amulec et winsnare

[antoineauc]

Bonjour, mon pc a été infecté j'ai effectué un scan FRST, pouvez vous me dire ce qu'il en est svp
Merci:

http://pjjoint.malekal.com/files.php?id ... g12v10n8c6
http://pjjoint.malekal.com/files.php?id ... 0r12v12s12
http://pjjoint.malekal.com/files.php?id ... 15p11v6t12

[angelique]

Bonjour,

• Ouvre le bloc-notes : Menu Démarrer / Tous les programmes / Accessoires et Bloc-Notes. (ou executer➫notepad)
  Copie/colle dedans ce qui suit :
  
  

  Code : Tout sélectionner

  R2 Kyubey; C:\Users\antoine.chaulieu\AppData\Roaming\Kyubey\Kyubey.exe [116736 2017-03-22] (Kyubey.exe) [Fichier non signé]
  R2 WinSAPSvc; C:\Users\antoine.chaulieu\AppData\Roaming\WinSAPSvc\WinSAP.dll [218624 2017-03-23] (Windows) [Fichier non signé]
  R2 WinSnare; C:\Users\antoine.chaulieu\AppData\Roaming\WinSnare\WinSnare.dll [775168 2017-03-23] (InterSect Alliance Pty Ltd) [Fichier non signé] <==== ATTENTION
  S2 Cluseywreph; C:\Program Files (x86)\Casution\Nptlog.dll [X]
  S2 ed2kidle; "C:\Program Files (x86)\amulell\ed2k.exe" -downloadwhenidle [X]
  Task: {946EBB9E-A841-43C0-8465-9486B0DF6FAE} - System32\Tasks\Juqgehuwuk Cache => C:\Program Files (x86)\Casution\phupas.exe [2017-01-27] (Glarysoft Ltd)
  Task: {9E434371-8A6B-4CB3-8965-AE9BEF4A3B37} - System32\Tasks\Milimili => C:\Program Files (x86)\MIO\MIO.exe [2017-02-06] ()
  Task: {BD2A1820-16C8-4A2A-A3FA-785508AF2BD3} - System32\Tasks\BikaQ_FetchAndUpgrade_CanBeDel => C:\Program Files (x86)\BikaQRss\BikaQ.exe  <==== ATTENTION
  ShortcutWithArgument: C:\Users\antoine.chaulieu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.startpageing123.com/?type=sc&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC
  ShortcutWithArgument: C:\Users\antoine.chaulieu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.startpageing123.com/?type=sc&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC
  ShortcutWithArgument: C:\Users\antoine.chaulieu\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.startpageing123.com/?type=sc&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC
  ShortcutWithArgument: C:\Users\antoine.chaulieu\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.startpageing123.com/?type=sc&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC
  ShortcutWithArgument: C:\Users\antoine.chaulieu\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.startpageing123.com/?type=sc&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC
  ShortcutWithArgument: C:\Users\antoine.chaulieu\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.startpageing123.com/?type=sc&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC
  ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.startpageing123.com/?type=sc&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC
  HKU\S-1-5-21-614999404-2844882042-3129812769-5210\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
  HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.startpageing123.com/?type=hp&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC
  HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.startpageing123.com/?type=hp&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC
  HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.startpageing123.com/search/?type=ds&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC&q={searchTerms}
  HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.startpageing123.com/search/?type=ds&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC&q={searchTerms}
  HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.startpageing123.com/?type=hp&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC
  HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.startpageing123.com/?type=hp&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC
  HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.startpageing123.com/search/?type=ds&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC&q={searchTerms}
  HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.startpageing123.com/search/?type=ds&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC&q={searchTerms}
  HKU\S-1-5-21-614999404-2844882042-3129812769-5210\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.startpageing123.com/?type=hp&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC
  SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.startpageing123.com/search/?type=ds&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC&q={searchTerms}
  SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.startpageing123.com/search/?type=ds&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC&q={searchTerms}
  SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.startpageing123.com/search/?type=ds&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC&q={searchTerms}
  SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.startpageing123.com/search/?type=ds&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC&q={searchTerms}
  StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.startpageing123.com/?type=sc&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC
  StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.startpageing123.com/?type=sc&ts=1490196877&z=1f25a2d99dc6650a66e88a1g3z9tee7g6t4qbbam2m&from=che0812&uid=KINGSTONXSHFS37A120G_50026B725907CAFC
  2017-03-22 16:46 - 2017-03-22 16:46 - 00000000 ____D C:\Program Files (x86)\58D29C6B_jumpeasy
  2017-03-22 16:36 - 2017-03-22 16:36 - 00000000 ____D C:\Program Files (x86)\58D29A02_jumpeasy
  2017-03-22 16:35 - 2017-03-23 14:50 - 00000000 _____ C:\Users\Public\Documents\report.dat
  2017-03-22 16:35 - 2017-03-22 16:36 - 00000000 ____D C:\Program Files (x86)\58D299BE_jumpeasy
  2017-03-22 16:35 - 2017-03-22 16:35 - 00000000 _____ C:\WINDOWS\SysWOW64\4
  2017-03-22 16:35 - 2017-03-22 16:35 - 00000000 _____ C:\WINDOWS\SysWOW64\3
  2017-03-22 12:12 - 2017-03-23 11:33 - 00003610 _____ C:\WINDOWS\System32\Tasks\Milimili
  2017-03-22 12:12 - 2017-03-22 12:12 - 00003208 _____ C:\WINDOWS\System32\Tasks\BikaQ_FetchAndUpgrade_CanBeDel
  2017-03-08 10:04 - 2017-03-23 11:33 - 00000000 ____D C:\Users\antoine.chaulieu\AppData\Roaming\WinSnare
  2017-03-08 10:04 - 2017-03-23 11:32 - 00000000 ____D C:\Users\antoine.chaulieu\AppData\Roaming\WinSAPSvc
  2017-03-08 10:04 - 2017-03-22 16:43 - 00000000 ____D C:\Program Files (x86)\BikaQRss
  2017-03-08 10:04 - 2017-03-22 16:34 - 00000000 ____D C:\Program Files (x86)\MIO
  2017-03-08 10:04 - 2017-03-08 10:04 - 00000000 ____D C:\Users\antoine.chaulieu\AppData\Roaming\Kyubey
  2017-03-08 09:54 - 2017-03-08 09:54 - 00000000 ____D C:\Program Files (x86)\MK
  2017-03-08 09:53 - 2017-03-22 12:11 - 00000000 ____D C:\Program Files (x86)\h9kafbc6
  EmptyTemp:
  
  

• Menu Fichier / Enregistrer-sous
  Place toi sur le bureau.
  Dans le champs en bas, nom du fichier mets : fixlist.txt
  Clic sur Enregistrer - cela va créer un fichier fixlist.txt sur le bureau.
• Ferme toutes les applications, y compris ton navigateur
• Double-clique sur FRST.exe
  Sous Vista, Windows 7, 8,10, etc.... il faut lancer le fichier par clic-droit ➫ Exécuter en tant qu'administrateur
  Sur le menu principal, clique une seule fois sur Corriger/Fix et patiente le temps de la correction
  
  
  Un redémarrage peut être nécessaire (pas obligatoire).
• L'outil va créer un rapport de correction Fixlog.txt. Poste ce rapport dans ta réponse avec ton commentaire si c'est mieux !

[antoineauc]

Merci de votre réponse rapide !

ça à l'air d'avoir fonctionné
voici le rapport:
http://pjjoint.malekal.com/files.php?id ... 14l5m12h10

[angelique]

Surf un peu et confirme que c'est bon.

[antoineauc]

Oui après un peut de navigation et un redémarrage tout m'a l'air ok merci beaucoup !

[Malekal_morte]

Tu peux supprimer le dossier C:\FRST =)

Termine par un nettoyage Malwarebytes Anti-Malware (MBAM ) version gratuite


Quelques conseils :

Pour ne plus te faire avoir.
A lire - Programmes parasites / PUPs : Dossier Adwares/PUPs : programmes indésirables et parasites
(Surtout active les détections LPIs pour détecter les programmes parasites et publicitaires)