Windows 10 est infecté par DNS Unblocker... l'enfer

[HMamI]

Bonjour,

Depuis deux jours, mon Windows est infecté par DNS Unblocker.

Des publicités envahissent mes navigateurs Explorer Edge et Firefox, de nouveaux onglets s’ouvrent avec des sites non sollicités. J'ai essayé CCleaner, uninstal du panneau de configuration, reset des navigateurs, ... rien ne marche. J’utilise donc un autre ordinateur pour envoyer ce message. Je vous joins les fichiers générés avec toutes les options cochées par FRST67.exe

FRST http://pjjoint.malekal.com/files.php?id ... 6z10s13r11
Addition http://pjjoint.malekal.com/files.php?id ... r14n5l5x11
shortcut http://pjjoint.malekal.com/files.php?id ... 19d10i5v15

Merci pour vos contributions et votre aide.

Cordialement.

[angelique]

1. Ouvre le bloc-notes : Menu Démarrer / Tous les programmes / Accessoires et Bloc-Notes. (ou executer---> notepad)
   Copie/colle dedans ce qui suit :
   
   

   Task: {0A03AE01-FE78-49B9-89D8-81C3DC2DDB59} - System32\Tasks\Security Center Update - 233048341 => C:\Users\MarketingEspace\AppData\Roaming\Renyzi\egunezo.exe <==== ATTENTION
   Task: {1CE9197D-63DC-426E-8B88-FF93C4788CEF} - System32\Tasks\Security Center Update - 770232468 => C:\Users\MarketingEspace\AppData\Roaming\Yzehvo\hecee.exe <==== ATTENTION
   Task: {271CC8D1-8340-41F5-9355-7D1ED0E2B8F3} - System32\Tasks\MarketingEspaceAvatarArrangedV2 => Rundll32.exe MortgageableUser.dll,main 7 1 <==== ATTENTION
   Task: {5F5EB402-8F41-4B20-8EEB-1742CF5630D4} - System32\Tasks\Security Center Update - 4154664145 => C:\Users\MarketingEspace\AppData\Roaming\Urgaadis\isike.exe <==== ATTENTION
   Task: {6953EE22-65C2-4D89-A879-23EADED7EC34} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\BrowserChoice\browserchoice.exe
   Task: {83E41B87-8963-44D8-8FEA-4861325199C1} - System32\Tasks\{31AC3EA7-DA28-2272-DE8F-45C2B812886A} => C:\WINDOWS\system32\regsvr32.exe [2015-10-30] (Microsoft Corporation)
   Task: {97E6FBFD-E01C-4A0C-95FA-E4AE119443C1} - System32\Tasks\DNSLOCKINGTON => dnslockington.exe <==== ATTENTION
   Task: {9EF11FB6-CB60-4006-9D0D-9121CF6F0704} - System32\Tasks\Security Center Update - 1276688492 => C:\Users\MarketingEspace\AppData\Roaming\Myalpyzo\poyda.exe <==== ATTENTION
   Task: {AAEEE182-AFBF-4398-AEF2-157042C698CB} - System32\Tasks\Security Center Update - 3524091739 => C:\Users\MarketingEspace\AppData\Roaming\Axentyp\lenue.exe <==== ATTENTION
   Task: {B505DF8C-8E6D-4DB2-A8D2-D514F9FF93E2} - System32\Tasks\Security Center Update - 3944897569 => C:\Users\MarketingEspace\AppData\Roaming\Akizhaas\xyomxi.exe <==== ATTENTION
   Task: {BCE93989-A061-460C-9F1D-A66FF53A8856} - System32\Tasks\Security Center Update - 2337832968 => C:\Users\MarketingEspace\AppData\Roaming\Abluodb\atorymr.exe <==== ATTENTION
   Task: {BE05CA2B-6524-420D-827B-A7A461603358} - System32\Tasks\Security Center Update - 2144752174 => C:\Users\MarketingEspace\AppData\Roaming\Yqlibyx\gyvak.exe <==== ATTENTION
   Task: {D41707AB-7883-482F-94A7-E321EF7BA48F} - System32\Tasks\Security Center Update - 3110180878 => C:\Users\MarketingEspace\AppData\Roaming\Abiqboc\usoca.exe <==== ATTENTION
   Task: {EF215EC8-CCA1-408B-9121-669FEA06022F} - System32\Tasks\Security Center Update - 1727154253 => C:\Users\MarketingEspace\AppData\Roaming\Ileraf\xuobsi.exe <==== ATTENTION
   Task: C:\WINDOWS\Tasks\Security Center Update - 1048292996.job => C:\Users\MarketingEspace\AppData\Roaming\Yqyczi\qazelac.exe <==== ATTENTION
   Task: C:\WINDOWS\Tasks\Security Center Update - 1276688492.job => C:\Users\MarketingEspace\AppData\Roaming\Myalpyzo\poyda.exe <==== ATTENTION
   Task: C:\WINDOWS\Tasks\Security Center Update - 1727154253.job => C:\Users\MarketingEspace\AppData\Roaming\Ileraf\xuobsi.exe <==== ATTENTION
   Task: C:\WINDOWS\Tasks\Security Center Update - 2144752174.job => C:\Users\MarketingEspace\AppData\Roaming\Yqlibyx\gyvak.exe <==== ATTENTION
   Task: C:\WINDOWS\Tasks\Security Center Update - 233048341.job => C:\Users\MarketingEspace\AppData\Roaming\Renyzi\egunezo.exe <==== ATTENTION
   Task: C:\WINDOWS\Tasks\Security Center Update - 2337832968.job => C:\Users\MarketingEspace\AppData\Roaming\Abluodb\atorymr.exe <==== ATTENTION
   Task: C:\WINDOWS\Tasks\Security Center Update - 3110180878.job => C:\Users\MarketingEspace\AppData\Roaming\Abiqboc\usoca.exe <==== ATTENTION
   Task: C:\WINDOWS\Tasks\Security Center Update - 3524091739.job => C:\Users\MarketingEspace\AppData\Roaming\Axentyp\lenue.exe <==== ATTENTION
   Task: C:\WINDOWS\Tasks\Security Center Update - 3944897569.job => C:\Users\MarketingEspace\AppData\Roaming\Akizhaas\xyomxi.exe <==== ATTENTION
   Task: C:\WINDOWS\Tasks\Security Center Update - 4154664145.job => C:\Users\MarketingEspace\AppData\Roaming\Urgaadis\isike.exe <==== ATTENTION
   Task: C:\WINDOWS\Tasks\Security Center Update - 770232468.job => C:\Users\MarketingEspace\AppData\Roaming\Yzehvo\hecee.exe <==== ATTENTION
   Tcpip\Parameters: [NameServer] 82.163.142.7 95.211.158.134
   Tcpip\..\Interfaces\{36b77cee-5e7e-4815-a966-408d126e75c0}: [NameServer] 82.163.142.7 95.211.158.134
   Tcpip\..\Interfaces\{8fcfd15f-f7b8-4124-8bd7-596a87646313}: [NameServer] 82.163.142.7 95.211.158.134
   Tcpip\..\Interfaces\{8fcfd15f-f7b8-4124-8bd7-596a87646313}: [DhcpNameServer] 82.163.142.7
   Tcpip\..\Interfaces\{9f8c861d-7758-4bd1-aa00-c5bd4e894263}: [NameServer] 82.163.142.7 95.211.158.134
   Tcpip\..\Interfaces\{9f8c861d-7758-4bd1-aa00-c5bd4e894263}: [DhcpNameServer] 82.163.142.7
   2016-03-03 19:59 - 2016-03-03 19:59 - 00000000 ____D C:\ProgramData\c2458fde-3a95-0
   2016-03-03 19:55 - 2016-03-03 19:55 - 00022244 _____ C:\WINDOWS\System32\Tasks\DNSLOCKINGTON
   2016-03-03 19:54 - 2016-03-03 19:54 - 00003902 _____ C:\WINDOWS\System32\Tasks\{31AC3EA7-DA28-2272-DE8F-45C2B812886A}
   2016-03-03 19:54 - 2016-03-03 19:54 - 00000000 ____D C:\ProgramData\e1a8e454
   2016-03-03 19:54 - 2016-03-03 19:54 - 00000000 ____D C:\ProgramData\c2458fde-1327-0
   2016-03-03 19:54 - 2016-03-03 19:54 - 00000000 ____D C:\ProgramData\{138bfce7-212c-1}
   2016-03-03 19:54 - 2016-03-03 19:54 - 00000000 ____D C:\ProgramData\{028fe102-012c-0}
   2016-02-13 00:43 - 2016-03-03 19:55 - 00000000 ____D C:\ProgramData\ffb8b303-24e5-0
   2016-02-13 00:43 - 2016-03-03 19:54 - 00000000 ____D C:\ProgramData\ffb8b303-2337-1
   2016-02-13 00:43 - 2016-02-27 15:48 - 00000376 __RSH C:\ProgramData\ntuser.pol
   2016-02-13 00:43 - 2016-02-23 00:05 - 00002676 _____ C:\WINDOWS\System32\Tasks\MarketingEspaceAvatarArrangedV2
   2016-02-13 00:43 - 2016-02-13 00:43 - 00000000 ____D C:\Users\MarketingEspace\AppData\Roaming\PriceFountain
   2016-03-05 14:00 - 2014-10-05 13:54 - 00000872 _____ C:\WINDOWS\Tasks\Security Center Update - 4154664145.job
   2016-03-05 14:00 - 2014-10-05 02:50 - 00000866 _____ C:\WINDOWS\Tasks\Security Center Update - 1727154253.job
   2016-03-05 14:00 - 2014-10-04 22:49 - 00000868 _____ C:\WINDOWS\Tasks\Security Center Update - 3524091739.job
   2016-03-05 14:00 - 2014-10-04 18:49 - 00000868 _____ C:\WINDOWS\Tasks\Security Center Update - 2144752174.job
   2016-03-05 14:00 - 2014-10-04 14:49 - 00000868 _____ C:\WINDOWS\Tasks\Security Center Update - 233048341.job
   2016-03-05 14:00 - 2014-10-03 14:51 - 00000868 _____ C:\WINDOWS\Tasks\Security Center Update - 1048292996.job
   2016-03-05 14:00 - 2014-10-03 10:54 - 00000874 _____ C:\WINDOWS\Tasks\Security Center Update - 3944897569.job
   2016-03-05 14:00 - 2014-10-03 06:51 - 00000872 _____ C:\WINDOWS\Tasks\Security Center Update - 2337832968.job
   2016-03-05 14:00 - 2014-10-03 02:49 - 00000872 _____ C:\WINDOWS\Tasks\Security Center Update - 1276688492.job
   2016-03-05 14:00 - 2014-10-02 22:55 - 00000868 _____ C:\WINDOWS\Tasks\Security Center Update - 3110180878.job
   2016-03-05 14:00 - 2014-10-01 18:45 - 00000864 _____ C:\WINDOWS\Tasks\Security Center Update - 770232468.job
   2016-02-23 00:05 - 2014-10-05 13:54 - 00003246 _____ C:\WINDOWS\System32\Tasks\Security Center Update - 4154664145
   2016-02-23 00:05 - 2014-10-05 02:50 - 00003240 _____ C:\WINDOWS\System32\Tasks\Security Center Update - 1727154253
   2016-02-23 00:05 - 2014-10-04 22:49 - 00003242 _____ C:\WINDOWS\System32\Tasks\Security Center Update - 3524091739
   2016-02-23 00:05 - 2014-10-04 18:49 - 00003242 _____ C:\WINDOWS\System32\Tasks\Security Center Update - 2144752174
   2016-02-23 00:05 - 2014-10-04 14:49 - 00003242 _____ C:\WINDOWS\System32\Tasks\Security Center Update - 233048341
   2016-02-23 00:05 - 2014-10-03 14:51 - 00003242 _____ C:\WINDOWS\System32\Tasks\Security Center Update - 1048292996
   2016-02-23 00:05 - 2014-10-03 10:54 - 00003248 _____ C:\WINDOWS\System32\Tasks\Security Center Update - 3944897569
   2016-02-23 00:05 - 2014-10-03 06:51 - 00003246 _____ C:\WINDOWS\System32\Tasks\Security Center Update - 2337832968
   2016-02-23 00:05 - 2014-10-03 02:50 - 00003246 _____ C:\WINDOWS\System32\Tasks\Security Center Update - 1276688492
   2016-02-23 00:05 - 2014-10-02 22:55 - 00003242 _____ C:\WINDOWS\System32\Tasks\Security Center Update - 3110180878
   2016-02-23 00:05 - 2014-10-01 18:45 - 00003238 _____ C:\WINDOWS\System32\Tasks\Security Center Update - 770232468
   C:\Users\MarketingEspace\AppData\Roaming\Renyzi
   C:\Users\MarketingEspace\AppData\Roaming\Yzehvo
   C:\Users\MarketingEspace\AppData\Roaming\Urgaadis
   C:\Users\MarketingEspace\AppData\Roaming\Myalpyzo
   C:\Users\MarketingEspace\AppData\Roaming\Axentyp
   C:\Users\MarketingEspace\AppData\Roaming\Akizhaas
   C:\Users\MarketingEspace\AppData\Roaming\Abluodb
   C:\Users\MarketingEspace\AppData\Roaming\Yqlibyx
   C:\Users\MarketingEspace\AppData\Roaming\Yqyczi
   C:\Users\MarketingEspace\AppData\Roaming\Abiqboc
   C:\Users\MarketingEspace\AppData\Roaming\Ileraf
   C:\Users\MarketingEspace\AppData\Roaming\Yqyczi
   C:\Users\MarketingEspace\AppData\Roaming\Myalpyzo
   C:\Users\MarketingEspace\AppData\Roaming\Ileraf
   C:\Users\MarketingEspace\AppData\Roaming\Yqlibyx
   C:\Users\MarketingEspace\AppData\Roaming\Renyzi
   C:\Users\MarketingEspace\AppData\Roaming\Abluodb
   C:\Users\MarketingEspace\AppData\Roaming\Abiqboc
   C:\Users\MarketingEspace\AppData\Roaming\Axentyp
   C:\Users\MarketingEspace\AppData\Roaming\Akizhaas
   C:\Users\MarketingEspace\AppData\Roaming\Urgaadis
   C:\Users\MarketingEspace\AppData\Roaming\Yzehvo
   cmd: ipconfig /flushdns
   EmptyTemp:
   

2. Menu Fichier / Enregistrer-sous
   Place toi sur le bureau.
   Dans le champs en bas, nom du fichier mets : fixlist.txt
   Clic sur Enregistrer - cela va créer un fichier fixlist.txt sur le bureau.
   
   Relance FRST et clic sur le bouton fix/Correction
   Un redémarrage peut être nécessaire (pas obligatoire).
   Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

[HMamI]

Bonjour et merci pour votre aide,

J'ai appliqué le fichier txt et je vous joins la réponse :

http://pjjoint.malekal.com/files.php?id ... 2s10p15q12

Le problème est réglé.
Un grand merci et un Ouf de soulagement.
Cordialement,

[Malekal_morte]

Quelques conseils :

Pour tenter de prévenir les sites malicieux, tu peux installer Blockulicious.

Pour ne plus te faire avoir.
A lire - Programmes parasites / PUPs : Dossier Adwares/PUPs : programmes indésirables et parasites
(Surtout active les détections LPIs pour détecter les programmes parasites et publicitaires)

[HMamI]

Bonjour,
J'en ai bien pris note, je vais l'installer.
Cordialement,