - System32\Tasks\tntigsixtf => C:\ProgramData\mbT8EW.exe <==== ATTENTION
Task: {3F5F2CFF-E22F-4277-BF15-2CCA1AF7FADE} - System32\Tasks\{D8E5EB3A-C3E6-4AFF-AA59-BCD45105D8D6} => pcalua.exe -a C:\Users\FABIO\AppData\Roaming\VOPackage\uninstall.exe
Task: {4DA25568-93DF-419F-A046-C9EBFAEA0ED7} - System32\Tasks\vqlguayvdg => C:\ProgramData\mbT8EW.exe <==== ATTENTION
Task: {55D5AE4C-6889-4AE7-900B-916C998C4B4D} - System32\Tasks\luprtm => Rundll32.exe "C:\Windows\system32\KBDDA7.dll",OFEOYYBRZ
Task: {73B11387-0284-46B3-913D-14103724E2BF} - System32\Tasks\urreonaitd => C:\Users\FABIO\AppData\Local\mbT8EW.exe
Task: {7EC53EB7-860F-4D75-9E1D-ABE5E4879EC9} - System32\Tasks\uabotangnc => C:\ProgramData\mbT8EW.exe <==== ATTENTION
C:\Windows\system32\KBDDA7.dll
C:\ProgramData\ActiveU0

*****************

HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run\\ActiveUpdate => value removed successfully.
HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run\\ActiveUpdate => value removed successfully.
HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls\\x64 => value removed successfully.
C:\Users\FABIO\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaaiabcopkplhgaedhbloeejhhankf => moved successfully.
C:\Users\FABIO\AppData\Local\Google\Chrome\User Data\Default\Extensions\khinnbnbfoefcjajacldjdhmigkelmpf => moved successfully.
C:\Users\FABIO\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj => moved successfully.
C:\Users\Public\HELP_DECRYPT.URL => moved successfully.
C:\Users\Public\Downloads\HELP_DECRYPT.URL => moved successfully.
C:\Users\FABIO\HELP_DECRYPT.URL => moved successfully.
C:\Users\FABIO\AppData\Roaming\HELP_DECRYPT.HTML => moved successfully.
C:\Users\FABIO\AppData\HELP_DECRYPT.HTML => moved successfully.
C:\Users\FABIO\AppData\Roaming\HELP_DECRYPT.TXT => moved successfully.
C:\Users\FABIO\AppData\HELP_DECRYPT.TXT => moved successfully.
C:\Users\FABIO\AppData\Roaming\HELP_DECRYPT.URL => moved successfully.
C:\Users\FABIO\AppData\HELP_DECRYPT.URL => moved successfully.
C:\Users\FABIO\AppData\Local\HELP_DECRYPT.HTML => moved successfully.
C:\Users\FABIO\AppData\Local\HELP_DECRYPT.TXT => moved successfully.
C:\Users\FABIO\AppData\Local\HELP_DECRYPT.URL => moved successfully.
"C:\ProgramData\HELP_DECRYPT.HTML" => File/Folder not found.
"C:\ProgramData\HELP_DECRYPT.TXT" => File/Folder not found.
"C:\ProgramData\HELP_DECRYPT.URL" => File/Folder not found.
C:\Windows\Tasks\luprtm.job => moved successfully.
C:\Users\FABIO\AppData\Roaming\bibstats => moved successfully.
C:\Windows\Tasks\d2834d00-aad2-4352-b74a-0f61289b7e44-3.job => moved successfully.
C:\Windows\Tasks\ef794e2d-b6ee-4571-a663-4232521290ad-4.job => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DC865805-ED7F-4AFA-967D-94D8EC9AE189}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DC865805-ED7F-4AFA-967D-94D8EC9AE189}" => key removed successfully.
C:\Windows\System32\Tasks\ibqotovqsc => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ibqotovqsc" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{84CEBE4B-34D6-467F-814A-1B98370464B8}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{84CEBE4B-34D6-467F-814A-1B98370464B8}" => key removed successfully.
C:\Windows\System32\Tasks\Windows Update Check - 0x11D4037D => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Windows Update Check - 0x11D4037D" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0EC4BB63-3195-4ABF-94F0-A66B6C7429CC}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0EC4BB63-3195-4ABF-94F0-A66B6C7429CC}" => key removed successfully.
C:\Windows\System32\Tasks\wdkiwbqcru => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\wdkiwbqcru" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{18C88BBD-D317-44CF-9993-4C0EC98AEC64}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{18C88BBD-D317-44CF-9993-4C0EC98AEC64}" => key removed successfully.
C:\Windows\System32\Tasks\tntigsixtf => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\tntigsixtf" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3F5F2CFF-E22F-4277-BF15-2CCA1AF7FADE}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3F5F2CFF-E22F-4277-BF15-2CCA1AF7FADE}" => key removed successfully.
C:\Windows\System32\Tasks\{D8E5EB3A-C3E6-4AFF-AA59-BCD45105D8D6} => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{D8E5EB3A-C3E6-4AFF-AA59-BCD45105D8D6}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4DA25568-93DF-419F-A046-C9EBFAEA0ED7}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4DA25568-93DF-419F-A046-C9EBFAEA0ED7}" => key removed successfully.
C:\Windows\System32\Tasks\vqlguayvdg => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\vqlguayvdg" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{55D5AE4C-6889-4AE7-900B-916C998C4B4D}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{55D5AE4C-6889-4AE7-900B-916C998C4B4D}" => key removed successfully.
C:\Windows\System32\Tasks\luprtm => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\luprtm" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{73B11387-0284-46B3-913D-14103724E2BF}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{73B11387-0284-46B3-913D-14103724E2BF}" => key removed successfully.
C:\Windows\System32\Tasks\urreonaitd => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\urreonaitd" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7EC53EB7-860F-4D75-9E1D-ABE5E4879EC9}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7EC53EB7-860F-4D75-9E1D-ABE5E4879EC9}" => key removed successfully.
C:\Windows\System32\Tasks\uabotangnc => moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\uabotangnc" => key removed successfully.
C:\Windows\system32\KBDDA7.dll => moved successfully.
"C:\ProgramData\ActiveU0" => File/Folder not found.

==== End of Fixlog 15:14:29 ====

[fabu]

je ne trouve pas le fichier suivant que je dois vous envoyer C:\ProgramData\ActiveU0\dwvaztybt.exe

et pour celui la ca dit que ca ne prend pas en charge les fichiers dll C:\Windows\system32\KBDDA7.dll

[Malekal_morte]

KBDDA7.dll doit se trouver dans la quarantaine de FRST : C:\FRST\quarantine

réinitialisation les navigateurs WEB puis remets les serveurs DNS.

[fabu]

j ai essaye de faire un maximum des choses que vous m avez conseillees
j avoues que je suis completement perdu!!!
comment puis je savoir si mon ordi va mieux? et y a t il un moyen de tenter de recuperer mes photos? vraiment le plus important
merci infiniment pour le temps et l aide

[Malekal_morte]

Si tu as fait la dernière étape : remettre les serveurs DNS etc.
Refais un scan FRST et donne les rapports via pjjoint.

On va voir ce qu'il reste.

[fabu]

merci beaucoup le voici

http://pjjoint.malekal.com/files.php?id ... 10t11d6x69

[Malekal_morte]

Il doit rester un DNS pas bon à priori.
Remets bien tous les serveurs de noms en automatique sur chaque carte, voir second paragraphe de : http://forum.malekal.com/reinitialiser- ... 48312.html

Fais ça aussi, ça ne fera pas de mal :

Malwarebytes (temps : environ 40min de scan):
==================================================
Télécharge et installe Malwarebyte : https://www.malekal.com/malwarebyte-ant ... les-virus/
Mets le à  jour puis lance un examen.

A la fin du scan, clic sur "Supprimer Selection" en bas à  gauche.
Redémarre l'ordinateur si besoin.
Après redémarrage, relance Malwarebytes.
Vas chercher le rapport dans l'onglet Historique.
A gauche Journal des examens.
Doube-clic sur l'examen dans la liste.
Puis en bas Copier dans le presse papier
Vas sur http://pjjoint.malekal.com et en bas, clic droit / coller pour coller le rapport du scan Malwarebytes.
Clic sur envoyer.
Dans un nouveau message ici en réponse, donne le lien pjjoint afin de pouvoir consulter le rapport.