Chrome infecté de pop up indésirables

[robin.greffier]

Bonjour , pourriez vous m'aider a decrypter les rapports du logiciel FRST
Voici les 3 liens : https://pjjoint.malekal.com/files.php?i ... 7m11v15l14
https://pjjoint.malekal.com/files.php?i ... e5d15p8j12
https://pjjoint.malekal.com/files.php?i ... 9t15r8l5g7
Merci d'avance

[Malekal_morte]

Salut,
Tu infectes ton PC en téléchargeant des cracks.

A désinstaller :

Avast
QuickTime
Spybot (inutile)

Voici la correction à effectuer avec FRST. Tu peux t'aider de cette Voici la correction à effectuer avec FRST. Tu peux t'aider de cette #fix note explicative avec des captures d'écran.
Relance FRST puis sur ton clavier appuyer sur la touche CTRL + Y.
Le bloc-note va s'ouvrir, copie/colle ceci.

Code : Tout sélectionner

CreateRestorePoint:
CloseProcesses:
Task: {2CA3E142-5AC2-4DA7-ACE5-F43592CE4B32} - System32\Tasks\52fc4ec3511917c267cc245bbf9775d9 => sc start 52fc4ec3511917c267cc245bbf9775d9 <==== ATTENTION
Task: {3E19DEDC-7A4D-475A-A805-A5B7273755F0} - System32\Tasks\mraz_mishandled => C:\Program Files (x86)\Gallimard\Justin.exe
Task: {60D10AE3-F799-413B-9605-C84B38942469} - System32\Tasks\SoftUpgrade => C:\Program Files (x86)\SoftUpgrade\softup.exe [2018-04-13] () <==== ATTENTION
C:\Program Files\Blu-ray to iTunes Plugin
C:\Program Files (x86)\SoftUpgrade
Task: {6FE7155F-FDC6-4A30-8C43-229F6ABC7DFF} - System32\Tasks\Blu-ray to iTunes Plugin => C:\WINDOWS\system32\rundll32.exe "C:\Program Files\Blu-ray to iTunes Plugin\Blu-ray to iTunes Plugin.dll",TfMkbiNclog <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G1.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G2.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G3.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G4.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G5.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G6.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Updater_Online_Application.job => C:\Program Files (x86)\Microleaves\Online Application\Online Application Updater.exe <==== ATTENTION
 AppInit_DLLs: C:\ProgramData\Subair\Zoomeco.dll => C:\ProgramData\Subair\Zoomeco.dll [342528 2018-04-15] ()
 C:\ProgramData\Subair
GroupPolicy: Restriction ? <==== ATTENTION 
C:\Program Files (x86)\ProxyGate
 S2 pgt_svc; C:\Program Files (x86)\ProxyGate\MainService.exe [2285664 2017-02-22] (Gold Click Ltd) <==== ATTENTION
R2 RSGService; C:\ProgramData\rsg\rsgmpsp.exe [32768 2018-09-10] (Remo Software) 
C:\ProgramData\rsg
 2018-11-13 00:14 - 2018-11-13 00:15 - 187766515 _____ C:\Users\robin\Downloads\Hitman.2.Build.1.0.PROPER.FCKDRM (1).zip
2018-11-12 23:57 - 2018-11-12 23:58 - 141196820 _____ C:\Users\robin\Downloads\Hitman.2.PROPER.Crack-FCKDRM.rar
2018-11-12 23:55 - 2018-11-12 23:55 - 000002612 _____ C:\Users\robin\Desktop\steam_emu.ini
2018-11-12 23:23 - 2018-11-12 23:24 - 183245699 _____ C:\Users\robin\Downloads\Hitman.2.Build.1.0.PROPER.FCKDRM.zip
2018-11-12 23:01 - 2018-11-12 23:01 - 000000000 ____D C:\Users\Public\Documents\Steam
2018-11-12 22:14 - 2018-11-12 22:15 - 140613041 _____ C:\Users\robin\Downloads\Hitman.2.Crack.Only-FCKDRM.rar
2018-11-12 21:44 - 2018-11-12 21:45 - 000000000 ____D C:\Users\robin\Desktop\Hitman.2.Build.1.0.PROPER.FCKDRM
2018-11-12 15:27 - 2018-11-12 15:27 - 000275188 _____ C:\Users\robin\Downloads\HITMAN.2-FCKDRM.torrent 
RemoveProxy:
Reboot:

Ferme le bloc-note, retourne sur FRST et clique sur le bouton "Corriger / Fix"
Un redémarrage sera peut-être nécessaire et automatique.
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

Redémarre l'ordinateur.
(L'ordinateur peut redémarrer tout seul, si le rapport de correction ne s'ouvre pas, cherche un fichier fixlog.txt qui se trouve dans le même dossier que FRST)

2) réinitialiser les navigateurs:
==================================
Réinitialise tes navigateurs et/ou re-paramètre manuellement tes navigateurs WEB ( page de démarrage, moteur de recherche, etc ) mais aussi supprimer/désactiver les extensions inutiles/parasites.
Pour t'aider à effectuer ce ménage, clique ci-dessous sur le nom du navigateur WEB que tu utilises :
* Réinitialiser et réparer Mozilla Firefox
* Réinitialiser et réparer Google Chrome
* Réinitialiser et réparer Internet Explorer
(Ne pas utiliser Zeok)

3)
Faire un nettoyage Malwarebytes Anti-Malware (MBAM ) version gratuite

4)
Refais un scan FRST et donne les nouveaux rapports via pjjoint

[robin.greffier]

Merci pour ta reponse rapide et efficace !haha oui difficile de disinguer les faux positif des vraix menaces helas, j'ai tout suivi a la lettre mise a part pour zoek je l'ai utlilisé et ensuite j'ai fait un nettoyage manuel.
Le contenu de fix log :
Fix result of Farbar Recovery Scan Tool (x64) Version: 01.12.2018 01
Ran by robin (04-12-2018 23:27:31) Run:1
Running from C:\Users\robin\Desktop\frst
Loaded Profiles: robin (Available Profiles: robin)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CreateRestorePoint:
CloseProcesses:
Task: {2CA3E142-5AC2-4DA7-ACE5-F43592CE4B32} - System32\Tasks\52fc4ec3511917c267cc245bbf9775d9 => sc start 52fc4ec3511917c267cc245bbf9775d9 <==== ATTENTION
Task: {3E19DEDC-7A4D-475A-A805-A5B7273755F0} - System32\Tasks\mraz_mishandled => C:\Program Files (x86)\Gallimard\Justin.exe
Task: {60D10AE3-F799-413B-9605-C84B38942469} - System32\Tasks\SoftUpgrade => C:\Program Files (x86)\SoftUpgrade\softup.exe [2018-04-13] () <==== ATTENTION
C:\Program Files\Blu-ray to iTunes Plugin
C:\Program Files (x86)\SoftUpgrade
Task: {6FE7155F-FDC6-4A30-8C43-229F6ABC7DFF} - System32\Tasks\Blu-ray to iTunes Plugin => C:\WINDOWS\system32\rundll32.exe "C:\Program Files\Blu-ray to iTunes Plugin\Blu-ray to iTunes Plugin.dll",TfMkbiNclog <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G1.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G2.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G3.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G4.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G5.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Online Application V2G6.job => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Updater_Online_Application.job => C:\Program Files (x86)\Microleaves\Online Application\Online Application Updater.exe <==== ATTENTION
AppInit_DLLs: C:\ProgramData\Subair\Zoomeco.dll => C:\ProgramData\Subair\Zoomeco.dll [342528 2018-04-15] ()
C:\ProgramData\Subair
GroupPolicy: Restriction ? <==== ATTENTION
C:\Program Files (x86)\ProxyGate
S2 pgt_svc; C:\Program Files (x86)\ProxyGate\MainService.exe [2285664 2017-02-22] (Gold Click Ltd) <==== ATTENTION
R2 RSGService; C:\ProgramData\rsg\rsgmpsp.exe [32768 2018-09-10] (Remo Software)
C:\ProgramData\rsg
2018-11-13 00:14 - 2018-11-13 00:15 - 187766515 _____ C:\Users\robin\Downloads\Hitman.2.Build.1.0.PROPER.FCKDRM (1).zip
2018-11-12 23:57 - 2018-11-12 23:58 - 141196820 _____ C:\Users\robin\Downloads\Hitman.2.PROPER.Crack-FCKDRM.rar
2018-11-12 23:55 - 2018-11-12 23:55 - 000002612 _____ C:\Users\robin\Desktop\steam_emu.ini
2018-11-12 23:23 - 2018-11-12 23:24 - 183245699 _____ C:\Users\robin\Downloads\Hitman.2.Build.1.0.PROPER.FCKDRM.zip
2018-11-12 23:01 - 2018-11-12 23:01 - 000000000 ____D C:\Users\Public\Documents\Steam
2018-11-12 22:14 - 2018-11-12 22:15 - 140613041 _____ C:\Users\robin\Downloads\Hitman.2.Crack.Only-FCKDRM.rar
2018-11-12 21:44 - 2018-11-12 21:45 - 000000000 ____D C:\Users\robin\Desktop\Hitman.2.Build.1.0.PROPER.FCKDRM
2018-11-12 15:27 - 2018-11-12 15:27 - 000275188 _____ C:\Users\robin\Downloads\HITMAN.2-FCKDRM.torrent
RemoveProxy:
Reboot:
*****************

Restore point was successfully created.
Processes closed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{2CA3E142-5AC2-4DA7-ACE5-F43592CE4B32}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2CA3E142-5AC2-4DA7-ACE5-F43592CE4B32}" => removed successfully
C:\WINDOWS\System32\Tasks\52fc4ec3511917c267cc245bbf9775d9 => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\52fc4ec3511917c267cc245bbf9775d9" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3E19DEDC-7A4D-475A-A805-A5B7273755F0}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3E19DEDC-7A4D-475A-A805-A5B7273755F0}" => removed successfully
C:\WINDOWS\System32\Tasks\mraz_mishandled => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\mraz_mishandled" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{60D10AE3-F799-413B-9605-C84B38942469}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{60D10AE3-F799-413B-9605-C84B38942469}" => removed successfully
C:\WINDOWS\System32\Tasks\SoftUpgrade => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SoftUpgrade" => removed successfully
C:\Program Files\Blu-ray to iTunes Plugin => moved successfully
C:\Program Files (x86)\SoftUpgrade => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{6FE7155F-FDC6-4A30-8C43-229F6ABC7DFF}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6FE7155F-FDC6-4A30-8C43-229F6ABC7DFF}" => removed successfully
C:\WINDOWS\System32\Tasks\Blu-ray to iTunes Plugin => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Blu-ray to iTunes Plugin" => removed successfully
C:\WINDOWS\Tasks\Online Application V2G1.job => moved successfully
C:\WINDOWS\Tasks\Online Application V2G2.job => moved successfully
C:\WINDOWS\Tasks\Online Application V2G3.job => moved successfully
C:\WINDOWS\Tasks\Online Application V2G4.job => moved successfully
C:\WINDOWS\Tasks\Online Application V2G5.job => moved successfully
C:\WINDOWS\Tasks\Online Application V2G6.job => moved successfully
C:\WINDOWS\Tasks\Updater_Online_Application.job => moved successfully
"C:\ProgramData\Subair\Zoomeco.dll" => Value data removed successfully
C:\ProgramData\Subair => moved successfully
C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully
C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully
C:\Program Files (x86)\ProxyGate => moved successfully
HKLM\System\CurrentControlSet\Services\pgt_svc => removed successfully
pgt_svc => service removed successfully
HKLM\System\CurrentControlSet\Services\RSGService => removed successfully
RSGService => service removed successfully
C:\ProgramData\rsg => moved successfully
C:\Users\robin\Downloads\Hitman.2.Build.1.0.PROPER.FCKDRM (1).zip => moved successfully
C:\Users\robin\Downloads\Hitman.2.PROPER.Crack-FCKDRM.rar => moved successfully
C:\Users\robin\Desktop\steam_emu.ini => moved successfully
C:\Users\robin\Downloads\Hitman.2.Build.1.0.PROPER.FCKDRM.zip => moved successfully
C:\Users\Public\Documents\Steam => moved successfully
C:\Users\robin\Downloads\Hitman.2.Crack.Only-FCKDRM.rar => moved successfully
C:\Users\robin\Desktop\Hitman.2.Build.1.0.PROPER.FCKDRM => moved successfully
C:\Users\robin\Downloads\HITMAN.2-FCKDRM.torrent => moved successfully

========= RemoveProxy: =========

"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully
"HKU\S-1-5-21-1490650208-3217101103-190331726-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\S-1-5-21-1490650208-3217101103-190331726-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully


========= End of RemoveProxy: =========



The system needed a reboot.

==== End of Fixlog 23:27:40 ====


les liens du rapport frst : https://pjjoint.malekal.com/files.php?i ... 15m1412w11
https://pjjoint.malekal.com/files.php?i ... 3x13d6k9z6
https://pjjoint.malekal.com/files.php?i ... 11f10m6c14
Encore merci pour ton aide

[Malekal_morte]

Voici la correction à effectuer avec FRST. Tu peux t'aider de cette Voici la correction à effectuer avec FRST. Tu peux t'aider de cette #fix note explicative avec des captures d'écran.
Relance FRST puis sur ton clavier appuyer sur la touche CTRL + Y.
Le bloc-note va s'ouvrir, copie/colle ceci.

Code : Tout sélectionner

CreateRestorePoint:
CloseProcesses:
C:\Program Files\Red Giant Link
Task: {8A626A14-1D97-4F32-A60F-40EBB6A996DB} - System32\Tasks\Red Giant Link => C:\Program Files\Red Giant Link\Red Giant Link.exe <==== ATTENTION
Task: {8B6819AF-078E-4A3B-B8D9-160B0E917033} - System32\Tasks\rolland ache revivalist => C:\Users\robin\AppData\Local\Justin.exe
C:\Users\robin\AppData\Local\Justin.exe
Task: {65FF55FA-700A-4B82-94F9-7F920EC82B8D} - System32\Tasks\scenarios => C:\Program Files (x86)\Samplings\Justin.exe
Task: {520BD820-0818-4580-93C3-DC3ABA46BEDC} - System32\Tasks\gatapers-gatewaystapers-gateways => C:\Program Files (x86)\execute\injunctive.exe
Task: {53D24ABB-7DA4-4F75-8F55-C0E73AEE7116} - System32\Tasks\garolland ache revivalistrolland ache revivalist => C:\Users\robin\AppData\Local\Justin.exe
Task: {560A7CB1-6BF5-44F1-9727-FAE25B63622D} - System32\Tasks\gaturns_destroyerturns_destroyer => C:\Users\robin\AppData\Local\injunctive.exe
Task: {06ACA471-A333-4F1E-983B-186CD5E114E8} - System32\Tasks\tapers-gateways => C:\Program Files (x86)\execute\injunctive.exe
C:\Program Files (x86)\execute
HKU\S-1-5-21-1490650208-3217101103-190331726-1001\...\RunOnce: [Application Restart #3] => C:\ProgramData\RSG\rsgpsrsdk.exe /RestartByRestartManager:47D5E9AD-E43E-4800-A27A-AF5C141E5A3E /RestartByRestartManager:21E4644C-0454-4128-B929-352B70B9196E /RestartByRestartManager:D0442983-F98E-49ae (the data entry has 80 more characters).
C:\ProgramData\RSG
C:\Users\robin\AppData\Local\injunctive.exe
Task: {BC032530-5F19-472C-9760-8540B8EACF4B} - System32\Tasks\turns_destroyer => C:\Users\robin\AppData\Local\injunctive.exe
Task: {19EE6AE5-1B9D-478F-ACC7-2676B4C15C38} - System32\Tasks\promontories disdainfully => C:\Program Files (x86)\Gallimard\injunctive.exe
RemoveProxy:
Reboot:

Ferme le bloc-note, retourne sur FRST et clique sur le bouton "Corriger / Fix"
Un redémarrage sera peut-être nécessaire et automatique.
Un fichier texte apparaît, copie/colle le contenu ici dans un nouveau message.

Redémarre l'ordinateur.
(L'ordinateur peut redémarrer tout seul, si le rapport de correction ne s'ouvre pas, cherche un fichier fixlog.txt qui se trouve dans le même dossier que FRST)