Contenu republié avec la permission de Malwarebytes (https://forums.malwarebytes.org/index.php?showforum=39)
PC Health Advisor est un faux nettoyeur/optimiseur, affiche intentionnellement des faux-positifs pour convaincre l'utilisateur que son système a des problèmes et lui faire acheter le logiciel.
Plus d'infos : Registry Cleaners: Digital Snake Oil | Malwarebytes Labs (https://blog.malwarebytes.com/cybercrime/2015/06/digital-snake-oil/)
(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/PCHealthAdvisor/main.png&key=5b7a87355bc3e7a128784f1a4c2282a13b0d4dc79747f69e53b52775de8e6fb0)
- S'installe en tant que programme, soit à l'insu de l'utilisateur ou parce qu'il n'a pas décoché les sponsors proposés lors de l'installation d'un logiciel gratuit légitime, soit depuis le site de l'éditeur
(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/PCHealthAdvisor/warning4.png&key=4451a7e08f69ea2fcb4fddae3b7372936ffacade4a15d38acfa16da01088e3be)
- Affiche ces alertes pendant l'installation
(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/PCHealthAdvisor/warning1.png&key=bd7a1d3fa3493f7ea5dd99ff1487f395e78fb40a6c019d74b58c2dd57dc5cf20)
(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/PCHealthAdvisor/warning2.png&key=2df789215457492be020d3a8568b8657376e5b4fa86b13803474502b77ad0e47)
(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/PCHealthAdvisor/warning5.png&key=10d6bd34c5a0870efdab0dce609fb8dca313bf4d6c31319d4e83b9a50d7f388a)
(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/PCHealthAdvisor/warning6.png&key=b2d76b54fdf89dce017e1e14c2fa26adba072a4afddeff8670e77c2874c2db3e)
- Affiche cet écran quand vous essayez de corriger les problèmes signalés
(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/PCHealthAdvisor/warning7.png&key=cc4d9e4b965ee153d576b188c2e8c079ccb75c827802573e75bd304cf5cb15a4)
- Crée cette icône dans le Menu Démarrer, la Barre des tâches et sur le Bureau
(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/PCHealthAdvisor/icons.png&key=c643ef8f9c1862cca042ac6babf6b779b717661610a5c9076019d3c19c9ab082)
**********
Détection de PC Health Advisor dans des rapports FRST :
ParetoLogic PC Health Advisor (HKLM-x32\...\{3CBF3EBB-235D-4c29-A68B-2BB1F428586E}) (Version: 3.2.8.0 - ParetoLogic, Inc.)
Task: {6ABE739A-C6A0-47ED-B812-C3A6BC0361C3} - System32\Tasks\PC Health Advisor => C:\Program Files (x86)\ParetoLogic\PCHA\PCHA.exe [2017-01-18] (ParetoLogic)
Task: {7E46AA87-95F8-4504-8034-B0F3724BE6B0} - System32\Tasks\PC Health Advisor Startup => C:\Program Files (x86)\ParetoLogic\PCHA\PCHA.exe [2017-01-18] (ParetoLogic)
Task: {90E98E78-6DBD-4513-8FA6-FD1767EDC04F} - System32\Tasks\PC Health Advisor Update => C:\Program Files (x86)\ParetoLogic\PCHA\PCHA.exe [2017-01-18] (ParetoLogic)
Task: {DF8FAF9B-104D-438F-955F-57D3CECF7060} - System32\Tasks\PC Health Advisor Defrag => C:\Program Files (x86)\ParetoLogic\PCHA\PCHA.exe [2017-01-18] (ParetoLogic)
Task: C:\Windows\Tasks\PC Health Advisor Defrag.job => C:\Program Files (x86)\ParetoLogic\PCHA\PCHA.exe
Task: C:\Windows\Tasks\PC Health Advisor Startup.job => C:\Program Files (x86)\ParetoLogic\PCHA\PCHA.exe1C:\Program Files (x86)\ParetoLogic\PCHA\PCHA.exe
Task: C:\Windows\Tasks\PC Health Advisor Update.job => C:\Program Files (x86)\ParetoLogic\PCHA\PCHA.exe
Task: C:\Windows\Tasks\PC Health Advisor.job => C:\Program Files (x86)\ParetoLogic\PCHA\PCHA.exe
() C:\Program Files (x86)\ParetoLogic\PCHA\LiteZip.dll
() C:\Program Files (x86)\ParetoLogic\PCHA\ExtensionManager.dll
() C:\Program Files (x86)\ParetoLogic\PCHA\CommonLoggingExtension.pxt
() C:\Program Files (x86)\ParetoLogic\PCHA\CommonSpecialist.pxt
() C:\Program Files (x86)\ParetoLogic\PCHA\RegHookSpecialist.pxt
() C:\Program Files (x86)\ParetoLogic\PCHA\Utility.pxt
() C:\Program Files (x86)\ParetoLogic\PCHA\LiteUnzip.dll
(ParetoLogic) C:\Program Files (x86)\ParetoLogic\PCHA\PCHA.exe
(Digital Care Solutions) C:\Program Files\BDServices\BitDefenderCOM.exe
R2 BitDefenderCOM; C:\Program Files\BDServices\BitDefenderCom.exe [1028096 2016-12-12] (Digital Care Solutions) [File not signed]
S3 scan; C:\Program Files\BDServices\scan.dll [627688 2016-12-12] (Bitdefender)
R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [485512 2016-12-12] (BitDefender S.R.L.)
C:\Users\{Nom_Utilisateur}\AppData\Roaming\ParetoLogic
C:\Windows\System32\Tasks\PC Health Advisor Startup
C:\Program Files\BDServices
C:\Windows\System32\Tasks\PC Health Advisor Update
C:\Windows\System32\Tasks\PC Health Advisor
C:\Windows\System32\Tasks\PC Health Advisor Defrag
C:\Users\{Nom_Utilisateur}\Desktop\ParetoLogic PC Health Advisor.lnk
C:\Windows\Tasks\PC Health Advisor Update.job
C:\Windows\Tasks\PC Health Advisor Startup.job
C:\Windows\Tasks\PC Health Advisor Defrag.job
C:\Windows\Tasks\PC Health Advisor.job
C:\Users\{Nom_Utilisateur}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic
C:\ProgramData\ParetoLogic
C:\Program Files (x86)\ParetoLogic
**********
Détecté et traité par Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable)
PUP.Optional.ParetoLogic
Tutoriel d'utilisation Malwarebytes en images (https://forum.security-x.fr/tutoriels-317/tutoriel-malwarebytes-anti-malware-22723/)
Source : Removal instructions for PC Health Advisor de Metallica - Malwarebytes Forums (https://forums.malwarebytes.com/topic/197798-removal-instructions-for-pc-health-advisor/)
Toujours infecté ? Une question avant de faire des manipulations ?
Venez poster un nouveau sujet dans ce forum : http://forum.security-x.fr/desinfections/ en prenant soin de suivre la procédure http://forum.security-x.fr/desinfections/procedure-preliminaire/