Voila mon lien pjjoint

Salut,

Un minimum d'explications sur les prb rencontrés auraient été le bienvenue.

Relance OTL.
o sous Persfonnalisation (Custom Scan), copie_colle le contenu du cadre ci dessous (bien prendre :OTL en début).
Clic Correction (Fix), un rapport apparraitra, copie/colle le contenu ici:

:OTL
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: URL = http://www.delta-search.com/?q={searchTerms}&affID=119776&babsrc=SP_ss&mntrId=044f4d5900000000000074f06d8c67ac
O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll (Yontoo LLC)
O4 - HKLM..\Run: [Java Update] C:\Program Files\Java\divx.exe ()
CHR - Extension: Facebook Notifications = C:\Users\PIERRE-BONNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmameahlembdcigphohgiodcgjomcgeo\1.27_0\
[2013/02/20 22:16:35 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\searchplugins
[2013/02/20 22:16:27 | 000,000,000 | ---D | C] -- C:\ProgramData\BrowserProtect
[2013/02/20 22:15:46 | 000,000,000 | ---D | C] -- C:\Users\PIERRE-BONNET\AppData\Local\PutLockerDownloader
[2013/02/20 22:15:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Yontoo
[2012/06/12 16:11:08 | 000,000,000 | ---D | M] -- C:\Users\PIERRE-BONNET\AppData\Roaming\OfferBox
[2012/05/30 23:03:21 | 000,000,000 | ---D | M] -- C:\Users\PIERRE-BONNET\AppData\Roaming\Babylon

* redemarre le pc sous windows et poste le rapport ici

Like the angel you are, you laugh creating a lightness in my chest,
Your eyes they penetrate me,
(Your answer's always 'maybe')
That's when I got up and left

divx.exe se lance encore ?

Reparamètre ton navigateur WEB :
* Firefox : Menu Outils / Modules Complémentaires et Extension - voir https://www.malekal.com/reparer-firefox/?t=36057&start=
* Google Chrome : https://www.malekal.com/reparer-google-chrome/?t=35837&start=

Si c'est sur Google Chrome et que c'est au lancement, faut enlever Delta Search du groupe des pages.

Enfaite, je croyais répondre à un autre sujet, du coup, mon message avait plus de sens.
Pour résumé, j'avais comme page de démarrage : Deltasearch et je n'arrivais pas à m'en défaire, j'ai donc suivi les indications d'un autre post qui m'a dit d'envoyer le ppjoint.

Bref : Voila le rapport :

Merci de ta réponse rapide !

========== OTL ==========
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}\ deleted successfully.
C:\Program Files (x86)\Yontoo\YontooIEClient.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Java Update deleted successfully.
C:\Program Files\Java\divx.exe moved successfully.
C:\Users\PIERRE-BONNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmameahlembdcigphohgiodcgjomcgeo\1.27_0\js folder moved successfully.
C:\Users\PIERRE-BONNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmameahlembdcigphohgiodcgjomcgeo\1.27_0\images folder moved successfully.
C:\Users\PIERRE-BONNET\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmameahlembdcigphohgiodcgjomcgeo\1.27_0 folder moved successfully.
C:\Windows\SysWow64\searchplugins folder moved successfully.
Folder C:\ProgramData\BrowserProtect\ not found.
C:\Users\PIERRE-BONNET\AppData\Local\PutLockerDownloader\PutLockerDownloader.exe_Url_eqfd3rngnw5yi1uyk5oaguinay1rtfqv\1.0.0.1 folder moved successfully.
C:\Users\PIERRE-BONNET\AppData\Local\PutLockerDownloader\PutLockerDownloader.exe_Url_eqfd3rngnw5yi1uyk5oaguinay1rtfqv folder moved successfully.
C:\Users\PIERRE-BONNET\AppData\Local\PutLockerDownloader folder moved successfully.
C:\Program Files (x86)\Yontoo folder moved successfully.
C:\Users\PIERRE-BONNET\AppData\Roaming\OfferBox\http_app.offerbox.com\sdch folder moved successfully.
C:\Users\PIERRE-BONNET\AppData\Roaming\OfferBox\http_app.offerbox.com folder moved successfully.

Ok, j'ai pu DeltaSearch en démarrage. Ensuite, effectivmeent, divx.exe ne s'est pas lancé au démarrage, donc il semblerait que ce soit réglé. Cependant que faire de tout les fichiers dans C:\OTL\moveit etc... ?

Puis considérer avoir effacé le virus ou malware présent ?

halala encore un bitcoin.

"%systemdrive%\Program Files\Java\svchost.exe" -u http://keitostin@gmail.com_100:100@pit.deepbit.net:8332 -k poclbm DEVICE=0

Tu devrais changer d'antivirus

MSE c'est un peu pourri...

Ton malware : https://www.virustotal.com/gui/file/8d41b10ffbbcfc7fbb4965501eb7e18fb528252fee4b6fa6fdf9b3188555cc8f

SHA256: 8d41b10ffbbcfc7fbb4965501eb7e18fb528252fee4b6fa6fdf9b3188555cc8f
Nom du fichier : avz00001.dta
Ratio de détection : 27 / 46
Date d'analyse : 2012-12-07 20:23:32 UTC (il y a 2 mois, 2 semaines)

Agnitum Packed/MPress 20121207
AhnLab-V3 Trojan/Win32.Gen 20121207
AntiVir TR/Zusy.983.120 20121207
Antiy-AVL Trojan/win32.agent.gen 20121204
Avast Win32:Malware-gen 20121207
AVG - 20121207
BitDefender - 20121207
ByteHero - 20121130
CAT-QuickHeal - 20121207
ClamAV - 20121207
Commtouch - 20121207
Comodo Heur.Packed.Unknown 20121207
DrWeb Trojan.KillProc.19473 20121207
Emsisoft - 20121207
eSafe Win32.GenVariant.Zus 20121205
ESET-NOD32 BAT/CoinMiner.G 20121207
F-Prot - 20121207
F-Secure - 20121207
Fortinet W32/Dx.B2M4!tr 20121207
GData Win32:Malware-gen 20121207
Ikarus Trojan-Dropper.Win32.Mudrop 20121207
Jiangmin TrojanDropper.Mudrop.ddz 20121207
K7AntiVirus Riskware 20121207
Kaspersky - 20121207
Kingsoft Win32.Troj.DeepScan.a.(kcloud) 20121206
Malwarebytes Trojan.Dropper.SFX 20121207
McAfee Generic.dx!b2m4 20121207
McAfee-GW-Edition Heuristic.BehavesLike.Win32.Suspicious-PKR.K 20121207
Microsoft - 20121207
MicroWorld-eScan - 20121207
NANO-Antivirus Trojan.Win32.Siggen3.tvyve 20121207
Norman W32/Suspicious_Gen5.EAHD 20121207
nProtect - 20121207
Panda Generic Malware 20121207
PCTools - 20121207
Rising - 20121207
Sophos Mal/Generic-L 20121207
SUPERAntiSpyware - 20121207
Symantec Trojan.Gen 20121207
TheHacker - 20121207
TotalDefense - 20121207
TrendMicro TROJ_SPNR.30HL12 20121207
TrendMicro-HouseCall TROJ_SPNR.30HL12 20121207
VBA32 Trojan.Skillis.mkj 20121207
VIPRE Trojan.Win32.Generic!BT 20121207

Like the angel you are, you laugh creating a lightness in my chest,
Your eyes they penetrate me,
(Your answer's always 'maybe')
That's when I got up and left